fix fragment handling in ip_filter

diff --git a/Changes b/Changes
index a975f5b..2e4efa7 100644 (file)
--- a/Changes
+++ b/Changes
@@ -1,3 +1,6 @@
+* Mon Nov 14 2005 Brendan O'Dea <bod@optus.net> 2.1.11
+- Fix fragment handling in ip_filter.
+

 * Sat Nov 5 2005 Brendan O'Dea <bod@optus.net> 2.1.10
 - Add scripts/l2tpns-capture.
 - Fix LCP Echo frequency.
 * Sat Nov 5 2005 Brendan O'Dea <bod@optus.net> 2.1.10
 - Add scripts/l2tpns-capture.
 - Fix LCP Echo frequency.

diff --git a/l2tpns.c b/l2tpns.c
index 67211ce..8af4eb2 100644 (file)
--- a/l2tpns.c
+++ b/l2tpns.c
@@ -4,7 +4,7 @@
 // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
 // vim: sw=8 ts=8
 
 // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
 // vim: sw=8 ts=8
 

-char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.146 2005/11/04 14:41:50 bodea Exp $";
+char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.147 2005/11/14 08:38:02 bodea Exp $";

 
 #include <arpa/inet.h>
 #include <assert.h>
 
 #include <arpa/inet.h>
 #include <assert.h>


@@ -5350,7 +5350,10 @@ int ip_filter(uint8_t *buf, int len, uint8_t filter)
 
                if (frag_offset)
                {
 
                if (frag_offset)
                {

-                       if (!rule->frag || rule->action == FILTER_ACTION_DENY)
+                       // non-fragmented deny rules are skipped if containing L4 matches
+                       if (!rule->frag &&
+                           (rule->src_ports.op || rule->dst_ports.op || rule->tcp_flag_op) &&
+                           rule->action == FILTER_ACTION_DENY)

                                continue;
                }
                else
                                continue;
                }
                else

diff --git a/l2tpns.h b/l2tpns.h
index 9693dbe..1412cbd 100644 (file)
--- a/l2tpns.h
+++ b/l2tpns.h
@@ -1,5 +1,5 @@
 // L2TPNS Global Stuff
 // L2TPNS Global Stuff

-// $Id: l2tpns.h,v 1.97 2005/11/04 14:41:50 bodea Exp $
+// $Id: l2tpns.h,v 1.98 2005/11/14 08:38:02 bodea Exp $

 
 #ifndef __L2TPNS_H__
 #define __L2TPNS_H__
 
 #ifndef __L2TPNS_H__
 #define __L2TPNS_H__


@@ -15,7 +15,7 @@
 #include <sys/types.h>
 #include <libcli.h>
 
 #include <sys/types.h>
 #include <libcli.h>
 

-#define VERSION        "2.1.10"
+#define VERSION        "2.1.11"

 
 // Limits
 #define MAXTUNNEL      500             // could be up to 65535
 
 // Limits
 #define MAXTUNNEL      500             // could be up to 65535

diff --git a/l2tpns.spec b/l2tpns.spec
index 434f222..65d22dd 100644 (file)
--- a/l2tpns.spec
+++ b/l2tpns.spec
@@ -1,6 +1,6 @@
 Summary: A high-speed clustered L2TP LNS
 Name: l2tpns
 Summary: A high-speed clustered L2TP LNS
 Name: l2tpns

-Version: 2.1.10
+Version: 2.1.11

 Release: 1
 Copyright: GPL
 Group: System Environment/Daemons
 Release: 1
 Copyright: GPL
 Group: System Environment/Daemons


@@ -43,5 +43,5 @@ rm -rf %{buildroot}
 %attr(644,root,root) /usr/share/man/man[58]/*
 
 %changelog
 %attr(644,root,root) /usr/share/man/man[58]/*
 
 %changelog

-* Sat Nov 5 2005 Brendan O'Dea <bod@optus.net> 2.1.10-1
-- 2.1.10 release, see /usr/share/doc/l2tpns-2.1.10/Changes
+* Mon Nov 14 2005 Brendan O'Dea <bod@optus.net> 2.1.11-1
+- 2.1.11 release, see /usr/share/doc/l2tpns-2.1.11/Changes