From 9c10d20b1d55687cec007128831d60b9c3ab929d Mon Sep 17 00:00:00 2001
From: Naveen N <naveenn@juniper.net>
Date: Mon, 28 Dec 2015 08:56:55 +0530
Subject: [PATCH] Add fat flow support * Maintain a list of protocol and port
 specified as fat flow   Ignore flow matching protocol + port combination.
 Fixes-Bug: #1518234,#1522285

Change-Id: I6e98b68467f36f1a91227a811f7860c71aaff411
---
 src/schema/vnc_cfg.xsd                        | 23 ++++++
 src/vnsw/agent/cmn/agent.cc                   | 21 ++++++
 src/vnsw/agent/cmn/agent.h                    |  2 +
 src/vnsw/agent/oper/test/test_intf.cc         | 75 +++++++++++++++++++
 src/vnsw/agent/oper/vm_interface.cc           | 66 +++++++++++++++-
 src/vnsw/agent/oper/vm_interface.h            | 46 ++++++++++++
 src/vnsw/agent/pkt/pkt_flow_info.cc           | 47 ++++++++++++
 src/vnsw/agent/pkt/pkt_flow_info.h            |  2 +-
 src/vnsw/agent/pkt/test/egress-flow.xml       | 40 ++++++++++
 src/vnsw/agent/pkt/test/ingress-flow.xml      | 34 ++++++++-
 src/vnsw/agent/test-xml/test_xml_oper.cc      | 21 ++++++
 src/vnsw/agent/test-xml/test_xml_oper.h       |  3 +
 .../agent/vrouter/ksync/agent_ksync.sandesh   |  6 ++
 .../agent/vrouter/ksync/interface_ksync.cc    | 17 +++++
 .../agent/vrouter/ksync/interface_ksync.h     |  1 +
 15 files changed, 399 insertions(+), 5 deletions(-)

diff --git a/src/schema/vnc_cfg.xsd b/src/schema/vnc_cfg.xsd
index f249f354a46..d7f324b243c 100644
--- a/src/schema/vnc_cfg.xsd
+++ b/src/schema/vnc_cfg.xsd
@@ -1062,6 +1062,29 @@ targetNamespace="http://www.contrailsystems.com/2012/VNC-CONFIG/0">
      ListProperty('virtual-machine-interface-bindings',
                   'virtual-machine-interface') -->
 
+<xsd:complexType name="ProtocolType">
+    <xsd:all>
+        <xsd:element name="protocol" type="xsd:string"/>
+        <xsd:element name="port" type="xsd:integer"/>
+    </xsd:all>
+</xsd:complexType>
+
+<xsd:complexType name="FatFlowProtocols">
+    <xsd:all>
+        <xsd:element name="fat-flow-protocol" type="ProtocolType" maxOccurs="unbounded"/>
+    </xsd:all>
+</xsd:complexType>
+
+<!--
+    The protocols for which flows on the virtual-machine-interface fall
+    into a single protocol flow
+-->
+<xsd:element name="virtual-machine-interface-fat-flow-protocols"
+             type="FatFlowProtocols"/>
+<!--#IFMAP-SEMANTICS-IDL
+     Property('virtual-machine-interface-fat-flow-protocols',
+             'virtual-machine-interface') -->
+
 <xsd:element name="virtual-machine-interface-sub-interface"/>
 <!--#IFMAP-SEMANTICS-IDL
      Link('virtual-machine-interface-sub-interface',
diff --git a/src/vnsw/agent/cmn/agent.cc b/src/vnsw/agent/cmn/agent.cc
index 1cffdf941e5..c03edb1904e 100644
--- a/src/vnsw/agent/cmn/agent.cc
+++ b/src/vnsw/agent/cmn/agent.cc
@@ -657,6 +657,27 @@ void Agent::SetAgentMcastLabelRange(uint8_t idx) {
     label_range_[idx] = str.str();
 }
 
+uint16_t
+Agent::ProtocolStringToInt(const std::string &proto) {
+    if (proto == "tcp" || proto == "TCP") {
+        return IPPROTO_TCP;
+    }
+
+    if (proto == "udp" || proto == "UDP") {
+        return IPPROTO_UDP;
+    }
+
+    if (proto == "sctp" || proto == "SCTP") {
+        return IPPROTO_SCTP;
+    }
+
+    if (proto =="icmp" || proto == "ICMP") {
+        return IPPROTO_ICMP;
+    }
+
+    return atoi(proto.c_str());
+}
+
 Agent::ForwardingMode Agent::TranslateForwardingMode
 (const std::string &mode) const {
     if (mode == "l2")
diff --git a/src/vnsw/agent/cmn/agent.h b/src/vnsw/agent/cmn/agent.h
index c06f1901eb1..3db20373ed1 100644
--- a/src/vnsw/agent/cmn/agent.h
+++ b/src/vnsw/agent/cmn/agent.h
@@ -7,6 +7,7 @@
 
