aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/AbstractAclServiceImpl.java

   1 /*
   2  * Copyright (c) 2016 Red Hat, Inc. and others. All rights reserved.
   3  *
   4  * This program and the accompanying materials are made available under the
   5  * terms of the Eclipse Public License v1.0 which accompanies this distribution,
   6  * and is available at http://www.eclipse.org/legal/epl-v10.html
   7  */
   8 package org.opendaylight.netvirt.aclservice;
   9
  10 import static org.opendaylight.genius.infra.Datastore.CONFIGURATION;
  11
  12 import com.google.common.collect.Lists;
  13 import java.math.BigInteger;
  14 import java.util.ArrayList;
  15 import java.util.Collection;
  16 import java.util.Collections;
  17 import java.util.HashMap;
  18 import java.util.HashSet;
  19 import java.util.List;
  20 import java.util.Map;
  21 import java.util.Map.Entry;
  22 import java.util.Set;
  23 import java.util.SortedSet;
  24 import java.util.stream.Collectors;
  25 import org.eclipse.jdt.annotation.Nullable;
  26 import org.opendaylight.controller.md.sal.binding.api.DataBroker;
  27 import org.opendaylight.genius.infra.ManagedNewTransactionRunner;
  28 import org.opendaylight.genius.infra.ManagedNewTransactionRunnerImpl;
  29 import org.opendaylight.genius.mdsalutil.ActionInfo;
  30 import org.opendaylight.genius.mdsalutil.FlowEntity;
  31 import org.opendaylight.genius.mdsalutil.InstructionInfo;
  32 import org.opendaylight.genius.mdsalutil.MDSALUtil;
  33 import org.opendaylight.genius.mdsalutil.MatchInfoBase;
  34 import org.opendaylight.genius.mdsalutil.NwConstants;
  35 import org.opendaylight.genius.mdsalutil.actions.ActionNxConntrack;
  36 import org.opendaylight.genius.mdsalutil.actions.ActionNxConntrack.NxCtAction;
  37 import org.opendaylight.genius.mdsalutil.actions.ActionNxCtClear;
  38 import org.opendaylight.genius.mdsalutil.actions.ActionNxResubmit;
  39 import org.opendaylight.genius.mdsalutil.instructions.InstructionApplyActions;
  40 import org.opendaylight.genius.mdsalutil.interfaces.IMdsalApiManager;
  41 import org.opendaylight.genius.mdsalutil.matches.MatchEthernetType;
  42 import org.opendaylight.genius.mdsalutil.matches.MatchMetadata;
  43 import org.opendaylight.genius.mdsalutil.nxmatches.NxMatchCtState;
  44 import org.opendaylight.infrautils.jobcoordinator.JobCoordinator;
  45 import org.opendaylight.netvirt.aclservice.api.AclInterfaceCache;
  46 import org.opendaylight.netvirt.aclservice.api.AclServiceListener;
  47 import org.opendaylight.netvirt.aclservice.api.AclServiceManager.Action;
  48 import org.opendaylight.netvirt.aclservice.api.utils.AclInterface;
  49 import org.opendaylight.netvirt.aclservice.utils.AclConntrackClassifierType;
  50 import org.opendaylight.netvirt.aclservice.utils.AclConstants;
  51 import org.opendaylight.netvirt.aclservice.utils.AclDataUtil;
  52 import org.opendaylight.netvirt.aclservice.utils.AclServiceOFFlowBuilder;
  53 import org.opendaylight.netvirt.aclservice.utils.AclServiceUtils;
  54 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.Acl;
  55 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.AccessListEntries;
  56 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.Ace;
  57 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.Matches;
  58 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.matches.ace.type.AceIp;
  59 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.matches.ace.type.ace.ip.ace.ip.version.AceIpv4;
  60 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.yang.types.rev130715.Uuid;
  61 import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.servicebinding.rev160406.ServiceModeBase;
  62 import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.servicebinding.rev160406.ServiceModeEgress;
  63 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.DirectionBase;
  64 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.DirectionEgress;
  65 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.DirectionIngress;
  66 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.InterfaceAcl.InterfaceType;
  67 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.SecurityRuleAttr;
  68 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.interfaces._interface.AllowedAddressPairs;
  69 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.interfaces._interface.SubnetInfo;
  70 import org.opendaylight.yangtools.yang.common.Uint64;
  71 import org.slf4j.Logger;
  72 import org.slf4j.LoggerFactory;
  73
  74 public abstract class AbstractAclServiceImpl implements AclServiceListener {
  75
  76     private static final Logger LOG = LoggerFactory.getLogger(AbstractAclServiceImpl.class);
  77
  78     protected final IMdsalApiManager mdsalManager;
  79     protected final ManagedNewTransactionRunner txRunner;
  80     protected final Class<? extends ServiceModeBase> serviceMode;
  81     protected final AclDataUtil aclDataUtil;
  82     protected final AclServiceUtils aclServiceUtils;
  83     protected final JobCoordinator jobCoordinator;
  84     protected final AclInterfaceCache aclInterfaceCache;
  85
  86     protected final Class<? extends DirectionBase> direction;
  87     protected final String directionString;
  88
  89     /**
  90      * Initialize the member variables.
  91      *
  92      * @param serviceMode the service mode
  93      * @param dataBroker the data broker instance.
  94      * @param mdsalManager the mdsal manager instance.
  95      * @param aclDataUtil the acl data util.
  96      * @param aclServiceUtils the acl service util.
  97      * @param jobCoordinator the job coordinator
  98      * @param aclInterfaceCache the acl interface cache
  99      */
 100     public AbstractAclServiceImpl(Class<? extends ServiceModeBase> serviceMode, DataBroker dataBroker,
 101             IMdsalApiManager mdsalManager, AclDataUtil aclDataUtil, AclServiceUtils aclServiceUtils,
 102             JobCoordinator jobCoordinator, AclInterfaceCache aclInterfaceCache) {
 103         this.txRunner = new ManagedNewTransactionRunnerImpl(dataBroker);
 104         this.mdsalManager = mdsalManager;
 105         this.serviceMode = serviceMode;
 106         this.aclDataUtil = aclDataUtil;
 107         this.aclServiceUtils = aclServiceUtils;
 108         this.jobCoordinator = jobCoordinator;
 109         this.aclInterfaceCache = aclInterfaceCache;
 110
 111         this.direction =
 112                 this.serviceMode.equals(ServiceModeEgress.class) ? DirectionIngress.class : DirectionEgress.class;
 113         this.directionString = this.direction.equals(DirectionEgress.class) ? "Egress" : "Ingress";
 114     }
 115
 116     @Override
 117     public boolean applyAcl(AclInterface port) {
 118         if (port == null) {
 119             LOG.error("port cannot be null");
 120             return false;
 121         }
 122         BigInteger dpId = port.getDpId();
 123         if (dpId == null || port.getLPortTag() == null) {
 124             LOG.error("Unable to find DpId from ACL interface with id {}", port.getInterfaceId());
 125             return false;
 126         }
 127
 128         LOG.debug("Applying ACL on port {} with DpId {}", port, dpId);
 129         List<FlowEntity> flowEntries = new ArrayList<>();
 130         if (port.getInterfaceType() == InterfaceType.DhcpService) {
 131             programDhcpService(flowEntries, port, Action.ADD, NwConstants.ADD_FLOW);
 132         } else {
 133             if (port.getSecurityGroups() == null) {
 134                 LOG.info("Port {} without SGs", port.getInterfaceId());
 135                 return false;
 136             }
 137             programAcl(flowEntries, port, Action.ADD, NwConstants.ADD_FLOW);
 138             updateRemoteAclFilterTable(flowEntries, port, NwConstants.ADD_FLOW);
 139         }
 140         programFlows(AclConstants.ACL_JOB_KEY_PREFIX + port.getInterfaceId(), flowEntries, NwConstants.ADD_FLOW);
 141         return true;
 142     }
 143
 144     @Override
 145     public boolean bindAcl(AclInterface port) {
 146         if (port == null) {
 147             LOG.error("Port cannot be null for binding ACL service");
 148             return false;
 149         }
 150         bindService(port);
 151         return true;
 152     }
 153
 154     @Override
 155     public boolean unbindAcl(AclInterface port) {
 156         if (port == null) {
 157             LOG.error("Port cannot be null for unbinding ACL service");
 158             return false;
 159         }
 160         if (port.getDpId() != null) {
 161             unbindService(port);
 162         }
 163         return true;
 164     }
 165
 166     @Override
 167     public boolean updateAcl(AclInterface portBefore, AclInterface portAfter) {
 168         // this check is to avoid situations of port update coming before interface state is up
 169         if (portAfter.getDpId() == null || portAfter.getLPortTag() == null) {
 170             LOG.debug("Unable to find DpId from ACL interface with id {} and lport {}", portAfter.getInterfaceId(),
 171                     portAfter.getLPortTag());
 172             return false;
 173         }
 174         boolean result = true;
 175         boolean isPortSecurityEnable = portAfter.isPortSecurityEnabled();
 176         boolean isPortSecurityEnableBefore = portBefore.isPortSecurityEnabled();
 177         // if port security is changed, apply/remove Acls
 178         if (isPortSecurityEnableBefore != isPortSecurityEnable) {
 179             LOG.debug("On ACL update, Port security is {} for {}", isPortSecurityEnable ? "Enabled" :
 180                     "Disabled", portAfter.getInterfaceId());
 181             if (isPortSecurityEnable) {
 182                 result = applyAcl(portAfter);
 183             } else {
 184                 result = removeAcl(portBefore);
 185             }
 186         } else if (isPortSecurityEnable) {
 187             // Acls has been updated, find added/removed Acls and act accordingly.
 188             processInterfaceUpdate(portBefore, portAfter);
 189             LOG.debug("On ACL update, ACL has been updated for {}", portAfter.getInterfaceId());
 190         } else if (portAfter.getInterfaceType() == InterfaceType.DhcpService) {
 191             processDhcpServiceInterfaceUpdate(portBefore, portAfter);
 192         }
 193
 194         return result;
 195     }
 196
 197     private void processDhcpServiceInterfaceUpdate(AclInterface portBefore, AclInterface portAfter) {
 198         List<FlowEntity> addFlowEntries = new ArrayList<>();
 199         List<FlowEntity> deleteFlowEntries = new ArrayList<>();
 200         List<AllowedAddressPairs> addedAaps = AclServiceUtils
 201                 .getUpdatedAllowedAddressPairs(portAfter.getAllowedAddressPairs(), portBefore.getAllowedAddressPairs());
 202         List<AllowedAddressPairs> deletedAaps = AclServiceUtils
 203                 .getUpdatedAllowedAddressPairs(portBefore.getAllowedAddressPairs(), portAfter.getAllowedAddressPairs());
 204         if (deletedAaps != null && !deletedAaps.isEmpty()) {
 205             processDhcpServiceUpdate(deleteFlowEntries, portBefore, deletedAaps, NwConstants.DEL_FLOW);
 206         }
 207         if (addedAaps != null && !addedAaps.isEmpty()) {
 208             processDhcpServiceUpdate(addFlowEntries, portAfter, addedAaps, NwConstants.ADD_FLOW);
 209         }
 210         programFlows(AclConstants.ACL_JOB_KEY_PREFIX + portAfter.getInterfaceId(), deleteFlowEntries,
 211                 NwConstants.DEL_FLOW);
 212         programFlows(AclConstants.ACL_JOB_KEY_PREFIX + portAfter.getInterfaceId(), addFlowEntries,
 213                 NwConstants.ADD_FLOW);
 214     }
 215
 216     private void processInterfaceUpdate(AclInterface portBefore, AclInterface portAfter) {
 217         List<FlowEntity> addFlowEntries = new ArrayList<>();
 218         List<FlowEntity> deleteFlowEntries = new ArrayList<>();
 219         List<AllowedAddressPairs> addedAaps = AclServiceUtils
 220                 .getUpdatedAllowedAddressPairs(portAfter.getAllowedAddressPairs(), portBefore.getAllowedAddressPairs());
 221         List<AllowedAddressPairs> deletedAaps = AclServiceUtils
 222                 .getUpdatedAllowedAddressPairs(portBefore.getAllowedAddressPairs(), portAfter.getAllowedAddressPairs());
 223         if (deletedAaps != null && !deletedAaps.isEmpty()) {
 224             programAclWithAllowedAddress(deleteFlowEntries, portBefore, deletedAaps, Action.UPDATE,
 225                     NwConstants.DEL_FLOW);
 226             updateRemoteAclFilterTable(deleteFlowEntries, portBefore, portBefore.getSecurityGroups(), deletedAaps,
 227                     NwConstants.DEL_FLOW);
 228         }
 229         if (addedAaps != null && !addedAaps.isEmpty()) {
 230             programAclWithAllowedAddress(addFlowEntries, portAfter, addedAaps, Action.UPDATE, NwConstants.ADD_FLOW);
 231             updateRemoteAclFilterTable(addFlowEntries, portAfter, portAfter.getSecurityGroups(), addedAaps,
 232                     NwConstants.ADD_FLOW);
 233         }
 234         if (portAfter.getSubnetInfo() != null && portBefore.getSubnetInfo() == null) {
 235             programBroadcastRules(addFlowEntries, portAfter, Action.UPDATE, NwConstants.ADD_FLOW);
 236         }
 237         handleSubnetChange(portBefore, portAfter, addFlowEntries, deleteFlowEntries);
 238
 239         List<Uuid> addedAcls = AclServiceUtils.getUpdatedAclList(portAfter.getSecurityGroups(),
 240                 portBefore.getSecurityGroups());
 241         List<Uuid> deletedAcls = AclServiceUtils.getUpdatedAclList(portBefore.getSecurityGroups(),
 242                 portAfter.getSecurityGroups());
 243         if (!deletedAcls.isEmpty() || !addedAcls.isEmpty()) {
 244             handleAclChange(deleteFlowEntries, portBefore, deletedAcls, NwConstants.DEL_FLOW);
 245             handleAclChange(addFlowEntries, portAfter, addedAcls, NwConstants.ADD_FLOW);
 246         }
 247
 248         programFlows(AclConstants.ACL_JOB_KEY_PREFIX + portAfter.getInterfaceId(), deleteFlowEntries,
 249                 NwConstants.DEL_FLOW);
 250         programFlows(AclConstants.ACL_JOB_KEY_PREFIX + portAfter.getInterfaceId(), addFlowEntries,
 251                 NwConstants.ADD_FLOW);
 252     }
 253
 254     private void handleSubnetChange(AclInterface portBefore, AclInterface portAfter,
 255             List<FlowEntity> addFlowEntries, List<FlowEntity> deleteFlowEntries) {
 256         List<SubnetInfo> deletedSubnets =
 257                 AclServiceUtils.getSubnetDiff(portBefore.getSubnetInfo(), portAfter.getSubnetInfo());
 258         List<SubnetInfo> addedSubnets =
 259                 AclServiceUtils.getSubnetDiff(portAfter.getSubnetInfo(), portBefore.getSubnetInfo());
 260
 261         if (deletedSubnets != null && !deletedSubnets.isEmpty()) {
 262             programIcmpv6RARule(deleteFlowEntries, portAfter, deletedSubnets, NwConstants.DEL_FLOW);
 263             programSubnetBroadcastRules(deleteFlowEntries, portAfter, deletedSubnets, NwConstants.DEL_FLOW);
 264         }
 265         if (addedSubnets != null && !addedSubnets.isEmpty()) {
 266             programIcmpv6RARule(addFlowEntries, portAfter, addedSubnets, NwConstants.ADD_FLOW);
 267             programSubnetBroadcastRules(addFlowEntries, portAfter, addedSubnets, NwConstants.ADD_FLOW);
 268         }
 269     }
 270
 271     private void handleAclChange(List<FlowEntity> flowEntries, AclInterface port, List<Uuid> aclList,
 272             int addOrRemove) {
 273         int operationForAclRules = addOrRemove == NwConstants.DEL_FLOW ? NwConstants.MOD_FLOW : addOrRemove;
 274         programAclRules(flowEntries, port, aclList, operationForAclRules);
 275         updateRemoteAclFilterTable(flowEntries, port, aclList, port.getAllowedAddressPairs(), addOrRemove);
 276         programAclDispatcherTable(flowEntries, port, addOrRemove);
 277     }
 278
 279     protected SortedSet<Integer> getRemoteAclTags(AclInterface port) {
 280         return this.direction == DirectionIngress.class ? port.getIngressRemoteAclTags()
 281                 : port.getEgressRemoteAclTags();
 282     }
 283
 284     protected void programAclDispatcherTable(List<FlowEntity> flowEntries, AclInterface port, int addOrRemove) {
 285         SortedSet<Integer> remoteAclTags = getRemoteAclTags(port);
 286         if (remoteAclTags.isEmpty()) {
 287             LOG.debug("No {} rules with remote group id for port={}", this.directionString, port.getInterfaceId());
 288             return;
 289         }
 290         Integer firstRemoteAclTag = remoteAclTags.first();
 291         Integer lastRemoteAclTag = remoteAclTags.last();
 292
 293         programFirstRemoteAclEntryInDispatcherTable(flowEntries, port, firstRemoteAclTag, addOrRemove);
 294         programLastRemoteAclEntryInDispatcherTable(flowEntries, port, lastRemoteAclTag, addOrRemove);
 295
 296         Integer previousRemoteAclTag = firstRemoteAclTag;
 297         for (Integer remoteAclTag : remoteAclTags) {
 298             if (remoteAclTag.equals(firstRemoteAclTag)) {
 299                 continue;
 300             }
 301             List<MatchInfoBase> matches = new ArrayList<>();
 302             matches.addAll(AclServiceUtils.buildMatchesForLPortTagAndRemoteAclTag(port.getLPortTag(),
 303                     previousRemoteAclTag, serviceMode));
 304             String flowId = this.directionString + "_ACL_Dispatcher_" + port.getDpId() + "_" + port.getLPortTag() + "_"
 305                     + remoteAclTag;
 306
 307             List<InstructionInfo> instructions =
 308                     AclServiceOFFlowBuilder.getGotoInstructionInfo(getAclRuleBasedFilterTable());
 309             instructions.add(AclServiceUtils.getWriteMetadataForRemoteAclTag(remoteAclTag));
 310             addFlowEntryToList(flowEntries, Uint64.valueOf(port.getDpId()), getAclFilterCumDispatcherTable(), flowId,
 311                     AclConstants.ACE_GOTO_NEXT_REMOTE_ACL_PRIORITY, 0, 0, AclConstants.COOKIE_ACL_BASE, matches,
 312                     instructions, addOrRemove);
 313
 314             previousRemoteAclTag = remoteAclTag;
 315         }
 316     }
 317
 318     protected void programFirstRemoteAclEntryInDispatcherTable(List<FlowEntity> flowEntries, AclInterface port,
 319             Integer firstRemoteAclTag, int addOrRemove) {
 320         List<MatchInfoBase> matches = new ArrayList<>();
 321         matches.add(AclServiceUtils.buildLPortTagMatch(port.getLPortTag(), serviceMode));
 322         String flowId = this.directionString + "_ACL_Dispatcher_First_" + port.getDpId() + "_" + port.getLPortTag()
 323                 + "_" + firstRemoteAclTag;
 324
 325         List<InstructionInfo> instructions =
 326                 AclServiceOFFlowBuilder.getGotoInstructionInfo(getAclRuleBasedFilterTable());
 327         instructions.add(AclServiceUtils.getWriteMetadataForRemoteAclTag(firstRemoteAclTag));
 328         addFlowEntryToList(flowEntries, Uint64.valueOf(port.getDpId()), getAclFilterCumDispatcherTable(), flowId,
 329                 AclConstants.ACE_FIRST_REMOTE_ACL_PRIORITY, 0, 0, AclConstants.COOKIE_ACL_BASE, matches, instructions,
 330                 addOrRemove);
 331     }
 332
 333     protected void programLastRemoteAclEntryInDispatcherTable(List<FlowEntity> flowEntries, AclInterface port,
 334             Integer lastRemoteAclTag, int addOrRemove) {
 335         List<MatchInfoBase> matches = new ArrayList<>();
 336         matches.addAll(AclServiceUtils.buildMatchesForLPortTagAndRemoteAclTag(port.getLPortTag(), lastRemoteAclTag,
 337                 serviceMode));
 338         String flowId = this.directionString + "_ACL_Dispatcher_Last_" + port.getDpId() + "_" + port.getLPortTag() + "_"
 339                 + lastRemoteAclTag;
 340
 341         List<InstructionInfo> instructions = AclServiceOFFlowBuilder.getDropInstructionInfo();
 342         addFlowEntryToList(flowEntries, Uint64.valueOf(port.getDpId()), getAclFilterCumDispatcherTable(), flowId,
 343                 AclConstants.ACE_LAST_REMOTE_ACL_PRIORITY, 0, 0, AclServiceUtils.getDropFlowCookie(port.getLPortTag()),
 344                 matches, instructions, addOrRemove);
 345     }
 346
 347     private void programAcl(List<FlowEntity> flowEntries, AclInterface port, Action action, int addOrRemove) {
 348         programAclWithAllowedAddress(flowEntries, port, port.getAllowedAddressPairs(), action, addOrRemove);
 349     }
 350
 351     private void programAclWithAllowedAddress(List<FlowEntity> flowEntries, AclInterface port,
 352             List<AllowedAddressPairs> allowedAddresses, Action action, int addOrRemove) {
 353         Uint64 dpId = Uint64.valueOf(port.getDpId());
 354         int lportTag = port.getLPortTag();
 355         LOG.debug("Applying ACL Allowed Address on DpId {}, lportTag {}, Action {}", dpId, lportTag, action);
 356         String portId = port.getInterfaceId();
 357         programAntiSpoofingRules(flowEntries, port, allowedAddresses, action, addOrRemove);
 358         programAclPortSpecificFixedRules(flowEntries, dpId, allowedAddresses, lportTag, portId, action, addOrRemove);
 359         if (action == Action.ADD || action == Action.REMOVE) {
 360             programAclRules(flowEntries, port, port.getSecurityGroups(), addOrRemove);
 361             programAclDispatcherTable(flowEntries, port, addOrRemove);
 362         }
 363     }
 364
 365     /**
 366      * Programs the acl custom rules.
 367      *
 368      * @param flowEntries the flow entries
 369      * @param port acl interface
 370      * @param aclUuidList the list of acl uuid to be applied
 371      * @param addOrRemove whether to delete or add flow
 372      * @return program succeeded
 373      */
 374     protected boolean programAclRules(List<FlowEntity> flowEntries, AclInterface port, List<Uuid> aclUuidList,
 375             int addOrRemove) {
 376         BigInteger dpId = port.getDpId();
 377         LOG.debug("Applying custom rules on DpId {}, lportTag {}", dpId, port.getLPortTag());
 378         if (aclUuidList == null || dpId == null) {
 379             LOG.warn("{} ACL parameters can not be null. dpId={}, aclUuidList={}", this.directionString, dpId,
 380                     aclUuidList);
 381             return false;
 382         }
 383         for (Uuid aclUuid : aclUuidList) {
 384             Acl acl = this.aclDataUtil.getAcl(aclUuid.getValue());
 385             if (null == acl) {
 386                 LOG.warn("The ACL {} not found in cache", aclUuid.getValue());
 387                 continue;
 388             }
 389             AccessListEntries accessListEntries = acl.getAccessListEntries();
 390             if (accessListEntries != null && accessListEntries.getAce() != null) {
 391                 for (Ace ace: accessListEntries.getAce()) {
 392                     programAceRule(flowEntries, port, aclUuid.getValue(), ace, addOrRemove);
 393                 }
 394             }
 395         }
 396         return true;
 397     }
 398
 399     /**
 400      * Programs the ace specific rule.
 401      *
 402      * @param flowEntries flow entries
 403      * @param port acl interface
 404      * @param aclName the acl name
 405      * @param ace rule to be program
 406      * @param addOrRemove whether to delete or add flow
 407      */
 408     protected void programAceRule(List<FlowEntity> flowEntries, AclInterface port, String aclName, Ace ace,
 409             int addOrRemove) {
 410         SecurityRuleAttr aceAttr = AclServiceUtils.getAccessListAttributes(ace);
 411         if (aceAttr == null) {
 412             LOG.error("Ace {} of Acl {} is either null or not having SecurityRuleAttr",
 413                     ((ace == null) ? null : ace.getRuleName()), aclName);
 414             return;
 415         }
 416         if (addOrRemove == NwConstants.ADD_FLOW && aceAttr.isDeleted()) {
 417             LOG.trace("Ignoring {} rule which is already deleted", ace.getRuleName());
 418             return;
 419         }
 420         if (!isValidDirection(aceAttr.getDirection())) {
 421             LOG.trace("Ignoring {} direction while processing for {} ACE Rule {}", aceAttr.getDirection(),
 422                     this.directionString, ace.getRuleName());
 423             return;
 424         }
 425         LOG.debug("Program {} ACE rule for dpId={}, lportTag={}, addOrRemove={}, ace={}, portId={}",
 426                 this.directionString, port.getDpId(), port.getLPortTag(), addOrRemove, ace.getRuleName(),
 427                 port.getInterfaceId());
 428
 429         Matches matches = ace.getMatches();
 430         if (matches != null && matches.getAceType() instanceof AceIp) {
 431             Map<String, List<MatchInfoBase>> flowMap = AclServiceOFFlowBuilder.programIpFlow(matches);
 432             if (!AclServiceUtils.doesAceHaveRemoteGroupId(aceAttr)) {
 433                 // programming for ACE which doesn't have any remote group Id
 434                 programForAceNotHavingRemoteAclId(flowEntries, port, aclName, ace, flowMap, addOrRemove);
 435             } else {
 436                 Uuid remoteAclId = aceAttr.getRemoteGroupId();
 437                 // programming for ACE which have remote group Id
 438                 programAceSpecificFlows(flowEntries, port, aclName, ace, flowMap, remoteAclId, addOrRemove);
 439             }
 440         }
 441     }
 442
 443     protected void programForAceNotHavingRemoteAclId(List<FlowEntity> flowEntries, AclInterface port, String aclName,
 444             Ace ace, @Nullable Map<String, List<MatchInfoBase>> flowMap, int addOrRemove) {
 445         if (null == flowMap) {
 446             return;
 447         }
 448         MatchInfoBase lportTagMatch = AclServiceUtils.buildLPortTagMatch(port.getLPortTag(), serviceMode);
 449         List<InstructionInfo> instructions = AclServiceOFFlowBuilder.getGotoInstructionInfo(getAclCommitterTable());
 450         Integer flowPriority = this.aclServiceUtils.getAceFlowPriority(aclName);
 451
 452         for (Entry<String, List<MatchInfoBase>> entry : flowMap.entrySet()) {
 453             String flowName = entry.getKey();
 454             List<MatchInfoBase> matches = entry.getValue();
 455             matches.add(lportTagMatch);
 456             String flowId = flowName + this.directionString + "_" + port.getDpId() + "_" + port.getLPortTag() + "_"
 457                     + ace.key().getRuleName();
 458
 459             int operation = addOrRemove == NwConstants.MOD_FLOW ? NwConstants.DEL_FLOW : addOrRemove;
 460             addFlowEntryToList(flowEntries, Uint64.valueOf(port.getDpId()), getAclFilterCumDispatcherTable(),
 461                     flowId, flowPriority, 0, 0, AclConstants.COOKIE_ACL_BASE, matches, instructions, operation);
 462
 463             if (addOrRemove != NwConstants.DEL_FLOW) {
 464                 programAclForExistingTrafficTable(port, ace, addOrRemove, flowName, matches, flowPriority);
 465             }
 466         }
 467     }
 468
 469     protected void programAceSpecificFlows(List<FlowEntity> flowEntries, AclInterface port, String aclName, Ace ace,
 470             @Nullable Map<String, List<MatchInfoBase>> flowMap, Uuid remoteAclId, int addOrRemove) {
 471         if (null == flowMap) {
 472             return;
 473         }
 474         Integer remoteAclTag = this.aclServiceUtils.getAclTag(remoteAclId);
 475         if (remoteAclTag == null || remoteAclTag == AclConstants.INVALID_ACL_TAG) {
 476             LOG.error("remoteAclTag={} is null or invalid for remoteAclId={}", remoteAclTag, remoteAclId);
 477             return;
 478         }
 479         List<MatchInfoBase> lportAndAclMatches =
 480                 AclServiceUtils.buildMatchesForLPortTagAndRemoteAclTag(port.getLPortTag(), remoteAclTag, serviceMode);
 481         List<InstructionInfo> instructions = AclServiceOFFlowBuilder.getGotoInstructionInfo(getAclRemoteAclTable());
 482         Integer flowPriority = this.aclServiceUtils.getAceFlowPriority(aclName);
 483
 484         for (Entry<String, List<MatchInfoBase>> entry : flowMap.entrySet()) {
 485             String flowName = entry.getKey();
 486             List<MatchInfoBase> matches = entry.getValue();
 487             matches.addAll(lportAndAclMatches);
 488             String flowId = flowName + this.directionString + "_" + port.getDpId() + "_" + port.getLPortTag() + "_"
 489                     + ace.key().getRuleName();
 490
 491             int operation = addOrRemove == NwConstants.MOD_FLOW ? NwConstants.DEL_FLOW : addOrRemove;
 492             addFlowEntryToList(flowEntries, Uint64.valueOf(port.getDpId()), getAclRuleBasedFilterTable(), flowId,
 493                     flowPriority, 0, 0, AclConstants.COOKIE_ACL_BASE, matches, instructions, operation);
 494
 495             if (addOrRemove != NwConstants.DEL_FLOW) {
 496                 programAclForExistingTrafficTable(port, ace, addOrRemove, flowName, matches, flowPriority);
 497             }
 498         }
 499     }
 500
 501     private void programAclForExistingTrafficTable(AclInterface port, Ace ace, int addOrRemove, String flowName,
 502             List<MatchInfoBase> matches, Integer priority) {
 503         AceIp acl = (AceIp) ace.getMatches().getAceType();
 504         final String newFlowName = flowName + this.directionString + "_" + port.getDpId() + "_" + port.getLPortTag()
 505                 + "_" + (acl.getAceIpVersion() instanceof AceIpv4 ? "_IPv4" : "_IPv6") + "_FlowAfterRuleDeleted";
 506
 507         final List<MatchInfoBase> newMatches =
 508                 matches.stream().filter(obj -> !(obj instanceof NxMatchCtState || obj instanceof MatchMetadata))
 509                         .collect(Collectors.toList());
 510         newMatches.add(AclServiceUtils.buildLPortTagMatch(port.getLPortTag(), serviceMode));
 511         newMatches.add(new NxMatchCtState(AclConstants.TRACKED_RPL_CT_STATE, AclConstants.TRACKED_RPL_CT_STATE_MASK));
 512
 513         List<InstructionInfo> instructions =
 514                 AclServiceUtils.createCtMarkInstructionForNewState(getAclFilterCumDispatcherTable(), port.getElanId());
 515         // Reversing the flow add/delete operation for this table.
 516         List<FlowEntity> flowEntries = new ArrayList<>();
 517         int operation = addOrRemove == NwConstants.ADD_FLOW ? NwConstants.DEL_FLOW : NwConstants.ADD_FLOW;
 518         addFlowEntryToList(flowEntries, Uint64.valueOf(port.getDpId()), getAclForExistingTrafficTable(), newFlowName,
 519                 priority, 0, AclServiceUtils.getHardTimoutForApplyStatefulChangeOnExistingTraffic(ace, aclServiceUtils),
 520                 AclConstants.COOKIE_ACL_BASE, newMatches, instructions, operation);
 521         programFlows(AclConstants.ACL_JOB_KEY_PREFIX + port.getInterfaceId(), flowEntries, operation);
 522     }
 523
 524     @Override
 525     public boolean removeAcl(AclInterface port) {
 526         if (port.getDpId() == null) {
 527             LOG.warn("Unable to find DP Id from ACL interface with id {}", port.getInterfaceId());
 528             return false;
 529         }
 530         List<FlowEntity> flowEntries = new ArrayList<>();
 531         if (port.getInterfaceType() == InterfaceType.DhcpService) {
 532             programDhcpService(flowEntries, port, Action.REMOVE, NwConstants.DEL_FLOW);
 533         } else {
 534             programAcl(flowEntries, port, Action.REMOVE, NwConstants.DEL_FLOW);
 535             updateRemoteAclFilterTable(flowEntries, port, NwConstants.DEL_FLOW);
 536         }
 537         programFlows(AclConstants.ACL_JOB_KEY_PREFIX + port.getInterfaceId(), flowEntries, NwConstants.DEL_FLOW);
 538         return true;
 539     }
 540
 541     @Override
 542     public boolean applyAce(AclInterface port, String aclName, Ace ace) {
 543         if (!port.isPortSecurityEnabled() || port.getDpId() == null) {
 544             return false;
 545         }
 546         List<FlowEntity> flowEntries = new ArrayList<>();
 547         programAceRule(flowEntries, port, aclName, ace, NwConstants.ADD_FLOW);
 548         programFlows(AclConstants.ACL_JOB_KEY_PREFIX + port.getInterfaceId(), flowEntries, NwConstants.ADD_FLOW);
 549         return true;
 550     }
 551
 552     @Override
 553     public boolean removeAce(AclInterface port, String aclName, Ace ace) {
 554         if (!port.isPortSecurityEnabled() || port.getDpId() == null) {
 555             return false;
 556         }
 557         List<FlowEntity> flowEntries = new ArrayList<>();
 558         programAceRule(flowEntries, port, aclName, ace, NwConstants.MOD_FLOW);
 559         programFlows(AclConstants.ACL_JOB_KEY_PREFIX + port.getInterfaceId(), flowEntries, NwConstants.DEL_FLOW);
 560         return true;
 561     }
 562
 563     @Override
 564     public void updateRemoteAcl(Acl aclBefore, Acl aclAfter, Collection<AclInterface> portsBefore) {
 565         handleRemoteAclUpdate(aclBefore, aclAfter, portsBefore);
 566     }
 567
 568     /**
 569      * Bind service.
 570      *
 571      * @param aclInterface the acl interface
 572      */
 573     public abstract void bindService(AclInterface aclInterface);
 574
 575     /**
 576      * Unbind service.
 577      *
 578      * @param aclInterface the acl interface
 579      */
 580     protected abstract void unbindService(AclInterface aclInterface);
 581
 582     /**
 583      * Programs DHCP Service flows.
 584      *
 585      * @param flowEntries the flow entries
 586      * @param port the acl interface
 587      * @param action add/modify/remove action
 588      * @param addOrRemove addorRemove
 589      */
 590     protected abstract void programDhcpService(List<FlowEntity> flowEntries, AclInterface port,
 591             Action action, int addOrRemove);
 592
 593     /**
 594      * Programs DHCP service flows.
 595      *
 596      * @param flowEntries the flow entries
 597      * @param port the acl interface
 598      * @param allowedAddresses the allowed addresses
 599      * @param addOrRemove addorRemove
 600      */
 601     protected abstract void processDhcpServiceUpdate(List<FlowEntity> flowEntries, AclInterface port,
 602             List<AllowedAddressPairs> allowedAddresses, int addOrRemove);
 603
 604     /**
 605      * Programs the anti-spoofing rules.
 606      *
 607      * @param flowEntries the flow entries
 608      * @param port the acl interface
 609      * @param allowedAddresses the allowed addresses
 610      * @param action add/modify/remove action
 611      * @param addOrRemove addorRemove
 612      */
 613     protected abstract void programAntiSpoofingRules(List<FlowEntity> flowEntries, AclInterface port,
 614             List<AllowedAddressPairs> allowedAddresses, Action action, int addOrRemove);
 615
 616     /**
 617      * Programs broadcast rules.
 618      *
 619      * @param flowEntries the flow entries
 620      * @param port the Acl Interface port
 621      * @param addOrRemove whether to delete or add flow
 622      */
 623     protected abstract void programBroadcastRules(List<FlowEntity> flowEntries, AclInterface port, Action action,
 624             int addOrRemove);
 625
 626     /**
 627      * Programs broadcast rules.
 628      *
 629      * @param flowEntries the flow entries
 630      * @param port the Acl Interface port
 631      * @param subnetInfoList the port subnet info list
 632      * @param addOrRemove whether to delete or add flow
 633      */
 634     protected abstract void programSubnetBroadcastRules(List<FlowEntity> flowEntries, AclInterface port,
 635             List<SubnetInfo> subnetInfoList, int addOrRemove);
 636
 637     protected abstract void programIcmpv6RARule(List<FlowEntity> flowEntries, AclInterface port,
 638             List<SubnetInfo> subnets, int addOrRemove);
 639
 640     /**
 641      * Add Flow to list.
 642      *
 643      * @param dpId
 644      *            the dpId
 645      * @param tableId
 646      *            the tableId
 647      * @param flowId
 648      *            the flowId
 649      * @param priority
 650      *            the priority
 651      * @param idleTimeOut
 652      *            the idle timeout
 653      * @param hardTimeOut
 654      *            the hard timeout
 655      * @param cookie
 656      *            the cookie
 657      * @param matches
 658      *            the list of matches to be writted
 659      * @param instructions
 660      *            the list of instruction to be written.
 661      * @param addOrRemove
 662      *            add or remove the entries.
 663      */
 664     protected void addFlowEntryToList(List<FlowEntity> flowEntries, Uint64 dpId, short tableId, String flowId,
 665             int priority, int idleTimeOut, int hardTimeOut, Uint64 cookie, List<? extends MatchInfoBase> matches,
 666             List<InstructionInfo> instructions, int addOrRemove) {
 667         List<InstructionInfo> instructionInfos = null;
 668         if (addOrRemove == NwConstants.ADD_FLOW) {
 669             instructionInfos = instructions;
 670         }
 671         FlowEntity flowEntity = MDSALUtil.buildFlowEntity(dpId, tableId, flowId, priority,
 672                 flowId, idleTimeOut, hardTimeOut, cookie, matches, instructionInfos);
 673         LOG.trace("Adding flow to list: DpnId {}, flowId {}", dpId, flowId);
 674         flowEntries.add(flowEntity);
 675     }
 676
 677     protected void programFlows(String jobName, List<FlowEntity> flowEntries, int addOrRemove) {
 678         List<List<FlowEntity>> flowEntityParts = Lists.partition(flowEntries, AclConstants.FLOWS_PER_TRANSACTION);
 679         for (List<FlowEntity> part : flowEntityParts) {
 680             jobCoordinator.enqueueJob(jobName,
 681                 () -> Collections.singletonList(txRunner.callWithNewReadWriteTransactionAndSubmit(CONFIGURATION,
 682                     tx -> {
 683                         if (addOrRemove == NwConstants.ADD_FLOW) {
 684                             for (FlowEntity flowEntity: part) {
 685                                 mdsalManager.addFlow(tx, flowEntity);
 686                             }
 687                         } else {
 688                             for (FlowEntity flowEntity: part) {
 689                                 mdsalManager.removeFlow(tx, flowEntity);
 690                             }
 691                         }
 692                     })), AclConstants.JOB_MAX_RETRIES);
 693         }
 694     }
 695
 696     protected List<InstructionInfo> getDispatcherTableResubmitInstructions() {
 697         return getDispatcherTableResubmitInstructions(new ArrayList<>());
 698     }
 699
 700     /**
 701      * Gets the dispatcher table resubmit instructions based on ingress/egress service mode w.r.t switch.
