vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/AbstractAclServiceImpl.java

   1 /*
   2  * Copyright (c) 2016 Red Hat, Inc. and others. All rights reserved.
   3  *
   4  * This program and the accompanying materials are made available under the
   5  * terms of the Eclipse Public License v1.0 which accompanies this distribution,
   6  * and is available at http://www.eclipse.org/legal/epl-v10.html
   7  */
   8 package org.opendaylight.netvirt.aclservice;
   9
  10 import java.math.BigInteger;
  11 import java.util.ArrayList;
  12 import java.util.List;
  13 import org.opendaylight.controller.md.sal.binding.api.DataBroker;
  14 import org.opendaylight.genius.mdsalutil.ActionInfo;
  15 import org.opendaylight.genius.mdsalutil.ActionType;
  16 import org.opendaylight.genius.mdsalutil.FlowEntity;
  17 import org.opendaylight.genius.mdsalutil.InstructionInfo;
  18 import org.opendaylight.genius.mdsalutil.InstructionType;
  19 import org.opendaylight.genius.mdsalutil.MDSALUtil;
  20 import org.opendaylight.genius.mdsalutil.MatchInfoBase;
  21 import org.opendaylight.genius.mdsalutil.NwConstants;
  22 import org.opendaylight.genius.mdsalutil.interfaces.IMdsalApiManager;
  23 import org.opendaylight.netvirt.aclservice.api.AclServiceListener;
  24 import org.opendaylight.netvirt.aclservice.api.AclServiceManager.Action;
  25 import org.opendaylight.netvirt.aclservice.api.utils.AclInterface;
  26 import org.opendaylight.netvirt.aclservice.utils.AclConstants;
  27 import org.opendaylight.netvirt.aclservice.utils.AclServiceUtils;
  28 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.Ace;
  29 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.yang.types.rev130715.Uuid;
  30 import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.servicebinding.rev160406.ServiceModeBase;
  31 import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.servicebinding.rev160406.ServiceModeEgress;
  32 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.interfaces._interface.AllowedAddressPairs;
  33 import org.slf4j.Logger;
  34 import org.slf4j.LoggerFactory;
  35
  36 public abstract class AbstractAclServiceImpl implements AclServiceListener {
  37
  38     private static final Logger LOG = LoggerFactory.getLogger(AbstractAclServiceImpl.class);
  39
  40     private final IMdsalApiManager mdsalManager;
  41     private final Class<? extends ServiceModeBase> serviceMode;
  42     protected final DataBroker dataBroker;
  43
  44     /**
  45      * Initialize the member variables.
  46      *
  47      * @param serviceMode the service mode
  48      * @param dataBroker the data broker instance.
  49      * @param mdsalManager the mdsal manager instance.
  50      */
  51     public AbstractAclServiceImpl(Class<? extends ServiceModeBase> serviceMode, DataBroker dataBroker,
  52             IMdsalApiManager mdsalManager) {
  53         this.dataBroker = dataBroker;
  54         this.mdsalManager = mdsalManager;
  55         this.serviceMode = serviceMode;
  56     }
  57
  58     @Override
  59     public boolean applyAcl(AclInterface port) {
  60         BigInteger dpId = port.getDpId();
  61         if (dpId == null) {
  62             LOG.error("Unable to find DP Id from ACL interface with id {}", port.getInterfaceId());
  63             return false;
  64         }
  65
  66         programAclWithAllowedAddress(dpId, port.getAllowedAddressPairs(), port.getLPortTag(), port.getSecurityGroups(),
  67                 Action.ADD, NwConstants.ADD_FLOW);
  68
  69         // TODO: uncomment bindservice() when the acl flow programming is
  70         // implemented
  71         // bindService(port.getName());
  72         return true;
  73     }
  74
  75     @Override
  76     public boolean updateAcl(AclInterface portBefore, AclInterface portAfter) {
  77         boolean result = false;
  78         boolean isPortSecurityEnable = portAfter.getPortSecurityEnabled();
  79         boolean isPortSecurityEnableBefore = portBefore.getPortSecurityEnabled();
  80         // if port security is changed, apply/remove Acls
  81         if (isPortSecurityEnableBefore != isPortSecurityEnable) {
  82             if (isPortSecurityEnable) {
  83                 result = applyAcl(portAfter);
  84             } else {
  85                 result = removeAcl(portAfter);
  86             }
  87         } else if (isPortSecurityEnable) {
  88             // Acls has been updated, find added/removed Acls and act accordingly.
  89             processInterfaceUpdate(portBefore, portAfter);
  90         }
  91
  92         return result;
  93     }
  94
  95     private void processInterfaceUpdate(AclInterface portBefore, AclInterface portAfter) {
  96         BigInteger dpId = portAfter.getDpId();
  97         List<AllowedAddressPairs> addedAllowedAddressPairs =
  98                 AclServiceUtils.getUpdatedAllowedAddressPairs(portAfter.getAllowedAddressPairs(),
  99                         portBefore.getAllowedAddressPairs());
 100         List<AllowedAddressPairs> deletedAllowedAddressPairs =
 101                 AclServiceUtils.getUpdatedAllowedAddressPairs(portBefore.getAllowedAddressPairs(),
 102                         portAfter.getAllowedAddressPairs());
 103         if (addedAllowedAddressPairs != null && !addedAllowedAddressPairs.isEmpty()) {
 104             programAclWithAllowedAddress(dpId, addedAllowedAddressPairs, portAfter.getLPortTag(),
 105                     portAfter.getSecurityGroups(), Action.UPDATE, NwConstants.ADD_FLOW);
 106         }
 107         if (deletedAllowedAddressPairs != null && !deletedAllowedAddressPairs.isEmpty()) {
 108             programAclWithAllowedAddress(dpId, deletedAllowedAddressPairs, portAfter.getLPortTag(),
 109                     portAfter.getSecurityGroups(), Action.UPDATE, NwConstants.DEL_FLOW);
 110         }
 111
 112         List<Uuid> addedAcls = AclServiceUtils.getUpdatedAclList(portAfter.getSecurityGroups(),
 113                 portBefore.getSecurityGroups());
 114         List<Uuid> deletedAcls = AclServiceUtils.getUpdatedAclList(portBefore.getSecurityGroups(),
 115                 portAfter.getSecurityGroups());
 116         if (addedAcls != null && !addedAcls.isEmpty()) {
 117             updateCustomRules(dpId, portAfter.getLPortTag(), addedAcls, NwConstants.ADD_FLOW);
 118         }
 119         if (deletedAcls != null && !deletedAcls.isEmpty()) {
 120             updateCustomRules(dpId, portAfter.getLPortTag(), deletedAcls, NwConstants.DEL_FLOW);
 121         }
 122     }
 123
 124     private void updateCustomRules(BigInteger dpId, int lportTag, List<Uuid> aclUuidList, int action) {
 125         programAclRules(aclUuidList, dpId, lportTag, action);
 126     }
 127
 128     private void programAclWithAllowedAddress(BigInteger dpId, List<AllowedAddressPairs> allowedAddresses,
 129             int lportTag, List<Uuid> aclUuidList, Action action, int addOrRemove) {
 130         programFixedRules(dpId, "", allowedAddresses, lportTag, action, addOrRemove);
 131         if (action == Action.ADD || action == Action.REMOVE) {
 132             programAclRules(aclUuidList, dpId, lportTag, addOrRemove);
 133         }
 134     }
 135
 136     @Override
 137     public boolean removeAcl(AclInterface port) {
 138         BigInteger dpId = port.getDpId();
 139         if (dpId == null) {
 140             LOG.error("Unable to find DP Id from ACL interface with id {}", port.getInterfaceId());
 141             return false;
 142         }
 143
 144         programAclWithAllowedAddress(dpId, port.getAllowedAddressPairs(), port.getLPortTag(), port.getSecurityGroups(),
 145                 Action.REMOVE, NwConstants.DEL_FLOW);
 146         // TODO: uncomment unbindService() when the acl flow programming is
 147         // implemented
 148         // unbindService(port.getName());
 149         return true;
 150     }
 151
 152     @Override
 153     public boolean applyAce(AclInterface port, Ace ace) {
 154         if (!port.isPortSecurityEnabled()) {
 155             return false;
 156         }
 157         programAceRule(port.getDpId(), port.getLPortTag(), NwConstants.ADD_FLOW, ace);
 158         return true;
 159     }
 160
 161     @Override
 162     public boolean removeAce(AclInterface port, Ace ace) {
 163         if (!port.isPortSecurityEnabled()) {
 164             return false;
 165         }
 166         programAceRule(port.getDpId(), port.getLPortTag(), NwConstants.DEL_FLOW, ace);
 167         return true;
 168     }
 169
 170
 171     /**
 172      * Bind service.
