[aclorch]: add support for acl rule to match out port by shine4chen · Pull Request #810 · sonic-net/sonic-swss

shine4chen · 2019-03-08T10:23:41Z

What I did
ACL rule can match out port. Out port could be port intf , lag or vlan.

Why I did it
mclag need acl rule can bind to LAG and acl rule can match out port.

How I verified it
test it on nephos lab

Details if related

pull from origin

orchagent/aclorch.cpp

lguohan · 2019-04-25T09:17:17Z

orchagent/aclorch.cpp

+                }
+                else if (port.m_type == Port::LAG)
+                {
+                    m_outPorts.push_back(port.m_lag_id); 


does not match SAI spec.

https://github.com/opencomputeproject/SAI/blob/master/inc/saiacl.h#L1260

same as above.

Thinks, we will delete LAG port.

orchagent/aclorch.cpp

* Aclorch can be the consumer of the APP_ACL_TABLE_NAME and APP_ACL_RULE_TABLE_NAME tables in APP_DB * ACL rule can match out port Signed-off-by: shine.chen <shine.chen@nephosinc.com>

Signed-off-by: leo.li <leo.li@nephosinc.com>

leoli-nps · 2019-06-25T11:23:39Z

The corresponding VS test case has been added, please review.

Signed-off-by: shine.chen <shine.chen@nephosinc.com>

stcheng · 2019-07-23T18:59:26Z

could you resolve the conflicts?

Signed-off-by: shine.chen <shine.chen@nephosinc.com>

shine4chen · 2019-07-24T03:26:18Z

@stcheng we have fixed the conflicts.

orchagent/aclorch.cpp

lguohan · 2019-08-01T17:51:01Z

where is the mclag design spec? since out_ports match are not supported in various asic vendor. we need a more generic approach to address this need.

shine4chen · 2019-08-02T02:52:06Z

@lguohan we have discuss it with BRCM folks in sonic-mclag-subgroup. There is a workaround in SAI layer by combination of ingress acl and egress acl. With this workaround most vendors can support out-ports.

The following is the isolation logic description copied from MCLAG-HLD

In ASIC, ACL rule is used to isolate peer link from MC-LAG port. The rule is when the traffic is received from peer link and the output port is MC-LAG member port, the traffic must be dropped. For the chips whose ACL rule can't support out-port, there is a workaround in SAI layer by combination of ingress acl and egress acl. An alternative approach is to use isolation group. Isolation group still have some weakness, First isolation group can't support tunnel-port and orchagent doesn't support it currently. secondly isolation group may not be supported by all ASIC vendors. Using ACL is a more generic way to support the isolation function. We can refine this function to use isolation group later if it’s required.

lguohan · 2019-09-18T00:46:16Z

unless Broadcom SAI as well as other vendor SAI has implemented outPorts, merging this PR will immediately break the image.

lguohan · 2019-09-18T00:50:36Z

isolation group is much more generic and different ASIC can choose different way to implement. Not all ASIC verdors have the same workaround as broadcom. I do not see a reason why we cannot add LAG into isolation group, it is a simple metadata change.

shine4chen · 2019-09-18T03:14:17Z

@lguohan Thanks for the feedback. The following is my answer for your concern.

Mclag feature is not enabled by default. So even for the vendor who doesn't work around acl-outport it wouldn't break the image by default. If vendor like to enable the mclag , of course it need to fix up.
In the existing master branch , saiisolationgroup.h isn't included and orchagent support is missing too. So needless to mention SAI support. Nephos team plans to include mclag feature on 201910 release. As time is limited could community accept this PR now? We can refine the isolation code on our next release.

adyeung · 2019-09-20T22:08:33Z

BRCM will implement an isolation group solution for ingress filtering instead of outPorts, pkts will be dropped at the ingress instead of queueing for egress drop. Design proposal along with other MCLAG improvements will be shared in the upcoming BRCM enhancement HLD.

adyeung

BRCM team has completed the review, we have no further request or comment to add, please proceed to the next steps.

shine4chen · 2019-09-26T01:58:24Z

retest this please

shine4chen · 2019-10-02T11:22:06Z

retest this please

merge azure/sonic-swss to aclorch branch

Signed-off-by: shine.chen <shine.chen@mediatek.com>

shine4chen · 2019-11-17T16:08:18Z

retest this please

shine4chen · 2019-11-29T01:22:43Z

retest this please

shine4chen · 2019-11-29T07:52:10Z

retest this please

shine4chen · 2019-11-30T09:37:59Z

retest this please

ACL rule can match out port. Out port could be port intf , lag or vlan. Signed-off-by: shine.chen <shine.chen@nephosinc.com>

…b-cli/sonic-db-dump (sonic-net#810) * [MultiDB] sonic-utilities - replace redis-cli/redis-dump with sonic-db-cli/sonic-db-dump * only accept upper and underscore to prevent injection * quotation on db_name

ACL rule can match out port. Out port could be port intf , lag or vlan. Signed-off-by: shine.chen <shine.chen@nephosinc.com>

