)]}'
{
  "commit": "4835453ce464b3067d3ebb86e782bae273531381",
  "tree": "965d04e4164bfcfd27348a148fc9e95661fe219c",
  "parents": [
    "c8d2bc9bc39ebea8437fd974fdbc21847bb897a3"
  ],
  "author": {
    "name": "Kees Cook",
    "email": "keescook@chromium.org",
    "time": "Thu Jan 31 13:19:28 2013 -0800"
  },
  "committer": {
    "name": "Kees Cook",
    "email": "keescook@chromium.org",
    "time": "Sun Oct 02 21:56:57 2016 -0700"
  },
  "message": "tcp: sysctl to disable TCP simultaneous connect\n\nThis is based on Willy Tarreau\u0027s patch from 2008[1]. The goal is to\nclose a corner-case of TCP that isn\u0027t used and poses a small DoS risk.\nFor systems that do not want to take any risk at all, this is a desirable\nconfiguration knob.\n\nIt is possible for two clients to connect with crossed SYNs without\nchecking sequence numbers. As such, it might be possible to guess a source\nport number to block a system from making connections to well-known\nports and IP addresses (e.g. auto-update checks) without requiring a\nMiTM position.\n\nThe feature can now be disabled via sysctl:\n\n$ echo 0 \u003e /proc/sys/net/ipv4/tcp_simult_connect\n$ echo ohai | nc -w 1 -p 50000 localhost 50000 -v -v -v\nnc: connect to localhost port 50000 (tcp) timed out: Operation now in progress\nnc: connect to localhost port 50000 (tcp) timed out: Operation now in progress\n\n$ echo 1 \u003e /proc/sys/net/ipv4/tcp_simult_connect\n$ echo ohai | nc -w 1 -p 50000 localhost 50000 -v -v -v\nConnection to localhost 50000 port [tcp/*] succeeded!\nohai\n\n[1] http://thread.gmane.org/gmane.linux.network/107971\n\nCc: Willy Tarreau \u003cw@1wt.eu\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "9ae929395b24c442e61bb81e07609fbf8c55ffdb",
      "old_mode": 33188,
      "old_path": "Documentation/networking/ip-sysctl.txt",
      "new_id": "be1f21612c2009e581bb04de4f6a2e451fb88a36",
      "new_mode": 33188,
      "new_path": "Documentation/networking/ip-sysctl.txt"
    },
    {
      "type": "modify",
      "old_id": "7717302cab91e1bb18cc42c3f2d4b51f98f3c148",
      "old_mode": 33188,
      "old_path": "include/net/tcp.h",
      "new_id": "dadf8925c2b978559e22123aca63b2bf6f975ac6",
      "new_mode": 33188,
      "new_path": "include/net/tcp.h"
    },
    {
      "type": "modify",
      "old_id": "1cb67de106fee1103aa487af1f889ae6aea0c80c",
      "old_mode": 33188,
      "old_path": "net/ipv4/sysctl_net_ipv4.c",
      "new_id": "9efe1d4feaebb3dc62c4d3974bedb47ce9205401",
      "new_mode": 33188,
      "new_path": "net/ipv4/sysctl_net_ipv4.c"
    },
    {
      "type": "modify",
      "old_id": "a756b8749a26b59f8a093d12e747aca8eead67cc",
      "old_mode": 33188,
      "old_path": "net/ipv4/tcp_input.c",
      "new_id": "53e2c7505695f27827a742faf1061e7e1811ad98",
      "new_mode": 33188,
      "new_path": "net/ipv4/tcp_input.c"
    }
  ]
}