Skip to content

Commit

Permalink
[Dual-ToR] handle 'mux_tunnel_egress_acl' attrib in order to change A…
Browse files Browse the repository at this point in the history
…CL configuration (drop on ingress/egress) on standby ToR (sonic-net#2646)

- What I did
Use "mux_tunnel_ingress_acl" to set ACL rules on ingress/egress side depending on attribute value ("disabled/enabled").

- Why I did it
We need to drop data-plane traffic and handle Control-plane traffic in the Dual-ToR scenario.
But we can't do it on Mellanox platform and process traffic on ingress.
To workaround it we can set ACL rules on egress ports, so will process control plane on ingress and drop Data-plane traffic that came from standby port on egress

- How I verified it
check "show mux status" on standby ToR - Mux status should be healthy.
check "show what-just-happened" on standby ToR - no ICMP drop expected on standby ports.

Signed-off-by: Andriy Yurkiv <[email protected]>
  • Loading branch information
ayurkiv-nvda authored Mar 1, 2023
1 parent c2b01ba commit 79afcb3
Show file tree
Hide file tree
Showing 4 changed files with 12 additions and 3 deletions.
1 change: 1 addition & 0 deletions orchagent/aclorch.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -3188,6 +3188,7 @@ void AclOrch::initDefaultTableTypes()
builder.withName(TABLE_TYPE_DROP)
.withBindPointType(SAI_ACL_BIND_POINT_TYPE_PORT)
.withMatch(make_shared<AclTableMatch>(SAI_ACL_TABLE_ATTR_FIELD_TC))
.withMatch(make_shared<AclTableMatch>(SAI_ACL_TABLE_ATTR_FIELD_IN_PORTS))
.build()
);

Expand Down
1 change: 1 addition & 0 deletions orchagent/aclorch.h
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,7 @@

#define MLNX_MAX_RANGES_COUNT 16
#define INGRESS_TABLE_DROP "IngressTableDrop"
#define EGRESS_TABLE_DROP "EgressTableDrop"
#define RULE_OPER_ADD 0
#define RULE_OPER_DELETE 1

Expand Down
12 changes: 9 additions & 3 deletions orchagent/muxorch.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -791,8 +791,14 @@ MuxAclHandler::MuxAclHandler(sai_object_id_t port, string alias)
{
SWSS_LOG_ENTER();

string value;
shared_ptr<DBConnector> m_config_db = shared_ptr<DBConnector>(new DBConnector("CONFIG_DB", 0));
unique_ptr<Table> m_systemDefaultsTable = unique_ptr<Table>(new Table(m_config_db.get(), "SYSTEM_DEFAULTS"));
m_systemDefaultsTable->hget("mux_tunnel_egress_acl", "status", value);
is_ingress_acl_ = value != "enabled";

// There is one handler instance per MUX port
string table_name = MUX_ACL_TABLE_NAME;
string table_name = is_ingress_acl_ ? MUX_ACL_TABLE_NAME : EGRESS_TABLE_DROP;
string rule_name = MUX_ACL_RULE_NAME;

port_ = port;
Expand Down Expand Up @@ -830,7 +836,7 @@ MuxAclHandler::MuxAclHandler(sai_object_id_t port, string alias)
MuxAclHandler::~MuxAclHandler(void)
{
SWSS_LOG_ENTER();
string table_name = MUX_ACL_TABLE_NAME;
string table_name = is_ingress_acl_ ? MUX_ACL_TABLE_NAME : EGRESS_TABLE_DROP;
string rule_name = MUX_ACL_RULE_NAME;

SWSS_LOG_NOTICE("Un-Binding port %" PRIx64 "", port_);
Expand Down Expand Up @@ -876,7 +882,7 @@ void MuxAclHandler::createMuxAclTable(sai_object_id_t port, string strTable)
auto dropType = gAclOrch->getAclTableType(TABLE_TYPE_DROP);
assert(dropType);
acl_table.validateAddType(*dropType);
acl_table.stage = ACL_STAGE_INGRESS;
acl_table.stage = is_ingress_acl_ ? ACL_STAGE_INGRESS : ACL_STAGE_EGRESS;
gAclOrch->addAclTable(acl_table);
bindAllPorts(acl_table);
}
Expand Down
1 change: 1 addition & 0 deletions orchagent/muxorch.h
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ class MuxAclHandler
// class shared dict: ACL table name -> ACL table
static std::map<std::string, AclTable> acl_table_;
sai_object_id_t port_ = SAI_NULL_OBJECT_ID;
bool is_ingress_acl_ = true;
string alias_;
};

Expand Down

0 comments on commit 79afcb3

Please sign in to comment.