Skip to content

Commit f889f80

Browse files
author
Shuotian Cheng
authored
[aclorch]: Add ICMP type/code match for v4/v6 (sonic-net#868)
Support the following matches: SAI_ACL_TABLE_ATTR_FIELD_ICMP_TYPE SAI_ACL_TABLE_ATTR_FIELD_ICMP_CODE SAI_ACL_TABLE_ATTR_FIELD_ICMPV6_TYPE SAI_ACL_TABLE_ATTR_FIELD_ICMPV6_CODE Signed-off-by: Shu0T1an ChenG <shuche@microsoft.com>
1 parent a62aa83 commit f889f80

3 files changed

Lines changed: 246 additions & 49 deletions

File tree

‎orchagent/aclorch.cpp‎

Lines changed: 102 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,10 @@ acl_rule_attr_lookup_t aclMatchLookup =
4646
{ MATCH_IP_TYPE, SAI_ACL_ENTRY_ATTR_FIELD_ACL_IP_TYPE },
4747
{ MATCH_DSCP, SAI_ACL_ENTRY_ATTR_FIELD_DSCP },
4848
{ MATCH_TC, SAI_ACL_ENTRY_ATTR_FIELD_TC },
49+
{ MATCH_ICMP_TYPE, SAI_ACL_ENTRY_ATTR_FIELD_ICMP_TYPE },
50+
{ MATCH_ICMP_CODE, SAI_ACL_ENTRY_ATTR_FIELD_ICMP_CODE },
51+
{ MATCH_ICMPV6_TYPE, SAI_ACL_ENTRY_ATTR_FIELD_ICMPV6_TYPE },
52+
{ MATCH_ICMPV6_CODE, SAI_ACL_ENTRY_ATTR_FIELD_ICMPV6_CODE },
4953
{ MATCH_L4_SRC_PORT_RANGE, (sai_acl_entry_attr_t)SAI_ACL_RANGE_TYPE_L4_SRC_PORT_RANGE },
5054
{ MATCH_L4_DST_PORT_RANGE, (sai_acl_entry_attr_t)SAI_ACL_RANGE_TYPE_L4_DST_PORT_RANGE },
5155
{ MATCH_TUNNEL_VNI, SAI_ACL_ENTRY_ATTR_FIELD_TUNNEL_VNI },
@@ -334,6 +338,12 @@ bool AclRule::validateAddMatch(string attr_name, string attr_value)
334338
value.aclfield.data.u8 = to_uint<uint8_t>(attr_value);
335339
value.aclfield.mask.u8 = 0xFF;
336340
}
341+
else if (attr_name == MATCH_ICMP_TYPE || attr_name == MATCH_ICMP_CODE ||
342+
attr_name == MATCH_ICMPV6_TYPE || attr_name == MATCH_ICMPV6_CODE)
343+
{
344+
value.aclfield.data.u8 = to_uint<uint8_t>(attr_value);
345+
value.aclfield.mask.u8 = 0xFF;
346+
}
337347
else if (attr_name == MATCH_TUNNEL_VNI)
338348
{
339349
value.aclfield.data.u32 = to_uint<uint32_t>(attr_value);
@@ -850,12 +860,19 @@ bool AclRuleL3::validateAddMatch(string attr_name, string attr_value)
850860
{
851861
if (attr_name == MATCH_DSCP)
852862
{
853-
SWSS_LOG_ERROR("DSCP match is not supported for the tables of type L3");
863+
SWSS_LOG_ERROR("DSCP match is not supported for table type L3");
854864
return false;
855865
}
866+
856867
if (attr_name == MATCH_SRC_IPV6 || attr_name == MATCH_DST_IPV6)
857868
{
858-
SWSS_LOG_ERROR("IPv6 address match is not supported for the tables of type L3");
869+
SWSS_LOG_ERROR("IPv6 address match is not supported for table type L3");
870+
return false;
871+
}
872+
873+
if (attr_name == MATCH_ICMPV6_TYPE || attr_name == MATCH_ICMPV6_CODE)
874+
{
875+
SWSS_LOG_ERROR("ICMPv6 match is not supported for table type L3");
859876
return false;
860877
}
861878

@@ -906,12 +923,19 @@ bool AclRuleL3V6::validateAddMatch(string attr_name, string attr_value)
906923
{
907924
if (attr_name == MATCH_DSCP)
908925
{
909-
SWSS_LOG_ERROR("DSCP match is not supported for the tables of type L3V6");
926+
SWSS_LOG_ERROR("DSCP match is not supported for table type L3V6");
910927
return false;
911928
}
929+
912930
if (attr_name == MATCH_SRC_IP || attr_name == MATCH_DST_IP)
913931
{
914-
SWSS_LOG_ERROR("IPv4 address match is not supported for the tables of type L3V6");
932+
SWSS_LOG_ERROR("IPv4 address match is not supported for table type L3V6");
933+
return false;
934+
}
935+
936+
if (attr_name == MATCH_ICMP_TYPE || attr_name == MATCH_ICMP_CODE)
937+
{
938+
SWSS_LOG_ERROR("ICMPv4 match is not supported for table type L3V6");
915939
return false;
916940
}
917941