 702      *
 703      * @param actionsInfos
 704      *            the actions infos
 705      * @return the instructions for dispatcher table resubmit
 706      */
 707     protected List<InstructionInfo> getDispatcherTableResubmitInstructions(List<ActionInfo> actionsInfos) {
 708         short dispatcherTableId = NwConstants.LPORT_DISPATCHER_TABLE;
 709         if (ServiceModeEgress.class.equals(this.serviceMode)) {
 710             dispatcherTableId = NwConstants.EGRESS_LPORT_DISPATCHER_TABLE;
 711         }
 712
 713         List<InstructionInfo> instructions = new ArrayList<>();
 714         actionsInfos.add(new ActionNxResubmit(dispatcherTableId));
 715         instructions.add(new InstructionApplyActions(actionsInfos));
 716         return instructions;
 717     }
 718
 719     protected void handleRemoteAclUpdate(Acl aclBefore, Acl aclAfter, Collection<AclInterface> portsBefore) {
 720         String aclName = aclAfter.getAclName();
 721         Collection<AclInterface> interfaceList = aclDataUtil.getInterfaceList(new Uuid(aclName));
 722         if (interfaceList.isEmpty()) {
 723             LOG.trace("handleRemoteAclUpdate: No interfaces found with ACL={}", aclName);
 724             return;
 725         }
 726         Set<Uuid> remoteAclsBefore = AclServiceUtils.getRemoteAclIdsByDirection(aclBefore, this.direction);
 727         Set<Uuid> remoteAclsAfter = AclServiceUtils.getRemoteAclIdsByDirection(aclAfter, this.direction);
 728
 729         Set<Uuid> remoteAclsAdded = new HashSet<>(remoteAclsAfter);
 730         remoteAclsAdded.removeAll(remoteAclsBefore);
 731
 732         Set<Uuid> remoteAclsDeleted = new HashSet<>(remoteAclsBefore);
 733         remoteAclsDeleted.removeAll(remoteAclsAfter);
 734
 735         List<FlowEntity> addFlowEntries = new ArrayList<>();
 736         List<FlowEntity> deleteFlowEntries = new ArrayList<>();
 737         if (!remoteAclsAdded.isEmpty() || !remoteAclsDeleted.isEmpty()) {
 738             // delete and add flows in ACL dispatcher table for all applicable
 739             // ports
 740             for (AclInterface portBefore : portsBefore) {
 741                 programAclDispatcherTable(deleteFlowEntries, portBefore, NwConstants.DEL_FLOW);
 742             }
 743             for (AclInterface port : interfaceList) {
 744                 programAclDispatcherTable(addFlowEntries, port, NwConstants.ADD_FLOW);
 745             }
 746         }
 747         Set<BigInteger> dpns = interfaceList.stream().map(AclInterface::getDpId).collect(Collectors.toSet());
 748
 749         programRemoteAclTable(deleteFlowEntries, aclName, remoteAclsDeleted, dpns, NwConstants.DEL_FLOW);
 750         programRemoteAclTable(addFlowEntries, aclName, remoteAclsAdded, dpns, NwConstants.ADD_FLOW);
 751
 752         programFlows(aclName, deleteFlowEntries, NwConstants.DEL_FLOW);
 753         programFlows(aclName, addFlowEntries, NwConstants.ADD_FLOW);
 754     }
 755
 756     private void programRemoteAclTable(List<FlowEntity> flowEntries, String aclName, Set<Uuid> remoteAclIds,
 757             Set<BigInteger> dpns, int addOrRemove) {
 758         for (Uuid remoteAclId : remoteAclIds) {
 759             Collection<AclInterface> remoteAclInterfaces = aclDataUtil.getInterfaceList(remoteAclId);
 760             if (remoteAclInterfaces.isEmpty()) {
 761                 continue;
 762             }
 763             Set<AllowedAddressPairs> aaps =
 764                     remoteAclInterfaces.stream().map(AclInterface::getAllowedAddressPairs).flatMap(List::stream)
 765                             .filter(AclServiceUtils::isNotIpAllNetwork).collect(Collectors.toSet());
 766
 767             Integer aclTag = aclServiceUtils.getAclTag(remoteAclId);
 768             if (addOrRemove == NwConstants.ADD_FLOW) {
 769                 for (BigInteger dpn : dpns) {
 770                     for (AllowedAddressPairs aap : aaps) {
 771                         programRemoteAclTableFlow(flowEntries, Uint64.valueOf(dpn), aclTag, aap, addOrRemove);
 772                     }
 773                 }
 774             } else if (addOrRemove == NwConstants.DEL_FLOW) {
 775                 Set<BigInteger> remoteAclDpns = new HashSet<>();
 776                 Map<String, Set<AclInterface>> mapAclWithPortSet =
 777                         aclDataUtil.getRemoteAclInterfaces(remoteAclId, this.direction);
 778                 if (mapAclWithPortSet != null) {
 779                     Map<String, Set<AclInterface>> copyOfMapAclWithPortSet = new HashMap<>(mapAclWithPortSet);
 780                     copyOfMapAclWithPortSet.remove(aclName);
 781                     remoteAclDpns = collectDpns(copyOfMapAclWithPortSet);
 782                 }
 783                 Set<BigInteger> dpnsToOperate = new HashSet<>(dpns);
 784                 dpnsToOperate.removeAll(remoteAclDpns);
 785                 LOG.debug(
 786                         "Deleting flows in Remote ACL table for remoteAclId={}, direction={}, dpnsToOperate={}, "
 787                                 + "remoteAclDpns={}, dpns={}",
 788                         remoteAclId.getValue(), directionString, dpnsToOperate, remoteAclDpns, dpns);
 789
 790                 for (BigInteger dpn : dpnsToOperate) {
 791                     for (AllowedAddressPairs aap : aaps) {
 792                         programRemoteAclTableFlow(flowEntries, Uint64.valueOf(dpn), aclTag, aap, addOrRemove);
 793                     }
 794                 }
 795             }
 796         }
 797     }
 798
 799     private void updateRemoteAclFilterTable(List<FlowEntity> flowEntries, AclInterface port, int addOrRemove) {
 800         updateRemoteAclFilterTable(flowEntries, port, port.getSecurityGroups(), port.getAllowedAddressPairs(),
 801                 addOrRemove);
 802     }
 803
 804     private void updateRemoteAclFilterTable(List<FlowEntity> flowEntries, AclInterface port, List<Uuid> aclList,
 805             List<AllowedAddressPairs> aaps, int addOrRemove) {
 806         if (aclList == null) {
 807             LOG.debug("Port {} without SGs", port.getInterfaceId());
 808             return;
 809         }
 810         String portId = port.getInterfaceId();
 811         LOG.trace("updateRemoteAclFilterTable for portId={}, aclList={}, aaps={}, addOrRemove={}", portId, aclList,
 812                 aaps, addOrRemove);
 813         for (Uuid aclId : aclList) {
 814             if (aclDataUtil.getRemoteAcl(aclId, this.direction) != null) {
 815                 Integer aclTag = aclServiceUtils.getAclTag(aclId);
 816                 if (addOrRemove == NwConstants.ADD_FLOW) {
 817                     syncRemoteAclTable(flowEntries, portId, aclId, aclTag, aaps, addOrRemove);
 818                 }
 819                 else if (addOrRemove == NwConstants.DEL_FLOW) {
 820                     jobCoordinator.enqueueJob(aclId.getValue(), () -> {
 821                         List<FlowEntity> remoteTableFlowEntries = new ArrayList<>();
 822                         syncRemoteAclTable(remoteTableFlowEntries, portId, aclId, aclTag, aaps, addOrRemove);
 823                         programFlows(AclConstants.ACL_JOB_KEY_PREFIX + aclId.getValue(),
 824                                 remoteTableFlowEntries, NwConstants.DEL_FLOW);
 825                         return Collections.emptyList();
 826                     });
 827                 }
 828             }
 829         }
 830         Set<Uuid> remoteAclIds = aclServiceUtils.getRemoteAclIdsByDirection(aclList, direction);
 831         for (Uuid remoteAclId : remoteAclIds) {
 832             syncRemoteAclTableFromOtherDpns(flowEntries, port, remoteAclId, addOrRemove);
 833         }
 834     }
 835
 836     private void syncRemoteAclTable(List<FlowEntity> flowEntries, String portId, Uuid acl, Integer aclTag,
 837             List<AllowedAddressPairs> aaps, int addOrRemove) {
 838         Map<String, Set<AclInterface>> mapAclWithPortSet = aclDataUtil.getRemoteAclInterfaces(acl, this.direction);
 839         Set<BigInteger> dpns = collectDpns(mapAclWithPortSet);
 840         for (AllowedAddressPairs aap : aaps) {
 841             if (!AclServiceUtils.isNotIpAllNetwork(aap)) {
 842                 continue;
 843             }
 844             if (aclServiceUtils.skipDeleteInCaseOfOverlappingIP(portId, acl, aap.getIpAddress(),
 845                     addOrRemove)) {
 846                 LOG.debug("Skipping delete of IP={} in remote ACL table for remoteAclId={}, portId={}",
 847                         aap.getIpAddress(), portId, acl.getValue());
 848                 continue;
 849             }
 850             for (BigInteger dpId : dpns) {
 851                 programRemoteAclTableFlow(flowEntries, Uint64.valueOf(dpId), aclTag, aap, addOrRemove);
 852             }
 853         }
 854     }
 855
 856     private void syncRemoteAclTableFromOtherDpns(List<FlowEntity> flowEntries, AclInterface port, Uuid remoteAclId,
 857             int addOrRemove) {
 858         Collection<AclInterface> aclInterfaces = aclDataUtil.getInterfaceList(remoteAclId);
 859
 860         if (!aclInterfaces.isEmpty() && isFirstPortInDpnWithRemoteAclId(port, remoteAclId)) {
 861             Integer aclTag = aclServiceUtils.getAclTag(remoteAclId);
 862             for (AclInterface aclInterface : aclInterfaces) {
 863                 if (port.getInterfaceId().equals(aclInterface.getInterfaceId())) {
 864                     continue;
 865                 }
 866                 for (AllowedAddressPairs aap : aclInterface.getAllowedAddressPairs()) {
 867                     if (AclServiceUtils.isNotIpAllNetwork(aap)) {
 868                         programRemoteAclTableFlow(flowEntries, Uint64.valueOf(port.getDpId()),
 869                             aclTag, aap, addOrRemove);
 870                     }
 871                 }
 872             }
 873         }
 874     }
 875
 876     private boolean isFirstPortInDpnWithRemoteAclId(AclInterface port, Uuid remoteAclId) {
 877         String portId = port.getInterfaceId();
 878         BigInteger dpId = port.getDpId();
 879         Map<String, Set<AclInterface>> remoteAclInterfacesMap =
 880                 aclDataUtil.getRemoteAclInterfaces(remoteAclId, direction);
 881         if (remoteAclInterfacesMap != null) {
 882             for (Set<AclInterface> interfaceSet : remoteAclInterfacesMap.values()) {
 883                 for (AclInterface aclInterface : interfaceSet) {
 884                     if (portId.equals(aclInterface.getInterfaceId())) {
 885                         continue;
 886                     }
 887                     if (dpId.equals(aclInterface.getDpId())) {
 888                         return false;
 889                     }
 890                 }
 891             }
 892         }
 893         return true;
 894     }
 895
 896     protected abstract void programRemoteAclTableFlow(List<FlowEntity> flowEntries, Uint64 dpId, Integer aclTag,
 897             AllowedAddressPairs aap, int addOrRemove);
 898
 899     protected Set<BigInteger> collectDpns(@Nullable Map<String, Set<AclInterface>> mapAclWithPortSet) {
 900         Set<BigInteger> dpns = new HashSet<>();
 901         if (mapAclWithPortSet == null) {
 902             return dpns;
 903         }
 904         for (Set<AclInterface> innerSet : mapAclWithPortSet.values()) {
 905             if (innerSet == null) {
 906                 continue;
 907             }
 908             for (AclInterface inter : innerSet) {
 909                 dpns.add(inter.getDpId());
 910             }
 911         }
 912         return dpns;
 913     }
 914
 915     /**
 916      * Programs the port specific fixed rules.
 917      *
 918      * @param flowEntries the flow entries
 919      * @param dpId the dp id
 920      * @param allowedAddresses the allowed addresses
 921      * @param lportTag the lport tag
 922      * @param portId the portId
 923      * @param action the action
 924      * @param write whether to add or remove the flow.
 925      */
 926     protected void programAclPortSpecificFixedRules(List<FlowEntity> flowEntries, Uint64 dpId,
 927             List<AllowedAddressPairs> allowedAddresses, int lportTag, String portId, Action action, int write) {
 928         programGotoClassifierTableRules(flowEntries, dpId, allowedAddresses, lportTag, write);
 929         if (action == Action.ADD || action == Action.REMOVE) {
 930             programConntrackRecircRules(flowEntries, dpId, allowedAddresses, lportTag, portId, write);
 931             programPortSpecificDropRules(flowEntries, dpId, lportTag, write);
 932             programAclCommitRules(flowEntries, dpId, lportTag, portId, write);
 933         }
 934         LOG.info("programAclPortSpecificFixedRules: flows for dpId={}, lportId={}, action={}, write={}", dpId, lportTag,
 935                 action, write);
 936     }
 937
 938     protected abstract void programGotoClassifierTableRules(List<FlowEntity> flowEntries, Uint64 dpId,
 939             List<AllowedAddressPairs> aaps, int lportTag, int addOrRemove);
 940
 941     /**
 942      * Adds the rule to send the packet to the netfilter to check whether it is a known packet.
 943      *
 944      * @param flowEntries the flow entries
 945      * @param dpId the dpId
 946      * @param aaps the allowed address pairs
 947      * @param lportTag the lport tag
 948      * @param portId the portId
 949      * @param addOrRemove whether to add or remove the flow
 950      */
 951     protected void programConntrackRecircRules(List<FlowEntity> flowEntries, Uint64 dpId,
 952             List<AllowedAddressPairs> aaps, int lportTag, String portId, int addOrRemove) {
 953         if (AclServiceUtils.doesIpv4AddressExists(aaps)) {
 954             programConntrackRecircRule(flowEntries, dpId, lportTag, portId, MatchEthernetType.IPV4, addOrRemove);
 955         }
 956         if (AclServiceUtils.doesIpv6AddressExists(aaps)) {
 957             programConntrackRecircRule(flowEntries, dpId, lportTag, portId, MatchEthernetType.IPV6, addOrRemove);
 958         }
 959     }
 960
 961     protected void programConntrackRecircRule(List<FlowEntity> flowEntries, Uint64 dpId, int lportTag,
 962             String portId, MatchEthernetType matchEtherType, int addOrRemove) {
 963         List<MatchInfoBase> matches = new ArrayList<>();
 964         matches.add(matchEtherType);
 965         matches.add(AclServiceUtils.buildLPortTagMatch(lportTag, serviceMode));
 966
 967         List<InstructionInfo> instructions = new ArrayList<>();
 968         if (addOrRemove == NwConstants.ADD_FLOW) {
 969             Long elanTag = getElanIdFromAclInterface(portId);
 970             if (elanTag == null) {
 971                 LOG.error("ElanId not found for portId={}; Context: dpId={}, lportTag={}, addOrRemove={},", portId,
 972                         dpId, lportTag, addOrRemove);
 973                 return;
 974             }
 975             List<ActionInfo> actionsInfos = new ArrayList<>();
 976             actionsInfos.add(new ActionNxConntrack(2, 0, 0, elanTag.intValue(), getAclForExistingTrafficTable()));
 977             instructions.add(new InstructionApplyActions(actionsInfos));
 978         }
 979
 980         String flowName =
 981                 this.directionString + "_Fixed_Conntrk_" + dpId.toString() + "_"
 982                     + lportTag + "_" + matchEtherType + "_Recirc";
 983         addFlowEntryToList(flowEntries, dpId, getAclConntrackSenderTable(), flowName,
 984                 AclConstants.ACL_DEFAULT_PRIORITY, 0, 0, AclConstants.COOKIE_ACL_BASE, matches, instructions,
 985                 addOrRemove);
 986     }
 987
 988     /**
 989      * Adds the rules to drop the unknown/invalid packets .
 990      *
 991      * @param flowEntries the flow entries
 992      * @param dpId the dpId
 993      * @param lportTag the lport tag
 994      * @param addOrRemove whether to add or remove the flow
 995      */
 996     protected void programPortSpecificDropRules(List<FlowEntity> flowEntries, Uint64 dpId, int lportTag,
 997             int addOrRemove) {
 998         LOG.debug("Programming Drop Rules: DpId={}, lportTag={}, addOrRemove={}", dpId, lportTag, addOrRemove);
 999         programConntrackInvalidDropRule(flowEntries, dpId, lportTag, addOrRemove);
1000         programAclRuleMissDropRule(flowEntries, dpId, lportTag, addOrRemove);
1001     }
1002
1003     /**
1004      * Adds the rule to drop the conntrack invalid packets .
1005      *
1006      * @param flowEntries the flow entries
1007      * @param dpId the dpId
1008      * @param lportTag the lport tag
1009      * @param addOrRemove whether to add or remove the flow
1010      */
1011     protected void programConntrackInvalidDropRule(List<FlowEntity> flowEntries, Uint64 dpId, int lportTag,
1012             int addOrRemove) {
1013         List<MatchInfoBase> matches = AclServiceOFFlowBuilder.addLPortTagMatches(lportTag,
1014                 AclConstants.TRACKED_INV_CT_STATE, AclConstants.TRACKED_INV_CT_STATE_MASK, serviceMode);
1015         List<InstructionInfo> instructions = AclServiceOFFlowBuilder.getDropInstructionInfo();
1016
1017         String flowId = this.directionString + "_Fixed_Conntrk_Drop" + dpId.toString()
1018                             + "_" + lportTag + "_Tracked_Invalid";
1019         addFlowEntryToList(flowEntries, dpId, getAclFilterCumDispatcherTable(), flowId,
1020                 AclConstants.CT_STATE_TRACKED_INVALID_PRIORITY, 0, 0, AclServiceUtils.getDropFlowCookie(lportTag),
1021                 matches, instructions, addOrRemove);
1022     }
1023
1024     /**
1025      * Program ACL rule miss drop rule for a port.
1026      *
1027      * @param flowEntries the flow entries
1028      * @param dpId the dp id
1029      * @param lportTag the lport tag
1030      * @param addOrRemove the add or remove
1031      */
1032     protected void programAclRuleMissDropRule(List<FlowEntity> flowEntries, Uint64 dpId, int lportTag,
1033             int addOrRemove) {
1034         List<MatchInfoBase> matches = new ArrayList<>();
1035         matches.add(AclServiceUtils.buildLPortTagMatch(lportTag, serviceMode));
1036         List<InstructionInfo> instructions = AclServiceOFFlowBuilder.getDropInstructionInfo();
1037
1038         String flowId = this.directionString + "_Fixed_Acl_Rule_Miss_Drop_" + dpId.toString() + "_" + lportTag;
1039         addFlowEntryToList(flowEntries, dpId, getAclFilterCumDispatcherTable(), flowId,
1040                 AclConstants.ACL_PORT_SPECIFIC_DROP_PRIORITY, 0, 0, AclServiceUtils.getDropFlowCookie(lportTag),
1041                 matches, instructions, addOrRemove);
1042     }
1043
1044     /**
1045      * Program acl commit rules.
1046      *
1047      * @param flowEntries the flow entries
1048      * @param dpId the dp id
1049      * @param lportTag the lport tag
1050      * @param portId the port id
1051      * @param addOrRemove the add or remove
1052      */
1053     protected void programAclCommitRules(List<FlowEntity> flowEntries, Uint64 dpId, int lportTag, String portId,
1054             int addOrRemove) {
1055         programAclCommitRuleForConntrack(flowEntries, dpId, lportTag, portId, MatchEthernetType.IPV4, addOrRemove);
1056         programAclCommitRuleForConntrack(flowEntries, dpId, lportTag, portId, MatchEthernetType.IPV6, addOrRemove);
1057         programAclCommitRuleForNonConntrack(flowEntries, dpId, lportTag, addOrRemove);
1058     }
1059
1060     /**
1061      * Program acl commit rule for conntrack.
1062      *
1063      * @param flowEntries the flow entries
1064      * @param dpId the dp id
1065      * @param lportTag the lport tag
1066      * @param portId the port id
1067      * @param matchEtherType the match ether type
1068      * @param addOrRemove the add or remove
1069      */
1070     protected void programAclCommitRuleForConntrack(List<FlowEntity> flowEntries, Uint64 dpId, int lportTag,
1071             String portId, MatchEthernetType matchEtherType, int addOrRemove) {
1072         List<MatchInfoBase> matches = new ArrayList<>();
1073         matches.add(matchEtherType);
1074         matches.addAll(AclServiceUtils.buildMatchesForLPortTagAndConntrackClassifierType(lportTag,
1075                 AclConntrackClassifierType.CONNTRACK_SUPPORTED, serviceMode));
1076
1077         List<ActionInfo> actionsInfos = new ArrayList<>();
1078         if (addOrRemove == NwConstants.ADD_FLOW) {
1079             Long elanId = getElanIdFromAclInterface(portId);
1080             if (elanId == null) {
1081                 LOG.error("ElanId not found for portId={}; Context: dpId={}, lportTag={}, addOrRemove={}", portId, dpId,
1082                         lportTag, addOrRemove);
1083                 return;
1084             }
1085             List<NxCtAction> ctActionsList =
1086                     Lists.newArrayList(new ActionNxConntrack.NxCtMark(AclConstants.CT_MARK_EST_STATE));
1087             actionsInfos.add(new ActionNxConntrack(2, 1, 0, elanId.intValue(), (short) 255, ctActionsList));
1088             actionsInfos.add(new ActionNxCtClear());
1089         }
1090         List<InstructionInfo> instructions = getDispatcherTableResubmitInstructions(actionsInfos);
1091
1092         String flowName = directionString + "_Acl_Commit_Conntrack_" + dpId.toString()
1093                             + "_" + lportTag + "_" + matchEtherType;
1094         // Flow for conntrack traffic to commit and resubmit to dispatcher
1095         addFlowEntryToList(flowEntries, dpId, getAclCommitterTable(), flowName, AclConstants.ACL_DEFAULT_PRIORITY,
1096                 0, 0, AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove);
1097     }
1098
1099     /**
1100      * Program acl commit rule for non conntrack.
1101      *
1102      * @param flowEntries the flow entries
1103      * @param dpId the dp id
1104      * @param lportTag the lport tag
1105      * @param addOrRemove the add or remove
1106      */
1107     protected void programAclCommitRuleForNonConntrack(List<FlowEntity> flowEntries, Uint64 dpId, int lportTag,
1108             int addOrRemove) {
1109         List<MatchInfoBase> matches = new ArrayList<>();
1110         matches.addAll(AclServiceUtils.buildMatchesForLPortTagAndConntrackClassifierType(lportTag,
1111                 AclConntrackClassifierType.NON_CONNTRACK_SUPPORTED, serviceMode));
1112
1113         List<InstructionInfo> instructions = getDispatcherTableResubmitInstructions();
1114         String flowName = this.directionString + "_Acl_Commit_Non_Conntrack_" + dpId + "_" + lportTag;
1115         // Flow for non-conntrack traffic to resubmit to dispatcher
1116         addFlowEntryToList(flowEntries, dpId, getAclCommitterTable(), flowName, AclConstants.ACL_DEFAULT_PRIORITY,
1117                 0, 0, AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove);
1118     }
1119
1120     @Nullable
1121     protected Long getElanIdFromAclInterface(String elanInterfaceName) {
1122         AclInterface aclInterface = aclInterfaceCache.get(elanInterfaceName);
1123         if (null != aclInterface) {
1124             return aclInterface.getElanId();
1125         }
1126         return null;
1127     }
1128
1129     protected abstract boolean isValidDirection(Class<? extends DirectionBase> direction);
1130
1131     protected abstract short getAclConntrackSenderTable();
1132
1133     protected abstract short getAclForExistingTrafficTable();
1134
1135     protected abstract short getAclFilterCumDispatcherTable();
1136
1137     protected abstract short getAclRuleBasedFilterTable();
1138
1139     protected abstract short getAclRemoteAclTable();
1140
1141     protected abstract short getAclCommitterTable();
1142 }