nat: fix counters increment for output feature - vpp

diff options

author	Alexander Chernavin <achernavin@netgate.com>	2021-07-06 06:08:26 -0400
committer	Matthew Smith <mgsmith@netgate.com>	2021-08-17 21:32:14 +0000
commit	4de12b9c62757f7297c6ac5c7eedff17082f4ee8 (patch)
tree	9435894aa5f601220efde2d9a414586cd9a79cad /src/plugins/dns/dns.api
parent	b93782b36643714a8dcb53e2e396da642b1b0053 (diff)

nat: fix counters increment for output feature

Type: fix The NAT plugin stores packet counters and a counter represents a vector indexed by interface index. When an interface is assigned a NAT role, the counters are validated to be long enough for the given interface index. When a packet traverses NAT in2out and output feature is disabled, the appropriate counters are updated by the RX interface index. In this case, translation happens on the inside interface and its index was ensured to be valid in all of the counters during NAT role assignment. When a packet traverses NAT in2out and output feature is enabled, the appropriate counters are updated by the RX interface index too. In this case, translation happens on the outside interface and the packet could be received on any interface, even with no NAT role assigned. If that's the case and its index is greater than the greatest index validated in the counters, a new counter value will be written to memory that does not belong to the counter. As a result, a crash will occur at some point. With this change, use TX interface index to update the counters when output feature is enabled. TX interface is an actual interface where translation happens and its index is always valid in the counters. Signed-off-by: Alexander Chernavin <achernavin@netgate.com> Change-Id: I53a52af949fe96419e1b5fef4134ab4062198f51

Diffstat (limited to 'src/plugins/dns/dns.api')

0 files changed, 0 insertions, 0 deletions

/* * mactime_device.h - device table entry * * Copyright (c) 2018 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #ifndef included_mactime_device_h #define included_mactime_device_h #include <vppinfra/time_range.h> #define MACTIME_RANGE_TYPE_DROP 0 #define MACTIME_RANGE_TYPE_ALLOW 1 typedef struct { u8 *device_name; u8 mac_address[6]; u64 data_quota; u64 data_used_in_range; u32 flags; u32 pool_index; f64 last_seen; clib_timebase_range_t *ranges; } mactime_device_t; /** Always drop packets from this device */ #define MACTIME_DEVICE_FLAG_STATIC_DROP (1<<0) #define MACTIME_DEVICE_FLAG_STATIC_ALLOW (1<<1) #define MACTIME_DEVICE_FLAG_DYNAMIC_DROP (1<<2) #define MACTIME_DEVICE_FLAG_DYNAMIC_ALLOW (1<<3) #define MACTIME_DEVICE_FLAG_DYNAMIC_ALLOW_QUOTA (1<<4) #define MACTIME_DEVICE_FLAG_DROP_UDP_10001 (1<<5) #endif /* included_mactime_device_h */ /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */


context:
space:
mode: