X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Fmap%2Fip4_map_t.c;h=a64b767c9083d5bb22422cbcf29bf97f878276e6;hb=9be93c8f85d752930566a1d37e9f4841ca78861f;hp=c6b091294bbaa0ba01c4f5a30c8475187aeba95a;hpb=bf4d126b811c6ad00068fd04af652c982dc289c1;p=vpp.git

diff --git a/src/plugins/map/ip4_map_t.c b/src/plugins/map/ip4_map_t.c
index c6b091294bb..a64b767c908 100644
--- a/src/plugins/map/ip4_map_t.c
+++ b/src/plugins/map/ip4_map_t.c
@@ -736,6 +736,14 @@ ip4_map_t (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
 	  ip4_map_t_classify (p0, d0, ip40, ip4_len0, &map_port0, &error0,
 			      &next0);
 
+	  /* Verify that port is not among the well-known ports */
+	  if ((d0->psid_length > 0 && d0->psid_offset > 0)
+	      && (clib_net_to_host_u16 (map_port0) <
+		  (0x1 << (16 - d0->psid_offset))))
+	    {
+	      error0 = MAP_ERROR_SEC_CHECK;
+	    }
+
 	  //Add MAP-T pseudo header in front of the packet
 	  vlib_buffer_advance (p0, -sizeof (*pheader0));
 	  pheader0 = vlib_buffer_get_current (p0);