renderers/ofoverlay/src/main/java/org/opendaylight/groupbasedpolicy/renderer/ofoverlay/flow/PolicyEnforcer.java

   1 /*
   2  * Copyright (c) 2014 Cisco Systems, Inc. and others. All rights reserved.
   3  *
   4  * This program and the accompanying materials are made available under the
   5  * terms of the Eclipse Public License v1.0 which accompanies this distribution,
   6  * and is available at http://www.eclipse.org/legal/epl-v10.html
   7  */
   8
   9 package org.opendaylight.groupbasedpolicy.renderer.ofoverlay.flow;
  10
  11 import static org.opendaylight.groupbasedpolicy.renderer.ofoverlay.EndpointManager.isExternal;
  12 import static org.opendaylight.groupbasedpolicy.renderer.ofoverlay.flow.FlowUtils.addNxRegMatch;
  13 import static org.opendaylight.groupbasedpolicy.renderer.ofoverlay.flow.FlowUtils.applyActionIns;
  14 import static org.opendaylight.groupbasedpolicy.renderer.ofoverlay.flow.FlowUtils.gotoTableIns;
  15 import static org.opendaylight.groupbasedpolicy.renderer.ofoverlay.flow.FlowUtils.instructions;
  16 import static org.opendaylight.groupbasedpolicy.renderer.ofoverlay.flow.FlowUtils.nxOutputRegAction;
  17
  18 import java.util.ArrayList;
  19 import java.util.Collections;
  20 import java.util.Comparator;
  21 import java.util.HashMap;
  22 import java.util.HashSet;
  23 import java.util.List;
  24 import java.util.Map;
  25 import java.util.Set;
  26
  27 import javax.annotation.concurrent.Immutable;
  28
  29 import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.OfContext;
  30 import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.PolicyManager.FlowMap;
  31 import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.flow.FlowUtils.RegMatch;
  32 import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.flow.OrdinalFactory.EndpointFwdCtxOrdinals;
  33 import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.sf.Action;
  34 import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.sf.AllowAction;
  35 import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.sf.ClassificationResult;
  36 import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.sf.Classifier;
  37 import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.sf.ParamDerivator;
  38 import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.sf.SubjectFeatures;
  39 import org.opendaylight.groupbasedpolicy.resolver.EgKey;
  40 import org.opendaylight.groupbasedpolicy.resolver.EndpointConstraint;
  41 import org.opendaylight.groupbasedpolicy.resolver.IndexedTenant;
  42 import org.opendaylight.groupbasedpolicy.resolver.Policy;
  43 import org.opendaylight.groupbasedpolicy.resolver.PolicyInfo;
  44 import org.opendaylight.groupbasedpolicy.resolver.RuleGroup;
  45 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev100924.IpPrefix;
  46 import org.opendaylight.yang.gen.v1.urn.opendaylight.action.types.rev131112.action.list.ActionBuilder;
  47 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.inventory.rev130819.FlowId;
  48 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.inventory.rev130819.tables.table.Flow;
  49 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.inventory.rev130819.tables.table.FlowBuilder;
  50 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.flow.Match;
  51 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.flow.MatchBuilder;
  52 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.common.rev140421.ClassifierDefinitionId;
  53 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.common.rev140421.ConditionName;
  54 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.common.rev140421.TenantId;
  55 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.endpoint.rev140421.endpoints.Endpoint;
  56 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.ofoverlay.rev140528.OfOverlayContext;
  57 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.policy.rev140421.HasDirection.Direction;
  58 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.policy.rev140421.has.action.refs.ActionRef;
  59 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.policy.rev140421.has.classifier.refs.ClassifierRef;
  60 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.policy.rev140421.subject.feature.instance.ParameterValue;
  61 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.policy.rev140421.tenants.tenant.EndpointGroup;
  62 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.policy.rev140421.tenants.tenant.EndpointGroup.IntraGroupPolicy;
  63 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.policy.rev140421.tenants.tenant.contract.subject.Rule;
  64 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.policy.rev140421.tenants.tenant.subject.feature.instances.ActionInstance;
  65 import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.policy.rev140421.tenants.tenant.subject.feature.instances.ClassifierInstance;
  66 import org.opendaylight.yang.gen.v1.urn.opendaylight.inventory.rev130819.NodeConnectorId;
  67 import org.opendaylight.yang.gen.v1.urn.opendaylight.inventory.rev130819.NodeId;
  68 import org.opendaylight.yang.gen.v1.urn.opendaylight.model.match.types.rev131026.match.Layer3Match;
  69 import org.opendaylight.yang.gen.v1.urn.opendaylight.model.match.types.rev131026.match.layer._3.match.Ipv4MatchBuilder;
  70 import org.opendaylight.yang.gen.v1.urn.opendaylight.model.match.types.rev131026.match.layer._3.match.Ipv6MatchBuilder;
  71 import org.opendaylight.yang.gen.v1.urn.opendaylight.openflowjava.nx.match.rev140421.NxmNxReg0;
  72 import org.opendaylight.yang.gen.v1.urn.opendaylight.openflowjava.nx.match.rev140421.NxmNxReg1;
  73 import org.opendaylight.yang.gen.v1.urn.opendaylight.openflowjava.nx.match.rev140421.NxmNxReg2;
  74 import org.opendaylight.yang.gen.v1.urn.opendaylight.openflowjava.nx.match.rev140421.NxmNxReg3;
  75 import org.opendaylight.yang.gen.v1.urn.opendaylight.openflowjava.nx.match.rev140421.NxmNxReg5;
  76 import org.opendaylight.yang.gen.v1.urn.opendaylight.openflowjava.nx.match.rev140421.NxmNxReg7;
  77 import org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.overlay.rev150105.TunnelTypeVxlan;
  78 import org.slf4j.Logger;
  79 import org.slf4j.LoggerFactory;
  80
  81 import com.google.common.base.Preconditions;
  82 import com.google.common.collect.ComparisonChain;
  83 import com.google.common.collect.Ordering;
  84 import com.google.common.collect.Table.Cell;
  85
  86 /**
  87  * Manage the table that enforces policy on the traffic. Traffic is denied
  88  * unless specifically allowed by policy
  89  */
  90 public class PolicyEnforcer extends FlowTable {
  91
  92     protected static final Logger LOG = LoggerFactory.getLogger(PolicyEnforcer.class);
  93
  94     private static org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.instruction.Instruction gotoEgressNatInstruction;
  95     private static org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.instruction.Instruction gotoExternalInstruction;
  96
  97     public static short TABLE_ID;
  98
  99     public PolicyEnforcer(OfContext ctx, short tableId) {
 100         super(ctx);
 101         this.TABLE_ID = tableId;
 102         this.gotoEgressNatInstruction = gotoTableIns(ctx.getPolicyManager().getTABLEID_EGRESS_NAT());
 103         this.gotoExternalInstruction = gotoTableIns(ctx.getPolicyManager().getTABLEID_EXTERNAL_MAPPER());
 104     }
 105
 106     @Override
 107     public short getTableId() {
 108         return TABLE_ID;
 109     }
 110
 111     @Override
 112     public void sync(NodeId nodeId, PolicyInfo policyInfo, FlowMap flowMap) throws Exception {
 113
 114         flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(1), null, TABLE_ID));
 115
 116         NodeConnectorId tunPort = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlan.class);
 117         if (tunPort != null) {
 118             flowMap.writeFlow(nodeId, TABLE_ID, allowFromTunnel(tunPort));
 119         }
 120
 121         HashSet<PolicyPair> visitedPairs = new HashSet<>();
 122         HashSet<PolicyPair> visitedReversePairs = new HashSet<>();
 123
 124         // Used for ARP flows
 125         Set<Integer> fdIds = new HashSet<>();
 126
 127         for (Endpoint srcEp : ctx.getEndpointManager().getEndpointsForNode(nodeId)) {
 128             for (EgKey srcEpgKey : ctx.getEndpointManager().getEgKeysForEndpoint(srcEp)) {
 129                 Set<EgKey> peers = policyInfo.getPeers(srcEpgKey);
 130                 for (EgKey dstEpgKey : peers) {
 131                     Set<Endpoint> dstEndpoints = new HashSet<>();
 132                     dstEndpoints.addAll(ctx.getEndpointManager().getEndpointsForGroup(dstEpgKey));
 133                     dstEndpoints.addAll(ctx.getEndpointManager().getExtEpsNoLocForGroup(dstEpgKey));
 134                     for (Endpoint dstEp : dstEndpoints) {
 135
 136                         EndpointFwdCtxOrdinals srcEpFwdCxtOrds = OrdinalFactory.getEndpointFwdCtxOrdinals(ctx,
 137                                 policyInfo, srcEp);
 138                         EndpointFwdCtxOrdinals dstEpFwdCxtOrds = OrdinalFactory.getEndpointFwdCtxOrdinals(ctx,
 139                                 policyInfo, dstEp);
 140                         int dcgId = dstEpFwdCxtOrds.getCgId();
 141                         int depgId = dstEpFwdCxtOrds.getEpgId();
 142                         int scgId = srcEpFwdCxtOrds.getCgId();
 143                         int sepgId = srcEpFwdCxtOrds.getEpgId();
 144
 145                         fdIds.add(srcEpFwdCxtOrds.getFdId());
 146                         NetworkElements netElements = new NetworkElements(srcEp, dstEp, nodeId, ctx, policyInfo);
 147
 148                         Policy policy = policyInfo.getPolicy(dstEpgKey, srcEpgKey);
 149                         for (Cell<EndpointConstraint, EndpointConstraint, List<RuleGroup>> activeRulesByConstraints : getActiveRulesBetweenEps(
 150                                 policy, dstEp, srcEp)) {
