Page MenuHomeFreeBSD

ipfw: improve matching on IPv4 fragments
ClosedPublic

Authored by glebius on Aug 10 2020, 9:17 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Mar 12, 12:35 AM
Unknown Object (File)
Tue, Mar 12, 12:35 AM
Unknown Object (File)
Tue, Mar 12, 12:35 AM
Unknown Object (File)
Fri, Mar 8, 4:07 AM
Unknown Object (File)
Feb 12 2024, 1:18 PM
Unknown Object (File)
Jan 6 2024, 2:51 AM
Unknown Object (File)
Jan 6 2024, 2:51 AM
Unknown Object (File)
Jan 6 2024, 2:51 AM

Details

Summary

Currently ipfw(8) allows to match on a packet being not a first fragment.
This prevents even such a simple rule as to block all fragmented packets.

This backward compatible enhancement allows to match explicitly on
IP_MF, IP_DF, even on IP_RF and on non-zero offset.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable