openstack/net-virt-providers/src/main/java/org/opendaylight/ovsdb/openstack/netvirt/providers/openflow13/services/EgressAclService.java

   1 /*
   2  * Copyright (C) 2014 Red Hat, Inc.
   3  *
   4  * This program and the accompanying materials are made available under the
   5  * terms of the Eclipse Public License v1.0 which accompanies this distribution,
   6  * and is available at http://www.eclipse.org/legal/epl-v10.html
   7  *
   8  * Authors : Madhu Venugopal
   9  */
  10 package org.opendaylight.ovsdb.openstack.netvirt.providers.openflow13.services;
  11
  12 import java.math.BigInteger;
  13 import java.util.List;
  14
  15 import org.opendaylight.neutron.spi.NeutronSecurityGroup;
  16 import org.opendaylight.neutron.spi.NeutronSecurityRule;
  17 import org.opendaylight.ovsdb.openstack.netvirt.api.Constants;
  18 import org.opendaylight.ovsdb.openstack.netvirt.api.EgressAclProvider;
  19 import org.opendaylight.ovsdb.openstack.netvirt.api.RoutingProvider;
  20 import org.opendaylight.ovsdb.openstack.netvirt.providers.ConfigInterface;
  21 import org.opendaylight.ovsdb.openstack.netvirt.providers.openflow13.AbstractServiceInstance;
  22 import org.opendaylight.ovsdb.openstack.netvirt.providers.openflow13.Service;
  23 import org.opendaylight.ovsdb.utils.mdsal.openflow.InstructionUtils;
  24 import org.opendaylight.ovsdb.utils.mdsal.openflow.MatchUtils;
  25 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev100924.Ipv4Prefix;
  26 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev100924.PortNumber;
  27 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.yang.types.rev100924.MacAddress;
  28 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.inventory.rev130819.FlowId;
  29 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.inventory.rev130819.tables.table.FlowBuilder;
  30 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.inventory.rev130819.tables.table.FlowKey;
  31 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.flow.InstructionsBuilder;
  32 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.flow.MatchBuilder;
  33 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.instruction.list.Instruction;
  34 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.instruction.list.InstructionBuilder;
  35 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.instruction.list.InstructionKey;
  36 import org.opendaylight.yang.gen.v1.urn.opendaylight.inventory.rev130819.nodes.NodeBuilder;
  37 import org.osgi.framework.BundleContext;
  38 import org.osgi.framework.ServiceReference;
  39 import org.slf4j.Logger;
  40 import org.slf4j.LoggerFactory;
  41
  42 import com.google.common.collect.Lists;
  43
  44 public class EgressAclService extends AbstractServiceInstance implements EgressAclProvider, ConfigInterface {
  45
  46     static final Logger logger = LoggerFactory.getLogger(EgressAclService.class);
  47
  48     public EgressAclService() {
  49         super(Service.EGRESS_ACL);
  50     }
  51
  52     public EgressAclService(Service service) {
  53         super(service);
  54     }
  55
  56     @Override
  57     public void programPortSecurityACL(Long dpid, String segmentationId, String attachedMac, long localPort,
  58                                        NeutronSecurityGroup securityGroup) {
  59
  60         logger.trace("programLocalBridgeRulesWithSec neutronSecurityGroup: {} ", securityGroup);
  61         List<NeutronSecurityRule> portSecurityList = securityGroup.getSecurityRules();
  62         /* Iterate over the Port Security Rules in the Port Security Group bound to the port*/
  63         for (NeutronSecurityRule portSecurityRule : portSecurityList) {
  64             /**
  65              * Neutron Port Security ACL "egress" and "IPv4"
  66              *
  67              * Check that the base conditions for flow based Port Security are true:
  68              * Port Security Rule Direction ("egress") and Protocol ("IPv4")
  69              * Neutron defines the direction "ingress" as the vSwitch to the VM as defined in:
  70              * http://docs.openstack.org/api/openstack-network/2.0/content/security_groups.html
  71              *
  72              */
  73             if (portSecurityRule.getSecurityRuleEthertype().equalsIgnoreCase("IPv4") &&