 151                             Set<IpPrefix> sIpPrefixes = Policy.getIpPrefixesFrom(activeRulesByConstraints.getRowKey()
 152                                 .getL3EpPrefixes());
 153                             Set<IpPrefix> dIpPrefixes = Policy.getIpPrefixesFrom(activeRulesByConstraints.getColumnKey()
 154                                 .getL3EpPrefixes());
 155                             PolicyPair policyPair = new PolicyPair(depgId, sepgId, dcgId, scgId, dIpPrefixes,
 156                                     sIpPrefixes, netElements.getDstNodeId(), netElements.getSrcNodeId());
 157                             if (visitedPairs.contains(policyPair)) {
 158                                 LOG.trace("PolicyEnforcer: Already visited PolicyPair {}, endpoints {} {} skipped",
 159                                         policyPair, srcEp.getKey(), dstEp.getKey());
 160                                 continue;
 161                             } else {
 162                                 LOG.trace("PolicyEnforcer: Visiting PolicyPair {} endpoints {} {}", policyPair,
 163                                         srcEp.getKey(), dstEp.getKey());
 164                                 visitedPairs.add(policyPair);
 165                             }
 166                             syncPolicy(flowMap, netElements, activeRulesByConstraints.getValue(), policyPair);
 167                         }
 168
 169                         // Reverse
 170                         policy = policyInfo.getPolicy(srcEpgKey, dstEpgKey);
 171                         for (Cell<EndpointConstraint, EndpointConstraint, List<RuleGroup>> activeRulesByConstraints : getActiveRulesBetweenEps(
 172                                 policy, srcEp, dstEp)) {
 173                             Set<IpPrefix> sIpPrefixes = Policy.getIpPrefixesFrom(activeRulesByConstraints.getRowKey()
 174                                 .getL3EpPrefixes());
 175                             Set<IpPrefix> dIpPrefixes = Policy.getIpPrefixesFrom(activeRulesByConstraints.getColumnKey()
 176                                 .getL3EpPrefixes());
 177                             PolicyPair policyPair = new PolicyPair(sepgId, depgId, scgId, dcgId, sIpPrefixes,
 178                                     dIpPrefixes, netElements.getSrcNodeId(), netElements.getDstNodeId());
 179                             if (visitedReversePairs.contains(policyPair)) {
 180                                 LOG.trace(
 181                                         "PolicyEnforcer: Reverse: Already visited PolicyPair {}, endpoints {} {} skipped",
 182                                         policyPair, srcEp.getKey(), dstEp.getKey());
 183                                 continue;
 184                             } else {
 185                                 LOG.trace("PolicyEnforcer: Reverse: Visiting: PolicyPair {} via endpoints {} {}",
 186                                         policyPair, srcEp.getKey(), dstEp.getKey());
 187                                 visitedReversePairs.add(policyPair);
 188
 189                             }
 190                             syncPolicy(flowMap, netElements, activeRulesByConstraints.getValue(), policyPair);
 191                         }
 192                     }
 193                 }
 194             }
 195         }
 196
 197         // Allow same EPG
 198         for (Endpoint srcEp : ctx.getEndpointManager().getEndpointsForNode(nodeId)) {
 199             for (EgKey srcEpgKey : ctx.getEndpointManager().getEgKeysForEndpoint(srcEp)) {
 200
 201                 IndexedTenant tenant = ctx.getPolicyResolver().getTenant(srcEpgKey.getTenantId());
 202                 if (tenant != null) {
 203                     EndpointGroup group = tenant.getEndpointGroup(srcEpgKey.getEgId());
 204                     IntraGroupPolicy igp = group.getIntraGroupPolicy();
 205
 206                     if (igp == null || igp.equals(IntraGroupPolicy.Allow)) {
 207                         for (Endpoint dstEp : ctx.getEndpointManager().getEndpointsForGroup(srcEpgKey)) {
 208                             EndpointFwdCtxOrdinals srcEpFwdCxtOrds =
 209                                 OrdinalFactory.getEndpointFwdCtxOrdinals(ctx, policyInfo, srcEp);
 210                             EndpointFwdCtxOrdinals dstEpFwdCxtOrds =
 211                                 OrdinalFactory.getEndpointFwdCtxOrdinals(ctx, policyInfo, dstEp);
 212                             int depgId = dstEpFwdCxtOrds.getEpgId();
 213                             int sepgId = srcEpFwdCxtOrds.getEpgId();
 214                             flowMap.writeFlow(nodeId, TABLE_ID, allowSameEpg(sepgId, depgId));
 215                             flowMap.writeFlow(nodeId, TABLE_ID, allowSameEpg(depgId, sepgId));
 216                         }
 217                     }
 218                 }
 219             }
 220         }
 221
 222         // Write ARP flows per flood domain.
 223         for (Integer fdId : fdIds) {
 224             flowMap.writeFlow(nodeId, TABLE_ID, createArpFlow(fdId));
 225         }
 226     }
 227
 228     private Flow createArpFlow(Integer fdId) {
 229
 230         Long etherType = FlowUtils.ARP;
 231         // L2 Classifier so 20,000 for now
 232         Integer priority = 20000;
 233
 234         MatchBuilder mb = new MatchBuilder().setEthernetMatch(FlowUtils.ethernetMatch(null, null, etherType));
 235
 236         addNxRegMatch(mb, RegMatch.of(NxmNxReg5.class, Long.valueOf(fdId)));
 237
 238         Match match = mb.build();
 239         FlowId flowid = FlowIdUtils.newFlowId(TABLE_ID, "arp", match);
 240         Flow flow = base().setPriority(priority)
 241             .setId(flowid)
 242             .setMatch(match)
 243             .setInstructions(instructions(applyActionIns(nxOutputRegAction(NxmNxReg7.class))))
 244             .build();
 245         return flow;
 246     }
 247
 248     private Flow allowSameEpg(int sepgId, int depgId) {
 249
 250         MatchBuilder mb = new MatchBuilder();
 251         addNxRegMatch(mb, RegMatch.of(NxmNxReg0.class, Long.valueOf(sepgId)),
 252                 RegMatch.of(NxmNxReg2.class, Long.valueOf(depgId)));
 253         Match match = mb.build();
 254         FlowId flowId = FlowIdUtils.newFlowId(TABLE_ID, "intraallow", match);
 255         FlowBuilder flow = base().setId(flowId)
 256             .setMatch(match)
 257             .setPriority(65000)
 258             .setInstructions(instructions(applyActionIns(nxOutputRegAction(NxmNxReg7.class))));
 259         return flow.build();
 260     }
 261
 262     private Flow allowFromTunnel(NodeConnectorId tunPort) {
 263
 264         MatchBuilder mb = new MatchBuilder().setInPort(tunPort);
 265         addNxRegMatch(mb, RegMatch.of(NxmNxReg1.class, Long.valueOf(0xffffff)));
 266         Match match = mb.build();
 267         FlowId flowId = FlowIdUtils.newFlowId(TABLE_ID, "tunnelallow", match);
 268         FlowBuilder flow = base().setId(flowId)
 269             .setMatch(match)
 270             .setPriority(65000)
 271             .setInstructions(instructions(applyActionIns(nxOutputRegAction(NxmNxReg7.class))));
 272         return flow.build();
 273
 274     }
 275
 276     private void syncPolicy(FlowMap flowMap, NetworkElements netElements, List<RuleGroup> rgs, PolicyPair policyPair) {
 277         int priority = 65000;
 278         for (RuleGroup rg : rgs) {
 279             TenantId tenantId = rg.getContractTenant().getId();
 280             IndexedTenant tenant = ctx.getPolicyResolver().getTenant(tenantId);
 281             for (Rule r : rg.getRules()) {
 282                 syncDirection(flowMap, netElements, tenant, policyPair, r, Direction.In, priority);
 283                 syncDirection(flowMap, netElements, tenant, policyPair, r, Direction.Out, priority);
 284
 285                 priority -= 1;
 286             }
 287         }
 288     }
 289
 290     /**
 291      * Private internal class for ordering Actions in Rules. The order is
 292      * determined first by the value of the order parameter, with the lower
 293      * order actions being applied first; for Actions with either the same order
 294      * or no order, ordering is lexicographical by name.
 295      */
 296     private static class ActionRefComparator implements Comparator<ActionRef> {
 297
 298         public static final ActionRefComparator INSTANCE = new ActionRefComparator();
 299
 300         @Override
 301         public int compare(ActionRef arg0, ActionRef arg1) {
 302             return ComparisonChain.start()
 303                 .compare(arg0.getOrder(), arg1.getOrder(), Ordering.natural().nullsLast())
 304                 .compare(arg0.getName().getValue(), arg1.getName().getValue(), Ordering.natural().nullsLast())
 305                 .result();
 306         }
 307
 308     }
 309
 310     private void syncDirection(FlowMap flowMap, NetworkElements netElements, IndexedTenant contractTenant,
 311             PolicyPair policyPair, Rule rule, Direction direction, int priority) {
 312
 313
 314         Map<String, ParameterValue> paramsFromClassifier = new HashMap<>();
 315         Set<ClassifierDefinitionId> classifiers = new HashSet<>();
 316         for (ClassifierRef cr : rule.getClassifierRef()) {
 317             if (cr.getDirection() != null && !cr.getDirection().equals(Direction.Bidirectional)
 318                     && !cr.getDirection().equals(direction)) {
 319                 continue;
 320             }
 321
 322             // XXX - TODO - implement connection tracking (requires openflow
 323             // extension and data plane support - in 2.4. Will need to handle
 324             // case where we are working with mix of nodes.
 325
 326             ClassifierInstance ci = contractTenant.getClassifier(cr.getName());
 327             if (ci == null) {
 328                 // XXX TODO fail the match and raise an exception
 329                 LOG.warn("Classifier instance {} not found", cr.getName().getValue());
 330                 return;
 331             }
 332             Classifier cfier = SubjectFeatures.getClassifier(ci.getClassifierDefinitionId());
 333             if (cfier == null) {
 334                 // XXX TODO fail the match and raise an exception
 335                 LOG.warn("Classifier definition {} not found", ci.getClassifierDefinitionId().getValue());
 336                 return;
 337             }
 338             classifiers.add(new ClassifierDefinitionId(ci.getClassifierDefinitionId()));
 339             for (ParameterValue v : ci.getParameterValue()) {
 340                 if (paramsFromClassifier.get(v.getName().getValue()) == null) {
 341                     if (v.getIntValue() != null || v.getStringValue() != null || v.getRangeValue() != null) {
 342                         paramsFromClassifier.put(v.getName().getValue(), v);
 343                     }
 344                 } else {
 345                     if (!paramsFromClassifier.get(v.getName().getValue()).equals(v)) {
 346                         throw new IllegalArgumentException("Classification error in rule: " + rule.getName()
 347                                 + ".\nCause: " + "Classification conflict detected at parameter " + v.getName());
 348                     }
 349                 }
 350             }
 351         }
 352         if (classifiers.isEmpty()) {
 353             return;
 354         }
 355         List<Map<String, ParameterValue>> derivedParamsByName = ParamDerivator.ETHER_TYPE_DERIVATOR.deriveParameter(paramsFromClassifier);
 356         List<MatchBuilder> flowMatchBuilders = new ArrayList<>();
 357         for (Map<String, ParameterValue> params : derivedParamsByName) {
 358             List<MatchBuilder> matchBuildersToResolve = new ArrayList<>();
 359             if (policyPair.consumerEicIpPrefixes.isEmpty() && policyPair.providerEicIpPrefixes.isEmpty()) {
 360                 matchBuildersToResolve.add(createBaseMatch(direction, policyPair, null, null));
 361             } else if (!policyPair.consumerEicIpPrefixes.isEmpty() && policyPair.providerEicIpPrefixes.isEmpty()) {
 362                 for (IpPrefix sIpPrefix : policyPair.consumerEicIpPrefixes) {
 363                     matchBuildersToResolve.add(createBaseMatch(direction, policyPair, sIpPrefix, null));
 364                 }
 365             } else if (policyPair.consumerEicIpPrefixes.isEmpty() && !policyPair.providerEicIpPrefixes.isEmpty()) {
 366                 for (IpPrefix dIpPrefix : policyPair.consumerEicIpPrefixes) {
 367                     matchBuildersToResolve.add(createBaseMatch(direction, policyPair, null, dIpPrefix));
 368                 }
 369             } else {
 370                 for (IpPrefix sIpPrefix : policyPair.consumerEicIpPrefixes) {
 371                     for (IpPrefix dIpPrefix : policyPair.consumerEicIpPrefixes) {
 372                         matchBuildersToResolve.add(createBaseMatch(direction, policyPair, sIpPrefix, dIpPrefix));
 373                     }
 374                 }
 375             }
 376             for (ClassifierDefinitionId clDefId : classifiers) {
 377                 Classifier classifier = SubjectFeatures.getClassifier(clDefId);
 378                 ClassificationResult result = classifier.updateMatch(matchBuildersToResolve, params);
 379                 if (!result.isSuccessfull()) {
 380                     // TODO consider different handling.
