T6373: QoS Policy Limiter - classes for marked traffic do not work

(cherry picked from commit e50b7afc9d5b727d04933116ccf364a2b9a48c30)

2 files changed, 29 insertions, 3 deletions

diff --git a/python/vyos/qos/base.py b/python/vyos/qos/base.py
index 87927ba9d..98e486e42 100644
--- a/python/vyos/qos/base.py
+++ b/python/vyos/qos/base.py
@@ -247,9 +247,15 @@ class QoSBase:
                 filter_cmd_base += ' protocol all'
 
                 if 'match' in cls_config:
-                    is_filtered = False
+                    has_filter = False
                     for index, (match, match_config) in enumerate(cls_config['match'].items(), start=1):
                         filter_cmd = filter_cmd_base
+                        if not has_filter:
+                            for key in ['mark', 'vif', 'ip', 'ipv6']:
+                                if key in match_config:
+                                    has_filter = True
+                                    break
+
                         if self.qostype == 'shaper' and 'prio ' not in filter_cmd:
                             filter_cmd += f' prio {index}'
                         if 'mark' in match_config:
@@ -332,13 +338,12 @@ class QoSBase:
                                 cls = int(cls)
                                 filter_cmd += f' flowid {self._parent:x}:{cls:x}'
                                 self._cmd(filter_cmd)
-                                is_filtered = True
 
                     vlan_expression = "match.*.vif"
                     match_vlan = jmespath.search(vlan_expression, cls_config)
 
                     if any(tmp in ['exceed', 'bandwidth', 'burst'] for tmp in cls_config) \
-                        and is_filtered:
+                        and has_filter:
                         # For "vif" "basic match" is used instead of "action police" T5961
                         if not match_vlan:
                             filter_cmd += f' action police'
diff --git a/smoketest/scripts/cli/test_qos.py b/smoketest/scripts/cli/test_qos.py
index bcf5139c7..5977b2f41 100755
--- a/smoketest/scripts/cli/test_qos.py
+++ b/smoketest/scripts/cli/test_qos.py
@@ -738,6 +738,27 @@ class TestQoS(VyOSUnitTestSHIM.TestCase):
         self.cli_commit()
         self.assertEqual('', cmd(f'tc filter show dev {interface}'))
 
+    def test_14_policy_limiter_marked_traffic(self):
+        policy_name = 'smoke_test'
+        base_policy_path = ['qos', 'policy', 'limiter', policy_name]
+
+        self.cli_set(['qos', 'interface', self._interfaces[0], 'ingress', policy_name])
+        self.cli_set(base_policy_path + ['class', '100', 'bandwidth', '20gbit'])
+        self.cli_set(base_policy_path + ['class', '100', 'burst', '3760k'])
+        self.cli_set(base_policy_path + ['class', '100', 'match', 'INTERNAL', 'mark', '100'])
+        self.cli_set(base_policy_path + ['class', '100', 'priority', '20'])
+        self.cli_set(base_policy_path + ['default', 'bandwidth', '1gbit'])
+        self.cli_set(base_policy_path + ['default', 'burst', '125000000b'])
+        self.cli_commit()
+
+        tc_filters = cmd(f'tc filter show dev {self._interfaces[0]} ingress')
+        # class 100
+        self.assertIn('filter parent ffff: protocol all pref 20 fw chain 0', tc_filters)
+        self.assertIn('action order 1:  police 0x1 rate 20Gbit burst 3847500b mtu 2Kb action drop overhead 0b', tc_filters)
+        # default
+        self.assertIn('filter parent ffff: protocol all pref 255 basic chain 0', tc_filters)
+        self.assertIn('action order 1:  police 0x2 rate 1Gbit burst 125000000b mtu 2Kb action drop overhead 0b', tc_filters)
+
 
 if __name__ == '__main__':
     unittest.main(verbosity=2)