 #include <vector>
 #include <stdint.h>
+#include <string>
 #include <net/ethernet.h>
 #include <boost/intrusive_ptr.hpp>
 #include <base/intrusive_ptr_back_ref.h>
@@ -934,6 +935,7 @@ class Agent {
     }
     Agent::ForwardingMode TranslateForwardingMode(const std::string &mode) const;
 
+    static uint16_t ProtocolStringToInt(const std::string &str);
 private:
 
     AgentParam *params_;
diff --git a/src/vnsw/agent/oper/test/test_intf.cc b/src/vnsw/agent/oper/test/test_intf.cc
index 6bbfa564a04..7fecca2e107 100644
--- a/src/vnsw/agent/oper/test/test_intf.cc
+++ b/src/vnsw/agent/oper/test/test_intf.cc
@@ -170,6 +170,19 @@ class IntfTest : public ::testing::Test {
         client->WaitForIdle();
     }
 
+    void AddFatFlow(struct PortInfo *input, std::string protocol, int port) {
+
+        ostringstream str;
+
+        str << "<virtual-machine-interface-fat-flow-protocols>"
+               "<fat-flow-protocol>"
+               "<protocol>" << protocol << "</protocol>"
+               "<port>" << port << "</port>"
+               "</fat-flow-protocol>"
+               "</virtual-machine-interface-fat-flow-protocols>";
+        AddNode("virtual-machine-interface", input[0].name, input[0].intf_id,
+                str.str().c_str());
+    }
 
     unsigned int intf_count;
     Agent *agent;
@@ -3451,6 +3464,68 @@ TEST_F(IntfTest, Add_vmi_with_zero_mac_and_update_with_correct_mac) {
     client->Reset();
 }
 
+TEST_F(IntfTest, FatFlow) {
+    struct PortInfo input[] = {
+        {"vnet1", 1, "1.1.1.1", "00:00:00:00:00:01", 1, 1},
+    };
+
+    CreateVmportEnv(input, 1);
+    client->WaitForIdle();
+    EXPECT_TRUE(VmPortFind(1));
+
+    const VmInterface *intf = static_cast<const VmInterface *>(VmPortGet(1));
+    EXPECT_TRUE(intf->fat_flow_list().list_.size() == 0);
+
+    AddFatFlow(input, "udp", 53);
+    client->WaitForIdle();
+    EXPECT_TRUE(intf->fat_flow_list().list_.size() == 1);
+    EXPECT_TRUE(intf->IsFatFlow(IPPROTO_UDP, 53) == true);
+    EXPECT_TRUE(intf->IsFatFlow(IPPROTO_UDP, 0) == false);
+
+    DelNode("virtual-machine-interface", "vnet1");
+    client->WaitForIdle();
+    EXPECT_TRUE(intf->fat_flow_list().list_.size() == 0);
+
+    DeleteVmportEnv(input, 1, true);
+    client->WaitForIdle();
+    EXPECT_FALSE(VmPortFind(1));
+    client->Reset();
+}
+
+TEST_F(IntfTest, FatFlowDel) {
+    struct PortInfo input[] = {
+        {"vnet1", 1, "1.1.1.1", "00:00:00:00:00:01", 1, 1},
+    };
+
+    CreateVmportEnv(input, 1);
+    client->WaitForIdle();
+    EXPECT_TRUE(VmPortFind(1));
+
+    const VmInterface *intf = static_cast<const VmInterface *>(VmPortGet(1));
+    EXPECT_TRUE(intf->fat_flow_list().list_.size() == 0);
+
+    AddFatFlow(input, "udp", 53);
+    client->WaitForIdle();
+    EXPECT_TRUE(intf->fat_flow_list().list_.size() == 1);
+    EXPECT_TRUE(intf->IsFatFlow(IPPROTO_UDP, 53) == true);
+    EXPECT_TRUE(intf->IsFatFlow(IPPROTO_UDP, 0) == false);
+
+    CreateVmportEnv(input, 1);
+    client->WaitForIdle();
+    EXPECT_TRUE(intf->fat_flow_list().list_.size() == 0);
+    EXPECT_TRUE(intf->IsFatFlow(IPPROTO_UDP, 53) == false);
+    EXPECT_TRUE(intf->IsFatFlow(IPPROTO_UDP, 0) == false);
+
+    DelNode("virtual-machine-interface", "vnet1");
+    client->WaitForIdle();
+    EXPECT_TRUE(intf->fat_flow_list().list_.size() == 0);
+
+    DeleteVmportEnv(input, 1, true);
+    client->WaitForIdle();
+    EXPECT_FALSE(VmPortFind(1));
+    client->Reset();
+}
+
 int main(int argc, char **argv) {
     GETUSERARGS();
 
