X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=lib%2Fflow.c;h=754c0de0ba19cf8d9b1f12cf6101a677816baa22;hb=6910a6e6f25f7fe7adfd93c8405671e72d4d156b;hp=41f13b88c46f78299bc94d035f9d78cfb7b3a30c;hpb=d31f1109f10e5ffb9bf266306b913ebf23781666;p=sliver-openvswitch.git

diff --git a/lib/flow.c b/lib/flow.c
index 41f13b88c..754c0de0b 100644
--- a/lib/flow.c
+++ b/lib/flow.c
@@ -134,19 +134,16 @@ parse_ethertype(struct ofpbuf *b)
 static int
 parse_ipv6(struct ofpbuf *packet, struct flow *flow)
 {
-    struct ip6_hdr *nh;
-    int nh_len = sizeof(struct ip6_hdr);
-    int payload_len;
+    const struct ip6_hdr *nh;
     ovs_be32 tc_flow;
     int nexthdr;
 
-    if (packet->size < sizeof *nh) {
-        return -EINVAL;
+    nh = ofpbuf_try_pull(packet, sizeof *nh);
+    if (!nh) {
+        return EINVAL;
     }
 
-    nh = packet->data;
     nexthdr = nh->ip6_nxt;
-    payload_len = ntohs(nh->ip6_plen);
 
     flow->ipv6_src = nh->ip6_src;
     flow->ipv6_dst = nh->ip6_dst;
@@ -155,15 +152,6 @@ parse_ipv6(struct ofpbuf *packet, struct flow *flow)
     flow->nw_tos = (ntohl(tc_flow) >> 4) & IP_DSCP_MASK;
     flow->nw_proto = IPPROTO_NONE;
 
-    /* We don't process jumbograms. */
-    if (!payload_len) {
-        return -EINVAL;
-    }
-
-    if (packet->size < sizeof *nh + payload_len) {
-        return -EINVAL;
-    }
-
     while (1) {
         if ((nexthdr != IPPROTO_HOPOPTS)
                 && (nexthdr != IPPROTO_ROUTING)
@@ -179,9 +167,10 @@ parse_ipv6(struct ofpbuf *packet, struct flow *flow)
         /* We only verify that at least 8 bytes of the next header are
          * available, but many of these headers are longer.  Ensure that
          * accesses within the extension header are within those first 8
+         * bytes. All extension headers are required to be at least 8
          * bytes. */
-        if (packet->size < nh_len + 8) {
-            return -EINVAL;
+        if (packet->size < 8) {
+            return EINVAL;
         }
 
         if ((nexthdr == IPPROTO_HOPOPTS)
@@ -189,28 +178,28 @@ parse_ipv6(struct ofpbuf *packet, struct flow *flow)
                 || (nexthdr == IPPROTO_DSTOPTS)) {
             /* These headers, while different, have the fields we care about
              * in the same location and with the same interpretation. */
-            struct ip6_ext *ext_hdr;
-
-            ext_hdr = (struct ip6_ext *)((char *)packet->data + nh_len);
+            const struct ip6_ext *ext_hdr = (struct ip6_ext *)packet->data;
             nexthdr = ext_hdr->ip6e_nxt;
-            nh_len += (ext_hdr->ip6e_len + 1) * 8;
+            if (!ofpbuf_try_pull(packet, (ext_hdr->ip6e_len + 1) * 8)) {
+                return EINVAL;
+            }
         } else if (nexthdr == IPPROTO_AH) {
             /* A standard AH definition isn't available, but the fields
              * we care about are in the same location as the generic
              * option header--only the header length is calculated
              * differently. */
-            struct ip6_ext *ext_hdr;
-
-            ext_hdr = (struct ip6_ext *)((char *)packet->data + nh_len);
+            const struct ip6_ext *ext_hdr = (struct ip6_ext *)packet->data;
             nexthdr = ext_hdr->ip6e_nxt;
-            nh_len += (ext_hdr->ip6e_len + 2) * 4;
+            if (!ofpbuf_try_pull(packet, (ext_hdr->ip6e_len + 2) * 4)) {
+               return EINVAL;
+            }
         } else if (nexthdr == IPPROTO_FRAGMENT) {
-            struct ip6_frag *frag_hdr;
-
-            frag_hdr = (struct ip6_frag *)((char *)packet->data + nh_len);
+            const struct ip6_frag *frag_hdr = (struct ip6_frag *)packet->data;
 
             nexthdr = frag_hdr->ip6f_nxt;
-            nh_len += sizeof *frag_hdr;
+            if (!ofpbuf_try_pull(packet, sizeof *frag_hdr)) {
+                return EINVAL;
+            }
 
             /* We only process the first fragment. */
             if ((frag_hdr->ip6f_offlg & IP6F_OFF_MASK) != htons(0)) {
@@ -220,17 +209,104 @@ parse_ipv6(struct ofpbuf *packet, struct flow *flow)
         }
     }
 
-    /* The payload length claims to be smaller than the size of the
-     * headers we've already processed. */
-    if (payload_len < nh_len - sizeof *nh) {
-        return -EINVAL;
+    flow->nw_proto = nexthdr;
+    return 0;
+}
+
+static void
+parse_tcp(struct ofpbuf *packet, struct ofpbuf *b, struct flow *flow)
+{
+    const struct tcp_header *tcp = pull_tcp(b);
+    if (tcp) {
+        flow->tp_src = tcp->tcp_src;
+        flow->tp_dst = tcp->tcp_dst;
+        packet->l7 = b->data;
     }
+}
+
+static void
+parse_udp(struct ofpbuf *packet, struct ofpbuf *b, struct flow *flow)
+{
+    const struct udp_header *udp = pull_udp(b);
+    if (udp) {
+        flow->tp_src = udp->udp_src;
+        flow->tp_dst = udp->udp_dst;
+        packet->l7 = b->data;
+    }
+}
+
+static bool
+parse_icmpv6(struct ofpbuf *b, struct flow *flow)
+{
+    const struct icmp6_hdr *icmp = pull_icmpv6(b);
+
+    if (!icmp) {
+        return false;
+    }
+
+    /* The ICMPv6 type and code fields use the 16-bit transport port
+     * fields, so we need to store them in 16-bit network byte order. */
+    flow->icmp_type = htons(icmp->icmp6_type);
+    flow->icmp_code = htons(icmp->icmp6_code);
+
+    if (icmp->icmp6_code == 0 &&
+        (icmp->icmp6_type == ND_NEIGHBOR_SOLICIT ||
+         icmp->icmp6_type == ND_NEIGHBOR_ADVERT)) {
+        const struct in6_addr *nd_target;
+
+        nd_target = ofpbuf_try_pull(b, sizeof *nd_target);
+        if (!nd_target) {
+            return false;
+        }
+        flow->nd_target = *nd_target;
+
+        while (b->size >= 8) {
+            /* The minimum size of an option is 8 bytes, which also is
+             * the size of Ethernet link-layer options. */
+            const struct nd_opt_hdr *nd_opt = b->data;
+            int opt_len = nd_opt->nd_opt_len * 8;
+
+            if (!opt_len || opt_len > b->size) {
+                goto invalid;
+            }
+
+            /* Store the link layer address if the appropriate option is
+             * provided.  It is considered an error if the same link
+             * layer option is specified twice. */
+            if (nd_opt->nd_opt_type == ND_OPT_SOURCE_LINKADDR
+                    && opt_len == 8) {
+                if (eth_addr_is_zero(flow->arp_sha)) {
+                    memcpy(flow->arp_sha, nd_opt + 1, ETH_ADDR_LEN);
+                } else {
+                    goto invalid;
+                }
+            } else if (nd_opt->nd_opt_type == ND_OPT_TARGET_LINKADDR
+                    && opt_len == 8) {
+                if (eth_addr_is_zero(flow->arp_tha)) {
+                    memcpy(flow->arp_tha, nd_opt + 1, ETH_ADDR_LEN);
+                } else {
+                    goto invalid;
+                }
+            }
+
+            if (!ofpbuf_try_pull(b, opt_len)) {
+                goto invalid;
+            }
+        }
+    }
+
+    return true;
+
+invalid:
+    memset(&flow->nd_target, 0, sizeof(flow->nd_target));
+    memset(flow->arp_sha, 0, sizeof(flow->arp_sha));
+    memset(flow->arp_tha, 0, sizeof(flow->arp_tha));
+
+    return false;
 
-    flow->nw_proto = nexthdr;
-    return nh_len;
 }
 
-/* Initializes 'flow' members from 'packet', 'tun_id', and 'in_port.
+/* Initializes 'flow' members from 'packet', 'tun_id', and 'ofp_in_port'.
  * Initializes 'packet' header pointers as follows:
  *
  *    - packet->l2 to the start of the Ethernet header.
@@ -246,7 +322,7 @@ parse_ipv6(struct ofpbuf *packet, struct flow *flow)
  *      present and has a correct length, and otherwise NULL.
  */
 int
-flow_extract(struct ofpbuf *packet, ovs_be64 tun_id, uint16_t in_port,
+flow_extract(struct ofpbuf *packet, ovs_be64 tun_id, uint16_t ofp_in_port,
              struct flow *flow)
 {
     struct ofpbuf b = *packet;
@@ -257,7 +333,7 @@ flow_extract(struct ofpbuf *packet, ovs_be64 tun_id, uint16_t in_port,
 
     memset(flow, 0, sizeof *flow);
     flow->tun_id = tun_id;
-    flow->in_port = in_port;
+    flow->in_port = ofp_in_port;
 
     packet->l2 = b.data;
     packet->l3 = NULL;
@@ -292,19 +368,9 @@ flow_extract(struct ofpbuf *packet, ovs_be64 tun_id, uint16_t in_port,
             packet->l4 = b.data;
             if (!IP_IS_FRAGMENT(nh->ip_frag_off)) {
                 if (flow->nw_proto == IPPROTO_TCP) {
-                    const struct tcp_header *tcp = pull_tcp(&b);
-                    if (tcp) {
-                        flow->tp_src = tcp->tcp_src;
-                        flow->tp_dst = tcp->tcp_dst;
-                        packet->l7 = b.data;
-                    }
+                    parse_tcp(packet, &b, flow);
                 } else if (flow->nw_proto == IPPROTO_UDP) {
-                    const struct udp_header *udp = pull_udp(&b);
-                    if (udp) {
-                        flow->tp_src = udp->udp_src;
-                        flow->tp_dst = udp->udp_dst;
-                        packet->l7 = b.data;
-                    }
+                    parse_udp(packet, &b, flow);
                 } else if (flow->nw_proto == IPPROTO_ICMP) {
                     const struct icmp_header *icmp = pull_icmp(&b);
                     if (icmp) {
@@ -318,38 +384,20 @@ flow_extract(struct ofpbuf *packet, ovs_be64 tun_id, uint16_t in_port,
             }
         }
     } else if (flow->dl_type == htons(ETH_TYPE_IPV6)) {
-        int nh_len;
-        const struct ip6_hdr *nh;
 
-        nh_len = parse_ipv6(&b, flow);
-        if (nh_len < 0) {
+        retval = parse_ipv6(&b, flow);
+        if (retval) {
             return 0;
         }
 
-        nh = ofpbuf_pull(&b, nh_len);
-        if (nh) {
-            packet->l4 = b.data;
-            if (flow->nw_proto == IPPROTO_TCP) {
-                const struct tcp_header *tcp = pull_tcp(&b);
-                if (tcp) {
-                    flow->tp_src = tcp->tcp_src;
-                    flow->tp_dst = tcp->tcp_dst;
-                    packet->l7 = b.data;
-                }
-            } else if (flow->nw_proto == IPPROTO_UDP) {
-                const struct udp_header *udp = pull_udp(&b);
-                if (udp) {
-                    flow->tp_src = udp->udp_src;
-                    flow->tp_dst = udp->udp_dst;
-                    packet->l7 = b.data;
-                }
-            } else if (flow->nw_proto == IPPROTO_ICMPV6) {
-                const struct icmp6_hdr *icmp = pull_icmpv6(&b);
-                if (icmp) {
-                    flow->icmp_type = htons(icmp->icmp6_type);
-                    flow->icmp_code = htons(icmp->icmp6_code);
-                    packet->l7 = b.data;
-                }
+        packet->l4 = b.data;
+        if (flow->nw_proto == IPPROTO_TCP) {
+            parse_tcp(packet, &b, flow);
+        } else if (flow->nw_proto == IPPROTO_UDP) {
+            parse_udp(packet, &b, flow);
+        } else if (flow->nw_proto == IPPROTO_ICMPV6) {
+            if (parse_icmpv6(&b, flow)) {
+                packet->l7 = b.data;
             }
         }
     } else if (flow->dl_type == htons(ETH_TYPE_ARP)) {
@@ -408,7 +456,7 @@ void
 flow_format(struct ds *ds, const struct flow *flow)
 {
     ds_put_format(ds, "tunnel%#"PRIx64":in_port%04"PRIx16":tci(",
-                  flow->tun_id, flow->in_port);
+                  ntohll(flow->tun_id), flow->in_port);
     if (flow->vlan_tci) {
         ds_put_format(ds, "vlan%"PRIu16",pcp%d",
                       vlan_tci_to_vid(flow->vlan_tci),
@@ -508,7 +556,7 @@ flow_wildcards_is_exact(const struct flow_wildcards *wc)
     }
 
     for (i = 0; i < FLOW_N_REGS; i++) {
-        if (wc->reg_masks[i] != htonl(UINT32_MAX)) {
+        if (wc->reg_masks[i] != UINT32_MAX) {
             return false;
         }
     }
@@ -702,10 +750,13 @@ flow_hash_symmetric_l4(const struct flow *flow, uint32_t basis)
     }
     fields.vlan_tci = flow->vlan_tci & htons(VLAN_VID_MASK);
     fields.eth_type = flow->dl_type;
+
+    /* UDP source and destination port are not taken into account because they
+     * will not necessarily be symmetric in a bidirectional flow. */
     if (fields.eth_type == htons(ETH_TYPE_IP)) {
         fields.ipv4_addr = flow->nw_src ^ flow->nw_dst;
         fields.ip_proto = flow->nw_proto;
-        if (fields.ip_proto == IPPROTO_TCP || fields.ip_proto == IPPROTO_UDP) {
+        if (fields.ip_proto == IPPROTO_TCP) {
             fields.tp_addr = flow->tp_src ^ flow->tp_dst;
         }
     } else if (fields.eth_type == htons(ETH_TYPE_IPV6)) {
@@ -717,7 +768,7 @@ flow_hash_symmetric_l4(const struct flow *flow, uint32_t basis)
             ipv6_addr[i] = a[i] ^ b[i];
         }
         fields.ip_proto = flow->nw_proto;
-        if (fields.ip_proto == IPPROTO_TCP || fields.ip_proto == IPPROTO_UDP) {
+        if (fields.ip_proto == IPPROTO_TCP) {
             fields.tp_addr = flow->tp_src ^ flow->tp_dst;
         }
     }