Skip to content

[minigraph parser]: Allow to bind ACL table to LAGs and VLANs. #1040

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
oleksandrivantsiv wants to merge 1 commit into from
Closed

[minigraph parser]: Allow to bind ACL table to LAGs and VLANs. #1040

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 24 additions & 8 deletions src/sonic-config-engine/minigraph.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,16 +185,32 @@ def parse_dpg(dpg, hname):
is_mirror = False
for member in aclattach:
member = member.strip()
if pcs.has_key(member):
acl_intfs.extend(pcs[member]['members']) # For ACL attaching to port channels, we break them into port channel members
elif vlans.has_key(member):
print >> sys.stderr, "Warning: ACL " + aclname + " is attached to a Vlan interface, which is currently not supported"
elif port_alias_map.has_key(member):
acl_intfs.append(port_alias_map[member])
if port_alias_map.has_key(member):
allowed = True
for pc, pc_data in pcs.iteritems():
if port_alias_map[member] in pc_data['members']:
print >> sys.stderr, member + " interface is attached to port channel. ACL table bind to port channel members is not allowed."
allowed = False
if allowed:
acl_intfs.append(port_alias_map[member])
elif pcs.has_key(member) or vlans.has_key(member):
acl_intfs.append(member)
elif member.lower() == 'erspan':
is_mirror = True;
# Erspan session will be attached to all front panel ports
acl_intfs = port_alias_map.values()
# Erspan session should not be attached to port channel or VLAN members
deny_list = []
for pc_data in pcs.values():
deny_list += pc_data['members']

print vlan_members
for member in vlan_members.keys():
deny_list.append(member.split(KEY_SEPARATOR)[1])

print deny_list

acl_intfs = [p for p in port_alias_map.values() if p not in deny_list]
acl_intfs += pcs.keys()
acl_intfs += vlans.keys()
Copy link
Collaborator

@lguohan lguohan Dec 5, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

acl_intfs += vlans.keys() [](start = 20, length = 25)

for erspan rules, I think we should still allow the acl to be bind to the member ports.

The thing I agree is that when a port belongs to a lag, we can only bind the acl to the lag instead of the port. But this should not be extended to vlan and vlan member.

break;
if acl_intfs:
acls[aclname] = { 'policy_desc': aclname, 'ports': acl_intfs, 'type': 'MIRROR' if is_mirror else 'L3'}
Expand Down
2 changes: 1 addition & 1 deletion src/sonic-config-engine/tests/test_cfggen.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ def test_render_template(self):
def test_minigraph_acl(self):
argument = '-m "' + self.sample_graph_t0 + '" -p "' + self.port_config + '" -v ACL_TABLE'
output = self.run_script(argument)
self.assertEqual(output.strip(), "{'DATAACL': {'type': 'L3', 'policy_desc': 'DATAACL', 'ports': ['Ethernet112', 'Ethernet116', 'Ethernet120', 'Ethernet124']}}")
self.assertEqual(output.strip(), "{'DATAACL': {'type': 'L3', 'policy_desc': 'DATAACL', 'ports': ['PortChannel01', 'PortChannel02', 'PortChannel03', 'PortChannel04']}}")

def test_minigraph_everflow(self):
argument = '-m "' + self.sample_graph_t0 + '" -p "' + self.port_config + '" -v MIRROR_SESSION'
Expand Down