Operating System: All
Platform: All

See Deadline. EP conditions already raised as bug, will be dealt with in Li

See #2934, will address

With the following policy (just showing contract portion):

"contract": [
{
"id": "5c4b9e66-e014-4102-8058-cc44cfa0f803"
"clause": [

,
{
"name": "allow-http-clause",
"subject-refs": [ "allow-http-subject" ],
"consumer-matchers": {
"consumer-matcher": [
{
"name": "infected-matcher",
"condition": [

]
}
]
}
}

I would have expected that all Endpoints would be able to ping (covered by the "allow-icmp-clause" selecting the "allow-icmp-subject"), but only Endpoints with the "not-infected" condition to be able to pass HTTP traffic. However, I found that Endpoints with the "not-infected" condition couldn't ping. The reason is that their source condition group is different, which is stored in Nicira register 1 in our pipeline (in SourceMapper.java). When it reaches the PolicyEnforcer, the PolicyEnforcer tries matching ICMP on the "no conditions" value in register 1, and since the "not-infected" value is stored in register 1, the ICMP traffic isn't let through.

What's unclear is whether or not this is the expected behavior.

These 2 fragments below show corrected RESTconf, and I get expected result, i.e. everyone can ping everyone, but only "not-infected" consumers can HTTP (those with no condition get "Connection timed out"). Will test further with "inclusion-rule": "excluded", and with both rules/conditions on different consumers.

POST http://controllerIp:port/restconf/operations/endpoint:register-endpoint
{
"input": {

"endpoint-group": "1eaf9a67-a171-42a8-9282-71cf702f61dd",
"condition": [
"not-infected"
],
etc...

in PUT tenant:
...
"contract": [
{
"id": "22282cca-9a13-4d0c-a67e-a933ebb0b0ae",
"subject": [
{
"name": "allow-icmp-subject",
"rule": [
{
"name": "allow-icmp-rule",
"classifier-ref": [

],
"action-ref": [

]
}
]
},
{
"name": "chain-http-subject",
"rule": [
{
"name": "chain-http-rule",
"classifier-ref": [

,

],
"action-ref": [

]
}
]
}
],
"clause": [

,
{
"name": "chain-http-clause",
"subject-refs": [
"chain-http-subject"
],

"consumer-matchers": {
"condition-matcher": [
{
"name": "infected-matcher",
"match-type": "all",
"condition": [

]
}
]
}

}
]
}
]
...

After some testing tried, the result changed to initial: "not-infected" EP can HTTP, but cannot ping any provider, EP without condition can ping and cannot curl (it's expected)

https://git.opendaylight.org/gerrit/#/c/24230/