you do know you can just put a firewall rule in to prevent any IP options from hitting the server
The rule (matches header length > 20 bytes, i.e. IHL 6–15):
iptables -I INPUT 1 -m u32 --u32 "0>>24&0x0F=6:15" -m comment --comment ipopts-stopgap -j DROP
- ufw: add
-A ufw-before-input -m u32 --u32 "0>>24&0x0F=6:15" -j DROPto/etc/ufw/before.rules, above theRELATED,ESTABLISHEDaccept line. Then runufw reload. - csf: put the iptables line in
/usr/local/csf/bin/csfpre.shso it survives csf restarts. - Docker hosts: use
-t raw -I PREROUTINGinstead, so container traffic is covered too.
Test: run ping -R at the box and watch the counter go up in iptables -L INPUT -v -n. Note that many networks drop option packets in transit, so test from the same LAN or a local netns.
its a stopgap. not a fix. but you don't have to take all your servers offline ..... just put the block in and wait for the patch
which once again begs the question. why the fuck is your freezer connected to the internet