if (allowBroadcast == true) {
if (logger.isTraceEnabled())
logger.trace("Allowing broadcast traffic for PacketIn={}",
pi);
decision = new RoutingDecision(sw.getId(), pi.getInPort()
, IDeviceService.fcStore.
get(cntx, IDeviceService.CONTEXT_SRC_DEVICE),
IRoutingDecision.RoutingAction.MULTICAST);
decision.addToContext(cntx);
} else {
if (logger.isTraceEnabled())
logger.trace(
"Blocking malformed broadcast traffic for PacketIn={}",
pi);
decision = new RoutingDecision(sw.getId(), pi.getInPort()
, IDeviceService.fcStore.
get(cntx, IDeviceService.CONTEXT_SRC_DEVICE),
IRoutingDecision.RoutingAction.DROP);
decision.addToContext(cntx);
}
return Command.CONTINUE;
}
/*
* ARP response (unicast) can be let through without filtering through
* rules by uncommenting the code below
*/
/*
* else if (eth.getEtherType() == Ethernet.TYPE_ARP) {
* logger.info("allowing ARP traffic"); decision = new
* FirewallDecision(IRoutingDecision.RoutingAction.FORWARD_OR_FLOOD);
* decision.addToContext(cntx); return Command.CONTINUE; }
*/
// check if we have a matching rule for this packet/flow
// and no decision is taken yet
if (decision == null) {
RuleWildcardsPair match_ret = this.matchWithRule(sw, pi, cntx);
FirewallRule rule = match_ret.rule;
if (rule == null || rule.action == FirewallRule.FirewallAction.DENY) {
decision = new RoutingDecision(sw.getId(), pi.getInPort()
, IDeviceService.fcStore.
get(cntx, IDeviceService.CONTEXT_SRC_DEVICE),
IRoutingDecision.RoutingAction.DROP);
decision.setWildcards(match_ret.wildcards);
decision.addToContext(cntx);
if (logger.isTraceEnabled()) {
if (rule == null)
logger.trace(
"No firewall rule found for PacketIn={}, blocking flow",
pi);
else if (rule.action == FirewallRule.FirewallAction.DENY) {
logger.trace("Deny rule={} match for PacketIn={}",
rule, pi);
}
}
} else {
decision = new RoutingDecision(sw.getId(), pi.getInPort()
, IDeviceService.fcStore.
get(cntx, IDeviceService.CONTEXT_SRC_DEVICE),
IRoutingDecision.RoutingAction.FORWARD_OR_FLOOD);
decision.setWildcards(match_ret.wildcards);
decision.addToContext(cntx);