Re: IP Fragments
Bart De Schuymer <[email protected]>
| Newsgroups | gmane.linux.network.bridge.ebtables.user |
|---|---|
| Message-ID | <[email protected]> |
Op di, 10-01-2006 te 13:12 -0800, schreef David S. Miller: > From: Bart De Schuymer <[email protected]> > Date: Tue, 10 Jan 2006 19:29:12 +0000 > > > [EBTABLES] Don't match tcp/udp source/destination port for IP fragments > > > > Signed-off-by: Bart De Schuymer <[email protected]> > > Applied, thanks Bart. > > I'll push it to -stable. Here's the ebt_log.c part, which I overlooked. Again a candidate for - stable. cheers, Bart [EBTABLES] Don't match tcp/udp source/destination port for IP fragments Signed-off-by: Bart De Schuymer <[email protected]> --- linux-2.6.14.2/net/bridge/netfilter/ebt_log.c.old 2006-01-12 19:52:42.000000000 +0100 +++ linux-2.6.14.2/net/bridge/netfilter/ebt_log.c 2006-01-12 19:58:07.000000000 +0100 @@ -12,6 +12,7 @@ #include <linux/netfilter_bridge/ebt_log.h> #include <linux/module.h> #include <linux/ip.h> +#include <net/ip.h> #include <linux/if_arp.h> #include <linux/spinlock.h> @@ -92,6 +93,8 @@ static void ebt_log(const struct sk_buff ih->protocol == IPPROTO_UDP) { struct tcpudphdr _ports, *pptr; + if (ntohs(ih->frag_off) & IP_OFFSET) + goto out; pptr = skb_header_pointer(skb, ih->ihl*4, sizeof(_ports), &_ports); if (pptr == NULL) { ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click