Subject: Security discussion for TTL=255 now out of scope

From: Stuart Cheshire <[email-masked]>
Date: Wed, 27 Nov 2002 16:03:31 -0800

Thomas Narten made the following comment:

>In the case here, it seems like the 255 check provides
>a small security benefit, with the emphasis on small.

Erik Guttman and I have discussed this matter and have agreed that in the 
interests of reaching a conclusion on this document, it is necessary to 
declare that:

     ANY FURTHER DEBATE ON WHETHER THE SECURITY BENEFIT OF
     CHECKING THE RECEIVED TTL IS TINY/SMALL/MEDIUM/LARGE/ETC.
     IS OUT OF SCOPE FOR FURTHER DISCUSSION ON THE LIST.

All discussion in this area has proved religious and fruitless.

What we can all agree is that if you receive an IP packet with a TTL of 
255, it is safe to assume it originated from another host on the same 
link. What the receiver decides to do with this knowledge (with respect 
to security or anything else) is up to the receiver. The point is that 
TTL=255 gives the receiver some (small) piece of information about origin 
of the packet.

Stuart Cheshire <[email-masked]>
 * Wizard Without Portfolio, Apple Computer, Inc.
 * Chairman, IETF Zeroconf
 * www.stuartcheshire.org

---

From: Keith Moore <[email-masked]>
Date: Wed, 27 Nov 2002 20:38:13 -0500

>      IS OUT OF SCOPE FOR FURTHER DISCUSSION ON THE LIST.

let me get this straight.  you are forbidding discussion on an issue
of fundamental technical importance, one which an area director has
brought up as part of IESG review, one which you are required to discuss
in every RFC, one which the charter specifically states is not a
primary goal of zeroconf - in order to prevent any changes to the document
which might bring it in line with reasonable expectations and the working
group's charter?

I just want to be sure I understand.  because frankly, I don't think
that is the perogative of a WG chair.

Keith

---

From: Thomas Narten <[email-masked]>
Date: Wed, 27 Nov 2002 22:46:17 -0500

> All discussion in this area has proved religious and fruitless.

If security benefits (or non-benefits) of the check for TTL of 255 on
received packets is out of scope, please explain why the receiver
would ever want to do such a check. What problem does such a check
solve? I'm dead serious.

I think there is much agreement that we need to keep LLs on the
attached link. If that is the sole criteria, seems to me that:

- all senders should set the TTL to 1. This ensures that routers won't
  forward them off link. This includes all existing deployed routers,
  with no special configuration needed. They do this today. Sure,
  buggy or compromised routers might not, but in such environments one
  has much bigger problems to worry about.

- setting the TTL to anything other than 1 (and especially 255) seems
  nuts, as it makes it much more likely that LL packets will leak to
  places where they don't belong. And what would be the benefit of
  using a higher TTL? 

- the only reason I can think of to set the TTL to 255 on send is if
  you want the receiver to check for that value. But why would anyone
  care to do that? (remember, I (and others) can't site security
  arguments...)

> TTL=255 gives the receiver some (small) piece of information about origin 

And what information does "origin of the packet" communicate and under
what conditions would it be appropriate to use that information to
silently discard *ALL* traffic from a particular? If the WG can't
articulate that, I have a hard time understanding why the TTL
shouldn't just be set to 1 for the above reasons.

Thomas