X-Git-Url: https://git.opendaylight.org/gerrit/gitweb?a=blobdiff_plain;f=vpnservice%2Faclservice%2Fimpl%2Fsrc%2Fmain%2Fjava%2Forg%2Fopendaylight%2Fnetvirt%2Faclservice%2FEgressAclServiceImpl.java;h=637ae9d041cff9e38c3a4ef3fef5862690f3b2fc;hb=18d02b166feafa5a4ce69f1dc8a66faa7032a1fc;hp=d786a13ece25a8ff108b5d0285be9e9ae6092c60;hpb=d791fb8df8fa520398b14fdfd8fd0ec875b31a1e;p=netvirt.git diff --git a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/EgressAclServiceImpl.java b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/EgressAclServiceImpl.java index d786a13ece..637ae9d041 100644 --- a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/EgressAclServiceImpl.java +++ b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/EgressAclServiceImpl.java @@ -16,7 +16,6 @@ import org.opendaylight.controller.md.sal.binding.api.DataBroker; import org.opendaylight.controller.md.sal.common.api.data.LogicalDatastoreType; import org.opendaylight.genius.mdsalutil.ActionInfo; import org.opendaylight.genius.mdsalutil.ActionType; -import org.opendaylight.genius.mdsalutil.FlowEntity; import org.opendaylight.genius.mdsalutil.InstructionInfo; import org.opendaylight.genius.mdsalutil.InstructionType; import org.opendaylight.genius.mdsalutil.MDSALUtil; @@ -27,32 +26,30 @@ import org.opendaylight.genius.mdsalutil.NwConstants; import org.opendaylight.genius.mdsalutil.NxMatchFieldType; import org.opendaylight.genius.mdsalutil.NxMatchInfo; import org.opendaylight.genius.mdsalutil.interfaces.IMdsalApiManager; -import org.opendaylight.netvirt.aclservice.api.AclServiceListener; import org.opendaylight.netvirt.aclservice.utils.AclConstants; +import org.opendaylight.netvirt.aclservice.utils.AclServiceOFFlowBuilder; +import org.opendaylight.netvirt.aclservice.utils.AclServiceUtils; import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.Acl; import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.AccessListEntries; import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.Ace; import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.Matches; import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.matches.AceType; import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.matches.ace.type.AceIp; -import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.interfaces.rev140508.interfaces.Interface; import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.yang.types.rev130715.Uuid; import org.opendaylight.yang.gen.v1.urn.opendaylight.flow.types.rev131026.instruction.list.Instruction; import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.rpcs.rev160406.OdlInterfaceRpcService; import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.servicebinding.rev160406.ServiceModeIngress; import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.servicebinding.rev160406.service.bindings.services.info.BoundServices; import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.DirectionEgress; +import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.IpPrefixOrAddress; import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.SecurityRuleAttr; import org.opendaylight.yangtools.yang.binding.InstanceIdentifier; import org.slf4j.Logger; import org.slf4j.LoggerFactory; -public class EgressAclServiceImpl implements AclServiceListener { +public class EgressAclServiceImpl extends AbstractAclServiceImpl { - private static final Logger logger = LoggerFactory.getLogger(EgressAclServiceImpl.class); - - private final IMdsalApiManager mdsalManager; - private final OdlInterfaceRpcService interfaceManager; + private static final Logger LOG = LoggerFactory.getLogger(EgressAclServiceImpl.class); private final DataBroker dataBroker; /** @@ -63,52 +60,8 @@ public class EgressAclServiceImpl implements AclServiceListener { */ public EgressAclServiceImpl(DataBroker dataBroker, OdlInterfaceRpcService interfaceManager, IMdsalApiManager mdsalManager) { + super(dataBroker,interfaceManager,mdsalManager); this.dataBroker = dataBroker; - this.interfaceManager = interfaceManager; - this.mdsalManager = mdsalManager; - } - - @Override - public boolean applyAcl(Interface port) { - - if (!AclServiceUtils.isPortSecurityEnabled(port)) { - return false; - } - BigInteger dpId = AclServiceUtils.getDpnForInterface(interfaceManager, port.getName()); - org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.interfaces.rev140508.interfaces.state.Interface - interfaceState = AclServiceUtils.getInterfaceStateFromOperDS(dataBroker, port.getName()); - String attachMac = interfaceState.getPhysAddress().getValue(); - programFixedSecurityGroup(dpId, "", attachMac, NwConstants.ADD_FLOW); - List securityGroupsUuid = AclServiceUtils.getPortSecurityGroups(port); - programCustomRules(port, securityGroupsUuid, dpId, attachMac,NwConstants.ADD_FLOW ); - // TODO: uncomment bindservice() when the acl flow programming is - // implemented - // bindService(port.getName()); - return true; - } - - @Override - public boolean updateAcl(Interface port) { - return false; - } - - @Override - public boolean removeAcl(Interface port) { - if (!AclServiceUtils.isPortSecurityEnabled(port)) { - return false; - } - BigInteger dpId = AclServiceUtils.getDpnForInterface(interfaceManager, port.getName()); - org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.interfaces.rev140508.interfaces.state.Interface - interfaceState = AclServiceUtils.getInterfaceStateFromOperDS(dataBroker, port.getName()); - String attachMac = interfaceState.getPhysAddress().getValue(); - programFixedSecurityGroup(dpId, "", attachMac, NwConstants.DEL_FLOW); - List securityGroupsUuid = AclServiceUtils.getPortSecurityGroups(port); - programCustomRules(port, securityGroupsUuid, dpId, attachMac,NwConstants.DEL_FLOW ); - - // TODO: uncomment unbindService() when the acl flow programming is - // implemented - // unbindService(port.getName()); - return true; } /** @@ -116,7 +69,7 @@ public class EgressAclServiceImpl implements AclServiceListener { * * @param interfaceName the interface name */ - private void bindService(String interfaceName) { + protected void bindService(String interfaceName) { int flowPriority = AclConstants.EGRESS_ACL_DEFAULT_FLOW_PRIORITY; int instructionKey = 0; @@ -124,7 +77,7 @@ public class EgressAclServiceImpl implements AclServiceListener { instructions.add(MDSALUtil.buildAndGetGotoTableInstruction(AclConstants.EGRESS_ACL_TABLE_ID, ++instructionKey)); BoundServices serviceInfo = AclServiceUtils.getBoundServices( String.format("%s.%s.%s", "vpn", "egressacl", interfaceName), AclConstants.EGRESS_ACL_SERVICE_PRIORITY, - flowPriority, AclServiceUtils.COOKIE_ACL_BASE, instructions); + flowPriority, AclConstants.COOKIE_ACL_BASE, instructions); InstanceIdentifier path = AclServiceUtils.buildServiceId(interfaceName, AclConstants.EGRESS_ACL_SERVICE_PRIORITY, ServiceModeIngress.class); MDSALUtil.syncWrite(dataBroker, LogicalDatastoreType.CONFIGURATION, path, serviceInfo); @@ -135,26 +88,12 @@ public class EgressAclServiceImpl implements AclServiceListener { * * @param interfaceName the interface name */ - private void unbindService(String interfaceName) { + protected void unbindService(String interfaceName) { InstanceIdentifier path = AclServiceUtils.buildServiceId(interfaceName, AclConstants.EGRESS_ACL_SERVICE_PRIORITY, ServiceModeIngress.class); MDSALUtil.syncDelete(dataBroker, LogicalDatastoreType.CONFIGURATION, path); } - /** - * Gets the instructions