@Test public void testSyncFlows() throws Exception { Set<NodeConnectorId> connectors = new HashSet<>(); connectors.add(new NodeConnectorId(CONNECTOR_0)); EndpointBuilder endpointBuilder = new EndpointBuilder(buildEndpoint(IPV4_0, MAC_0, CONNECTOR_0) .build()); endpointBuilder.setTenant(getTestIndexedTenant().getTenant().getId()); Endpoint endpoint = endpointBuilder.build(); when(ctx.getEndpointManager()).thenReturn(endpointManager); when(ctx.getSwitchManager()).thenReturn(switchManager); when(ctx.getPolicyManager()).thenReturn(policyManager); when(ctx.getTenant(Mockito.any(TenantId.class))).thenReturn(getTestIndexedTenant()); when(endpointManager.getEndpointNodeConnectorId(Mockito.any(Endpoint.class))) .thenReturn(new NodeConnectorId(CONNECTOR_0)); when(switchManager.getTunnelPort(NODE_ID, TunnelTypeVxlan.class)).thenReturn(new NodeConnectorId(CONNECTOR_0)); when(switchManager.getTunnelPort(NODE_ID, TunnelTypeVxlanGpe.class)).thenReturn(new NodeConnectorId(CONNECTOR_1)); when(switchManager.getExternalPorts(Mockito.any(NodeId.class))).thenReturn(connectors); PortSecurityFlows flows = mock(PortSecurityFlows.class); PortSecurity portSecurity = new PortSecurity(ctx, tableId); portSecurity.syncFlows(flows, NODE_ID, endpoint, ofWriter); verify(flows, times(4)).dropFlow(Mockito.anyInt(), Mockito.anyLong(), eq(ofWriter)); verify(flows, times(2)).allowFromTunnelFlow(Mockito.anyShort(), Mockito.anyInt(), Mockito.any(NodeConnectorId.class), eq(ofWriter)); verify(flows, times(2)).allowFromTunnelFlow(Mockito.anyShort(), Mockito.anyInt(), Mockito.any(NodeConnectorId.class), eq(ofWriter)); verify(flows, times(2)).l3Flow(Mockito.anyShort(), Mockito.any(Endpoint.class), Mockito.any(NodeConnectorId.class), Mockito.any(MacAddress.class), Mockito.anyInt(), Mockito.anyBoolean(), eq(ofWriter)); verify(flows, times(1)).l3DhcpDoraFlow(Mockito.anyShort(), Mockito.any(NodeConnectorId.class), Mockito.any(MacAddress.class), Mockito.anyInt(), eq(ofWriter)); verify(flows, times(1)).l2flow(Mockito.anyShort(), Mockito.any(NodeConnectorId.class), Mockito.any(MacAddress.class), Mockito.anyInt(), eq(ofWriter)); verify(flows, times(1)).popVlanTagsOnExternalPortFlows(Mockito.anyShort(), Mockito.any(NodeConnectorId.class), eq(getL2FloodDomainList(false)), Mockito.anyInt(), eq(ofWriter)); verify(flows, times(1)).allowFromExternalPortFlow(Mockito.anyShort(), Mockito.any(NodeConnectorId.class), Mockito.anyInt(), eq(ofWriter)); InOrder order = inOrder(ctx, flows); order.verify(flows, times(4)).dropFlow(Mockito.anyInt(), Mockito.anyLong(), eq(ofWriter)); order.verify(ctx, times(1)).getPolicyManager(); order.verify(ctx, times(1)).getSwitchManager(); order.verify(flows, times(1)).allowFromTunnelFlow(Mockito.anyShort(), Mockito.anyInt(), Mockito.any(NodeConnectorId.class), eq(ofWriter)); order.verify(ctx, times(1)).getSwitchManager(); order.verify(flows, times(1)).allowFromTunnelFlow(Mockito.anyShort(), Mockito.anyInt(), Mockito.any(NodeConnectorId.class), eq(ofWriter)); order.verify(ctx, times(1)).getEndpointManager(); order.verify(flows, times(1)).l3Flow(Mockito.anyShort(), Mockito.any(Endpoint.class), Mockito.any(NodeConnectorId.class), Mockito.any(MacAddress.class), Mockito.anyInt(), eq(false), eq(ofWriter)); order.