  74                 portSecurityRule.getSecurityRuleDirection().equalsIgnoreCase("egress")) {
  75                 logger.debug("Egress IPV4 ACL  Port Security Rule: {} ", portSecurityRule);
  76                 // ToDo: Implement Port Range
  77
  78                 /**
  79                  * TCP Proto (True), TCP Port Minimum (True), TCP Port Max (True), IP Prefix (True)
  80                  */
  81                 if (String.valueOf(portSecurityRule.getSecurityRuleProtocol()).equalsIgnoreCase("tcp") &&
  82                     !String.valueOf(portSecurityRule.getSecurityRulePortMin()).equalsIgnoreCase("null") &&
  83                     !String.valueOf(portSecurityRule.getSecurityRulePortMax()).equalsIgnoreCase("null") &&
  84                     (!String.valueOf(portSecurityRule.getSecurityRuleRemoteIpPrefix()).equalsIgnoreCase("null") &&
  85                      !String.valueOf(portSecurityRule.getSecurityRuleRemoteIpPrefix())
  86                              .equalsIgnoreCase("0.0.0.0/0"))) {
  87                     logger.debug(
  88                             "Rule #1 egress PortSec Rule Matches -> TCP Protocol: {}, TCP Port Min: {}, TCP Port Max: {}, IP Prefix: {}",
  89                             portSecurityRule.getSecurityRuleProtocol(), portSecurityRule.getSecurityRulePortMin(),
  90                             portSecurityRule.getSecurityRulePortMax(),
  91                             portSecurityRule.getSecurityRuleRemoteIpPrefix());
  92                     egressACLDefaultTcpDrop(dpid, segmentationId, attachedMac,
  93                                             Constants.PROTO_PORT_PREFIX_MATCH_PRIORITY_DROP,
  94                                             true);
  95                     egressACLTcpPortWithPrefix(dpid, segmentationId,
  96                                                attachedMac, true, portSecurityRule.getSecurityRulePortMin(),
  97                                                portSecurityRule.getSecurityRuleRemoteIpPrefix(),
  98                                                Constants.PROTO_PORT_PREFIX_MATCH_PRIORITY);
  99                     continue;
 100                 }
 101                 /**
 102                  * TCP Proto (True), TCP Port Minimum (True), TCP Port Max (False), IP Prefix (True)
 103                  */
 104                 if (String.valueOf(portSecurityRule.getSecurityRuleProtocol()).equalsIgnoreCase("tcp") &&
 105                     !String.valueOf(portSecurityRule.getSecurityRulePortMin()).equalsIgnoreCase("null") &&
 106                     String.valueOf(portSecurityRule.getSecurityRulePortMax()).equalsIgnoreCase("null") &&
 107                     (!String.valueOf(portSecurityRule.getSecurityRuleRemoteIpPrefix()).equalsIgnoreCase("null") &&
 108                      !String.valueOf(portSecurityRule.getSecurityRuleRemoteIpPrefix())
 109                              .equalsIgnoreCase("0.0.0.0/0"))) {
 110                     logger.debug(
 111                             "Rule #2 egress PortSec Rule Matches -> TCP Protocol: {}, TCP Port Min: {}, TCP Port Max: {}, IP Prefix: {}",
 112                             portSecurityRule.getSecurityRuleProtocol(), portSecurityRule.getSecurityRulePortMin(),
 113                             portSecurityRule.getSecurityRulePortMax(),
 114                             portSecurityRule.getSecurityRuleRemoteIpPrefix());
 115                     egressACLDefaultTcpDrop(dpid, segmentationId, attachedMac,
 116                                             Constants.PROTO_PORT_PREFIX_MATCH_PRIORITY_DROP,
 117                                             true);
 118                     egressACLTcpPortWithPrefix(dpid, segmentationId,
 119                                                attachedMac, true, portSecurityRule.getSecurityRulePortMin(),
 120                                                portSecurityRule.getSecurityRuleRemoteIpPrefix(),
 121                                                Constants.PROTO_PORT_PREFIX_MATCH_PRIORITY);
 122                     continue;
 123                 }
 124                 /**
 125                  * TCP Proto (True), TCP Port Minimum (False), TCP Port Max (False), IP Prefix (True)
 126                  */
