[Nokia-7215] Dataplane IPv6 ACL rule cannot match packet correctly

[lizhijianrd]

Description

On latest 202311 marvell-armhf image, dataplane ACL rule cannot match packet correctly. Please check the details in repro steps.

Steps to reproduce the issue:

On Nokia-7215 Mx DUT with latest 202311 image installed:

1. [On DUT] Create file acl_table_types.json with below content:

   {
   "ACL_TABLE_TYPE": {
       "BMCDATAV6": {
           "MATCHES": ["SRC_IPV6", "DST_IPV6", "ETHER_TYPE", "IP_TYPE", "IP_PROTOCOL", "IN_PORTS", "L4_SRC_PORT", "L4_DST_PORT", "L4_SRC_PORT_RANGE", "L4_DST_PORT_RANGE", "ICMPV6_TYPE", "ICMPV6_CODE", "TCP_FLAGS"],
           "ACTIONS": ["PACKET_ACTION", "COUNTER"],
           "BIND_POINTS": ["PORT"]
       }
   }
   }

2. [On DUT] Issue below command to add custom ACL table type to running config:

   admin@sonic:~$ sudo sonic-cfggen -j acl_table_types.json -w

3. [On DUT] Issue below command to setup ACL table:

   admin@sonic:~$ sudo config acl add table NORTHBOUND_V6 BMCDATAV6 -p Ethernet0,Ethernet1,Ethernet2 -s ingress

4. [On DUT] Confirm ACL table is active:

   admin@sonic:~$ show acl table NORTHBOUND_V6
   Name           Type       Binding    Description    Stage    Status
   -------------  ---------  ---------  -------------  -------  --------
   NORTHBOUND_V6  BMCDATAV6  Ethernet0  NORTHBOUND_V6  ingress  Active
                         Ethernet1
                         Ethernet2

5. [On DUT] Create file acl.json with below contents:

   {
   "acl": {
       "acl-sets": {
           "acl-set": {
               "NORTHBOUND_V6": {
                   "acl-entries": {
                       "acl-entry": {
                           "4000_AD_HOC_TCP_SYN": {
                               "actions": {
                                   "config": {
                                       "forwarding-action": "DROP"
                                   }
                               },
                               "config": {
                                   "sequence-id": 4000
                               },
                               "ip": {
                                   "config": {
                                       "protocol": "6"
                                   }
                               },
                               "l2": {
                                   "config": {
                                       "ethertype": 34525
                                   }
                               },
                               "transport": {
                                   "config": {
                                       "tcp-flags": [
                                           "TCP_SYN"
                                       ]
                                   }
                               }
                           },
                           "4001_AD_HOC_ALLOW_ICMPV6_ECHO": {
                               "actions": {
                                   "config": {
                                       "forwarding-action": "ACCEPT"
                                   }
                               },
                               "config": {
                                   "sequence-id": 4001
                               },
                               "icmp": {
                                   "config": {
                                       "code": 0,
                                       "type": 129
                                   }
                               },
                               "ip": {
                                   "config": {
                                       "destination-ip-address": "fc03::1/128",
                                       "protocol": "58"
                                   }
                               },
                               "l2": {
                                   "config": {
                                       "ethertype": 34525
                                   }
                               }
                           }
                       }
                   }
               }
           }
       }
   }
   }

6. [On DUT] Issue below command to apply the ACL rules:

   admin@sonic:~$ acl-loader update full acl.json

7. [On DUT] Confirm ACL rules are active:

   admin@sonic:~$ show acl rule NORTHBOUND_V6
   Table          Rule       Priority    Action    Match                  Status
   -------------  ---------  ----------  --------  ---------------------  --------
   NORTHBOUND_V6  RULE_4000  6000        DROP      ETHER_TYPE: 34525      Active
                                               IP_PROTOCOL: 6
                                               TCP_FLAGS: 0x02/0x02
   NORTHBOUND_V6  RULE_4001  5999        FORWARD   DST_IPV6: fc03::1/128  Active
                                               ETHER_TYPE: 34525
                                               ICMPV6_CODE: 0
                                               ICMPV6_TYPE: 129
                                               IP_PROTOCOL: 58

8. [On DUT] Clear interface counter before sending packet in step 11:

   admin@sonic:~$ portstat -c
   Cleared counters

9. [On PTF Container] install python packet:

   root@fef264db69e9:~# pip3 install ptf
   Collecting ptf
   Downloading https://files.pythonhosted.org/packages/96/dd/c405056362da86494af91aed03cde223612699ccfd0216a0464776f9163a/ptf-0.10.0-py3-none-any.whl (59kB)
   100% |████████████████████████████████| 61kB 874kB/s
   Installing collected packages: ptf
   Successfully installed ptf-0.10.0

10. [On PTF Container] Open a Python interactive shell and issue below command to send 100 ICMPv6 ECHO REPLY packet:

    root@fef264db69e9:~# python3
    Python 3.7.3 (default, Mar 23 2024, 16:12:05)
    [GCC 8.3.0] on linux
    Type "help", "copyright", "credits" or "license" for more information.
    >>> from ptf import testutils
    WARNING:root:ROCEv2 support not found in Scapy
    WARNING:root:ERSPAN support not found in Scapy
    WARNING:root:GENEVE support not found in Scapy
    Using packet manipulation module: ptf.packet_scapy
    >>> pkt = testutils.simple_icmpv6_packet(ipv6_dst='fc03::1', icmp_type=129)
    >>> sendp(pkt, iface='eth0', count=100)
    ....................................................................................................
    Sent 100 packets.
    >>>

Describe the results you received:

[On DUT] Check ACL counter before and after send ICMPv6 packet with aclshow -a. We can see the counter of RULE_4000 increased by 100, but RULE_4001 doesn't increase. That's incorrect behavior.

admin@sonic:~$ aclshow -a
RULE NAME    TABLE NAME       PRIO    PACKETS COUNT    BYTES COUNT
-----------  -------------  ------  ---------------  -------------
RULE_4000    NORTHBOUND_V6    6000               15           1542
RULE_4001    NORTHBOUND_V6    5999                0              0
admin@sonic:~$ aclshow -a
RULE NAME    TABLE NAME       PRIO    PACKETS COUNT    BYTES COUNT
-----------  -------------  ------  ---------------  -------------
RULE_4000    NORTHBOUND_V6    6000              115          11942
RULE_4001    NORTHBOUND_V6    5999                0              0

Describe the results you expected:

ACL counter of RULE_4001 should increase by 100.

I can see the correct behavior on old 202311 image:

admin@sonic:~$ aclshow -a
RULE NAME    TABLE NAME       PRIO    PACKETS COUNT    BYTES COUNT
-----------  -------------  ------  ---------------  -------------
RULE_4000    NORTHBOUND_V6    6000                0              0
RULE_4001    NORTHBOUND_V6    5999                0              0
admin@sonic:~$ aclshow -a
RULE NAME    TABLE NAME       PRIO    PACKETS COUNT    BYTES COUNT
-----------  -------------  ------  ---------------  -------------
RULE_4000    NORTHBOUND_V6    6000                0              0
RULE_4001    NORTHBOUND_V6    5999              100          10400

Output of show version:

(paste your output here)

Output of show techsupport:

(paste your output here or download and attach the file here )

Additional information you deem important (e.g. issue happens only occasionally):

[johnchiucc]

After analysis, suggest use qualifier NEXT_HEADER instead of IP_PROTOCOL for IPv6 rules. Then do config load to apply it. One example at bottom.

Analysis A similar workaround in Marvell SAI is removed to avoid redundant part (as sonic-swss workaround), and improve ACL arrangement. The change pass community test cases but this combination of IP_PROTOCOL qualifier and custom ipv6 table type is not expected. Thus it exposes this sonic qualifier setting difference between IPv4 and IPv6.

• Use NEXT_HEADER for IPv6 is recommended. This follows SAI and IPv6 definition.

  • Use config load (ready for NEXT_HEADER qualifer)
  • To acl-loader, need community to improve acl-loader to accept NEXT_HEADER.

• Use IP_PROTOCOL for IPv6 is not recommended and going to be obsoleted

  • Pre-defined IPv6 (MIRRORV6, L3V6..etc) table type with sonic-swss workaround (snipped as below) converts IP_PROTOCOL as NEXT_HEADER to follow SAI definition as workaround.
  • code snippet of https://github.com/sonic-net/sonic-swss/blob/20e8b362a5e4fd5361a6f08effddd08d61d5d262/orchagent/aclorch.cpp#L1066

    // TODO: For backwards compatibility, users can substitute IP_PROTOCOL for NEXT_HEADER.
    // This should be removed in a future release.
    if ((m_pTable->type.getName() == TABLE_TYPE_MIRRORV6 || m_pTable->type.getName() == TABLE_TYPE_L3V6)
       && attr_name == MATCH_IP_PROTOCOL)
    {
    SWSS_LOG_WARN("Support for IP protocol on IPv6 tables will be removed in a future release, please switch to using NEXT_HEADER instead!");
    attr_name = MATCH_NEXT_HEADER;
    }

Working scenario With ACL configuration aligned to config schema using NEXT_HEADER and config load:

root@str-marvell-acs-1:/home/admin# cat acl_table_types.json
{
   "ACL_TABLE_TYPE": {
       "BMCDATAV6": {
           "MATCHES": ["SRC_IPV6", "DST_IPV6", "ETHER_TYPE", "IP_TYPE", "IN_PORTS", "L4_SRC_PORT", "L4_DST_PORT", "L4_SRC_PORT_RANGE", "L4_DST_PORT_RANGE", "ICMPV6_TYPE", "ICMPV6_CODE", "TCP_FLAGS", "NEXT_HEADER"],
           "ACTIONS": ["PACKET_ACTION", "COUNTER"],
           "BIND_POINTS": ["PORT"]
       }
   }
}
root@str-marvell-acs-1:/home/admin#
root@str-marvell-acs-1:/home/admin# cat acl_test.json
{
   "ACL_RULE": {
       "NORTHBOUND_V6|4000_AD_HOC_TCP_SYN": {
           "NEXT_HEADER": "6",
           "ETHER_TYPE": "34525",
           "PRIORITY": "6000",
           "TCP_FLAGS": "0x02/0x02",
           "PACKET_ACTION": "DROP"
    },
    "NORTHBOUND_V6|4001_AD_HOC_ALLOW_ICMPV6_ECHO": {
           "PACKET_ACTION": "FORWARD",
           "PRIORITY": "5999",
           "DST_IPV6": "fc03::1/128",
           "NEXT_HEADER": "58",
           "ETHER_TYPE": "34525",
           "ICMPV6_CODE": "0",
           "ICMPV6_TYPE": "129"
     }
   }
}

root@str-marvell-acs-1:/home/admin# sonic-cfggen -j acl_table_types.json -w
root@str-marvell-acs-1:/home/admin# config acl add table NORTHBOUND_V6 BMCDATAV6 -p Ethernet0,Ethernet1,Ethernet2 -s ingress
root@str-marvell-acs-1:/home/admin# config load acl_test.json -y
Running command: /usr/local/bin/sonic-cfggen -j acl_test.json --write-to-db