openvswitch: Reject ct_state unsupported bits (6f225952) · Commits · 戴 / test

net/openvswitch/conntrack.h

+12 −0

Original line number	Diff line number	Diff line
		@@ -34,6 +34,13 @@ int ovs_ct_execute(struct net , struct sk_buff , struct sw_flow_key *,
		void ovs_ct_fill_key(const struct sk_buff skb, struct sw_flow_key key);
		int ovs_ct_put_key(const struct sw_flow_key key, struct sk_buff skb);
		void ovs_ct_free_action(const struct nlattr *a);

		static inline bool ovs_ct_state_supported(u8 state)
		{
		return !(state & ~(OVS_CS_F_NEW \| OVS_CS_F_ESTABLISHED \|
		OVS_CS_F_RELATED \| OVS_CS_F_REPLY_DIR \|
		OVS_CS_F_INVALID \| OVS_CS_F_TRACKED));
		}
		#else
		#include <linux/errno.h>

		@@ -46,6 +53,11 @@ static inline bool ovs_ct_verify(struct net *net, int attr)
		return false;
		}

		static inline bool ovs_ct_state_supported(u8 state)
		{
		return false;
		}

		static inline int ovs_ct_copy_action(struct net net, const struct nlattr nla,
		const struct sw_flow_key *key,
		struct sw_flow_actions **acts, bool log)

+6 −0

Original line number	Diff line number	Diff line
		@@ -816,6 +816,12 @@ static int metadata_from_nlattrs(struct net net, struct sw_flow_match match,
		ovs_ct_verify(net, OVS_KEY_ATTR_CT_STATE)) {
		u8 ct_state = nla_get_u8(a[OVS_KEY_ATTR_CT_STATE]);

		if (!is_mask && !ovs_ct_state_supported(ct_state)) {
		OVS_NLERR(log, "ct_state flags %02x unsupported",
		ct_state);
		return -EINVAL;
		}

		SW_FLOW_KEY_PUT(match, ct.state, ct_state, is_mask);
		*attrs &= ~(1ULL << OVS_KEY_ATTR_CT_STATE);
		}