NetFlow harderning: RNG, config limit of DATA cached in SYN_RCVD state, configurable listen backlog, corner-case bug fix x 2. / GitHub CI tweaks. / Comment and/or doc changes.#114

Merged

ygoldfeld merged 24 commits into

mainfrom

flow-112-113_rng-and-syn-security

May 4, 2026

Commits on Apr 21, 2026

NetFlow: Using a CSPRNG (a-la `/dev/urandom`) for three classic cryptographically-sensitive RNG call sites in this TCP-like-over-UDP protocol impl: Ephemeral ports, initial sequence numbers, and 3-…
ygoldfeld
committed
(cont) Build fix.
ygoldfeld
committed
(cont) Build fix.
ygoldfeld
committed
(cont) Build fix.
ygoldfeld
committed
(cont) Build fix.
ygoldfeld
committed
NetFlow: Added backlog limit such that a `Server_socket` will reject (with RST) any SYN, when the number of half-opened plus not-user-accepted connection reaches that limit for that `Server_socket`…
ygoldfeld
committed
NetFlow: DATA packets received (potentially legitimately due to loss or reordering) to a half-opened connection were previously limited by a more general buffer-size limit; it is now a new separate…
ygoldfeld
committed
(cont) Build fix.
ygoldfeld
committed

Commits on Apr 23, 2026

Commits on Apr 24, 2026