aboutsummaryrefslogtreecommitdiffstats
path: root/src/plugins/map/ip6_map_t.c
diff options
context:
space:
mode:
authorVladimir Ratnikov <vratnikov@netgate.com>2020-03-18 08:20:08 -0400
committerOle Trøan <otroan@employees.org>2020-03-25 08:19:14 +0000
commitb1bd8760ce9b1416c8a7f12e411cfcf60de2929f (patch)
tree7eeed964b15adef909f474c18135e1736186e5d3 /src/plugins/map/ip6_map_t.c
parent753b96f31b0f34983bbc213516f1a05825d868a8 (diff)
map: fix hop limit expiration at br
Before this patch, packet was dropped in ip4-input, but ip4-map-t node dropped response due to 'security check failed' This patch checkes if hop_limit==1 and sets error and next frame and sends icmp6 response correctly Type: fix Signed-off-by: Vladimir Ratnikov <vratnikov@netgate.com> Change-Id: I85a6af58205b05754ef8c45a94817bb84f915c85
Diffstat (limited to 'src/plugins/map/ip6_map_t.c')
-rw-r--r--src/plugins/map/ip6_map_t.c14
1 files changed, 13 insertions, 1 deletions
diff --git a/src/plugins/map/ip6_map_t.c b/src/plugins/map/ip6_map_t.c
index ce973ea2e7f..874a14c99ed 100644
--- a/src/plugins/map/ip6_map_t.c
+++ b/src/plugins/map/ip6_map_t.c
@@ -544,6 +544,18 @@ ip6_map_t (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
ip6_map_t_embedded_address (d0, &ip60->dst_address);
vnet_buffer (p0)->map_t.mtu = d0->mtu ? d0->mtu : ~0;
+ map_port0 = -1;
+
+ if (PREDICT_FALSE (ip60->hop_limit == 1))
+ {
+ icmp6_error_set_vnet_buffer (p0, ICMP6_time_exceeded,
+ ICMP6_time_exceeded_ttl_exceeded_in_transit,
+ 0);
+ p0->error = error_node->errors[MAP_ERROR_TIME_EXCEEDED];
+ next0 = IP6_MAPT_NEXT_ICMP;
+ goto trace;
+ }
+
if (PREDICT_FALSE
(ip6_parse (vm, p0, ip60, p0->current_length,
&(vnet_buffer (p0)->map_t.v6.l4_protocol),
@@ -554,7 +566,6 @@ ip6_map_t (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
error0 == MAP_ERROR_NONE ? MAP_ERROR_MALFORMED : error0;
}
- map_port0 = -1;
l4_len0 =
(u32) clib_net_to_host_u16 (ip60->payload_length) +
sizeof (*ip60) - vnet_buffer (p0)->map_t.v6.l4_offset;
@@ -659,6 +670,7 @@ ip6_map_t (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
}
p0->error = error_node->errors[error0];
+ trace:
if (PREDICT_FALSE (p0->flags & VLIB_BUFFER_IS_TRACED))
{
map_add_trace (vm, node, p0,