secchan: Retain original input port for NXAST_RESUBMIT action.

The NXAST_RESUBMIT action causes a secondary lookup in the flow table with
a different input port value.  However, we want to retain the original
input port for processing the result of that secondary lookup.  Otherwise,
output to OFPP_IN_PORT will send the packet to the wrong port, and output
to the input port without specifying OFPP_IN_PORT will be mistakenly
allowed.

diff --git a/secchan/ofproto.c b/secchan/ofproto.c
index ccf4e40a0285ca1d819bede57b3858262500860b..5b0c504487d26052efc5f09dcab9e0e2709933df 100644 (file)
--- a/secchan/ofproto.c
+++ b/secchan/ofproto.c
@@ -1447,7 +1447,7 @@ xlate_table_action(const struct action_xlate_ctx *ctx, uint16_t in_port)
 
     nested_ctx.in = rule->actions;
     nested_ctx.n_in = rule->n_actions;
-    nested_ctx.flow = &flow;
+    nested_ctx.flow = ctx->flow;
     nested_ctx.ofproto = NULL; /* Prevent recursion. */
     nested_ctx.out = ctx->out;
     do_xlate_actions(&nested_ctx);