From a6b4b14ac1b6523f85fb13a7f259d9698a70444f Mon Sep 17 00:00:00 2001
Message-Id: <a6b4b14ac1b6523f85fb13a7f259d9698a70444f.1610458802.git.lorenzo.bianconi@redhat.com>
In-Reply-To: <f21c1b7a467a691847b5552d4570af706fcc5bb0.1610458802.git.lorenzo.bianconi@redhat.com>
References: <f21c1b7a467a691847b5552d4570af706fcc5bb0.1610458802.git.lorenzo.bianconi@redhat.com>
From: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Date: Tue, 5 Jan 2021 17:49:35 +0000
Subject: [PATCH 08/16] ovn-northd: split build_lswitch_output_port_sec into
iterators.
Split build_lswitch_output_port_sec into a per port and per
datapath iterator. Migrate to the relevant per-port and
per-datapath loops.
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Numan Siddique <numans@ovn.org>
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
---
northd/ovn-northd.c | 82 ++++++++++++++++++++-------------------------
1 file changed, 37 insertions(+), 45 deletions(-)
diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c
index 27a788095..92300e017 100644
--- a/northd/ovn-northd.c
+++ b/northd/ovn-northd.c
@@ -4917,51 +4917,47 @@ build_lswitch_input_port_sec_od(
}
}
+/* Egress table 8: Egress port security - IP (priorities 90 and 80)
+ * if port security enabled.
+ *
+ * Egress table 9: Egress port security - L2 (priorities 50 and 150).
+ *
+ * Priority 50 rules implement port security for enabled logical port.
+ *
+ * Priority 150 rules drop packets to disabled logical ports, so that
+ * they don't even receive multicast or broadcast packets.
+ */
static void
-build_lswitch_output_port_sec(struct hmap *ports, struct hmap *datapaths,
- struct hmap *lflows)
+build_lswitch_output_port_sec_op(struct ovn_port *op,
+ struct hmap *lflows,
+ struct ds *match,
+ struct ds *actions)
{
- struct ds actions = DS_EMPTY_INITIALIZER;
- struct ds match = DS_EMPTY_INITIALIZER;
- struct ovn_port *op;
- /* Egress table 8: Egress port security - IP (priorities 90 and 80)
- * if port security enabled.
- *
- * Egress table 9: Egress port security - L2 (priorities 50 and 150).
- *
- * Priority 50 rules implement port security for enabled logical port.
- *
- * Priority 150 rules drop packets to disabled logical ports, so that
- * they don't even receive multicast or broadcast packets.
- */
- HMAP_FOR_EACH (op, key_node, ports) {
- if (!op->nbsp || lsp_is_external(op->nbsp)) {
- continue;
- }
+ if (op->nbsp && (!lsp_is_external(op->nbsp))) {
- ds_clear(&actions);
- ds_clear(&match);
+ ds_clear(actions);
+ ds_clear(match);
- ds_put_format(&match, "outport == %s", op->json_key);
+ ds_put_format(match, "outport == %s", op->json_key);
if (lsp_is_enabled(op->nbsp)) {
build_port_security_l2("eth.dst", op->ps_addrs, op->n_ps_addrs,
- &match);
+ match);
if (!strcmp(op->nbsp->type, "localnet")) {
const char *queue_id = smap_get(&op->sb->options,
"qdisc_queue_id");
if (queue_id) {
- ds_put_format(&actions, "set_queue(%s); ", queue_id);
+ ds_put_format(actions, "set_queue(%s); ", queue_id);
}
}
- ds_put_cstr(&actions, "output;");
+ ds_put_cstr(actions, "output;");
