Anti-spoof check of IPv4-in-IPv6 fragments without reassembly

A network device comprising:

• one or more network interfaces configured to receive, from a first network, one or more fragments of a first network packet of a first network packet type, wherein the one or more fragments of the first network packet are part of a fragment flow, and wherein the first network packet encapsulates a second network packet of a second network packet type;
• and
• one or more processors configured to:
• in response to determining that the one or more network interfaces has not yet received a fragment of the first network packet that includes indications of a source network address and a source port for the second network packet, buffer the one or more fragments;
• in response to the one or more network interfaces receiving the fragment of the first network packet that includes the indications of the source network address and the source port for the second network packet, perform an anti-spoof check of the fragment flow based at least in part on the source network address and the source port for the second network packet without assembling the first network packet;
• wherein the one or more network interfaces are further configured to, subsequent to the one or more processors performing the anti-spoof check on the fragment flow, receive a second one or more fragments of the first network packet;
• wherein the one or more processors are further configured to:
• based on the fragment flow passing the anti-spoof check, buffer the second one or more fragments of the first network packet in the fragment buffer without performing the anti-spoof check on any of the second one or more fragments of the first network packet;
• and
• based on the fragment flow passing the anti-spoof check, in response to receiving all fragments of the first network packet:
• assemble the first network packet, and
• decapsulate the second network packet from the assembled first network packet;
• wherein the one or more network interfaces are further configured to forward the second network packet to a second network.

A computer-readable medium comprising instructions for causing a programmable processor to:

• receive, from a first network, one or more fragments of a first network packet of a first network packet type, wherein the one or more fragments of the first network packet are part of a fragment flow, and wherein the first network packet encapsulates a second network packet of a second network packet type;
• in response to determining that a fragment of the first network packet that includes indications of a source network address and a source port for the second network packet has not yet been received, buffer the one or more fragments;
• in response to receiving the fragment of the first network packet that includes the indications of the source network address and the source port for the second network packet, perform an anti-spoof check of the fragment flow based at least in part on the source network address and the source port for the second network packet without assembling the first network packet;
• subsequent to performing the anti-spoof check on the fragment flow, receive a second one or more fragments of the first network packet;
• based on the fragment flow passing the anti-spoof check, buffer the second one or more fragments of the first network packet in the fragment buffer without performing the anti-spoof check on any of the second one or more fragments of the first network packet;
• and
• based on the fragment flow passing the anti-spoof check, in response to receiving all fragments of the first network packet:
• assemble the first network packet,
• decapsulate the second network packet from the assembled first network packet, and
• forward, to a second network, the second network packet.