@@ -956,31 +980,40 @@ bool AclRuleMirror::validateAddMatch(string attr_name, string attr_value)
956980

957981
/*
958982
* Type of Tables and Supported Match Types (Configuration)
959-
* |--------------------------------------------------|
960-
* | Match Type | TABLE_MIRROR | TABLE_MIRRORV6 |
961-
* |--------------------------------------------------|
962-
* | MATCH_SRC_IP | √ | |
963-
* | MATCH_DST_IP | √ | |
964-
* |--------------------------------------------------|
965-
* | MATCH_SRC_IPV6 | | √ |
966-
* | MATCH_DST_IPV6 | | √ |
967-
* |--------------------------------------------------|
968-
* | MARTCH_ETHERTYPE | √ | |
969-
* |--------------------------------------------------|
983+
* |---------------------------------------------------|
984+
* | Match Type | TABLE_MIRROR | TABLE_MIRRORV6 |
985+
* |---------------------------------------------------|
986+
* | MATCH_SRC_IP | √ | |
987+
* | MATCH_DST_IP | √ | |
988+
* |---------------------------------------------------|
989+
* | MATCH_ICMP_TYPE | √ | |
990+
* | MATCH_ICMP_CODE | √ | |
991+
* |---------------------------------------------------|
992+
* | MATCH_ICMPV6_TYPE | | √ |
993+
* | MATCH_ICMPV6_CODE | | √ |
994+
* |---------------------------------------------------|
995+
* | MATCH_SRC_IPV6 | | √ |
996+
* | MATCH_DST_IPV6 | | √ |
997+
* |---------------------------------------------------|
998+
* | MARTCH_ETHERTYPE | √ | |
999+
* |---------------------------------------------------|
9701000
*/
9711001

9721002
if (m_tableType == ACL_TABLE_MIRROR &&
973-
(attr_name == MATCH_SRC_IPV6 || attr_name == MATCH_DST_IPV6))
1003+
(attr_name == MATCH_SRC_IPV6 || attr_name == MATCH_DST_IPV6 ||
1004+
attr_name == MATCH_ICMPV6_TYPE || attr_name == MATCH_ICMPV6_CODE))
9741005
{
9751006
SWSS_LOG_ERROR("%s match is not supported for the table of type MIRROR",
9761007
attr_name.c_str());
9771008
return false;
9781009
}
9791010

9801011
if (m_tableType == ACL_TABLE_MIRRORV6 &&
981-
(attr_name == MATCH_SRC_IP || attr_name == MATCH_DST_IP || attr_name == MATCH_ETHER_TYPE))
1012+
(attr_name == MATCH_SRC_IP || attr_name == MATCH_DST_IP ||
1013+
attr_name == MATCH_ICMP_TYPE || attr_name == MATCH_ICMP_CODE ||
1014+
attr_name == MATCH_ETHER_TYPE))
9821015
{
983-
SWSS_LOG_ERROR("%s match is not supported for the table of type MIRRORV6",
1016+
SWSS_LOG_ERROR("%s match is not supported for the table of type MIRRORv6",
9841017
attr_name.c_str());
9851018
return false;
9861019
}
@@ -1172,19 +1205,25 @@ bool AclTable::create()
11721205

11731206
/*
11741207
* Type of Tables and Supported Match Types (ASIC database)
1175-
* |-----------------------------------------------------------------|
1176-
* | | TABLE_MIRROR | TABLE_MIRROR | TABLE_MIRRORV6 |
1177-
* | Match Type |----------------------------------------------|
1178-
* | | combined | separated |
1179-
* |-----------------------------------------------------------------|
1180-
* | MATCH_SRC_IP | √ | √ | |
1181-
* | MATCH_DST_IP | √ | √ | |
1182-
* |-----------------------------------------------------------------|
1183-
* | MATCH_SRC_IPV6 | √ | | √ |
1184-
* | MATCH_DST_IPV6 | √ | | √ |
1185-
* |-----------------------------------------------------------------|
1186-
* | MARTCH_ETHERTYPE | √ | √ | |
1187-
* |-----------------------------------------------------------------|
1208+
* |------------------------------------------------------------------|
1209+
* | | TABLE_MIRROR | TABLE_MIRROR | TABLE_MIRRORV6 |
1210+
* | Match Type |----------------------------------------------|
1211+
* | | combined | separated |
1212+
* |------------------------------------------------------------------|
1213+
* | MATCH_SRC_IP | √ | √ | |
1214+
* | MATCH_DST_IP | √ | √ | |
1215+
* |------------------------------------------------------------------|
1216+
* | MATCH_ICMP_TYPE | √ | √ | |
1217+
* | MATCH_ICMP_CODE | √ | √ | |
1218+
* |------------------------------------------------------------------|
1219+
* | MATCH_SRC_IPV6 | √ | | √ |
1220+
* | MATCH_DST_IPV6 | √ | | √ |
1221+
* |------------------------------------------------------------------|
1222+
* | MATCH_ICMPV6_TYPE | √ | | √ |
1223+
* | MATCH_ICMPV6_CODE | √ | | √ |
1224+
* |------------------------------------------------------------------|
1225+
* | MARTCH_ETHERTYPE | √ | √ | |
1226+
* |------------------------------------------------------------------|
11881227
*/
11891228

