vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/AbstractEgressAclServiceImpl.java

   1 /*
   2  * Copyright (c) 2016 HPE, Inc. and others. All rights reserved.
   3  *
   4  * This program and the accompanying materials are made available under the
   5  * terms of the Eclipse Public License v1.0 which accompanies this distribution,
   6  * and is available at http://www.eclipse.org/legal/epl-v10.html
   7  */
   8 package org.opendaylight.netvirt.aclservice;
   9
  10 import com.google.common.util.concurrent.ListenableFuture;
  11 import java.math.BigInteger;
  12 import java.util.ArrayList;
  13 import java.util.Collections;
  14 import java.util.List;
  15 import java.util.Map;
  16 import java.util.Set;
  17 import java.util.stream.Collectors;
  18 import org.opendaylight.controller.md.sal.binding.api.DataBroker;
  19 import org.opendaylight.controller.md.sal.binding.api.WriteTransaction;
  20 import org.opendaylight.controller.md.sal.common.api.data.LogicalDatastoreType;
  21 import org.opendaylight.genius.datastoreutils.DataStoreJobCoordinator;
  22 import org.opendaylight.genius.mdsalutil.ActionInfo;
  23 import org.opendaylight.genius.mdsalutil.InstructionInfo;
  24 import org.opendaylight.genius.mdsalutil.MDSALUtil;
  25 import org.opendaylight.genius.mdsalutil.MatchInfoBase;
  26 import org.opendaylight.genius.mdsalutil.MetaDataUtil;
  27 import org.opendaylight.genius.mdsalutil.NwConstants;
  28 import org.opendaylight.genius.mdsalutil.instructions.InstructionGotoTable;
  29 import org.opendaylight.genius.mdsalutil.instructions.InstructionWriteMetadata;
  30 import org.opendaylight.genius.mdsalutil.interfaces.IMdsalApiManager;
  31 import org.opendaylight.genius.mdsalutil.matches.MatchArpSha;
  32 import org.opendaylight.genius.mdsalutil.matches.MatchEthernetSource;
  33 import org.opendaylight.genius.mdsalutil.matches.MatchEthernetType;
  34 import org.opendaylight.genius.utils.ServiceIndex;
  35 import org.opendaylight.netvirt.aclservice.api.AclServiceManager.Action;
  36 import org.opendaylight.netvirt.aclservice.api.utils.AclInterface;
  37 import org.opendaylight.netvirt.aclservice.utils.AclConstants;
  38 import org.opendaylight.netvirt.aclservice.utils.AclDataUtil;
  39 import org.opendaylight.netvirt.aclservice.utils.AclServiceOFFlowBuilder;
  40 import org.opendaylight.netvirt.aclservice.utils.AclServiceUtils;
  41 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.Acl;
  42 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.AccessListEntries;
  43 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.Ace;
  44 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.Matches;
  45 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.matches.AceType;
  46 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.matches.ace.type.AceIp;
  47 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.yang.types.rev130715.MacAddress;
  48 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.yang.types.rev130715.Uuid;
  49 import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.instruction.list.Instruction;
  50 import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.servicebinding.rev160406.ServiceModeEgress;
  51 import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.servicebinding.rev160406.ServiceModeIngress;
  52 import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.servicebinding.rev160406.service.bindings.services.info.BoundServices;
  53 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.DirectionEgress;
  54 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.IpPrefixOrAddress;
  55 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.SecurityRuleAttr;
  56 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.interfaces._interface.AllowedAddressPairs;
  57 import org.opendaylight.yangtools.yang.binding.InstanceIdentifier;
  58 import org.slf4j.Logger;
  59 import org.slf4j.LoggerFactory;
  60
  61 /**
  62  * Provides abstract implementation for egress (w.r.t VM) ACL service.
  63  *
  64  * <p>
  65  * Note: Table names used are w.r.t switch. Hence, switch ingress is VM egress
  66  * and vice versa.
  67  */
  68 public abstract class AbstractEgressAclServiceImpl extends AbstractAclServiceImpl {
  69
  70     private static final Logger LOG = LoggerFactory.getLogger(AbstractEgressAclServiceImpl.class);
  71
  72     /**
  73      * Initialize the member variables.
  74      *
  75      * @param dataBroker the data broker instance.
  76      * @param mdsalManager the mdsal manager instance.
  77      * @param aclDataUtil
  78      *            the acl data util.
