From a6b4b14ac1b6523f85fb13a7f259d9698a70444f Mon Sep 17 00:00:00 2001

Message-Id: <a6b4b14ac1b6523f85fb13a7f259d9698a70444f.1610458802.git.lorenzo.bianconi@redhat.com>

In-Reply-To: <f21c1b7a467a691847b5552d4570af706fcc5bb0.1610458802.git.lorenzo.bianconi@redhat.com>

References: <f21c1b7a467a691847b5552d4570af706fcc5bb0.1610458802.git.lorenzo.bianconi@redhat.com>

From: Anton Ivanov <anton.ivanov@cambridgegreys.com>

Date: Tue, 5 Jan 2021 17:49:35 +0000

Subject: [PATCH 08/16] ovn-northd: split build_lswitch_output_port_sec into

 iterators.

Split build_lswitch_output_port_sec into a per port and per

datapath iterator. Migrate to the relevant per-port and

per-datapath loops.

Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>

Signed-off-by: Numan Siddique <numans@ovn.org>

Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>

---

 northd/ovn-northd.c | 82 ++++++++++++++++++++-------------------------

 1 file changed, 37 insertions(+), 45 deletions(-)

diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c

index 27a788095..92300e017 100644

--- a/northd/ovn-northd.c

+++ b/northd/ovn-northd.c

@@ -4917,51 +4917,47 @@ build_lswitch_input_port_sec_od(

     }

 }

+/* Egress table 8: Egress port security - IP (priorities 90 and 80)

+ * if port security enabled.

+ *

+ * Egress table 9: Egress port security - L2 (priorities 50 and 150).

+ *

+ * Priority 50 rules implement port security for enabled logical port.

+ *

+ * Priority 150 rules drop packets to disabled logical ports, so that

+ * they don't even receive multicast or broadcast packets.

+ */

 static void

-build_lswitch_output_port_sec(struct hmap *ports, struct hmap *datapaths,

-                              struct hmap *lflows)

+build_lswitch_output_port_sec_op(struct ovn_port *op,

+                                 struct hmap *lflows,

+                                 struct ds *match,

+                                 struct ds *actions)

 {

-    struct ds actions = DS_EMPTY_INITIALIZER;

-    struct ds match = DS_EMPTY_INITIALIZER;

-    struct ovn_port *op;

-    /* Egress table 8: Egress port security - IP (priorities 90 and 80)

-     * if port security enabled.

-     *

-     * Egress table 9: Egress port security - L2 (priorities 50 and 150).

-     *

-     * Priority 50 rules implement port security for enabled logical port.

-     *

-     * Priority 150 rules drop packets to disabled logical ports, so that

-     * they don't even receive multicast or broadcast packets.

-     */

-    HMAP_FOR_EACH (op, key_node, ports) {

-        if (!op->nbsp || lsp_is_external(op->nbsp)) {

-            continue;

-        }

+    if (op->nbsp && (!lsp_is_external(op->nbsp))) {

-        ds_clear(&actions);

-        ds_clear(&match);

+        ds_clear(actions);

+        ds_clear(match);

-        ds_put_format(&match, "outport == %s", op->json_key);

+        ds_put_format(match, "outport == %s", op->json_key);

         if (lsp_is_enabled(op->nbsp)) {

             build_port_security_l2("eth.dst", op->ps_addrs, op->n_ps_addrs,

-                                   &match);

+                                   match);

             if (!strcmp(op->nbsp->type, "localnet")) {

                 const char *queue_id = smap_get(&op->sb->options,

                                                 "qdisc_queue_id");

                 if (queue_id) {

-                    ds_put_format(&actions, "set_queue(%s); ", queue_id);

+                    ds_put_format(actions, "set_queue(%s); ", queue_id);

                 }

             }

-            ds_put_cstr(&actions, "output;");

+            ds_put_cstr(actions, "output;");

             ovn_lflow_add_with_hint(lflows, op->od, S_SWITCH_OUT_PORT_SEC_L2,

-                                    50, ds_cstr(&match), ds_cstr(&actions),

+                                    50, ds_cstr(match), ds_cstr(actions),

                                     &op->nbsp->header_);

         } else {

             ovn_lflow_add_with_hint(lflows, op->od, S_SWITCH_OUT_PORT_SEC_L2,

-                                    150, ds_cstr(&match), "drop;",

+                                    150, ds_cstr(match), "drop;",

                                     &op->nbsp->header_);

         }

@@ -4969,23 +4965,20 @@ build_lswitch_output_port_sec(struct hmap *ports, struct hmap *datapaths,

             build_port_security_ip(P_OUT, op, lflows, &op->nbsp->header_);

         }

     }

+}

-    /* Egress tables 8: Egress port security - IP (priority 0)

-     * Egress table 9: Egress port security L2 - multicast/broadcast

-     *                 (priority 100). */

-    struct ovn_datapath *od;

-    HMAP_FOR_EACH (od, key_node, datapaths) {

-        if (!od->nbs) {

-            continue;

-        }

-

+/* Egress tables 8: Egress port security - IP (priority 0)

+ * Egress table 9: Egress port security L2 - multicast/broadcast

+ *                 (priority 100). */

+static void

+build_lswitch_output_port_sec_od(struct ovn_datapath *od,

+                              struct hmap *lflows)

+{

+    if (od->nbs) {

         ovn_lflow_add(lflows, od, S_SWITCH_OUT_PORT_SEC_IP, 0, "1", "next;");

         ovn_lflow_add(lflows, od, S_SWITCH_OUT_PORT_SEC_L2, 100, "eth.mcast",

                       "output;");

     }

-

-    ds_destroy(&match);

-    ds_destroy(&actions);

 }

 static void

@@ -6768,8 +6761,7 @@ is_vlan_transparent(const struct ovn_datapath *od)

 }

 static void

-build_lswitch_flows(struct hmap *datapaths, struct hmap *ports,

-                    struct hmap *lflows)

+build_lswitch_flows(struct hmap *datapaths, struct hmap *lflows)

 {

     /* This flow table structure is documented in ovn-northd(8), so please

      * update ovn-northd.8.xml if you change anything. */

@@ -6790,8 +6782,6 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports,

         }

     }

-    build_lswitch_output_port_sec(ports, datapaths, lflows);

-

     ds_destroy(&match);

     ds_destroy(&actions);

 }

@@ -11351,6 +11341,7 @@ build_lswitch_and_lrouter_iterate_by_od(struct ovn_datapath *od,

     build_lswitch_dns_lookup_and_response(od, lsi->lflows);

     build_lswitch_dhcp_and_dns_defaults(od, lsi->lflows);

     build_lswitch_destination_lookup_bmcast(od, lsi->lflows, &lsi->actions);

+    build_lswitch_output_port_sec_od(od, lsi->lflows);

     /* Build Logical Router Flows. */

     build_adm_ctrl_flows_for_lrouter(od, lsi->lflows);

@@ -11391,6 +11382,8 @@ build_lswitch_and_lrouter_iterate_by_op(struct ovn_port *op,

     build_lswitch_external_port(op, lsi->lflows);

     build_lswitch_ip_unicast_lookup(op, lsi->lflows, lsi->mcgroups,

                                     &lsi->actions, &lsi->match);

+    build_lswitch_output_port_sec_op(op, lsi->lflows,

+                                     &lsi->actions, &lsi->match);

     /* Build Logical Router Flows. */

     build_adm_ctrl_flows_for_lrouter_port(op, lsi->lflows, &lsi->match,

@@ -11462,8 +11455,7 @@ build_lswitch_and_lrouter_flows(struct hmap *datapaths, struct hmap *ports,

     ds_destroy(&lsi.match);

     ds_destroy(&lsi.actions);

-    /* Legacy lswitch build - to be migrated. */

-    build_lswitch_flows(datapaths, ports, lflows);

+    build_lswitch_flows(datapaths, lflows);

     /* Legacy lrouter build - to be migrated. */

     build_lrouter_flows(datapaths, ports, lflows, meter_groups, lbs);

-- 

2.29.2