lkml.org 
[lkml]   [2004]   [Jun]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: TCP-RST Vulnerability - Doubt
    On Mon, Jun 28, 2004 at 01:22:37PM +0000, Miquel van Smoorenburg wrote:
    >
    > MD5 protection on BGP sessions isn't very common yet.

    The Cisco routers we deployed 3.5 years ago were already configured with MD5
    enabled on BGP, this was on IOS 12.0 at this time. And I guess that Cisco
    still has a good share amongst the BGP setups.

    > MD5 uses CPU,
    > and routers don't usually have much of that. Which means that now an
    > MD5 CPU attack is possible instead of a TCP RST attack.

    MD5 is not that much expensive. I even wonder if all those new routers
    with VPN hardware acceleration, MD5 could not be computed in hardware
    at nearly no cost.

    > The "TTL hack" solution is safer. Make sure sender uses a TTL
    > of 255, on the receiver discard all packets with a TTL < 255.
    > You can use iptables to implement that on a Linux box.

    This will not work in an eBGP multi-hop setup. However, you can often
    still discard packets with a TTL < 252 or something like that, which
    might imply a packet from outside the provider's area.

    But the real problem is that the provider should do the anti-spoofing
    himself and not accept BGP packets from the wrong NIC ! And it's relatively
    easy to show them where they're bad.

    Regards,
    Willy

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:04    [W:0.024 / U:152.436 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site