 127                 if (String.valueOf(portSecurityRule.getSecurityRuleProtocol()).equalsIgnoreCase("tcp") &&
 128                     String.valueOf(portSecurityRule.getSecurityRulePortMin()).equalsIgnoreCase("null") &&
 129                     String.valueOf(portSecurityRule.getSecurityRulePortMax()).equalsIgnoreCase("null") &&
 130                     !String.valueOf(portSecurityRule.getSecurityRuleRemoteIpPrefix()).equalsIgnoreCase("null")) {
 131                     logger.debug(
 132                             "Rule #3 egress PortSec Rule Matches -> TCP Protocol: {}, TCP Port Min: {}, TCP Port Max: {}, IP Prefix: {}",
 133                             portSecurityRule.getSecurityRuleProtocol(), portSecurityRule.getSecurityRulePortMin(),
 134                             portSecurityRule.getSecurityRulePortMax(),
 135                             portSecurityRule.getSecurityRuleRemoteIpPrefix());
 136                     egressACLDefaultTcpDrop(dpid, segmentationId, attachedMac, Constants.PROTO_PREFIX_MATCH_PRIORITY_DROP,
 137                                             true);
 138                     egressACLPermitAllProto(dpid, segmentationId, attachedMac, true,
 139                                             portSecurityRule.getSecurityRuleRemoteIpPrefix(), Constants.PROTO_PREFIX_MATCH_PRIORITY);
 140                     continue;
 141                 }
 142                 /**
 143                  * TCP Proto (False), TCP Port Minimum (False), TCP Port Max (False), IP Prefix (True)
 144                  */
 145                 if (String.valueOf(portSecurityRule.getSecurityRuleProtocol()).equalsIgnoreCase("null") &&
 146                     String.valueOf(portSecurityRule.getSecurityRulePortMin()).equalsIgnoreCase("null") &&
 147                     String.valueOf(portSecurityRule.getSecurityRulePortMin()).equalsIgnoreCase("null") &&
 148                     (!String.valueOf(portSecurityRule.getSecurityRuleRemoteIpPrefix()).equalsIgnoreCase("null") &&
 149                      !String.valueOf(portSecurityRule.getSecurityRuleRemoteIpPrefix())
 150                              .equalsIgnoreCase("0.0.0.0/0"))) {
 151                     logger.debug(
 152                             "Rule #4 egress PortSec Rule Matches -> TCP Protocol: {}, TCP Port Min: {}, TCP Port Max: {}, IP Prefix: {}",
 153                             portSecurityRule.getSecurityRuleProtocol(), portSecurityRule.getSecurityRulePortMin(),
 154                             portSecurityRule.getSecurityRulePortMax(),
 155                             portSecurityRule.getSecurityRuleRemoteIpPrefix());
 156                     egressACLDefaultTcpDrop(dpid, segmentationId, attachedMac, Constants.PREFIX_MATCH_PRIORITY_DROP, true);
 157                     egressACLPermitAllProto(dpid, segmentationId, attachedMac, true,
 158                                             portSecurityRule.getSecurityRuleRemoteIpPrefix(), Constants.PREFIX_MATCH_PRIORITY);
 159                     continue;
 160                 }
 161                 /**
 162                  * TCP Proto (True), TCP Port Minimum (True), TCP Port Max (True), IP Prefix (False)
 163                  */
 164                 if (String.valueOf(portSecurityRule.getSecurityRuleProtocol()).equalsIgnoreCase("tcp") &&
 165                     !String.valueOf(portSecurityRule.getSecurityRulePortMin()).equalsIgnoreCase("null") &&
 166                     !String.valueOf(portSecurityRule.getSecurityRulePortMax()).equalsIgnoreCase("null") &&
 167                     String.valueOf(portSecurityRule.getSecurityRuleRemoteIpPrefix()).equalsIgnoreCase("null")) {
 168                     logger.debug(
 169                             "Rule #5 egress PortSec Rule Matches -> TCP Protocol: {}, TCP Port Min: {}, TCP Port Max: {}, IP Prefix: {}",
 170                             portSecurityRule.getSecurityRuleProtocol(), portSecurityRule.getSecurityRulePortMin(),
 171                             portSecurityRule.getSecurityRulePortMax(),
 172                             portSecurityRule.getSecurityRuleRemoteIpPrefix());
 173                     egressACLDefaultTcpDrop(dpid, segmentationId, attachedMac, Constants.PROTO_PORT_MATCH_PRIORITY_DROP,
 174                                             true);
 175                     egressACLTcpSyn(dpid, segmentationId,
 176                                     attachedMac, true, portSecurityRule.getSecurityRulePortMin(),
 177                                     Constants.PROTO_PORT_MATCH_PRIORITY);
 178                     continue;
 179                 }
 180                 /**
 181                  * TCP Proto (True), TCP Port Minimum (True), TCP Port Max (False), IP Prefix (False)
 182                  */
 183                 if (String.valueOf(portSecurityRule.getSecurityRuleProtocol()).equalsIgnoreCase("tcp") &&
 184                     !String.valueOf(portSecurityRule.getSecurityRulePortMin()).equalsIgnoreCase("null") &&
 185                     String.valueOf(portSecurityRule.getSecurityRulePortMax()).equalsIgnoreCase("null") &&
 186                     String.valueOf(portSecurityRule.getSecurityRuleRemoteIpPrefix()).equalsIgnoreCase("null")) {
 187                     logger.debug(
 188                             "Rule #6 egress PortSec Rule Matches -> TCP Protocol: {}, TCP Port Min: {}, TCP Port Max: {}, IP Prefix: {}",
 189                             portSecurityRule.getSecurityRuleProtocol(), portSecurityRule.getSecurityRulePortMin(),
 190                             portSecurityRule.getSecurityRulePortMax(),
 191                             portSecurityRule.getSecurityRuleRemoteIpPrefix());
 192                     egressACLDefaultTcpDrop(dpid, segmentationId, attachedMac,
 193                                             Constants.PROTO_PORT_MATCH_PRIORITY_DROP, true);
 194                     egressACLTcpSyn(dpid, segmentationId, attachedMac, true,
 195                                     portSecurityRule.getSecurityRulePortMin(), Constants.PROTO_PORT_MATCH_PRIORITY);
 196                     continue;
 197                 }
 198                 /**
 199                  * TCP Proto (True), TCP Port Minimum (False), TCP Port Max (False), IP Prefix (False or 0.0.0.0/0)
 200                  */
 201                 if (String.valueOf(portSecurityRule.getSecurityRuleProtocol()).equalsIgnoreCase("tcp") &&
 202                     String.valueOf(portSecurityRule.getSecurityRulePortMin()).equalsIgnoreCase("null") &&
 203                     String.valueOf(portSecurityRule.getSecurityRulePortMax()).equalsIgnoreCase("null") &&
 204                     ((String.valueOf(portSecurityRule.getSecurityRuleRemoteIpPrefix()).equalsIgnoreCase("null")) ||
 205                      String.valueOf(portSecurityRule.getSecurityRuleRemoteIpPrefix())
 206                              .equalsIgnoreCase("0.0.0.0/0"))) {
 207                     logger.debug(
 208                             "Rule #7 egress PortSec Rule Matches -> TCP Protocol: {}, TCP Port Min: {}, TCP Port Max: {}, IP Prefix: {}",
 209                             portSecurityRule.getSecurityRuleProtocol(), portSecurityRule.getSecurityRulePortMin(),
 210                             portSecurityRule.getSecurityRulePortMax(),
 211                             portSecurityRule.getSecurityRuleRemoteIpPrefix());
 212                     // No need to drop until UDP/ICMP are implemented
 213                     // egressACLDefaultTcpDrop(dpid, segmentationId, attachedMac, PROTO_MATCH_PRIORITY_DROP, true);
 214                     egressAllowProto(dpid, segmentationId, attachedMac, true,
 215                                      portSecurityRule.getSecurityRuleProtocol(), Constants.PROTO_MATCH_PRIORITY);
 216                     continue;
 217                 }
 218                 logger.debug("ACL Match combination not found for rule: {}", portSecurityRule);
 219             }
 220         }
 221     }
 222
 223     public void egressACLDefaultTcpDrop(Long dpidLong, String segmentationId, String attachedMac,
 224                                         int priority, boolean write) {
 225
 226         String nodeName = Constants.OPENFLOW_NODE_PREFIX + dpidLong;
 227         MatchBuilder matchBuilder = new MatchBuilder();
 228         NodeBuilder nodeBuilder = createNodeBuilder(nodeName);
 229         FlowBuilder flowBuilder = new FlowBuilder();
 230
 231         flowBuilder.setMatch(MatchUtils.createSmacTcpPortWithFlagMatch(matchBuilder,
