https://jira.opendaylight.org This file is an XML representation of an issue en-us 8.20.10 820010 22-06-2022 https://jira.opendaylight.org/browse/GBP-18 groupbasedpolicy <p>Fixed in current work.</p> <p>FlowIDs not updated (no reference to "cond", and hence FlowMap not updated.</p> <p>Operating System: All<br/> Platform: All</p> GBP-18

Conditions do not work correctly - especially with inheritance

Bug Resolved Done Konstantin Blagov Keith Burns Wed, 11 Mar 2015 03:51:04 +0000 Sun, 11 Oct 2015 23:26:27 +0000 Sun, 11 Oct 2015 23:26:27 +0000 unspecified General 0 2 <p>See Deadline. EP conditions already raised as bug, will be dealt with in Li</p> <p>See #2934, will address</p> <p>With the following policy (just showing contract portion):</p> <p>"contract": [<br/> {<br/> "id": "5c4b9e66-e014-4102-8058-cc44cfa0f803"<br/> "clause": [<br/> </p> { "name": "allow-icmp-clause", "subject-refs": [ "allow-icmp-subject" ] } <p>,<br/> {<br/> "name": "allow-http-clause",<br/> "subject-refs": [ "allow-http-subject" ],<br/> "consumer-matchers": {<br/> "consumer-matcher": [<br/> {<br/> "name": "infected-matcher",<br/> "condition": [ </p> { "name": "not-infected", "inclusion-rule": "include" } <p> ]<br/> }<br/> ]<br/> }<br/> }</p> <p>I would have expected that all Endpoints would be able to ping (covered by the "allow-icmp-clause" selecting the "allow-icmp-subject"), but only Endpoints with the "not-infected" condition to be able to pass HTTP traffic. However, I found that Endpoints with the "not-infected" condition couldn't ping. The reason is that their source condition group is different, which is stored in Nicira register 1 in our pipeline (in SourceMapper.java). When it reaches the PolicyEnforcer, the PolicyEnforcer tries matching ICMP on the "no conditions" value in register 1, and since the "not-infected" value is stored in register 1, the ICMP traffic isn't let through.</p> <p>What's unclear is whether or not this is the expected behavior.</p> <p>These 2 fragments below show corrected RESTconf, and I get expected result, i.e. everyone can ping everyone, but only "not-infected" consumers can HTTP (those with no condition get "Connection timed out"). Will test further with "inclusion-rule": "excluded", and with both rules/conditions on different consumers.</p> <p>POST http://<tt>controllerIp</tt>:<tt>port</tt>/restconf/operations/endpoint:register-endpoint<br/> {<br/> "input": {</p> <p> "endpoint-group": "1eaf9a67-a171-42a8-9282-71cf702f61dd", <br/> "condition": [<br/> "not-infected"<br/> ],<br/> etc...</p> <p>in PUT tenant:<br/> ...<br/> "contract": [<br/> {<br/> "id": "22282cca-9a13-4d0c-a67e-a933ebb0b0ae",<br/> "subject": [<br/> {<br/> "name": "allow-icmp-subject",<br/> "rule": [<br/> {<br/> "name": "allow-icmp-rule",<br/> "classifier-ref": [</p> { "name": "icmp" } <p> ],<br/> "action-ref": [</p> { "name": "allow1", "order": 0 } <p> ]<br/> }<br/> ]<br/> },<br/> {<br/> "name": "chain-http-subject",<br/> "rule": [<br/> {<br/> "name": "chain-http-rule",<br/> "classifier-ref": [<br/> </p> { "name": "http-dest", "direction": "in" } <p>,</p> { "name": "http-src", "direction": "out" } <p> ],<br/> "action-ref": [</p> { "name": "allow1", "order": 0 } <p> ]<br/> }<br/> ]<br/> }<br/> ],<br/> "clause": [<br/> </p> { "name": "allow-icmp-clause", "subject-refs": [ "allow-icmp-subject" ] } <p>,<br/> {<br/> "name": "chain-http-clause",<br/> "subject-refs": [<br/> "chain-http-subject"<br/> ],</p> <p> "consumer-matchers": {<br/> "condition-matcher": [<br/> {<br/> "name": "infected-matcher",<br/> "match-type": "all",<br/> "condition": [ </p> { "name": "not-infected", "inclusion-rule": "include" } <p> ]<br/> }<br/> ]<br/> }</p> <p> }<br/> ]<br/> }<br/> ]<br/> ...</p> <p>After some testing tried, the result changed to initial: "not-infected" EP can HTTP, but cannot ping any provider, EP without condition can ping and cannot curl (it's expected)</p> <p><a href="https://git.opendaylight.org/gerrit/#/c/24230/" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/24230/</a></p> Blocks GBP-22 Development External issue ID 2815 External issue URL Issue Type ODL SR Target Milestone Priority Rank 0|i034yv: