Skip to content

doc/acl: document the PACKET_COLOR_ACTION ACL rule action #2429

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AnantKishorSharma wants to merge 1 commit into
base: master
Choose a base branch
from
Open

doc/acl: document the PACKET_COLOR_ACTION ACL rule action #2429

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 22 additions & 1 deletion doc/acl/ACL-High-Level-Design.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# ACL in SONiC
# High Level Design Document
### Rev 1.1
### Rev 1.2

# Table of Contents
* [List of Tables](#list-of-tables)
Expand Down Expand Up @@ -88,6 +88,7 @@
| 0.3 | 10-Nov-2016 | Andriy Moroz | Updated according to the comments |
| 0.4 | 20-Dec-2016 | Oleksandr Ivantsiv | Update data structures |
| 1.1 | 08-Apr-2025 | Anish Narsian | VXLAN inner src mac rewrite support |
| 1.2 | 01-Jul-2026 | Anant Kishor Sharma | PACKET_COLOR_ACTION (set packet color) ACL rule action |
# About this Manual
This document provides general information about the ACL feature implementation in SONiC.
# Scope
Expand Down Expand Up @@ -568,6 +569,25 @@ to class AclRuleMirror to indicate the stage the ACL mirror rule, according to t
action, "SAI_ACL_ENTRY_ATTR_ACTION_MIRROR_INGRESS" for ingress ACL rule, "SAI_ACL_ENTRY_ATTR_ACTION_MIRROR_EGRESS"
for egress ACL rule.
Add possibility to receive updates about mirror sessions state change and perform mirroring rules state change accordingly.

To set the packet color of ACL-matched traffic, the packet color action (keyword "PACKET_COLOR_ACTION") is realized by
class "AclRulePacket", which maps the configured color "GREEN"/"YELLOW"/"RED" to the SAI enum values
"SAI_PACKET_COLOR_GREEN"/"SAI_PACKET_COLOR_YELLOW"/"SAI_PACKET_COLOR_RED" and programs
"SAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLOR" on the ACL entry. The action is gated by the per-stage ASIC action
capability that is queried at startup and published in STATE_DB "ACL_STAGE_CAPABILITY_TABLE": it is available on any
stage (ingress and/or egress) whose SAI advertises "SAI_ACL_ACTION_TYPE_SET_PACKET_COLOR", and a table or rule that
uses it is rejected on platforms that do not advertise it, so there is no behavior change for existing platforms. The
action is handled in the generic CONFIG_DB ACL pipeline (previously "SAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLOR" was
only reachable via the P4Orch/P4RT path).

Because setting the packet color only marks the matched packet's drop precedence (consumed downstream by a
color-aware policer or WRED) and neither forwards nor drops it, "PACKET_COLOR_ACTION" is an additive
(composable) action rather than an exclusive one: a rule may carry it alone -- the matched packet keeps its
normal forwarding path and simply carries the assigned color -- or combine it with a single forwarding action
(e.g. "FORWARD"/"DROP") and/or a counter on the same rule. Accordingly "AclRulePacket::validate()" excludes
"SAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLOR" from its single exclusive-action check. Setting the color updates
internal drop precedence only; it does not modify DSCP or PCP directly (those change on egress only when a
"TC_AND_COLOR_TO_DSCP"/"TC_AND_COLOR_TO_DOT1P" QoS map is configured).
# 4 Flows
## 4.1 Creating of ACL Objects
![](acl_create.png)
Expand Down Expand Up @@ -629,6 +649,7 @@ Ansible + PTF
|packet_action | ACL Rule property. Packet actions "forward" or "drop". Valid for rules in "L3" tables only
|mirror_action | Action "mirror". Valid for rules in "mirror" tables only
|inner_src_mac_rewrite_action | Action to rewrite the inner src mac rewrite field.
|packet_color_action | Action to set the packet color ("GREEN"/"YELLOW"/"RED") on matching packets. Maps to SAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLOR
*Keywords derived from the SAI ACL attributes.*
# Appendix B: Sample input json file
```
Expand Down