From 2d66b44732405bb788287bed726de637a20df68f Mon Sep 17 00:00:00 2001
From: Brendan O'Dea <bod@optus.net>
Date: Mon, 14 Nov 2005 08:38:02 +0000
Subject: [PATCH 1/1] fix fragment handling in ip_filter

---
 Changes     | 3 +++
 l2tpns.c    | 7 +++++--
 l2tpns.h    | 4 ++--
 l2tpns.spec | 6 +++---
 4 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/Changes b/Changes
index a975f5b..2e4efa7 100644
--- a/Changes
+++ b/Changes
@@ -1,3 +1,6 @@
+* Mon Nov 14 2005 Brendan O'Dea <bod@optus.net> 2.1.11
+- Fix fragment handling in ip_filter.
+
 * Sat Nov 5 2005 Brendan O'Dea <bod@optus.net> 2.1.10
 - Add scripts/l2tpns-capture.
 - Fix LCP Echo frequency.
diff --git a/l2tpns.c b/l2tpns.c
index 0c0921c..ab9aded 100644
--- a/l2tpns.c
+++ b/l2tpns.c
@@ -4,7 +4,7 @@
 // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
 // vim: sw=8 ts=8
 
-char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.146 2005-11-04 14:41:50 bodea Exp $";
+char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.147 2005-11-14 08:38:02 bodea Exp $";
 
 #include <arpa/inet.h>
 #include <assert.h>
@@ -5350,7 +5350,10 @@ int ip_filter(uint8_t *buf, int len, uint8_t filter)
 
 		if (frag_offset)
 		{
-			if (!rule->frag || rule->action == FILTER_ACTION_DENY)
+			// non-fragmented deny rules are skipped if containing L4 matches
+			if (!rule->frag &&
+			    (rule->src_ports.op || rule->dst_ports.op || rule->tcp_flag_op) &&
+			    rule->action == FILTER_ACTION_DENY)
 				continue;
 		}
 		else
diff --git a/l2tpns.h b/l2tpns.h
index e1d2d0d..6fcdf2b 100644
--- a/l2tpns.h
+++ b/l2tpns.h
@@ -1,5 +1,5 @@
 // L2TPNS Global Stuff
-// $Id: l2tpns.h,v 1.97 2005-11-04 14:41:50 bodea Exp $
+// $Id: l2tpns.h,v 1.98 2005-11-14 08:38:02 bodea Exp $
 
 #ifndef __L2TPNS_H__
 #define __L2TPNS_H__
@@ -15,7 +15,7 @@
 #include <sys/types.h>
 #include <libcli.h>
 
-#define VERSION	"2.1.10"
+#define VERSION	"2.1.11"
 
 // Limits
 #define MAXTUNNEL	500		// could be up to 65535
diff --git a/l2tpns.spec b/l2tpns.spec
index 434f222..65d22dd 100644
--- a/l2tpns.spec
+++ b/l2tpns.spec
@@ -1,6 +1,6 @@
 Summary: A high-speed clustered L2TP LNS
 Name: l2tpns
-Version: 2.1.10
+Version: 2.1.11
 Release: 1
 Copyright: GPL
 Group: System Environment/Daemons
@@ -43,5 +43,5 @@ rm -rf %{buildroot}
 %attr(644,root,root) /usr/share/man/man[58]/*
 
 %changelog
-* Sat Nov 5 2005 Brendan O'Dea <bod@optus.net> 2.1.10-1
-- 2.1.10 release, see /usr/share/doc/l2tpns-2.1.10/Changes
+* Mon Nov 14 2005 Brendan O'Dea <bod@optus.net> 2.1.11-1
+- 2.1.11 release, see /usr/share/doc/l2tpns-2.1.11/Changes
-- 
2.20.1