X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipip%2Fnode.c;h=6171d3e5d71cdb989cad3715a903d6cc948785a4;hb=2f54c27f7fd0d2c24e7d6b1d48809e8b58ec1abf;hp=f24ea97b2cdc202728de0c916532adee1cef47d9;hpb=298c69510ff4b64a262d465eb8877c4e7f4e60e0;p=vpp.git

diff --git a/src/vnet/ipip/node.c b/src/vnet/ipip/node.c
index f24ea97b2cd..6171d3e5d71 100644
--- a/src/vnet/ipip/node.c
+++ b/src/vnet/ipip/node.c
@@ -65,7 +65,7 @@ ipip_input (vlib_main_t * vm, vlib_node_runtime_t * node,
   ipip_main_t *gm = &ipip_main;
   u32 n_left_from, next_index, *from, *to_next, n_left_to_next;
   u32 tunnel_sw_if_index = ~0;
-  u32 thread_index = vlib_get_thread_index ();
+  u32 thread_index = vm->thread_index;
   u32 len;
   vnet_interface_main_t *im = &gm->vnet_main->interface_main;
 
@@ -99,6 +99,14 @@ ipip_input (vlib_main_t * vm, vlib_node_runtime_t * node,
 	  if (is_ipv6)
 	    {
 	      ip60 = vlib_buffer_get_current (b0);
+	      /* Check for outer fragmentation */
+	      if (ip60->protocol == IP_PROTOCOL_IPV6_FRAGMENTATION)
+		{
+		  next0 = IPIP_INPUT_NEXT_DROP;
+		  b0->error = node->errors[IPIP_ERROR_FRAGMENTED_PACKET];
+		  goto drop;
+		}
+
 	      vlib_buffer_advance (b0, sizeof (*ip60));
 	      ip_set (&src0, &ip60->src_address, false);
 	      ip_set (&dst0, &ip60->dst_address, false);
@@ -108,6 +116,14 @@ ipip_input (vlib_main_t * vm, vlib_node_runtime_t * node,
 	  else
 	    {
 	      ip40 = vlib_buffer_get_current (b0);
+	      /* Check for outer fragmentation */
+	      if (ip40->flags_and_fragment_offset &
+		  clib_host_to_net_u16 (IP4_HEADER_FLAG_MORE_FRAGMENTS))
+		{
+		  next0 = IPIP_INPUT_NEXT_DROP;
+		  b0->error = node->errors[IPIP_ERROR_FRAGMENTED_PACKET];
+		  goto drop;
+		}
 	      vlib_buffer_advance (b0, sizeof (*ip40));
 	      ip_set (&src0, &ip40->src_address, true);
 	      ip_set (&dst0, &ip40->dst_address, true);