Module Name: src Committed By: maxv Date: Thu Mar 1 06:08:44 UTC 2018
Modified Files: src/sys/netinet: tcp_input.c Log Message: Revert rev1.183 (2003). It was intended as an optimization, but it increases the attack surface: the IPsec policy is not enforced on RST packets when the socket is in the LISTEN state, and an (unauthenticated) attacker could jam the connection between two IPsec hosts by sending RST packets between the client's SYN and ACK packets. Discussed with ozaki-r@. To generate a diff of this commit: cvs rdiff -u -r1.382 -r1.383 src/sys/netinet/tcp_input.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.