Examples with Acl org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.Acl used on opensource projects

Example 51 with Acl

use of org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.Acl in project netvirt by opendaylight.

the class AbstractAclServiceImpl method programRemoteAclTable.

private void programRemoteAclTable(String aclName, Set<Uuid> remoteAclIds, Set<BigInteger> dpns, int addOrRemove) {
    for (Uuid remoteAclId : remoteAclIds) {
        Collection<AclInterface> remoteAclInterfaces = aclDataUtil.getInterfaceList(remoteAclId);
        if (remoteAclInterfaces == null || remoteAclInterfaces.isEmpty()) {
            continue;
        }
        Set<AllowedAddressPairs> aaps = remoteAclInterfaces.stream().map(port -> port.getAllowedAddressPairs()).flatMap(List::stream).filter(aap -> AclServiceUtils.isNotIpAllNetwork(aap)).collect(Collectors.toSet());
        Integer aclTag = aclServiceUtils.getAclTag(remoteAclId);
        if (addOrRemove == NwConstants.ADD_FLOW) {
            for (BigInteger dpn : dpns) {
                for (AllowedAddressPairs aap : aaps) {
                    programRemoteAclTableFlow(dpn, aclTag, aap, addOrRemove);
                }
            }
        } else if (addOrRemove == NwConstants.DEL_FLOW) {
            Set<BigInteger> remoteAclDpns = new HashSet<>();
            Map<String, Set<AclInterface>> mapAclWithPortSet = aclDataUtil.getRemoteAclInterfaces(remoteAclId, this.direction);
            if (mapAclWithPortSet != null) {
                Map<String, Set<AclInterface>> copyOfMapAclWithPortSet = new HashMap<>(mapAclWithPortSet);
                copyOfMapAclWithPortSet.remove(aclName);
                remoteAclDpns = collectDpns(copyOfMapAclWithPortSet);
            }
            Set<BigInteger> dpnsToOperate = new HashSet<>(dpns);
            dpnsToOperate.removeAll(remoteAclDpns);
            LOG.debug("Deleting flows in Remote ACL table for remoteAclId={}, direction={}, dpnsToOperate={}, " + "remoteAclDpns={}, dpns={}", remoteAclId.getValue(), directionString, dpnsToOperate, remoteAclDpns, dpns);
            for (BigInteger dpn : dpnsToOperate) {
                for (AllowedAddressPairs aap : aaps) {
                    programRemoteAclTableFlow(dpn, aclTag, aap, addOrRemove);
                }
            }
        }
    }
}

Example 52 with Acl

use of org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.Acl in project netvirt by opendaylight.

the class AclLiveStatisticsHelper method addError.

/**
 * Adds the error.
 *
 * @param lstAclPortStats the lst acl port stats
 * @param aclStatsBuilder the acl stats builder
 * @param errMsg the error message
 */
private static void addError(List<AclPortStats> lstAclPortStats, AclPortStatsBuilder aclStatsBuilder, String errMsg) {
    aclStatsBuilder.setError(new ErrorBuilder().setErrorMessage(errMsg).build());
    lstAclPortStats.add(aclStatsBuilder.build());
}

Example 53 with Acl

use of org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.Acl in project netvirt by opendaylight.

the class AclLiveStatisticsHelper method getAclDropStats.

/**
 * Gets the acl drop stats.
 *
 * @param direction the direction
 * @param aclStatsBuilder the acl stats builder
 * @param flowStatsOutput the flow stats output
 */
private static void getAclDropStats(Direction direction, AclPortStatsBuilder aclStatsBuilder, GetFlowStatisticsOutput flowStatsOutput) {
    List<FlowAndStatisticsMapList> flowAndStatisticsMapList = flowStatsOutput.getFlowAndStatisticsMapList();
    if (flowAndStatisticsMapList == null || flowAndStatisticsMapList.isEmpty()) {
        String errMsg = "Unable to retrieve drop counts as interface is not configured for statistics collection.";
        aclStatsBuilder.setError(new ErrorBuilder().setErrorMessage(errMsg).build());
        return;
    }
    BytesBuilder portEgressBytesBuilder = new BytesBuilder();
    BytesBuilder portIngressBytesBuilder = new BytesBuilder();
    PacketsBuilder portEgressPacketsBuilder = new PacketsBuilder();
    PacketsBuilder portIngressPacketsBuilder = new PacketsBuilder();
    for (FlowAndStatisticsMapList flowStats : flowAndStatisticsMapList) {
        BigInteger portEgressBytesBuilderDropCount = BigInteger.valueOf(0);
        BigInteger portEgressPacketsBuilderDropCount = BigInteger.valueOf(0);
        BigInteger portIngressBytesBuilderDropCount = BigInteger.valueOf(0);
        BigInteger portIngressPacketsBuilderDropCount = BigInteger.valueOf(0);
        switch(flowStats.getTableId()) {
            case NwConstants.INGRESS_ACL_FILTER_CUM_DISPATCHER_TABLE:
                if (flowStats.getPriority().equals(AclConstants.CT_STATE_TRACKED_INVALID_PRIORITY)) {
                    portEgressBytesBuilder.setInvalidDropCount(flowStats.getByteCount().getValue());
                    portEgressPacketsBuilder.setInvalidDropCount(flowStats.getPacketCount().getValue());
                } else if (flowStats.getPriority().equals(AclConstants.ACL_PORT_SPECIFIC_DROP_PRIORITY)) {
                    if (portEgressBytesBuilder.getDropCount() != null) {
                        portEgressBytesBuilderDropCount = portEgressBytesBuilder.getDropCount().add(flowStats.getByteCount().getValue());
                        portEgressPacketsBuilderDropCount = portEgressPacketsBuilder.getDropCount().add(flowStats.getPacketCount().getValue());
                    } else {
                        portEgressBytesBuilderDropCount = flowStats.getByteCount().getValue();
                        portEgressPacketsBuilderDropCount = flowStats.getPacketCount().getValue();
                    }
                } else if (flowStats.getPriority().equals(AclConstants.ACE_LAST_REMOTE_ACL_PRIORITY)) {
                    if (portEgressBytesBuilder.getDropCount() != null) {
                        portEgressBytesBuilderDropCount = portEgressBytesBuilder.getDropCount().add(flowStats.getByteCount().getValue());
                        portEgressPacketsBuilderDropCount = portEgressPacketsBuilder.getDropCount().add(flowStats.getPacketCount().getValue());
                    } else {
                        portEgressBytesBuilderDropCount = flowStats.getByteCount().getValue();
                        portEgressPacketsBuilderDropCount = flowStats.getPacketCount().getValue();
                    }
                }
                // TODO: Update stats for other drops
                break;
            case NwConstants.EGRESS_ACL_FILTER_CUM_DISPATCHER_TABLE:
                if (flowStats.getPriority().equals(AclConstants.CT_STATE_TRACKED_INVALID_PRIORITY)) {
                    portIngressBytesBuilder.setInvalidDropCount(flowStats.getByteCount().getValue());
                    portIngressPacketsBuilder.setInvalidDropCount(flowStats.getPacketCount().getValue());
                } else if (flowStats.getPriority().equals(AclConstants.ACL_PORT_SPECIFIC_DROP_PRIORITY)) {
                    if (portIngressBytesBuilder.getDropCount() != null) {
                        portIngressBytesBuilderDropCount = portIngressBytesBuilder.getDropCount().add(flowStats.getByteCount().getValue());
                        portIngressPacketsBuilderDropCount = portIngressPacketsBuilder.getDropCount().add(flowStats.getPacketCount().getValue());
                    } else {
                        portIngressBytesBuilderDropCount = flowStats.getByteCount().getValue();
                        portIngressPacketsBuilderDropCount = flowStats.getPacketCount().getValue();
                    }
                } else if (flowStats.getPriority().equals(AclConstants.ACE_LAST_REMOTE_ACL_PRIORITY)) {
                    if (portIngressBytesBuilder.getDropCount() != null) {
                        portIngressBytesBuilderDropCount = portIngressBytesBuilder.getDropCount().add(flowStats.getByteCount().getValue());
                        portIngressPacketsBuilderDropCount = portIngressPacketsBuilder.getDropCount().add(flowStats.getPacketCount().getValue());
                    } else {
                        portIngressBytesBuilderDropCount = flowStats.getByteCount().getValue();
                        portIngressPacketsBuilderDropCount = flowStats.getPacketCount().getValue();
                    }
                }
                // TODO: Update stats for other drops
                break;
            default:
                LOG.warn("Invalid table ID filtered for Acl flow stats: {}", flowStats);
                break;
        }
        portEgressBytesBuilder.setDropCount(portEgressBytesBuilderDropCount);
        portEgressPacketsBuilder.setDropCount(portEgressPacketsBuilderDropCount);
        portIngressBytesBuilder.setDropCount(portIngressBytesBuilderDropCount);
        portIngressPacketsBuilder.setDropCount(portIngressPacketsBuilderDropCount);
    }
    List<AclDropStats> lstAclDropStats = new ArrayList<>();
    if (direction == Direction.Egress || direction == Direction.Both) {
        AclDropStats aclEgressDropStats = new AclDropStatsBuilder().setDirection(Direction.Egress).setBytes(portEgressBytesBuilder.build()).setPackets(portEgressPacketsBuilder.build()).build();
        lstAclDropStats.add(aclEgressDropStats);
    }
    if (direction == Direction.Ingress || direction == Direction.Both) {
        AclDropStats aclIngressDropStats = new AclDropStatsBuilder().setDirection(Direction.Ingress).setBytes(portIngressBytesBuilder.build()).setPackets(portIngressPacketsBuilder.build()).build();
        lstAclDropStats.add(aclIngressDropStats);
    }
    aclStatsBuilder.setAclDropStats(lstAclDropStats);
}

Example 54 with Acl

use of org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.Acl in project netvirt by opendaylight.

the class NeutronSecurityRuleListener method add.

@Override
// TODO Clean up the exception handling
@SuppressWarnings("checkstyle:IllegalCatch")
protected void add(InstanceIdentifier<SecurityRule> instanceIdentifier, SecurityRule securityRule) {
    LOG.trace("added securityRule: {}", securityRule);
    try {
        Ace ace = toAceBuilder(securityRule).build();
        InstanceIdentifier<Ace> identifier = getAceInstanceIdentifier(securityRule);
        MDSALUtil.syncWrite(dataBroker, LogicalDatastoreType.CONFIGURATION, identifier, ace);
    } catch (Exception ex) {
        LOG.error("Exception occured while adding acl for security rule: {}. ", securityRule, ex);
    }
}

Example 55 with Acl

use of org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.Acl in project netvirt by opendaylight.

the class NeutronSecurityRuleListener method toAceBuilder.

private AceBuilder toAceBuilder(SecurityRule securityRule) {
    AceIpBuilder aceIpBuilder = new AceIpBuilder();
    SecurityRuleAttrBuilder securityRuleAttrBuilder = new SecurityRuleAttrBuilder();
    DestinationPortRangeBuilder destinationPortRangeBuilder = new DestinationPortRangeBuilder();
    boolean isDirectionIngress = false;
    if (securityRule.getDirection() != null) {
        securityRuleAttrBuilder.setDirection(DIRECTION_MAP.get(securityRule.getDirection()));
        isDirectionIngress = securityRule.getDirection().equals(DirectionIngress.class);
    }
    if (securityRule.getPortRangeMax() != null) {
        destinationPortRangeBuilder.setUpperPort(new PortNumber(securityRule.getPortRangeMax()));
    }
    if (securityRule.getPortRangeMin() != null) {
        destinationPortRangeBuilder.setLowerPort(new PortNumber(securityRule.getPortRangeMin()));
        // set destination port range if lower port is specified as it is mandatory parameter in acl model
        aceIpBuilder.setDestinationPortRange(destinationPortRangeBuilder.build());
    }
    aceIpBuilder = handleRemoteIpPrefix(securityRule, aceIpBuilder, isDirectionIngress);
    if (securityRule.getRemoteGroupId() != null) {
        securityRuleAttrBuilder.setRemoteGroupId(securityRule.getRemoteGroupId());
    }
    if (securityRule.getProtocol() != null) {
        SecurityRuleAttributes.Protocol protocol = securityRule.getProtocol();
        if (protocol.getUint8() != null) {
            // uint8
            aceIpBuilder.setProtocol(protocol.getUint8());
        } else {
            // symbolic protocol name
            aceIpBuilder.setProtocol(PROTOCOL_MAP.get(protocol.getIdentityref()));
        }
    }
    MatchesBuilder matchesBuilder = new MatchesBuilder();
    matchesBuilder.setAceType(aceIpBuilder.build());
    // set acl action as permit for the security rule
    ActionsBuilder actionsBuilder = new ActionsBuilder();
    actionsBuilder.setPacketHandling(new PermitBuilder().setPermit(true).build());
    AceBuilder aceBuilder = new AceBuilder();
    aceBuilder.setKey(new AceKey(securityRule.getUuid().getValue()));
    aceBuilder.setRuleName(securityRule.getUuid().getValue());
    aceBuilder.setMatches(matchesBuilder.build());
    aceBuilder.setActions(actionsBuilder.build());
    aceBuilder.addAugmentation(SecurityRuleAttr.class, securityRuleAttrBuilder.build());
    return aceBuilder;
}