Filtering VLAN packets having malformed tpids
Malformed VLAN packets can be detected by programming suitable rules in a TCAM in the packet processing pipeline. In some deployments, for example, the TCAM rule(s) can match on the parsed EtherType metadata. More specifically, the match can be based on the EtherType metadata being set to a value equal to known VLAN TPIDs, such as 0x8100, 0x88a8, rather than being set to a standard EtherType.
1. A method in a network device to detect and filter virtual local area network (VLAN) packets, the method comprising:
receiving an ingress packet, the ingress packet containing one or more VLAN tags;
identifying a VLAN tag in the ingress packet;
using the identified VLAN tag to access data in the ingress packet, wherein when the identified VLAN tag has a first value, the data is at a first location in the ingress packet, wherein when the identified VLAN tag has a second value, the data is at a second location in the ingress packet different from the first location;
using the data to identify a matched rule among a plurality of rules stored in a memory of the network device; and
processing the ingress packet in accordance with one or more actions associated with the matched rule, wherein the one or more actions includes dropping the ingress packet.
2. The method of claim 1 , wherein a starting byte position of the data in the ingress packet is determined based on a tag protocol identifier (TPID) in the VLAN tag.
3. The method of claim 1 , wherein the data in the ingress packet is interpreted to contain a protocol that describes data contained in a payload of the ingress packet.
4. The method of claim 1 , wherein the matched rule is identified when the data does not represent a protocol that describes data contained in a payload of the ingress packet.
5. The method of claim 4 , wherein the matched rule is identified when the data is a tag protocol identifier (TPID) value instead of a protocol that describes the data contained in the payload of the ingress packet.
6. The method of claim 1 , wherein the matched rule is identified when the data contains a TPID value.
7. The method of claim 1 , wherein the matched rule is the highest priority rule among a plurality of rules.
8. A network device comprising:
at least one packet processor; and
a computer-readable storage medium comprising executable code for controlling the at least one packet processor to:
receive an ingress packet comprising at least one VLAN tag and a payload portion;
use the VLAN tag to identify a location in the ingress packet, wherein the location in the ingress packet begins at a first byte position when the VLAN tag has a first value and at a second byte position different from the first byte position when the VLAN tag has a second value; and
use data beginning at the identified location to process the ingress packet, including:
dropping the ingress packet when the data does not represent a protocol that describes data in the payload portion; and
forwarding the ingress packet when the data represents a protocol that describes the data in the payload portion.
9. The network device of claim 8 , wherein the data beginning at the identified location in the ingress packet is interpreted to represent a protocol that describes the data in the payload portion.
10. The network device of claim 8 , wherein the identified location in the ingress packet is determined based on tag protocol identifiers (TPIDs) in the one or more VLAN tags.
11. The network device of claim 8 , wherein the ingress packet comprises a plurality of user-defined fields (UDFs), wherein the VLAN tags are located among the UDFs.
12. The network device of claim 8 , further comprising a memory having stored therein a plurality of rules, wherein the computer-readable storage medium further comprises executable code for controlling the at least one packet processor to:
store into a data store the data beginning at the identified location in the ingress packet;
use the data stored in the data store to identify a rule from among the plurality of rules; and
process the ingress packet in accordance with one or more actions associated with the identified rule, wherein the one or more actions includes dropping the ingress packet.
13. The network device of claim 12 , wherein the identified rule is identified when the data in the data store is a tag protocol identifier (TPID) value.
14. The network device of claim 12 , wherein the identified rule is identified when a VLAN ID in one of the VLAN tags is equal to 0.
15. The network device of claim 12 , wherein the identified rule is the highest priority rule among a plurality of rules.
16. A network device comprising:
at least one packet processor;
a content addressable memory having stored therein a plurality of first rules; and
a computer-readable storage medium comprising executable code for controlling the at least one packet processor to:
receive an ingress packet comprising at least one VLAN tag;
use the VLAN tag to identify a location in the ingress packet, wherein the location in the ingress packet begins at a first byte position when the VLAN tag has a first value and at a second byte position different from the first byte position when the VLAN tag has a second value;
use data at the identified location to identify a rule among the plurality of first rules; and
process the ingress packet in accordance with one or more actions associated with the identified rule,
wherein the plurality of first rules comprise match criteria that match on VLAN tag data.
17. The network device of claim 16 , wherein the one or more actions associated with the identified rule includes dropping the ingress packet.
18. The network device of claim 16 , wherein the plurality of first rules are the highest priority rules in the content addressable memory.
19. The network device of claim 16 , wherein at least one of the plurality of first rules matches on the data in the data store being a TPID value.
20. The network device of claim 16 , wherein at least one of the plurality of first rules matches on a VLAN ID in one of the VLAN tags being equal to 0.