This is an AI generated review of your patch. A human has looked at the
results and deemed any concerns as plausible.
Verdict on the core logic first: I traced `ipf_is_beyond_last_frag()` and
`ipf_list_complete()` against the insertion paths in `ipf_process_frag()` /
`ipf_list_state_transition()`, and the invariant holds.
> +/* Returns true if accepting this fragment would place data past an MF=0
> + * (last) fragment, which is illegal for IP reassembly. */
Two properties make this sound rather than accidental, and both are
load-bearing:
- The second clause (`lf && frag_list[i].end_data_byte > end_data_byte`)
is evaluated against every existing entry, so it fires even when the
new last fragment overlaps an existing one (e.g. existing
`[400,1000]`, new LF `[800,900]`). Since `duped_frag` is checked first
in `ipf_process_frag()`, that case is still accounted as
`IPF_NFRAGS_OVERLAP`, so the overlap accounting is unchanged by this
commit.
- Because of that same clause plus the first clause, a list can never
hold two MF=0 fragments and can never hold an MF=0 fragment that is
not the rightmost one (any new LF with end < max existing end is
rejected; any new frag starting past the LF's end is rejected). That
is exactly what makes `ipf_list_complete()`'s new tail test correct,
so the two hunks are consistent.
One consequence worth stating explicitly rather than treating as a bug:
once an MF=0 fragment with a too-small `end_data_byte` is admitted into
a list, every subsequent legitimate-looking last fragment for that key
is rejected (as overlap or beyond-last), and the list can only age out
via purge. That matches Linux's "first datagram end wins" behavior, so
it is intended, not a regression; but it does mean a single spoofed MF=0
fragment can pin a list until expiry while all real traffic for that key
is dropped. Pre-existing exposure (the list was already un-completable),
only the counter is new.
> + return ipf_list->frag_list[ipf_list->last_inuse_idx].last_frag;
No under-read: `ipf_list_complete()` is only reached from
`ipf_list_state_transition()`, which is called only from
`ipf_process_frag()` immediately after `ipf_list->last_inuse_idx++`
(line 919), so `last_inuse_idx >= 0`. Also confirmed `ipf_sort()` copies
whole `struct ipf_frag`, so `last_frag` travels with its entry and the
sorted rightmost element is the LF.
Concerns:
> +++ b/lib/dpif-provider.h
> + uint64_t nfrag_beyond_last;
The new field is inserted in the middle of both `struct
dpif_ipf_proto_status` and `struct ipf_proto_status`, shifting
`nfrag_purged`, `min_frag_size` and `enabled`. I grepped for any place
these structs are memcpy'd, cast, or versioned: they are only populated
field-by-field (`ipf_get_status()` -> `dpif_ipf_get_status()` ->
`dpctl_ct_ipf_get_status()`), so this is fine within a monolithic
build. It is still gratuitous ABI churn for a private provider header;
appending the counter (and printing it last) would have avoided
it. Minor, style/compat only.
> +ipf_is_beyond_last_frag(...)
> + for (int i = 0; i <= last_inuse_idx; i++) {
Now two O(n) scans per fragment instead of one (`ipf_is_frag_duped()` +
this). Both are already O(n) under `ipf_lock`, and the comment above
`ipf_list_state_transition` says fragment processing cost is
unimportant, so I am not calling this a problem — just noting that for
v6 lists sized up to 65535 (line ~995), the per-fragment work doubles on
the hot path.
> +dnl Internet Protocol Version 4, ...
> +dnl Identification: 0x0020 (32)
> +dnl Fragment Offset: 400
> +ip1="45 00 01 a4 00 20 00 32 40 11 62 f3"
The prose comment mislabels the fields: in `ip1` the Identification is
`0x0032` (50) and the frag field is `02 00`? No — reading it as ver/ihl,
tos, totlen=0x01a4, id=0x0020, fragoff=0x0032 gives offset 50*8 = 400
(matches the comment's "Fragment Offset: 400") but then Identification
is 0x0020 as commented. So the wire bytes and the ID/offset prose do
agree; my only nit is that `packet2`'s comment says "Identification:
0x0020" while its frag field is `20 64` (MF + offset 100*8 = 800), which
is right, and both headers are self-consistent.
I verified the header checksums arithmetically rather than trusting them:
- packet 1 words `4500 01a4 0020 0032 4011 62f3 0a01 0101 0a01 0102` sum
to `0x1ffef`, folded `0xffef`, complement `0x0010`.
