Added support for "UNDERLAY_SET_DSCP" and "UNDERLAY_SET_DSCPV6" tables by siqbal1986 · Pull Request #3307 · sonic-net/sonic-swss

siqbal1986 · 2024-09-29T22:25:43Z

What I did
This PR adds the logical table UNDERLAY_SET_DSCP and UNDERLAY_SET_DSCPV6.
This feature allows SONIC to match an ingress L4 packet and change the DSCP field of the outer header when the packet is egressing.
These tables are only created on Cisco-8000, Mlnx and VS platforms.
The PR also adds support to check if the platform supports the following SAI attributes.
SAI_SWITCH_ATTR_ACL_USER_META_DATA_RANGE
SAI_ACL_ENTRY_ATTR_ACTION_SET_ACL_META_DATA
SAI_ACL_ENTRY_ATTR_FIELD_ACL_USER_META
Verified on Mlnx 2700

Why I did it
The match set for these tables are following. The action for both of these tables is SET_DSCP
UNDERLAY_SET_DSCP

SRC_IP
DST_IP
IP_PROTOCOL
L4_SRC_PORT
L4_DST_PORT
TCP_FLAGS
DSCP

UNDERLAY_SET_DSCPV6

SRC_IPV6
DST_IPV6
IPV6_NEXT_HEADER
L4_SRC_PORT
L4_DST_PORT
DSCP
Note: These tables are not created but only their names are used.

Since we require matching based on L4 parameters, all the mentioned match attributes are necessary. Merging these into a single table would result in a larger TCAM footprint which may be impact existing ACL usage scenarios.

These table names translate into MARK_META and MARK_METAV6 and EGR_SET_DSCP tables.
The translation is such that an attempt to create UNDERLAY_SET_DSCP or UNDERLAY_SET_DSCPV6 results into creation of
MARK_META & EGR_SET_DSCP or MARK_METAV6 & EGR_SET_DSCP .
The EGR_SET_DSCP table is shared and created only once. if both UNDERLAY_SET_DSCP and UNDERLAY_SET_DSCPV6 are created then only one instance of EGR_SET_DSCP is created to save tcam resource. The EGR_SET_DSCP is created in the Egress stage.

These internal MARK_META/V6 and EGR_SET_DSCP tables use SAI_ACL_ENTRY_ATTR_ACTION_SET_ACL_META_DATA and SAI_ACL_ENTRY_ATTR_FIELD_ACL_USER_META to set and match the metaData field.
For Example:
if the intent is to match an ingressing packet with fields
"DST_IP": "20.0.0.1/32",
"SRC_IP": "10.0.0.0/32",
"DSCP": "1"
"SRC_PORT" : "10"
"DST_PORT" : "20"
and set its outer DSCP to 12 after encapsulation,
This would be done so by MARK_META entry in ingress tcam matching based on above mentioned critera and setting a metaData value e.g. "1"
Another EGR_SET_DSCP entry in egress stage would be created with match criteria of metaData=1 and action of SET_DSCP=12.

Each entry in the EGR_SET_DSCP table is refcounted and shared among all the rules interested in same DSCP value.
There are 7 metadata values available [1...7]. This is currently hardcoded but this can be enhanced based on capibility check.

A Metadata Manager class governs the allcoation and freeing of each metadata value and they are shared based on DSCP value.
How I verified it
Added 16 Tests in sonic-mgmt. All passing.

Manual Test:
Tests added for the tables and Metadata Manager. 9 Test cases have been added which verfiy the table creation, deletion, EGR_SET_DSCP referencing, Entry creation/deletion, metadata value allcation/ release and exhausion scenarios.

Details if related
tested on mlnx 2700 with following rule
{ "ACL_RULE": {
"OVERLAY_MARK_META_TEST|RULE0": {
"PRIORITY": "999",
"DSCP_ACTION": "40",
"SRC_IP": "1.1.1.1/32"
},
"OVERLAY_MARK_META_TEST|RULE1": {
"PRIORITY": "998",
"DSCP_ACTION": "42",
"SRC_IP": "2.2.2.2/32"
}
} and a vxlan tunnel

reviewed HLD.sonic-net/SONiC#1743

SAI_SWITCH_ATTR_ACL_USER_META_DATA_RANGE SAI_ACL_ENTRY_ATTR_ACTION_SET_ACL_META_DATA SAI_ACL_ENTRY_ATTR_FIELD_ACL_USER_META

orchagent/aclorch.cpp

bingwang-ms · 2024-11-01T21:46:36Z

Creating the egress table implicitly when creating the ingress table still looks tricky to me. That also makes code logic more complicated. I still suggest separating them.

prsunny · 2024-11-07T00:22:03Z

Can you link the HLD to PR?

orchagent/aclorch.cpp

…in AddAclRule and removeAclRule

kperumalbfn · 2024-11-12T21:43:21Z

orchagent/aclorch.cpp

+            matchData.data.u32 = to_uint<uint32_t>(attr_value);
+            matchData.mask.u32 = 0xFFFFFFFF;
+
+            if (matchData.data.u16 < m_pAclOrch->getAclMetaDataMin() || matchData.data.u16 > m_pAclOrch->getAclMetaDataMax())


kperumalbfn · 2024-11-12T21:48:18Z

orchagent/aclorch.cpp

+                    m_switchMetaDataCapabilities[TABLE_ACL_USER_META_DATA_MAX] = std::to_string(attrs[0].value.u32range.max);
+                    metadataMin = uint16_t(attrs[0].value.u32range.min);
+                    metadataMax = uint16_t(attrs[0].value.u32range.max);
+                }


Do we need typecast here?

the metadata values supproted by platforms are 1-7 , and 1-4095 bit. I dont think any platform would support a 32 bit for this field or any tcam would have 4 billion enties.

i have changed this code to restrict the range to 0-4095

kperumalbfn · 2024-11-12T21:53:58Z

orchagent/aclorch.cpp

+        m_switchMetaDataCapabilities[TABLE_ACL_ENTRY_ATTR_META_CAPABLE] = "false";
+        m_switchMetaDataCapabilities[TABLE_ACL_ENTRY_ACTION_META_CAPABLE] = "false";
+
+        status = sai_query_attribute_capability(gSwitchId, SAI_OBJECT_TYPE_SWITCH, SAI_SWITCH_ATTR_ACL_USER_META_DATA_RANGE, &capability);


SImilar to validating USER_META_DATA capability, do we need to check ACL action set_dscp capability?

that is already present on all platforms as we have tables using this capability.

kperumalbfn · 2024-11-12T21:56:07Z

orchagent/aclorch.cpp

-			    bAllAttributesOk = false;
-		    }
-	    }
+	        {


pls check indentation here

kperumalbfn · 2024-11-12T21:57:49Z

orchagent/aclorch.h

+    uint16_t metaMin = 0;
+    uint16_t metaMax = 0;
+    list<uint16_t> m_freeMetadata;
+    map<uint8_t, uint16_t> m_dscpMetadata;


pls check for uint32 for all references to metadata.

i have limited the metadata to be between 0-4095. beyond this range, i double we ll have a platform which would allow 4k acl entries in a group.

siqbal1986 · 2024-11-16T18:42:35Z

/azp run

azure-pipelines · 2024-11-16T18:42:41Z

Commenter does not have sufficient privileges for PR 3307 in repo sonic-net/sonic-swss

siqbal1986 · 2024-11-16T18:43:07Z

/azpw run

mssonicbld · 2024-11-16T18:43:09Z

/AzurePipelines run

azure-pipelines · 2024-11-16T18:43:19Z

Azure Pipelines successfully started running 1 pipeline(s).

bingwang-ms

LGTM now.

kperumalbfn

LGTM

sonic-net#3307) What I did This PR adds the logical table UNDERLAY_SET_DSCP and UNDERLAY_SET_DSCPV6. This feature allows SONIC to match an ingress L4 packet and change the DSCP field of the outer header when the packet is egressing. These tables are only created on Cisco-8000, Mlnx and VS platforms. The PR also adds support to check if the platform supports the following SAI attributes. SAI_SWITCH_ATTR_ACL_USER_META_DATA_RANGE SAI_ACL_ENTRY_ATTR_ACTION_SET_ACL_META_DATA SAI_ACL_ENTRY_ATTR_FIELD_ACL_USER_META

sonic-net#3307) What I did This PR adds the logical table UNDERLAY_SET_DSCP and UNDERLAY_SET_DSCPV6. This feature allows SONIC to match an ingress L4 packet and change the DSCP field of the outer header when the packet is egressing. These tables are only created on Cisco-8000, Mlnx and VS platforms. The PR also adds support to check if the platform supports the following SAI attributes. SAI_SWITCH_ATTR_ACL_USER_META_DATA_RANGE SAI_ACL_ENTRY_ATTR_ACTION_SET_ACL_META_DATA SAI_ACL_ENTRY_ATTR_FIELD_ACL_USER_META Signed-off-by: Baorong Liu <[email protected]>

siqbal1986 and others added 3 commits September 2, 2024 00:44

added support to check the SAI switch capibility of

0883766

SAI_SWITCH_ATTR_ACL_USER_META_DATA_RANGE SAI_ACL_ENTRY_ATTR_ACTION_SET_ACL_META_DATA SAI_ACL_ENTRY_ATTR_FIELD_ACL_USER_META

ACL DSCP change table implemntation 1

7f2eed3

Merge branch 'sonic-net:master' into dscp_acl_2

d478ef9

siqbal1986 requested a review from prsunny as a code owner September 29, 2024 22:25

siqbal1986 mentioned this pull request Sep 29, 2024

Tests for ACL DSCP change table. sonic-net/sonic-mgmt#14791

Closed

8 tasks

siqbal1986 requested review from bingwang-ms and kperumalbfn September 29, 2024 22:28

siqbal1986 mentioned this pull request Oct 23, 2024

support to check SAI capability of ACL META_DATA fields #3274

Closed

Merge branch 'master' into dscp_acl_2

6d7783d