Re: Linux 2.4.27 SECURITY BUG - TCP Local and REMOTE(verified) Denial of Service Attack

Tonnerre
2004-09-13T19:10:28Z

[-- Attachment #1: Type: text/plain, Size: 511 bytes --]

Salut,

On Mon, Sep 13, 2004 at 06:18:47AM +0200, Willy Tarreau wrote:
> > The BGP state machine should instead, in normal operation, have
> > only treated Hold time expired as the definitive sign of "peer is
> > down" and allowed reconnects.
>
> It should not necessarily wait for the time-out, but at least wait for
> a few reconnect errors.

Problem there: you can fake connection errors almost as easily as
sending an RST packet, so the DoS might reappear, might it not?

Tonnerre

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]