diff options
author | Justin Pettit <jpettit@nicira.com> | 2012-12-13 16:22:55 -0800 |
---|---|---|
committer | Justin Pettit <jpettit@nicira.com> | 2012-12-13 16:35:26 -0800 |
commit | 8963743a95f53933249e468492b163747f1b2b73 (patch) | |
tree | 74c574d04180b7ced9ed1df568d736aef50fe0e0 | |
parent | aa8d2ee8ae0d47f1683cf51e83f104022102ed73 (diff) |
meta-flow: Don't allow negative port numbers.
If a negative number is supplied, the parsing code used to convert it
into a signed one. We ran into an incident where a third-party script
was attempting to get the OpenFlow port number for an interface, but got
-1 from the database, since the number had not yet been assigned. This
was converted to 65535, which maps to OFPP_NONE and all flows with
ingress port OFPP_NONE were modified. This commit disallows negative
port numbers to help prevent broken integration scripts from disturbing
the flow table.
Issue #14036
Signed-off-by: Justin Pettit <jpettit@nicira.com>
-rw-r--r-- | lib/meta-flow.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/lib/meta-flow.c b/lib/meta-flow.c index 3060c8bf..5e3007b3 100644 --- a/lib/meta-flow.c +++ b/lib/meta-flow.c @@ -1927,7 +1927,10 @@ mf_from_ofp_port_string(const struct mf_field *mf, const char *s, uint16_t port; assert(mf->n_bytes == sizeof(ovs_be16)); - if (ofputil_port_from_string(s, &port)) { + if (*s == '-') { + return xasprintf("%s: negative values not supported for %s", + s, mf->name); + } else if (ofputil_port_from_string(s, &port)) { *valuep = htons(port); *maskp = htons(UINT16_MAX); return NULL; |