[ovs-dev,IPv6,v2,03/10] ovn-controller: Tighten "nd" definition, add "nd_ns" and "nd_na".
diff mbox

Message ID 1469773580-33112-3-git-send-email-jpettit@ovn.org
State Accepted
Headers show

Commit Message

Justin Pettit July 29, 2016, 6:26 a.m. UTC
According to RFC 4861, Neighbor Discovery messages should only match
when the Hop Limit is 255 to prevent off-link senders from sending ND
messages.  This commit limits matching to that Hop Limit.

It also introduces Neighbor Discovery Solicitation ("nd_ns") and
Advertisement ("nd_na") definitions.

The "nd.sll" and "nd.tll" only apply to "nd_ns" and "nd_na",
respectively.  This commit limits those symbols appropriately.  (Note
that Router and Redirect also use those fields, so we will need to
include them as well when they are added.)

Signed-off-by: Justin Pettit <jpettit@ovn.org>

---
v1->v2: Switch to "nd_ns" and "nd_na".

 ovn/controller/lflow.c | 12 +++++++-----
 ovn/ovn-sb.xml         |  4 +++-
 tests/test-ovn.c       | 13 ++++++++-----
 3 files changed, 18 insertions(+), 11 deletions(-)

Comments

Ben Pfaff July 29, 2016, 4:53 p.m. UTC | #1
On Thu, Jul 28, 2016 at 11:26:13PM -0700, Justin Pettit wrote:
> According to RFC 4861, Neighbor Discovery messages should only match
> when the Hop Limit is 255 to prevent off-link senders from sending ND
> messages.  This commit limits matching to that Hop Limit.
> 
> It also introduces Neighbor Discovery Solicitation ("nd_ns") and
> Advertisement ("nd_na") definitions.
> 
> The "nd.sll" and "nd.tll" only apply to "nd_ns" and "nd_na",
> respectively.  This commit limits those symbols appropriately.  (Note
> that Router and Redirect also use those fields, so we will need to
> include them as well when they are added.)
> 
> Signed-off-by: Justin Pettit <jpettit@ovn.org>

Thanks.

Acked-by: Ben Pfaff <blp@ovn.org>

Patch
diff mbox

diff --git a/ovn/controller/lflow.c b/ovn/controller/lflow.c
index a4f3322..c06bf18 100644
--- a/ovn/controller/lflow.c
+++ b/ovn/controller/lflow.c
@@ -158,12 +158,14 @@  lflow_init(void)
     expr_symtab_add_field(&symtab, "arp.tha", MFF_ARP_THA, "arp", false);
 
     expr_symtab_add_predicate(&symtab, "nd",
-                              "icmp6.type == {135, 136} && icmp6.code == 0");
+              "icmp6.type == {135, 136} && icmp6.code == 0 && ip.ttl == 255");
+    expr_symtab_add_predicate(&symtab, "nd_ns",
+              "icmp6.type == 135 && icmp6.code == 0 && ip.ttl == 255");
+    expr_symtab_add_predicate(&symtab, "nd_na",
+              "icmp6.type == 136 && icmp6.code == 0 && ip.ttl == 255");
     expr_symtab_add_field(&symtab, "nd.target", MFF_ND_TARGET, "nd", false);
-    expr_symtab_add_field(&symtab, "nd.sll", MFF_ND_SLL,
-              "nd && icmp6.type == 135", false);
-    expr_symtab_add_field(&symtab, "nd.tll", MFF_ND_TLL,
-              "nd && icmp6.type == 136", false);
+    expr_symtab_add_field(&symtab, "nd.sll", MFF_ND_SLL, "nd_ns", false);
+    expr_symtab_add_field(&symtab, "nd.tll", MFF_ND_TLL, "nd_na", false);
 
     expr_symtab_add_predicate(&symtab, "tcp", "ip.proto == 6");
     expr_symtab_add_field(&symtab, "tcp.src", MFF_TCP_SRC, "tcp", false);
diff --git a/ovn/ovn-sb.xml b/ovn/ovn-sb.xml
index c5f236e..01b7d45 100644
--- a/ovn/ovn-sb.xml
+++ b/ovn/ovn-sb.xml
@@ -837,7 +837,9 @@ 
         <li><code>ip.later_frag</code> expands to <code>ip.frag[1]</code></li>
         <li><code>ip.first_frag</code> expands to <code>ip.is_frag &amp;&amp; !ip.later_frag</code></li>
         <li><code>arp</code> expands to <code>eth.type == 0x806</code></li>
-        <li><code>nd</code> expands to <code>icmp6.type == {135, 136} &amp;&amp; icmp6.code == 0</code></li>
+        <li><code>nd</code> expands to <code>icmp6.type == {135, 136} &amp;&amp; icmp6.code == 0 &amp;&amp; ip.ttl == 255</code></li>
+        <li><code>nd_ns</code> expands to <code>icmp6.type == 135 &amp;&amp; icmp6.code == 0 &amp;&amp; ip.ttl == 255</code></li>
+        <li><code>nd_na</code> expands to <code>icmp6.type == 136 &amp;&amp; icmp6.code == 0 &amp;&amp; ip.ttl == 255</code></li>
         <li><code>tcp</code> expands to <code>ip.proto == 6</code></li>
         <li><code>udp</code> expands to <code>ip.proto == 17</code></li>
         <li><code>sctp</code> expands to <code>ip.proto == 132</code></li>
diff --git a/tests/test-ovn.c b/tests/test-ovn.c
index ffb4e50..e226b3b 100644
--- a/tests/test-ovn.c
+++ b/tests/test-ovn.c
@@ -212,12 +212,15 @@  create_symtab(struct shash *symtab)
     expr_symtab_add_field(symtab, "arp.tpa", MFF_ARP_TPA, "arp", false);
     expr_symtab_add_field(symtab, "arp.tha", MFF_ARP_THA, "arp", false);
 
-    expr_symtab_add_predicate(symtab, "nd", "icmp6.type == {135, 136} && icmp6.code == 0");
+    expr_symtab_add_predicate(symtab, "nd",
+              "icmp6.type == {135, 136} && icmp6.code == 0 && ip.ttl == 255");
+    expr_symtab_add_predicate(symtab, "nd_ns",
+              "icmp6.type == 135 && icmp6.code == 0 && ip.ttl == 255");
+    expr_symtab_add_predicate(symtab, "nd_na",
+              "icmp6.type == 136 && icmp6.code == 0 && ip.ttl == 255");
     expr_symtab_add_field(symtab, "nd.target", MFF_ND_TARGET, "nd", false);
-    expr_symtab_add_field(symtab, "nd.sll", MFF_ND_SLL,
-              "nd && icmp6.type == 135", false);
-    expr_symtab_add_field(symtab, "nd.tll", MFF_ND_TLL,
-              "nd && icmp6.type == 136", false);
+    expr_symtab_add_field(symtab, "nd.sll", MFF_ND_SLL, "nd_ns", false);
+    expr_symtab_add_field(symtab, "nd.tll", MFF_ND_TLL, "nd_na", false);
 
     expr_symtab_add_predicate(symtab, "tcp", "ip.proto == 6");
     expr_symtab_add_field(symtab, "tcp.src", MFF_TCP_SRC, "tcp", false);