  79      * @param aclServiceUtils
  80      *            the acl service util.
  81      */
  82     public AbstractEgressAclServiceImpl(DataBroker dataBroker, IMdsalApiManager mdsalManager, AclDataUtil aclDataUtil,
  83             AclServiceUtils aclServiceUtils) {
  84         // Service mode is w.rt. switch
  85         super(ServiceModeIngress.class, dataBroker, mdsalManager, aclDataUtil, aclServiceUtils);
  86     }
  87
  88     /**
  89      * Bind service.
  90      *
  91      * @param aclInterface the acl interface
  92      */
  93     @Override
  94     public void bindService(AclInterface aclInterface) {
  95         String interfaceName = aclInterface.getInterfaceId();
  96         DataStoreJobCoordinator dataStoreCoordinator = DataStoreJobCoordinator.getInstance();
  97         dataStoreCoordinator.enqueueJob(interfaceName,
  98             () -> {
  99                 int instructionKey = 0;
 100                 List<Instruction> instructions = new ArrayList<>();
 101                 Long vpnId = aclInterface.getVpnId();
 102                 if (vpnId != null) {
 103                     instructions.add(MDSALUtil.buildAndGetWriteMetadaInstruction(MetaDataUtil.getVpnIdMetadata(vpnId),
 104                         MetaDataUtil.METADATA_MASK_VRFID, ++instructionKey));
 105                     LOG.debug("Binding ACL service for interface {} with vpnId {}", interfaceName, vpnId);
 106                 } else {
 107                     Long elanTag = aclInterface.getElanId();
 108                     instructions.add(
 109                         MDSALUtil.buildAndGetWriteMetadaInstruction(MetaDataUtil.getElanTagMetadata(elanTag),
 110                         MetaDataUtil.METADATA_MASK_SERVICE, ++instructionKey));
 111                     LOG.debug("Binding ACL service for interface {} with ElanTag {}", interfaceName, elanTag);
 112                 }
 113                 instructions.add(
 114                         MDSALUtil.buildAndGetGotoTableInstruction(NwConstants.INGRESS_ACL_TABLE, ++instructionKey));
 115                 short serviceIndex = ServiceIndex.getIndex(NwConstants.ACL_SERVICE_NAME,
 116                         NwConstants.ACL_SERVICE_INDEX);
 117                 int flowPriority = AclConstants.EGRESS_ACL_DEFAULT_FLOW_PRIORITY;
 118                 BoundServices serviceInfo = AclServiceUtils.getBoundServices(
 119                         String.format("%s.%s.%s", "acl", "egressacl", interfaceName), serviceIndex, flowPriority,
 120                         AclConstants.COOKIE_ACL_BASE, instructions);
 121                 InstanceIdentifier<BoundServices> path =
 122                     AclServiceUtils.buildServiceId(interfaceName, serviceIndex, ServiceModeIngress.class);
 123
 124
 125                 WriteTransaction writeTxn = dataBroker.newWriteOnlyTransaction();
 126                 writeTxn.put(LogicalDatastoreType.CONFIGURATION, path, serviceInfo,
 127                         WriteTransaction.CREATE_MISSING_PARENTS);
 128
 129                 return Collections.singletonList(writeTxn.submit());
 130             });
 131     }
 132
 133     /**
 134      * Unbind service.