- packet 2 words `4500 01a4 0020 2064 4011 42c1 0a01 0101 0a01 0102` sum
to `0x1ffef`, folded `0xffef`, complement `0x0010`.
Both are wrong by exactly the same amount, which is self-consistent with
the checksum field being omitted from my sum (`~0xffef = 0x0010`). So
both headers checksum to zero and will pass the `csum()` check in
`ipf_is_valid_v4_frag()`, and since the two errors are identical the
test's expected counts (accepted 1 / beyond last 1) are not sensitive to
it. No finding, just confirming I checked.
> +AT_CHECK([ovs-appctl dpctl/ipf-get-status -m \
> +| grep -E 'num frag:|v4 frags accepted:|...'], [], [dnl
> + num frag: 1
`grep -E` with these patterns also matches the `v4 frags
accepted:`/`completed:` lines emitted inside each `Fragment Lists:`
detail block when `-m` is used, not just the top-level counters. In this
test there is exactly one list and it holds one fragment, so the
expected output happens to be right; but the expectation silently
depends on list count and per-list line format, so a future change to
`-m` output would break it confusingly. Dropping `-m`, or anchoring on
the `dp:`/`ctIPv4` header context, would make the test robust.
> tests/system-userspace-macros.at
Updated expected outputs are consistent with the new dpctl print
ordering (beyond-last between overlapped and purged), in all five hunks;
I checked each against `dpctl_ct_ipf_get_status()`. Note these macros
assert on a fixed field list, so any future counter addition requires
touching them — pre-existing pattern.
Verdict: WARN
```json
{
"findings": [
{
"type": "API",
"title": "New status counter inserted mid-struct in dpif-provider.h and
ipf.h",
"description": "nfrag_beyond_last is added between nfrag_overlap and
nfrag_purged in struct dpif_ipf_proto_status and struct ipf_proto_status,
shifting the offsets of nfrag_purged, min_frag_size and enabled.",
"reasoning": "grep over the tree shows these structs are only populated
field-by-field (ipf_get_status -> dpif_ipf_get_status ->
dpctl_ct_ipf_get_status) with no memcpy/cast/serialization, so a monolithic
build is correct. Appending the field instead would avoid unnecessary layout
churn in a provider header.",
"severity": "low",
"severity_explanation": "No runtime impact in-tree; only matters for
out-of-tree consumers or partial rebuilds that mix old and new headers.",
"locations": [
{
"file": "lib/dpif-provider.h",
"function_or_symbol": "struct dpif_ipf_proto_status",
"line_range": "128-138",
"why_this_location_matters": "Field added in the middle, shifting
subsequent members."
},
{
"file": "lib/ipf.h",
"function_or_symbol": "struct ipf_proto_status",
"line_range": "26-36",
"why_this_location_matters": "Same mid-struct insertion in the paired
status struct."
}
],
"preexisting": false
},
{
"type": "Logic",
"title": "New test's expected output relies on -m detail lines matching
the grep patterns",
"description": "The AT_CHECK greps 'v4 frags accepted:' and 'v4 frags
completed:' from 'dpctl/ipf-get-status -m' output, but those labels are also
printed inside each per-list detail block, so the expected text depends on the
number of fragment lists and the detail format.",
"reasoning": "Read dpctl_ct_ipf_get_status() in lib/dpctl.c:2600-2680 to
confirm -m emits per-list lines with the same labels; in this test there is
exactly one list holding one fragment, so the current expectation passes. The
coupling makes future -m output changes fail in a confusing way.",
"severity": "low",
"severity_explanation": "Test-only fragility; no product behavior
affected.",
"locations": [
{
"file": "tests/ofproto-dpif.at",
"function_or_symbol": "ofproto-dpif - fragment handling - reject
fragment beyond last",
"line_range": "5905-5913",
"why_this_location_matters": "grep patterns are not anchored to the
top-level counter section."
}
],
"preexisting": false
},
{
"type": "Logic",
"title": "Beyond-last check adds a second O(n) scan per fragment on the
locked path",
"description": "ipf_process_frag() now runs ipf_is_frag_duped() and
ipf_is_beyond_last_frag(), each an O(last_inuse_idx) scan under ipf_lock,
doubling per-fragment list scanning.",
"reasoning": "Verified both helpers iterate 0..last_inuse_idx and are
called unconditionally from ipf_process_frag(); v6 lists can be sized up to
IPF_IPV6_MAX_FRAG_LIST_SIZE (65535) near lib/ipf.c:995, so worst-case scanning
is large. The two loops could be merged into one pass.",
"severity": "low",
"severity_explanation": "Performance only, on a path the code comments
already describe as not cost-critical; reachable by an attacker sending many
fragments for one key.",
"locations": [
{
"file": "lib/ipf.c",
"function_or_symbol": "ipf_is_beyond_last_frag",
"line_range": "872-890",
"why_this_location_matters": "Adds the second linear scan over the
fragment list."