diff --git a/src/vnsw/agent/oper/vm_interface.cc b/src/vnsw/agent/oper/vm_interface.cc
index 6c93e144a0b..6ed9d683148 100644
--- a/src/vnsw/agent/oper/vm_interface.cc
+++ b/src/vnsw/agent/oper/vm_interface.cc
@@ -61,7 +61,7 @@ VmInterface::VmInterface(const boost::uuids::uuid &uuid) :
     tx_vlan_id_(kInvalidVlanId), rx_vlan_id_(kInvalidVlanId), parent_(NULL),
     local_preference_(VmInterface::INVALID), oper_dhcp_options_(),
     sg_list_(), floating_ip_list_(), service_vlan_list_(), static_route_list_(),
-    allowed_address_pair_list_(), vrf_assign_rule_list_(),
+    allowed_address_pair_list_(), fat_flow_list_(), vrf_assign_rule_list_(),
     vrf_assign_acl_(NULL), vm_ip_service_addr_(0), 
     device_type_(VmInterface::DEVICE_TYPE_INVALID),
     vmi_type_(VmInterface::VMI_TYPE_INVALID),
@@ -415,6 +415,18 @@ static void BuildVrfAndServiceVlanInfo(Agent *agent,
     return;
 }
 
+static void BuildFatFlowTable(Agent *agent, VmInterfaceConfigData *data,
+                              IFMapNode *node) {
+    VirtualMachineInterface *cfg = static_cast <VirtualMachineInterface *>
+                                       (node->GetObject());
+    for (FatFlowProtocols::const_iterator it = cfg->fat_flow_protocols().begin();
+            it != cfg->fat_flow_protocols().end(); it++) {
+        uint16_t protocol = Agent::ProtocolStringToInt(it->protocol);
+        data->fat_flow_list_.list_.insert(VmInterface::FatFlowEntry(protocol,
+                                          it->port));
+    }
+}
+
 static void BuildInstanceIp(Agent *agent, VmInterfaceConfigData *data,
                             IFMapNode *node) {
     InstanceIp *ip = static_cast<InstanceIp *>(node->GetObject());
@@ -798,6 +810,14 @@ bool VmInterface::IsConfigurerSet(VmInterface::Configurer type) {
     return ((configurer_ & (1 << type)) != 0);
 }
 
+bool VmInterface::IsFatFlow(uint8_t protocol, uint16_t port) const {
+    if (fat_flow_list_.list_.find(FatFlowEntry(protocol, port)) !=
+                fat_flow_list_.list_.end()) {
+        return true;
+    }
+    return false;
+}
+
 static bool DeleteVmi(InterfaceTable *table, const uuid &u, DBRequest *req) {
     int type = table->GetVmiToVmiType(u);
     if (type <= (int)VmInterface::VMI_TYPE_INVALID)
@@ -923,6 +943,7 @@ bool InterfaceTable::VmiProcessConfig(IFMapNode *node, DBRequest &req,
     }
 
     UpdateAttributes(agent_, data);
+    BuildFatFlowTable(agent_, data, node);
 
     // Get DHCP enable flag from subnet
     if (vn_node && data->addr_.to_ulong()) {
@@ -1332,10 +1353,13 @@ void VmInterface::ApplyConfigCommon(const VrfEntry *old_vrf,
     //DHCP MAC IP binding
     ApplyMacVmBindingConfig(old_vrf, old_l2_active,  old_dhcp_enable);
     //Security Group update
-    if (IsActive())
+    if (IsActive()) {
         UpdateSecurityGroup();
-    else
+        UpdateFatFlow();
+    } else {
         DeleteSecurityGroup();
+        DeleteFatFlow();
+    }
 
 }
 
@@ -1731,6 +1755,16 @@ bool VmInterface::CopyConfig(const InterfaceTable *table,
         ret = true;
      }
 