verify(flows, times(1)).l3Flow(Mockito.anyShort(), Mockito.any(Endpoint.class), Mockito.any(NodeConnectorId.class), Mockito.any(MacAddress.class), Mockito.anyInt(), eq(true), eq(ofWriter)); order.verify(flows, times(1)).l3DhcpDoraFlow(Mockito.anyShort(), Mockito.any(NodeConnectorId.class), Mockito.any(MacAddress.class), Mockito.anyInt(), eq(ofWriter)); order.verify(flows, times(1)).l2flow(Mockito.anyShort(), Mockito.any(NodeConnectorId.class), Mockito.any(MacAddress.class), Mockito.anyInt(), eq(ofWriter)); order.verify(ctx, times(1)).getPolicyManager(); order.verify(ctx, times(1)).getSwitchManager(); order.verify(ctx, times(2)).getTenant(Mockito.any(TenantId.class)); order.verify(flows, times(1)).popVlanTagsOnExternalPortFlows(Mockito.anyShort(), Mockito.any(NodeConnectorId.class), eq(getL2FloodDomainList(false)), Mockito.anyInt(), eq(ofWriter)); order.verify(flows, times(1)).allowFromExternalPortFlow(Mockito.anyShort(), Mockito.any(NodeConnectorId.class), Mockito.anyInt(), eq(ofWriter)); }
@VisibleForTesting void syncFlows(PortSecurityFlows flows, NodeId nodeId, Endpoint endpoint, OfWriter ofWriter) { flows.dropFlow(DROP, null, ofWriter); flows.dropFlow(DROP_ARP, FlowUtils.ARP, ofWriter); flows.dropFlow(DROP_IPV4, FlowUtils.IPv4, ofWriter); flows.dropFlow(DROP_IPV6, FlowUtils.IPv6, ofWriter); short sourceMapperId = ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER(); NodeConnectorId vxLanPort = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlan.class); if (vxLanPort != null) { flows.allowFromTunnelFlow(sourceMapperId, ALLOW_FROM_TUNNEL, vxLanPort, ofWriter); } NodeConnectorId vxLanGpePort = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlanGpe.class); if (vxLanGpePort != null) { flows.allowFromTunnelFlow(sourceMapperId, ALLOW_FROM_TUNNEL, vxLanGpePort, ofWriter); } TenantId tenantId = endpoint.getTenant(); if (EndpointManager.isInternal(endpoint, getExternalImplicitGroupsForTenant(tenantId))) { NodeConnectorId nodeConnectorId = ctx.getEndpointManager().getEndpointNodeConnectorId(endpoint); MacAddress macAddress = endpoint.getMacAddress(); if (nodeConnectorId != null && macAddress != null) { flows.l3Flow(sourceMapperId, endpoint, nodeConnectorId, macAddress, L3IP_FLOW, false, ofWriter); flows.l3Flow(sourceMapperId, endpoint, nodeConnectorId, macAddress, L3ARP_FLOW, true, ofWriter); flows.l3DhcpDoraFlow(sourceMapperId, nodeConnectorId, macAddress, DHCP_DORA, ofWriter); flows.l2flow(sourceMapperId, nodeConnectorId, macAddress, L2FLOW, ofWriter); } } else { if (LOG.isTraceEnabled()) { LOG.trace("External Endpoint is ignored in PortSecurity: {}", endpoint); } } short ingressNatId = ctx.getPolicyManager().getTABLEID_INGRESS_NAT(); for (NodeConnectorId connectorId : ctx.getSwitchManager().getExternalPorts(nodeId)) { if (tenantId != null && ctx.getTenant(tenantId) != null) { Tenant tenant = ctx.getTenant(tenantId).getTenant(); if (tenant != null && tenant.getForwardingContext() != null && tenant.getForwardingContext().getL2FloodDomain() != null) { List<L2FloodDomain> floodDomains = tenant.getForwardingContext().getL2FloodDomain(); flows.popVlanTagsOnExternalPortFlows(ingressNatId, connectorId, floodDomains, POP_VLAN_TAG_EXTERNAL, ofWriter); } } flows.allowFromExternalPortFlow(ingressNatId, connectorId, ALLOW_EXTERNAL, ofWriter); } }
