[aclorch]: Support SET_PACKET_COLOR ACL action#4717
Open
AnantKishorSharma wants to merge 1 commit into
Open
Conversation
Collaborator
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
AnantKishorSharma
force-pushed
the
acl-set-packet-color-action
branch
from
ffa1e4d to
14a6c2b
Compare
Collaborator
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds support for setting packet color (GREEN/YELLOW/RED) via the generic CONFIG_DB ACL pipeline in AclOrch, mapping the new PACKET_COLOR_ACTION to SAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLOR and capability-gating it based on the platform’s advertised ACL action + enum-value support.
Changes:
- Add
PACKET_COLOR_ACTION→SAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLORmapping plus value lookup (GREEN/YELLOW/RED→SAI_PACKET_COLOR_*) and rule-time validation. - Extend ACL capability querying to include enum-value capability checks for the new action.
- Add mock unit tests covering supported/unsupported platforms and invalid color handling; document the new schema field.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| tests/mock_tests/aclorch_ut.cpp | Adds unit tests for SET_PACKET_COLOR action programming and capability gating. |
| orchagent/aclorch.h | Introduces PACKET_COLOR_ACTION action name and packet color string constants/types. |
| orchagent/aclorch.cpp | Implements action parsing/mapping + capability querying for SET_PACKET_COLOR. |
| doc/swss-schema.md | Documents packet_color_action in the ACL rule schema. |
Collaborator
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
AnantKishorSharma
force-pushed
the
acl-set-packet-color-action
branch
from
3ce233b to
77248ed
Compare
Collaborator
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Collaborator
|
Hi, there are workflow run(s) waiting for approval, you may be first-time contributor. I will notify maintainers to help approve once PR is approved. Thanks! ---Powered by SONiC BuildBot
|
Collaborator
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Map PACKET_COLOR_ACTION (GREEN/YELLOW/RED) to SAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLOR in the CONFIG_DB AclOrch pipeline (previously reachable only via P4Orch). The action is capability-gated: platforms that do not advertise it reject the table, with no other change. SET_PACKET_COLOR is a composable QoS marking consumed downstream by a color-aware policer/WRED, so AclRulePacket::validate() caps only the non-color actions at one -- a rule may set the color and still carry a single forwarding/terminating action (e.g. PACKET_ACTION) plus a counter. Tests: positive, capability-gate, and color + PACKET_ACTION(FORWARD) compose. Signed-off-by: Anant Kishor Sharma <anant.kishor-sharma@hpe.com>
AnantKishorSharma
force-pushed
the
acl-set-packet-color-action
branch
from
d7aaa40 to
fbec30c
Compare
Collaborator
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
AnantKishorSharma
added a commit
to AnantKishorSharma/SONiC
that referenced
this pull request
Jul 13, 2026
Document PACKET_COLOR_ACTION (GREEN/YELLOW/RED) in the ACL High Level Design: it maps to SAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLOR in the generic CONFIG_DB AclOrch pipeline, is capability-gated per ACL stage (ingress and/or egress), and is a no-op on platforms whose SAI does not advertise the action. It is a composable QoS marking (sets internal drop precedence only, not DSCP/PCP) that may accompany a single forwarding action plus a counter. Companion to sonic-net/sonic-swss#4717. Signed-off-by: Anant Kishor Sharma <anant.kishor-sharma@hpe.com>
AnantKishorSharma
added a commit
to AnantKishorSharma/SONiC
that referenced
this pull request
Jul 13, 2026
Document PACKET_COLOR_ACTION (GREEN/YELLOW/RED) in the ACL High Level Design: it maps to SAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLOR in the generic CONFIG_DB AclOrch pipeline, is capability-gated per ACL stage (ingress and/or egress), and is a no-op on platforms whose SAI does not advertise the action. It is a composable QoS marking (sets internal drop precedence only, not DSCP/PCP) that may accompany a single forwarding action plus a counter. Companion to sonic-net/sonic-swss#4717. Signed-off-by: Anant Kishor Sharma <anant.kishor-sharma@hpe.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What I did
Add
PACKET_COLOR_ACTION(GREEN/YELLOW/RED) to the generic CONFIG_DBAclOrchpipeline, mapping it toSAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLOR.SAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLORwas only reachable via the P4Orch/P4RT path; the standard CONFIG_DB AclOrch pipeline had no mapping.Details
aclL3ActionLookup: mapPACKET_COLOR_ACTION->SAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLORaclPacketColorLookup:GREEN/YELLOW/RED->SAI_PACKET_COLOR_*(value is case-insensitive)AclRulePacket::validateAddAction: parse the color value, reject invalid valuesAclRulePacket::validate:SET_PACKET_COLORis a composable QoS marking (a drop-precedence color consumed downstream by a color-aware policer/WRED), so a rule may set the color and still carry a single forwarding/terminating action (e.g.PACKET_ACTION) plus a counter — only the non-color actions are capped at one. This is consistent with the composableSET_POLICER([aclorch] acl set policer action #4666) andSET_TC([aclorch]: Support SET_TC (traffic class) ACL rule action #4726) actions; SAI appliesSET_PACKET_COLORas an independentCREATE_AND_SETaction.queryAclActionCapability: query the enum-value capability so the action is capability-gated (platforms that don't advertise it simply reject the table — no behavior change for anyone else)How I verified
AclRuleSetPacketColorAction(positive — programs the rightsai_packet_color_t, rejects invalid color),AclTableSetPacketColorActionNotSupported(negative — table rejected when the platform does not advertise the action), andAclRuleSetPacketColorActionComposeForward(PACKET_ACTION=FORWARD+PACKET_COLOR_ACTIONin one rule is created and programs both SAI actions). Full swss mock unit-test suite passes (914/914).SAI_ACL_ENTRY_ATTR_ACTION_SET_PACKET_COLORin ASIC_DB and the corresponding field-processor action (verified viabcmcmd).Requires the YANG model addition: sonic-net/sonic-buildimage#28151
HLD: sonic-net/SONiC#2429
Fixes #4716