ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ip: reassembly: drop zero length fragments

Browse Source 
Zero length fragments are invalid and should be dropped. This patch adds
that.

Type: improvement
Change-Id: Ic6466c39ca8bf376efe06bb3b7f5d7f1ae812866
Signed-off-by: Klement Sekera <ksekera@cisco.com>
This commit is contained in:
Klement Sekera
2021-12-01 10:14:38 +00:00
committed by Ole Tr�an
parent b97bec0ae5
commit 755042dec0
4 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/vnet/ip/ip6_error.h
View File

@@ -89,6 +89,7 @@
_ (REASS_NO_BUF, "out of buffers (drop)") \
_ (REASS_TIMEOUT, "fragments dropped due to reassembly timeout") \
_ (REASS_INTERNAL_ERROR, "drops due to internal reassembly error") \
_ (REASS_INVALID_FRAG_LEN, "invalid fragment length") \
_ (REASS_UNSUPP_IP_PROTO, "unsupported ip protocol")
// clang-format on

8
src/vnet/ip/reass/ip6_full_reass.c
View File

@@ -41,6 +41,7 @@ typedef enum
IP6_FULL_REASS_RC_TOO_MANY_FRAGMENTS,
IP6_FULL_REASS_RC_NO_BUF,
IP6_FULL_REASS_RC_HANDOFF,
IP6_FULL_REASS_RC_INVALID_FRAG_LEN,
} ip6_full_reass_rc_t;
typedef struct
@@ -888,6 +889,10 @@ ip6_full_reass_update (vlib_main_t *vm, vlib_node_runtime_t *node,
u32 fragment_length =
vlib_buffer_length_in_chain (vm, fb) -
(fvnb->ip.reass.ip6_frag_hdr_offset + sizeof (*frag_hdr));
if (0 == fragment_length)
{
return IP6_FULL_REASS_RC_INVALID_FRAG_LEN;
}
u32 fragment_last = fvnb->ip.reass.fragment_last =
fragment_first + fragment_length - 1;
int more_fragments = ip6_frag_hdr_more (frag_hdr);
@@ -1207,6 +1212,9 @@ ip6_full_reassembly_inline (vlib_main_t * vm,
case IP6_FULL_REASS_RC_INTERNAL_ERROR:
counter = IP6_ERROR_REASS_INTERNAL_ERROR;
break;
case IP6_FULL_REASS_RC_INVALID_FRAG_LEN:
counter = IP6_ERROR_REASS_INVALID_FRAG_LEN;
break;
}
if (~0 != counter)
{

8
src/vnet/ip/reass/ip6_sv_reass.c
View File

@@ -41,6 +41,7 @@ typedef enum
IP6_SV_REASS_RC_TOO_MANY_FRAGMENTS,
IP6_SV_REASS_RC_INTERNAL_ERROR,
IP6_SV_REASS_RC_UNSUPP_IP_PROTO,
IP6_SV_REASS_RC_INVALID_FRAG_LEN,
} ip6_sv_reass_rc_t;
typedef struct
@@ -400,6 +401,10 @@ ip6_sv_reass_update (vlib_main_t *vm, vlib_node_runtime_t *node,
u32 fragment_length =
vlib_buffer_length_in_chain (vm, fb) -
(fvnb->ip.reass.ip6_frag_hdr_offset + sizeof (*frag_hdr));
if (0 == fragment_length)
{
return IP6_SV_REASS_RC_INVALID_FRAG_LEN;
}
u32 fragment_last = fvnb->ip.reass.fragment_last =
fragment_first + fragment_length - 1;
fvnb->ip.reass.range_first = fragment_first;
@@ -667,6 +672,9 @@ ip6_sv_reassembly_inline (vlib_main_t * vm,
case IP6_SV_REASS_RC_INTERNAL_ERROR:
counter = IP6_ERROR_REASS_INTERNAL_ERROR;
break;
case IP6_SV_REASS_RC_INVALID_FRAG_LEN:
counter = IP6_ERROR_REASS_INVALID_FRAG_LEN;
break;
}
if (~0 != counter)
{

18
test/test_reassembly.py
View File

@@ -1392,6 +1392,15 @@ class TestIPv6Reassembly(VppTestCase):
self.assertIn(ICMPv6ParamProblem, icmp)
self.assert_equal(icmp[ICMPv6ParamProblem].code, 3, "ICMP code")
def test_truncated_fragment(self):
""" truncated fragment """
pkt = (Ether(src=self.pg0.local_mac, dst=self.pg0.remote_mac) /
IPv6(src=self.pg0.remote_ip6, dst=self.pg0.local_ip6,
nh=44, plen=2) /
IPv6ExtHdrFragment(nh=6))
self.send_and_assert_no_replies(self.pg0, [pkt], self.pg0)
def test_invalid_frag_size(self):
""" fragment size not a multiple of 8 """
p = (Ether(dst=self.src_if.local_mac, src=self.src_if.remote_mac) /
@@ -1917,6 +1926,15 @@ class TestIPv6SVReassembly(VppTestCase):
IPv6ExtHdrFragment(id=1)/ICMPv6EchoRequest())
rx = self.send_and_expect(self.src_if, [pkt], self.dst_if)
def test_truncated_fragment(self):
""" truncated fragment """
pkt = (Ether(src=self.pg0.local_mac, dst=self.pg0.remote_mac) /
IPv6(src=self.pg0.remote_ip6, dst=self.pg0.local_ip6,
nh=44, plen=2) /
IPv6ExtHdrFragment(nh=6))
self.send_and_assert_no_replies(self.pg0, [pkt], self.pg0)
class TestIPv4ReassemblyLocalNode(VppTestCase):
""" IPv4 Reassembly for packets coming to ip4-local node """