Merge "Drop ICMP error packets for ICMP errors" into R2.20

Juniper · Mar 15, 2016 · ff6eacc · ff6eacc
2 parents 4c7e245 + 0171abb
commit ff6eacc
Showing 1 changed file with 11 additions and 2 deletions.
diff --git a/dp-core/vr_proto_ip.c b/dp-core/vr_proto_ip.c
@@ -872,6 +872,8 @@ vr_inet_proto_flow(struct vrouter *router, unsigned short vrf,
         struct vr_packet *pkt, uint16_t vlan, struct vr_ip *ip,
         struct vr_flow *flow_p)
 {
+    int ret = 0;
+
     unsigned short *t_hdr, sport, dport;
     unsigned short nh_id;
 
@@ -883,10 +885,17 @@ vr_inet_proto_flow(struct vrouter *router, unsigned short vrf,
     if (ip->ip_proto == VR_IP_PROTO_ICMP) {
         icmph = (struct vr_icmp *)t_hdr;
         if (vr_icmp_error(icmph)) {
+            /* we will generate a flow only for the first icmp error */
             if ((unsigned char *)ip == pkt_network_header(pkt)) {
-                vr_inet_proto_flow(router, vrf, pkt, vlan,
+                ret = vr_inet_proto_flow(router, vrf, pkt, vlan,
                         (struct vr_ip *)(icmph + 1), flow_p);
+                if (ret)
+                    return ret;
+
                 vr_inet_flow_swap(flow_p);
+            } else {
+                /* for icmp error for icmp error, we will drop the packet */
+                return -1;
             }
 
             return 0;
@@ -1016,7 +1025,7 @@ vr_inet_flow_lookup(struct vrouter *router, struct vr_packet *pkt,
             vr_enqueue_to_assembler(router, pkt, fmd);
         } else {
             /* unlikely to be hit. you can safely discount misc drops here */
-            vr_pfree(pkt, VP_DROP_FRAGMENTS);
+            vr_pfree(pkt, VP_DROP_MISC);
         }
         return FLOW_CONSUMED;
     }