 173      *
 174      * @param interfaceName the interface name
 175      */
 176     protected abstract void bindService(String interfaceName);
 177
 178     /**
 179      * Unbind service.
 180      *
 181      * @param interfaceName the interface name
 182      */
 183     protected abstract void unbindService(String interfaceName);
 184
 185     /**
 186      * Program the default anti-spoofing rule and the conntrack rules.
 187      *
 188      * @param dpid the dpid
 189      * @param dhcpMacAddress the dhcp mac address.
 190      * @param allowedAddresses the allowed addresses
 191      * @param lportTag the lport tag
 192      * @param action add/modify/remove action
 193      * @param addOrRemove addorRemove
 194      */
 195     protected abstract void programFixedRules(BigInteger dpid, String dhcpMacAddress,
 196             List<AllowedAddressPairs> allowedAddresses, int lportTag, Action action, int addOrRemove);
 197
 198     /**
 199      * Programs the acl custom rules.
 200      *
 201      * @param aclUuidList the list of acl uuid to be applied
 202      * @param dpId the dpId
 203      * @param lportTag the lport tag
 204      * @param addOrRemove whether to delete or add flow
 205      */
 206     protected abstract void programAclRules(List<Uuid> aclUuidList, BigInteger dpId, int lportTag, int addOrRemove);
 207
 208     /**
 209      * Programs the ace custom rule.
 210      *
 211      * @param dpId the dpId
 212      * @param lportTag the lport tag
 213      * @param addOrRemove whether to delete or add flow
 214      * @param ace rule to be program
 215      */
 216     protected abstract void programAceRule(BigInteger dpId, int lportTag, int addOrRemove, Ace ace);
 217
 218     /**
 219      * Writes/remove the flow to/from the datastore.
 220      * @param dpId the dpId
 221      * @param tableId the tableId
 222      * @param flowId the flowId
 223      * @param priority the priority
 224      * @param flowName the flow name
 225      * @param idleTimeOut the idle timeout
 226      * @param hardTimeOut the hard timeout
 227      * @param cookie the cookie
 228      * @param matches the list of matches to be writted
 229      * @param instructions the list of instruction to be written.
 230      * @param addOrRemove add or remove the entries.
 231      */
 232     protected void syncFlow(BigInteger dpId, short tableId, String flowId, int priority, String flowName,
 233                           int idleTimeOut, int hardTimeOut, BigInteger cookie, List<? extends MatchInfoBase>  matches,
 234                           List<InstructionInfo> instructions, int addOrRemove) {
 235         if (addOrRemove == NwConstants.DEL_FLOW) {
 236             FlowEntity flowEntity = MDSALUtil.buildFlowEntity(dpId, tableId,flowId,
 237                 priority, flowName , idleTimeOut, hardTimeOut, cookie, matches, null);
 238             LOG.trace("Removing Acl Flow DpnId {}, flowId {}", dpId, flowId);
 239             mdsalManager.removeFlow(flowEntity);
 240         } else {
 241             FlowEntity flowEntity = MDSALUtil.buildFlowEntity(dpId, tableId, flowId,
 242                 priority, flowName, idleTimeOut, hardTimeOut, cookie, matches, instructions);
 243             LOG.trace("Installing DpnId {}, flowId {}", dpId, flowId);
 244             mdsalManager.installFlow(flowEntity);
 245         }
 246     }
 247
 248     /**
 249      * Gets the dispatcher table resubmit instructions based on ingress/egress
 250      * service mode w.r.t switch.
 251      *
 252      * @param actionsInfos the actions infos
 253      * @return the instructions for dispatcher table resubmit
 254      */
 255     protected List<InstructionInfo> getDispatcherTableResubmitInstructions(List<ActionInfo> actionsInfos) {
 256         short dispatcherTableId = NwConstants.LPORT_DISPATCHER_TABLE;
 257         if (ServiceModeEgress.class.equals(this.serviceMode)) {
 258             dispatcherTableId = AclConstants.EGRESS_LPORT_DISPATCHER_TABLE;
 259         }
 260
 261         List<InstructionInfo> instructions = new ArrayList<>();
 262         actionsInfos.add(new ActionInfo(ActionType.nx_resubmit, new String[] {Short.toString(dispatcherTableId)}));
 263         instructions.add(new InstructionInfo(InstructionType.apply_actions, actionsInfos));
 264         return instructions;
 265     }
 266 }