diff options
| author | Peter Oskolkov <[email protected]> | 2018-08-02 23:34:37 +0000 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2018-08-06 00:16:46 +0000 |
| commit | 7969e5c40dfd04799d4341f1b7cd266b6e47f227 (patch) | |
| tree | 167103e66b8f8ebf96bf4ca7644c3e0f7b3bca10 /net/ipv4/proc.c | |
| parent | net/tls: Mark the end in scatterlist table (diff) | |
| download | kernel-7969e5c40dfd04799d4341f1b7cd266b6e47f227.tar.gz kernel-7969e5c40dfd04799d4341f1b7cd266b6e47f227.zip | |
ip: discard IPv4 datagrams with overlapping segments.
This behavior is required in IPv6, and there is little need
to tolerate overlapping fragments in IPv4. This change
simplifies the code and eliminates potential DDoS attack vectors.
Tested: ran ip_defrag selftest (not yet available uptream).
Suggested-by: David S. Miller <[email protected]>
Signed-off-by: Peter Oskolkov <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
Cc: Florian Westphal <[email protected]>
Acked-by: Stephen Hemminger <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'net/ipv4/proc.c')
| -rw-r--r-- | net/ipv4/proc.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c index b46e4cf9a55a..70289682a670 100644 --- a/net/ipv4/proc.c +++ b/net/ipv4/proc.c @@ -119,6 +119,7 @@ static const struct snmp_mib snmp4_ipextstats_list[] = { SNMP_MIB_ITEM("InECT1Pkts", IPSTATS_MIB_ECT1PKTS), SNMP_MIB_ITEM("InECT0Pkts", IPSTATS_MIB_ECT0PKTS), SNMP_MIB_ITEM("InCEPkts", IPSTATS_MIB_CEPKTS), + SNMP_MIB_ITEM("ReasmOverlaps", IPSTATS_MIB_REASM_OVERLAPS), SNMP_MIB_SENTINEL }; |