This behavior is required in IPv6, and there is little need to tolerate overlapping fragments in IPv4. This change simplifies the code and eliminates potential DDoS attack vectors. Tested: ran ip_defrag selftest (not yet available uptream).
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -56,6 +56,7 @@ enum · 55 unmodified lines | ||
| 56 | 56 | IPSTATS_MIB_ECT1PKTS, /* InECT1Pkts */ |
| 57 | 57 | IPSTATS_MIB_ECT0PKTS, /* InECT0Pkts */ |
| 58 | 58 | IPSTATS_MIB_CEPKTS, /* InCEPkts */ |
| 59 | + IPSTATS_MIB_REASM_OVERLAPS, /* ReasmOverlaps */ | |
| 59 | 60 | __IPSTATS_MIB_MAX |
| 60 | 61 | }; |
| 61 | 62 | |