Type: docs
Change-Id: I32ac3d5c06420af374245551e99f3ce932e716cc
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

- GHSA-rc9p-89wj-mx7h

Type: fix

Change-Id: I2ec3c57a8fe6682804759e5ab7b1e92d3c2510c9
Signed-off-by: Rob Shearman <robertshearman@gmail.com>
Signed-off-by: Dave Wallace <dwallacelf@gmail.com>

* Previous to this patch, if first packet on session
was non-SYN (fsol-non-syn), by default session bitmap
was rewritten to mark all subsequent packets for drop &
session was kept in SFDP table with state SECURITY and
its timeout value is updated, effectively dropping
all packets matching that session until timeout.

* This patch updates default behavior for fsol-non-syn
so that a session is tagged for immediate removal from SFDP
at the next sfdp-expire cycle (with timeout=0), without
dropping any traffic for that session.

* The fsol-non-sy behavior can be now configured between
the previous default and the new default using CLI
command "set sfdp tcp-check fsol-non-syn.."

Type: improvement

Change-Id: I507b3953d1937193d949a762775202a0e9d365e9
Signed-off-by: Hadi Rayan Al-Sandid <halsandi@cisco.com>
(cherry picked from commit 5196c54)

Previous code hapened to work but only for low queue count.
In CSIT the symptom is failing NDRPDR multicore tests on xxv710 NIC
(tested only on 2n-zn2) due to receiving packets in groups of 4.

The idea of the fix was discovered by Gemini 3.5 Thinking,
but I renamed the related variable to fully retain the copyright.

(cherry picked from commit 74edcf1)

Type: fix
Fixes: 67f03ba
Ticket: vpp-4089

Change-Id: I2d72bf9befddf32940f5922524e8744c1a20c058
Signed-off-by: Vratko Polak <vrpolak@cisco.com>

Both IPv4 and IPv6 fragmentation may derive the next fragment ID from
the running_fragment_id global variable which is shared across all VPP
worker threads, and the fragmentation code can be called from any of
the main thread or worker threads. Therefore, a data race exists
whereby fragments could be generated to the same destination with the
same fragment IDs and cause reassembly to fail.

Fix this by atomically fetching and incrementing
running_fragment_id. Whilst there, fix truncation of the IPv6 fragment
ID from 32-bits to 16-bits by changing the type of ip_frag_id to match
that of the IPv6 fragment header. Also convert the fragment ID from
host-endian to network-endian in both the IPv4 and IPv6 cases for
consistency.

In addition, allow TestIPv4Frag to work with multiple VPP workers
(demonstrating that the IPv4 fragmentation code can run on worker
threads) by changing VppNeighbor.get_stats to sum over all cores, and
not just return the stats for core 0.

Type: fix
Fixes: cb9cada
Change-Id: Icaa7192c5a77c2d40cd12a2220c7bc97460f11ab
Signed-off-by: Rob Shearman <robertshearman@gmail.com>
(cherry picked from commit ee04326)

Type: docs
Change-Id: Ib0bb99d0ab36d29d5b109ffd26b8e67c11a9169a
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>