| commit | 4a70bbfaef0361d27272629d1a250a937edcafe4 | [log] [tgz] |
|---|---|---|
| author | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | Fri Aug 31 09:55:54 2012 +0000 |
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | Sun Sep 09 22:13:49 2012 +0200 |
| tree | 8389e2f3b55cfcec5770a9fd83b9a52c31e4128b | |
| parent | 64f509ce71b08d037998e93dd51180c19b2f464c [diff] |
netfilter: Validate the sequence number of dataless ACK packets as well We spare nothing by not validating the sequence number of dataless ACK packets and enabling it makes harder off-path attacks. See: "Reflection scan: an Off-Path Attack on TCP" by Jan Wrobel, http://arxiv.org/abs/1201.2074 Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>