X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipip%2Fnode.c;h=6171d3e5d71cdb989cad3715a903d6cc948785a4;hb=53fffa1;hp=d55b91a0b93c87180c797448967c99abf6dd3f2a;hpb=067cd6229a47ea3ba8b59a2a04090e80afb5bd2c;p=vpp.git

diff --git a/src/vnet/ipip/node.c b/src/vnet/ipip/node.c
index d55b91a0b93..6171d3e5d71 100644
--- a/src/vnet/ipip/node.c
+++ b/src/vnet/ipip/node.c
@@ -99,6 +99,14 @@ ipip_input (vlib_main_t * vm, vlib_node_runtime_t * node,
 	  if (is_ipv6)
 	    {
 	      ip60 = vlib_buffer_get_current (b0);
+	      /* Check for outer fragmentation */
+	      if (ip60->protocol == IP_PROTOCOL_IPV6_FRAGMENTATION)
+		{
+		  next0 = IPIP_INPUT_NEXT_DROP;
+		  b0->error = node->errors[IPIP_ERROR_FRAGMENTED_PACKET];
+		  goto drop;
+		}
+
 	      vlib_buffer_advance (b0, sizeof (*ip60));
 	      ip_set (&src0, &ip60->src_address, false);
 	      ip_set (&dst0, &ip60->dst_address, false);
@@ -108,6 +116,14 @@ ipip_input (vlib_main_t * vm, vlib_node_runtime_t * node,
 	  else
 	    {
 	      ip40 = vlib_buffer_get_current (b0);
+	      /* Check for outer fragmentation */
+	      if (ip40->flags_and_fragment_offset &
+		  clib_host_to_net_u16 (IP4_HEADER_FLAG_MORE_FRAGMENTS))
+		{
+		  next0 = IPIP_INPUT_NEXT_DROP;
+		  b0->error = node->errors[IPIP_ERROR_FRAGMENTED_PACKET];
+		  goto drop;
+		}
 	      vlib_buffer_advance (b0, sizeof (*ip40));
 	      ip_set (&src0, &ip40->src_address, true);
 	      ip_set (&dst0, &ip40->dst_address, true);