[ovs-dev] [PATCH] datapath: Return EEXIST on overlapping new flow request

[Andy Zhou]

Flow update still requires unmasked key to match. If not,
return EINVAL.

CC: Justin Pettit <jpettit at nicira.com>
Signed-off-by: Andy Zhou <azhou at nicira.com>
---
 datapath/datapath.c |   11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/datapath/datapath.c b/datapath/datapath.c
index ee3d5e4..a514e74 100644
--- a/datapath/datapath.c
+++ b/datapath/datapath.c
@@ -1343,12 +1343,6 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info)
 		/* We found a matching flow. */
 		struct sw_flow_actions *old_acts;
 
-		/* Make sure the it has the same unmasked key. */
-		if (!ovs_flow_cmp_unmasked_key(flow, &key, match.range.end)) {
-			error = -EINVAL;
-			goto err_unlock_ovs;
-		}
-
 		/* Bail out if we're not allowed to modify an existing flow.
 		 * We accept NLM_F_CREATE in place of the intended NLM_F_EXCL
 		 * because Generic Netlink treats the latter as a dump
@@ -1360,6 +1354,11 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info)
 		    info->nlhdr->nlmsg_flags & (NLM_F_CREATE | NLM_F_EXCL))
 			goto err_unlock_ovs;
 
+		/* The unmasked key has to be the same for flow updates. */
+		error = -EINVAL;
+		if (!ovs_flow_cmp_unmasked_key(flow, &key, match.range.end))
+			goto err_unlock_ovs;
+
 		/* Update actions. */
 		old_acts = ovsl_dereference(flow->sf_acts);
 		rcu_assign_pointer(flow->sf_acts, acts);
-- 
1.7.9.5