package org.opendaylight.groupbasedpolicy.renderer.ofoverlay.flow;
+import java.util.Collections;
+import java.util.List;
+import java.util.ArrayList;
+import java.util.HashSet;
import java.util.Set;
+import org.opendaylight.groupbasedpolicy.dto.IndexedTenant;
import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.OfContext;
-import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.PolicyManager.FlowMap;
-import org.opendaylight.groupbasedpolicy.resolver.EgKey;
-import org.opendaylight.groupbasedpolicy.resolver.PolicyInfo;
+import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.OfWriter;
+import org.opendaylight.groupbasedpolicy.renderer.ofoverlay.endpoint.EndpointManager;
import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev100924.Ipv4Prefix;
import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev100924.Ipv6Prefix;
import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.inventory.rev130819.FlowId;
import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.inventory.rev130819.tables.table.Flow;
import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.inventory.rev130819.tables.table.FlowBuilder;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.flow.InstructionsBuilder;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.flow.Match;
import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.flow.MatchBuilder;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.common.rev140421.TenantId;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.instruction.instruction.go.to.table._case.GoToTable;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.instruction.list.Instruction;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.instruction.list.InstructionBuilder;
import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.endpoint.rev140421.endpoint.fields.L3Address;
import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.endpoint.rev140421.endpoints.Endpoint;
-import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.ofoverlay.rev140528.EndpointLocation.LocationType;
+
import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.ofoverlay.rev140528.OfOverlayContext;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.policy.rev140421.tenants.tenant.policy.ExternalImplicitGroup;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.ofoverlay.rev140528.Segmentation;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.policy.rev140421.tenants.Tenant;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.groupbasedpolicy.policy.rev140421.tenants.tenant.forwarding.context.L2FloodDomain;
import org.opendaylight.yang.gen.v1.urn.opendaylight.inventory.rev130819.NodeConnectorId;
import org.opendaylight.yang.gen.v1.urn.opendaylight.inventory.rev130819.NodeId;
import org.opendaylight.yang.gen.v1.urn.opendaylight.model.match.types.rev131026.match.Layer3Match;
}
@Override
- public void sync(NodeId nodeId, PolicyInfo policyInfo, FlowMap flowMap) {
+ public void sync(NodeId nodeId, OfWriter ofWriter) {
- // Allow traffic from tunnel and external ports
+ // Allow traffic from tunnel ports
NodeConnectorId tunnelIf = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlan.class);
if (tunnelIf != null)
- flowMap.writeFlow(nodeId, TABLE_ID, allowFromPort(tunnelIf));
- Set<NodeConnectorId> external =
- ctx.getSwitchManager().getExternalPorts(nodeId);
- for (NodeConnectorId extIf : external) {
- flowMap.writeFlow(nodeId, TABLE_ID, allowFromPort(extIf));
- }
+ ofWriter.writeFlow(nodeId, TABLE_ID, allowFromPort(tunnelIf));
// Default drop all
- flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(1), null));
+ ofWriter.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(1), null, TABLE_ID));
// Drop IP traffic that doesn't match a source IP rule
- flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(110), FlowUtils.ARP));
- flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(111), FlowUtils.IPv4));
- flowMap.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(112), FlowUtils.IPv6));
+ ofWriter.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(110), FlowUtils.ARP, TABLE_ID));
+ ofWriter.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(111), FlowUtils.IPv4, TABLE_ID));
+ ofWriter.writeFlow(nodeId, TABLE_ID, dropFlow(Integer.valueOf(112), FlowUtils.IPv6, TABLE_ID));
+ Set<TenantId> tenantIds = new HashSet<>();
for (Endpoint ep : ctx.getEndpointManager().getEndpointsForNode(nodeId)) {
OfOverlayContext ofc = ep.getAugmentation(OfOverlayContext.class);
+ if (ofc == null || ofc.getNodeConnectorId() == null) {
+ LOG.info("Endpoint {} does not contain node-connector-id. OFOverlay ignores the endpoint.",
+ ep.getKey());
+ continue;
+ }
- if (ofc != null && ofc.getNodeConnectorId() != null
- && (ofc.getLocationType() == null || LocationType.Internal.equals(ofc.getLocationType()))) {
+ tenantIds.add(ep.getTenant());
+ Set<ExternalImplicitGroup> eigs = getExternalImplicitGroupsForTenant(ep.getTenant());
+ if (EndpointManager.isInternal(ep, eigs)) {
// Allow layer 3 traffic (ARP and IP) with the correct
// source IP, MAC, and source port
- l3flow(flowMap, nodeId, ep, ofc, 120, false);
- l3flow(flowMap, nodeId, ep, ofc, 121, true);
- flowMap.writeFlow(nodeId, TABLE_ID, l3DhcpDoraFlow(ep, ofc, 115));
+ l3flow(ofWriter, nodeId, ep, ofc, 120, false);
+ l3flow(ofWriter, nodeId, ep, ofc, 121, true);
+ ofWriter.writeFlow(nodeId, TABLE_ID, l3DhcpDoraFlow(ep, ofc, 115));
// Allow layer 2 traffic with the correct source MAC and
// source port (note lower priority than drop IP rules)
- flowMap.writeFlow(nodeId, TABLE_ID, l2flow(ep, ofc, 100));
+ ofWriter.writeFlow(nodeId, TABLE_ID, l2flow(ep, ofc, 100));
+ } else { // EP is external
+ if (LOG.isTraceEnabled()) {
+ LOG.trace("External Endpoint is ignored in PortSecurity: {}", ep);
+ }
+ }
+ }
+
+ for (TenantId tenantId : tenantIds) {
+ for (NodeConnectorId nc : ctx.getSwitchManager().getExternalPorts(nodeId)) {
+ // TODO Bug 3546 - Difficult: External port is unrelated to Tenant, L3C, L2BD..
+ for (Flow flow : popVlanTagsOnExternalPort(nc, tenantId, 210)) {
+ // tagged frames have to be untagged when entering policy domain
+ ofWriter.writeFlow(nodeId, TABLE_ID, flow);
+ }
+ // allowing untagged frames entering policy domain
+ ofWriter.writeFlow(nodeId, TABLE_ID, allowFromExternalPort(nc, 200));
}
}
}
- private Flow allowFromPort(
- NodeConnectorId port) {
- FlowId flowid = new FlowId(new StringBuilder()
- .append("allow|")
- .append(port.getValue())
- .toString());
+ private Set<ExternalImplicitGroup> getExternalImplicitGroupsForTenant(TenantId tenantId) {
+ IndexedTenant tenant = ctx.getTenant(tenantId);
+ if (tenant == null) {
+ return Collections.emptySet();
+ }
+ return tenant.getExternalImplicitGroups();
+ }
+
+ private Flow allowFromPort(NodeConnectorId port) {
+ Match match = new MatchBuilder()
+ .setInPort(port)
+ .build();
+ FlowId flowid = FlowIdUtils.newFlowId(TABLE_ID, "allow", match);
FlowBuilder flowb = base()
.setId(flowid)
- .setPriority(Integer.valueOf(200))
- .setMatch(new MatchBuilder()
- .setInPort(port)
- .build())
+ .setPriority(Integer.valueOf(300))
+ .setMatch(match)
.setInstructions(FlowUtils.gotoTableInstructions(ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER()));
return flowb.build();
-
}
private Flow l2flow(Endpoint ep, OfOverlayContext ofc, Integer priority) {
- FlowId flowid = new FlowId(new StringBuilder()
- .append(ofc.getNodeConnectorId().getValue())
- .append("|")
- .append(ep.getMacAddress().getValue())
- .toString());
+ Match match = new MatchBuilder()
+ .setEthernetMatch(
+ FlowUtils.ethernetMatch(ep.getMacAddress(), null, null))
+ .setInPort(ofc.getNodeConnectorId())
+ .build();
+ FlowId flowid = FlowIdUtils.newFlowId(TABLE_ID, "L2", match);
FlowBuilder flowb = base()
.setPriority(priority)
.setId(flowid)
- .setMatch(new MatchBuilder()
- .setEthernetMatch(FlowUtils.ethernetMatch(ep.getMacAddress(),
- null, null))
- .setInPort(ofc.getNodeConnectorId())
- .build())
+ .setMatch(match)
.setInstructions(FlowUtils.gotoTableInstructions(ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER()));
return flowb.build();
String ikey = "255.255.255.255/32";
Layer3Match m = new Ipv4MatchBuilder().setIpv4Destination(new Ipv4Prefix(ikey)).build();
- FlowId flowid = new FlowId(new StringBuilder()
- .append(ofc.getNodeConnectorId().getValue())
- .append("|")
- .append(ep.getMacAddress().getValue())
- .append("|dhcp|")
- .append(etherType)
- .toString());
+ Match match = new MatchBuilder()
+ .setEthernetMatch(
+ FlowUtils.ethernetMatch(ep.getMacAddress(),
+ null,
+ etherType))
+ .setLayer3Match(m)
+ .setInPort(ofc.getNodeConnectorId())
+ .build();
+ FlowId flowid = FlowIdUtils.newFlowId(TABLE_ID, "dhcp", match);
Flow flow = base()
.setPriority(priority)
.setId(flowid)
- .setMatch(new MatchBuilder()
- .setEthernetMatch(FlowUtils.ethernetMatch(ep.getMacAddress(),
- null,
- etherType))
- .setLayer3Match(m)
- .setInPort(ofc.getNodeConnectorId())
- .build())
+ .setMatch(match)
.setInstructions(FlowUtils.gotoTableInstructions(ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER()))
.build();
-
return flow;
}
- private void l3flow(FlowMap flowMap, NodeId nodeId,
+ private void l3flow(OfWriter ofWriter, NodeId nodeId,
Endpoint ep, OfOverlayContext ofc,
Integer priority, boolean arp) {
if (ep.getL3Address() == null)
} else {
continue;
}
- FlowId flowid = new FlowId(new StringBuilder()
- .append(ofc.getNodeConnectorId().getValue())
- .append("|")
- .append(ep.getMacAddress().getValue())
- .append("|")
- .append(ikey)
- .append("|")
- .append(etherType)
- .toString());
+ Match match = new MatchBuilder()
+ .setEthernetMatch(
+ FlowUtils.ethernetMatch(ep.getMacAddress(),
+ null,
+ etherType))
+ .setLayer3Match(m)
+ .setInPort(ofc.getNodeConnectorId())
+ .build();
+ FlowId flowid = FlowIdUtils.newFlowId(TABLE_ID, "L3", match);
Flow flow = base()
.setPriority(priority)
.setId(flowid)
- .setMatch(new MatchBuilder()
- .setEthernetMatch(FlowUtils.ethernetMatch(ep.getMacAddress(),
- null,
- etherType))
- .setLayer3Match(m)
- .setInPort(ofc.getNodeConnectorId())
- .build())
+ .setMatch(match)
.setInstructions(FlowUtils.gotoTableInstructions(ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER()))
.build();
- flowMap.writeFlow(nodeId, TABLE_ID,flow);
+ ofWriter.writeFlow(nodeId, TABLE_ID,flow);
}
}
+
+ private Flow allowFromExternalPort(NodeConnectorId nc, Integer priority) {
+ Match match = new MatchBuilder().setInPort(nc).build();
+ FlowId flowid = FlowIdUtils.newFlowId(TABLE_ID, "allowExternal", match);
+ FlowBuilder flowb = base().setId(flowid)
+ .setPriority(Integer.valueOf(priority))
+ .setMatch(match)
+ .setInstructions(FlowUtils.gotoTableInstructions(ctx.getPolicyManager().getTABLEID_INGRESS_NAT()));
+ return flowb.build();
+ }
+
+ /**
+ * Pops VLAN tag for inbound traffic.
+ *
+ * @param nc should be external for now
+ * @param tenantId of {@link Tenant} from which {@link L2FloodDomain}s are read from which VLAN IDs are resolved.
+ * @param priority of flows in the table
+ * @return {@link Flow}s which match on ingress port, and VLAN ID to pop.
+ * {@link GoToTable} Instructions are set to INGRESS NAT table.
+ */
+ private List<Flow> popVlanTagsOnExternalPort(NodeConnectorId nc, TenantId tenantId, Integer priority) {
+ List<Flow> flows = new ArrayList<>();
+ for(L2FloodDomain l2Fd : ctx.getTenant(tenantId).getTenant().getForwardingContext().getL2FloodDomain()) {
+ Segmentation segmentation = l2Fd.getAugmentation(Segmentation.class);
+ if (segmentation != null) {
+ Integer vlanId = segmentation.getSegmentationId();
+ flows.add(buildPopVlanFlow(nc, vlanId, priority));
+ }
+ }
+ return flows;
+ }
+
+ private Flow buildPopVlanFlow(NodeConnectorId nc, Integer vlanId, int priority) {
+ Match match = new MatchBuilder()
+ .setVlanMatch(FlowUtils.vlanMatch(vlanId, true))
+ .setInPort(nc)
+ .build();
+ List<Instruction> instructions = new ArrayList<>();
+ instructions.add(FlowUtils.popVlanInstruction(0));
+ instructions.add(new InstructionBuilder().setOrder(1)
+ // TODO for now matches on external flows are passed to ingress nat table
+ .setInstruction(FlowUtils.gotoTableIns(ctx.getPolicyManager().getTABLEID_INGRESS_NAT()))
+ .build());
+ FlowId flowid = FlowIdUtils.newFlowId(TABLE_ID, "allowExternalPopVlan", match);
+ return base().setPriority(priority)
+ .setId(flowid)
+ .setMatch(match)
+ .setInstructions(new InstructionsBuilder().setInstruction(instructions).build())
+ .build();
+ }
}
Code Review / groupbasedpolicy.git / blobdiff