+    FatFlowEntrySet &old_fat_flow_entry_list = fat_flow_list_.list_;
+    const FatFlowEntrySet &new_fat_flow_entry_list =
+        data->fat_flow_list_.list_;
+    if (AuditList<FatFlowList, FatFlowEntrySet::iterator>
+        (fat_flow_list_, old_fat_flow_entry_list.begin(),
+         old_fat_flow_entry_list.end(), new_fat_flow_entry_list.begin(),
+         new_fat_flow_entry_list.end())) {
+        ret = true;
+    }
+
     InstanceIpSet &old_ipv4_list = instance_ipv4_list_.list_;
     InstanceIpSet new_ipv4_list = data->instance_ipv4_list_.list_;
     //Native ip of instance should be advertised even if
@@ -2881,6 +2915,20 @@ void VmInterface::DeleteSecurityGroup() {
     }
 }
 
+void VmInterface::UpdateFatFlow() {
+    DeleteFatFlow();
+}
+
+void VmInterface::DeleteFatFlow() { 
+    FatFlowEntrySet::iterator it = fat_flow_list_.list_.begin();
+    while (it != fat_flow_list_.list_.end()) {
+        FatFlowEntrySet::iterator prev = it++;
+        if (prev->del_pending_) {
+            fat_flow_list_.list_.erase(prev);
+        }
+    }
+}
+
 void VmInterface::UpdateL2TunnelId(bool force_update, bool policy_change) {
     AllocL2MplsLabel(force_update, policy_change);
 }
@@ -3270,6 +3318,18 @@ void VmInterface::InstanceIpList::Remove(InstanceIpSet::iterator &it) {
     it->set_del_pending(true);
 }
 
+void VmInterface::FatFlowList::Insert(const FatFlowEntry *rhs) {
+    list_.insert(*rhs);
+}
+
+void VmInterface::FatFlowList::Update(const FatFlowEntry *lhs,
+                                      const FatFlowEntry *rhs) {
+}
+
+void VmInterface::FatFlowList::Remove(FatFlowEntrySet::iterator &it) {
+    it->set_del_pending(true);
+}
+
 /////////////////////////////////////////////////////////////////////////////
 // FloatingIp routines
 /////////////////////////////////////////////////////////////////////////////
diff --git a/src/vnsw/agent/oper/vm_interface.h b/src/vnsw/agent/oper/vm_interface.h
index 51682b8afcc..6a8a6256524 100644
--- a/src/vnsw/agent/oper/vm_interface.h
+++ b/src/vnsw/agent/oper/vm_interface.h
@@ -359,6 +359,43 @@ class VmInterface : public Interface {
         InstanceIpSet list_;
     };
 
+    struct FatFlowEntry : ListEntry {
+        FatFlowEntry(): protocol(0), port(0) {}
+        FatFlowEntry(const FatFlowEntry &rhs):
+            protocol(rhs.protocol), port(rhs.port) {}
+        FatFlowEntry(const uint8_t proto, const uint16_t p):
+            protocol(proto), port(p) {}
+        virtual ~FatFlowEntry(){}
+        bool operator == (const FatFlowEntry &rhs) const {
+            return (rhs.protocol == protocol && rhs.port == port);
+        }
+
+        bool operator() (const FatFlowEntry  &lhs,
+                         const FatFlowEntry &rhs) const {
+            return lhs.IsLess(&rhs);
+        }
+
+        bool IsLess(const FatFlowEntry *rhs) const {
+            if (protocol != rhs->protocol) {
+                return protocol < rhs->protocol;
+            }
+            return port < rhs->port;
+        }
+        uint8_t protocol;
+        uint16_t port;
+    };
+    typedef std::set<FatFlowEntry, FatFlowEntry> FatFlowEntrySet;
+
+    struct FatFlowList {
+        FatFlowList(): list_() {}
+        ~FatFlowList() {}
+        void Insert(const FatFlowEntry *rhs);
+        void Update(const FatFlowEntry *lhs, const FatFlowEntry *rhs);
+        void Remove(FatFlowEntrySet::iterator &it);
+
+        FatFlowEntrySet list_;
+    };
+
     enum Trace {
         ADD,
         DELETE,
@@ -477,6 +514,11 @@ class VmInterface : public Interface {
         return instance_ipv6_list_;
     }
 
+    const FatFlowList &fat_flow_list() const {
+        return fat_flow_list_;
+    }
+
+    bool IsFatFlow(uint8_t protocol, uint16_t port) const;
     void set_vxlan_id(int vxlan_id) { vxlan_id_ = vxlan_id; }
     void set_subnet_bcast_addr(const Ip4Address &addr) {
         subnet_bcast_addr_ = addr;
@@ -678,6 +720,8 @@ class VmInterface : public Interface {
     void DeleteAllowedAddressPair(bool l2);
     void UpdateSecurityGroup();
     void DeleteSecurityGroup();
+    void UpdateFatFlow();
+    void DeleteFatFlow();
     void UpdateL2TunnelId(bool force_update, bool policy_change);
     void DeleteL2TunnelId();
     void DeleteL2InterfaceRoute(bool old_l2_active, VrfEntry *old_vrf,
@@ -748,6 +792,7 @@ class VmInterface : public Interface {
     AllowedAddressPairList allowed_address_pair_list_;
     InstanceIpList instance_ipv4_list_;
     InstanceIpList instance_ipv6_list_;
+    FatFlowList fat_flow_list_;
 
