Bug 8981: ACL: ARP/DHCP anti-spoofing flows does not include VM/AAP ip/mac

matches in VM egress direction

ACL updated to include IP+MAC matches for ARP and MAC only matches for DHCP
with anti-spoofing flows in VM egress direction

Change-Id: If3e3de5a4ea66dc23c6bec5ba66881abb6cdbc0a
Signed-off-by: Shashidhar Raja <shashidharr@altencalsoftlabs.com>
Signed-off-by: Vivekanandan Narasimhan <n.vivekanandan@ericsson.com>

diff --git a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/AbstractEgressAclServiceImpl.java b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/AbstractEgressAclServiceImpl.java
index b932b0f82b17b0066e207b28a9c52b426f4ef011..5229b37209d90b0488412d9ba0f014f443108ed3 100644 (file)
--- a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/AbstractEgressAclServiceImpl.java
+++ b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/AbstractEgressAclServiceImpl.java
@@ -29,6 +29,7 @@ import org.opendaylight.genius.mdsalutil.instructions.InstructionGotoTable;
 import org.opendaylight.genius.mdsalutil.instructions.InstructionWriteMetadata;
 import org.opendaylight.genius.mdsalutil.interfaces.IMdsalApiManager;
 import org.opendaylight.genius.mdsalutil.matches.MatchArpSha;
+import org.opendaylight.genius.mdsalutil.matches.MatchEthernetSource;
 import org.opendaylight.genius.mdsalutil.matches.MatchEthernetType;
 import org.opendaylight.genius.utils.ServiceIndex;
 import org.opendaylight.netvirt.aclservice.api.AclServiceManager.Action;
@@ -50,6 +51,7 @@ import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.ser
 import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.servicebinding.rev160406.ServiceModeIngress;
 import org.opendaylight.yang.gen.v1.urn.opendaylight.genius.interfacemanager.servicebinding.rev160406.service.bindings.services.info.BoundServices;
 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.DirectionEgress;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.IpPrefixOrAddress;
 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.SecurityRuleAttr;
 import org.opendaylight.yang.gen.v1.urn.opendaylight.netvirt.aclservice.rev160608.interfaces._interface.AllowedAddressPairs;
 import org.opendaylight.yangtools.yang.binding.InstanceIdentifier;
@@ -160,9 +162,10 @@ public abstract class AbstractEgressAclServiceImpl extends AbstractAclServiceImp
         LOG.info("programFixedRules : {} default rules.", action == Action.ADD ? "adding" : "removing");
 
         if (action == Action.ADD || action == Action.REMOVE) {
-
-            egressAclDhcpAllowClientTraffic(dpid, dhcpMacAddress, lportTag, addOrRemove);
-            egressAclDhcpv6AllowClientTraffic(dpid, dhcpMacAddress, lportTag, addOrRemove);
+            Set<MacAddress> aapMacs =
+                allowedAddresses.stream().map(aap -> aap.getMacAddress()).collect(Collectors.toSet());
+            egressAclDhcpAllowClientTraffic(dpid, aapMacs, lportTag, addOrRemove);
+            egressAclDhcpv6AllowClientTraffic(dpid, aapMacs, lportTag, addOrRemove);
             egressAclDhcpDropServerTraffic(dpid, dhcpMacAddress, lportTag, addOrRemove);
             egressAclDhcpv6DropServerTraffic(dpid, dhcpMacAddress, lportTag, addOrRemove);
             egressAclIcmpv6DropRouterAdvts(dpid, lportTag, addOrRemove);
@@ -175,15 +178,10 @@ public abstract class AbstractEgressAclServiceImpl extends AbstractAclServiceImp
     @Override
     protected void updateArpForAllowedAddressPairs(BigInteger dpId, int lportTag, List<AllowedAddressPairs> deletedAAP,
             List<AllowedAddressPairs> addedAAP) {
-        Set<MacAddress> deletedAAPmacs =
-                deletedAAP.stream().map(AllowedAddressPairs::getMacAddress).collect(Collectors.toSet());
-        Set<MacAddress> addedAAPmacs =
-                addedAAP.stream().map(AllowedAddressPairs::getMacAddress).collect(Collectors.toSet());
-
-        // Remove common macs to avoid delete and add of ARP flows having same MAC.
-        deletedAAPmacs.removeAll(addedAAPmacs);
-        programArpRule(dpId, deletedAAPmacs, lportTag, NwConstants.DEL_FLOW);
-        programArpRule(dpId, addedAAPmacs, lportTag, NwConstants.ADD_FLOW);
+        // Remove common allowedAddrPairIPs to avoid delete and add of ARP flows having same MAC and IP
+        deletedAAP.removeAll(addedAAP);
+        programArpRule(dpId, deletedAAP, lportTag, NwConstants.DEL_FLOW);
+        programArpRule(dpId, addedAAP, lportTag, NwConstants.ADD_FLOW);
     }
 
     @Override
@@ -353,21 +351,25 @@ public abstract class AbstractEgressAclServiceImpl extends AbstractAclServiceImp
      * allowed.
      *
      * @param dpId the dpid
-     * @param dhcpMacAddress the DHCP server mac address
+     * @param aapMacs the AAP mac addresses
      * @param lportTag the lport tag
      * @param addOrRemove whether to add or remove the flow
      */
-    private void egressAclDhcpAllowClientTraffic(BigInteger dpId, String dhcpMacAddress, int lportTag,
+    private void egressAclDhcpAllowClientTraffic(BigInteger dpId, Set<MacAddress> aapMacs, int lportTag,
             int addOrRemove) {
-        final List<MatchInfoBase> matches = AclServiceUtils.buildDhcpMatches(AclConstants.DHCP_CLIENT_PORT_IPV4,
-                AclConstants.DHCP_SERVER_PORT_IPV4, lportTag, ServiceModeEgress.class);
-
         List<ActionInfo> actionsInfos = new ArrayList<>();
         List<InstructionInfo> instructions = getDispatcherTableResubmitInstructions(actionsInfos);
+        for (MacAddress aapMac : aapMacs) {
+            List<MatchInfoBase> matches = new ArrayList<>();
+            matches.addAll(AclServiceUtils.buildDhcpMatches(AclConstants.DHCP_CLIENT_PORT_IPV4,
+                AclConstants.DHCP_SERVER_PORT_IPV4, lportTag, ServiceModeEgress.class));
+            matches.add(new MatchEthernetSource(aapMac));
 
-        String flowName = "Egress_DHCP_Client_v4" + dpId + "_" + lportTag + "_" + dhcpMacAddress + "_Permit_";
-        syncFlow(dpId, NwConstants.INGRESS_ACL_TABLE, flowName, AclConstants.PROTO_DHCP_CLIENT_TRAFFIC_MATCH_PRIORITY,
-            "ACL", 0, 0, AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove);
+            String flowName = "Egress_DHCP_Client_v4" + dpId + "_" + lportTag + "_" + aapMac.getValue() + "_Permit_";
+            syncFlow(dpId, NwConstants.INGRESS_ACL_TABLE, flowName,
+                    AclConstants.PROTO_DHCP_CLIENT_TRAFFIC_MATCH_PRIORITY, "ACL", 0, 0, AclConstants.COOKIE_ACL_BASE,
+                    matches, instructions, addOrRemove);
+        }
     }
 
     /**
@@ -375,58 +377,58 @@ public abstract class AbstractEgressAclServiceImpl extends AbstractAclServiceImp
      * allowed.
      *
      * @param dpId the dpid
-     * @param dhcpMacAddress the DHCP server mac address
+     * @param aapMacs the AAP mac addresses
      * @param lportTag the lport tag
      * @param addOrRemove whether to add or remove the flow
      */
-    private void egressAclDhcpv6AllowClientTraffic(BigInteger dpId, String dhcpMacAddress, int lportTag,
+    private void egressAclDhcpv6AllowClientTraffic(BigInteger dpId, Set<MacAddress> aapMacs, int lportTag,
             int addOrRemove) {
-        final List<MatchInfoBase> matches = AclServiceUtils.buildDhcpV6Matches(AclConstants.DHCP_CLIENT_PORT_IPV6,
-                AclConstants.DHCP_SERVER_PORT_IPV6, lportTag, ServiceModeEgress.class);
-
         List<ActionInfo> actionsInfos = new ArrayList<>();
         List<InstructionInfo> instructions = getDispatcherTableResubmitInstructions(actionsInfos);
+        for (MacAddress aapMac : aapMacs) {
+            List<MatchInfoBase> matches = new ArrayList<>();
+            matches.addAll(AclServiceUtils.buildDhcpV6Matches(AclConstants.DHCP_CLIENT_PORT_IPV6,
+                AclConstants.DHCP_SERVER_PORT_IPV6, lportTag, ServiceModeEgress.class));
+            matches.add(new MatchEthernetSource(aapMac));
 
