ovn: Add stateful ACL support.

[cascardo/ovs.git] / ovn / controller / binding.c

diff --git a/ovn/controller/binding.c b/ovn/controller/binding.c
index 402d4d2..7f31b31 100644 (file)
--- a/ovn/controller/binding.c
+++ b/ovn/controller/binding.c
@@ -16,6 +16,7 @@
 #include <config.h>
 #include "binding.h"
 
+#include "lib/bitmap.h"
 #include "lib/sset.h"
 #include "lib/util.h"
 #include "lib/vswitch-idl.h"
@@ -71,12 +72,58 @@ get_local_iface_ids(const struct ovsrec_bridge *br_int, struct sset *lports)
     }
 }
 
+static void
+update_ct_zones(struct sset *lports, struct simap *ct_zones,
+                unsigned long *ct_zone_bitmap)
+{
+    struct simap_node *ct_zone, *ct_zone_next;
+    const char *iface_id;
+    int scan_start = 1;
+
+    /* xxx This is wasteful to assign a zone to each port--even if no
+     * xxx security policy is applied. */
+
+    /* Delete any zones that are associated with removed ports. */
+    SIMAP_FOR_EACH_SAFE(ct_zone, ct_zone_next, ct_zones) {
+        if (!sset_contains(lports, ct_zone->name)) {
+            bitmap_set0(ct_zone_bitmap, ct_zone->data);
+            simap_delete(ct_zones, ct_zone);
+        }
+    }
+
+    /* Assign a unique zone id for each logical port. */
+    SSET_FOR_EACH(iface_id, lports) {
+        size_t zone;
+
+        if (simap_contains(ct_zones, iface_id)) {
+            continue;
+        }
+
+        /* We assume that there are 64K zones and that we own them all. */
+        zone = bitmap_scan(ct_zone_bitmap, 0, scan_start, MAX_CT_ZONES + 1);
+        if (zone == MAX_CT_ZONES + 1) {
+            static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 1);
+            VLOG_WARN_RL(&rl, "exhausted all ct zones");
+            return;
+        }
+        scan_start = zone + 1;
+
+        bitmap_set1(ct_zone_bitmap, zone);
+        simap_put(ct_zones, iface_id, zone);
+
+        /* xxx We should erase any old entries for this
+         * xxx zone, but we need a generic interface to the conntrack
+         * xxx table. */
+    }
+}
+
 void
 binding_run(struct controller_ctx *ctx, const struct ovsrec_bridge *br_int,
-            const char *chassis_id)
+            const char *chassis_id, struct simap *ct_zones,
+            unsigned long *ct_zone_bitmap)
 {
     const struct sbrec_chassis *chassis_rec;
-    const struct sbrec_binding *binding_rec;
+    const struct sbrec_port_binding *binding_rec;
     struct sset lports, all_lports;
     const char *name;
 
@@ -84,7 +131,7 @@ binding_run(struct controller_ctx *ctx, const struct ovsrec_bridge *br_int,
         return;
     }
 
-    chassis_rec = get_chassis_by_name(ctx->ovnsb_idl, chassis_id);
+    chassis_rec = get_chassis(ctx->ovnsb_idl, chassis_id);
     if (!chassis_rec) {
         return;
     }
@@ -97,13 +144,14 @@ binding_run(struct controller_ctx *ctx, const struct ovsrec_bridge *br_int,
         /* We have no integration bridge, therefore no local logical ports.
          * We'll remove our chassis from all port binding records below. */
     }
+    update_ct_zones(&lports, ct_zones, ct_zone_bitmap);
     sset_clone(&all_lports, &lports);
 
-    ovsdb_idl_txn_add_comment(ctx->ovnsb_idl_txn,
-                              "ovn-controller: updating bindings for '%s'",
-                              chassis_id);
+    ovsdb_idl_txn_add_comment(
+        ctx->ovnsb_idl_txn,"ovn-controller: updating port bindings for '%s'",
+        chassis_id);
 
-    SBREC_BINDING_FOR_EACH(binding_rec, ctx->ovnsb_idl) {
+    SBREC_PORT_BINDING_FOR_EACH(binding_rec, ctx->ovnsb_idl) {
         if (sset_find_and_delete(&lports, binding_rec->logical_port) ||
                 (binding_rec->parent_port && binding_rec->parent_port[0] &&
                  sset_contains(&all_lports, binding_rec->parent_port))) {
@@ -116,14 +164,14 @@ binding_run(struct controller_ctx *ctx, const struct ovsrec_bridge *br_int,
                           binding_rec->chassis->name,
                           chassis_rec->name);
             }
-            sbrec_binding_set_chassis(binding_rec, chassis_rec);
+            sbrec_port_binding_set_chassis(binding_rec, chassis_rec);
         } else if (binding_rec->chassis == chassis_rec) {
-            sbrec_binding_set_chassis(binding_rec, NULL);
+            sbrec_port_binding_set_chassis(binding_rec, NULL);
         }
     }
 
     SSET_FOR_EACH (name, &lports) {
-        VLOG_DBG("No binding record for lport %s", name);
+        VLOG_DBG("No port binding record for lport %s", name);
     }
     sset_destroy(&lports);
     sset_destroy(&all_lports);
@@ -141,21 +189,22 @@ binding_cleanup(struct controller_ctx *ctx, const char *chassis_id)
     if (!chassis_id) {
         return true;
     }
+
     const struct sbrec_chassis *chassis_rec
-        = get_chassis_by_name(ctx->ovnsb_idl, chassis_id);
+        = get_chassis(ctx->ovnsb_idl, chassis_id);
     if (!chassis_rec) {
         return true;
     }
 
-    ovsdb_idl_txn_add_comment(ctx->ovnsb_idl_txn,
-                              "ovn-controller: removing all bindings for '%s'",
-                              chassis_id);
+    ovsdb_idl_txn_add_comment(
+        ctx->ovnsb_idl_txn,
+        "ovn-controller: removing all port bindings for '%s'", chassis_id);
 
-    const struct sbrec_binding *binding_rec;
+    const struct sbrec_port_binding *binding_rec;
     bool any_changes = false;
-    SBREC_BINDING_FOR_EACH(binding_rec, ctx->ovnsb_idl) {
+    SBREC_PORT_BINDING_FOR_EACH(binding_rec, ctx->ovnsb_idl) {
         if (binding_rec->chassis == chassis_rec) {
-            sbrec_binding_set_chassis(binding_rec, NULL);
+            sbrec_port_binding_set_chassis(binding_rec, NULL);
             any_changes = true;
         }
     }