VOL-3464: DHCP packets can be trapped to ONOS without Authentication
- ACLs can be sometimes have very broad classifiers to work around the limited number
of ACLs that can be installed on the BAL. This would mean that unwanted
packets can sometimes be trapped to host and could be used by the end user
for DDoS attacks by sending spurious packets that match broad classifier BAL ACLs.
This patch introduces some very low level checks on the trapped packets
at the openolt agent application. The packets could be trapped at the application
as a result of broad level BAL ACL classifiers, but the application
does more low checks derived from VOLTHA flow and only then allows the packets to
VOLTHA system if the low checks pass.
- Update BUILDING.md with details of installing PcapPlusPlus library.
- Bump version to 3.1.0
Change-Id: I53eee968c51659c31353eeb5d8d4e144a443c293
diff --git a/agent/src/core_utils.h b/agent/src/core_utils.h
index e4eec7f..8404912 100644
--- a/agent/src/core_utils.h
+++ b/agent/src/core_utils.h
@@ -98,7 +98,7 @@
Status install_acl(const acl_classifier_key acl_key);
Status remove_acl(int acl_id);
void formulate_acl_classifier_key(acl_classifier_key *key, const ::openolt::Classifier& classifier);
-Status handle_acl_rule_install(int32_t onu_id, uint64_t flow_id,
+Status handle_acl_rule_install(int32_t onu_id, uint64_t flow_id, int32_t gemport_id,
const std::string flow_type, int32_t access_intf_id,
int32_t network_intf_id,
const ::openolt::Classifier& classifier);
@@ -114,4 +114,6 @@
bool is_voltha_flow_installed(uint64_t voltha_flow_id );
const device_flow* get_device_flow(uint64_t voltha_flow_id);
const device_flow_params* get_device_flow_params(uint64_t voltha_flow_id);
+trap_to_host_packet_type get_trap_to_host_packet_type(const ::openolt::Classifier& classifier);
+bool is_packet_allowed(bcmolt_access_control_receive_eth_packet_data *data, int32_t gemport_id);
#endif // OPENOLT_CORE_UTILS_H_