Messages in this thread | | | Date | Thu, 7 Feb 2013 10:39:50 -0800 | From | Stephen Hemminger <> | Subject | Re: [PATCH] tcp: sysctl to disable TCP simultaneous connect |
| |
On Thu, 7 Feb 2013 09:52:40 -0800 Kees Cook <keescook@chromium.org> wrote:
> This is based on Willy Tarreau's patch from 2008[1]. The goal is to > close a corner-case of TCP that isn't used and poses a small DoS risk. > For systems that do not want to take any risk at all, this is a desirable > configuration knob. > > It is possible for two clients to connect with crossed SYNs without > checking sequence numbers. As such, it might be possible to guess a source > port number to block a system from making connections to well-known > ports and IP addresses (e.g. auto-update checks) without requiring a > MiTM position. >
This patch probably also breaks TCP STUNT that is used by some applications for NAT traversal.
| |