홍길동 / onos

Go to a project
Toggle navigation Toggle navigation pinning
Hyunsun Moon
Committed by Gerrit Code Review
81ab23b3 1 parent 9186613c

Added drop rules to prevent packets for virtual networks go out 

through the physical network

Change-Id: I84dddb0c7ca4764c00566c29c163badc8d5c538f
Inline Side-by-side
Showing 1 changed file with 33 additions and 1 deletions
...@@ -196,6 +196,7 @@ public class CordVtnRuleInstaller { ...@@ -196,6 +196,7 @@ public class CordVtnRuleInstaller {
196 196
197 populateLocalInPortRule(deviceId, inPort, hostIp); 197 populateLocalInPortRule(deviceId, inPort, hostIp);
198 populateDirectAccessRule(Ip4Prefix.valueOf(subnet.cidr()), Ip4Prefix.valueOf(subnet.cidr())); 198 populateDirectAccessRule(Ip4Prefix.valueOf(subnet.cidr()), Ip4Prefix.valueOf(subnet.cidr()));
199 + populateServiceIsolationRule(Ip4Prefix.valueOf(subnet.cidr()));
199 populateDstIpRule(deviceId, inPort, dstMac, hostIp, tunnelId, tunnelIp); 200 populateDstIpRule(deviceId, inPort, dstMac, hostIp, tunnelId, tunnelIp);
200 populateTunnelInRule(deviceId, inPort, dstMac, tunnelId); 201 populateTunnelInRule(deviceId, inPort, dstMac, tunnelId);
201 } 202 }
...@@ -785,6 +786,37 @@ public class CordVtnRuleInstaller { ...@@ -785,6 +786,37 @@ public class CordVtnRuleInstaller {
785 .fromApp(appId) 786 .fromApp(appId)
786 .withSelector(selector) 787 .withSelector(selector)
787 .withTreatment(treatment) 788 .withTreatment(treatment)
789 + .withPriority(DEFAULT_PRIORITY)
790 + .forDevice(device.id())
791 + .forTable(TABLE_ACCESS_TYPE)
792 + .makePermanent()
793 + .build();
794 +
795 + processFlowRule(true, flowRuleDirect);
796 + }
797 + }
798 +
799 + /**
800 + * Populates drop rules that does not match any direct access rules but has
801 + * destination to a different service network in ACCESS_TYPE table.
802 + *
803 + * @param dstRange destination ip range
804 + */
805 + private void populateServiceIsolationRule(Ip4Prefix dstRange) {
806 + TrafficSelector selector = DefaultTrafficSelector.builder()
807 + .matchEthType(Ethernet.TYPE_IPV4)
808 + .matchIPDst(dstRange)
809 + .build();
810 +
811 + TrafficTreatment treatment = DefaultTrafficTreatment.builder()
812 + .drop()
813 + .build();
814 +
815 + for (Device device : deviceService.getAvailableDevices(SWITCH)) {
816 + FlowRule flowRuleDirect = DefaultFlowRule.builder()
817 + .fromApp(appId)
818 + .withSelector(selector)
819 + .withTreatment(treatment)
788 .withPriority(LOW_PRIORITY) 820 .withPriority(LOW_PRIORITY)
789 .forDevice(device.id()) 821 .forDevice(device.id())
790 .forTable(TABLE_ACCESS_TYPE) 822 .forTable(TABLE_ACCESS_TYPE)
...@@ -820,7 +852,7 @@ public class CordVtnRuleInstaller { ...@@ -820,7 +852,7 @@ public class CordVtnRuleInstaller {
820 .fromApp(appId) 852 .fromApp(appId)
821 .withSelector(selector) 853 .withSelector(selector)
822 .withTreatment(treatment) 854 .withTreatment(treatment)
823 - .withPriority(DEFAULT_PRIORITY) 855 + .withPriority(HIGH_PRIORITY)
824 .forDevice(outGroup.getKey()) 856 .forDevice(outGroup.getKey())
825 .forTable(TABLE_ACCESS_TYPE) 857 .forTable(TABLE_ACCESS_TYPE)
826 .makePermanent() 858 .makePermanent()
......