 381                     throw new IllegalArgumentException("Classification conflict detected in rule: " + rule.getName()
 382                             + ".\nCause: " + result.getErrorMessage());
 383                 }
 384                 matchBuildersToResolve = new ArrayList<>(result.getMatchBuilders());
 385             }
 386             flowMatchBuilders.addAll(matchBuildersToResolve);
 387         }
 388
 389         /*
 390          * Create the ordered action list. The implicit action is "allow", and
 391          * is therefore always in the list
 392          */
 393
 394         List<ActionBuilder> actionBuilderList = new ArrayList<ActionBuilder>();
 395         if (rule.getActionRef() != null) {
 396             /*
 397              * Pre-sort by references using order, then name
 398              */
 399             List<ActionRef> actionRefList = new ArrayList<ActionRef>(rule.getActionRef());
 400             Collections.sort(actionRefList, ActionRefComparator.INSTANCE);
 401
 402             for (ActionRef actionRule : actionRefList) {
 403                 ActionInstance actionInstance = contractTenant.getAction(actionRule.getName());
 404                 if (actionInstance == null) {
 405                     // XXX TODO fail the match and raise an exception
 406                     LOG.warn("Action instance {} not found", actionRule.getName().getValue());
 407                     return;
 408                 }
 409                 Action action = SubjectFeatures.getAction(actionInstance.getActionDefinitionId());
 410                 if (action == null) {
 411                     // XXX TODO fail the match and raise an exception
 412                     LOG.warn("Action definition {} not found", actionInstance.getActionDefinitionId().getValue());
 413                     return;
 414                 }
 415
 416                 Map<String, Object> params = new HashMap<>();
 417                 if (actionInstance.getParameterValue() != null) {
 418                     for (ParameterValue v : actionInstance.getParameterValue()) {
 419                         if (v.getName() == null)
 420                             continue;
 421                         if (v.getIntValue() != null) {
 422                             params.put(v.getName().getValue(), v.getIntValue());
 423                         } else if (v.getStringValue() != null) {
 424                             params.put(v.getName().getValue(), v.getStringValue());
 425                         }
 426                     }
 427                 }
 428                 /*
 429                  * Convert the GBP Action to one or more OpenFlow Actions
 430                  */
 431                 if (!(actionRefList.indexOf(actionRule) == (actionRefList.size() - 1) && action.equals(SubjectFeatures.getAction(AllowAction.DEFINITION.getId())))) {
 432                     actionBuilderList = action.updateAction(actionBuilderList, params, actionRule.getOrder(), netElements, policyPair, flowMap, ctx, direction);
 433                 }
 434
 435             }
 436         }
 437         FlowBuilder flow = base().setPriority(Integer.valueOf(priority));
 438         for (MatchBuilder mb : flowMatchBuilders) {
 439             Match match = mb.build();
 440             FlowId flowId = FlowIdUtils.newFlowId(TABLE_ID, "cg", match);
 441             flow.setMatch(match).setId(flowId).setPriority(Integer.valueOf(priority));
 442
 443             /*
 444              * If destination is External, the last Action ALLOW must be changed to goto
 445              * NAT/External table.
 446              * If actionBuilderList is empty (we removed the last Allow) then go straight to
 447              * ExternalMapper table.
 448              */
 449
 450             if (isExternal(netElements.getDstEp())) {
 451                 flow.setInstructions(instructions(getGotoEgressNatInstruction()));
 452             } else if (actionBuilderList.isEmpty()) {
 453                 flow.setInstructions(instructions(getGotoExternalInstruction()));
 454             } else {
 455                 flow.setInstructions(instructions(applyActionIns(actionBuilderList), getGotoExternalInstruction()));
 456             }
 457             flowMap.writeFlow(netElements.getLocalNodeId(), TABLE_ID, flow.build());
 458         }
 459     }
 460
 461     private MatchBuilder createBaseMatch(Direction direction, PolicyPair policyPair, IpPrefix sIpPrefix,
 462             IpPrefix dIpPrefix) {
 463         MatchBuilder baseMatch = new MatchBuilder();
 464         if (direction.equals(Direction.In)) {
 465             addNxRegMatch(baseMatch, RegMatch.of(NxmNxReg0.class, Long.valueOf(policyPair.consumerEpgId)),
 466                     RegMatch.of(NxmNxReg1.class, Long.valueOf(policyPair.consumerCondGrpId)),
 467                     RegMatch.of(NxmNxReg2.class, Long.valueOf(policyPair.providerEpgId)),
 468                     RegMatch.of(NxmNxReg3.class, Long.valueOf(policyPair.providerCondGrpId)));
 469             if (sIpPrefix != null) {
 470                 baseMatch.setLayer3Match(createLayer3Match(sIpPrefix, true));
 471             }
 472             if (dIpPrefix != null) {
 473                 baseMatch.setLayer3Match(createLayer3Match(dIpPrefix, true));
 474             }
 475         } else {
 476             addNxRegMatch(baseMatch, RegMatch.of(NxmNxReg0.class, Long.valueOf(policyPair.providerEpgId)),
