Subject: Re: TTL treatment in draft-ietf-zeroconf-ipv4-linklocal-07.txt

From: Brad Hards <[email-masked]>
Date: Wed, 27 Nov 2002 08:24:58 +1100

On Wed, 27 Nov 2002 08:12, Jeb R. Linton wrote:
> > From: [email-masked]  On Behalf Of Brad Hards
> >
> > If you SET 1 on sending, then you do not know if the packet
> > originated on the local link, but you do know that, even
> > in the presence of pretty broken routing, the packet is
> > unlikely to leave the local link. There is no point in
> > checking on receipt.
>
> Not necessarily true, IMHO. If compatibility rather than security is to
> be the default behavior, the standard could be to set TTL=1. This would
> allow potentially useful TTL=1 checking as a user option in order to
> catch the majority of script-kiddie DoS attacks. As was pointed out
> earlier, an attacker would have to match the TTL to the true number of
> hops in order to defeat this, so it seems likely that this would offer
> protection from a good percentage of attacks.
traceroute(8) will make the script automatic.

I agree with your point about checking TTL causing breakage. If you are going 
to check for anything, then it has to be TTL=255. Anything else is just pain 
for no real benefit.

The other issue that I should have brought up before is the real need for 
interoperability. Link-local addresses aren't really that useful in most of 
the current implementations. It is possible to fix the current 
implementations with some admin work (registry hacks, updating to better 
operating system), so how much pain are we talking about by enforcing TTL 
checks from the day of the RFC issue?

Brad

Brad
- -- 
http://linux.conf.au. 22-25Jan2003. Perth, Aust. I'm registered. Are you?

---

From: Stuart Cheshire <[email-masked]>
Date: Wed, 27 Nov 2002 16:32:12 -0800

>Talking on behalf of Apple, we consider that dropping datagrams from 
>169.254 with TTL != 255 is a MUST. All recent versions of Mac OS 9 and 
>Mac OS X do implement this behavior and we've already accepted the fact 
>that we may fail to interoperate with older version of Mac OS.

Let me add a correction:

Since 2001, Mac OS 9 and X machines have set the TTL to 255, but not 
checked the TTL on inbound packets. This was done to provide a one-year 
"grace period" where Macs emit correct packets, but remain compatible 
with older systems that don't.

Starting in August 2002, the one-year "grace period" was over, and Mac OS 
X 10.2 started enforcing the check on inbound packets. We felt that one 
year should be enough time for other vendors to ship software updates to 
bring their products in-line with what the working group had agreed.

Stuart Cheshire <[email-masked]>
 * Wizard Without Portfolio, Apple Computer, Inc.
 * Chairman, IETF Zeroconf
 * www.stuartcheshire.org