for dispatcher table resubmit. - * - * @return the instructions for dispatcher table resubmit - */ - private List getInstructionsForDispatcherTableResubmit() { - List instructions = new ArrayList<>(); - List actionsInfos = new ArrayList<>(); - actionsInfos.add(new ActionInfo(ActionType.nx_resubmit, - new String[] {Short.toString(NwConstants.LPORT_DISPATCHER_TABLE)})); - instructions.add(new InstructionInfo(InstructionType.apply_actions, actionsInfos)); - return instructions; - } - /** * Program the default anti-spoofing rule and the conntrack rules. * @@ -163,9 +102,9 @@ public class EgressAclServiceImpl implements AclServiceListener { * @param attachMac The vm mac address * @param addOrRemove addorRemove */ - private void programFixedSecurityGroup(BigInteger dpid, String dhcpMacAddress, - String attachMac, int addOrRemove) { - logger.info("programFixedSecurityGroup : adding default security group rules."); + protected void programFixedRules(BigInteger dpid, String dhcpMacAddress, + String attachMac, int addOrRemove) { + LOG.info("programFixedRules : adding default rules."); egressAclDhcpAllowClientTraffic(dpid, dhcpMacAddress, attachMac, addOrRemove); egressAclDhcpv6AllowClientTraffic(dpid, dhcpMacAddress, attachMac, addOrRemove); egressAclDhcpDropServerTraffic(dpid, dhcpMacAddress, attachMac, addOrRemove); @@ -180,62 +119,67 @@ public class EgressAclServiceImpl implements AclServiceListener { /** * Programs the custom flows. * - * @param port the interface - * @param securityGroupsUuid the list of SG uuid to be applied + * @param aclUuidList the list of acl uuid to be applied * @param dpId the dpId * @param attachMac the attached mac * @param addOrRemove whether to delete or add flow */ - private void programCustomRules(Interface port, List securityGroupsUuid, BigInteger dpId, String attachMac, - int addOrRemove) { - logger.trace("Applying custom rules DpId {}, vmMacAddress {}", dpId, attachMac ); - for (Uuid sgUuid :securityGroupsUuid ) { + protected void programAclRules(List aclUuidList, BigInteger dpId, String attachMac, + IpPrefixOrAddress attachIp, int addOrRemove) { + LOG.trace("Applying custom rules DpId {}, vmMacAddress {}", dpId, attachMac ); + for (Uuid sgUuid :aclUuidList ) { Acl acl = AclServiceUtils.getAcl(dataBroker, sgUuid.getValue()); + if (null == acl) { + LOG.warn("The ACL is empty"); + continue; + } AccessListEntries accessListEntries = acl.getAccessListEntries(); List aceList = accessListEntries.getAce(); for (Ace ace: aceList) { - SecurityRuleAttr aceAttr = AclServiceUtils.getAccesssListAttributes(ace); - - if (!aceAttr.getDirection().equals(DirectionEgress.class)) { - continue; - } - - Matches matches = ace.getMatches(); - AceType aceType = matches.getAceType(); - Map> flowMap = null; - if (aceType instanceof AceIp) { - flowMap = AclServiceOFFlowBuilder.programIpFlow(matches); - } - - if (null == flowMap) { - logger.error("Failed to apply ACL {} vmMacAddress {}", ace.getKey(), attachMac); - continue; - } - //The flow map contains list of flows if port range is selected. - for ( String flowName : flowMap.keySet()) { - List flows = flowMap.get(flowName); - flowName = flowName + "Egress" + attachMac; - flows .add(new MatchInfo(MatchFieldType.eth_src, - new String[] { attachMac })); - /*flows.add(new NxMatchInfo(NxMatchFieldType.ct_state, - new long[] { AclServiceUtils.TRACKED_NEW_CT_STATE, - AclServiceUtils.TRACKED_NEW_CT_STATE_MASK}));*/ - List instructions = new ArrayList<>(); - List actionsInfos = new ArrayList<>(); - actionsInfos.add(new ActionInfo(ActionType.nx_conntrack, - new String[] {"1", "0", "0", "255"}, 2)); - instructions.add(new InstructionInfo(InstructionType.apply_actions, - actionsInfos)); - instructions.add(new