 135      *
 136      * @param aclInterface the acl interface
 137      */
 138     @Override
 139     protected void unbindService(AclInterface aclInterface) {
 140         String interfaceName = aclInterface.getInterfaceId();
 141         InstanceIdentifier<BoundServices> path =
 142                 AclServiceUtils.buildServiceId(interfaceName,
 143                         ServiceIndex.getIndex(NwConstants.ACL_SERVICE_NAME, NwConstants.ACL_SERVICE_INDEX),
 144                         ServiceModeIngress.class);
 145
 146         DataStoreJobCoordinator dataStoreCoordinator = DataStoreJobCoordinator.getInstance();
 147         LOG.debug("UnBinding ACL service for interface {}", interfaceName);
 148         dataStoreCoordinator.enqueueJob(interfaceName,
 149             () -> {
 150                 WriteTransaction writeTxn = dataBroker.newWriteOnlyTransaction();
 151                 writeTxn.delete(LogicalDatastoreType.CONFIGURATION, path);
 152
 153                 List<ListenableFuture<Void>> futures = new ArrayList<>();
 154                 futures.add(writeTxn.submit());
 155                 return futures;
 156             });
 157     }
 158
 159     @Override
 160     protected void programGeneralFixedRules(BigInteger dpid, String dhcpMacAddress,
 161             List<AllowedAddressPairs> allowedAddresses, int lportTag, Action action, int addOrRemove) {
 162         LOG.info("programFixedRules : {} default rules.", action == Action.ADD ? "adding" : "removing");
 163
 164         if (action == Action.ADD || action == Action.REMOVE) {
 165             Set<MacAddress> aapMacs =
 166                 allowedAddresses.stream().map(aap -> aap.getMacAddress()).collect(Collectors.toSet());
 167             egressAclDhcpAllowClientTraffic(dpid, aapMacs, lportTag, addOrRemove);
 168             egressAclDhcpv6AllowClientTraffic(dpid, aapMacs, lportTag, addOrRemove);
 169             egressAclDhcpDropServerTraffic(dpid, dhcpMacAddress, lportTag, addOrRemove);
 170             egressAclDhcpv6DropServerTraffic(dpid, dhcpMacAddress, lportTag, addOrRemove);
 171             egressAclIcmpv6DropRouterAdvts(dpid, lportTag, addOrRemove);
 172             egressAclIcmpv6AllowedList(dpid, lportTag, addOrRemove);
 173
 174             programArpRule(dpid, allowedAddresses, lportTag, addOrRemove);
 175         }
 176     }
 177
 178     @Override
 179     protected void updateArpForAllowedAddressPairs(BigInteger dpId, int lportTag, List<AllowedAddressPairs> deletedAAP,
 180             List<AllowedAddressPairs> addedAAP) {
 181         // Remove common allowedAddrPairIPs to avoid delete and add of ARP flows having same MAC and IP
 182         deletedAAP.removeAll(addedAAP);
 183         programArpRule(dpId, deletedAAP, lportTag, NwConstants.DEL_FLOW);
 184         programArpRule(dpId, addedAAP, lportTag, NwConstants.ADD_FLOW);
 185     }
 186
 187     @Override
 188     protected boolean programAclRules(AclInterface port, List<Uuid> aclUuidList, int addOrRemove) {
 189         BigInteger dpId = port.getDpId();
 190         LOG.debug("Applying custom rules on DpId {}, lportTag {}", dpId, port.getLPortTag());
 191         if (aclUuidList == null || dpId == null) {
 192             LOG.warn("one of the egress acl parameters can not be null. sg {}, dpId {}",
 193                     aclUuidList, dpId);
 194             return false;
 195         }
 196         for (Uuid sgUuid :aclUuidList) {
 197             Acl acl = AclServiceUtils.getAcl(dataBroker, sgUuid.getValue());
 198             if (null == acl) {
 199                 LOG.warn("The ACL is empty");
 200                 continue;
 201             }
 202             AccessListEntries accessListEntries = acl.getAccessListEntries();
 203             List<Ace> aceList = accessListEntries.getAce();
 204             for (Ace ace: aceList) {
 205                 programAceRule(port, addOrRemove, acl.getAclName(), ace, null);
 206             }
 207         }
 208         return true;
 209     }
 210
 211     @Override
 212     protected void programAceRule(AclInterface port, int addOrRemove, String aclName, Ace ace,
 213             List<AllowedAddressPairs> syncAllowedAddresses) {
 214         SecurityRuleAttr aceAttr = AclServiceUtils.getAccesssListAttributes(ace);
 215         if (!aceAttr.getDirection().equals(DirectionEgress.class)) {