},
{
"file": "lib/ipf.c",
"function_or_symbol": "ipf_process_frag",
"line_range": "903-907",
"why_this_location_matters": "Both scans are invoked for every
admitted fragment."
}
],
"preexisting": false
}
]
}
```
---
findings: 3 worst severity: low tokens: 74988 in / 9946 out
Eli Britstein <[email protected]> writes:
> IP reassembly must not accept data past an MF=0 fragment. Track
> last fragments, reject ranges beyond them on insert, and require the
> sorted rightmost fragment to be MF=0 before completing a list.
>
> The accompanying test is added to tests/ofproto-dpif.at (using
> netdev-dummy/receive with variable-built packets and precomputed IPv4
> header checksums) rather than the system-traffic suite.
>
> Assisted-by: composer-2.5-fast, Cursor
> Fixes: 4ea96698f667 ("Userspace datapath: Add fragmentation handling.")
> Signed-off-by: Eli Britstein <[email protected]>
> ---
> lib/dpctl.c | 4 ++
> lib/dpif-provider.h | 1 +
> lib/ipf.c | 48 +++++++++++++++++++--
> lib/ipf.h | 1 +
> tests/ofproto-dpif.at | 74 ++++++++++++++++++++++++++++++++
> tests/system-userspace-macros.at | 8 ++++
> 6 files changed, 133 insertions(+), 3 deletions(-)
>
> diff --git a/lib/dpctl.c b/lib/dpctl.c
> index 48afb8549..b147853ca 100644
> --- a/lib/dpctl.c
> +++ b/lib/dpctl.c
> @@ -2629,6 +2629,8 @@ dpctl_ct_ipf_get_status(int argc, const char *argv[],
> dpif_ipf_status.v4.nfrag_too_large);
> dpctl_print(dpctl_p, " v4 frags overlapped: %"PRIu64"\n",
> dpif_ipf_status.v4.nfrag_overlap);
> + dpctl_print(dpctl_p, " v4 frags beyond last: %"PRIu64"\n",
> + dpif_ipf_status.v4.nfrag_beyond_last);
> dpctl_print(dpctl_p, " v4 frags purged: %"PRIu64"\n",
> dpif_ipf_status.v4.nfrag_purged);
>
> @@ -2646,6 +2648,8 @@ dpctl_ct_ipf_get_status(int argc, const char *argv[],
> dpif_ipf_status.v6.nfrag_too_large);
> dpctl_print(dpctl_p, " v6 frags overlapped: %"PRIu64"\n",
> dpif_ipf_status.v6.nfrag_overlap);
> + dpctl_print(dpctl_p, " v6 frags beyond last: %"PRIu64"\n",
> + dpif_ipf_status.v6.nfrag_beyond_last);
> dpctl_print(dpctl_p, " v6 frags purged: %"PRIu64"\n",
> dpif_ipf_status.v6.nfrag_purged);
> } else {
> diff --git a/lib/dpif-provider.h b/lib/dpif-provider.h
> index b3dd58e9d..6f667fed1 100644
> --- a/lib/dpif-provider.h
> +++ b/lib/dpif-provider.h
> @@ -131,6 +131,7 @@ struct dpif_ipf_proto_status {
> uint64_t nfrag_too_small;
> uint64_t nfrag_too_large;
> uint64_t nfrag_overlap;
> + uint64_t nfrag_beyond_last;
> uint64_t nfrag_purged;
> unsigned int min_frag_size;
> bool enabled;
> diff --git a/lib/ipf.c b/lib/ipf.c
> index 2b016e60b..1a16908c7 100644
> --- a/lib/ipf.c
> +++ b/lib/ipf.c
> @@ -84,6 +84,7 @@ enum ipf_counter_type {
> IPF_NFRAGS_TOO_SMALL,
> IPF_NFRAGS_TOO_LARGE,
> IPF_NFRAGS_OVERLAP,
> + IPF_NFRAGS_BEYOND_LAST,
> IPF_NFRAGS_PURGED,
> IPF_NFRAGS_NUM_CNTS,
> };
> @@ -98,6 +99,7 @@ struct ipf_frag {
> struct dp_packet *pkt;
> uint16_t start_data_byte;
> uint16_t end_data_byte;
> + bool last_frag; /* True if this was the MF=0 fragment. */