     // Peer for interface routes
     std::auto_ptr<LocalVmPortPeer> peer_;
@@ -908,6 +953,7 @@ struct VmInterfaceConfigData : public VmInterfaceData {
     VmInterface::AllowedAddressPairList allowed_address_pair_list_;
     VmInterface::InstanceIpList instance_ipv4_list_;
     VmInterface::InstanceIpList instance_ipv6_list_;
+    VmInterface::FatFlowList fat_flow_list_;
     VmInterface::DeviceType device_type_;
     VmInterface::VmiType vmi_type_;
     // Parent physical-interface. Used in VMWare/ ToR logical-interface
diff --git a/src/vnsw/agent/pkt/pkt_flow_info.cc b/src/vnsw/agent/pkt/pkt_flow_info.cc
index b602b5784e8..2379a79fd06 100644
--- a/src/vnsw/agent/pkt/pkt_flow_info.cc
+++ b/src/vnsw/agent/pkt/pkt_flow_info.cc
@@ -1019,6 +1019,7 @@ void PktFlowInfo::IngressProcess(const PktInfo *pkt, PktControlInfo *in,
         return;
     }
 
+    CalculatePort(pkt, in->intf_);
     // We always expect route for source-ip for ingress flows.
     // If route not present, return from here so that a short flow is added
     UpdateRoute(&in->rt_, in->vrf_, pkt->ip_saddr, pkt->smac,
@@ -1150,6 +1151,7 @@ void PktFlowInfo::EgressProcess(const PktInfo *pkt, PktControlInfo *in,
     }
 
     if (out->intf_ && out->intf_->type() == Interface::VM_INTERFACE) {
+        CalculatePort(pkt, out->intf_);
         const VmInterface *vm_intf = static_cast<const VmInterface *>(out->intf_);
         if (vm_intf->IsFloatingIp(pkt->ip_daddr)) {
             pkt->l3_forwarding = true;
@@ -1338,6 +1340,51 @@ bool PktFlowInfo::Process(const PktInfo *pkt, PktControlInfo *in,
     return true;
 }
 
+//Mask source port or destination port if a port has fat flow
+//configuration. If both source port and destination port are
+//present in configuration then the lowest of the port takes
+//priority
+void PktFlowInfo::CalculatePort(const PktInfo *cpkt, const Interface *in) {
+    const VmInterface *intf = NULL;
+    PktInfo *pkt = const_cast<PktInfo *>(cpkt);
+
+    if (in == NULL || in->type() != Interface::VM_INTERFACE) {
+        return;
+    }
+
+    intf = static_cast<const VmInterface *>(in);
+    if (intf->fat_flow_list().list_.size() == 0) {
+        return;
+    }
+
+    uint16_t sport = pkt->sport;
+    if (pkt->ip_proto == IPPROTO_ICMP) {
+        sport = 0;
+    }
+    if (pkt->sport < pkt->dport) {
+        if (intf->IsFatFlow(pkt->ip_proto, sport)) {
+            pkt->dport = 0;
+            return;
+        }
+
+        if (intf->IsFatFlow(pkt->ip_proto, pkt->dport)) {
+            pkt->sport = 0;
+            return;
+        }
+        return;
+    }
+
+    if (intf->IsFatFlow(pkt->ip_proto, pkt->dport)) {
+        pkt->sport = 0;
+        return;
+    }
+
+    if (intf->IsFatFlow(pkt->ip_proto, sport)) {
+        pkt->dport = 0;
+        return;
+    }
+}
+
 // A flow can mean that traffic is seen on an interface. The path preference
 // module can potentially be interested in this event. Check and generate
 // traffic seen event
diff --git a/src/vnsw/agent/pkt/pkt_flow_info.h b/src/vnsw/agent/pkt/pkt_flow_info.h
index 2567427db13..3ae7800cbe5 100644
--- a/src/vnsw/agent/pkt/pkt_flow_info.h
+++ b/src/vnsw/agent/pkt/pkt_flow_info.h
@@ -100,7 +100,7 @@ class PktFlowInfo {
                      const IpAddress &addr, const MacAddress &mac,
                      FlowRouteRefMap &ref_map);
     uint8_t RouteToPrefixLen(const AgentRoute *route);
-
+    void CalculatePort(const PktInfo *p, const Interface *intf);
     bool                l3_flow;
     Address::Family     family;
     boost::shared_ptr<PktInfo> pkt;
diff --git a/src/vnsw/agent/pkt/test/egress-flow.xml b/src/vnsw/agent/pkt/test/egress-flow.xml
index ecec00ece97..555b54fba0e 100644
--- a/src/vnsw/agent/pkt/test/egress-flow.xml
+++ b/src/vnsw/agent/pkt/test/egress-flow.xml
@@ -84,6 +84,46 @@
          dvn="vn1" action="pass"/> 
     </validate>
 