…sonic-net#810) Fix binary serializer can't deserialize protopuf buffer content issue. #### Work item tracking Microsoft ADO (number only): 17753804 #### Why I did it Fix binary serializer can't deserialize protopuf buffer content issue. #### How I did it Fix code but when deserialize binary string. #### How to verify it Add UT. Pass all UT. #### Which release branch to backport (provide reason below if selected)  - [ ] 201811 - [ ] 201911 - [ ] 202006 - [ ] 202012 - [ ] 202106 - [ ] 202111 #### Description for the changelog Fix binary serializer can't deserialize protopuf buffer content issue. #### Link to config_db schema for YANG module changes  #### A picture of a cute animal (not mandatory but encouraged)

Merge pull request #1 from Azure/master

9326978

pull from origin

shine4chen changed the title ~~Acl enhancement~~ [aclorch]: add support for acl rule to match out port Mar 11, 2019

zhenggen-xu reviewed Apr 4, 2019

View reviewed changes

orchagent/aclorch.cpp Outdated Show resolved Hide resolved

lguohan reviewed Apr 25, 2019

View reviewed changes

orchagent/aclorch.cpp Outdated Show resolved Hide resolved

lguohan reviewed Apr 25, 2019

View reviewed changes

orchagent/aclorch.cpp Show resolved Hide resolved

Do some enhancement to ACLorch for mclag

5079d97

* Aclorch can be the consumer of the APP_ACL_TABLE_NAME and APP_ACL_RULE_TABLE_NAME tables in APP_DB * ACL rule can match out port Signed-off-by: shine.chen <shine.chen@nephosinc.com>

shine4chen force-pushed the aclorch branch from e6efbdc to 5079d97 Compare May 5, 2019 10:04

[vstest] add the corresponding vstest for pr#810

a418c6a

Signed-off-by: leo.li <leo.li@nephosinc.com>

change APP_ACL_TABLE_NAME to APP_ACL_TABLE_TABLE_NAME

fa71011

Signed-off-by: shine.chen <shine.chen@nephosinc.com>

merge to master branch and resolve the conflict

2b0305e

Signed-off-by: shine.chen <shine.chen@nephosinc.com>

stcheng reviewed Jul 24, 2019

View reviewed changes

orchagent/aclorch.cpp Outdated Show resolved Hide resolved

lguohan requested a review from rlhui August 1, 2019 17:54

lguohan assigned rlhui Aug 1, 2019

shine4chen mentioned this pull request Aug 30, 2019

MCLAG feature for SONIC sonic-net/sonic-buildimage#2514

Merged

adyeung approved these changes Sep 20, 2019

View reviewed changes

Merge pull request #3 from Azure/master

b7d6d64

merge azure/sonic-swss to aclorch branch

stcheng approved these changes Oct 2, 2019

View reviewed changes

rlhui approved these changes Nov 10, 2019

View reviewed changes

prsunny approved these changes Nov 14, 2019

View reviewed changes

define ACL-table-MCLAG for MCLAG feature

3ed8258

Signed-off-by: shine.chen <shine.chen@mediatek.com>

rlhui requested a review from prsunny November 16, 2019 00:50

prsunny approved these changes Nov 16, 2019

View reviewed changes

lguohan merged commit be867dc into sonic-net:master Jan 29, 2020

lguohan pushed a commit that referenced this pull request Jan 30, 2020

[aclorch]: add support for acl rule to match out port (#810)

c6a8a04

ACL rule can match out port. Out port could be port intf , lag or vlan. Signed-off-by: shine.chen <shine.chen@nephosinc.com>

davidfordouce mentioned this pull request Sep 21, 2020

iccpd service is not running in the image built from latest SONIC mainline code. sonic-net/sonic-buildimage#5310

Open

Conversation

shine4chen commented Mar 8, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lguohan Apr 25, 2019

Choose a reason for hiding this comment

Uh oh!

jianjundong Apr 25, 2019

Choose a reason for hiding this comment

Uh oh!

Uh oh!

leoli-nps commented Jun 25, 2019

Uh oh!

stcheng commented Jul 23, 2019

Uh oh!

shine4chen commented Jul 24, 2019

Uh oh!

Uh oh!

lguohan commented Aug 1, 2019

Uh oh!

shine4chen commented Aug 2, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lguohan commented Sep 18, 2019

Uh oh!

lguohan commented Sep 18, 2019

Uh oh!

shine4chen commented Sep 18, 2019

Uh oh!

adyeung commented Sep 20, 2019

Uh oh!

adyeung left a comment

Choose a reason for hiding this comment

Uh oh!

shine4chen commented Sep 26, 2019

Uh oh!

shine4chen commented Oct 2, 2019

Uh oh!

shine4chen commented Nov 17, 2019

Uh oh!

shine4chen commented Nov 29, 2019

Uh oh!

shine4chen commented Nov 29, 2019

Uh oh!

shine4chen commented Nov 30, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

shine4chen commented Mar 8, 2019 •

edited

Loading

shine4chen commented Aug 2, 2019 •

edited

Loading