commit b1bd8760ce9b1416c8a7f12e411cfcf60de2929f
author Vladimir Ratnikov <vratnikov@netgate.com> Wed Mar 18 08:20:08 2020 -0400
committer Ole Trøan <otroan@employees.org> Wed Mar 25 08:19:14 2020 +0000
tree 7eeed964b15adef909f474c18135e1736186e5d3
parent 753b96f31b0f34983bbc213516f1a05825d868a8

map: fix hop limit expiration at br

Before this patch, packet was dropped in ip4-input,
but ip4-map-t node dropped response due to
'security check failed'
This patch checkes if hop_limit==1 and sets error
and next frame and sends icmp6 response correctly

Type: fix

Signed-off-by: Vladimir Ratnikov <vratnikov@netgate.com>
Change-Id: I85a6af58205b05754ef8c45a94817bb84f915c85

src/plugins/map/test/test_map.py

diff --git a/src/plugins/map/test/test_map.py b/src/plugins/map/test/test_map.py
index 66cb9ba..59c2333 100644
--- a/src/plugins/map/test/test_map.py
+++ b/src/plugins/map/test/test_map.py
@@ -591,7 +591,22 @@
         for p in rx:
             self.validate(p[1], icmp4_reply)
 
-        # IPv6 Hop limit
+        # IPv6 Hop limit at BR
+        ip6_hlim_expired = IPv6(hlim=1, src='2001:db8:1ab::c0a8:1:ab',
+                                dst='1234:5678:90ab:cdef:ac:1001:200:0')
+        p6 = (p_ether6 / ip6_hlim_expired / payload)
+
+        icmp6_reply = (IPv6(hlim=255, src=self.pg1.local_ip6,
+                            dst="2001:db8:1ab::c0a8:1:ab") /
+                       ICMPv6TimeExceeded(code=0) /
+                       IPv6(src="2001:db8:1ab::c0a8:1:ab",
+                            dst='1234:5678:90ab:cdef:ac:1001:200:0',
+                            hlim=1) / payload)
+        rx = self.send_and_expect(self.pg1, p6*1, self.pg1)
+        for p in rx:
+            self.validate(p[1], icmp6_reply)
+
+        # IPv6 Hop limit beyond BR
         ip6_hlim_expired = IPv6(hlim=0, src='2001:db8:1ab::c0a8:1:ab',
                                 dst='1234:5678:90ab:cdef:ac:1001:200:0')
         p6 = (p_ether6 / ip6_hlim_expired / payload)