Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Drop ICMP error packets for ICMP errors
In case of ICMP error packets for ICMP errors, we were not initializing
flow key and trying to form a flow out of that key, resulting in wrong
key length and corrupted flow entry(s).

We will drop such packets.

Change-Id: Idae46a7e128482ad89da8b5bd1bd0ef6b17ef28e
Closes-BUG: #1556363
  • Loading branch information
anandhk-juniper committed Mar 12, 2016
1 parent 571f4f2 commit f589486
Showing 1 changed file with 11 additions and 2 deletions.
13 changes: 11 additions & 2 deletions dp-core/vr_proto_ip.c
Expand Up @@ -841,6 +841,8 @@ vr_inet_proto_flow(struct vrouter *router, unsigned short vrf,
struct vr_packet *pkt, uint16_t vlan, struct vr_ip *ip,
struct vr_flow *flow_p)
{
int ret = 0;

unsigned short *t_hdr, sport, dport;
unsigned short nh_id;

Expand All @@ -851,10 +853,17 @@ vr_inet_proto_flow(struct vrouter *router, unsigned short vrf,
if (ip->ip_proto == VR_IP_PROTO_ICMP) {
icmph = (struct vr_icmp *)t_hdr;
if (vr_icmp_error(icmph)) {
/* we will generate a flow only for the first icmp error */
if ((unsigned char *)ip == pkt_network_header(pkt)) {
vr_inet_proto_flow(router, vrf, pkt, vlan,
ret = vr_inet_proto_flow(router, vrf, pkt, vlan,
(struct vr_ip *)(icmph + 1), flow_p);
if (ret)
return ret;

vr_inet_flow_swap(flow_p);
} else {
/* for icmp error for icmp error, we will drop the packet */
return -1;
}

return 0;
Expand Down Expand Up @@ -964,7 +973,7 @@ vr_inet_flow_lookup(struct vrouter *router, struct vr_packet *pkt,
vr_enqueue_to_assembler(router, pkt, fmd);
} else {
/* unlikely to be hit. you can safely discount misc drops here */
vr_pfree(pkt, VP_DROP_FRAGMENTS);
vr_pfree(pkt, VP_DROP_MISC);
}
return FLOW_CONSUMED;
}
Expand Down

0 comments on commit f589486

Please sign in to comment.