diff options
| author | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2012-08-31 09:55:54 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-11-26 11:34:46 -0800 |
| commit | d87b26d50da9eca1be14216c9f7dac5b9b0ae3f9 (patch) | |
| tree | ce1874000463346a0a3d5b6d4fe509b8443385c4 /lib/debugobjects.c | |
| parent | 02f7a0df82b15ceee37e2e24caa5dd68a2585682 (diff) | |
netfilter: Validate the sequence number of dataless ACK packets as well
commit 4a70bbfaef0361d27272629d1a250a937edcafe4 upstream.
We spare nothing by not validating the sequence number of dataless
ACK packets and enabling it makes harder off-path attacks.
See: "Reflection scan: an Off-Path Attack on TCP" by Jan Wrobel,
http://arxiv.org/abs/1201.2074
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'lib/debugobjects.c')
0 files changed, 0 insertions, 0 deletions