ufw: add -A ufw-before-input -m u32 --u32"0>>24&0x0F=6:15" -j DROP to /etc/ufw/before.rules, above the RELATED,ESTABLISHED accept line. Then run ufw reload.
csf: put the iptables line in /usr/local/csf/bin/csfpre.sh so it survives csf restarts.
Docker hosts: use -t raw -I PREROUTING instead, so container traffic is covered too.
Test: run ping -R at the box and watch the counter go up in iptables -L INPUT -v -n. Note that many networks drop option packets in transit, so test from the same LAN or a local netns.
its a stopgap. not a fix. but you don’t have to take all your servers offline …
just put the block in and wait for the patch
you do know you can just put a firewall rule in to prevent any IP options from hitting the server
The rule (matches header length > 20 bytes, i.e. IHL 6–15):
-A ufw-before-input -m u32 --u32 "0>>24&0x0F=6:15" -j DROPto/etc/ufw/before.rules, above theRELATED,ESTABLISHEDaccept line. Then runufw reload./usr/local/csf/bin/csfpre.shso it survives csf restarts.-t raw -I PREROUTINGinstead, so container traffic is covered too.Test: run
ping -Rat the box and watch the counter go up iniptables -L INPUT -v -n. Note that many networks drop option packets in transit, so test from the same LAN or a local netns.its a stopgap. not a fix. but you don’t have to take all your servers offline … just put the block in and wait for the patch