+    <virtual-machine-interface nova="1"
+     uuid="3" name="tap3" mac="00:00:00:00:03:03" vn-name="vn1" vn-uuid="1"
+     vm-name="vm1" vm-uuid="1" vrf="vrf1" ip="1.1.1.3" fat-flow="53" fat-flow="10"
+     />
+    <vmi-vrf uuid="3" name="tap3-vm1" />
+    <validate name="validate-5">
+        <virtual-machine-interface name="tap3" uuid="3" present="1" active="1" />
+    </validate>
+
+    <packet uuid="1" id="1" name="l2-udp-from-fat-flow-fabric" intf="3" fwd_mode="l2"
+     tunnel_type="gre" tunnel_sip="10.10.10.10"
+     smac="00:00:00:00:01:02" dmac="00:00:00:00:03:03"
+     sip="1.1.1.2" dip="1.1.1.3" proto="udp" sport="1000" dport="53"
+     type="flow" />
+    <packet uuid="1" id="1" name="l2-udp-from-fat-flow-fabric" intf="3" fwd_mode="l2"
+     tunnel_type="gre" tunnel_sip="10.10.10.10"
+     smac="00:00:00:00:01:02" dmac="00:00:00:00:03:03"
+     sip="1.1.1.2" dip="1.1.1.3" proto="udp" sport="10" dport="53"
+     type="flow" />
+
+    <validate name="validate-6">
+        <flow name="l3-udp-to-fat-flow-1" uuid="1" vrf="vrf1" nh="18" sip="1.1.1.3"
+         dip="1.1.1.2" proto="udp" sport="53" dport="0" svn="vn1"
+         dvn="vn1" action="pass"/>
+        <flow name="l3-udp-to-fat-flow-2" uuid="1" vrf="vrf1" nh="27" sip="1.1.1.2"
+         dip="1.1.1.3" proto="udp" sport="0" dport="53" svn="vn1"
+         dvn="vn1" action="pass"/>
+        <flow name="l3-udp-to-fat-flow-1" uuid="1" vrf="vrf1" nh="18" sip="1.1.1.3"
+         dip="1.1.1.2" proto="udp" sport="0" dport="10" svn="vn1"
+         dvn="vn1" action="pass"/>
+        <flow name="l3-udp-to-fat-flow-2" uuid="1" vrf="vrf1" nh="27" sip="1.1.1.2"
+         dip="1.1.1.3" proto="udp" sport="10" dport="0" svn="vn1"
+         dvn="vn1" action="pass"/>
+    </validate>
+    <virtual-machine-interface delete="1" nova="1"
+     uuid="3" name="tap3" mac="00:00:00:00:03:03" vn-name="vn1" vn-uuid="1"
+     vm-name="vm1" vm-uuid="1" vrf="vrf1" ip="1.1.1.3" fat-flow="53"
+     />
+    <vmi-vrf delete="1" uuid="3" name="tap3-vm1" />
+
     <virtual-machine-interface delete="1" nova="1"
      uuid="1" name="tap1" mac="00:00:00:00:00:01" vn-name="vn1" vn-uuid="1"
      vm-name="vm1" vm-uuid="1" vrf="vrf1" ip="1.1.1.1"
diff --git a/src/vnsw/agent/pkt/test/ingress-flow.xml b/src/vnsw/agent/pkt/test/ingress-flow.xml
index e7d6d6de297..f67bdd773c9 100644
--- a/src/vnsw/agent/pkt/test/ingress-flow.xml
+++ b/src/vnsw/agent/pkt/test/ingress-flow.xml
@@ -62,6 +62,38 @@
          dvn="vn1" action="pass" rpf_nh="12"/>
     </validate>
 
+    <virtual-machine-interface nova="1"
+     uuid="3" name="tap3" mac="00:00:00:00:03:03" vn-name="vn1" vn-uuid="1"
+     vm-name="vm1" vm-uuid="1" vrf="vrf1" ip="1.1.1.3" fat-flow="53"
+     />
+    <vmi-vrf uuid="3" name="tap3-vm1" />
+    <validate name="validate-3">
+        <virtual-machine-interface name="tap3" uuid="2" present="1" active="1" />
+    </validate>
+
+    <packet uuid="1" id="1" name="l2-fat-flow-from-vm" intf="1" fwd_mode="l2"
+     smac="00:00:00:00:01:01" dmac="00:00:00:00:03:03"
+     sip="1.1.1.1" dip="1.1.1.3" proto="udp" sport="1800" dport="53"
+     type="flow" />
+    <packet uuid="1" id="1" name="l2-fat-flow-from-vm" intf="3" fwd_mode="l2"
+     smac="00:00:00:00:03:03" dmac="00:00:00:00:01:01"
+     sip="1.1.1.3" dip="1.1.1.1" proto="udp" sport="53" dport="1800"
+     type="flow" />
+    <validate name="validate-3">
+        <flow name="l2-fat-flow-from-vm" uuid="1" vrf="vrf1" nh="11" sip="1.1.1.1"
+         dip="1.1.1.3" proto="udp" sport="1800" dport="53" svn="vn1"
+         dvn="vn1" action="pass"/>
+        <flow name="l2-fat-flow-from-vm-2" uuid="1" vrf="vrf1" nh="16" sip="1.1.1.3"
+         dip="1.1.1.1" proto="udp" sport="53" dport="0" svn="vn1"
+         dvn="vn1" action="pass"/>
+    </validate>
+
+    <virtual-machine-interface delete="1" nova="1"
+     uuid="3" name="tap3" mac="00:00:00:00:03:03" vn-name="vn1" vn-uuid="1"
+     vm-name="vm1" vm-uuid="1" vrf="vrf1" ip="1.1.1.3" fat-flow="53"
+     />
+    <vmi-vrf delete="1" uuid="3" name="tap3-vm1" />
+
     <virtual-machine-interface delete="1" nova="1"
      uuid="1" name="tap1" mac="00:00:00:00:01:01" vn-name="vn1" vn-uuid="1"
      vm-name="vm1" vm-uuid="1" vrf="vrf1" ip="1.1.1.1"
@@ -70,7 +102,7 @@
     <virtual-machine-interface delete="1" nova="1"
      uuid="2" name="tap2" mac="00:00:00:00:01:02" vn-name="vn1" vn-uuid="1"
      vm-name="vm2" vm-uuid="2" vrf="vrf1" ip="1.1.1.2"
-    />
+     />
 
     <virtual-network delete="1" uuid="1" name="vn1"/>
     <virtual-machine delete="1" uuid="1" name="vm1"/>
diff --git a/src/vnsw/agent/test-xml/test_xml_oper.cc b/src/vnsw/agent/test-xml/test_xml_oper.cc
index 3f130d1c67c..4bfc0b9bd42 100644
--- a/src/vnsw/agent/test-xml/test_xml_oper.cc
+++ b/src/vnsw/agent/test-xml/test_xml_oper.cc
@@ -337,6 +337,16 @@ bool AgentUtXmlVmInterface::ReadXml() {
     vlan_tag_ = 0;
     GetUintAttribute(node(), "vlan-tag", &vlan_tag_);
     GetStringAttribute(node(), "parent-vmi", &parent_vmi_);
+
+     xml_attribute attr = node().attribute("fat-flow");
+     for (;attr != xml_attribute(); attr = attr.next_attribute()) {
+         if (std::string(attr.name()) == "fat-flow") {
+             uint32_t value = attr.as_uint();
+             fat_flow_port_.push_back(value);
+         } else {
+             break;
+         }
+     }
     return true;
 }
 
@@ -355,6 +365,16 @@ bool AgentUtXmlVmInterface::ToXml(xml_node *parent) {
             sprintf(buff, "%d", vlan_tag_);
             AddXmlNodeWithValue(&n1, "sub-interface-vlan-tag", buff);
         }
+
+        n1 = n.append_child("virtual-machine-interface-fat-flow-protocols");
+        std::vector<uint16_t>::const_iterator it = fat_flow_port_.begin();
+        for(;it != fat_flow_port_.end(); it++) {
+            xml_node n2 = n1.append_child("fat-flow-protocol");
+            AddXmlNodeWithValue(&n2, "protocol", "UDP");
+            stringstream s;
+            s << *it;
+            AddXmlNodeWithValue(&n2, "port", s.str());
+        }
     }
 
     if (add_nova_) {
@@ -1039,6 +1059,7 @@ bool AgentUtXmlVmInterfaceValidate::ReadXml() {
     if (id) {
         vn_uuid_ = MakeUuid(id);
     }
+
     return true;
 }
 
