[mirror_ovs.git] / secchan / in-band.c

/*
 * Copyright (c) 2008, 2009 Nicira Networks.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <config.h>
#include "in-band.h"
#include <arpa/inet.h>
#include <errno.h>
#include <inttypes.h>
#include <net/if.h>
#include <string.h>
#include <stdlib.h>
#include "flow.h"
#include "mac-learning.h"
#include "netdev.h"
#include "odp-util.h"
#include "ofp-print.h"
#include "ofproto.h"
#include "ofpbuf.h"
#include "openflow/openflow.h"
#include "packets.h"
#include "poll-loop.h"
#include "rconn.h"
#include "status.h"
#include "timeval.h"
#include "vconn.h"

#define THIS_MODULE VLM_in_band
#include "vlog.h"

#define IB_BASE_PRIORITY 18181800

enum {
    IBR_FROM_LOCAL_PORT,        /* Sent by the local port. */
    IBR_OFP_TO_LOCAL,           /* Sent to secure channel on local port. */
    IBR_ARP_FROM_LOCAL,         /* ARP from the local port. */
    IBR_ARP_TO_LOCAL,           /* ARP to the local port. */
    IBR_ARP_FROM_CTL,           /* ARP from the controller. */
    IBR_TO_CTL_OFP_SRC,         /* To controller, OpenFlow source port. */
    IBR_TO_CTL_OFP_DST,         /* To controller, OpenFlow dest port. */
    IBR_FROM_CTL_OFP_SRC,       /* From controller, OpenFlow source port. */
    IBR_FROM_CTL_OFP_DST,       /* From controller, OpenFlow dest port. */
#if OFP_TCP_PORT != OFP_SSL_PORT
#error Need to support separate TCP and SSL flows.
#endif
    N_IB_RULES
};

struct ib_rule {
    bool installed;
    flow_t flow;
    uint32_t wildcards;
    unsigned int priority;
};

struct in_band {
    struct ofproto *ofproto;
    struct rconn *controller;
    struct status_category *ss_cat;

    /* Keeping track of controller's MAC address. */
    uint32_t ip;                /* Current IP, 0 if unknown. */
    uint32_t last_ip;           /* Last known IP, 0 if never known. */
    uint8_t mac[ETH_ADDR_LEN];  /* Current MAC, 0 if unknown. */
    uint8_t last_mac[ETH_ADDR_LEN]; /* Last known MAC, 0 if never known */
    char *dev_name;
    time_t next_refresh;        /* Next time to refresh MAC address. */

    /* Keeping track of the local port's MAC address. */
    uint8_t local_mac[ETH_ADDR_LEN]; /* Current MAC. */
    time_t next_local_refresh;  /* Next time to refresh MAC address. */

    /* Rules that we set up. */
    struct ib_rule rules[N_IB_RULES];
};

static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(60, 60);

static const uint8_t *
get_controller_mac(struct in_band *ib)
{
    time_t now = time_now();
    uint32_t controller_ip;

    controller_ip = rconn_get_remote_ip(ib->controller);
    if (controller_ip != ib->ip || now >= ib->next_refresh) {
        bool have_mac;

        ib->ip = controller_ip;

        /* Look up MAC address. */
        memset(ib->mac, 0, sizeof ib->mac);
        if (ib->ip) {
            uint32_t local_ip = rconn_get_local_ip(ib->controller);
            struct in_addr in4;
            int retval;

            in4.s_addr = local_ip;
            if (netdev_find_dev_by_in4(&in4, &ib->dev_name)) {
                retval = netdev_nodev_arp_lookup(ib->dev_name, ib->ip,
                        ib->mac);
                if (retval) {
                    VLOG_DBG_RL(&rl, "cannot look up controller MAC address "
                                "("IP_FMT"): %s",
                                IP_ARGS(&ib->ip), strerror(retval));
                }
            } else {
                VLOG_DBG_RL(&rl, "cannot find device with IP address "IP_FMT,
                    IP_ARGS(&local_ip));
            }
        }
        have_mac = !eth_addr_is_zero(ib->mac);

