diff options
| author | Jesse Gross <jesse@nicira.com> | 2012-08-02 18:22:38 -0700 |
|---|---|---|
| committer | Jesse Gross <jesse@nicira.com> | 2012-08-03 19:29:40 -0700 |
| commit | e353e467f08fdcad56cabf6ace93101e7174394d (patch) | |
| tree | 4398fa1e5e3c80ccf9fb2d710e840892712de8d3 /datapath | |
| parent | c4610f3c889f838f051cab4c7fb0c3b5fe715a41 (diff) | |
datapath: Relax set header validation.
When installing a flow with an action to set a particular field we
need to validate that the packets that are part of the flow actually
contain that header. With IP we use zeroed addresses and with TCP/UDP
the check is for zeroed ports. This check is overly broad and can catch
packets like DHCP requests that have a zero source address in a
legitimate header. This changes the check to look for a zeroed protocol
number for IP or for both ports be zero for TCP/UDP before considering
the header to not exist.
Bug #12769
Reported-by: Ethan Jackson <ethan@nicira.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
Diffstat (limited to 'datapath')
| -rw-r--r-- | datapath/datapath.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/datapath/datapath.c b/datapath/datapath.c index b9ff07f0..641c812d 100644 --- a/datapath/datapath.c +++ b/datapath/datapath.c @@ -562,10 +562,10 @@ static int validate_sample(const struct nlattr *attr, static int validate_tp_port(const struct sw_flow_key *flow_key) { if (flow_key->eth.type == htons(ETH_P_IP)) { - if (flow_key->ipv4.tp.src && flow_key->ipv4.tp.dst) + if (flow_key->ipv4.tp.src || flow_key->ipv4.tp.dst) return 0; } else if (flow_key->eth.type == htons(ETH_P_IPV6)) { - if (flow_key->ipv6.tp.src && flow_key->ipv6.tp.dst) + if (flow_key->ipv6.tp.src || flow_key->ipv6.tp.dst) return 0; } @@ -598,7 +598,7 @@ static int validate_set(const struct nlattr *a, if (flow_key->eth.type != htons(ETH_P_IP)) return -EINVAL; - if (!flow_key->ipv4.addr.src || !flow_key->ipv4.addr.dst) + if (!flow_key->ip.proto) return -EINVAL; ipv4_key = nla_data(ovs_key); |