diff --git a/src/vnsw/agent/test-xml/test_xml_oper.h b/src/vnsw/agent/test-xml/test_xml_oper.h
index 36d462092bd..8d3e588ae29 100644
--- a/src/vnsw/agent/test-xml/test_xml_oper.h
+++ b/src/vnsw/agent/test-xml/test_xml_oper.h
@@ -91,6 +91,7 @@ class AgentUtXmlVmInterface : public AgentUtXmlConfig {
     std::string ip_;
     bool add_nova_;
     uint16_t vlan_tag_;
+    std::vector<uint16_t> fat_flow_port_;
     std::string parent_vmi_;
 };
 
@@ -315,6 +316,8 @@ class AgentUtXmlVmInterfaceValidate : public AgentUtXmlValidationNode {
     std::string device_type_;
     std::string vmi_type_;
     uint16_t vlan_tag_;
+    std::vector<uint16_t> fat_flow_port_;
+
     boost::uuids::uuid vn_uuid_;
 };
 
diff --git a/src/vnsw/agent/vrouter/ksync/agent_ksync.sandesh b/src/vnsw/agent/vrouter/ksync/agent_ksync.sandesh
index f1eabe4e885..1fbd2740dc0 100644
--- a/src/vnsw/agent/vrouter/ksync/agent_ksync.sandesh
+++ b/src/vnsw/agent/vrouter/ksync/agent_ksync.sandesh
@@ -2,6 +2,11 @@
  * Copyright (c) 2013 Juniper Networks, Inc. All rights reserved.
  */
 
+struct KSyncIntfFatFlowInfo {
+    1: u16 protocol;
+    2: u16 port;
+}
+
 struct KSyncIntfInfo {
     1: u32 idx;
     2: string name;
@@ -13,6 +18,7 @@ struct KSyncIntfInfo {
     8: optional u32 service_enabled;
     9: optional string analyzer_name;
    10: optional u32 l2_active;
+   11: optional list<KSyncIntfFatFlowInfo> fat_flows;
 }
 
 traceobject sandesh KSyncIntf {
diff --git a/src/vnsw/agent/vrouter/ksync/interface_ksync.cc b/src/vnsw/agent/vrouter/ksync/interface_ksync.cc
index 7b091b90ad0..cdace303012 100644
--- a/src/vnsw/agent/vrouter/ksync/interface_ksync.cc
+++ b/src/vnsw/agent/vrouter/ksync/interface_ksync.cc
@@ -340,6 +340,12 @@ bool InterfaceKSyncEntry::Sync(DBEntry *e) {
 
     switch (intf->type()) {
     case Interface::VM_INTERFACE:
+    {    const VmInterface *vm_intf = static_cast<const VmInterface *>(intf);
+        if (fat_flow_list_.list_ != vm_intf->fat_flow_list().list_) {
+            fat_flow_list_ = vm_intf->fat_flow_list();
+            ret = true;
+        }
+    }
     case Interface::PACKET:
         dmac = table->agent()->vrrp_mac();
         break;
@@ -671,6 +677,17 @@ void InterfaceKSyncEntry::FillObjectLog(sandesh_op::type op,
         info.set_policy_enabled(policy_enabled_);
         info.set_service_enabled(has_service_vlan_);
         info.set_analyzer_name(analyzer_name_);
+
+        std::vector<KSyncIntfFatFlowInfo> fat_flows;
+        for (VmInterface::FatFlowEntrySet::const_iterator it =
+             fat_flow_list_.list_.begin(); it != fat_flow_list_.list_.end();
+             it++) {
+            KSyncIntfFatFlowInfo info;
+            info.set_protocol(it->protocol);
+            info.set_port(it->port);
+            fat_flows.push_back(info);
+        }
+        info.set_fat_flows(fat_flows);
     }
 }
 
diff --git a/src/vnsw/agent/vrouter/ksync/interface_ksync.h b/src/vnsw/agent/vrouter/ksync/interface_ksync.h
index f371800e397..28ddb7d8358 100644
--- a/src/vnsw/agent/vrouter/ksync/interface_ksync.h
+++ b/src/vnsw/agent/vrouter/ksync/interface_ksync.h
@@ -112,6 +112,7 @@ class InterfaceKSyncEntry : public KSyncNetlinkDBEntry {
     std::string display_name_;
     Interface::Transport transport_;
     bool flood_unknown_unicast_;
+    VmInterface::FatFlowList fat_flow_list_;
     DISALLOW_COPY_AND_ASSIGN(InterfaceKSyncEntry);
 };