11901229
if (type == ACL_TABLE_MIRROR)
@@ -1197,6 +1236,14 @@ bool AclTable::create()
11971236
attr.value.booldata = true;
11981237
table_attrs.push_back(attr);
11991238

1239+
attr.id = SAI_ACL_TABLE_ATTR_FIELD_ICMP_TYPE;
1240+
attr.value.booldata = true;
1241+
table_attrs.push_back(attr);
1242+
1243+
attr.id = SAI_ACL_TABLE_ATTR_FIELD_ICMP_CODE;
1244+
attr.value.booldata = true;
1245+
table_attrs.push_back(attr);
1246+
12001247
// If the switch supports v6 and requires one single table
12011248
if (m_pAclOrch->m_mirrorTableCapabilities[ACL_TABLE_MIRRORV6] &&
12021249
m_pAclOrch->m_isCombinedMirrorV6Table)
@@ -1208,6 +1255,14 @@ bool AclTable::create()
12081255
attr.id = SAI_ACL_TABLE_ATTR_FIELD_DST_IPV6;
12091256
attr.value.booldata = true;
12101257
table_attrs.push_back(attr);
1258+
1259+
attr.id = SAI_ACL_TABLE_ATTR_FIELD_ICMPV6_TYPE;
1260+
attr.value.booldata = true;
1261+
table_attrs.push_back(attr);
1262+
1263+
attr.id = SAI_ACL_TABLE_ATTR_FIELD_ICMPV6_CODE;
1264+
attr.value.booldata = true;
1265+
table_attrs.push_back(attr);
12111266
}
12121267
}
12131268
else if (type == ACL_TABLE_L3V6 || type == ACL_TABLE_MIRRORV6) // v6 only
@@ -1219,6 +1274,14 @@ bool AclTable::create()
12191274
attr.id = SAI_ACL_TABLE_ATTR_FIELD_DST_IPV6;
12201275
attr.value.booldata = true;
12211276
table_attrs.push_back(attr);
1277+
1278+
attr.id = SAI_ACL_TABLE_ATTR_FIELD_ICMPV6_TYPE;
1279+
attr.value.booldata = true;
1280+
table_attrs.push_back(attr);
1281+
1282+
attr.id = SAI_ACL_TABLE_ATTR_FIELD_ICMPV6_CODE;
1283+
attr.value.booldata = true;
1284+
table_attrs.push_back(attr);
12221285
}
12231286
else // v4 only
12241287
{
@@ -1229,6 +1292,14 @@ bool AclTable::create()
12291292
attr.id = SAI_ACL_TABLE_ATTR_FIELD_DST_IP;
12301293
attr.value.booldata = true;
12311294
table_attrs.push_back(attr);
1295+
1296+
attr.id = SAI_ACL_TABLE_ATTR_FIELD_ICMP_TYPE;
1297+
attr.value.booldata = true;
1298+
table_attrs.push_back(attr);
1299+
1300+
attr.id = SAI_ACL_TABLE_ATTR_FIELD_ICMP_CODE;
1301+
attr.value.booldata = true;
1302+
table_attrs.push_back(attr);
12321303
}
12331304

12341305
attr.id = SAI_ACL_TABLE_ATTR_FIELD_L4_SRC_PORT;

‎orchagent/aclorch.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,10 @@
5050
#define MATCH_L4_SRC_PORT_RANGE "L4_SRC_PORT_RANGE"
5151
#define MATCH_L4_DST_PORT_RANGE "L4_DST_PORT_RANGE"
5252
#define MATCH_TC "TC"
53+
#define MATCH_ICMP_TYPE "ICMP_TYPE"
54+
#define MATCH_ICMP_CODE "ICMP_CODE"
55+
#define MATCH_ICMPV6_TYPE "ICMPV6_TYPE"
56+
#define MATCH_ICMPV6_CODE "ICMPV6_CODE"
5357
#define MATCH_TUNNEL_VNI "TUNNEL_VNI"
5458
#define MATCH_INNER_ETHER_TYPE "INNER_ETHER_TYPE"
5559
#define MATCH_INNER_IP_PROTOCOL "INNER_IP_PROTOCOL"

0 commit comments

Comments
 (0)