summaryrefslogtreecommitdiffstats
path: root/src/plugins/acl/acl.h
diff options
context:
space:
mode:
authorAndrew Yourtchenko <ayourtch@gmail.com>2017-04-04 14:10:40 +0000
committerDamjan Marion <dmarion.lists@gmail.com>2017-04-06 15:30:21 +0000
commitd1b05647427c79cfd5322991bbe663fae65f37b5 (patch)
treec7449b51cd46575c7978d8cac795b15a84f4163a /src/plugins/acl/acl.h
parent0eb2b16f95c0c43302be79a1c4df8b828ac97e37 (diff)
acl-plugin: make the IPv4/IPv6 non-first fragment handling in line with ACL (VPP-682)
This fixes the previously-implicit "drop all non-first fragments" behavior to be more in line with security rules: a non-first fragment is treated for the purposes of matching the ACL as a packet with the port match succeeding. This allows to change the behavior to permit the fragmented packets for the default "permit specific rules" ruleset, but also gives the flexibility to block the non-initial fragments by inserting into the begining a bogus rule which would deny the L4 traffic. Also, add a knob which allows to potentially turn this behavior off in case of a dire need (and revert to dropping all non-initial fragments), via a debug CLI. Change-Id: I546b372b65ff2157d9c68b1d32f9e644f1dd71b4 Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com> (cherry picked from commit 9fc0c26c6b28fd6c8b8142ea52f52eafa7e8c7ac)
Diffstat (limited to 'src/plugins/acl/acl.h')
-rw-r--r--src/plugins/acl/acl.h5
1 files changed, 4 insertions, 1 deletions
diff --git a/src/plugins/acl/acl.h b/src/plugins/acl/acl.h
index f5a1fe0f934..d708c521dfa 100644
--- a/src/plugins/acl/acl.h
+++ b/src/plugins/acl/acl.h
@@ -181,6 +181,9 @@ typedef struct {
/* EH values that we can skip over */
uword *fa_ipv6_known_eh_bitmap;
+ /* whether to match L4 ACEs with ports on the non-initial fragment */
+ int l4_match_nonfirst_fragment;
+
/* conn table per-interface conn table parameters */
u32 fa_conn_table_hash_num_buckets;
uword fa_conn_table_hash_memory_size;
@@ -235,6 +238,7 @@ typedef struct {
_(HOPBYHOP , 0 , "IPv6ExtHdrHopByHop") \
_(ROUTING , 43 , "IPv6ExtHdrRouting") \
_(DESTOPT , 60 , "IPv6ExtHdrDestOpt") \
+ _(FRAGMENT , 44 , "IPv6ExtHdrFragment") \
_(MOBILITY , 135, "Mobility Header") \
_(HIP , 139, "Experimental use Host Identity Protocol") \
_(SHIM6 , 140, "Shim6 Protocol") \
@@ -247,7 +251,6 @@ typedef struct {
Also, Fragment header needs special processing.
_(NONEXT , 59 , "NoNextHdr") \
- _(FRAGMENT , 44 , "IPv6ExtHdrFragment") \
ESP is hiding its internal format, so no point in trying to go past it.