On FreeBSD, you can just copy a full chunck of frag reassemble code from the back of ip_input() function to somewhere before the ipf hook. The downside is you can't use ipf or ipfw to block fragments, all fragment are reassembled before reaching ipf and ipfw, or they are dropped from the reassembly queue if the header frag doesn't arrive before the timeout. You can forget all "keep frag" rules on the ipf because it will not see any fragmented packet.
Will there be risk? maybe a fragment flood can use up all your mbuf. However, if you allow frag to pass without seeing its header, you are better off to let your firewall to crash rather than the host that the firewall is protecting.
If you only interested in solve the udp fragment issue, you can wrap the reassemble code you "copy" with a proto==IPPROTO_UDP test, and leave the rest of the protocol to run the default freebsd execution path.
Hope it might help, Ming
Alex Zhilyakov wrote:
Hello Darren,
Thank you for the patch! I appreciate your help very much. By any chance, is it possible to have an IPF 3.x patch as well? I would help me a lot. Thanks!
-Alex Zhilyakov Network Manager, Accatel Inc. +1-212-3794000
On Sat, 13 Nov 2004, Darren Reed wrote:
Or, maybe there is a way to set up the following behaviour: pass all udp
frags where offset > sizeof(udp header). For frags where offset=0 and
size >= sizeof(udp header), run it through firewall rules to make a
decision. This should give a better work-around for udp frags coming in
wrong order, because all frags but first will sit in IP stack and not be
reassembled and passed to application layer until first frag arrives, and
first frag is contolled by firewall fules. I could not figure out by
documentation if smth like this is possible.
For this, I can give you a patch to work with IPFilter 4.1.
It changes the "fragtail" flag to be "fragbody" and allows you to write rules like this:
block in quick all with short pass in proto udp all with frag-body pass in proto udp from .. port ... to ... port ...
And that should work for you.
Darren