 216             LOG.debug("Ignoring Ingress direction ACE Rule {}", ace.getRuleName());
 217             return;
 218         }
 219         Matches matches = ace.getMatches();
 220         AceType aceType = matches.getAceType();
 221         Map<String,List<MatchInfoBase>> flowMap = null;
 222         if (aceType instanceof AceIp) {
 223             flowMap = AclServiceOFFlowBuilder.programIpFlow(matches);
 224             if (syncAllowedAddresses != null) {
 225                 flowMap = AclServiceUtils.getFlowForAllowedAddresses(syncAllowedAddresses, flowMap, false);
 226             } else if (aceAttr.getRemoteGroupId() != null) {
 227                 flowMap = aclServiceUtils.getFlowForRemoteAcl(port, aceAttr.getRemoteGroupId(), port.getInterfaceId(),
 228                         flowMap, false);
 229             }
 230         }
 231         int lportTag = port.getLPortTag();
 232         if (null == flowMap) {
 233             LOG.error("Failed to apply ACL {} lportTag {}", ace.getKey(), lportTag);
 234             return;
 235         }
 236         for (String flowName : flowMap.keySet()) {
 237             syncSpecificAclFlow(port.getDpId(), lportTag, addOrRemove, ace, port.getInterfaceId(), flowMap, flowName);
 238         }
 239     }
 240
 241     @Override
 242     protected void updateRemoteAclTableForPort(AclInterface port, Uuid acl, int addOrRemove,
 243             AllowedAddressPairs ip, BigInteger aclId, BigInteger dpId) {
 244         Long elanTag = port.getElanId();
 245         Long vpnId = port.getVpnId();
 246         List<MatchInfoBase> flowMatches = new ArrayList<>();
 247         flowMatches.addAll(AclServiceUtils.buildIpAndDstServiceMatch(elanTag, ip, dataBroker, vpnId));
 248
 249         List<InstructionInfo> instructions = new ArrayList<>();
 250
 251         InstructionWriteMetadata writeMetatdata =
 252                 new InstructionWriteMetadata(AclServiceUtils.getAclIdMetadata(aclId),
 253                         MetaDataUtil.METADATA_MASK_REMOTE_ACL_ID);
 254         instructions.add(writeMetatdata);
 255         instructions.add(new InstructionGotoTable(getEgressAclFilterTable()));
 256
 257         Long serviceTag = vpnId != null ? vpnId : elanTag;
 258         String flowNameAdded = "Acl_Filter_Egress_" + new String(ip.getIpAddress().getValue()) + "_" + serviceTag;
 259
 260         syncFlow(dpId, getEgressAclRemoteAclTable(), flowNameAdded, AclConstants.NO_PRIORITY, "ACL", 0, 0,
 261                 AclConstants.COOKIE_ACL_BASE, flowMatches, instructions, addOrRemove);
 262     }
 263
 264     protected short getEgressAclFilterTable() {
 265         return NwConstants.INGRESS_ACL_FILTER_TABLE;
 266     }
 267
 268     protected short getEgressAclRemoteAclTable() {
 269         return NwConstants.INGRESS_ACL_REMOTE_ACL_TABLE;
 270     }
 271
 272     protected abstract String syncSpecificAclFlow(BigInteger dpId, int lportTag, int addOrRemove, Ace ace,
 273             String portId, Map<String, List<MatchInfoBase>> flowMap, String flowName);
 274
 275     /**
 276      * Anti-spoofing rule to block the Ipv4 DHCP server traffic from the port.
 277      *
 278      * @param dpId the dpId
 279      * @param dhcpMacAddress the Dhcp mac address
 280      * @param lportTag the lport tag
 281      * @param addOrRemove add/remove the flow.
 282      */
 283     protected void egressAclDhcpDropServerTraffic(BigInteger dpId, String dhcpMacAddress, int lportTag,
 284             int addOrRemove) {
 285         List<MatchInfoBase> matches = AclServiceUtils.buildDhcpMatches(AclConstants.DHCP_SERVER_PORT_IPV4,
 286                 AclConstants.DHCP_CLIENT_PORT_IPV4, lportTag, ServiceModeEgress.class);
 287
 288         String flowName = "Egress_DHCP_Server_v4" + dpId + "_" + lportTag + "_" + dhcpMacAddress + "_Drop_";
 289         syncFlow(dpId, NwConstants.INGRESS_ACL_TABLE, flowName,
 290                 AclConstants.PROTO_DHCP_CLIENT_TRAFFIC_MATCH_PRIORITY, "ACL", 0,
 291                 0, AclConstants.COOKIE_ACL_BASE, matches, Collections.emptyList(), addOrRemove);
 292     }
 293
 294     /**
 295      * Anti-spoofing rule to block the Ipv6 DHCP server traffic from the port.
 296      *
 297      * @param dpId the dpId
 298      * @param dhcpMacAddress the Dhcp mac address
 299      * @param lportTag the lport tag
 300      * @param addOrRemove add/remove the flow.
