[code sync] Merge code from sonic-net/sonic-utilities:202511 to 202603#328
Merged
Conversation
mssonicbld
commented
May 14, 2026
mssonicbld
commented
Collaborator
If we don't include IP_TYPE as a qualifier in the IP_PROTOCOL rules then we might end up matching non-IP packets with matching values in the IP_PROTOCOL offset (10-bytes after ETH header). Fixes: sonic-net/sonic-mgmt#23960 #### What I did In acl-loader include `IP_TYPE=IP` qualifier on any rules that use `IP_PROTOCOL` as a qualifier. #### How I did it Modify the openconfig->db_schema function `convert_ip` to add `IP_TYPE=IP` if the rule being converted has `IP_PROTOCOL` in it. #### How to verify it I configured an ACL with an IP_PROTOCOL qualifying rule and saw that the `IP_TYPE=IP` was added to it (See RULE_7): ``` > acl-loader update full /etc/sonic/acl-erspan.json --table_name EVERFLOW --session_name test_session_1 > show acl rule Table Rule Priority Action Match Status -------- ------- ---------- ------------------------------ ---------------------------- -------- EVERFLOW RULE_1 9999 MIRROR INGRESS: test_session_1 SRC_IP: 20.0.0.10/32 Active EVERFLOW RULE_2 9998 MIRROR INGRESS: test_session_1 DST_IP: 30.0.0.10/32 Active EVERFLOW RULE_3 9997 MIRROR INGRESS: test_session_1 DST_IP: 192.168.0.2/32 Active EVERFLOW RULE_4 9996 MIRROR INGRESS: test_session_1 L4_SRC_PORT: 4661 Active EVERFLOW RULE_5 9995 MIRROR INGRESS: test_session_1 L4_DST_PORT: 4661 Active EVERFLOW RULE_6 9994 MIRROR INGRESS: test_session_1 ETHER_TYPE: 4660 Active EVERFLOW RULE_7 9993 MIRROR INGRESS: test_session_1 IP_PROTOCOL: 126 Active IP_TYPE: IP EVERFLOW RULE_8 9992 MIRROR INGRESS: test_session_1 L4_SRC_PORT_RANGE: 4672-4681 Active EVERFLOW RULE_9 9991 MIRROR INGRESS: test_session_1 L4_DST_PORT_RANGE: 4672-4681 Active EVERFLOW RULE_10 9990 MIRROR INGRESS: test_session_1 DSCP: 51 Active ``` I also reran `test_everflow_fwd_recircle_port_queue_check` on a system that always failed due to packets matching RULE_7 and now the test passes. #### Previous command output (if the output of a command-line utility has changed) No change #### New command output (if the output of a command-line utility has changed) No change Signed-off-by: Sonic Build Admin <sonicbld@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.