 477                     RegMatch.of(NxmNxReg1.class, Long.valueOf(policyPair.providerCondGrpId)),
 478                     RegMatch.of(NxmNxReg2.class, Long.valueOf(policyPair.consumerEpgId)),
 479                     RegMatch.of(NxmNxReg3.class, Long.valueOf(policyPair.consumerCondGrpId)));
 480             if (sIpPrefix != null) {
 481                 baseMatch.setLayer3Match(createLayer3Match(sIpPrefix, false));
 482             }
 483             if (dIpPrefix != null) {
 484                 baseMatch.setLayer3Match(createLayer3Match(dIpPrefix, false));
 485             }
 486         }
 487         return baseMatch;
 488     }
 489
 490     private Layer3Match createLayer3Match(IpPrefix ipPrefix, boolean isSrc) {
 491         if (ipPrefix.getIpv4Prefix() != null) {
 492             if (isSrc) {
 493                 return new Ipv4MatchBuilder().setIpv4Source(ipPrefix.getIpv4Prefix()).build();
 494             } else {
 495                 return new Ipv4MatchBuilder().setIpv4Destination(ipPrefix.getIpv4Prefix()).build();
 496             }
 497         } else {
 498             if (isSrc) {
 499                 return new Ipv6MatchBuilder().setIpv6Source(ipPrefix.getIpv6Prefix()).build();
 500             } else {
 501                 return new Ipv6MatchBuilder().setIpv6Destination(ipPrefix.getIpv6Prefix()).build();
 502             }
 503         }
 504     }
 505
 506     // TODO: move to a common utils for all renderers
 507     public List<Cell<EndpointConstraint, EndpointConstraint, List<RuleGroup>>> getActiveRulesBetweenEps(Policy policy,
 508             Endpoint consEp, Endpoint provEp) {
 509         List<Cell<EndpointConstraint, EndpointConstraint, List<RuleGroup>>> rulesWithEpConstraints = new ArrayList<>();
 510         if (policy.getRuleMap() != null) {
 511             for (Cell<EndpointConstraint, EndpointConstraint, List<RuleGroup>> cell : policy.getRuleMap().cellSet()) {
 512                 EndpointConstraint consEpConstraint = cell.getRowKey();
 513                 EndpointConstraint provEpConstraint = cell.getColumnKey();
 514                 if (epMatchesConstraint(consEp, consEpConstraint) && epMatchesConstraint(provEp, provEpConstraint)) {
 515                     rulesWithEpConstraints.add(cell);
 516                 }
 517             }
 518         }
 519         return rulesWithEpConstraints;
 520     }
 521
 522     private boolean epMatchesConstraint(Endpoint ep, EndpointConstraint constraint) {
 523         List<ConditionName> epConditions = Collections.emptyList();
 524         if (ep.getCondition() != null) {
 525             epConditions = ep.getCondition();
 526         }
 527         return constraint.getConditionSet().matches(epConditions);
 528     }
 529
 530     private static org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.instruction.Instruction getGotoEgressNatInstruction() {
 531         return gotoEgressNatInstruction;
 532     }
 533
 534     private static org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.instruction.Instruction getGotoExternalInstruction() {
 535         return gotoExternalInstruction;
 536     }
 537
 538     @Immutable
 539     public static class PolicyPair {
 540
 541         private final int consumerEpgId;
 542         private final int providerEpgId;
 543         private final int consumerCondGrpId;
 544         private final int providerCondGrpId;
 545         private final Set<IpPrefix> consumerEicIpPrefixes;
 546         private final Set<IpPrefix> providerEicIpPrefixes;
 547         private NodeId consumerEpNodeId;
 548         private NodeId providerEpNodeId;
 549
 550         public int getConsumerEpgId() {
 551             return consumerEpgId;
 552         }
 553
 554         public int getProviderEpgId() {
 555             return providerEpgId;
 556         }
 557
 558         public NodeId getConsumerEpNodeId() {
 559             return consumerEpNodeId;
 560         }
 561
 562         public NodeId getProviderEpNodeId() {
 563             return providerEpNodeId;
 564         }
 565
 566         public PolicyPair(int consumerEpgId, int providerEpgId, int consumerCondGrpId, int providerCondGrpId,
 567                 Set<IpPrefix> consumerEicIpPrefixes, Set<IpPrefix> providerEicIpPrefixes, NodeId consumerEpNodeId, NodeId providerEpNodeId) {
 568             super();
 569             this.consumerEpgId = consumerEpgId;
 570             this.providerEpgId = providerEpgId;
 571             this.consumerCondGrpId = consumerCondGrpId;
 572             this.providerCondGrpId = providerCondGrpId;
 573             this.consumerEicIpPrefixes = consumerEicIpPrefixes;
 574             this.providerEicIpPrefixes = providerEicIpPrefixes;
 575             this.consumerEpNodeId = consumerEpNodeId;
 576             this.providerEpNodeId = providerEpNodeId;
 577         }
 578
 579         @Override
 580         public int hashCode() {
 581             final int prime = 31;
 582             int result = 1;
 583             result = prime * result + ((providerEicIpPrefixes == null) ? 0 : providerEicIpPrefixes.hashCode());
 584             result = prime * result + providerCondGrpId;
 585             result = prime * result + providerEpgId;
 586             result = prime * result + ((consumerEicIpPrefixes == null) ? 0 : consumerEicIpPrefixes.hashCode());
