Messages in this thread Patch in this message | | | Date | Thu, 12 Jan 2006 18:37:49 -0800 | From | Chris Wright <> | Subject | [PATCH 11/17] [EBTABLES] Dont match tcp/udp source/destination port for IP fragments |
| |
-stable review patch. If anyone has any objections, please let us know. ------------------
--- net/bridge/netfilter/ebt_ip.c | 3 +++ 1 file changed, 3 insertions(+)
--- linux-2.6.15.y.orig/net/bridge/netfilter/ebt_ip.c +++ linux-2.6.15.y/net/bridge/netfilter/ebt_ip.c @@ -15,6 +15,7 @@ #include <linux/netfilter_bridge/ebtables.h> #include <linux/netfilter_bridge/ebt_ip.h> #include <linux/ip.h> +#include <net/ip.h> #include <linux/in.h> #include <linux/module.h> @@ -51,6 +52,8 @@ static int ebt_filter_ip(const struct sk if (!(info->bitmask & EBT_IP_DPORT) && !(info->bitmask & EBT_IP_SPORT)) return EBT_MATCH; + if (ntohs(ih->frag_off) & IP_OFFSET) + return EBT_NOMATCH; pptr = skb_header_pointer(skb, ih->ihl*4, sizeof(_ports), &_ports); if (pptr == NULL) -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |