GTSM and TCP accept problem

[Stephen Hemminger <shemminger@vyatta.com>]

The implementation of Generalized TTL Security has a problem
on the TCP accept side. Since there can be different number of
hops for each peer, the listener ends up doing

   socket
   bind
   set TTL to 255
   listen
   while (nfd = accept(peer)) {
     info = lookup(peer)
     set MINTTL to 255 - info->ttl_hops


The problem is that a rogue peer can still do three way
handshake causing the accept to succeed. But the rogue will
leave a stuck connection that will then have to timeout.

The only ways I have come up to deal with this are:
   * have short timeout on initial data (recycle faster)
   * push peer;MINTTL table down into kernel (per socket)
   * have BGP do this through iptables which is a non-starter
     for a general application that needs to run on BSD, and
     would mess up existing firewall rules.

Ideas welcome..