 587             result = prime * result + consumerCondGrpId;
 588             result = prime * result + consumerEpgId;
 589             result = prime * result + ((consumerEpNodeId == null) ? 0 : consumerEpNodeId.hashCode());
 590             result = prime * result + ((providerEpNodeId == null) ? 0 : providerEpNodeId.hashCode());
 591
 592             return result;
 593         }
 594
 595         @Override
 596         public boolean equals(Object obj) {
 597             if (this == obj)
 598                 return true;
 599             if (obj == null)
 600                 return false;
 601             if (getClass() != obj.getClass())
 602                 return false;
 603             PolicyPair other = (PolicyPair) obj;
 604             if (providerEicIpPrefixes == null) {
 605                 if (other.providerEicIpPrefixes != null) {
 606                     return false;
 607                 }
 608             } else if (!providerEicIpPrefixes.equals(other.providerEicIpPrefixes)) {
 609                 return false;
 610             }
 611             if (consumerEicIpPrefixes == null) {
 612                 if (other.consumerEicIpPrefixes != null) {
 613                     return false;
 614                 }
 615             } else if (!consumerEicIpPrefixes.equals(other.consumerEicIpPrefixes)) {
 616                 return false;
 617             }
 618             if (consumerEpNodeId == null) {
 619                 if (other.consumerEpNodeId != null) {
 620                     return false;
 621                 }
 622             } else if (!consumerEpNodeId.getValue().equals(other.consumerEpNodeId.getValue())) {
 623                 return false;
 624             }
 625             if (providerEpNodeId == null) {
 626                 if (other.providerEpNodeId != null) {
 627                     return false;
 628                 }
 629             } else if (!providerEpNodeId.getValue().equals(other.providerEpNodeId.getValue())) {
 630                 return false;
 631             }
 632             if (providerCondGrpId != other.providerCondGrpId)
 633                 return false;
 634             if (providerEpgId != other.providerEpgId)
 635                 return false;
 636             if (consumerCondGrpId != other.consumerCondGrpId)
 637                 return false;
 638             if (consumerEpgId != other.consumerEpgId)
 639                 return false;
 640
 641             return true;
 642         }
 643
 644         @Override
 645         public String toString() {
 646             return new StringBuilder().append("consumerEPG: ")
 647                 .append(consumerEpgId)
 648                 .append("consumerCG: ")
 649                 .append(consumerCondGrpId)
 650                 .append("providerEPG: ")
 651                 .append(providerEpgId)
 652                 .append("providerCG: ")
 653                 .append(providerCondGrpId)
 654                 .append("consumerEpNodeId: ")
 655                 .append(consumerEpNodeId)
 656                 .append("providerEpNodeId: ")
 657                 .append(providerEpNodeId)
 658                 .append("consumerEicIpPrefixes: ")
 659                 .append(consumerEicIpPrefixes)
 660                 .append("providerEicIpPrefixes: ")
 661                 .append(providerEicIpPrefixes)
 662                 .toString();
 663         }
 664     }
 665
 666     public class NetworkElements {
 667
 668         private Endpoint srcEp;
 669         private Endpoint dstEp;
 670         private NodeId srcNodeId;
 671         private NodeId dstNodeId;
 672         private NodeId localNodeId;
 673         private EndpointFwdCtxOrdinals srcEpOrds;
 674         private EndpointFwdCtxOrdinals dstEpOrds;
 675
 676         public NetworkElements(Endpoint srcEp, Endpoint dstEp, NodeId nodeId, OfContext ctx, PolicyInfo policyInfo)
 677                 throws Exception {
 678             Preconditions.checkArgument(srcEp.getAugmentation(OfOverlayContext.class) != null);
 679             Preconditions.checkArgument(dstEp.getAugmentation(OfOverlayContext.class) != null);
 680
 681             this.srcEp = srcEp;
 682             this.dstEp = dstEp;
 683             this.localNodeId = nodeId;
 684             this.srcEpOrds = OrdinalFactory.getEndpointFwdCtxOrdinals(ctx, policyInfo, srcEp);
 685             this.dstEpOrds = OrdinalFactory.getEndpointFwdCtxOrdinals(ctx, policyInfo, dstEp);
 686             this.dstNodeId = dstEp.getAugmentation(OfOverlayContext.class).getNodeId();
 687             this.srcNodeId = srcEp.getAugmentation(OfOverlayContext.class).getNodeId();
 688         }
 689
 690
 691         public Endpoint getSrcEp() {
 692             return srcEp;
 693         }
 694
 695
 696         Endpoint getDstEp() {
 697             return dstEp;
 698         }
 699
 700
 701         public NodeId getSrcNodeId() {
 702             return srcNodeId;
 703         }
 704
 705
 706         public NodeId getDstNodeId() {
 707             return dstNodeId;
 708         }
 709
 710
 711         public NodeId getLocalNodeId() {
 712             return localNodeId;
 713         }
 714
 715
 716         public EndpointFwdCtxOrdinals getSrcEpOrds() {
 717             return srcEpOrds;
 718         }
 719
 720
 721         public EndpointFwdCtxOrdinals getDstEpOrds() {
 722             return dstEpOrds;
 723         }
 724
 725
 726
 727     }
 728 }