On Thu, 7 Feb 2013 09:52:40 -0800 Kees Cook <keescook@xxxxxxxxxxxx> wrote: > This is based on Willy Tarreau's patch from 2008[1]. The goal is to > close a corner-case of TCP that isn't used and poses a small DoS risk. > For systems that do not want to take any risk at all, this is a desirable > configuration knob. > > It is possible for two clients to connect with crossed SYNs without > checking sequence numbers. As such, it might be possible to guess a source > port number to block a system from making connections to well-known > ports and IP addresses (e.g. auto-update checks) without requiring a > MiTM position. > This patch probably also breaks TCP STUNT that is used by some applications for NAT traversal. -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
