[Yang] Incorrect definition of IN_PORTS and OUT_PORTS in sonic-acl.yang

[lizhijianrd]

Description

The type of IN_PORTS and OUT_PORTS at sonic-acl.yang.j2#L131 is incorrect.

According to Everflow-test-plan, it should be a string, not uint16. The string format should be a list of SONiC interface name separated by comma, like `"Ethernet3,Ethernet4".

According to Sonic-mclag-hld, OUT_PORTS should be a string of the same format.

This bug causes GCU cannot add/update data-plane ACL rules with IN_PORTS and OUT_PORTS.

Steps to reproduce the issue:

1. Setup custom ACL table type on DUT.
   a. Write below content to file acl_table_types.json on DUT:

   {
       "ACL_TABLE_TYPE": {
           "BMCDATAV6": {
               "MATCHES": "SRC_IPV6,DST_IPV6,ETHER_TYPE,IP_TYPE,IP_PROTOCOL,IN_PORTS,L4_SRC_PORT,L4_DST_PORT,L4_SRC_PORT_RANGE,L4_DST_PORT_RANGE",
               "ACTIONS": "PACKET_ACTION,COUNTER",
               "BIND_POINTS": "PORT"
           }
       }
   }

   b. Add custom ACL table type to config_db: sonic-cfggen -j acl_table_types.json -w
2. Create ACL table on DUT: sudo config acl add table SAMPLE_ACL_TABLE BMCDATAV6 -p Ethernet1,Ethernet2 -s ingress.
3. Add first ACL rule to config_db via acl-loader:
   a. Write below content to file acl_rules.json on DUT:

   {
       "acl": {
           "acl-sets": {
               "acl-set": {
                   "SAMPLE_ACL_TABLE": {
                       "acl-entries": {
                           "acl-entry": {
                               "RULE_1": {
                                   "actions": {
                                       "config": {
                                           "forwarding-action": "DROP"
                                       }
                                   },
                                   "config": {
                                       "sequence-id": 1
                                   },
                                   "input_interface": {
                                       "interface_ref": {
                                           "config": {
                                               "interface": "Ethernet1"
                                           }
                                       }
                                   }
                               }
                           }
                       }
                   }
               }
           }
       }
   }

   b. Use acl-loader to load above ACL rule: acl-loader update full --table_name SAMPLE_ACL_TABLE acl_rules.json.
4. Add second ACL rule to config_db via GCU:
   a. Write below content to file patch.json on DUT:

   [
       {
           "op": "add",
           "path": "/ACL_RULE/SAMPLE_ACL_TABLE|RULE_3000",
           "value": {
               "PACKET_ACTION": "FORWARD",
               "PRIORITY": "7000",
               "IN_PORTS": "Ethernet2"
           }
       }
   ]

   b. Use GCU to apply above patch: sudo config apply-patch patch.json

Describe the results you received:

At step 4.b, I got below error on DUT:

$ sudo config apply-patch patch.json
Patch Applier: Patch application starting.
Patch Applier: Patch: [{"op": "add", "path": "/ACL_RULE/SAMPLE_ACL_TABLE|RULE_3000", "value": {"PACKET_ACTION": "FORWARD", "PRIORITY": "7000", "IN_PORTS": "Ethernet2"}}]
Patch Applier: Getting current config db.
Patch Applier: Simulating the target full config after applying the patch.
Patch Applier: Validating all JsonPatch operations are permitted on the specified fields
Patch Applier: Validating target config does not have empty tables, since they do not show up in ConfigDb.
Patch Applier: Sorting patch updates.
Failed to apply patch
Usage: config apply-patch [OPTIONS] PATCH_FILE_PATH
Try "config apply-patch -h" for help.

Error: Given patch will produce invalid config. Error: Data Loading Failed
All Keys are not parsed in ACL_RULE
dict_keys(['SAMPLE_ACL_TABLE|RULE_1', 'SAMPLE_ACL_TABLE|RULE_3000'])
exceptionList:["invalid literal for int() with base 10: 'E'", "invalid literal for int() with base 10: 'E'"]

From the error message we can see both the first ACL rule (already exist in config_db) and the second ACL rule (in GCU patch) cannot pass Yang validation. They failed on key IN_PORTS, which should be a string, but incorrectly defined as uint16 in Yang model.

Describe the results you expected:

Expect step 4.b can apply the second ACL rule on DUT successfully.

Output of show version:

Can repro this issue on 202205.

Output of show techsupport:

(paste your output here or download and attach the file here )

Additional information you deem important (e.g. issue happens only occasionally):

[bingwang-ms]

So we can load ACL rules with "IN_PORTS" with acl-loader, but it's not accepted when using config apply-patch, right?

[lizhijianrd]

So we can load ACL rules with "IN_PORTS" with acl-loader, but it's not accepted when using config apply-patch, right?

Yes, you are right.