From 3a343d42d7bd90753ea6ed48fe750a7a209b1ddf Mon Sep 17 00:00:00 2001 From: Klement Sekera Date: Thu, 16 May 2019 14:35:46 +0200 Subject: reassembly: prevent long chain attack limit max # of fragments to 3 per packet by default add API option to configure the limit at runtime Change-Id: Ie4b9507bf5c6095b9a5925972b37fe0032f4f9e8 Signed-off-by: Klement Sekera --- src/vnet/ip/ip4_error.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'src/vnet/ip/ip4_error.h') diff --git a/src/vnet/ip/ip4_error.h b/src/vnet/ip/ip4_error.h index badcc6609e9..d3bf6d79714 100644 --- a/src/vnet/ip/ip4_error.h +++ b/src/vnet/ip/ip4_error.h @@ -86,6 +86,8 @@ /* Errors signalled by ip4-reassembly */ \ _ (REASS_DUPLICATE_FRAGMENT, "duplicate/overlapping fragments") \ _ (REASS_LIMIT_REACHED, "drops due to concurrent reassemblies limit") \ + _ (REASS_FRAGMENT_CHAIN_TOO_LONG, "fragment chain too long (drop)") \ + _ (REASS_NO_BUF, "out of buffers (drop)") \ _ (REASS_MALFORMED_PACKET, "malformed packets") \ _ (REASS_INTERNAL_ERROR, "drops due to internal reassembly error") -- cgit 1.2.3-korg