 232                                                                        attachedMac, Constants.TCP_SYN, segmentationId).build());
 233         logger.debug("MatchBuilder contains: {}", flowBuilder.getMatch());
 234
 235         String flowId = "TCP_Syn_Egress_Default_Drop_" + segmentationId + "_" + attachedMac;
 236         flowBuilder.setId(new FlowId(flowId));
 237         FlowKey key = new FlowKey(new FlowId(flowId));
 238         flowBuilder.setStrict(false);
 239         flowBuilder.setPriority(priority);
 240         flowBuilder.setBarrier(true);
 241         flowBuilder.setTableId(this.getTable());
 242         flowBuilder.setKey(key);
 243         flowBuilder.setFlowName(flowId);
 244         flowBuilder.setHardTimeout(0);
 245         flowBuilder.setIdleTimeout(0);
 246
 247         if (write) {
 248             // Instantiate the Builders for the OF Actions and Instructions
 249             InstructionBuilder ib = new InstructionBuilder();
 250             InstructionsBuilder isb = new InstructionsBuilder();
 251             List<Instruction> instructions = Lists.newArrayList();
 252
 253             InstructionUtils.createDropInstructions(ib);
 254             ib.setOrder(0);
 255             ib.setKey(new InstructionKey(0));
 256             instructions.add(ib.build());
 257             // Add InstructionBuilder to the Instruction(s)Builder List
 258             isb.setInstruction(instructions);
 259
 260             logger.debug("Instructions contain: {}", ib.getInstruction());
 261             // Add InstructionsBuilder to FlowBuilder
 262             flowBuilder.setInstructions(isb.build());
 263             writeFlow(flowBuilder, nodeBuilder);
 264         } else {
 265             removeFlow(flowBuilder, nodeBuilder);
 266         }
 267     }
 268
 269     public void egressACLTcpPortWithPrefix(Long dpidLong, String segmentationId, String attachedMac, boolean write,
 270                                            Integer securityRulePortMin, String securityRuleIpPrefix, Integer protoPortPrefixMatchPriority) {
 271
 272         String nodeName = Constants.OPENFLOW_NODE_PREFIX + dpidLong;
 273         PortNumber tcpPort = new PortNumber(securityRulePortMin);
 274         MatchBuilder matchBuilder = new MatchBuilder();
 275         NodeBuilder nodeBuilder = createNodeBuilder(nodeName);
 276         FlowBuilder flowBuilder = new FlowBuilder();
 277         Ipv4Prefix srcIpPrefix = new Ipv4Prefix(securityRuleIpPrefix);
 278
 279         flowBuilder.setMatch(MatchUtils
 280                                      .createSmacTcpSynDstIpPrefixTcpPort(matchBuilder, new MacAddress(attachedMac),
 281                                                                          tcpPort, Constants.TCP_SYN, segmentationId, srcIpPrefix).build());
 282
 283         logger.debug(" MatchBuilder contains:  {}", flowBuilder.getMatch());
 284         String flowId = "UcastEgress_" + segmentationId + "_" + attachedMac +
 285                         securityRulePortMin + securityRuleIpPrefix;
 286         // Add Flow Attributes
 287         flowBuilder.setId(new FlowId(flowId));
 288         FlowKey key = new FlowKey(new FlowId(flowId));
 289         flowBuilder.setStrict(false);
 290         flowBuilder.setPriority(protoPortPrefixMatchPriority);
 291         flowBuilder.setBarrier(true);
 292         flowBuilder.setTableId(this.getTable());
 293         flowBuilder.setKey(key);
 294         flowBuilder.setFlowName(flowId);
 295         flowBuilder.setHardTimeout(0);
 296         flowBuilder.setIdleTimeout(0);
 297
 298         if (write) {
 299             // Instantiate the Builders for the OF Actions and Instructions
 300             InstructionBuilder ib = new InstructionBuilder();
 301             InstructionsBuilder isb = new InstructionsBuilder();
 302             List<Instruction> instructionsList = Lists.newArrayList();
 303
 304             ib = this.getMutablePipelineInstructionBuilder();
 305             ib.setOrder(0);
 306             ib.setKey(new InstructionKey(0));
 307             instructionsList.add(ib.build());
 308             isb.setInstruction(instructionsList);
 309
 310             logger.debug("Instructions contain: {}", ib.getInstruction());
 311             // Add InstructionsBuilder to FlowBuilder
