holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Reject SPT=0 SYN under 'tcpflags' option

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@366 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2002-12-13 23:39:57 +00:00
parent 46f0ae548f
commit 6f5a5cf9c0
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
STABLE/firewall
View File

@ -3326,6 +3326,12 @@ add_common_rules() {
run_iptables -A tcpflags -p tcp --tcp-flags ALL NONE $disposition run_iptables -A tcpflags -p tcp --tcp-flags ALL NONE $disposition
run_iptables -A tcpflags -p tcp --tcp-flags SYN,RST SYN,RST $disposition run_iptables -A tcpflags -p tcp --tcp-flags SYN,RST SYN,RST $disposition
run_iptables -A tcpflags -p tcp --tcp-flags SYN,FIN SYN,FIN $disposition run_iptables -A tcpflags -p tcp --tcp-flags SYN,FIN SYN,FIN $disposition
#
# A Shorewall user reported seeing outgoing SYN ACK packets with DPT=0
# That prompted me to add the following which will stop an incoming
# SYN with SPT=0
#
run_iptables -A tcpflags -p tcp --syn --sport 0 $disposition
for interface in $interfaces; do for interface in $interfaces; do
for chain in `first_chains $interface`; do for chain in `first_chains $interface`; do