-        String flowName = "Egress_DHCP_Client_v6" + "_" + dpId + "_" + lportTag + "_" + dhcpMacAddress + "_Permit_";
-        syncFlow(dpId, NwConstants.INGRESS_ACL_TABLE, flowName, AclConstants.PROTO_DHCP_CLIENT_TRAFFIC_MATCH_PRIORITY,
-            "ACL", 0, 0, AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove);
+            String flowName = "Egress_DHCP_Client_v6" + "_" + dpId + "_" + lportTag + "_" + aapMac.getValue()
+                                    + "_Permit_";
+            syncFlow(dpId, NwConstants.INGRESS_ACL_TABLE, flowName,
+                    AclConstants.PROTO_DHCP_CLIENT_TRAFFIC_MATCH_PRIORITY, "ACL", 0, 0, AclConstants.COOKIE_ACL_BASE,
+                    matches, instructions, addOrRemove);
+        }
     }
 
     /**
-     * Program arp rule.
+     * Adds the rule to allow arp packets.
      *
-     * @param dpId the dp id
+     * @param dpId the dpId
      * @param allowedAddresses the allowed addresses
      * @param lportTag the lport tag
      * @param addOrRemove whether to add or remove the flow
      */
     protected void programArpRule(BigInteger dpId, List<AllowedAddressPairs> allowedAddresses, int lportTag,
             int addOrRemove) {
-        // Collecting macs as a set to avoid duplicate
-        Set<MacAddress> macs =
-                allowedAddresses.stream().map(AllowedAddressPairs::getMacAddress).collect(Collectors.toSet());
-        programArpRule(dpId, macs, lportTag, addOrRemove);
-    }
+        for (AllowedAddressPairs allowedAddress : allowedAddresses) {
+            if (!AclServiceUtils.isIPv4Address(allowedAddress)) {
+                continue; // For IPv6 allowed addresses
+            }
 
-    /**
-     * Adds the rule to allow arp packets.
-     *
-     * @param dpId the dpId
-     * @param macs the set of MACs
-     * @param lportTag the lport tag
-     * @param addOrRemove whether to add or remove the flow
-     */
-    protected void programArpRule(BigInteger dpId, Set<MacAddress> macs, int lportTag, int addOrRemove) {
-        for (MacAddress mac : macs) {
+            IpPrefixOrAddress allowedAddressIp = allowedAddress.getIpAddress();
+            MacAddress allowedAddressMac = allowedAddress.getMacAddress();
+            List<MatchInfoBase> arpIpMatches = AclServiceUtils.buildArpIpMatches(allowedAddressIp);
             List<MatchInfoBase> matches = new ArrayList<>();
             matches.add(MatchEthernetType.ARP);
-            matches.add(new MatchArpSha(mac));
+            matches.add(new MatchArpSha(allowedAddressMac));
+            matches.add(new MatchEthernetSource(allowedAddressMac));
+            matches.addAll(arpIpMatches);
             matches.add(buildLPortTagMatch(lportTag));
 
             List<InstructionInfo> instructions = getDispatcherTableResubmitInstructions(new ArrayList<>());
             LOG.debug(addOrRemove == NwConstants.DEL_FLOW ? "Deleting " : "Adding " + "ARP Rule on DPID {}, "
                     + "lportTag {}", dpId, lportTag);
-            String flowName = "Egress_ARP_" + dpId + "_" + lportTag + "_" + mac.getValue();
+            String flowName = "Egress_ARP_" + dpId + "_" + lportTag + "_" + allowedAddress.getMacAddress().getValue()
+                    + String.valueOf(allowedAddressIp.getValue());
             syncFlow(dpId, NwConstants.INGRESS_ACL_TABLE, flowName,
                     AclConstants.PROTO_ARP_TRAFFIC_MATCH_PRIORITY, "ACL", 0, 0,
                     AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove);