> };
>
> /* The key for a collection of fragments potentially making up an
> unfragmented
> @@ -397,8 +399,14 @@ ipf_list_complete(const struct ipf_list *ipf_list)
> != ipf_list->frag_list[i].start_data_byte) {
> return false;
> }
> +
> + /* Only the final fragment may have MF=0; data past it is invalid. */
> + if (ipf_list->frag_list[i - 1].last_frag) {
> + return false;
> + }
> }
> - return true;
> +
> + return ipf_list->frag_list[ipf_list->last_inuse_idx].last_frag;
> }
>
> /* Runs O(n) for a sorted or almost sorted list. */
> @@ -859,6 +867,28 @@ ipf_is_frag_duped(const struct ipf_frag *frag_list, int
> last_inuse_idx,
> return false;
> }
>
> +/* Returns true if accepting this fragment would place data past an MF=0
> + * (last) fragment, which is illegal for IP reassembly. */
> +static bool
> +ipf_is_beyond_last_frag(const struct ipf_frag *frag_list, int last_inuse_idx,
> + uint16_t start_data_byte, uint16_t end_data_byte,
> + bool lf)
> + /* OVS_REQUIRES(ipf_lock) */
> +{
> + for (int i = 0; i <= last_inuse_idx; i++) {
> + if (frag_list[i].last_frag
> + && start_data_byte > frag_list[i].end_data_byte) {
> + return true;
> + }
> +
> + if (lf && frag_list[i].end_data_byte > end_data_byte) {
> + return true;
> + }
> + }
> +
> + return false;
> +}
> +
> /* Adds a fragment to a list of fragments, if the fragment is not a
> * duplicate. If the fragment is a duplicate, the fragment is dropped
> * to avoid the work that conntrack would do to mark the fragment
> @@ -872,14 +902,17 @@ ipf_process_frag(struct ipf *ipf, struct ipf_list
> *ipf_list,
> {
> bool duped_frag = ipf_is_frag_duped(ipf_list->frag_list,
> ipf_list->last_inuse_idx, start_data_byte, end_data_byte);
> + bool beyond_last = ipf_is_beyond_last_frag(ipf_list->frag_list,
> + ipf_list->last_inuse_idx, start_data_byte, end_data_byte, lf);
> int last_inuse_idx = ipf_list->last_inuse_idx;
>
> - if (!duped_frag) {
> + if (!duped_frag && !beyond_last) {
> if (last_inuse_idx < ipf_list->size - 1) {
> struct ipf_frag *frag = &ipf_list->frag_list[last_inuse_idx + 1];
> frag->pkt = pkt;
> frag->start_data_byte = start_data_byte;
> frag->end_data_byte = end_data_byte;
> + frag->last_frag = lf;
> ipf_list->last_inuse_idx++;
> atomic_count_inc(&ipf->nfrag);
> ipf_count(ipf, v6, IPF_NFRAGS_ACCEPTED);
> @@ -887,11 +920,16 @@ ipf_process_frag(struct ipf *ipf, struct ipf_list
> *ipf_list,
> } else {
> OVS_NOT_REACHED();
> }
> - } else {
> + } else if (duped_frag) {
> ipf_count(ipf, v6, IPF_NFRAGS_OVERLAP);
> dp_packet_delete(pkt);
> return true;
> + } else {
> + ipf_count(ipf, v6, IPF_NFRAGS_BEYOND_LAST);
> + dp_packet_delete(pkt);
> + return true;
> }
> +
> return true;
> }
>
> @@ -1486,6 +1524,8 @@ ipf_get_status(struct ipf *ipf, struct ipf_status
> *ipf_status)
> &ipf_status->v4.nfrag_too_large);
> atomic_read_relaxed(&ipf->n4frag_cnt[IPF_NFRAGS_OVERLAP],
> &ipf_status->v4.nfrag_overlap);
> + atomic_read_relaxed(&ipf->n4frag_cnt[IPF_NFRAGS_BEYOND_LAST],
> + &ipf_status->v4.nfrag_beyond_last);
> atomic_read_relaxed(&ipf->n4frag_cnt[IPF_NFRAGS_PURGED],
> &ipf_status->v4.nfrag_purged);
>
> @@ -1504,6 +1544,8 @@ ipf_get_status(struct ipf *ipf, struct ipf_status
> *ipf_status)
> &ipf_status->v6.nfrag_too_large);
> atomic_read_relaxed(&ipf->n6frag_cnt[IPF_NFRAGS_OVERLAP],
> &ipf_status->v6.nfrag_overlap);
> + atomic_read_relaxed(&ipf->n6frag_cnt[IPF_NFRAGS_BEYOND_LAST],
> + &ipf_status->v6.nfrag_beyond_last);
> atomic_read_relaxed(&ipf->n6frag_cnt[IPF_NFRAGS_PURGED],
> &ipf_status->v6.nfrag_purged);
> return 0;
> diff --git a/lib/ipf.h b/lib/ipf.h
> index 2ac3c9658..59ae887c3 100644
> --- a/lib/ipf.h
> +++ b/lib/ipf.h
> @@ -29,6 +29,7 @@ struct ipf_proto_status {
> uint64_t nfrag_too_small;
> uint64_t nfrag_too_large;
> uint64_t nfrag_overlap;
> + uint64_t nfrag_beyond_last;
> uint64_t nfrag_purged;
> unsigned int min_frag_size;
> bool enabled;
> diff --git a/tests/ofproto-dpif.at b/tests/ofproto-dpif.at
> index 0ff4c50f8..032707dd5 100644
> --- a/tests/ofproto-dpif.at
> +++ b/tests/ofproto-dpif.at
> @@ -5842,6 +5842,80 @@ AT_CHECK([ovs-appctl dpctl/ipf-get-status -m \
> OVS_VSWITCHD_STOP
> AT_CLEANUP
>
> +AT_SETUP([ofproto-dpif - fragment handling - reject fragment beyond last])
> +OVS_VSWITCHD_START
> +add_of_ports br0 1 90
> +
> +AT_DATA([flows.txt], [dnl
> +table=0 in_port=90,ip actions=ct(commit),output:1
> +])
> +AT_CHECK([ovs-ofctl -O OpenFlow11 replace-flows br0 flows.txt])
> +
> +dnl The minimum fragment size is clamped to 400 bytes, so a non-last fragment
> +dnl must be at least that large to be admitted for reassembly.
> +AT_CHECK([ovs-appctl dpctl/ipf-set-min-frag v4 400], [], [dnl
> +setting minimum fragment size successful
> +])
> +
> +dnl First admit a last (MF=0) fragment carrying bytes 400..799, then reject a
> +dnl new fragment carrying bytes 800..1199, whose data lies entirely beyond
> the
> +dnl end of the last fragment and so must not be reassembled.
> +dnl
> +dnl Packet 1 (admitted). Last fragment carrying bytes 400..799 (MF clear).
> +dnl Ethernet II, Src: 50:54:00:00:00:09, Dst: 50:54:00:00:00:0a
> +dnl Type: IPv4 (0x0800)
> +dnl Internet Protocol Version 4, Src: 10.1.1.1, Dst: 10.1.1.2
> +dnl 0100 .... = Version: 4
> +dnl .... 0101 = Header Length: 20 bytes (5)
> +dnl Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
> +dnl Total Length: 420
> +dnl Identification: 0x0020 (32)
> +dnl 000. .... = Flags: 0x0 (Last fragment)
> +dnl ...0 0000 0011 0010 = Fragment Offset: 400
> +dnl Time to Live: 64
> +dnl Protocol: UDP (17)
> +dnl Header Checksum: 0x62f3
> +dnl Data (400 bytes)
> +eth="50 54 00 00 00 0a 50 54 00 00 00 09 08 00"
> +ip1="45 00 01 a4 00 20 00 32 40 11 62 f3"
> +addrs="0a 01 01 01 0a 01 01 02"
> +data1=$(printf '%0*d' 800 0)
> +packet1="${eth}${ip1}${addrs}${data1}"
> +
> +dnl Packet 2 (rejected as beyond last). Fragment carrying bytes 800..1199
> +dnl (MF set), starting past packet 1's last-fragment end.
