I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know:
- RFC 2385 was designed to protect BGP, and by extension BGP-type protocols (i.e. long running TCP connections).
- BGP uses long-running TCP connections, HTTP does not.
- Encryption/IPSec has superseded RFC 2385 for protecting BGP.
- The TCP RST attack is against long running TCP connections because the attack relies on probability.
- The impact against resetting a HTTP kept-alive connection is that the next request would restart it.
- Most connections transfer data in milliseconds, the window of attack is too small for HTTP to effectively targeted. The attack depends on the window size and bandwidth of the attacker against the server and seem to take seconds even under good conditions according to page 25 of Slipping in the window: TCP reset attacks)
- A web view is typically made up of multiple connections for each connected client making this type of denial of service unattractive compared to alternatives.
- Linux (specifically RHEL or Debian) has support for rfc2385 but can't be globally enabled.
- Neither NGINX nor Apache has configuration options to open sockets with tcp-md5-checksums enabled.
- Even if rfc2385 was active for HTTP, it wouldn't solve a problem, but would increase load on the server. Which is only a minor side point.
I've attempted to explain that rfc2385 isn't relevant to web servers, but they are saying it's an issue with TCP which while true, simplifies that it's an attack against a specific nature of the TCP connection.
I've resorted to explaining that neither Apache and nginx can enable what they're asking for. They keep sending me knowledge base documents mentioning Windows, Cisco, NetBSD, BGP, but never anything relating to apache nor nginx.
Beyond the linked documents I've sent them LWN explaining it:
It would be hard to use this technique to shut down a web server; HTTP connections tend to be short-lived to begin with.
There is a patch available on Windows that fixes the warning which they are sending through as a suggestion, but it's clearly doesn't accomplish anything for linux.
Am I speaking nonsense? What would be your suggestion of getting the client that have security compliance to worry about to get on the same page as me?