summaryrefslogtreecommitdiffstats
path: root/src/vnet/ip/ip4_error.h
diff options
context:
space:
mode:
authorKlement Sekera <ksekera@cisco.com>2019-05-16 14:35:46 +0200
committerOle Trøan <otroan@employees.org>2019-05-20 12:13:11 +0000
commit3a343d42d7bd90753ea6ed48fe750a7a209b1ddf (patch)
treeba831c36c69365d67a2d20d7a6d447b831a1b88e /src/vnet/ip/ip4_error.h
parentb388e1a50603a07e20007141221ca4f4a18ab698 (diff)
reassembly: prevent long chain attack
limit max # of fragments to 3 per packet by default add API option to configure the limit at runtime Change-Id: Ie4b9507bf5c6095b9a5925972b37fe0032f4f9e8 Signed-off-by: Klement Sekera <ksekera@cisco.com>
Diffstat (limited to 'src/vnet/ip/ip4_error.h')
-rw-r--r--src/vnet/ip/ip4_error.h2
1 files changed, 2 insertions, 0 deletions
diff --git a/src/vnet/ip/ip4_error.h b/src/vnet/ip/ip4_error.h
index badcc6609e9..d3bf6d79714 100644
--- a/src/vnet/ip/ip4_error.h
+++ b/src/vnet/ip/ip4_error.h
@@ -86,6 +86,8 @@
/* Errors signalled by ip4-reassembly */ \
_ (REASS_DUPLICATE_FRAGMENT, "duplicate/overlapping fragments") \
_ (REASS_LIMIT_REACHED, "drops due to concurrent reassemblies limit") \
+ _ (REASS_FRAGMENT_CHAIN_TOO_LONG, "fragment chain too long (drop)") \
+ _ (REASS_NO_BUF, "out of buffers (drop)") \
_ (REASS_MALFORMED_PACKET, "malformed packets") \
_ (REASS_INTERNAL_ERROR, "drops due to internal reassembly error")