package org.opendaylight.groupbasedpolicy.renderer.ofoverlay.flow;
+import java.util.Collection;
import java.util.Set;
import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.OfContext;
import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.inventory.rev130819.FlowId;
import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.inventory.rev130819.tables.table.Flow;
import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.inventory.rev130819.tables.table.FlowBuilder;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.flow.Match;
import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.flow.MatchBuilder;
import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.endpoint.rev140421.endpoint.fields.L3Address;
import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.endpoint.rev140421.endpoints.Endpoint;
protected static final Logger LOG =
LoggerFactory.getLogger(PortSecurity.class);
- public static final short TABLE_ID = 0;
+ public static short TABLE_ID;
- public PortSecurity(OfContext ctx) {
+ public PortSecurity(OfContext ctx, short tableId) {
super(ctx);
+ this.TABLE_ID=tableId;
}
@Override
@Override
public void sync(NodeId nodeId, PolicyInfo policyInfo, FlowMap flowMap) {
- // Allow traffic from tunnel and external ports
+ // Allow traffic from tunnel ports
NodeConnectorId tunnelIf = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlan.class);
if (tunnelIf != null)
flowMap.writeFlow(nodeId, TABLE_ID, allowFromPort(tunnelIf));
+
+ // Allow traffic from tunnel ports
+ //TODO Bug 3546 - Difficult: External port is unrelated to Tenant, L3C, L2BD..
+
Set<NodeConnectorId> external =
ctx.getSwitchManager().getExternalPorts(nodeId);
for (NodeConnectorId extIf : external) {
- flowMap.writeFlow(nodeId, TABLE_ID, allowFromPort(extIf));
+ flowMap.writeFlow(nodeId, TABLE_ID, allowFromExternalPort(extIf));
}
// Default drop all
- flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(1), null));
+ flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(1), null, TABLE_ID));
// Drop IP traffic that doesn't match a source IP rule
- flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(110), FlowUtils.ARP));
- flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(111), FlowUtils.IPv4));
- flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(112), FlowUtils.IPv6));
-
- for (EgKey sepg : ctx.getEndpointManager().getGroupsForNode(nodeId)) {
- for (Endpoint ep : ctx.getEndpointManager().getEndpointsForNode(nodeId, sepg)) {
- OfOverlayContext ofc = ep.getAugmentation(OfOverlayContext.class);
-
- if (ofc != null && ofc.getNodeConnectorId() != null &&
- (ofc.getLocationType() == null ||
- LocationType.Internal.equals(ofc.getLocationType()))) {
- // Allow layer 3 traffic (ARP and IP) with the correct
- // source IP, MAC, and source port
- l3flow(flowMap, nodeId, ep, ofc, 120, false);
- l3flow(flowMap, nodeId, ep, ofc, 121, true);
- flowMap.writeFlow(nodeId, TABLE_ID, l3DhcpDoraFlow(ep, ofc, 115));
-
- // Allow layer 2 traffic with the correct source MAC and
- // source port (note lower priority than drop IP rules)
- flowMap.writeFlow(nodeId, TABLE_ID, l2flow(ep, ofc, 100));
- }
+ flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(110), FlowUtils.ARP, TABLE_ID));
+ flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(111), FlowUtils.IPv4, TABLE_ID));
+ flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(112), FlowUtils.IPv6, TABLE_ID));
+
+ for (Endpoint ep : ctx.getEndpointManager().getEndpointsForNode(nodeId)) {
+ OfOverlayContext ofc = ep.getAugmentation(OfOverlayContext.class);
+
+ if (ofc != null && ofc.getNodeConnectorId() != null
+ && (ofc.getLocationType() == null || LocationType.Internal.equals(ofc.getLocationType()))) {
+ // Allow layer 3 traffic (ARP and IP) with the correct
+ // source IP, MAC, and source port
+ l3flow(flowMap, nodeId, ep, ofc, 120, false);
+ l3flow(flowMap, nodeId, ep, ofc, 121, true);
+ flowMap.writeFlow(nodeId, TABLE_ID, l3DhcpDoraFlow(ep, ofc, 115));
+
+ // Allow layer 2 traffic with the correct source MAC and
+ // source port (note lower priority than drop IP rules)
+ flowMap.writeFlow(nodeId, TABLE_ID, l2flow(ep, ofc, 100));
}
}
}
- private Flow allowFromPort(
- NodeConnectorId port) {
- FlowId flowid = new FlowId(new StringBuilder()
- .append("allow|")
- .append(port.getValue())
- .toString());
+ private Flow allowFromPort(NodeConnectorId port) {
+ Match match = new MatchBuilder()
+ .setInPort(port)
+ .build();
+ FlowId flowid = FlowIdUtils.newFlowId(TABLE_ID, "allow", match);
FlowBuilder flowb = base()
.setId(flowid)
.setPriority(Integer.valueOf(200))
- .setMatch(new MatchBuilder()
- .setInPort(port)
- .build())
- .setInstructions(FlowUtils.gotoTableInstructions((short) (getTableId() + 1)));
+ .setMatch(match)
+ .setInstructions(FlowUtils.gotoTableInstructions(ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER()));
return flowb.build();
+ }
+ private Flow allowFromExternalPort(NodeConnectorId port) {
+ Match match = new MatchBuilder()
+ .setInPort(port)
+ .build();
+ FlowId flowid = FlowIdUtils.newFlowId(TABLE_ID, "allowExternal", match);
+ FlowBuilder flowb = base()
+ .setId(flowid)
+ .setPriority(Integer.valueOf(200))
+ .setMatch(match)
+ .setInstructions(FlowUtils.gotoTableInstructions(ctx.getPolicyManager().getTABLEID_INGRESS_NAT()));
+ return flowb.build();
}
private Flow l2flow(Endpoint ep, OfOverlayContext ofc, Integer priority) {
- FlowId flowid = new FlowId(new StringBuilder()
- .append(ofc.getNodeConnectorId().getValue())
- .append("|")
- .append(ep.getMacAddress().getValue())
- .toString());
+ Match match = new MatchBuilder()
+ .setEthernetMatch(
+ FlowUtils.ethernetMatch(ep.getMacAddress(), null, null))
+ .setInPort(ofc.getNodeConnectorId())
+ .build();
+ FlowId flowid = FlowIdUtils.newFlowId(TABLE_ID, "L2", match);
FlowBuilder flowb = base()
.setPriority(priority)
.setId(flowid)
- .setMatch(new MatchBuilder()
- .setEthernetMatch(FlowUtils.ethernetMatch(ep.getMacAddress(),
- null, null))
- .setInPort(ofc.getNodeConnectorId())
- .build())
- .setInstructions(FlowUtils.gotoTableInstructions((short) (TABLE_ID + 1)));
+ .setMatch(match)
+ .setInstructions(FlowUtils.gotoTableInstructions(ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER()));
return flowb.build();
}
String ikey = "255.255.255.255/32";
Layer3Match m = new Ipv4MatchBuilder().setIpv4Destination(new Ipv4Prefix(ikey)).build();
- FlowId flowid = new FlowId(new StringBuilder()
- .append(ofc.getNodeConnectorId().getValue())
- .append("|")
- .append(ep.getMacAddress().getValue())
- .append("|dhcp|")
- .append(etherType)
- .toString());
+ Match match = new MatchBuilder()
+ .setEthernetMatch(
+ FlowUtils.ethernetMatch(ep.getMacAddress(),
+ null,
+ etherType))
+ .setLayer3Match(m)
+ .setInPort(ofc.getNodeConnectorId())
+ .build();
+ FlowId flowid = FlowIdUtils.newFlowId(TABLE_ID, "dhcp", match);
Flow flow = base()
.setPriority(priority)
.setId(flowid)
- .setMatch(new MatchBuilder()
- .setEthernetMatch(FlowUtils.ethernetMatch(ep.getMacAddress(),
- null,
- etherType))
- .setLayer3Match(m)
- .setInPort(ofc.getNodeConnectorId())
- .build())
- .setInstructions(FlowUtils.gotoTableInstructions((short) (TABLE_ID + 1)))
+ .setMatch(match)
+ .setInstructions(FlowUtils.gotoTableInstructions(ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER()))
.build();
return flow;
} else {
continue;
}
- FlowId flowid = new FlowId(new StringBuilder()
- .append(ofc.getNodeConnectorId().getValue())
- .append("|")
- .append(ep.getMacAddress().getValue())
- .append("|")
- .append(ikey)
- .append("|")
- .append(etherType)
- .toString());
+ Match match = new MatchBuilder()
+ .setEthernetMatch(
+ FlowUtils.ethernetMatch(ep.getMacAddress(),
+ null,
+ etherType))
+ .setLayer3Match(m)
+ .setInPort(ofc.getNodeConnectorId())
+ .build();
+ FlowId flowid = FlowIdUtils.newFlowId(TABLE_ID, "L3", match);
Flow flow = base()
.setPriority(priority)
.setId(flowid)
- .setMatch(new MatchBuilder()
- .setEthernetMatch(FlowUtils.ethernetMatch(ep.getMacAddress(),
- null,
- etherType))
- .setLayer3Match(m)
- .setInPort(ofc.getNodeConnectorId())
- .build())
- .setInstructions(FlowUtils.gotoTableInstructions((short) (TABLE_ID + 1)))
+ .setMatch(match)
+ .setInstructions(FlowUtils.gotoTableInstructions(ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER()))
.build();
flowMap.writeFlow(nodeId, TABLE_ID,flow);
Code Review / groupbasedpolicy.git / blobdiff