 312             flowBuilder.setInstructions(isb.build());
 313             writeFlow(flowBuilder, nodeBuilder);
 314         } else {
 315             removeFlow(flowBuilder, nodeBuilder);
 316         }
 317     }
 318
 319
 320
 321     public void egressAllowProto(Long dpidLong, String segmentationId, String attachedMac, boolean write,
 322                                  String securityRuleProtcol, Integer protoMatchPriority) {
 323
 324         String nodeName = Constants.OPENFLOW_NODE_PREFIX + dpidLong;
 325         MatchBuilder matchBuilder = new MatchBuilder();
 326         NodeBuilder nodeBuilder = createNodeBuilder(nodeName);
 327         FlowBuilder flowBuilder = new FlowBuilder();
 328
 329         flowBuilder.setMatch(MatchUtils
 330                                      .createDmacIpTcpSynMatch(matchBuilder, new MacAddress(attachedMac), null, null).build());
 331         flowBuilder.setMatch(MatchUtils
 332                                      .createTunnelIDMatch(matchBuilder, new BigInteger(segmentationId)).build());
 333
 334         logger.debug("MatchBuilder contains:  {}", flowBuilder.getMatch());
 335         String flowId = "EgressAllProto_" + segmentationId + "_" +
 336                         attachedMac + "_AllowEgressTCPSyn_" + securityRuleProtcol;
 337         // Add Flow Attributes
 338         flowBuilder.setId(new FlowId(flowId));
 339         FlowKey key = new FlowKey(new FlowId(flowId));
 340         flowBuilder.setStrict(false);
 341         flowBuilder.setPriority(protoMatchPriority);
 342         flowBuilder.setBarrier(true);
 343         flowBuilder.setTableId(this.getTable());
 344         flowBuilder.setKey(key);
 345         flowBuilder.setFlowName(flowId);
 346         flowBuilder.setHardTimeout(0);
 347         flowBuilder.setIdleTimeout(0);
 348
 349         if (write) {
 350             // Instantiate the Builders for the OF Actions and Instructions
 351             InstructionBuilder ib = new InstructionBuilder();
 352             InstructionsBuilder isb = new InstructionsBuilder();
 353             List<Instruction> instructionsList = Lists.newArrayList();
 354
 355             ib = this.getMutablePipelineInstructionBuilder();
 356             ib.setOrder(0);
 357             ib.setKey(new InstructionKey(0));
 358             instructionsList.add(ib.build());
 359             isb.setInstruction(instructionsList);
 360
 361             logger.debug("Instructions contain: {}", ib.getInstruction());
 362             // Add InstructionsBuilder to FlowBuilder
 363             flowBuilder.setInstructions(isb.build());
 364             writeFlow(flowBuilder, nodeBuilder);
 365         } else {
 366             removeFlow(flowBuilder, nodeBuilder);
 367         }
 368     }
 369
 370     public void egressACLPermitAllProto(Long dpidLong, String segmentationId, String attachedMac,
 371                                         boolean write, String securityRuleIpPrefix, Integer protoPortMatchPriority) {
 372
 373         String nodeName = Constants.OPENFLOW_NODE_PREFIX + dpidLong;
 374         Ipv4Prefix srcIpPrefix = new Ipv4Prefix(securityRuleIpPrefix);
 375         MatchBuilder matchBuilder = new MatchBuilder();
 376         NodeBuilder nodeBuilder = createNodeBuilder(nodeName);
 377         FlowBuilder flowBuilder = new FlowBuilder();
 378
 379         flowBuilder.setMatch(MatchUtils.createTunnelIDMatch(matchBuilder, new BigInteger(segmentationId))
 380                                      .build());
 381         if (securityRuleIpPrefix != null) {
 382             flowBuilder.setMatch(MatchUtils
 383                                          .createSmacIpTcpSynMatch(matchBuilder, new MacAddress(attachedMac), null, srcIpPrefix)
 384                                          .build());
 385         } else {
 386             flowBuilder.setMatch(MatchUtils
 387                                          .createSmacIpTcpSynMatch(matchBuilder, new MacAddress(attachedMac), null, null)
 388                                          .build());
 389         }
 390         logger.debug("MatchBuilder contains: {}", flowBuilder.getMatch());
 391         String flowId = "Egress_Proto_ACL" + segmentationId + "_" +
 392                         attachedMac + "_Permit_" + securityRuleIpPrefix;
 393         // Add Flow Attributes
 394         flowBuilder.setId(new FlowId(flowId));
 395         FlowKey key = new FlowKey(new FlowId(flowId));
 396         flowBuilder.setStrict(false);
 397         flowBuilder.setPriority(protoPortMatchPriority);
 398         flowBuilder.setBarrier(true);
 399         flowBuilder.setTableId(this.getTable());
 400         flowBuilder.setKey(key);
 401         flowBuilder.setFlowName(flowId);
 402         flowBuilder.setHardTimeout(0);
 403         flowBuilder.setIdleTimeout(0);
 404
 405         if (write) {
 406             // Instantiate the Builders for the OF Actions and Instructions
 407             InstructionBuilder ib = new InstructionBuilder();
 408             InstructionsBuilder isb = new InstructionsBuilder();
 409             List<Instruction> instructionsList = Lists.newArrayList();
 410
 411             ib = this.getMutablePipelineInstructionBuilder();
 412             ib.setOrder(0);
 413             ib.setKey(new InstructionKey(0));
 414             instructionsList.add(ib.build());
 415             isb.setInstruction(instructionsList);
 416
 417             logger.debug("Instructions contain: {}", ib.getInstruction());
 418             // Add InstructionsBuilder to FlowBuilder
 419             flowBuilder.setInstructions(isb.build());
 420             writeFlow(flowBuilder, nodeBuilder);
 421         } else {
 422             removeFlow(flowBuilder, nodeBuilder);
 423         }
 424     }
 425
 426
 427     public void egressACLTcpSyn(Long dpidLong, String segmentationId, String attachedMac, boolean write,
 428                                 Integer securityRulePortMin, Integer protoPortMatchPriority) {
 429
 430         String nodeName = Constants.OPENFLOW_NODE_PREFIX + dpidLong;
 431         PortNumber tcpPort = new PortNumber(securityRulePortMin);
 432         MatchBuilder matchBuilder = new MatchBuilder();
 433         NodeBuilder nodeBuilder = createNodeBuilder(nodeName);
 434         FlowBuilder flowBuilder = new FlowBuilder();
 435
 436         flowBuilder.setMatch(MatchUtils.createSmacTcpSyn(matchBuilder, attachedMac, tcpPort,
 437                                                          Constants.TCP_SYN, segmentationId).build());
 438
 439         logger.debug("MatchBuilder contains: {}", flowBuilder.getMatch());
 440         String flowId = "Ucast_this.getTable()" + segmentationId + "_" + attachedMac + securityRulePortMin;
 441         // Add Flow Attributes
 442         flowBuilder.setId(new FlowId(flowId));
 443         FlowKey key = new FlowKey(new FlowId(flowId));
 444         flowBuilder.setStrict(false);
 445         flowBuilder.setPriority(protoPortMatchPriority);
 446         flowBuilder.setBarrier(true);
 447         flowBuilder.setTableId(this.getTable());
 448         flowBuilder.setKey(key);
 449         flowBuilder.setFlowName(flowId);
 450         flowBuilder.setHardTimeout(0);
 451         flowBuilder.setIdleTimeout(0);
 452
 453         if (write) {
 454             // Instantiate the Builders for the OF Actions and Instructions
 455             InstructionBuilder ib = new InstructionBuilder();
 456             InstructionsBuilder isb = new InstructionsBuilder();
 457             List<Instruction> instructionsList = Lists.newArrayList();
 458
 459             ib = this.getMutablePipelineInstructionBuilder();
 460             ib.setOrder(0);
 461             ib.setKey(new InstructionKey(0));
 462             instructionsList.add(ib.build());
 463             isb.setInstruction(instructionsList);
 464
 465             logger.debug("Instructions contain: {}", ib.getInstruction());
 466             // Add InstructionsBuilder to FlowBuilder
 467             flowBuilder.setInstructions(isb.build());
 468             writeFlow(flowBuilder, nodeBuilder);
 469         } else {
 470             removeFlow(flowBuilder, nodeBuilder);
 471         }
 472     }
 473
 474     @Override
 475     public void setDependencies(BundleContext bundleContext, ServiceReference serviceReference) {
 476         super.setOrchestrator(bundleContext.getServiceReference(EgressAclProvider.class.getName()), this);
 477     }
 478
 479     @Override
 480     public void setDependencies(Object impl) {}
 481 }