Re: TCP-RST Vulnerability - Doubt

[Willy Tarreau <willy@w.ods.org>]

On Mon, Jun 28, 2004 at 01:22:37PM +0000, Miquel van Smoorenburg wrote:
> 
> MD5 protection on BGP sessions isn't very common yet.

The Cisco routers we deployed 3.5 years ago were already configured with MD5
enabled on BGP, this was on IOS 12.0 at this time. And I guess that Cisco
still has a good share amongst the BGP setups.

> MD5 uses CPU,
> and routers don't usually have much of that. Which means that now an
> MD5 CPU attack is possible instead of a TCP RST attack.

MD5 is not that much expensive. I even wonder if all those new routers
with VPN hardware acceleration, MD5 could not be computed in hardware
at nearly no cost.
 
> The "TTL hack" solution is safer. Make sure sender uses a TTL
> of 255, on the receiver discard all packets with a TTL < 255.
> You can use iptables to implement that on a Linux box.

This will not work in an eBGP multi-hop setup. However, you can often
still discard packets with a TTL < 252 or something like that, which
might imply a packet from outside the provider's area.

But the real problem is that the provider should do the anti-spoofing
himself and not accept BGP packets from the wrong NIC ! And it's relatively
easy to show them where they're bad.

Regards,
Willy