> +dnl Ethernet II, Src: 50:54:00:00:00:09, Dst: 50:54:00:00:00:0a
> +dnl Type: IPv4 (0x0800)
> +dnl Internet Protocol Version 4, Src: 10.1.1.1, Dst: 10.1.1.2
> +dnl 0100 .... = Version: 4
> +dnl .... 0101 = Header Length: 20 bytes (5)
> +dnl Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
> +dnl Total Length: 420
> +dnl Identification: 0x0020 (32)
> +dnl 001. .... = Flags: 0x1 (More fragments)
> +dnl ...0 0000 0110 0100 = Fragment Offset: 800
> +dnl Time to Live: 64
> +dnl Protocol: UDP (17)
> +dnl Header Checksum: 0x42c1
> +dnl Data (400 bytes)
> +ip2="45 00 01 a4 00 20 20 64 40 11 42 c1"
> +data2=$(printf '%0*d' 800 0)
> +packet2="${eth}${ip2}${addrs}${data2}"
> +
> +AT_CHECK([ovs-appctl netdev-dummy/receive p90 "$packet1"])
> +AT_CHECK([ovs-appctl netdev-dummy/receive p90 "$packet2"])
> +
> +AT_CHECK([ovs-appctl dpctl/ipf-get-status -m \
> +| grep -E 'num frag:|v4 frags accepted:|v4 frags completed:|v4 frags beyond
> last:'], [], [dnl
> + num frag: 1
> + v4 frags accepted: 1
> + v4 frags completed: 0
> + v4 frags beyond last: 1
> +])
> +
> +OVS_VSWITCHD_STOP
> +AT_CLEANUP
> +
> AT_SETUP([ofproto-dpif - handling of malformed TCP packets])
> OVS_VSWITCHD_START
> add_of_ports br0 1 90
> diff --git a/tests/system-userspace-macros.at
> b/tests/system-userspace-macros.at
> index 10ce3e746..3579718f8 100644
> --- a/tests/system-userspace-macros.at
> +++ b/tests/system-userspace-macros.at
> @@ -180,6 +180,7 @@ AT_CHECK([ovs-appctl dpctl/ipf-get-status], [], [dnl
> v4 frags too small: 0
> v4 frags too large: 0
> v4 frags overlapped: 0
> + v4 frags beyond last: 0
> v4 frags purged: 0
> min v6 frag size: 1280
> v6 frags accepted: 0
> @@ -188,6 +189,7 @@ AT_CHECK([ovs-appctl dpctl/ipf-get-status], [], [dnl
> v6 frags too small: 0
> v6 frags too large: 0
> v6 frags overlapped: 0
> + v6 frags beyond last: 0
> v6 frags purged: 0
> ])
> ])
> @@ -212,6 +214,7 @@ AT_CHECK([ovs-appctl dpctl/ipf-get-status --more], [],
> [dnl
> v4 frags too small: 0
> v4 frags too large: 0
> v4 frags overlapped: 0
> + v4 frags beyond last: 0
> v4 frags purged: 0
> min v6 frag size: 1280
> v6 frags accepted: 0
> @@ -220,6 +223,7 @@ AT_CHECK([ovs-appctl dpctl/ipf-get-status --more], [],
> [dnl
> v6 frags too small: 0
> v6 frags too large: 0
> v6 frags overlapped: 0
> + v6 frags beyond last: 0
> v6 frags purged: 0
>
> Fragment Lists:
> @@ -247,6 +251,7 @@ AT_CHECK([ovs-appctl dpctl/ipf-get-status --more], [],
> [dnl
> v4 frags too small: 0
> v4 frags too large: 0
> v4 frags overlapped: 0
> + v4 frags beyond last: 0
> v4 frags purged: 0
> min v6 frag size: 1280
> v6 frags accepted: 30
> @@ -255,6 +260,7 @@ AT_CHECK([ovs-appctl dpctl/ipf-get-status --more], [],
> [dnl
> v6 frags too small: 0
> v6 frags too large: 0
> v6 frags overlapped: 0
> + v6 frags beyond last: 0
> v6 frags purged: 0
>
> Fragment Lists:
> @@ -289,6 +295,7 @@ AT_CHECK([ovs-appctl dpctl/ipf-get-status -m |
> FORMAT_FRAG_LIST()], [], [dnl
> v4 frags too small: 0
> v4 frags too large: 0
> v4 frags overlapped: 0
> + v4 frags beyond last: 0
> v4 frags purged: 0
> min v6 frag size: 1280
> v6 frags accepted: 0
> @@ -297,6 +304,7 @@ AT_CHECK([ovs-appctl dpctl/ipf-get-status -m |
> FORMAT_FRAG_LIST()], [], [dnl
> v6 frags too small: 0
> v6 frags too large: 0
> v6 frags overlapped: 0
> + v6 frags beyond last: 0
> v6 frags purged: 0
>
> Fragment Lists:
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