PortSecurity extends FlowTable { @VisibleForTesting void syncFlows(PortSecurityFlows flows, NodeId nodeId, Endpoint endpoint, OfWriter ofWriter) { flows.dropFlow(DROP, null, ofWriter); flows.dropFlow(DROP_ARP, FlowUtils.ARP, ofWriter); flows.dropFlow(DROP_IPV4, FlowUtils.IPv4, ofWriter); flows.dropFlow(DROP_IPV6, FlowUtils.IPv6, ofWriter); short sourceMapperId = ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER(); NodeConnectorId vxLanPort = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlan.class); if (vxLanPort != null) { flows.allowFromTunnelFlow(sourceMapperId, ALLOW_FROM_TUNNEL, vxLanPort, ofWriter); } NodeConnectorId vxLanGpePort = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlanGpe.class); if (vxLanGpePort != null) { flows.allowFromTunnelFlow(sourceMapperId, ALLOW_FROM_TUNNEL, vxLanGpePort, ofWriter); } TenantId tenantId = endpoint.getTenant(); if (EndpointManager.isInternal(endpoint, getExternalImplicitGroupsForTenant(tenantId))) { NodeConnectorId nodeConnectorId = ctx.getEndpointManager().getEndpointNodeConnectorId(endpoint); MacAddress macAddress = endpoint.getMacAddress(); if (nodeConnectorId != null && macAddress != null) { flows.l3Flow(sourceMapperId, endpoint, nodeConnectorId, macAddress, L3IP_FLOW, false, ofWriter); flows.l3Flow(sourceMapperId, endpoint, nodeConnectorId, macAddress, L3ARP_FLOW, true, ofWriter); flows.l3DhcpDoraFlow(sourceMapperId, nodeConnectorId, macAddress, DHCP_DORA, ofWriter); flows.l2flow(sourceMapperId, nodeConnectorId, macAddress, L2FLOW, ofWriter); } } else { if (LOG.isTraceEnabled()) { LOG.trace("External Endpoint is ignored in PortSecurity: {}", endpoint); } } short ingressNatId = ctx.getPolicyManager().getTABLEID_INGRESS_NAT(); for (NodeConnectorId connectorId : ctx.getSwitchManager().getExternalPorts(nodeId)) { if (tenantId != null && ctx.getTenant(tenantId) != null) { Tenant tenant = ctx.getTenant(tenantId).getTenant(); if (tenant != null && tenant.getForwardingContext() != null && tenant.getForwardingContext().getL2FloodDomain() != null) { List<L2FloodDomain> floodDomains = tenant.getForwardingContext().getL2FloodDomain(); flows.popVlanTagsOnExternalPortFlows(ingressNatId, connectorId, floodDomains, POP_VLAN_TAG_EXTERNAL, ofWriter); } } flows.allowFromExternalPortFlow(ingressNatId, connectorId, ALLOW_EXTERNAL, ofWriter); } } }
PortSecurity extends FlowTable { @VisibleForTesting void syncFlows(PortSecurityFlows flows, NodeId nodeId, Endpoint endpoint, OfWriter ofWriter) { flows.dropFlow(DROP, null, ofWriter); flows.dropFlow(DROP_ARP, FlowUtils.ARP, ofWriter); flows.dropFlow(DROP_IPV4, FlowUtils.IPv4, ofWriter); flows.dropFlow(DROP_IPV6, FlowUtils.IPv6, ofWriter); short sourceMapperId = ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER(); NodeConnectorId vxLanPort = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlan.class); if (vxLanPort != null) { flows.allowFromTunnelFlow(sourceMapperId, ALLOW_FROM_TUNNEL, vxLanPort, ofWriter); } NodeConnectorId vxLanGpePort = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlanGpe.class); if (vxLanGpePort != null) { flows.allowFromTunnelFlow(sourceMapperId, ALLOW_FROM_TUNNEL, vxLanGpePort, ofWriter); } TenantId tenantId = endpoint.getTenant(); if (EndpointManager.isInternal(endpoint, getExternalImplicitGroupsForTenant(tenantId))) { NodeConnectorId nodeConnectorId = ctx.getEndpointManager().getEndpointNodeConnectorId(endpoint); MacAddress macAddress = endpoint.getMacAddress(); if (nodeConnectorId != null && macAddress != null) { flows.l3Flow(sourceMapperId, endpoint, nodeConnectorId, macAddress, L3IP_FLOW, false, ofWriter); flows.l3Flow(sourceMapperId, endpoint, nodeConnectorId, macAddress, L3ARP_FLOW, true, ofWriter); flows.l3DhcpDoraFlow(sourceMapperId, nodeConnectorId, macAddress, DHCP_DORA, ofWriter); flows.l2flow(sourceMapperId, nodeConnectorId, macAddress, L2FLOW, ofWriter); } } else { if (LOG.isTraceEnabled()) { LOG.trace("External Endpoint is ignored in PortSecurity: {}", endpoint); } } short ingressNatId = ctx.getPolicyManager().getTABLEID_INGRESS_NAT(); for (NodeConnectorId connectorId : ctx.getSwitchManager().getExternalPorts(nodeId)) { if (tenantId != null && ctx.getTenant(tenantId) != null) { Tenant tenant = ctx.getTenant(tenantId).getTenant(); if (tenant != null && tenant.getForwardingContext() != null && tenant.getForwardingContext().getL2FloodDomain() != null) { List<L2FloodDomain> floodDomains = tenant.getForwardingContext().getL2FloodDomain(); flows.popVlanTagsOnExternalPortFlows(ingressNatId, connectorId, floodDomains, POP_VLAN_TAG_EXTERNAL, ofWriter); } } flows.allowFromExternalPortFlow(ingressNatId, connectorId, ALLOW_EXTERNAL, ofWriter); } } PortSecurity(OfContext ctx, short tableId); }
PortSecurity extends FlowTable { @VisibleForTesting void syncFlows(PortSecurityFlows flows, NodeId nodeId, Endpoint endpoint, OfWriter ofWriter) { flows.dropFlow(DROP, null, ofWriter); flows.dropFlow(DROP_ARP, FlowUtils.ARP, ofWriter); flows.dropFlow(DROP_IPV4, FlowUtils.IPv4, ofWriter); flows.dropFlow(DROP_IPV6, FlowUtils.IPv6, ofWriter); short sourceMapperId = ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER(); NodeConnectorId vxLanPort = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlan.class); if (vxLanPort != null) { flows.allowFromTunnelFlow(sourceMapperId, ALLOW_FROM_TUNNEL, vxLanPort, ofWriter); } NodeConnectorId vxLanGpePort = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlanGpe.class); if (vxLanGpePort != null) { flows.allowFromTunnelFlow(sourceMapperId, ALLOW_FROM_TUNNEL, vxLanGpePort, ofWriter); } TenantId tenantId = endpoint.getTenant(); if (EndpointManager.isInternal(endpoint, getExternalImplicitGroupsForTenant(tenantId))) { NodeConnectorId nodeConnectorId = ctx.getEndpointManager().getEndpointNodeConnectorId(endpoint); MacAddress macAddress = endpoint.getMacAddress(); if (nodeConnectorId != null && macAddress != null) { flows.l3Flow(sourceMapperId, endpoint, nodeConnectorId, macAddress, L3IP_FLOW, false, ofWriter); flows.l3Flow(sourceMapperId, endpoint, nodeConnectorId, macAddress, L3ARP_FLOW, true, ofWriter); flows.l3DhcpDoraFlow(sourceMapperId, nodeConnectorId, macAddress, DHCP_DORA, ofWriter); flows.l2flow(sourceMapperId, nodeConnectorId, macAddress, L2FLOW, ofWriter); } } else { if (LOG.isTraceEnabled()) { LOG.trace("External Endpoint is ignored in PortSecurity: {}", endpoint); } } short ingressNatId = ctx.getPolicyManager().getTABLEID_INGRESS_NAT(); for (NodeConnectorId connectorId : ctx.getSwitchManager().getExternalPorts(nodeId)) { if (tenantId != null && ctx.getTenant(tenantId) != null) { Tenant tenant = ctx.getTenant(tenantId).getTenant(); if (tenant != null && tenant.getForwardingContext() != null && tenant.getForwardingContext().getL2FloodDomain() != null) { List<L2FloodDomain> floodDomains = tenant.getForwardingContext().getL2FloodDomain(); flows.popVlanTagsOnExternalPortFlows(ingressNatId, connectorId, floodDomains, POP_VLAN_TAG_EXTERNAL, ofWriter); } } flows.allowFromExternalPortFlow(ingressNatId, connectorId, ALLOW_EXTERNAL, ofWriter); } } PortSecurity(OfContext ctx, short tableId); @Override short getTableId(); @Override void sync(Endpoint endpoint, OfWriter ofWriter); }
PortSecurity extends FlowTable { @VisibleForTesting void syncFlows(PortSecurityFlows flows, NodeId nodeId, Endpoint endpoint, OfWriter ofWriter) { flows.dropFlow(DROP, null, ofWriter); flows.dropFlow(DROP_ARP, FlowUtils.ARP, ofWriter); flows.dropFlow(DROP_IPV4, FlowUtils.IPv4, ofWriter); flows.dropFlow(DROP_IPV6, FlowUtils.IPv6, ofWriter); short sourceMapperId = ctx.getPolicyManager().getTABLEID_SOURCE_MAPPER(); NodeConnectorId vxLanPort = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlan.class); if (vxLanPort != null) { flows.allowFromTunnelFlow(sourceMapperId, ALLOW_FROM_TUNNEL, vxLanPort, ofWriter); } NodeConnectorId vxLanGpePort = ctx.getSwitchManager().getTunnelPort(nodeId, TunnelTypeVxlanGpe.class); if (vxLanGpePort != null) { flows.allowFromTunnelFlow(sourceMapperId, ALLOW_FROM_TUNNEL, vxLanGpePort, ofWriter); } TenantId tenantId = endpoint.getTenant(); if (EndpointManager.isInternal(endpoint, getExternalImplicitGroupsForTenant(tenantId))) { NodeConnectorId nodeConnectorId = ctx.getEndpointManager().getEndpointNodeConnectorId(endpoint); MacAddress macAddress = endpoint.getMacAddress(); if (nodeConnectorId != null && macAddress != null) { flows.l3Flow(sourceMapperId, endpoint, nodeConnectorId, macAddress, L3IP_FLOW, false, ofWriter); flows.l3Flow(sourceMapperId, endpoint, nodeConnectorId, macAddress, L3ARP_FLOW, true, ofWriter); flows.l3DhcpDoraFlow(sourceMapperId, nodeConnectorId, macAddress, DHCP_DORA, ofWriter); flows.l2flow(sourceMapperId, nodeConnectorId, macAddress, L2FLOW, ofWriter); } } else { if (LOG.isTraceEnabled()) { LOG.trace("External Endpoint is ignored in PortSecurity: {}", endpoint); } } short ingressNatId = ctx.getPolicyManager().getTABLEID_INGRESS_NAT(); for (NodeConnectorId connectorId : ctx.getSwitchManager().getExternalPorts(nodeId)) { if (tenantId != null && ctx.getTenant(tenantId) != null) { Tenant tenant = ctx.getTenant(tenantId).getTenant(); if (tenant != null && tenant.getForwardingContext() != null && tenant.getForwardingContext().getL2FloodDomain() != null) { List<L2FloodDomain> floodDomains = tenant.getForwardingContext().getL2FloodDomain(); flows.popVlanTagsOnExternalPortFlows(ingressNatId, connectorId, floodDomains, POP_VLAN_TAG_EXTERNAL, ofWriter); } } flows.allowFromExternalPortFlow(ingressNatId, connectorId, ALLOW_EXTERNAL, ofWriter); } } PortSecurity(OfContext ctx, short tableId); @Override short getTableId(); @Override void sync(Endpoint endpoint, OfWriter ofWriter);  }