Re: IP Fragments
Bart De Schuymer <[email protected]>
| Newsgroups | gmane.linux.network.bridge.ebtables.user |
|---|---|
| Message-ID | <[email protected]> |
Op di, 10-01-2006 te 04:26 +0100, schreef François-Xavier Le Bail: > Hello Bart, > > Thank you for your answer. > > In ebt_ip.c, in case of match test on UDP or TCP source or destination port, do > you think we need a test on the IP header to see if this is a IP fragment or > not, because, in case of fragment, data in place of UDP/TCP Header (on 4 first > bytes) could match the source or destination port ? You're right, this patch should fix it. Thanks. Dave, please apply. This is probably a candidate for -stable. cheers, Bart [EBTABLES] Don't match tcp/udp source/destination port for IP fragments Signed-off-by: Bart De Schuymer <[email protected]> --- linux-2.6.14.2/net/bridge/netfilter/ebt_ip.c.old 2006-01-10 19:54:08.000000000 +0100 +++ linux-2.6.14.2/net/bridge/netfilter/ebt_ip.c 2006-01-10 19:59:18.000000000 +0100 @@ -15,6 +15,7 @@ #include <linux/netfilter_bridge/ebtables.h> #include <linux/netfilter_bridge/ebt_ip.h> #include <linux/ip.h> +#include <net/ip.h> #include <linux/in.h> #include <linux/module.h> @@ -51,6 +52,8 @@ static int ebt_filter_ip(const struct sk if (!(info->bitmask & EBT_IP_DPORT) && !(info->bitmask & EBT_IP_SPORT)) return EBT_MATCH; + if (ntohs(ih->frag_off) & IP_OFFSET) + return EBT_NOMATCH; pptr = skb_header_pointer(skb, ih->ihl*4, sizeof(_ports), &_ports); if (pptr == NULL) ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_idv37&alloc_id865&op=click