You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/rules
Philippe Antoine 6cb6225b28 tcp: rejects FIN+SYN packets as invalid
Ticket: #4569

If a FIN+SYN packet is sent, the destination may keep the
connection alive instead of starting to close it.
In this case, a later SYN packet will be ignored by the
destination.

Previously, Suricata considered this a session reuse, and thus
used the sequence number of the last SYN packet, instead of
using the one of the live connection, leading to evasion.

This commit errors on FIN+SYN so that they do not get
processed as regular FIN packets.
3 years ago
..
Makefile.am
app-layer-events.rules
decoder-events.rules ipv6: decoder event on invalid length 3 years ago
dhcp-events.rules
dnp3-events.rules
dns-events.rules
files.rules
http-events.rules http/range: reassemble files from different flows with range 3 years ago
http2-events.rules http2: follow range requests 3 years ago
ipsec-events.rules ike: set event for multiple server proposals 3 years ago
kerberos-events.rules
modbus-events.rules
mqtt-events.rules
nfs-events.rules
ntp-events.rules
smb-events.rules
smtp-events.rules
ssh-events.rules
stream-events.rules tcp: rejects FIN+SYN packets as invalid 3 years ago
tls-events.rules