summaryrefslogtreecommitdiffstats
path: root/src/vnet
diff options
context:
space:
mode:
authorNeale Ranns <nranns@cisco.com>2020-09-23 11:25:21 +0000
committerOle Tr�an <otroan@employees.org>2020-10-08 09:04:05 +0000
commit22eefd79a1817ce6d0da3b20412eb61ce718cbaf (patch)
treea3b4145fcd57f4284e1823329586ec73bdc80397 /src/vnet
parent47a3d9975fa3af7a7537b565d6511dadc0df61fb (diff)
ip-neighbor: Grat ARPs from different subnet are dropped
Type: test Signed-off-by: Neale Ranns <nranns@cisco.com> Change-Id: Id07e8981a903f11f50fb494a93d01815382025e4
Diffstat (limited to 'src/vnet')
-rw-r--r--src/vnet/arp/arp.c13
1 files changed, 8 insertions, 5 deletions
diff --git a/src/vnet/arp/arp.c b/src/vnet/arp/arp.c
index 14a1ae97d1e..6a32229adda 100644
--- a/src/vnet/arp/arp.c
+++ b/src/vnet/arp/arp.c
@@ -543,6 +543,8 @@ arp_reply (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
dst_fei = ip4_fib_table_lookup (ip4_fib_get (fib_index0),
&arp0->ip4_over_ethernet[1].ip4,
32);
+ conn_sw_if_index0 = fib_entry_get_resolving_interface (dst_fei);
+
switch (arp_dst_fib_check (dst_fei, &dst_flags))
{
case ARP_DST_FIB_ADJ:
@@ -554,10 +556,12 @@ arp_reply (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
* from spamming us with gratuitous ARPS that might otherwise
* blow our ARP cache
*/
- if (arp0->ip4_over_ethernet[0].ip4.as_u32 ==
- arp0->ip4_over_ethernet[1].ip4.as_u32)
- error0 =
- arp_learn (sw_if_index0, &arp0->ip4_over_ethernet[0]);
+ if (conn_sw_if_index0 != sw_if_index0)
+ error0 = ETHERNET_ARP_ERROR_l3_dst_address_not_local;
+ else if (arp0->ip4_over_ethernet[0].ip4.as_u32 ==
+ arp0->ip4_over_ethernet[1].ip4.as_u32)
+ error0 = arp_learn (sw_if_index0,
+ &arp0->ip4_over_ethernet[0]);
goto drop;
case ARP_DST_FIB_CONN:
/* destination is connected, continue to process */
@@ -615,7 +619,6 @@ arp_reply (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
}
/* Honor unnumbered interface, if any */
- conn_sw_if_index0 = fib_entry_get_resolving_interface (dst_fei);
if (sw_if_index0 != conn_sw_if_index0 ||
sw_if_index0 != fib_entry_get_resolving_interface (src_fei))
{