 301      */
 302     protected void egressAclDhcpv6DropServerTraffic(BigInteger dpId, String dhcpMacAddress, int lportTag,
 303             int addOrRemove) {
 304         List<MatchInfoBase> matches = AclServiceUtils.buildDhcpV6Matches(AclConstants.DHCP_SERVER_PORT_IPV6,
 305                 AclConstants.DHCP_CLIENT_PORT_IPV6, lportTag, ServiceModeEgress.class);
 306
 307         String flowName = "Egress_DHCP_Server_v6" + "_" + dpId + "_" + lportTag + "_" + dhcpMacAddress + "_Drop_";
 308         syncFlow(dpId, NwConstants.INGRESS_ACL_TABLE, flowName,
 309                 AclConstants.PROTO_DHCP_CLIENT_TRAFFIC_MATCH_PRIORITY, "ACL", 0,
 310                 0, AclConstants.COOKIE_ACL_BASE, matches, Collections.emptyList(), addOrRemove);
 311     }
 312
 313     /**
 314      * Anti-spoofing rule to block the Ipv6 Router Advts from the VM port.
 315      *
 316      * @param dpId the dpId
 317      * @param lportTag the lport tag
 318      * @param addOrRemove add/remove the flow.
 319      */
 320     private void egressAclIcmpv6DropRouterAdvts(BigInteger dpId, int lportTag, int addOrRemove) {
 321         List<MatchInfoBase> matches = AclServiceUtils.buildIcmpV6Matches(AclConstants.ICMPV6_TYPE_RA, 0, lportTag,
 322                 ServiceModeEgress.class);
 323
 324         String flowName = "Egress_ICMPv6" + "_" + dpId + "_" + lportTag + "_" + AclConstants.ICMPV6_TYPE_RA + "_Drop_";
 325         syncFlow(dpId, NwConstants.INGRESS_ACL_TABLE, flowName, AclConstants.PROTO_IPV6_DROP_PRIORITY, "ACL", 0,
 326                 0, AclConstants.COOKIE_ACL_BASE, matches, Collections.emptyList(), addOrRemove);
 327     }
 328
 329     /**
 330      * Add rule to allow certain ICMPv6 traffic from VM ports.
 331      *
 332      * @param dpId the dpId
 333      * @param lportTag the lport tag
 334      * @param addOrRemove add/remove the flow.
 335      */
 336     private void egressAclIcmpv6AllowedList(BigInteger dpId, int lportTag, int addOrRemove) {
 337         List<ActionInfo> actionsInfos = new ArrayList<>();
 338         List<InstructionInfo> instructions = getDispatcherTableResubmitInstructions(actionsInfos);
 339
 340         for (Integer icmpv6Type: AclConstants.allowedIcmpv6NdList()) {
 341             List<MatchInfoBase> matches = AclServiceUtils.buildIcmpV6Matches(icmpv6Type, 0, lportTag,
 342                     ServiceModeEgress.class);
 343             String flowName = "Egress_ICMPv6" + "_" + dpId + "_" + lportTag + "_" + icmpv6Type + "_Permit_";
 344             syncFlow(dpId, NwConstants.INGRESS_ACL_TABLE, flowName, AclConstants.PROTO_IPV6_ALLOWED_PRIORITY,
 345                     "ACL", 0, 0, AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove);
 346         }
 347     }
 348
 349     /**
 350      * Add rule to ensure only DHCP server traffic from the specified mac is
 351      * allowed.
 352      *
 353      * @param dpId the dpid
 354      * @param aapMacs the AAP mac addresses
 355      * @param lportTag the lport tag
 356      * @param addOrRemove whether to add or remove the flow
 357      */
 358     private void egressAclDhcpAllowClientTraffic(BigInteger dpId, Set<MacAddress> aapMacs, int lportTag,
 359             int addOrRemove) {
 360         List<ActionInfo> actionsInfos = new ArrayList<>();
 361         List<InstructionInfo> instructions = getDispatcherTableResubmitInstructions(actionsInfos);
 362         for (MacAddress aapMac : aapMacs) {
 363             List<MatchInfoBase> matches = new ArrayList<>();
 364             matches.addAll(AclServiceUtils.buildDhcpMatches(AclConstants.DHCP_CLIENT_PORT_IPV4,
 365                 AclConstants.DHCP_SERVER_PORT_IPV4, lportTag, ServiceModeEgress.class));
 366             matches.add(new MatchEthernetSource(aapMac));
 367
 368             String flowName = "Egress_DHCP_Client_v4" + dpId + "_" + lportTag + "_" + aapMac.getValue() + "_Permit_";
 369             syncFlow(dpId, NwConstants.INGRESS_ACL_TABLE, flowName,
 370                     AclConstants.PROTO_DHCP_CLIENT_TRAFFIC_MATCH_PRIORITY, "ACL", 0, 0, AclConstants.COOKIE_ACL_BASE,
 371                     matches, instructions, addOrRemove);
 372         }
 373     }
 374
 375     /**
 376      * Add rule to ensure only DHCPv6 server traffic from the specified mac is
 377      * allowed.
 378      *
 379      * @param dpId the dpid
 380      * @param aapMacs the AAP mac addresses
 381      * @param lportTag the lport tag
 382      * @param addOrRemove whether to add or remove the flow
 383      */
 384     private void egressAclDhcpv6AllowClientTraffic(BigInteger dpId, Set<MacAddress> aapMacs, int lportTag,
 385             int addOrRemove) {
 386         List<ActionInfo> actionsInfos = new ArrayList<>();
 387         List<InstructionInfo> instructions = getDispatcherTableResubmitInstructions(actionsInfos);
 388         for (MacAddress aapMac : aapMacs) {
 389             List<MatchInfoBase> matches = new ArrayList<>();
 390             matches.addAll(AclServiceUtils.buildDhcpV6Matches(AclConstants.DHCP_CLIENT_PORT_IPV6,
 391                 AclConstants.DHCP_SERVER_PORT_IPV6, lportTag, ServiceModeEgress.class));
 392             matches.add(new MatchEthernetSource(aapMac));
 393
 394             String flowName = "Egress_DHCP_Client_v6" + "_" + dpId + "_" + lportTag + "_" + aapMac.getValue()
 395                                     + "_Permit_";
 396             syncFlow(dpId, NwConstants.INGRESS_ACL_TABLE, flowName,
 397                     AclConstants.PROTO_DHCP_CLIENT_TRAFFIC_MATCH_PRIORITY, "ACL", 0, 0, AclConstants.COOKIE_ACL_BASE,
 398                     matches, instructions, addOrRemove);
 399         }
 400     }
 401
 402     /**
 403      * Adds the rule to allow arp packets.
 404      *
 405      * @param dpId the dpId
 406      * @param allowedAddresses the allowed addresses
 407      * @param lportTag the lport tag
 408      * @param addOrRemove whether to add or remove the flow
 409      */
 410     protected void programArpRule(BigInteger dpId, List<AllowedAddressPairs> allowedAddresses, int lportTag,
 411             int addOrRemove) {
 412         for (AllowedAddressPairs allowedAddress : allowedAddresses) {
 413             if (!AclServiceUtils.isIPv4Address(allowedAddress)) {
 414                 continue; // For IPv6 allowed addresses
 415             }
 416
 417             IpPrefixOrAddress allowedAddressIp = allowedAddress.getIpAddress();
 418             MacAddress allowedAddressMac = allowedAddress.getMacAddress();
 419             List<MatchInfoBase> arpIpMatches = AclServiceUtils.buildArpIpMatches(allowedAddressIp);
 420             List<MatchInfoBase> matches = new ArrayList<>();
 421             matches.add(MatchEthernetType.ARP);
 422             matches.add(new MatchArpSha(allowedAddressMac));
 423             matches.add(new MatchEthernetSource(allowedAddressMac));
 424             matches.addAll(arpIpMatches);
 425             matches.add(buildLPortTagMatch(lportTag));
 426
 427             List<InstructionInfo> instructions = getDispatcherTableResubmitInstructions(new ArrayList<>());
 428             LOG.debug(addOrRemove == NwConstants.DEL_FLOW ? "Deleting " : "Adding " + "ARP Rule on DPID {}, "
 429                     + "lportTag {}", dpId, lportTag);
 430             String flowName = "Egress_ARP_" + dpId + "_" + lportTag + "_" + allowedAddress.getMacAddress().getValue()
 431                     + String.valueOf(allowedAddressIp.getValue());
 432             syncFlow(dpId, NwConstants.INGRESS_ACL_TABLE, flowName,
 433                     AclConstants.PROTO_ARP_TRAFFIC_MATCH_PRIORITY, "ACL", 0, 0,
 434                     AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove);
 435         }
 436     }
 437
 438     protected MatchInfoBase buildLPortTagMatch(int lportTag) {
 439         return AclServiceUtils.buildLPortTagMatch(lportTag, ServiceModeEgress.class);
 440     }
 441 }