reassembly: prevent long chain attack

[vpp.git] / src / vnet / ip / ip4_error.h

diff --git a/src/vnet/ip/ip4_error.h b/src/vnet/ip/ip4_error.h
index 95d12ec..d3bf6d7 100644 (file)
--- a/src/vnet/ip/ip4_error.h
+++ b/src/vnet/ip/ip4_error.h
@@ -57,8 +57,9 @@
   _ (MTU_EXCEEDED, "ip4 MTU exceeded and DF set")                      \
   _ (DST_LOOKUP_MISS, "ip4 destination lookup miss")                   \
   _ (SRC_LOOKUP_MISS, "ip4 source lookup miss")                                \
-  _ (ADJACENCY_DROP, "ip4 adjacency drop")                             \
-  _ (ADJACENCY_PUNT, "ip4 adjacency punt")                             \
+  _ (DROP, "ip4 drop")                                                  \
+  _ (PUNT, "ip4 punt")                                                  \
+  _ (SAME_INTERFACE, "ip4 egress interface same as ingress")            \
                                                                        \
   /* Errors signalled by ip4-local. */                                 \
   _ (UNKNOWN_PROTOCOL, "unknown ip protocol")                          \
@@ -70,11 +71,25 @@
   _ (UNICAST_SOURCE_CHECK_FAILS, "ip4 unicast source check fails")     \
                                                                         \
   /* Spoofed packets in ip4-rewrite-local */                            \
-  _(SPOOFED_LOCAL_PACKETS, "ip4 spoofed local-address packet drops")    \
+  _ (SPOOFED_LOCAL_PACKETS, "ip4 spoofed local-address packet drops")   \
                                                                         \
   /* Errors singalled by ip4-inacl */                                   \
   _ (INACL_TABLE_MISS, "input ACL table-miss drops")                    \
-  _ (INACL_SESSION_DENY, "input ACL session deny drops")
+  _ (INACL_SESSION_DENY, "input ACL session deny drops")                \
+  /* Errors singalled by ip4-outacl */                                  \
+  _ (OUTACL_TABLE_MISS, "output ACL table-miss drops")                  \
+  _ (OUTACL_SESSION_DENY, "output ACL session deny drops")              \
+                                                                        \
+  /* Erros from mfib-forward */                                         \
+  _ (RPF_FAILURE, "Multicast RPF check failed")                         \
+                                                                        \
+  /* Errors signalled by ip4-reassembly */                              \
+  _ (REASS_DUPLICATE_FRAGMENT, "duplicate/overlapping fragments")       \
+  _ (REASS_LIMIT_REACHED, "drops due to concurrent reassemblies limit") \
+  _ (REASS_FRAGMENT_CHAIN_TOO_LONG, "fragment chain too long (drop)")   \
+  _ (REASS_NO_BUF, "out of buffers (drop)")                             \
+  _ (REASS_MALFORMED_PACKET, "malformed packets")                       \
+  _ (REASS_INTERNAL_ERROR, "drops due to internal reassembly error")
 
 typedef enum
 {