InstructionInfo(InstructionType.goto_table, - new long[] { AclConstants.EGRESS_ACL_NEXT_TABLE_ID })); - syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclServiceUtils.PROTO_MATCH_PRIORITY, - "ACL", 0, 0, AclServiceUtils.COOKIE_ACL_BASE, flows, instructions, addOrRemove); - } + programAceRule(dpId, attachMac, attachIp, addOrRemove, ace); } } } + protected void programAceRule(BigInteger dpId, String attachMac, IpPrefixOrAddress attachIp, int addOrRemove, + Ace ace) { + SecurityRuleAttr aceAttr = AclServiceUtils.getAccesssListAttributes(ace); + if (!aceAttr.getDirection().equals(DirectionEgress.class)) { + return; + } + Matches matches = ace.getMatches(); + AceType aceType = matches.getAceType(); + Map> flowMap = null; + if (aceType instanceof AceIp) { + flowMap = AclServiceOFFlowBuilder.programIpFlow(matches); + } + if (null == flowMap) { + LOG.error("Failed to apply ACL {} vmMacAddress {}", ace.getKey(), attachMac); + return; + } + //The flow map contains list of flows if port range is selected. + for ( String flowName : flowMap.keySet()) { + List flows = flowMap.get(flowName); + flowName += "Egress" + attachMac + String.valueOf(attachIp.getValue()) + ace.getKey().getRuleName(); + flows .add(new MatchInfo(MatchFieldType.eth_src, + new String[] { attachMac })); + flows.add(new NxMatchInfo(NxMatchFieldType.ct_state, + new long[] { AclConstants.TRACKED_NEW_CT_STATE, AclConstants.TRACKED_NEW_CT_STATE_MASK})); + flows.addAll(AclServiceUtils.getAllowedIpMatches(attachIp, MatchFieldType.ipv4_source)); + List instructions = new ArrayList<>(); + List actionsInfos = new ArrayList<>(); + actionsInfos.add(new ActionInfo(ActionType.nx_conntrack, + new String[] {"1", "0", "0", "255"}, 2)); + instructions.add(new InstructionInfo(InstructionType.apply_actions, + actionsInfos)); + instructions.add(new InstructionInfo(InstructionType.goto_table, + new long[] { AclConstants.EGRESS_ACL_NEXT_TABLE_ID })); + syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclConstants.PROTO_MATCH_PRIORITY, + "ACL", 0, 0, AclConstants.COOKIE_ACL_BASE, flows, instructions, addOrRemove); + } + } + /** * Anti-spoofing rule to block the Ipv4 DHCP server traffic from the port. * @param dpId the dpId @@ -245,12 +189,8 @@ public class EgressAclServiceImpl implements AclServiceListener { */ private void egressAclDhcpDropServerTraffic(BigInteger dpId, String dhcpMacAddress, String attachMac, int addOrRemove) { - List matches = AclServiceUtils.programDhcpMatches(AclServiceUtils.dhcpServerPort_IpV4, - AclServiceUtils.dhcpClientPort_IpV4); - matches.add(new MatchInfo(MatchFieldType.eth_src, - new String[] { attachMac })); - matches.add(new NxMatchInfo(NxMatchFieldType.ct_state, - new long[] { AclServiceUtils.TRACKED_NEW_CT_STATE, AclServiceUtils.TRACKED_NEW_CT_STATE_MASK})); + List matches = AclServiceUtils.buildDhcpSourceMatches(AclConstants.DHCP_SERVER_PORT_IPV4, + AclConstants.DHCP_CLIENT_PORT_IPV4, attachMac); List instructions = new ArrayList<>(); @@ -259,8 +199,8 @@ public class EgressAclServiceImpl implements AclServiceListener { actionsInfos.add(new ActionInfo(ActionType.drop_action, new String[] {})); String flowName = "Egress_DHCP_Server_v4" + dpId + "_" + attachMac + "_" + dhcpMacAddress + "_Drop_"; - syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclServiceUtils.PROTO_MATCH_PRIORITY, "ACL", 0, 0, - AclServiceUtils.COOKIE_ACL_BASE, matches, instructions, addOrRemove); + syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclConstants.PROTO_MATCH_PRIORITY, "ACL", 0, 0, + AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove); } /** @@ -272,12 +212,8 @@ public class EgressAclServiceImpl implements AclServiceListener { */ private void egressAclDhcpv6DropServerTraffic(BigInteger dpId, String dhcpMacAddress, String attachMac, int addOrRemove) { - List matches = AclServiceUtils.programDhcpMatches(AclServiceUtils.dhcpServerPort_Ipv6, - AclServiceUtils.dhcpClientPort_IpV6); - matches.add(new MatchInfo(MatchFieldType.eth_src, - new String[] { attachMac })); - matches.add(new NxMatchInfo(NxMatchFieldType.ct_state, - new long[] { AclServiceUtils.TRACKED_NEW_CT_STATE, AclServiceUtils.TRACKED_NEW_CT_STATE_MASK})); + List matches = AclServiceUtils.buildDhcpSourceMatches(AclConstants.DHCP_SERVER_PORT_IPV6, + AclConstants.DHCP_CLIENT_PORT_IPV6, attachMac); List instructions = new ArrayList<>(); @@ -285,29 +221,24 @@ public class EgressAclServiceImpl implements AclServiceListener { actionsInfos.add(new ActionInfo(ActionType.drop_action, new String[] {})); - String flowName = "Egress_DHCP_Server_v4" + "_" + dpId + "_" + attachMac + "_" + dhcpMacAddress + "_Drop_"; - syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclServiceUtils.PROTO_MATCH_PRIORITY, "ACL", 0, 0, - AclServiceUtils.COOKIE_ACL_BASE, matches, instructions, addOrRemove); + String flowName = "Egress_DHCP_Server_v6" + "_" + dpId + "_" + attachMac + "_" + dhcpMacAddress + "_Drop_"; + syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclConstants.PROTO_MATCH_PRIORITY, "ACL", 0, 0, + AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove); } /** * Add rule to ensure only DHCP server traffic from the specified mac is allowed. * - * @param dpidLong the dpid - * @param segmentationId the segmentation id + * @param dpId the dpid * @param dhcpMacAddress the DHCP server mac address - * @param attachMac the mac address of the port - * @param write is write or delete - * @param protoPortMatchPriority the priority + * @param attachMac the mac address of the port + * @param addOrRemove whether to add or remove the flow */ private void egressAclDhcpAllowClientTraffic(BigInteger dpId, String dhcpMacAddress, String attachMac, int addOrRemove) { - List matches = AclServiceUtils.programDhcpMatches(AclServiceUtils.dhcpClientPort_IpV4, - AclServiceUtils.dhcpServerPort_IpV4); - matches.add(new MatchInfo(MatchFieldType.eth_src, - new String[] { attachMac })); - matches.add(new NxMatchInfo(NxMatchFieldType.ct_state, - new long[] { AclServiceUtils.TRACKED_NEW_CT_STATE, AclServiceUtils.TRACKED_NEW_CT_STATE_MASK})); + final List matches = + AclServiceUtils.buildDhcpSourceMatches(AclConstants.DHCP_CLIENT_PORT_IPV4, + AclConstants.DHCP_SERVER_PORT_IPV4, attachMac); List instructions = new ArrayList<>(); @@ -322,28 +253,23 @@ public class EgressAclServiceImpl implements AclServiceListener { instructions.add(new InstructionInfo(InstructionType.goto_table, new long[] { AclConstants.EGRESS_ACL_NEXT_TABLE_ID })); String flowName = "Egress_DHCP_Client_v4" + dpId + "_" + attachMac + "_" + dhcpMacAddress + "_Permit_"; - syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclServiceUtils.PROTO_MATCH_PRIORITY, "ACL", 0, 0, - AclServiceUtils.COOKIE_ACL_BASE, matches, instructions, addOrRemove); + syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclConstants.PROTO_MATCH_PRIORITY, "ACL", 0, 0, + AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove); } /** * Add rule to ensure only DHCPv6 server traffic from the specified mac is allowed. * - * @param dpidLong the dpid - * @param segmentationId the segmentation id + * @param dpId the dpid * @param dhcpMacAddress the DHCP server mac address * @param attachMac the mac address of the port - * @param write is write or delete - * @param protoPortMatchPriority the priority + * @param addOrRemove whether to add or remove the flow */ private void egressAclDhcpv6AllowClientTraffic(BigInteger dpId, String dhcpMacAddress, String attachMac, int addOrRemove) { - List matches = AclServiceUtils.programDhcpMatches(AclServiceUtils.dhcpClientPort_IpV6, - AclServiceUtils.dhcpServerPort_Ipv6); - matches.add(new MatchInfo(MatchFieldType.eth_src, - new String[] { attachMac })); - matches.add(new NxMatchInfo(NxMatchFieldType.ct_state, - new long[] { AclServiceUtils.TRACKED_NEW_CT_STATE, AclServiceUtils.TRACKED_NEW_CT_STATE_MASK})); + final List matches = + AclServiceUtils.buildDhcpSourceMatches(AclConstants.DHCP_CLIENT_PORT_IPV6, + AclConstants.DHCP_SERVER_PORT_IPV6, attachMac); List instructions = new ArrayList<>(); @@ -356,9 +282,9 @@ public class EgressAclServiceImpl implements AclServiceListener { instructions.add(new InstructionInfo(InstructionType.goto_table, new long[] { AclConstants.EGRESS_ACL_NEXT_TABLE_ID })); - String flowName = "Egress_DHCP_Client_v4" + "_" + dpId + "_" + attachMac + "_" + dhcpMacAddress + "_Permit_"; - syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclServiceUtils.PROTO_MATCH_PRIORITY, "ACL", 0, 0, - AclServiceUtils.COOKIE_ACL_BASE, matches, instructions, addOrRemove); + String flowName = "Egress_DHCP_Client_v6" + "_" + dpId + "_" + attachMac + "_" + dhcpMacAddress + "_Permit_"; + syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclConstants.PROTO_MATCH_PRIORITY, "ACL", 0, 0, + AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove); } /** @@ -389,12 +315,12 @@ public class EgressAclServiceImpl implements AclServiceListener { instructions.add(new InstructionInfo(InstructionType.apply_actions, actionsInfos)); String flowName = "Egress_Fixed_Conntrk_Untrk_" + dpId + "_" + attachMac + "_" + flowId; - syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclServiceUtils.PROTO_MATCH_PRIORITY, "ACL", 0, 0, - AclServiceUtils.COOKIE_ACL_BASE, matches, instructions, addOrRemove); + syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclConstants.PROTO_MATCH_PRIORITY, "ACL", 0, 0, + AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove); } /** - * Adds the rule to forward the packets known packets . + * Adds the rule to forward the packets known packets. * @param dpId the dpId * @param attachMac the attached mac address * @param priority the priority of the flow @@ -423,7 +349,7 @@ public class EgressAclServiceImpl implements AclServiceListener { new long[] { AclConstants.EGRESS_ACL_NEXT_TABLE_ID })); String flowName = "Egress_Fixed_Conntrk_Untrk_" + dpId + "_" + attachMac + "_" + flowId; syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, priority, "ACL", 0, 0, - AclServiceUtils.COOKIE_ACL_BASE, matches, instructions, addOrRemove); + AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove); } /** @@ -453,7 +379,7 @@ public class EgressAclServiceImpl implements AclServiceListener { new String[] {})); String flowName = "Egress_Fixed_Conntrk_NewDrop_" + dpId + "_" + attachMac + "_" + flowId; syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, priority, "ACL", 0, 0, - AclServiceUtils.COOKIE_ACL_BASE, matches, instructions, addOrRemove); + AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove); } /** @@ -479,38 +405,8 @@ public class EgressAclServiceImpl implements AclServiceListener { instructions.add(new InstructionInfo(InstructionType.goto_table, new long[] { AclConstants.EGRESS_ACL_NEXT_TABLE_ID })); String flowName = "Egress_ARP_" + dpId + "_" + attachMac ; - syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclServiceUtils.PROTO_MATCH_PRIORITY, "ACL", 0, 0, - AclServiceUtils.COOKIE_ACL_BASE, matches, instructions, addOrRemove); - } - - /** - * Writes/remove the flow to/from the datastore. - * @param dpId the dpId - * @param tableId the tableId - * @param flowId the flowId - * @param priority the priority - * @param flowName the flow name - * @param idleTimeOut the idle timeout - * @param hardTimeOut the hard timeout - * @param cookie the cookie - * @param matches the list of matches to be writted - * @param instructions the list of instruction to be written. - * @param addOrRemove add or remove the entries. - */ - private void syncFlow(BigInteger dpId, short tableId, String flowId, int priority, String flowName, - int idleTimeOut, int hardTimeOut, BigInteger cookie, List matches, - List instructions, int addOrRemove) { - if (addOrRemove == NwConstants.DEL_FLOW) { - FlowEntity flowEntity = MDSALUtil.buildFlowEntity(dpId, tableId,flowId, - priority, flowName , idleTimeOut, hardTimeOut, cookie, matches, null); - logger.trace("Removing Acl Flow DpnId {}, flowId {}", dpId, flowId); - mdsalManager.removeFlow(flowEntity); - } else { - FlowEntity flowEntity = MDSALUtil.buildFlowEntity(dpId, tableId, flowId, - priority, flowName, idleTimeOut, hardTimeOut, cookie, matches, instructions); - logger.trace("Installing DpnId {}, flowId {}", dpId, flowId); - mdsalManager.installFlow(flowEntity); - } + syncFlow(dpId, AclConstants.EGRESS_ACL_TABLE_ID, flowName, AclConstants.PROTO_MATCH_PRIORITY, "ACL", 0, 0, + AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove); } /** @@ -520,18 +416,18 @@ public class EgressAclServiceImpl implements AclServiceListener { * @param write whether to add or remove the flow. */ private void programEgressAclFixedConntrackRule(BigInteger dpid, String attachMac, int write) { - programConntrackRecircRule(dpid, attachMac,AclServiceUtils.CT_STATE_UNTRACKED_PRIORITY, - "Untracked",AclServiceUtils.UNTRACKED_CT_STATE,AclServiceUtils.UNTRACKED_CT_STATE_MASK, write ); - programConntrackForwardRule(dpid, attachMac, AclServiceUtils.CT_STATE_TRACKED_EXIST_PRIORITY, - "Tracked_Established", AclServiceUtils.TRACKED_EST_CT_STATE, AclServiceUtils.TRACKED_CT_STATE_MASK, + programConntrackRecircRule(dpid, attachMac,AclConstants.CT_STATE_UNTRACKED_PRIORITY, + "Untracked",AclConstants.UNTRACKED_CT_STATE,AclConstants.UNTRACKED_CT_STATE_MASK, write ); + programConntrackForwardRule(dpid, attachMac, AclConstants.CT_STATE_TRACKED_EXIST_PRIORITY, + "Tracked_Established", AclConstants.TRACKED_EST_CT_STATE, AclConstants.TRACKED_CT_STATE_MASK, write ); - programConntrackForwardRule(dpid, attachMac, AclServiceUtils.CT_STATE_TRACKED_EXIST_PRIORITY, - "Tracked_Related", AclServiceUtils.TRACKED_REL_CT_STATE, AclServiceUtils.TRACKED_CT_STATE_MASK, write ); - programConntrackDropRule(dpid, attachMac, AclServiceUtils.CT_STATE_NEW_PRIORITY_DROP, - "Tracked_New", AclServiceUtils.TRACKED_NEW_CT_STATE, AclServiceUtils.TRACKED_NEW_CT_STATE_MASK, write ); - programConntrackDropRule(dpid, attachMac, AclServiceUtils.CT_STATE_NEW_PRIORITY_DROP, - "Tracked_Invalid",AclServiceUtils.TRACKED_INV_CT_STATE, AclServiceUtils.TRACKED_INV_CT_STATE_MASK, + programConntrackForwardRule(dpid, attachMac, AclConstants.CT_STATE_TRACKED_EXIST_PRIORITY, + "Tracked_Related", AclConstants.TRACKED_REL_CT_STATE, AclConstants.TRACKED_CT_STATE_MASK, write ); + programConntrackDropRule(dpid, attachMac, AclConstants.CT_STATE_NEW_PRIORITY_DROP, + "Tracked_New", AclConstants.TRACKED_NEW_CT_STATE, AclConstants.TRACKED_NEW_CT_STATE_MASK, write ); + programConntrackDropRule(dpid, attachMac, AclConstants.CT_STATE_NEW_PRIORITY_DROP, + "Tracked_Invalid",AclConstants.TRACKED_INV_CT_STATE, AclConstants.TRACKED_INV_CT_STATE_MASK, write ); - logger.info("programEgressAclFixedConntrackRule : default connection tracking rule are added."); + LOG.info("programEgressAclFixedConntrackRule : default connection tracking rule are added."); } }