From patchwork Thu Apr 7 16:18:33 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Justin Pettit X-Patchwork-Id: 607494 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from archives.nicira.com (archives.nicira.com [96.126.127.54]) by ozlabs.org (Postfix) with ESMTP id 3qgnpP5VB5z9t5q for ; Fri, 8 Apr 2016 02:18:52 +1000 (AEST) Received: from archives.nicira.com (localhost [127.0.0.1]) by archives.nicira.com (Postfix) with ESMTP id 5512C102DD; Thu, 7 Apr 2016 09:18:45 -0700 (PDT) X-Original-To: dev@openvswitch.org Delivered-To: dev@openvswitch.org Received: from mx3v3.cudamail.com (mx3.cudamail.com [64.34.241.5]) by archives.nicira.com (Postfix) with ESMTPS id C751D102C1 for ; Thu, 7 Apr 2016 09:18:44 -0700 (PDT) Received: from bar6.cudamail.com (localhost [127.0.0.1]) by mx3v3.cudamail.com (Postfix) with ESMTPS id 4320016213D for ; Thu, 7 Apr 2016 10:18:44 -0600 (MDT) X-ASG-Debug-ID: 1460045922-0b32373537946440001-byXFYA Received: from mx3-pf1.cudamail.com ([192.168.14.2]) by bar6.cudamail.com with ESMTP id oQbXEkBXINFAnqVW (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 07 Apr 2016 10:18:42 -0600 (MDT) X-Barracuda-Envelope-From: jpettit@ovn.org X-Barracuda-RBL-Trusted-Forwarder: 192.168.14.2 Received: from unknown (HELO relay5-d.mail.gandi.net) (217.70.183.197) by mx3-pf1.cudamail.com with ESMTPS (DHE-RSA-AES256-SHA encrypted); 7 Apr 2016 16:18:42 -0000 Received-SPF: pass (mx3-pf1.cudamail.com: SPF record at ovn.org designates 217.70.183.197 as permitted sender) X-Barracuda-Apparent-Source-IP: 217.70.183.197 X-Barracuda-RBL-IP: 217.70.183.197 Received: from mfilter14-d.gandi.net (mfilter14-d.gandi.net [217.70.178.142]) by relay5-d.mail.gandi.net (Postfix) with ESMTP id CD94F41C0B7; Thu, 7 Apr 2016 18:18:40 +0200 (CEST) X-Virus-Scanned: Debian amavisd-new at mfilter14-d.gandi.net Received: from relay5-d.mail.gandi.net ([IPv6:::ffff:217.70.183.197]) by mfilter14-d.gandi.net (mfilter14-d.gandi.net [::ffff:10.0.15.180]) (amavisd-new, port 10024) with ESMTP id jVABQ9Isel03; Thu, 7 Apr 2016 18:18:37 +0200 (CEST) X-Originating-IP: 98.234.50.139 Received: from [10.0.1.13] (unknown [98.234.50.139]) (Authenticated sender: jpettit@ovn.org) by relay5-d.mail.gandi.net (Postfix) with ESMTPSA id 8A12941C0BD; Thu, 7 Apr 2016 18:18:36 +0200 (CEST) Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-CudaMail-Whitelist-To: dev@openvswitch.org X-CudaMail-MID: CM-V1-406030426 X-CudaMail-DTE: 040716 X-CudaMail-Originating-IP: 217.70.183.197 X-CudaMail-Envelope-Sender: jpettit@ovn.org X-ASG-Orig-Subj: [##CM-V1-406030426##]Re: [ovs-dev] [PATCH] ovn-northd: Handle IPv4 addresses with prefixes in lport port security From: Justin Pettit In-Reply-To: Date: Thu, 7 Apr 2016 09:18:33 -0700 Message-Id: References: <570528E1.1010104@redhat.com> <4C99DA19-7A44-463B-86B1-58A2D257BABE@ovn.org> To: Numan Siddique X-Mailer: Apple Mail (2.3124) X-Barracuda-Connect: UNKNOWN[192.168.14.2] X-Barracuda-Start-Time: 1460045922 X-Barracuda-Encrypted: DHE-RSA-AES256-SHA X-Barracuda-URL: https://web.cudamail.com:443/cgi-mod/mark.cgi X-ASG-Whitelist: Header =?UTF-8?B?eFwtY3VkYW1haWxcLXdoaXRlbGlzdFwtdG8=?