diff options
| author | rwatson <rwatson@FreeBSD.org> | 2001-01-09 03:10:30 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2001-01-09 03:10:30 +0000 |
| commit | c4fb1f7419a715bf4407f248c373b9526e1e746f (patch) | |
| tree | d19eec25f1660a1ba339672a49a0ae347602778c /sys/netinet/tcp.h | |
| parent | 7825fe8202cfc1f9cce34390693bcdbd7d9882b9 (diff) | |
| download | FreeBSD-src-c4fb1f7419a715bf4407f248c373b9526e1e746f.zip FreeBSD-src-c4fb1f7419a715bf4407f248c373b9526e1e746f.tar.gz | |
o IPFW incorrectly handled filtering in the presence of previously
reserved and now allocated TCP flags in incoming packets. This patch
stops overloading those bits in the IP firewall rules, and moves
colliding flags to a seperate field, ipflg. The IPFW userland
management tool, ipfw(8), is updated to reflect this change. New TCP
flags related to ECN are now included in tcp.h for reference, although
we don't currently implement TCP+ECN.
o To use this fix without completely rebuilding, it is sufficient to copy
ip_fw.h and tcp.h into your appropriate include directory, then rebuild
the ipfw kernel module, and ipfw tool, and install both. Note that a
mismatch between module and userland tool will result in incorrect
installation of firewall rules that may have unexpected effects. This
is an MFC candidate, following shakedown. This bug does not appear
to affect ipfilter.
Reviewed by: security-officer, billf
Reported by: Aragon Gouveia <aragon@phat.za.net>
Diffstat (limited to 'sys/netinet/tcp.h')
| -rw-r--r-- | sys/netinet/tcp.h | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/netinet/tcp.h b/sys/netinet/tcp.h index 6c214e8..3b72094 100644 --- a/sys/netinet/tcp.h +++ b/sys/netinet/tcp.h @@ -67,7 +67,9 @@ struct tcphdr { #define TH_PUSH 0x08 #define TH_ACK 0x10 #define TH_URG 0x20 -#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) +#define TH_ECE 0x40 +#define TH_CWR 0x80 +#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR) u_short th_win; /* window */ u_short th_sum; /* checksum */ |
