Page MenuHomeFreeBSD

ipfw: improve matching on IPv4 fragments
ClosedPublic

Authored by glebius on Aug 10 2020, 9:17 PM.

Details

Summary

Currently ipfw(8) allows to match on a packet being not a first fragment.
This prevents even such a simple rule as to block all fragmented packets.

This backward compatible enhancement allows to match explicitly on
IP_MF, IP_DF, even on IP_RF and on non-zero offset.

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.