diff options
author | rwatson <rwatson@FreeBSD.org> | 2001-01-09 03:10:30 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2001-01-09 03:10:30 +0000 |
commit | c4fb1f7419a715bf4407f248c373b9526e1e746f (patch) | |
tree | d19eec25f1660a1ba339672a49a0ae347602778c /sys/netinet/ip_fw.h | |
parent | 7825fe8202cfc1f9cce34390693bcdbd7d9882b9 (diff) | |
download | FreeBSD-src-c4fb1f7419a715bf4407f248c373b9526e1e746f.zip FreeBSD-src-c4fb1f7419a715bf4407f248c373b9526e1e746f.tar.gz |
o IPFW incorrectly handled filtering in the presence of previously
reserved and now allocated TCP flags in incoming packets. This patch
stops overloading those bits in the IP firewall rules, and moves
colliding flags to a seperate field, ipflg. The IPFW userland
management tool, ipfw(8), is updated to reflect this change. New TCP
flags related to ECN are now included in tcp.h for reference, although
we don't currently implement TCP+ECN.
o To use this fix without completely rebuilding, it is sufficient to copy
ip_fw.h and tcp.h into your appropriate include directory, then rebuild
the ipfw kernel module, and ipfw tool, and install both. Note that a
mismatch between module and userland tool will result in incorrect
installation of firewall rules that may have unexpected effects. This
is an MFC candidate, following shakedown. This bug does not appear
to affect ipfilter.
Reviewed by: security-officer, billf
Reported by: Aragon Gouveia <aragon@phat.za.net>
Diffstat (limited to 'sys/netinet/ip_fw.h')
-rw-r--r-- | sys/netinet/ip_fw.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/netinet/ip_fw.h b/sys/netinet/ip_fw.h index f61abd1..a642d72 100644 --- a/sys/netinet/ip_fw.h +++ b/sys/netinet/ip_fw.h @@ -222,7 +222,8 @@ struct ipfw_dyn_rule { #define IP_FW_IF_TCPSEQ 0x00000004 /* tcp sequence number */ #define IP_FW_IF_TCPACK 0x00000008 /* tcp acknowledgement number */ #define IP_FW_IF_TCPWIN 0x00000010 /* tcp window size */ -#define IP_FW_IF_TCPMSK 0x0000001f /* mask of all tcp values */ +#define IP_FW_IF_TCPEST 0x00000020 /* established TCP connection */ +#define IP_FW_IF_TCPMSK 0x0000003f /* mask of all tcp values */ #define IP_FW_IF_IPOPT 0x00000100 /* ip options */ #define IP_FW_IF_IPLEN 0x00000200 /* ip length */ @@ -274,7 +275,6 @@ struct ipfw_dyn_rule { #define IP_FW_TCPF_PSH TH_PUSH #define IP_FW_TCPF_ACK TH_ACK #define IP_FW_TCPF_URG TH_URG -#define IP_FW_TCPF_ESTAB 0x40 /* * Main firewall chains definitions and global var's definitions. |