[meta]: Enable validation for SAI_ATTR_VALUE_TYPE_ACL_FIELD_DATA_UINT8_LIST by srodd-nexthop · Pull Request #1856 · sonic-net/sonic-sairedis

srodd-nexthop · 2026-04-17T12:22:12Z

Why I did it

SAI_ATTR_VALUE_TYPE_ACL_FIELD_DATA_UINT8_LIST is the value type used for ACL fields backed by UDF (user-defined field) groups — the byte pattern and mask live in aclfield.data.u8list. In meta/Meta.cpp the validation cases for this type were commented out in all five paths (create, set, get, post_get, post_remove), so UDF ACL matches were being silently skipped by the meta layer.

This blocks the UDF feature being added to orchagent (companion PR: sonic-net/sonic-swss#<4493#>) — without metadata validation, UDF ACL rules don't round-trip correctly through sairedis.

Work item tracking

Microsoft ADO (number only): N/A

How I did it

meta/Meta.cpp — uncommented and enabled the SAI_ATTR_VALUE_TYPE_ACL_FIELD_DATA_UINT8_LIST case in:

meta_generic_validation_create — VALIDATION_LIST(md, value.aclfield.data.u8list) when aclfield.enable is set.
meta_generic_validation_set — same, for SET operations.
meta_generic_validation_get — unconditional VALIDATION_LIST on get.
meta_generic_validation_post_get — VALIDATION_LIST_GET when enabled.
meta_generic_validation_post_remove — no-op (no object references to decrement for u8list), but the case is now present rather than falling through.

meta/SaiSerialize.cpp — added serialization support for the u8list field so it round-trips through the sairedis record/replay layer.

How to verify it

Build:

sairedis builds cleanly (make).
Existing meta unit tests pass (make check in meta/ and unittest/).

Runtime (with the companion orchagent PR):

Create a UDF group + UDF match via config_db.json; verify sairedis accepts the CREATE for an ACL_ENTRY referencing the UDF group as a match field (visible in sairedis.rec).
Confirm syncd receives and applies the ACL_ENTRY attributes including the u8list byte pattern.
Without this PR, the same flow silently drops the UDF match validation — any malformed u8list would reach syncd unchecked.

Which release branch to backport (provide reason below if selected)

Not a backport — enables a new feature (UDF ACL matching).

Tested branch (Please provide the tested image version)

master

Description for the changelog

Enable meta validation for SAI_ATTR_VALUE_TYPE_ACL_FIELD_DATA_UINT8_LIST (ACL fields with uint8 list values, used by UDF).

linux-foundation-easycla · 2026-04-17T12:22:20Z

The committers listed above are authorized under a signed CLA.

✅ login: srodd-nexthop / name: satishkumar rodd (12393d8, a2bdcfa)

mssonicbld · 2026-04-17T12:22:21Z

/azp run

azure-pipelines · 2026-04-17T12:22:33Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2026-04-21T13:56:36Z

/azp run

azure-pipelines · 2026-04-21T13:56:49Z

Azure Pipelines successfully started running 1 pipeline(s).

srodd-nexthop · 2026-05-11T13:43:57Z

/azp run

azure-pipelines · 2026-05-11T13:44:04Z

Commenter does not have sufficient privileges for PR 1856 in repo sonic-net/sonic-sairedis

Adds tests/udf/test_udf.py covering the UDF feature added in sonic-net/sonic-swss#4493 (UdfOrch), sonic-net/sonic-buildimage#26874 (YANG), and sonic-net/sonic-sairedis#1856 (meta validation). Registers the suite under t0 and t1-lag in .azure-pipelines/pr_test_scripts.yaml. Coverage (18 test classes, 30+ test methods): - Baseline ASIC_DB programming and CONFIG_DB schema - UDP traffic match through UDF-backed ACL fields - ACL rule create/delete with UDF dependencies - UDF/ACL teardown ordering (correct-order and wrong-order recovery) - ACL rule priority shadowing - Forward reference resolution (TABLE_TYPE configured before SELECTOR) - Multiple selectors per UDF group, distinct OIDs - Invalid CONFIG_DB rejection (negative tests) - SAI UDF_MATCH/UDF attribute round-trip from CONFIG_DB - L3-type auto-mask, L4-port-zero match presence detection - Match type filtering at packet level - Selector field validation (missing/unknown base, missing match) - Selector immutability and idempotent SET handling - UDF_MATCH refcount sharing across selectors (dedup) - UDF_GROUP refcount layering (TABLE_TYPE / TABLE / multi-table) - ACL rule blocking selector deletion - Edge cases (rule with UDF not in table, double-delete, type-vs-table deletion ordering) - End-to-end traffic with full UDF + ACL pipeline All config done directly via sonic-cfggen -j -w; SAI object lifecycle verified via ASIC_DB OID diffing. Module-scoped LogAnalyzer captures unexpected orchagent errors in non-failing mode (negative tests deliberately trigger SWSS_LOG_ERRORs that are ignored via regex). conftest.py overrides yang_validation_check with a UDF-scoped equivalent that validates only UDF/UDF_SELECTOR tables against sonic-udf.yang (avoids spurious failures from FLEX_COUNTER_TABLE entries not covered by installed YANG models on some platforms). Signed-off-by: satishkumar <srodd@nexthop.ai>

Adds tests/udf/test_udf.py covering the UDF feature added in sonic-net/sonic-swss#4493 (UdfOrch), sonic-net/sonic-buildimage#26874 (YANG), and sonic-net/sonic-sairedis#1856 (meta validation). Registers the suite under t0 and t1-lag in .azure-pipelines/pr_test_scripts.yaml. Coverage (18 test classes, 30+ test methods): - Baseline ASIC_DB programming and CONFIG_DB schema - UDP traffic match through UDF-backed ACL fields - ACL rule create/delete with UDF dependencies - UDF/ACL teardown ordering (correct-order and wrong-order recovery) - ACL rule priority shadowing - Forward reference resolution (TABLE_TYPE configured before SELECTOR) - Multiple selectors per UDF group, distinct OIDs - Invalid CONFIG_DB rejection (negative tests) - SAI UDF_MATCH/UDF attribute round-trip from CONFIG_DB - L3-type auto-mask, L4-port-zero match presence detection - Match type filtering at packet level - Selector field validation (missing/unknown base, missing match) - Selector immutability and idempotent SET handling - UDF_MATCH refcount sharing across selectors (dedup) - UDF_GROUP refcount layering (TABLE_TYPE / TABLE / multi-table) - ACL rule blocking selector deletion - Edge cases (rule with UDF not in table, double-delete, type-vs-table deletion ordering) - End-to-end traffic with full UDF + ACL pipeline All config done directly via sonic-cfggen -j -w; SAI object lifecycle verified via ASIC_DB OID diffing. Module-scoped LogAnalyzer captures unexpected orchagent errors in non-failing mode (negative tests deliberately trigger SWSS_LOG_ERRORs that are ignored via regex). Signed-off-by: satishkumar <srodd@nexthop.ai>

Signed-off-by: satishkumar rodd <srodd@nexthop.ai>

Adds tests/udf/test_udf.py covering the UDF feature added in sonic-net/sonic-swss#4493 (UdfOrch), sonic-net/sonic-buildimage#26874 (YANG), and sonic-net/sonic-sairedis#1856 (meta validation). Registers the suite under t0 and t1-lag in .azure-pipelines/pr_test_scripts.yaml. Coverage (18 test classes, 30+ test methods): - Baseline ASIC_DB programming and CONFIG_DB schema - UDP traffic match through UDF-backed ACL fields - ACL rule create/delete with UDF dependencies - UDF/ACL teardown ordering (correct-order and wrong-order recovery) - ACL rule priority shadowing - Forward reference resolution (TABLE_TYPE configured before SELECTOR) - Multiple selectors per UDF group, distinct OIDs - Invalid CONFIG_DB rejection (negative tests) - SAI UDF_MATCH/UDF attribute round-trip from CONFIG_DB - L3-type auto-mask, L4-port-zero match presence detection - Match type filtering at packet level - Selector field validation (missing/unknown base, missing match) - Selector immutability and idempotent SET handling - UDF_MATCH refcount sharing across selectors (dedup) - UDF_GROUP refcount layering (TABLE_TYPE / TABLE / multi-table) - ACL rule blocking selector deletion - Edge cases (rule with UDF not in table, double-delete, type-vs-table deletion ordering) - End-to-end traffic with full UDF + ACL pipeline All config done directly via sonic-cfggen -j -w; SAI object lifecycle verified via ASIC_DB OID diffing. Module-scoped LogAnalyzer captures unexpected orchagent errors in non-failing mode (negative tests deliberately trigger SWSS_LOG_ERRORs that are ignored via regex). Signed-off-by: satishkumar <srodd@nexthop.ai>

Note that the UINT8_LIST ACL field value type is consumed by UDF-backed ACL match fields, where the byte pattern lives in aclfield.data.u8list. Signed-off-by: satishkumar rodd <srodd@nexthop.ai>

mssonicbld · 2026-05-12T04:27:08Z

/azp run

azure-pipelines · 2026-05-12T04:27:19Z

Azure Pipelines successfully started running 1 pipeline(s).

Signed-off-by: satishkumar rodd <srodd@nexthop.ai>

mssonicbld · 2026-05-13T05:55:46Z

/azp run

azure-pipelines · 2026-05-13T05:55:57Z

Azure Pipelines successfully started running 1 pipeline(s).

Fixes Build amd64 / BuildAsan amd64 failure: aspellcheck.pl: WARNING: Word 'UDF' is misspelled ../meta/Meta.cpp Signed-off-by: satishkumar rodd <srodd@nexthop.ai>

mssonicbld · 2026-05-13T09:16:04Z

/azp run

azure-pipelines · 2026-05-13T09:16:17Z

Azure Pipelines successfully started running 1 pipeline(s).

Fixes SaiSerialize.sai_serialize_attr_value unit test failure: C++ exception with description ':- sai_deserialize_list: invalid list' thrown in the test body. The earlier guard (12393d8, a2bdcfa) skipped the '&mask:' portion when mask.u8list was empty. That broke round-trip: deserialize still expects the suffix and throws on an empty smask. Reverting to the unconditional form (matching master and all other ACL field types) restores symmetry. sai_serialize_number_list handles empty lists without crashing, as proven by master where this test passes. Signed-off-by: satishkumar rodd <srodd@nexthop.ai>

mssonicbld · 2026-05-13T11:45:20Z

/azp run

azure-pipelines · 2026-05-13T11:45:32Z

Azure Pipelines successfully started running 1 pipeline(s).

Signed-off-by: satishkumar rodd <srodd@nexthop.ai>

mssonicbld · 2026-05-13T12:46:04Z

/azp run

azure-pipelines · 2026-05-13T12:46:17Z

Azure Pipelines successfully started running 1 pipeline(s).

srodd-nexthop mentioned this pull request Apr 21, 2026

[HLD] User Defined Fields(UDF) feature in SONiC sonic-net/SONiC#2299

Open

srodd-nexthop force-pushed the srodd.nexthopai.udf branch from ddf5e52 to fa97379 Compare April 21, 2026 13:55

srodd-nexthop marked this pull request as ready for review April 21, 2026 13:56

srodd-nexthop mentioned this pull request Apr 21, 2026

[orchagent]: Add UdfOrch for user-defined field (UDF) ACL matching sonic-net/sonic-swss#4493

Open

srodd-nexthop mentioned this pull request May 11, 2026

[udf] Add sonic-mgmt tests for UDF feature sonic-net/sonic-mgmt#24518

Open

6 tasks

u8_list validation handling

12393d8

Signed-off-by: satishkumar rodd <srodd@nexthop.ai>

srodd-nexthop force-pushed the srodd.nexthopai.udf branch from fa97379 to 12393d8 Compare May 11, 2026 17:09

meta: clarify intent of u8_list validation case

a2bdcfa

Note that the UINT8_LIST ACL field value type is consumed by UDF-backed ACL match fields, where the byte pattern lives in aclfield.data.u8list. Signed-off-by: satishkumar rodd <srodd@nexthop.ai>

ci: retrigger pipeline

bff2d9d

Signed-off-by: satishkumar rodd <srodd@nexthop.ai>

tests: add UDF to aspell dictionary

31dfa7c

Fixes Build amd64 / BuildAsan amd64 failure: aspellcheck.pl: WARNING: Word 'UDF' is misspelled ../meta/Meta.cpp Signed-off-by: satishkumar rodd <srodd@nexthop.ai>

ci: retrigger pipeline

3074f0d

Signed-off-by: satishkumar rodd <srodd@nexthop.ai>

Conversation

srodd-nexthop commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why I did it

Work item tracking

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Tested branch (Please provide the tested image version)

Description for the changelog

Uh oh!

linux-foundation-easycla Bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mssonicbld commented Apr 17, 2026

Uh oh!

azure-pipelines Bot commented Apr 17, 2026

Uh oh!

mssonicbld commented Apr 21, 2026

Uh oh!

azure-pipelines Bot commented Apr 21, 2026

Uh oh!

srodd-nexthop commented May 11, 2026

Uh oh!

azure-pipelines Bot commented May 11, 2026

Uh oh!

mssonicbld commented May 12, 2026

Uh oh!

azure-pipelines Bot commented May 12, 2026

Uh oh!

mssonicbld commented May 13, 2026

Uh oh!

azure-pipelines Bot commented May 13, 2026

Uh oh!

mssonicbld commented May 13, 2026

Uh oh!

azure-pipelines Bot commented May 13, 2026

Uh oh!

mssonicbld commented May 13, 2026

Uh oh!

azure-pipelines Bot commented May 13, 2026

Uh oh!

mssonicbld commented May 13, 2026

Uh oh!

azure-pipelines Bot commented May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

srodd-nexthop commented Apr 17, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Apr 17, 2026 •

edited

Loading