On 13 Apr 2014, at 01:54, tolga ceylan <[email protected]> wrote:
> > The RFC has a lot of statements about silently dropping packets in case of > various anomalies. But the correct action should be to drop the connection. > This would uncover faulty implementations and other bugs that may > slide due to 'silently drop' behavior. It'll also make malicious > activity a bit more difficult and exposed due to the necessity to reestablish > connections for any brute force attempts. > > What is your opinion on this? There are two MUST discards. One is the the payload being reflected doesn't match, the other is the the payload_length is too large. The second one is the critical one for the heartbleed attack. Let us consider this case. It is clear that you don't respond. You could keep the connection or drop it. When dropping it, you give the attacker an immediate indication that you are not vulnerable. So the attacker can move on. If you don't drop the connection, the attacker has to wait until he decides that the stack is not vulnerable. So it takes more resources on his side. However, the crucial point is to follow the MUST and not send the heartbeat response... Best regards Michael > > Cheers, > Tolga Ceylan > > > > > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > Development Mailing List [email protected] > Automated List Manager [email protected] > ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