= X-Virus-Scanned: by bsmtpd at cudamail.com X-Barracuda-BRTS-Status: 1 Cc: ovs dev Subject: Re: [ovs-dev] [PATCH] ovn-northd: Handle IPv4 addresses with prefixes in lport port security X-BeenThere: dev@openvswitch.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@openvswitch.org Sender: "dev" > On Apr 6, 2016, at 11:26 PM, Numan Siddique wrote: > > > ​Thanks for the comments Justin. I tried a similar approach. It will not work in the cases where the port security address also has a prefix defined. > For example with port security - "00:00:00:00:00:02 10.0.0.4/24", the ovn lexer parser is throwing the below error, > > ------- > lflow|WARN|error parsing match "outport == "sw0-port2" && eth.dst == 00:00:00:00:00:02 && ip4.dst == {255.255.255.255, 224.0.0.0/4, 10.0.0.4/24}": Value contains unmasked 1-bits. > ------ Ah, it should probably be added to the unit tests to make sure we don't reintroduce a problem. (Thanks for writing unit tests, by the way.) What if you apply the mask first like the patch at the end of this message? I also expanded your unit tests to include a check for the issue you mentioned. --Justin -=-=-=-=-=-=- diff --git a/ovn/northd/ovn-northd.c b/ovn/northd/ovn-northd.c index 302cc1d..e60f72e 100644 --- a/ovn/northd/ovn-northd.c +++ b/ovn/northd/ovn-northd.c @@ -1179,8 +1179,11 @@ build_port_security_nd(struct ovn_port *op, struct hmap * if (ps.n_ipv4_addrs) { ds_put_cstr(&match, " && ("); for (size_t i = 0; i < ps.n_ipv4_addrs; i++) { - ds_put_format(&match, "arp.spa == "IP_FMT" || ", - IP_ARGS(ps.ipv4_addrs[i].addr)); + ovs_be32 mask = be32_prefix_mask(ps.ipv4_addrs[i].plen); + ds_put_cstr(&match, "arp.spa == "); + ip_format_masked(ps.ipv4_addrs[i].addr & mask, mask, + &match); + ds_put_cstr(&match, " || "); } ds_chomp(&match, ' '); ds_chomp(&match, '|'); @@ -1264,7 +1267,9 @@ build_port_security_ip(enum ovn_pipeline pipeline, struct } for (int i = 0; i < ps.n_ipv4_addrs; i++) { - ds_put_format(&match, IP_FMT", ", IP_ARGS(ps.ipv4_addrs[i].addr + ovs_be32 mask = be32_prefix_mask(ps.ipv4_addrs[i].plen); + ip_format_masked(ps.ipv4_addrs[i].addr & mask, mask, &match); + ds_put_cstr(&match, ", "); } /* Replace ", " by "}". */ diff --git a/tests/ovn.at b/tests/ovn.at index 22121e1..d8bc395 100644 --- a/tests/ovn.at +++ b/tests/ovn.at @@ -1930,6 +1930,27 @@ for i in 1 2 3; do test_ipv6 ${i}3 f00000000${i}${i}3 f00000000021 $sip $tip done +# configure lport13 to send and received IPv4 packets with an address range +ovn-nbctl lport-set-port-security lp13 "f0:00:00:00:00:13 192.168.0.13 10.0.0.4 + +sip=`ip_to_hex 10 0 0 14` +tip=`ip_to_hex 192 168 0 23` +# IPv4 packet from lport13 with src ip 10.0.0.14 destined to lport23 +# with dst ip 192.168.0.23 should be allowed +test_ip 13 f00000000013 f00000000023 $sip $tip 23 + +sip=`ip_to_hex 192 168 0 33` +tip=`ip_to_hex 10 0 0 15` +# IPv4 packet from lport33 with src ip 192.168.0.33 destined to lport13 +# with dst ip 10.0.0.15 should be received by lport13 +test_ip 33 f00000000033 f00000000013 $sip $tip 13 + +sip=`ip_to_hex 10 0 0 13` +tip=`ip_to_hex 192 168 0 22` +# arp packet with inner ip 10.0.0.13 should be allowed for lport13 +test_arp 13 f00000000013 f00000000013 $sip $tip 0 f00000000022 + + # Allow some time for packet forwarding.