diff options
| author | Ben Pfaff <blp@nicira.com> | 2010-08-24 16:00:27 -0700 |
|---|---|---|
| committer | Ben Pfaff <blp@nicira.com> | 2010-08-26 10:56:20 -0700 |
| commit | 401eeb92d32ac0fa07f34f5b803d67b8032b6403 (patch) | |
| tree | d3c36f17662b43a6f4ed65e938b12ab3823ed2a5 /datapath/flow.c | |
| parent | e5ae7df8c7f44cb2d6f42daaab1d3c26c7a88ae3 (diff) | |
Add Nicira extension to OpenFlow for dropping spoofed ARP packets.
"ARP spoofing" is when a host claims an incorrect association between an
IP address and a MAC address for deceptive purposes. OpenFlow by itself
can prevent a host from sending out ARP replies from an incorrect MAC
address in the Ethernet L2 header, but it cannot control the MAC addresses
inside the ARP L3 packet. This commit adds a new action that can be used
to drop these spoofed packets.
CC: Paul Ingram <paul@nicira.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
Diffstat (limited to 'datapath/flow.c')
| -rw-r--r-- | datapath/flow.c | 15 |
1 files changed, 0 insertions, 15 deletions
diff --git a/datapath/flow.c b/datapath/flow.c index 5e362e30..c37c8e0f 100644 --- a/datapath/flow.c +++ b/datapath/flow.c @@ -34,21 +34,6 @@ struct kmem_cache *flow_cache; static unsigned int hash_seed; -struct arp_eth_header -{ - __be16 ar_hrd; /* format of hardware address */ - __be16 ar_pro; /* format of protocol address */ - unsigned char ar_hln; /* length of hardware address */ - unsigned char ar_pln; /* length of protocol address */ - __be16 ar_op; /* ARP opcode (command) */ - - /* Ethernet+IPv4 specific members. */ - unsigned char ar_sha[ETH_ALEN]; /* sender hardware address */ - unsigned char ar_sip[4]; /* sender IP address */ - unsigned char ar_tha[ETH_ALEN]; /* target hardware address */ - unsigned char ar_tip[4]; /* target IP address */ -} __attribute__((packed)); - static inline bool arphdr_ok(struct sk_buff *skb) { int nh_ofs = skb_network_offset(skb); |