Skip to content

[doc/acl]: Add TC_ACTION (set traffic class) ACL rule action #2432

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AnantKishorSharma wants to merge 1 commit into
base: master
Choose a base branch
from
+18 −1
Open

[doc/acl]: Add TC_ACTION (set traffic class) ACL rule action #2432

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 18 additions & 1 deletion doc/acl/ACL-High-Level-Design.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# ACL in SONiC
# High Level Design Document
### Rev 1.1
### Rev 1.2

# Table of Contents
* [List of Tables](#list-of-tables)
Expand Down Expand Up @@ -88,6 +88,7 @@
| 0.3 | 10-Nov-2016 | Andriy Moroz | Updated according to the comments |
| 0.4 | 20-Dec-2016 | Oleksandr Ivantsiv | Update data structures |
| 1.1 | 08-Apr-2025 | Anish Narsian | VXLAN inner src mac rewrite support |
| 1.2 | 01-Jul-2026 | Anant Kishor Sharma | TC_ACTION (set traffic class) ACL rule action |
# About this Manual
This document provides general information about the ACL feature implementation in SONiC.
# Scope
Expand Down Expand Up @@ -568,6 +569,21 @@ to class AclRuleMirror to indicate the stage the ACL mirror rule, according to t
action, "SAI_ACL_ENTRY_ATTR_ACTION_MIRROR_INGRESS" for ingress ACL rule, "SAI_ACL_ENTRY_ATTR_ACTION_MIRROR_EGRESS"
for egress ACL rule.
Add possibility to receive updates about mirror sessions state change and perform mirroring rules state change accordingly.

To set the traffic class (Class-of-Service) of ACL-matched traffic, the traffic class action (keyword "TC_ACTION") is
realized by class "AclRulePacket", which parses the configured 8-bit value (0-255) and programs it as
"SAI_ACL_ENTRY_ATTR_ACTION_SET_TC" on the ACL entry. The action is gated by the per-stage ASIC action capability that
is queried at startup and published in STATE_DB "ACL_STAGE_CAPABILITY_TABLE": it is available on any stage (ingress
and/or egress) whose SAI advertises "SAI_ACL_ACTION_TYPE_SET_TC", and a table or rule that uses it is rejected on
platforms that do not advertise it, so there is no behavior change for existing platforms. The action is handled in the
generic CONFIG_DB ACL pipeline (previously "SAI_ACL_ENTRY_ATTR_ACTION_SET_TC" was only reachable via the P4Orch/P4RT path).

Because setting the traffic class neither forwards nor drops a packet, "TC_ACTION" is an additive
(composable) action rather than an exclusive one: a rule may carry it alone -- the matched packet keeps its
normal forwarding path and simply carries the assigned traffic class -- or combine it with a single
forwarding action (e.g. "FORWARD"/"DROP") and/or a counter on the same rule. Accordingly
"AclRulePacket::validate()" excludes "SAI_ACL_ENTRY_ATTR_ACTION_SET_TC" from its single exclusive-action
check.
# 4 Flows
## 4.1 Creating of ACL Objects
![](acl_create.png)
Expand Down Expand Up @@ -629,6 +645,7 @@ Ansible + PTF
|packet_action | ACL Rule property. Packet actions "forward" or "drop". Valid for rules in "L3" tables only
|mirror_action | Action "mirror". Valid for rules in "mirror" tables only
|inner_src_mac_rewrite_action | Action to rewrite the inner src mac rewrite field.
|tc_action | Action to set the traffic class (Class-of-Service), an 8-bit value 0-255, on matching packets. Maps to SAI_ACL_ENTRY_ATTR_ACTION_SET_TC
*Keywords derived from the SAI ACL attributes.*
# Appendix B: Sample input json file
```
Expand Down