HONEYCOMB-246: allow mixing deny/permit rules

- adds classify table on the end of each of the 3 chains to enforce ordering
- updates v3po.yang with default-action leaf
- updates postman collection

Change-Id: If54abec1a6516eaf87aae0e5da9382a6e5dee1f3
Signed-off-by: Marek Gradzki <mgradzki@cisco.com>

8 files changed, 60 insertions, 52 deletions

diff --git a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AbstractAceWriter.java b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AbstractAceWriter.java
index 70cfee894..2e2d1648e 100644
--- a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AbstractAceWriter.java
+++ b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AbstractAceWriter.java
@@ -20,7 +20,6 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
 
 import com.google.common.annotations.VisibleForTesting;
-import io.fd.honeycomb.translate.util.RWUtils;
 import io.fd.honeycomb.translate.vpp.util.JvppReplyConsumer;
 import io.fd.honeycomb.translate.write.WriteFailedException;
 import io.fd.vpp.jvpp.core.dto.ClassifyAddDelSession;
@@ -30,8 +29,8 @@ import io.fd.vpp.jvpp.core.dto.ClassifyAddDelTableReply;
 import io.fd.vpp.jvpp.core.dto.InputAclSetInterface;
 import io.fd.vpp.jvpp.core.future.FutureJVppCore;
 import java.util.List;
+import java.util.ListIterator;
 import java.util.concurrent.CompletionStage;
-import java.util.stream.Collector;
 import javax.annotation.Nonnegative;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -40,6 +39,7 @@ import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.cont
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160708.access.lists.acl.access.list.entries.ace.actions.packet.handling.Permit;
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160708.access.lists.acl.access.list.entries.ace.matches.AceType;
 import org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.v3po.rev161214.InterfaceMode;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.v3po.rev161214.ietf.acl.base.attributes.AccessLists;
 import org.opendaylight.yangtools.yang.binding.InstanceIdentifier;
 
 /**
@@ -59,8 +59,8 @@ abstract class AbstractAceWriter<T extends AceType> implements AceWriter, JvppRe
     @VisibleForTesting
     static final int VLAN_TAG_LEN = 4;
 
-    private static final Collector<PacketHandling, ?, PacketHandling> SINGLE_ITEM_COLLECTOR =
-        RWUtils.singleItemCollector();
+    private static final int PERMIT = -1;
+    private static final int DENY = 0;
 
     private final FutureJVppCore futureJVppCore;
 
@@ -71,15 +71,13 @@ abstract class AbstractAceWriter<T extends AceType> implements AceWriter, JvppRe
     /**
      * Creates classify table for given ACE.
      *
-     * @param action         packet handling action (permit/deny)
      * @param ace            ACE to be translated
      * @param mode           interface mode
      * @param nextTableIndex classify table index
      * @param vlanTags       number of vlan tags
      * @return classify table that represents given ACE
      */
-    protected abstract ClassifyAddDelTable createClassifyTable(@Nonnull final PacketHandling action,
-                                                               @Nonnull final T ace,
+    protected abstract ClassifyAddDelTable createClassifyTable(@Nonnull final T ace,
                                                                @Nullable final InterfaceMode mode,
                                                                final int nextTableIndex,
                                                                final int vlanTags);
@@ -110,26 +108,41 @@ abstract class AbstractAceWriter<T extends AceType> implements AceWriter, JvppRe
 
     @Override
     public final void write(@Nonnull final InstanceIdentifier<?> id, @Nonnull final List<Ace> aces,
-                            final InterfaceMode mode, @Nonnull final InputAclSetInterface request,
+                            final InterfaceMode mode, final AccessLists.DefaultAction defaultAction,
+                            @Nonnull final InputAclSetInterface request,
                             @Nonnegative final int vlanTags)
         throws WriteFailedException {
-        final PacketHandling action = aces.stream().map(ace -> ace.getActions().getPacketHandling()).distinct()
-            .collect(SINGLE_ITEM_COLLECTOR);
 
         checkArgument(vlanTags >= 0 && vlanTags <= 2, "Number of vlan tags %s is not in [0,2] range");
-        int nextTableIndex = -1;
-        for (final Ace ace : aces) {
-            // Create table + session per entry
+        int nextTableIndex = configureDefaltAction(id, defaultAction);
 
-            final ClassifyAddDelTable ctRequest =
-                createClassifyTable(action, (T) ace.getMatches().getAceType(), mode, nextTableIndex, vlanTags);
+        final ListIterator<Ace> iterator = aces.listIterator(aces.size());
+        while (iterator.hasPrevious()) {
+            // Create table + session per entry
+            final Ace ace = iterator.previous();
+            final PacketHandling action = ace.getActions().getPacketHandling();
+            final T type = (T)ace.getMatches().getAceType();
+            final ClassifyAddDelTable ctRequest = createClassifyTable(type, mode, nextTableIndex, vlanTags);
             nextTableIndex = createClassifyTable(id, ctRequest);
-            createClassifySession(id,
-                createClassifySession(action, (T) ace.getMatches().getAceType(), mode, nextTableIndex, vlanTags));
+            createClassifySession(id, createClassifySession(action, type, mode, nextTableIndex, vlanTags));
         }
         setClassifyTable(request, nextTableIndex);
     }
 
+    private int configureDefaltAction(@Nonnull final InstanceIdentifier<?> id, final AccessLists.DefaultAction defaultAction)
+        throws WriteFailedException {
+        ClassifyAddDelTable ctRequest = createClassifyTable(-1);
+        if (AccessLists.DefaultAction.Permit.equals(defaultAction)) {
+            ctRequest.missNextIndex = PERMIT;
+        } else {
+            ctRequest.missNextIndex = DENY;
+        }
+        ctRequest.mask = new byte[16];
+        ctRequest.skipNVectors = 0;
+        ctRequest.matchNVectors = 1;
+        return createClassifyTable(id, ctRequest);
+    }
+
     private int createClassifyTable(@Nonnull final InstanceIdentifier<?> id,
                                     @Nonnull final ClassifyAddDelTable request)
         throws WriteFailedException {
@@ -147,22 +160,14 @@ abstract class AbstractAceWriter<T extends AceType> implements AceWriter, JvppRe
         getReplyForWrite(cs.toCompletableFuture(), id);
     }
 
-    protected ClassifyAddDelTable createClassifyTable(@Nonnull final PacketHandling action, final int nextTableIndex) {
+    protected ClassifyAddDelTable createClassifyTable(final int nextTableIndex) {
         final ClassifyAddDelTable request = new ClassifyAddDelTable();
         request.isAdd = 1;
         request.tableIndex = -1; // value not present
-
         request.nbuckets = 1; // we expect exactly one session per table
-
-        if (action instanceof Permit) {
-            request.missNextIndex = 0; // for list of permit rules, deny (0) should be default action
-        } else { // deny is default value
-            request.missNextIndex = -1; // for list of deny rules, permit (-1) should be default action
-        }
-
         request.nextTableIndex = nextTableIndex;
         request.memorySize = TABLE_MEM_SIZE;
-
+        request.missNextIndex = -1; // value not set, but anyway it is ignored for tables in chain
         return request;
     }
 
diff --git a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceEthWriter.java b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceEthWriter.java
index 89a92f5c0..667d9cc38 100644
--- a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceEthWriter.java
+++ b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceEthWriter.java
@@ -48,14 +48,13 @@ final class AceEthWriter extends AbstractAceWriter<AceEth> implements MacTransla
     }
 
     @Override
-    public ClassifyAddDelTable createClassifyTable(@Nonnull final PacketHandling action,
-                                                   @Nonnull final AceEth aceEth,
+    public ClassifyAddDelTable createClassifyTable(@Nonnull final AceEth aceEth,
                                                    @Nullable final InterfaceMode mode,
                                                    final int nextTableIndex,
                                                    final int vlanTags) {
         checkInterfaceMode(mode);
 
-        final ClassifyAddDelTable request = createClassifyTable(action, nextTableIndex);
+        final ClassifyAddDelTable request = createClassifyTable(nextTableIndex);
 
         request.mask = new byte[16];
         boolean aceIsEmpty = true;
@@ -102,7 +101,7 @@ final class AceEthWriter extends AbstractAceWriter<AceEth> implements MacTransla
         request.skipNVectors = 0;
         request.matchNVectors = MATCH_N_VECTORS;
 
-        LOG.debug("ACE action={}, rule={} translated to table={}.", action, aceEth, request);
+        LOG.debug("ACE rule={} translated to table={}.", aceEth, request);
         return request;
     }
 
diff --git a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceIp4Writer.java b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceIp4Writer.java
index e539d4e14..e1d05f6ec 100644
--- a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceIp4Writer.java
+++ b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceIp4Writer.java
@@ -78,15 +78,14 @@ final class AceIp4Writer extends AbstractAceWriter<AceIp> implements Ipv4Transla
     }
 
     @Override
-    public ClassifyAddDelTable createClassifyTable(@Nonnull final PacketHandling action,
-                                                   @Nonnull final AceIp aceIp,
+    public ClassifyAddDelTable createClassifyTable(@Nonnull final AceIp aceIp,
                                                    @Nullable final InterfaceMode mode,
                                                    final int nextTableIndex,
                                                    final int vlanTags) {
         checkArgument(aceIp.getAceIpVersion() instanceof AceIpv4, "Expected AceIpv4 version, but was %", aceIp);
         final AceIpv4 ipVersion = (AceIpv4) aceIp.getAceIpVersion();
 
-        final ClassifyAddDelTable request = createClassifyTable(action, nextTableIndex);
+        final ClassifyAddDelTable request = createClassifyTable(nextTableIndex);
         request.skipNVectors = 0; // match entire L2 and L3 header
         request.matchNVectors = MATCH_N_VECTORS;
 
@@ -137,7 +136,7 @@ final class AceIp4Writer extends AbstractAceWriter<AceIp> implements Ipv4Transla
                     String.format("Ace %s does not define packet field match values", aceIp.toString()));
         }
 
-        LOG.debug("ACE action={}, rule={} translated to table={}.", action, aceIp, request);
+        LOG.debug("ACE rule={} translated to table={}.", aceIp, request);
         return request;
     }
 
diff --git a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceIp6Writer.java b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceIp6Writer.java
index 2afc75c28..18fa1ec4d 100644
--- a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceIp6Writer.java
+++ b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceIp6Writer.java
@@ -92,15 +92,14 @@ final class AceIp6Writer extends AbstractAceWriter<AceIp> {
     }
 
     @Override
-    public ClassifyAddDelTable createClassifyTable(@Nonnull final PacketHandling action,
-                                                   @Nonnull final AceIp aceIp,
+    public ClassifyAddDelTable createClassifyTable(@Nonnull final AceIp aceIp,
                                                    @Nullable final InterfaceMode mode,
                                                    final int nextTableIndex,
                                                    final int vlanTags) {
         checkArgument(aceIp.getAceIpVersion() instanceof AceIpv6, "Expected AceIpv6 version, but was %", aceIp);
         final AceIpv6 ipVersion = (AceIpv6) aceIp.getAceIpVersion();
 
-        final ClassifyAddDelTable request = createClassifyTable(action, nextTableIndex);
+        final ClassifyAddDelTable request = createClassifyTable(nextTableIndex);
         request.skipNVectors = 0; // match entire L2 and L3 header
         request.matchNVectors = MATCH_N_VECTORS;
 
@@ -160,7 +159,7 @@ final class AceIp6Writer extends AbstractAceWriter<AceIp> {
                 String.format("Ace %s does not define packet field match values", aceIp.toString()));
         }
 
-        LOG.debug("ACE action={}, rule={} translated to table={}.", action, aceIp, request);
+        LOG.debug("ACE rule={} translated to table={}.", aceIp, request);
         return request;
     }
 
diff --git a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceWriter.java b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceWriter.java
index 63bd6a897..c2c024870 100644
--- a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceWriter.java
+++ b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/AceWriter.java
@@ -17,13 +17,14 @@
 package io.fd.honeycomb.translate.v3po.interfaces.acl.ingress;
 
 import io.fd.honeycomb.translate.write.WriteFailedException;
+import io.fd.vpp.jvpp.core.dto.InputAclSetInterface;
 import java.util.List;
 import javax.annotation.Nonnegative;
 import javax.annotation.Nonnull;
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160708.access.lists.acl.access.list.entries.Ace;
 import org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.v3po.rev161214.InterfaceMode;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.v3po.rev161214.ietf.acl.base.attributes.AccessLists;
 import org.opendaylight.yangtools.yang.binding.InstanceIdentifier;
-import io.fd.vpp.jvpp.core.dto.InputAclSetInterface;
 
