VPP: T8495: fix issue with assigning acl on sub interfaces

4 files changed, 57 insertions, 3 deletions

diff --git a/data/config-mode-dependencies/vyos-vpp.json b/data/config-mode-dependencies/vyos-vpp.json
index af7a8ca0d..edf941c77 100644
--- a/data/config-mode-dependencies/vyos-vpp.json
+++ b/data/config-mode-dependencies/vyos-vpp.json
@@ -15,6 +15,9 @@
         "vpp_sflow": ["vpp_sflow"],
         "pppoe_server": ["service_pppoe-server"]
     },
+    "interfaces_ethernet": {
+        "vpp_acl": ["vpp_acl"]
+    },
     "vpp_interfaces_bonding": {
         "vpp_interfaces_xconnect": ["vpp_interfaces_xconnect"],
         "vpp_interfaces_bridge": ["vpp_interfaces_bridge"],
@@ -51,4 +54,3 @@
         "vpp_nat_cgnat": ["vpp_nat_cgnat"]
     }
 }
-
diff --git a/smoketest/scripts/cli/test_vpp.py b/smoketest/scripts/cli/test_vpp.py
index 8fcd541f0..8e2b42d58 100755
--- a/smoketest/scripts/cli/test_vpp.py
+++ b/smoketest/scripts/cli/test_vpp.py
@@ -1392,6 +1392,44 @@ class TestVPP(VyOSUnitTestSHIM.TestCase):
         _, out = rc_cmd('sudo vppctl show flowprobe feature')
         self.assertIn(required_str, out)
 
+    def test_20_3_vpp_acl_subinterface(self):
+        base_acl = base_path + ['acl', 'ip']
+        vlan = '200'
+        subif = f'{interface}.{vlan}'
+        acl_name = 'STATEFUL'
+        acl_tag = '10'
+        rule = '10'
+
+        self.cli_set(['interfaces', 'ethernet', interface, 'vif', vlan])
+        self.cli_set(base_acl + ['tag-name', acl_name, 'rule', rule, 'action', 'permit'])
+        self.cli_set(
+            base_acl
+            + ['interface', subif, 'input', 'acl-tag', acl_tag, 'tag-name', acl_name]
+        )
+        self.cli_commit()
+
+        vpp = VPPControl()
+        subif_index = vpp.get_sw_if_index(subif)
+        self.assertIsNotNone(subif_index)
+
+        acl_index = None
+        for acl in vpp.api.acl_dump(acl_index=0xFFFFFFFF):
+            if acl.tag == acl_name:
+                acl_index = acl.acl_index
+                break
+        self.assertIsNotNone(acl_index)
+
+        acl_interfaces = [
+            entry
+            for entry in vpp.api.acl_interface_list_dump()
+            if entry.sw_if_index == subif_index and entry.count != 0
+        ]
+        self.assertEqual(len(acl_interfaces), 1)
+        self.assertEqual(acl_interfaces[0].n_input, 1)
+        self.assertEqual(
+            list(acl_interfaces[0].acls)[: acl_interfaces[0].count], [acl_index]
+        )
+
     def test_21_double_enabling_vpp(self):
         # Verify double enabling of VPP
 
diff --git a/src/conf_mode/interfaces_ethernet.py b/src/conf_mode/interfaces_ethernet.py
index 886f9b7b7..8d40e4d1f 100755
--- a/src/conf_mode/interfaces_ethernet.py
+++ b/src/conf_mode/interfaces_ethernet.py
@@ -175,6 +175,8 @@ def get_config(config=None):
     if tmp: ethernet.update({'frr_dict' : get_frrender_dict(conf)})
 
     ethernet['flowtable_interfaces'] = get_flowtable_interfaces(conf)
+    vif_changed = is_node_changed(conf, base + [ifname, 'vif'])
+    vif_s_changed = is_node_changed(conf, base + [ifname, 'vif-s'])
 
     vpp_config = conf.get_config_dict(
         ['vpp'],
@@ -190,6 +192,13 @@ def get_config(config=None):
             get_first_key=True,
             no_tag_node_value_mangle=True,
         )
+        if (
+            'acl' in vpp_config
+            and (vif_changed or vif_s_changed)
+            and dict_search(f'settings.interface.{ifname}', vpp_config) is not None
+        ):
+            ethernet['vpp_acl_dependent'] = True
+            set_dependents('vpp_acl', conf)
 
     # Protocols static arp dependency
     if 'static_arp' in ethernet:
@@ -441,7 +450,7 @@ def apply(ethernet):
         e.remove()
     else:
         e.update(ethernet)
-    if 'static_arp' in ethernet:
+    if 'static_arp' in ethernet or 'vpp_acl_dependent' in ethernet:
         call_dependents()
 
     vpp_iface_config = dict_search(f'vpp.settings.interface.{ifname}', ethernet)
diff --git a/src/conf_mode/vpp_acl.py b/src/conf_mode/vpp_acl.py
index ccbe11763..5b282dfdc 100644
--- a/src/conf_mode/vpp_acl.py
+++ b/src/conf_mode/vpp_acl.py
@@ -25,6 +25,7 @@ from vyos.configdict import node_changed
 from vyos.config import Config
 from vyos.utils.network import get_protocol_by_name
 
+from vyos.vpp.utils import cli_ethernet_with_vifs_ifaces
 from vyos.vpp.utils import cli_ifaces_list
 from vyos.vpp.acl import Acl
 from vyos.vpp.config_verify import verify_vpp_interface_not_a_member
@@ -184,7 +185,11 @@ def get_config(config=None) -> dict:
         {
             'changed_ip_ifaces': changed_ip_ifaces,
             'changed_mac_ifaces': changed_mac_ifaces,
-            'vpp_ifaces': cli_ifaces_list(conf),
+            'vpp_ifaces': list(
+                dict.fromkeys(
+                    cli_ifaces_list(conf) + cli_ethernet_with_vifs_ifaces(conf)
+                )
+            ),
         }
     )