        /* Log changes in IP, MAC addresses. */
        if (ib->ip && ib->ip != ib->last_ip) {
            VLOG_DBG("controller IP address changed from "IP_FMT
                     " to "IP_FMT, IP_ARGS(&ib->last_ip), IP_ARGS(&ib->ip));
            ib->last_ip = ib->ip;
        }
        if (have_mac && memcmp(ib->last_mac, ib->mac, ETH_ADDR_LEN)) {
            VLOG_DBG("controller MAC address changed from "ETH_ADDR_FMT" to "
                     ETH_ADDR_FMT,
                     ETH_ADDR_ARGS(ib->last_mac), ETH_ADDR_ARGS(ib->mac));
            memcpy(ib->last_mac, ib->mac, ETH_ADDR_LEN);
        }

        /* Schedule next refresh.
         *
         * If we have an IP address but not a MAC address, then refresh
         * quickly, since we probably will get a MAC address soon (via ARP).
         * Otherwise, we can afford to wait a little while. */
        ib->next_refresh = now + (!ib->ip || have_mac ? 10 : 1);
    }
    return !eth_addr_is_zero(ib->mac) ? ib->mac : NULL;
}

static const uint8_t *
get_local_mac(struct in_band *ib)
{
    time_t now = time_now();
    if (now >= ib->next_local_refresh) {
        uint8_t ea[ETH_ADDR_LEN];
        if (ib->dev_name && (!netdev_nodev_get_etheraddr(ib->dev_name, ea))) {
            memcpy(ib->local_mac, ea, ETH_ADDR_LEN);
        }
        ib->next_local_refresh = now + 1;
    }
    return !eth_addr_is_zero(ib->local_mac) ? ib->local_mac : NULL;
}

static void
in_band_status_cb(struct status_reply *sr, void *in_band_)
{
    struct in_band *in_band = in_band_;

    if (!eth_addr_is_zero(in_band->local_mac)) {
        status_reply_put(sr, "local-mac="ETH_ADDR_FMT,
                         ETH_ADDR_ARGS(in_band->local_mac));
    }

    if (!eth_addr_is_zero(in_band->mac)) {
        status_reply_put(sr, "controller-mac="ETH_ADDR_FMT,
                         ETH_ADDR_ARGS(in_band->mac));
    }
}

static void
drop_flow(struct in_band *in_band, int rule_idx)
{
    struct ib_rule *rule = &in_band->rules[rule_idx];

    if (rule->installed) {
        rule->installed = false;
        ofproto_delete_flow(in_band->ofproto, &rule->flow, rule->wildcards,
                            rule->priority);
    }
}

/* out_port and fixed_fields are assumed never to change. */
static void
setup_flow(struct in_band *in_band, int rule_idx, const flow_t *flow,
           uint32_t fixed_fields, uint16_t out_port)
{
    struct ib_rule *rule = &in_band->rules[rule_idx];

    if (!rule->installed || memcmp(flow, &rule->flow, sizeof *flow)) {
        union ofp_action action;

        drop_flow(in_band, rule_idx);

        rule->installed = true;
        rule->flow = *flow;
        rule->wildcards = OFPFW_ALL & ~fixed_fields;
        rule->priority = IB_BASE_PRIORITY + (N_IB_RULES - rule_idx);

        action.type = htons(OFPAT_OUTPUT);
        action.output.len = htons(sizeof action);
        action.output.port = htons(out_port);
        action.output.max_len = htons(0);
        ofproto_add_flow(in_band->ofproto, &rule->flow, rule->wildcards,
                         rule->priority, &action, 1, 0);
    }
}

void
in_band_run(struct in_band *in_band)
{
    const uint8_t *controller_mac;
    const uint8_t *local_mac;
    flow_t flow;

    if (time_now() < MIN(in_band->next_refresh, in_band->next_local_refresh)) {
        return;
    }
 
    /* NOTE: A router may sit between the switch and controller, so
     * we could not tie this to the controller's MAC address.  If the
     * switch and controller are on different subnets, we should be
     * using the router's MAC address in the 'controller_mac'. */
    controller_mac = get_controller_mac(in_band);
    local_mac = get_local_mac(in_band);

    /* Switch traffic sent by the local port. */
    memset(&flow, 0, sizeof flow);
    flow.in_port = ODPP_LOCAL;
    setup_flow(in_band, IBR_FROM_LOCAL_PORT, &flow, OFPFW_IN_PORT,
               OFPP_NORMAL);

    if (local_mac) {
        /* Deliver traffic sent over the secure channel to the connection's
         * interface. */
        memset(&flow, 0, sizeof flow);
        flow.dl_type = htons(ETH_TYPE_IP);
        memcpy(flow.dl_dst, local_mac, ETH_ADDR_LEN);
        flow.nw_proto = IP_TYPE_TCP;
        flow.tp_src = htons(OFP_TCP_PORT);
        setup_flow(in_band, IBR_OFP_TO_LOCAL, &flow, 
                    (OFPFW_DL_TYPE | OFPFW_DL_DST | OFPFW_NW_PROTO 
                     | OFPFW_TP_SRC), OFPP_NORMAL);

        /* Allow the connection's interface to be the source of ARP traffic. */
        memset(&flow, 0, sizeof flow);
        flow.dl_type = htons(ETH_TYPE_ARP);
        memcpy(flow.dl_src, local_mac, ETH_ADDR_LEN);
        setup_flow(in_band, IBR_ARP_FROM_LOCAL, &flow,
                   OFPFW_DL_TYPE | OFPFW_DL_SRC, OFPP_NORMAL);

        /* Allow the connection's interface to receive directed ARP traffic. */
        memset(&flow, 0, sizeof flow);
        flow.dl_type = htons(ETH_TYPE_ARP);
        memcpy(flow.dl_dst, local_mac, ETH_ADDR_LEN);
        setup_flow(in_band, IBR_ARP_TO_LOCAL, &flow, 
                   OFPFW_DL_TYPE | OFPFW_DL_DST, OFPP_NORMAL);
    } else {
        drop_flow(in_band, IBR_OFP_TO_LOCAL);
        drop_flow(in_band, IBR_ARP_FROM_LOCAL);
        drop_flow(in_band, IBR_ARP_TO_LOCAL);
    }

    if (controller_mac) {
        /* Switch ARP requests sent by the controller.  (OFPP_NORMAL will "do
         * the right thing" regarding VLANs here.) */
        memset(&flow, 0, sizeof flow);
        flow.dl_type = htons(ETH_TYPE_ARP);
        memcpy(flow.dl_dst, eth_addr_broadcast, ETH_ADDR_LEN);
        memcpy(flow.dl_src, controller_mac, ETH_ADDR_LEN);
        setup_flow(in_band, IBR_ARP_FROM_CTL, &flow,
                   OFPFW_DL_TYPE | OFPFW_DL_DST | OFPFW_DL_SRC,
                   OFPP_NORMAL);

        /* OpenFlow traffic to or from the controller.
         *
         * (A given field's value is completely ignored if it is wildcarded,
         * which is why we can get away with using a single 'flow' in each
         * case here.) */
        memset(&flow, 0, sizeof flow);
        flow.dl_type = htons(ETH_TYPE_IP);
        memcpy(flow.dl_src, controller_mac, ETH_ADDR_LEN);
        memcpy(flow.dl_dst, controller_mac, ETH_ADDR_LEN);
        flow.nw_proto = IP_TYPE_TCP;
        flow.tp_src = htons(OFP_TCP_PORT);
        flow.tp_dst = htons(OFP_TCP_PORT);
        setup_flow(in_band, IBR_TO_CTL_OFP_SRC, &flow,
                   (OFPFW_DL_TYPE | OFPFW_DL_DST | OFPFW_NW_PROTO
                    | OFPFW_TP_SRC), OFPP_NORMAL);
        setup_flow(in_band, IBR_TO_CTL_OFP_DST, &flow,
                   (OFPFW_DL_TYPE | OFPFW_DL_DST | OFPFW_NW_PROTO
                    | OFPFW_TP_DST), OFPP_NORMAL);
        setup_flow(in_band, IBR_FROM_CTL_OFP_SRC, &flow,
                   (OFPFW_DL_TYPE | OFPFW_DL_SRC | OFPFW_NW_PROTO
                    | OFPFW_TP_SRC), OFPP_NORMAL);
        setup_flow(in_band, IBR_FROM_CTL_OFP_DST, &flow,
                   (OFPFW_DL_TYPE | OFPFW_DL_SRC | OFPFW_NW_PROTO
                    | OFPFW_TP_DST), OFPP_NORMAL);
    } else {
        drop_flow(in_band, IBR_ARP_FROM_CTL);
        drop_flow(in_band, IBR_TO_CTL_OFP_DST);
        drop_flow(in_band, IBR_TO_CTL_OFP_SRC);
        drop_flow(in_band, IBR_FROM_CTL_OFP_DST);
        drop_flow(in_band, IBR_FROM_CTL_OFP_SRC);
    }
}

void
in_band_wait(struct in_band *in_band)
{
    time_t now = time_now();
    time_t wakeup = MIN(in_band->next_refresh, in_band->next_local_refresh);
    if (wakeup > now) {
        poll_timer_wait((wakeup - now) * 1000);
    } else {
        poll_immediate_wake();
    }
}

void
in_band_flushed(struct in_band *in_band)
{
    int i;

    for (i = 0; i < N_IB_RULES; i++) {
        in_band->rules[i].installed = false;
    }
}

void
in_band_create(struct ofproto *ofproto, struct switch_status *ss,
               struct rconn *controller, struct in_band **in_bandp)
{
    struct in_band *in_band;

    in_band = xcalloc(1, sizeof *in_band);
    in_band->ofproto = ofproto;
    in_band->controller = controller;
    in_band->ss_cat = switch_status_register(ss, "in-band",
                                             in_band_status_cb, in_band);
    in_band->next_refresh = TIME_MIN;
    in_band->next_local_refresh = TIME_MIN;
    in_band->dev_name = NULL;

    *in_bandp = in_band;
}

void
in_band_destroy(struct in_band *in_band)
{
    if (in_band) {
        switch_status_unregister(in_band->ss_cat);
        /* We don't own the rconn. */
    }
}
Commit	Line	Data
064af421 BP	1	/*
	2	* Copyright (c) 2008, 2009 Nicira Networks.
	3	*
a14bc59f BP	4	* Licensed under the Apache License, Version 2.0 (the "License");
	5	* you may not use this file except in compliance with the License.
	6	* You may obtain a copy of the License at:
064af421	7	*
a14bc59f BP	8	* http://www.apache.org/licenses/LICENSE-2.0
	9	*
	10	* Unless required by applicable law or agreed to in writing, software
	11	* distributed under the License is distributed on an "AS IS" BASIS,
	12	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	13	* See the License for the specific language governing permissions and
	14	* limitations under the License.
064af421 BP	15	*/
	16
	17	#include <config.h>
	18	#include "in-band.h"
	19	#include <arpa/inet.h>
	20	#include <errno.h>
	21	#include <inttypes.h>
	22	#include <net/if.h>
	23	#include <string.h>
26d9fe3b	24	#include <stdlib.h>
064af421 BP	25	#include "flow.h"
	26	#include "mac-learning.h"
	27	#include "netdev.h"
	28	#include "odp-util.h"
	29	#include "ofp-print.h"
	30	#include "ofproto.h"
	31	#include "ofpbuf.h"
	32	#include "openflow/openflow.h"
	33	#include "packets.h"
	34	#include "poll-loop.h"
	35	#include "rconn.h"
	36	#include "status.h"
	37	#include "timeval.h"
	38	#include "vconn.h"
	39
	40	#define THIS_MODULE VLM_in_band
	41	#include "vlog.h"
	42
	43	#define IB_BASE_PRIORITY 18181800
	44
	45	enum {
26d9fe3b JP	46	IBR_FROM_LOCAL_PORT, /* Sent by the local port. */
	47	IBR_OFP_TO_LOCAL, /* Sent to secure channel on local port. */
	48	IBR_ARP_FROM_LOCAL, /* ARP from the local port. */
a5f37a2d	49	IBR_ARP_TO_LOCAL, /* ARP to the local port. */
064af421 BP	50	IBR_ARP_FROM_CTL, /* ARP from the controller. */
	51	IBR_TO_CTL_OFP_SRC, /* To controller, OpenFlow source port. */
	52	IBR_TO_CTL_OFP_DST, /* To controller, OpenFlow dest port. */
	53	IBR_FROM_CTL_OFP_SRC, /* From controller, OpenFlow source port. */
	54	IBR_FROM_CTL_OFP_DST, /* From controller, OpenFlow dest port. */
	55	#if OFP_TCP_PORT != OFP_SSL_PORT
	56	#error Need to support separate TCP and SSL flows.
	57	#endif
	58	N_IB_RULES
	59	};
	60
	61	struct ib_rule {
	62	bool installed;
	63	flow_t flow;
	64	uint32_t wildcards;
	65	unsigned int priority;
	66	};
	67
	68	struct in_band {
	69	struct ofproto *ofproto;
064af421 BP	70	struct rconn *controller;
	71	struct status_category *ss_cat;
	72
	73	/* Keeping track of controller's MAC address. */
	74	uint32_t ip; /* Current IP, 0 if unknown. */
	75	uint32_t last_ip; /* Last known IP, 0 if never known. */
	76	uint8_t mac[ETH_ADDR_LEN]; /* Current MAC, 0 if unknown. */
	77	uint8_t last_mac[ETH_ADDR_LEN]; /* Last known MAC, 0 if never known */
26d9fe3b	78	char *dev_name;
064af421 BP	79	time_t next_refresh; /* Next time to refresh MAC address. */
	80
	81	/* Keeping track of the local port's MAC address. */
	82	uint8_t local_mac[ETH_ADDR_LEN]; /* Current MAC. */
	83	time_t next_local_refresh; /* Next time to refresh MAC address. */
	84
	85	/* Rules that we set up. */
	86	struct ib_rule rules[N_IB_RULES];
	87	};
	88
	89	static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(60, 60);
	90
	91	static const uint8_t *
	92	get_controller_mac(struct in_band *ib)
	93	{
	94	time_t now = time_now();
26d9fe3b	95	uint32_t controller_ip;
064af421	96
26d9fe3b JP	97	controller_ip = rconn_get_remote_ip(ib->controller);
26d9fe3b JP	98	if (controller_ip != ib->ip \|\| now >= ib->next_refresh) {
064af421 BP	99	bool have_mac;
064af421 BP	100
26d9fe3b	101	ib->ip = controller_ip;
064af421 BP	102
	103	/* Look up MAC address. */
	104	memset(ib->mac, 0, sizeof ib->mac);
	105	if (ib->ip) {
26d9fe3b JP	106	uint32_t local_ip = rconn_get_local_ip(ib->controller);
	107	struct in_addr in4;
	108	int retval;
	109
	110	in4.s_addr = local_ip;
	111	if (netdev_find_dev_by_in4(&in4, &ib->dev_name)) {
	112	retval = netdev_nodev_arp_lookup(ib->dev_name, ib->ip,
	113	ib->mac);
	114	if (retval) {
	115	VLOG_DBG_RL(&rl, "cannot look up controller MAC address "
	116	"("IP_FMT"): %s",
	117	IP_ARGS(&ib->ip), strerror(retval));
	118	}
	119	} else {
	120	VLOG_DBG_RL(&rl, "cannot find device with IP address "IP_FMT,
	121	IP_ARGS(&local_ip));
064af421 BP	122	}
	123	}
	124	have_mac = !eth_addr_is_zero(ib->mac);
	125
	126	/* Log changes in IP, MAC addresses. */
	127	if (ib->ip && ib->ip != ib->last_ip) {
	128	VLOG_DBG("controller IP address changed from "IP_FMT