ovn_lflow_add_with_hint(lflows, op->od, S_SWITCH_OUT_PORT_SEC_L2,
- 50, ds_cstr(&match), ds_cstr(&actions),
+ 50, ds_cstr(match), ds_cstr(actions),
&op->nbsp->header_);
} else {
ovn_lflow_add_with_hint(lflows, op->od, S_SWITCH_OUT_PORT_SEC_L2,
- 150, ds_cstr(&match), "drop;",
+ 150, ds_cstr(match), "drop;",
&op->nbsp->header_);
}
@@ -4969,23 +4965,20 @@ build_lswitch_output_port_sec(struct hmap *ports, struct hmap *datapaths,
build_port_security_ip(P_OUT, op, lflows, &op->nbsp->header_);
}
}
+}
- /* Egress tables 8: Egress port security - IP (priority 0)
- * Egress table 9: Egress port security L2 - multicast/broadcast
- * (priority 100). */
- struct ovn_datapath *od;
- HMAP_FOR_EACH (od, key_node, datapaths) {
- if (!od->nbs) {
- continue;
- }
-
+/* Egress tables 8: Egress port security - IP (priority 0)
+ * Egress table 9: Egress port security L2 - multicast/broadcast
+ * (priority 100). */
+static void
+build_lswitch_output_port_sec_od(struct ovn_datapath *od,
+ struct hmap *lflows)
+{
+ if (od->nbs) {
ovn_lflow_add(lflows, od, S_SWITCH_OUT_PORT_SEC_IP, 0, "1", "next;");
ovn_lflow_add(lflows, od, S_SWITCH_OUT_PORT_SEC_L2, 100, "eth.mcast",
"output;");
}
-
- ds_destroy(&match);
- ds_destroy(&actions);
}
static void
@@ -6768,8 +6761,7 @@ is_vlan_transparent(const struct ovn_datapath *od)
}
static void
-build_lswitch_flows(struct hmap *datapaths, struct hmap *ports,
- struct hmap *lflows)
+build_lswitch_flows(struct hmap *datapaths, struct hmap *lflows)
{
/* This flow table structure is documented in ovn-northd(8), so please
* update ovn-northd.8.xml if you change anything. */
@@ -6790,8 +6782,6 @@ build_lswitch_flows(struct hmap *datapaths, struct hmap *ports,
}
}
- build_lswitch_output_port_sec(ports, datapaths, lflows);
-
ds_destroy(&match);
ds_destroy(&actions);
}
@@ -11351,6 +11341,7 @@ build_lswitch_and_lrouter_iterate_by_od(struct ovn_datapath *od,
build_lswitch_dns_lookup_and_response(od, lsi->lflows);
build_lswitch_dhcp_and_dns_defaults(od, lsi->lflows);
build_lswitch_destination_lookup_bmcast(od, lsi->lflows, &lsi->actions);
+ build_lswitch_output_port_sec_od(od, lsi->lflows);
/* Build Logical Router Flows. */
build_adm_ctrl_flows_for_lrouter(od, lsi->lflows);
@@ -11391,6 +11382,8 @@ build_lswitch_and_lrouter_iterate_by_op(struct ovn_port *op,
build_lswitch_external_port(op, lsi->lflows);
build_lswitch_ip_unicast_lookup(op, lsi->lflows, lsi->mcgroups,
&lsi->actions, &lsi->match);
+ build_lswitch_output_port_sec_op(op, lsi->lflows,
+ &lsi->actions, &lsi->match);
/* Build Logical Router Flows. */
build_adm_ctrl_flows_for_lrouter_port(op, lsi->lflows, &lsi->match,
@@ -11462,8 +11455,7 @@ build_lswitch_and_lrouter_flows(struct hmap *datapaths, struct hmap *ports,
ds_destroy(&lsi.match);
ds_destroy(&lsi.actions);
- /* Legacy lswitch build - to be migrated. */
- build_lswitch_flows(datapaths, ports, lflows);
+ build_lswitch_flows(datapaths, lflows);
/* Legacy lrouter build - to be migrated. */
build_lrouter_flows(datapaths, ports, lflows, meter_groups, lbs);
--
2.29.2