Examples with Matches org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.Matches used on opensource projects

Example 91 with Matches

use of org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.Matches in project netvirt by opendaylight.

the class AclServiceUtils method getHardTimoutForApplyStatefulChangeOnExistingTraffic.

/**
 * Returns the hard timeout based on the protocol when a ACL rule removed from the instance.
 * It will returns the timeout configured in the {@link AclserviceConfig} class.
 *
 * @param ace the ace
 * @param aclServiceUtils acl service utils
 * @return the hard time out
 */
public static Integer getHardTimoutForApplyStatefulChangeOnExistingTraffic(Ace ace, AclServiceUtils aclServiceUtils) {
    int hardTimeout = AclConstants.SECURITY_GROUP_ICMP_IDLE_TIME_OUT;
    Matches matches = ace.getMatches();
    AceIp acl = (AceIp) matches.getAceType();
    Short protocol = acl.getProtocol();
    if (protocol == null) {
        return hardTimeout;
    } else if (protocol == NwConstants.IP_PROT_TCP) {
        hardTimeout = aclServiceUtils.getConfig().getSecurityGroupTcpIdleTimeout();
    } else if (protocol == NwConstants.IP_PROT_UDP) {
        hardTimeout = aclServiceUtils.getConfig().getSecurityGroupUdpIdleTimeout();
    }
    return hardTimeout;
}

Example 92 with Matches

use of org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.Matches in project netvirt by opendaylight.

the class AclServiceUtils method buildMatchesForLPortTagAndConntrackClassifierType.

public static Collection<? extends MatchInfoBase> buildMatchesForLPortTagAndConntrackClassifierType(int lportTag, AclConntrackClassifierType conntrackClassifierType, Class<? extends ServiceModeBase> serviceMode) {
    List<MatchInfoBase> matches = new ArrayList<>();
    if (serviceMode != null && serviceMode.isAssignableFrom(ServiceModeEgress.class)) {
        matches.add(AclServiceUtils.buildLPortTagMatch(lportTag, serviceMode));
        matches.add(AclServiceUtils.buildAclConntrackClassifierTypeMatch(conntrackClassifierType));
    } else {
        // In case of ingress service mode, only metadata is used for
        // matching both lportTag and conntrackClassifierType. Hence performing "or"
        // operation on both lportTag and conntrackClassifierType metadata.
        BigInteger metaData = MetaDataUtil.getLportTagMetaData(lportTag).or(MetaDataUtil.getAclConntrackClassifierTypeFromMetaData(conntrackClassifierType.getValue()));
        BigInteger metaDataMask = MetaDataUtil.METADATA_MASK_LPORT_TAG.or(MetaDataUtil.METADATA_MASK_ACL_CONNTRACK_CLASSIFIER_TYPE);
        matches.add(new MatchMetadata(metaData, metaDataMask));
    }
    return matches;
}

Example 93 with Matches

use of org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.Matches in project netvirt by opendaylight.

the class AclServiceTestBase method newInterfaceWithDstAllPorts.

@Test
public void newInterfaceWithDstAllPorts() throws Exception {
    LOG.info("newInterfaceWithDstAllPorts - start");
    newAllowedAddressPair(PORT_1, Collections.singletonList(SG_UUID_1), Collections.singletonList(AAP_PORT_1));
    dataBrokerUtil.put(new IdentifiedSubnetIpPrefixBuilder().interfaceName(PORT_1).addAllIpPrefixOrAddress(Collections.singletonList(new IpPrefixOrAddress(SUBNET_IP_PREFIX_1.toCharArray()))));
    // Given
    Matches matches = newMatch(AclConstants.SOURCE_LOWER_PORT_UNSPECIFIED, AclConstants.SOURCE_UPPER_PORT_UNSPECIFIED, 1, 65535, AclConstants.SOURCE_REMOTE_IP_PREFIX_UNSPECIFIED, AclConstants.DEST_REMOTE_IP_PREFIX_SPECIFIED, (short) NwConstants.IP_PROT_TCP);
    dataBrokerUtil.put(new IdentifiedAceBuilder().sgUuid(SG_UUID_1).newRuleName(SR_UUID_1_1).newMatches(matches).newDirection(DirectionEgress.class).build());
    matches = newMatch(AclConstants.SOURCE_LOWER_PORT_UNSPECIFIED, AclConstants.SOURCE_UPPER_PORT_UNSPECIFIED, 1, 65535, AclConstants.SOURCE_REMOTE_IP_PREFIX_SPECIFIED, AclConstants.DEST_REMOTE_IP_PREFIX_UNSPECIFIED, (short) NwConstants.IP_PROT_UDP);
    dataBrokerUtil.put(new IdentifiedAceBuilder().sgUuid(SG_UUID_1).newRuleName(SR_UUID_1_2).newMatches(matches).newDirection(DirectionIngress.class).build());
    // When
    putNewStateInterface(dataBroker, PORT_1, PORT_MAC_1);
    asyncEventsWaiter.awaitEventsConsumption();
    // Then
    newInterfaceWithDstAllPortsCheck();
    LOG.info("newInterfaceWithDstAllPorts - end");
}

Example 94 with Matches

use of org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.Matches in project netvirt by opendaylight.

the class AclServiceTestBase method newInterfaceWithEtherTypeAcl.

@Test
public void newInterfaceWithEtherTypeAcl() throws Exception {
    LOG.info("newInterfaceWithEtherTypeAcl - start");
    newAllowedAddressPair(PORT_1, Collections.singletonList(SG_UUID_1), Collections.singletonList(AAP_PORT_1));
    newAllowedAddressPair(PORT_2, Collections.singletonList(SG_UUID_1), Collections.singletonList(AAP_PORT_2));
    dataBrokerUtil.put(new IdentifiedSubnetIpPrefixBuilder().interfaceName(PORT_1).addAllIpPrefixOrAddress(Collections.singletonList(new IpPrefixOrAddress(SUBNET_IP_PREFIX_1.toCharArray()))));
    dataBrokerUtil.put(new IdentifiedSubnetIpPrefixBuilder().interfaceName(PORT_2).addAllIpPrefixOrAddress(Collections.singletonList(new IpPrefixOrAddress(SUBNET_IP_PREFIX_1.toCharArray()))));
    Matches matches = newMatch(AclConstants.SOURCE_LOWER_PORT_UNSPECIFIED, AclConstants.SOURCE_UPPER_PORT_UNSPECIFIED, AclConstants.DEST_LOWER_PORT_UNSPECIFIED, AclConstants.DEST_UPPER_PORT_UNSPECIFIED, AclConstants.SOURCE_REMOTE_IP_PREFIX_UNSPECIFIED, AclConstants.DEST_REMOTE_IP_PREFIX_SPECIFIED, (short) -1);
    dataBrokerUtil.put(new IdentifiedAceBuilder().sgUuid(SG_UUID_1).newRuleName(SR_UUID_1_1).newMatches(matches).newDirection(DirectionEgress.class).build());
    matches = newMatch(AclConstants.SOURCE_LOWER_PORT_UNSPECIFIED, AclConstants.SOURCE_UPPER_PORT_UNSPECIFIED, AclConstants.DEST_LOWER_PORT_UNSPECIFIED, AclConstants.DEST_UPPER_PORT_UNSPECIFIED, AclConstants.SOURCE_REMOTE_IP_PREFIX_SPECIFIED, AclConstants.DEST_REMOTE_IP_PREFIX_UNSPECIFIED, (short) -1);
    dataBrokerUtil.put(new IdentifiedAceBuilder().sgUuid(SG_UUID_1).newRuleName(SR_UUID_1_2).newMatches(matches).newDirection(DirectionIngress.class).newRemoteGroupId(new Uuid(SG_UUID_1)).build());
    // When
    putNewStateInterface(dataBroker, PORT_1, PORT_MAC_1);
    putNewStateInterface(dataBroker, PORT_2, PORT_MAC_2);
    asyncEventsWaiter.awaitEventsConsumption();
    // Then
    newInterfaceWithEtherTypeAclCheck();
    LOG.info("newInterfaceWithEtherTypeAcl - end");
}

Example 95 with Matches

use of org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160218.access.lists.acl.access.list.entries.ace.Matches in project netvirt by opendaylight.

the class EgressAclServiceImpl method egressAclDhcpv6AllowClientTraffic.

/**
 * Add rule to ensure only DHCPv6 server traffic from the specified mac is
 * allowed.
 *
 * @param dpId the dpid
 * @param allowedAddresses the allowed addresses
 * @param lportTag the lport tag
 * @param addOrRemove whether to add or remove the flow
 */
private void egressAclDhcpv6AllowClientTraffic(BigInteger dpId, List<AllowedAddressPairs> allowedAddresses, int lportTag, int addOrRemove) {
    List<InstructionInfo> instructions = getDispatcherTableResubmitInstructions();
    for (AllowedAddressPairs aap : allowedAddresses) {
        if (AclServiceUtils.isIPv4Address(aap)) {
            continue;
        }
        List<MatchInfoBase> matches = new ArrayList<>();
        matches.addAll(AclServiceUtils.buildDhcpV6Matches(AclConstants.DHCP_CLIENT_PORT_IPV6, AclConstants.DHCP_SERVER_PORT_IPV6, lportTag, serviceMode));
        matches.add(new MatchEthernetSource(aap.getMacAddress()));
        String flowName = "Egress_DHCP_Client_v6" + "_" + dpId + "_" + lportTag + "_" + aap.getMacAddress().getValue() + "_Permit_";
        syncFlow(dpId, getAclAntiSpoofingTable(), flowName, AclConstants.PROTO_DHCP_CLIENT_TRAFFIC_MATCH_PRIORITY, "ACL", 0, 0, AclConstants.COOKIE_ACL_BASE, matches, instructions, addOrRemove);
    }
}