	129	" to "IP_FMT, IP_ARGS(&ib->last_ip), IP_ARGS(&ib->ip));
	130	ib->last_ip = ib->ip;
	131	}
	132	if (have_mac && memcmp(ib->last_mac, ib->mac, ETH_ADDR_LEN)) {
	133	VLOG_DBG("controller MAC address changed from "ETH_ADDR_FMT" to "
	134	ETH_ADDR_FMT,
	135	ETH_ADDR_ARGS(ib->last_mac), ETH_ADDR_ARGS(ib->mac));
	136	memcpy(ib->last_mac, ib->mac, ETH_ADDR_LEN);
	137	}
	138
	139	/* Schedule next refresh.
	140	*
	141	* If we have an IP address but not a MAC address, then refresh
	142	* quickly, since we probably will get a MAC address soon (via ARP).
	143	* Otherwise, we can afford to wait a little while. */
	144	ib->next_refresh = now + (!ib->ip \|\| have_mac ? 10 : 1);
	145	}
	146	return !eth_addr_is_zero(ib->mac) ? ib->mac : NULL;
	147	}
	148
	149	static const uint8_t *
	150	get_local_mac(struct in_band *ib)
	151	{
	152	time_t now = time_now();
	153	if (now >= ib->next_local_refresh) {
	154	uint8_t ea[ETH_ADDR_LEN];
26d9fe3b	155	if (ib->dev_name && (!netdev_nodev_get_etheraddr(ib->dev_name, ea))) {
064af421 BP	156	memcpy(ib->local_mac, ea, ETH_ADDR_LEN);
	157	}
	158	ib->next_local_refresh = now + 1;
	159	}
	160	return !eth_addr_is_zero(ib->local_mac) ? ib->local_mac : NULL;
	161	}
	162
	163	static void
	164	in_band_status_cb(struct status_reply sr, void in_band_)
	165	{
	166	struct in_band *in_band = in_band_;
064af421	167
4701460a	168	if (!eth_addr_is_zero(in_band->local_mac)) {
064af421	169	status_reply_put(sr, "local-mac="ETH_ADDR_FMT,
4701460a	170	ETH_ADDR_ARGS(in_band->local_mac));
064af421 BP	171	}
064af421 BP	172
4701460a	173	if (!eth_addr_is_zero(in_band->mac)) {
064af421	174	status_reply_put(sr, "controller-mac="ETH_ADDR_FMT,
4701460a	175	ETH_ADDR_ARGS(in_band->mac));
064af421 BP	176	}
	177	}
	178
	179	static void
	180	drop_flow(struct in_band *in_band, int rule_idx)
	181	{
	182	struct ib_rule *rule = &in_band->rules[rule_idx];
	183
	184	if (rule->installed) {
	185	rule->installed = false;
	186	ofproto_delete_flow(in_band->ofproto, &rule->flow, rule->wildcards,
	187	rule->priority);
	188	}
	189	}
	190
	191	/* out_port and fixed_fields are assumed never to change. */
	192	static void
	193	setup_flow(struct in_band in_band, int rule_idx, const flow_t flow,
	194	uint32_t fixed_fields, uint16_t out_port)
	195	{
	196	struct ib_rule *rule = &in_band->rules[rule_idx];
	197
	198	if (!rule->installed \|\| memcmp(flow, &rule->flow, sizeof *flow)) {
	199	union ofp_action action;
	200
	201	drop_flow(in_band, rule_idx);
	202
	203	rule->installed = true;
	204	rule->flow = *flow;
	205	rule->wildcards = OFPFW_ALL & ~fixed_fields;
	206	rule->priority = IB_BASE_PRIORITY + (N_IB_RULES - rule_idx);
	207
	208	action.type = htons(OFPAT_OUTPUT);
	209	action.output.len = htons(sizeof action);
	210	action.output.port = htons(out_port);
	211	action.output.max_len = htons(0);
	212	ofproto_add_flow(in_band->ofproto, &rule->flow, rule->wildcards,
	213	rule->priority, &action, 1, 0);
	214	}
	215	}
	216
	217	void
	218	in_band_run(struct in_band *in_band)
	219	{
	220	const uint8_t *controller_mac;
	221	const uint8_t *local_mac;
	222	flow_t flow;
	223
	224	if (time_now() < MIN(in_band->next_refresh, in_band->next_local_refresh)) {
	225	return;
	226	}
a5f37a2d JP	227
	228	/* NOTE: A router may sit between the switch and controller, so
	229	* we could not tie this to the controller's MAC address. If the
	230	* switch and controller are on different subnets, we should be
	231	* using the router's MAC address in the 'controller_mac'. */
064af421 BP	232	controller_mac = get_controller_mac(in_band);
	233	local_mac = get_local_mac(in_band);
	234
26d9fe3b	235	/* Switch traffic sent by the local port. */
064af421 BP	236	memset(&flow, 0, sizeof flow);
	237	flow.in_port = ODPP_LOCAL;
	238	setup_flow(in_band, IBR_FROM_LOCAL_PORT, &flow, OFPFW_IN_PORT,
	239	OFPP_NORMAL);
	240
064af421	241	if (local_mac) {
a5f37a2d JP	242	/* Deliver traffic sent over the secure channel to the connection's
a5f37a2d JP	243	* interface. */
064af421	244	memset(&flow, 0, sizeof flow);
a5f37a2d	245	flow.dl_type = htons(ETH_TYPE_IP);
064af421	246	memcpy(flow.dl_dst, local_mac, ETH_ADDR_LEN);
a5f37a2d JP	247	flow.nw_proto = IP_TYPE_TCP;
	248	flow.tp_src = htons(OFP_TCP_PORT);
	249	setup_flow(in_band, IBR_OFP_TO_LOCAL, &flow,
	250	(OFPFW_DL_TYPE \| OFPFW_DL_DST \| OFPFW_NW_PROTO
	251	\| OFPFW_TP_SRC), OFPP_NORMAL);
26d9fe3b JP	252
	253	/* Allow the connection's interface to be the source of ARP traffic. */
	254	memset(&flow, 0, sizeof flow);
	255	flow.dl_type = htons(ETH_TYPE_ARP);
	256	memcpy(flow.dl_src, local_mac, ETH_ADDR_LEN);
	257	setup_flow(in_band, IBR_ARP_FROM_LOCAL, &flow,
	258	OFPFW_DL_TYPE \| OFPFW_DL_SRC, OFPP_NORMAL);
a5f37a2d JP	259
	260	/* Allow the connection's interface to receive directed ARP traffic. */
	261	memset(&flow, 0, sizeof flow);
	262	flow.dl_type = htons(ETH_TYPE_ARP);
	263	memcpy(flow.dl_dst, local_mac, ETH_ADDR_LEN);
	264	setup_flow(in_band, IBR_ARP_TO_LOCAL, &flow,
	265	OFPFW_DL_TYPE \| OFPFW_DL_DST, OFPP_NORMAL);
064af421	266	} else {
26d9fe3b JP	267	drop_flow(in_band, IBR_OFP_TO_LOCAL);
26d9fe3b JP	268	drop_flow(in_band, IBR_ARP_FROM_LOCAL);
a5f37a2d	269	drop_flow(in_band, IBR_ARP_TO_LOCAL);
064af421 BP	270	}
	271
	272	if (controller_mac) {
	273	/* Switch ARP requests sent by the controller. (OFPP_NORMAL will "do
	274	* the right thing" regarding VLANs here.) */
	275	memset(&flow, 0, sizeof flow);
	276	flow.dl_type = htons(ETH_TYPE_ARP);
	277	memcpy(flow.dl_dst, eth_addr_broadcast, ETH_ADDR_LEN);
	278	memcpy(flow.dl_src, controller_mac, ETH_ADDR_LEN);
	279	setup_flow(in_band, IBR_ARP_FROM_CTL, &flow,
	280	OFPFW_DL_TYPE \| OFPFW_DL_DST \| OFPFW_DL_SRC,
	281	OFPP_NORMAL);
	282
	283	/* OpenFlow traffic to or from the controller.
	284	*
	285	* (A given field's value is completely ignored if it is wildcarded,
	286	* which is why we can get away with using a single 'flow' in each
	287	* case here.) */
	288	memset(&flow, 0, sizeof flow);
	289	flow.dl_type = htons(ETH_TYPE_IP);
	290	memcpy(flow.dl_src, controller_mac, ETH_ADDR_LEN);
	291	memcpy(flow.dl_dst, controller_mac, ETH_ADDR_LEN);
	292	flow.nw_proto = IP_TYPE_TCP;
	293	flow.tp_src = htons(OFP_TCP_PORT);
	294	flow.tp_dst = htons(OFP_TCP_PORT);
	295	setup_flow(in_band, IBR_TO_CTL_OFP_SRC, &flow,
	296	(OFPFW_DL_TYPE \| OFPFW_DL_DST \| OFPFW_NW_PROTO
	297	\| OFPFW_TP_SRC), OFPP_NORMAL);
	298	setup_flow(in_band, IBR_TO_CTL_OFP_DST, &flow,
	299	(OFPFW_DL_TYPE \| OFPFW_DL_DST \| OFPFW_NW_PROTO
	300	\| OFPFW_TP_DST), OFPP_NORMAL);
	301	setup_flow(in_band, IBR_FROM_CTL_OFP_SRC, &flow,
	302	(OFPFW_DL_TYPE \| OFPFW_DL_SRC \| OFPFW_NW_PROTO
	303	\| OFPFW_TP_SRC), OFPP_NORMAL);
	304	setup_flow(in_band, IBR_FROM_CTL_OFP_DST, &flow,
	305	(OFPFW_DL_TYPE \| OFPFW_DL_SRC \| OFPFW_NW_PROTO
	306	\| OFPFW_TP_DST), OFPP_NORMAL);
	307	} else {
	308	drop_flow(in_band, IBR_ARP_FROM_CTL);
	309	drop_flow(in_band, IBR_TO_CTL_OFP_DST);
	310	drop_flow(in_band, IBR_TO_CTL_OFP_SRC);
	311	drop_flow(in_band, IBR_FROM_CTL_OFP_DST);
	312	drop_flow(in_band, IBR_FROM_CTL_OFP_SRC);
	313	}
	314	}
	315
	316	void
	317	in_band_wait(struct in_band *in_band)
	318	{
	319	time_t now = time_now();
	320	time_t wakeup = MIN(in_band->next_refresh, in_band->next_local_refresh);
	321	if (wakeup > now) {
	322	poll_timer_wait((wakeup - now) * 1000);
	323	} else {
	324	poll_immediate_wake();
	325	}
	326	}
	327
	328	void
	329	in_band_flushed(struct in_band *in_band)
	330	{
	331	int i;
	332
	333	for (i = 0; i < N_IB_RULES; i++) {
334	in_band->rules[i].installed = false;
335	}
336	}
337
26d9fe3b JP	338	void
26d9fe3b JP	339	in_band_create(struct ofproto ofproto, struct switch_status ss,
064af421 BP	340	struct rconn controller, struct in_band *in_bandp)
	341	{
	342	struct in_band *in_band;
064af421 BP	343
	344	in_band = xcalloc(1, sizeof *in_band);
	345	in_band->ofproto = ofproto;
064af421 BP	346	in_band->controller = controller;
	347	in_band->ss_cat = switch_status_register(ss, "in-band",
	348	in_band_status_cb, in_band);
	349	in_band->next_refresh = TIME_MIN;
	350	in_band->next_local_refresh = TIME_MIN;
26d9fe3b	351	in_band->dev_name = NULL;
064af421 BP	352
064af421 BP	353	*in_bandp = in_band;
064af421 BP	354	}
	355
	356	void
	357	in_band_destroy(struct in_band *in_band)
	358	{
	359	if (in_band) {
064af421 BP	360	switch_status_unregister(in_band->ss_cat);
	361	/* We don't own the rconn. */
	362	}
	363	}
	364