[vpp][acl] add vpp acl IN_PORT support HLD - #2506
Open
lolyu wants to merge 3 commits into
Open
Conversation
Signed-off-by: Longxiang Lyu <lolv@microsoft.com>
Collaborator
|
/azp run |
|
No pipelines are associated with this pull request. |
There was a problem hiding this comment.
Pull request overview
Adds an HLD for enforcing per-entry VPP ACL ingress-port scoping.
Changes:
- Defines port-signature ACL partitioning and rebinding.
- Specifies failure handling, counters, and scaling.
- Documents proposed implementation and testing.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Placeholder default ACL is not literally unmatchable: it holds a deny of destination 0.0.0.0/32, and the reason it must deny rather than permit is now stated. - Failure handling: a port whose unbind failed keeps its old assignment, so the retry unbinds what VPP actually holds instead of stranding the stale ACL bound and undeletable. - Counters: REQ-7 holds in the steady state only; a partial failure under-reports until the next successful reprogram. - Scaling is driven by distinct signatures, not distinct IN_PORTS sets, and the default ACL is always additional. - Testing: add REQ-4 and REQ-7 cases; describe the GCU drop-removal test as partial coverage of REQ-4, which is what it is. Signed-off-by: Longxiang Lyu <lolv@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Collaborator
|
/azp run |
|
No pipelines are associated with this pull request. |
A port whose unbind failed keeps its old swindex, but only a scoped ACL is carried under the empty signature. The default ACL is owned by m_acl_swindex_map for the table's lifetime; tracking it as scoped would expose it to the reap and leave that map holding a swindex VPP had released. Signed-off-by: Longxiang Lyu <lolv@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Collaborator
|
/azp run |
|
No pipelines are associated with this pull request. |
|
|
||
| SONiC ACL entries may be scoped to a subset of ingress ports via the SAI qualifier `SAI_ACL_ENTRY_ATTR_FIELD_IN_PORTS`. The ACL table is bound to a broad set of ports, and each entry may narrow itself to specific ingress ports. | ||
|
|
||
| The VPP-based virtual switch (`saivpp`) does not honour this qualifier. Creating or updating an ACL entry's `IN_PORTS` is accepted and **reported as successful**, but the port scope is discarded and the entry is programmed as if the qualifier were absent. |
Contributor
There was a problem hiding this comment.
with the proposed approach, what if IN_PORTS is used in egress ACL?
|
|
||
| --- | ||
|
|
||
| ## Design |
Contributor
There was a problem hiding this comment.
I feel a much simpler design is extend vpp acl with match on in_port. With sonic-ext plugin, we already store the original ingress interface. so matching should be very simple. The only thing is the patch cannot be upstreamed due to the dependency on sonic-ext
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add VPP ACL
IN_PORTsupport.Signed-off-by: Longxiang Lyu lolv@microsoft.com