 /**
  * Writer responsible for translation of ietf-acl model ACEs to VPP's classify tables and sessions.
@@ -34,12 +35,15 @@ interface AceWriter {
      * Translates list of ACEs to chain of classify tables. Each ACE is translated into one classify table with single
      * classify session. Also initializes input_acl_set_interface request message DTO with first classify table of the
      * chain that was created.
-     *  @param id      uniquely identifies ietf-acl container
-     * @param aces    list of access control entries
-     * @param mode
-     * @param request input_acl_set_interface request DTO
+     *
+     * @param id            uniquely identifies ietf-acl container
+     * @param aces          list of access control entries
+     * @param mode          interface mode (L2/L3)
+     * @param defaultAction to be taken when packet that does not match any of rules defined in
+     * @param request       input_acl_set_interface request DTO
      */
     void write(@Nonnull final InstanceIdentifier<?> id, @Nonnull final List<Ace> aces,
-               final InterfaceMode mode, @Nonnull final InputAclSetInterface request, @Nonnegative final int vlanTags)
+               final InterfaceMode mode, final AccessLists.DefaultAction defaultAction,
+               @Nonnull final InputAclSetInterface request, @Nonnegative final int vlanTags)
         throws WriteFailedException;
 }
diff --git a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/IetfAClWriter.java b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/IetfAClWriter.java
index 7105009dc..526fdd71f 100644
--- a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/IetfAClWriter.java
+++ b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/IetfAClWriter.java
@@ -50,6 +50,7 @@ import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.cont
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160708.access.lists.acl.access.list.entries.ace.matches.ace.type.ace.ip.AceIpVersion;
 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.access.control.list.rev160708.access.lists.acl.access.list.entries.ace.matches.ace.type.ace.ip.ace.ip.version.AceIpv4;
 import org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.v3po.rev161214.InterfaceMode;
+import org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.v3po.rev161214.ietf.acl.base.attributes.AccessLists;
 import org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.v3po.rev161214.ietf.acl.base.attributes.access.lists.Acl;
 import org.opendaylight.yangtools.yang.binding.InstanceIdentifier;
 import org.slf4j.Logger;
@@ -134,13 +135,13 @@ public final class IetfAClWriter implements JvppReplyConsumer {
     }
 
     void write(@Nonnull final InstanceIdentifier<?> id, final int swIfIndex, @Nonnull final List<Acl> acls,
-               @Nullable final InterfaceMode mode, @Nonnull final WriteContext writeContext)
+               final AccessLists.DefaultAction defaultAction, @Nullable final InterfaceMode mode, @Nonnull final WriteContext writeContext)
             throws WriteFailedException {
-        write(id, swIfIndex, mode, acls, writeContext, 0);
+        write(id, swIfIndex, mode, acls, defaultAction, writeContext, 0);
     }
 
     void write(@Nonnull final InstanceIdentifier<?> id, final int swIfIndex, final InterfaceMode mode,
-               @Nonnull final List<Acl> acls,
+               @Nonnull final List<Acl> acls, final AccessLists.DefaultAction defaultAction,
                @Nonnull final WriteContext writeContext, @Nonnegative final int numberOfTags)
             throws WriteFailedException {
 
@@ -166,7 +167,7 @@ public final class IetfAClWriter implements JvppReplyConsumer {
             if (aceWriter == null) {
                 LOG.warn("AceProcessor for {} not registered. Skipping ACE.", aceType);
             } else {
-                aceWriter.write(id, aces, mode, request, numberOfTags);
+                aceWriter.write(id, aces, mode, defaultAction, request, numberOfTags);
             }
         }
 
diff --git a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/IetfAclCustomizer.java b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/IetfAclCustomizer.java
index a98ee30a2..3a55e0068 100644
--- a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/IetfAclCustomizer.java
+++ b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/IetfAclCustomizer.java
@@ -61,7 +61,8 @@ public class IetfAclCustomizer implements WriterCustomizer<Ingress> {
         checkArgument(accessLists != null && accessLists.getAcl() != null,
                 "ietf-acl container does not define acl list");
 
-        aclWriter.write(id, ifIndex, accessLists.getAcl(), accessLists.getMode(), writeContext);
+        aclWriter.write(id, ifIndex, accessLists.getAcl(), accessLists.getDefaultAction(), accessLists.getMode(),
+            writeContext);
     }
 
     @Override
diff --git a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/SubInterfaceIetfAclCustomizer.java b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/SubInterfaceIetfAclCustomizer.java
index d5f1eb27d..79ee72825 100644
--- a/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/SubInterfaceIetfAclCustomizer.java
+++ b/v3po/v3po2vpp/src/main/java/io/fd/honeycomb/translate/v3po/interfaces/acl/ingress/SubInterfaceIetfAclCustomizer.java
@@ -80,8 +80,8 @@ public class SubInterfaceIetfAclCustomizer implements WriterCustomizer<Ingress>
         checkState(subInterfaceOptional.isPresent(), "Could not read SubInterface data object for %s", id);
         final SubInterface subInterface = subInterfaceOptional.get();
 
-        aclWriter.write(id, subInterfaceIndex, accessLists.getMode(), accessLists.getAcl(), writeContext,
-                getNumberOfTags(subInterface.getTags()));
+        aclWriter.write(id, subInterfaceIndex, accessLists.getMode(), accessLists.getAcl(),
+            accessLists.getDefaultAction(), writeContext, getNumberOfTags(subInterface.getTags()));
     }
 
     @Override