Protection against rule map update attacks

摘要

Technologies are described herein to manage the replacement of routing rules. Some example technologies may receive a request to replace one or more active rules in a routing device with one or more stored rules. Each of the active rules and the stored rules may specify a routing rule that specifies how to route packets within a network. The active rules may be routing rules that are actively being used by the routing device. The stored rules may be routing rules that are not currently in use by the routing device. A determination may be made as to whether a number of active rule replacements for the routing device exceeds a threshold. In response to determining that the number of the active rule replacements exceeds the threshold, the request to replace the one or more active rules in the routing device may be denied.

主权项

1. A method to manage replacement of routing rules for use by a routing device, the method comprising:
receiving a request to replace one or more active rules in the routing device with one or more stored rules, each of the one or more active rules and each of the one or more stored rules specifying a routing rule that specifies how to route packets within a network, wherein the stored rules are not actively being used by the routing device for routing; determining a number of active rule replacements for the routing device; determining that the number of the active rule replacements exceeds a threshold; and in response to determining that the number of the active rule replacements exceeds the threshold, denying the request to replace the one or more active rules in the routing device for a period of time until the routing device is determined to be capable to process the request to replace the one or more active rules.