Hello Darren, Thank you for the patch! I appreciate your help very much. By any chance, is it possible to have an IPF 3.x patch as well? I would help me a lot. Thanks!
-Alex Zhilyakov Network Manager, Accatel Inc. +1-212-3794000 On Sat, 13 Nov 2004, Darren Reed wrote: > > Or, maybe there is a way to set up the following behaviour: pass all udp > > frags where offset > sizeof(udp header). For frags where offset=0 and > > size >= sizeof(udp header), run it through firewall rules to make a > > decision. This should give a better work-around for udp frags coming in > > wrong order, because all frags but first will sit in IP stack and not be > > reassembled and passed to application layer until first frag arrives, and > > first frag is contolled by firewall fules. I could not figure out by > > documentation if smth like this is possible. > > For this, I can give you a patch to work with IPFilter 4.1. > > It changes the "fragtail" flag to be "fragbody" and allows you to write > rules like this: > > block in quick all with short > pass in proto udp all with frag-body > pass in proto udp from .. port ... to ... port ... > > And that should work for you. > > Darren