diff --git a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/utils/AclServiceUtils.java b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/utils/AclServiceUtils.java
index d7da3d99a17d8da9d01b1ab365823425b7034e4a..93cfc120aac5ca2a2a45328f0ac40a90de0eaedd 100644 (file)
--- a/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/utils/AclServiceUtils.java
+++ b/vpnservice/aclservice/impl/src/main/java/org/opendaylight/netvirt/aclservice/utils/AclServiceUtils.java
@@ -29,6 +29,7 @@ import org.opendaylight.genius.mdsalutil.MatchInfoBase;
 import org.opendaylight.genius.mdsalutil.MetaDataUtil;
 import org.opendaylight.genius.mdsalutil.NwConstants;
 import org.opendaylight.genius.mdsalutil.NxMatchInfo;
+import org.opendaylight.genius.mdsalutil.matches.MatchArpSpa;
 import org.opendaylight.genius.mdsalutil.matches.MatchEthernetType;
 import org.opendaylight.genius.mdsalutil.matches.MatchIcmpv6;
 import org.opendaylight.genius.mdsalutil.matches.MatchIpProtocol;
@@ -303,7 +304,7 @@ public final class AclServiceUtils {
      */
     public static List<MatchInfoBase> buildDhcpMatches(int srcPort, int dstPort, int lportTag,
             Class<? extends ServiceModeBase> serviceMode) {
-        List<MatchInfoBase> matches = new ArrayList<>(6);
+        List<MatchInfoBase> matches = new ArrayList<>(5);
         matches.add(MatchEthernetType.IPV4);
         matches.add(MatchIpProtocol.UDP);
         matches.add(new MatchUdpDestinationPort(dstPort));
@@ -495,6 +496,28 @@ public final class AclServiceUtils {
         return flowMatches;
     }
 
+    /**
+     * Builds the arp ip matches.
+     * @param ipPrefixOrAddress the ip prefix or address
+     * @return the MatchInfoBase list
+     */
+    public static List<MatchInfoBase> buildArpIpMatches(IpPrefixOrAddress ipPrefixOrAddress) {
+        List<MatchInfoBase> flowMatches = new ArrayList<>();
+        IpPrefix ipPrefix = ipPrefixOrAddress.getIpPrefix();
+        if (ipPrefix != null) {
+            Ipv4Prefix ipv4Prefix = ipPrefix.getIpv4Prefix();
+            if (ipv4Prefix != null && !ipv4Prefix.getValue().equals(AclConstants.IPV4_ALL_NETWORK)) {
+                flowMatches.add(new MatchArpSpa(ipv4Prefix));
+            }
+        } else {
+            IpAddress ipAddress = ipPrefixOrAddress.getIpAddress();
+            if (ipAddress != null && ipAddress.getIpv4Address() != null) {
+                flowMatches.add(new MatchArpSpa(ipAddress.getIpv4Address().getValue(), "32"));
+            }
+        }
+        return flowMatches;
+    }
+
     private List<MatchInfoBase> buildAclIdMetadataMatch(Uuid remoteAclId) {
         List<MatchInfoBase> flowMatches = new ArrayList<>();
         BigInteger aclId = buildAclId(remoteAclId);
@@ -606,7 +629,7 @@ public final class AclServiceUtils {
         return config;
     }
 
-    private static boolean isIPv4Address(AllowedAddressPairs aap) {
+    public static boolean isIPv4Address(AllowedAddressPairs aap) {
         IpPrefixOrAddress ipPrefixOrAddress = aap.getIpAddress();
         IpPrefix ipPrefix = ipPrefixOrAddress.getIpPrefix();
         if (ipPrefix != null) {
@@ -615,7 +638,7 @@ public final class AclServiceUtils {
             }
         } else {
             IpAddress ipAddress = ipPrefixOrAddress.getIpAddress();
-            if (ipAddress.getIpv4Address() != null) {
+            if (ipAddress != null && ipAddress.getIpv4Address() != null) {
                 return true;
             }
         }

diff --git a/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsBase.xtend b/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsBase.xtend
index 0d1d95114cf9d3d61ec375c49b82095705edb687..ec1f65521cc97604cd792e6e420a9343d5a8f679 100644 (file)
--- a/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsBase.xtend
+++ b/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsBase.xtend
@@ -14,6 +14,8 @@ import org.opendaylight.genius.mdsalutil.instructions.InstructionApplyActions
 import org.opendaylight.genius.mdsalutil.instructions.InstructionGotoTable
 import org.opendaylight.genius.mdsalutil.instructions.InstructionWriteMetadata
 import org.opendaylight.genius.mdsalutil.matches.MatchArpSha
+import org.opendaylight.genius.mdsalutil.matches.MatchArpSpa
+import org.opendaylight.genius.mdsalutil.matches.MatchEthernetSource
 import org.opendaylight.genius.mdsalutil.matches.MatchEthernetType
 import org.opendaylight.genius.mdsalutil.matches.MatchIcmpv6
 import org.opendaylight.genius.mdsalutil.matches.MatchIpProtocol
@@ -23,6 +25,7 @@ import org.opendaylight.genius.mdsalutil.matches.MatchMetadata
 import org.opendaylight.genius.mdsalutil.matches.MatchUdpDestinationPort
 import org.opendaylight.genius.mdsalutil.matches.MatchUdpSourcePort
 import org.opendaylight.genius.mdsalutil.nxmatches.NxMatchRegister
+import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.Ipv4Prefix
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.yang.types.rev130715.MacAddress
 import org.opendaylight.yang.gen.v1.urn.opendaylight.openflowjava.nx.match.rev140421.NxmNxReg6
 
@@ -160,7 +163,7 @@ class FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_DHCP_Client_v4123_987__Permit_"
+                flowId = "Egress_DHCP_Client_v4123_987_0D:AA:D8:42:30:F3_Permit_"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -172,7 +175,8 @@ class FlowEntryObjectsBase {
                     new MatchIpProtocol(17 as short),
                     new MatchUdpDestinationPort(67),
                     new MatchUdpSourcePort(68),
-                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F3"))
                 ]
                 priority = 63010
                 tableId = 211 as short
@@ -180,7 +184,7 @@ class FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_DHCP_Client_v6_123_987__Permit_"
+                flowId = "Egress_DHCP_Client_v6_123_987_0D:AA:D8:42:30:F3_Permit_"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -192,7 +196,8 @@ class FlowEntryObjectsBase {
                     new MatchIpProtocol(17 as short),
                     new MatchUdpDestinationPort(547),
                     new MatchUdpSourcePort(546),
-                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F3"))
                 ]
                 priority = 63010
                 tableId = 211 as short
@@ -313,7 +318,7 @@ class FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_ARP_123_987_0D:AA:D8:42:30:F3"
+                flowId = "Egress_ARP_123_987_0D:AA:D8:42:30:F310.0.0.1/32"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -323,6 +328,8 @@ class FlowEntryObjectsBase {
                 matchInfoList = #[
                     new MatchEthernetType(2054L),
                     new MatchArpSha(new MacAddress("0D:AA:D8:42:30:F3")),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F3")),
+                    new MatchArpSpa(new Ipv4Prefix("10.0.0.1/32")),
                     new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
                 ]
                 priority = 63010
@@ -455,7 +462,7 @@ class FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_DHCP_Client_v4123_987__Permit_"
+                flowId = "Egress_DHCP_Client_v4123_987_0D:AA:D8:42:30:F4_Permit_"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -467,7 +474,8 @@ class FlowEntryObjectsBase {
                     new MatchIpProtocol(17 as short),
                     new MatchUdpDestinationPort(67 as short),
                     new MatchUdpSourcePort(68 as short),
-                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F4"))
                 ]
                 priority = 63010
                 tableId = 211 as short
@@ -475,7 +483,7 @@ class FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_DHCP_Client_v6_123_987__Permit_"
+                flowId = "Egress_DHCP_Client_v6_123_987_0D:AA:D8:42:30:F4_Permit_"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -487,7 +495,8 @@ class FlowEntryObjectsBase {
                     new MatchIpProtocol(17 as short),
                     new MatchUdpDestinationPort(547 as short),
                     new MatchUdpSourcePort(546 as short),
-                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F4"))
                 ]
                 priority = 63010
                 tableId = 211 as short
@@ -607,7 +616,7 @@ class FlowEntryObjectsBase {
            new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_ARP_123_987_0D:AA:D8:42:30:F4"
+                flowId = "Egress_ARP_123_987_0D:AA:D8:42:30:F410.0.0.2/32"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -617,6 +626,8 @@ class FlowEntryObjectsBase {
                 matchInfoList = #[
                     new MatchEthernetType(2054L),
                     new MatchArpSha(new MacAddress("0D:AA:D8:42:30:F4")),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F4")),
+                    new MatchArpSpa(new Ipv4Prefix("10.0.0.2/32")),
                     new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
                 ]
                 priority = 63010
@@ -749,7 +760,7 @@ class FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_DHCP_Client_v4123_987__Permit_"
+                flowId = "Egress_DHCP_Client_v4123_987_0D:AA:D8:42:30:F5_Permit_"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -761,7 +772,8 @@ class FlowEntryObjectsBase {
                     new MatchIpProtocol(17 as short),
                     new MatchUdpDestinationPort(67),
                     new MatchUdpSourcePort(68),
-                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F5"))
                 ]
                 priority = 63010
                 tableId = 211 as short
@@ -769,7 +781,7 @@ class FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_DHCP_Client_v6_123_987__Permit_"
+                flowId = "Egress_DHCP_Client_v6_123_987_0D:AA:D8:42:30:F5_Permit_"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -781,7 +793,8 @@ class FlowEntryObjectsBase {
                     new MatchIpProtocol(17 as short),
                     new MatchUdpDestinationPort(547),
                     new MatchUdpSourcePort(546),
-                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F5"))
                 ]
                 priority = 63010
                 tableId = 211 as short
@@ -896,7 +909,7 @@ class FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_ARP_123_987_0D:AA:D8:42:30:F5"
+                flowId = "Egress_ARP_123_987_0D:AA:D8:42:30:F510.0.0.3/32"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -906,6 +919,8 @@ class FlowEntryObjectsBase {
                 matchInfoList = #[
                     new MatchEthernetType(2054L),
                     new MatchArpSha(new MacAddress("0D:AA:D8:42:30:F5")),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F5")),
+                    new MatchArpSpa(new Ipv4Prefix("10.0.0.3/32")),
                     new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
                 ]
                 priority = 63010
@@ -1195,6 +1210,7 @@ class FlowEntryObjectsBase {
                 matchInfoList = #[
                     new MatchEthernetType(2054L),
                     new MatchArpSha(new MacAddress("0D:AA:D8:42:30:F6")),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F6")),
                     new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
                 ]
                 priority = 63010
@@ -1213,6 +1229,7 @@ class FlowEntryObjectsBase {
                 matchInfoList = #[
                     new MatchEthernetType(2054L),
                     new MatchArpSha(new MacAddress("0D:AA:D8:42:30:F6")),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F6")),
                     new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
                 ]
                 priority = 63010
@@ -1412,7 +1429,7 @@ class FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_DHCP_Client_v4123_987__Permit_"
+                flowId = "Egress_DHCP_Client_v4123_987_" + mac + "_Permit_"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -1424,7 +1441,8 @@ class FlowEntryObjectsBase {
                     new MatchIpProtocol(17 as short),
                     new MatchUdpDestinationPort(67),
                     new MatchUdpSourcePort(68),
-                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress(mac))
                 ]
                 priority = 63010
                 tableId = 211 as short
@@ -1432,7 +1450,7 @@ class FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_DHCP_Client_v6_123_987__Permit_"
+                flowId = "Egress_DHCP_Client_v6_123_987_" + mac + "_Permit_"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -1444,7 +1462,8 @@ class FlowEntryObjectsBase {
                     new MatchIpProtocol(17 as short),
                     new MatchUdpDestinationPort(547),
                     new MatchUdpSourcePort(546),
-                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress(mac))
                 ]
                 priority = 63010
                 tableId = 211 as short
@@ -1569,6 +1588,7 @@ class FlowEntryObjectsBase {
                 matchInfoList = #[
                     new MatchEthernetType(2054L),
                     new MatchArpSha(new MacAddress(mac)),
+                    new MatchEthernetSource(new MacAddress(mac)),
                     new MatchMetadata(1085217976614912bi, 1152920405095219200bi)
                 ]
                 priority = 63010

diff --git a/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsStateful.xtend b/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsStateful.xtend
index be49830157da42973663af00fc090b558ae90fc4..00e57c65a9e09f77b2bdcd1ca2f10625430e3747 100644 (file)
--- a/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsStateful.xtend
+++ b/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsStateful.xtend
@@ -15,6 +15,7 @@ import org.opendaylight.genius.mdsalutil.actions.ActionNxResubmit
 import org.opendaylight.genius.mdsalutil.actions.ActionDrop
 import org.opendaylight.genius.mdsalutil.instructions.InstructionApplyActions
 import org.opendaylight.genius.mdsalutil.matches.MatchArpSha
+import org.opendaylight.genius.mdsalutil.matches.MatchArpSpa
 import org.opendaylight.genius.mdsalutil.matches.MatchEthernetDestination
 import org.opendaylight.genius.mdsalutil.matches.MatchEthernetSource
 import org.opendaylight.genius.mdsalutil.matches.MatchEthernetType
@@ -32,6 +33,7 @@ import org.opendaylight.genius.mdsalutil.nxmatches.NxMatchTcpDestinationPort
 import org.opendaylight.genius.mdsalutil.nxmatches.NxMatchUdpDestinationPort
 import org.opendaylight.genius.mdsalutil.FlowEntityBuilder
 import org.opendaylight.genius.mdsalutil.MetaDataUtil
+import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.Ipv4Prefix
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.yang.types.rev130715.MacAddress
 import org.opendaylight.genius.mdsalutil.NwConstants
 import org.opendaylight.genius.mdsalutil.nxmatches.NxMatchRegister
@@ -355,7 +357,7 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_ARP_123_987_0D:AA:D8:42:30:F4"
+                flowId = "Egress_ARP_123_987_0D:AA:D8:42:30:F410.0.0.2/32"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -365,6 +367,8 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                 matchInfoList = #[
                     new MatchEthernetType(2054L),
                     new MatchArpSha(new MacAddress("0D:AA:D8:42:30:F4")),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F4")),
+                    new MatchArpSpa(new Ipv4Prefix("10.0.0.2/32")),
                     new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
                 ]
                 priority = 63010
@@ -462,7 +466,27 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_ARP_123_987_0D:AA:D8:42:30:A4"
+                flowId = "Egress_ARP_123_987_0D:AA:D8:42:30:F410.0.0.100/32"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionNxResubmit(17 as short)
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchEthernetType(2054L),
+                    new MatchArpSha(new MacAddress("0D:AA:D8:42:30:F4")),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:F4")),
+                    new MatchArpSpa(new Ipv4Prefix("10.0.0.100/32")),
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                ]
+                priority = 63010
+                tableId = NwConstants.INGRESS_ACL_TABLE
+            ],
+            new FlowEntityBuilder >> [
+                dpnId = 123bi
+                cookie = 110100480bi
+                flowId = "Egress_ARP_123_987_0D:AA:D8:42:30:A410.0.0.101/32"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -472,10 +496,54 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                 matchInfoList = #[
                     new MatchEthernetType(2054L),
                     new MatchArpSha(new MacAddress("0D:AA:D8:42:30:A4")),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:A4")),
+                    new MatchArpSpa(new Ipv4Prefix("10.0.0.101/32")),
                     new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
                 ]
                 priority = 63010
                 tableId = NwConstants.INGRESS_ACL_TABLE
+            ],
+            new FlowEntityBuilder >> [
+                dpnId = 123bi
+                cookie = 110100480bi
+                flowId = "Egress_DHCP_Client_v4123_987_0D:AA:D8:42:30:A4_Permit_"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionNxResubmit(17 as short)
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchEthernetType(2048L),
+                    new MatchIpProtocol(17 as short),
+                    new MatchUdpDestinationPort(67 as short),
+                    new MatchUdpSourcePort(68 as short),
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:A4"))
+                ]
+                priority = 63010
+                tableId = 211 as short
+            ],
+            new FlowEntityBuilder >> [
+                dpnId = 123bi
+                cookie = 110100480bi
+                flowId = "Egress_DHCP_Client_v6_123_987_0D:AA:D8:42:30:A4_Permit_"
+                flowName = "ACL"
+                instructionInfoList = #[
+                    new InstructionApplyActions(#[
+                        new ActionNxResubmit(17 as short)
+                    ])
+                ]
+                matchInfoList = #[
+                    new MatchEthernetType(34525L),
+                    new MatchIpProtocol(17 as short),
+                    new MatchUdpDestinationPort(547 as short),
+                    new MatchUdpSourcePort(546 as short),
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress("0D:AA:D8:42:30:A4"))
+                ]
+                priority = 63010
+                tableId = 211 as short
             ]
         ]
     }
@@ -1837,7 +1905,7 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_DHCP_Client_v4123_987__Permit_"
+                flowId = "Egress_DHCP_Client_v4123_987_" + mac + "_Permit_"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -1849,7 +1917,8 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                     new MatchIpProtocol(17 as short),
                     new MatchUdpDestinationPort(67 as short),
                     new MatchUdpSourcePort(68 as short),
-                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress(mac))
                 ]
                 priority = 63010
                 tableId = 211 as short
@@ -1857,7 +1926,7 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_DHCP_Client_v6_123_987__Permit_"
+                flowId = "Egress_DHCP_Client_v6_123_987_" + mac + "_Permit_"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -1869,7 +1938,8 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                     new MatchIpProtocol(17 as short),
                     new MatchUdpDestinationPort(547 as short),
                     new MatchUdpSourcePort(546 as short),
-                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress(mac))
                 ]
                 priority = 63010
                 tableId = 211 as short
@@ -2055,7 +2125,7 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_ARP_123_987_" + mac
+                flowId = "Egress_ARP_123_987_" + mac + "10.0.0.1/32"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -2065,6 +2135,8 @@ class FlowEntryObjectsStateful extends FlowEntryObjectsBase {
                 matchInfoList = #[
                     new MatchEthernetType(2054L),
                     new MatchArpSha(new MacAddress(mac)),
+                    new MatchEthernetSource(new MacAddress(mac)),
+                    new MatchArpSpa(new Ipv4Prefix("10.0.0.1/32")),
                     new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
                 ]
                 priority = 63010

diff --git a/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsStateless.xtend b/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsStateless.xtend
index 0c154f1ac85fec41e99ac109dcc30d6603d23ab5..6c4801e88aa9352d67d890494da59ba65e90bae5 100644 (file)
--- a/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsStateless.xtend
+++ b/vpnservice/aclservice/impl/src/test/java/org/opendaylight/netvirt/aclservice/tests/FlowEntryObjectsStateless.xtend
@@ -13,6 +13,8 @@ import org.opendaylight.genius.mdsalutil.actions.ActionNxResubmit
 import org.opendaylight.genius.mdsalutil.FlowEntityBuilder
 import org.opendaylight.genius.mdsalutil.instructions.InstructionApplyActions
 import org.opendaylight.genius.mdsalutil.matches.MatchArpSha
+import org.opendaylight.genius.mdsalutil.matches.MatchArpSpa
+import org.opendaylight.genius.mdsalutil.matches.MatchEthernetSource
 import org.opendaylight.genius.mdsalutil.matches.MatchEthernetType
 import org.opendaylight.genius.mdsalutil.matches.MatchIcmpv4
 import org.opendaylight.genius.mdsalutil.matches.MatchIcmpv6
@@ -27,6 +29,7 @@ import org.opendaylight.genius.mdsalutil.nxmatches.NxMatchCtState
 import org.opendaylight.genius.mdsalutil.nxmatches.NxMatchRegister
 import org.opendaylight.genius.mdsalutil.nxmatches.NxMatchTcpDestinationPort
 import org.opendaylight.genius.mdsalutil.nxmatches.NxMatchUdpDestinationPort
+import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.Ipv4Prefix
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.yang.types.rev130715.MacAddress
 import org.opendaylight.yang.gen.v1.urn.opendaylight.openflowjava.nx.match.rev140421.NxmNxReg6
 import org.opendaylight.genius.mdsalutil.matches.MatchMetadata
@@ -953,7 +956,7 @@ class FlowEntryObjectsStateless extends FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_DHCP_Client_v4123_987__Permit_"
+                flowId = "Egress_DHCP_Client_v4123_987_" + mac + "_Permit_"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -965,7 +968,8 @@ class FlowEntryObjectsStateless extends FlowEntryObjectsBase {
                     new MatchIpProtocol(17 as short),
                     new MatchUdpDestinationPort(67 as short),
                     new MatchUdpSourcePort(68 as short),
-                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress(mac))
                 ]
                 priority = 63010
                 tableId = 211 as short
@@ -973,7 +977,7 @@ class FlowEntryObjectsStateless extends FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_DHCP_Client_v6_123_987__Permit_"
+                flowId = "Egress_DHCP_Client_v6_123_987_" + mac + "_Permit_"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -985,7 +989,8 @@ class FlowEntryObjectsStateless extends FlowEntryObjectsBase {
                     new MatchIpProtocol(17 as short),
                     new MatchUdpDestinationPort(547 as short),
                     new MatchUdpSourcePort(546 as short),
-                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG)
+                    new MatchMetadata(1085217976614912bi, MetaDataUtil.METADATA_MASK_LPORT_TAG),
+                    new MatchEthernetSource(new MacAddress(mac))
                 ]
                 priority = 63010
                 tableId = 211 as short
@@ -1100,7 +1105,7 @@ class FlowEntryObjectsStateless extends FlowEntryObjectsBase {
             new FlowEntityBuilder >> [
                 dpnId = 123bi
                 cookie = 110100480bi
-                flowId = "Egress_ARP_123_987_" + mac
+                flowId = "Egress_ARP_123_987_" + mac + "10.0.0.1/32"
                 flowName = "ACL"
                 instructionInfoList = #[
                     new InstructionApplyActions(#[
@@ -1110,6 +1115,8 @@ class FlowEntryObjectsStateless extends FlowEntryObjectsBase {
                 matchInfoList = #[
                     new MatchEthernetType(2054L),
                     new MatchArpSha(new MacAddress(mac)),
+                    new MatchEthernetSource(new MacAddress(mac)),
+                    new MatchArpSpa(new Ipv4Prefix("10.0.0.1/32")),
                     new MatchMetadata(1085217976614912bi, 1152920405095219200bi)
                 ]
                 priority = 63010