Skip to content

Conversation

@yue-fred-gao
Copy link
Contributor

why

currently vpp doesn't support binding multiple ACL tables. Each table is appended with default permit-all rules. With multiple tables, this may cause acl matched by such rules and skip the actual rule to make in the tables after this one.

what this PR does

  1. remove the default permit-all rules for each table
  2. If a table is empty, create a dummy rule that won't match any traffic because vpp doesn't allow empty table. The dummy rule matches dest-ip to 0.0.0.0/32
  3. sort all the tables by priority in the table group. vpp doesn't support parallel matching
  4. added catch-all acl group to the end. vpp default behavior of no match is drop but sonic is accept.

 - Added catch-all acl group
 - Add a dummy rule because vpp doesn't allow empty table

Signed-off-by: Yue Gao <yuega2@cisco.com>
@mssonicbld
Copy link
Collaborator

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@yue-fred-gao yue-fred-gao marked this pull request as ready for review December 19, 2025 21:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants