diff options
| author |   Andrew Yourtchenko <ayourtch@gmail.com> | 2017-04-04 14:10:40 +0000 |
|---|---|---|
| committer |   Damjan Marion <dmarion.lists@gmail.com> | 2017-04-04 19:45:05 +0000 |
| commit | 9fc0c26c6b28fd6c8b8142ea52f52eafa7e8c7ac (patch) | |
| tree | cbf36ed260babdfffd1c3451e2572e7bb168643f /src/vnet/classify/policer_classify.h | |
| parent | ec06222ae189fe8d84b63410130fff04bf446573 (diff) | |
acl-plugin: make the IPv4/IPv6 non-first fragment handling in line with ACL (VPP-682)
This fixes the previously-implicit "drop all non-first fragments" behavior
to be more in line with security rules: a non-first fragment is treated
for the purposes of matching the ACL as a packet with the port
match succeeding. This allows to change the behavior to permit
the fragmented packets for the default "permit specific rules"
ruleset, but also gives the flexibility to block the non-initial
fragments by inserting into the begining a bogus rule
which would deny the L4 traffic.
Also, add a knob which allows to potentially turn this behavior off
in case of a dire need (and revert to dropping all non-initial fragments),
via a debug CLI.
Change-Id: I546b372b65ff2157d9c68b1d32f9e644f1dd71b4
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
Diffstat (limited to 'src/vnet/classify/policer_classify.h')
0 files changed, 0 insertions, 0 deletions