Merge pull request #5129 from inetman28/fix-acl-subinterfaces

VPP: T8495: fix issue with assigning  acl on sub interfaces

2 files changed, 46 insertions, 1 deletions

diff --git a/smoketest/scripts/cli/test_vpp.py b/smoketest/scripts/cli/test_vpp.py
index e987da8df..59dbb2272 100755
--- a/smoketest/scripts/cli/test_vpp.py
+++ b/smoketest/scripts/cli/test_vpp.py
@@ -1454,6 +1454,46 @@ class TestVPP(VyOSUnitTestSHIM.TestCase):
         # Ensure that VPP process is active
         self.assertTrue(process_named_running(PROCESS_NAME))
 
+    def test_23_vpp_acl_subinterface(self):
+        base_acl = base_path + ['acl', 'ip']
+        vlan = '200'
+        subif = f'{interface}.{vlan}'
+        acl_name = 'STATEFUL'
+        acl_tag = '10'
+        rule = '10'
+
+        self.cli_set(['interfaces', 'ethernet', interface, 'vif', vlan])
+        self.cli_set(
+            base_acl + ['tag-name', acl_name, 'rule', rule, 'action', 'permit']
+        )
+        self.cli_set(
+            base_acl
+            + ['interface', subif, 'input', 'acl-tag', acl_tag, 'tag-name', acl_name]
+        )
+        self.cli_commit()
+
+        vpp = VPPControl()
+        subif_index = vpp.get_sw_if_index(subif)
+        self.assertIsNotNone(subif_index)
+
+        acl_index = None
+        for acl in vpp.api.acl_dump(acl_index=0xFFFFFFFF):
+            if acl.tag == acl_name:
+                acl_index = acl.acl_index
+                break
+        self.assertIsNotNone(acl_index)
+
+        acl_interfaces = [
+            entry
+            for entry in vpp.api.acl_interface_list_dump()
+            if entry.sw_if_index == subif_index and entry.count != 0
+        ]
+        self.assertEqual(len(acl_interfaces), 1)
+        self.assertEqual(acl_interfaces[0].n_input, 1)
+        self.assertEqual(
+            list(acl_interfaces[0].acls)[: acl_interfaces[0].count], [acl_index]
+        )
+
 
 if __name__ == '__main__':
     unittest.main(verbosity=2, failfast=VyOSUnitTestSHIM.TestCase.debug_on())
diff --git a/src/conf_mode/vpp_acl.py b/src/conf_mode/vpp_acl.py
index ccbe11763..5b282dfdc 100644
--- a/src/conf_mode/vpp_acl.py
+++ b/src/conf_mode/vpp_acl.py
@@ -25,6 +25,7 @@ from vyos.configdict import node_changed
 from vyos.config import Config
 from vyos.utils.network import get_protocol_by_name
 
+from vyos.vpp.utils import cli_ethernet_with_vifs_ifaces
 from vyos.vpp.utils import cli_ifaces_list
 from vyos.vpp.acl import Acl
 from vyos.vpp.config_verify import verify_vpp_interface_not_a_member
@@ -184,7 +185,11 @@ def get_config(config=None) -> dict:
         {
             'changed_ip_ifaces': changed_ip_ifaces,
             'changed_mac_ifaces': changed_mac_ifaces,
-            'vpp_ifaces': cli_ifaces_list(conf),
+            'vpp_ifaces': list(
+                dict.fromkeys(
+                    cli_ifaces_list(conf) + cli_ethernet_with_vifs_ifaces(conf)
+                )
+            ),
         }
     )