Re: unclean match
On Tue, 20 Aug 2002, Bernd Eckenfels wrote:
> On Tue, Aug 20, 2002 at 02:46:25PM +0200, Michael Kreilmeier wrote:
>> well, that's kind of what I thought. Does this module make it
>> unnecessary to filter out any bad combination of tcp-flags tha
>> classic way?
>
> you should realy read the source:
>
> /usr/src/linux/net/ipv4/netfilter/ipt_unclean.c
>
> it filters for example...
[...]
> /* CHECK: TCP reserved bits zero. */
> if(tcp_flag_word(tcph) & TCP_RESERVED_BITS) {
> limpk("TCP reserved bits not zero\n");
> return 0;
> }
Ack. Something to watch out for, then: the unclean match used to
consider any ECN packet "unclean". That snippet looks like it still may.
Be very careful if you enable this match, then, that you don't break ECN
connections.
Daniel
--
Hocine Bibo Aut In Eum Digitos Insero?
Reply to: