Subject: Re: Oppose: LL29 Link-local sources should specify TTL=1

From: Stuart Cheshire <[email-masked]>
Date: Wed, 12 Mar 2003 23:23:27 -0800

Robert Elz wrote:
>The ability to detect errant packets is similarly useless in general.
>You keep on citing that ability as a feature, but you have yet to give
>a reason how it ever achieves anything (in general).

Mika Liljeberg wrote:
>Sure. I just don't see a TTL=255 check helping any. LL addresses have no
>value as a secrity measure and people should not be bamboozled to think
>that they have.

This is IETF political correctness, and I do not believe it is helpful.

In the IETF fantasy parallel universe, there are no firewalls, and 
everyone uses strong end-to-end security all the time.

I make the following statement will full knowledge that it is IETF heresy:

In the world I live in, firewalls are common, and people see real value 
in reducing the population of potential attackers by such methods.

I personally do not like firewalls because they contribute to the famous 
"fog on the Internet", so I do not run one at my house. I also run an 
open 802.11 network with no WEP. Unfortunately not all of the devices in 
my house have strong end-to-end security. For example, my network printer 
supports LPR, but has NO access control of any kind. How do I stop it 
being abused? You can lecture me, and I can lecture the printer vendor 
about end-to-end security, and in the IETF fantasy parallel universe they 
send me new firmware the next day, but here in the real world, that 
doesn't solve my problem. Here in the real world I solve my problem by 
arranging for the printer to have only a link-local address. I could 
achieve a similar effect by installing a firewall, but that is just one 
more piece of hardware to buy and install and configure and maintain. 
This precaution I take prevents the printer from being directly accessed 
by any device outside the local link, thereby reducing the population of 
potential attackers from the entire planet to just people within range of 
my wireless base stations. This is a level of risk I am willing to 
accept. If anyone really wants to take time out from IETF meetings next 
week drive to my house and abuse my printer, I won't really be annoyed. 
In fact, I'll probably be amused that someone who is gainfully employed 
has time to waste on such stupidity. On the other hand, if I got junk 
pages spewing out of my printer at the same rate that spam email shows up 
in my email account (continuously, all day, every day) then I would get 
very annoyed very quickly.

I do not understand the people who refuse to see the benefit in reducing 
the population of potential attackers from the entire planet to just 
people within close physical proximity.

I fully agree that I would love to have strong end-to-end security all 
the time, but here in the real world you can't always have what you want, 
and in the absence of perfect security, a mechanism for knowing that a 
packet originated on the local link is one very useful tool in the 
networking toolbox.

Stuart Cheshire <[email-masked]>
 * Wizard Without Portfolio, Apple Computer, Inc.
 * www.stuartcheshire.org

---

From: Thomas Narten <[email-masked]>
Date: Thu, 13 Mar 2003 09:26:04 -0500

Stuart,

> everyone uses strong end-to-end security all the time.

And the IETF as far as I know isn't denying the presence of firewall
or thinking they are useless and have no value. Heck, there is even a
BOF scheduled for SF that very much assumes firewalls.

> in reducing the population of potential attackers by such methods.

I suspect most people here would agree. But bringing this up is a Red
Herring.

> people within close physical proximity.

I see the value, and I suspect most people do. That is not the issue
being debated here. The specific issue is whether the 255 check on
reciept provides enough additional benefit compared to the "security"
you already get from just using LLs in the first place. By using LL
addresses (and because routers won't generally forward them, etc.) you
already have cut off a huge avenue of vulnerabilities from off-link
attackers. This is independent of the 255 check.

The specific question is whether the 255 check provides sufficient
additional advantage to justify its downsides.

Thomas

---

From: "Subrata Goswami" <[email-masked]>
Date: Thu, 13 Mar 2003 09:28:35 -0800

I guess a better explanation of the TTL=255 choice would be good for the
list.
As far as I can tell, the following is the normal interpretation of
different
TTL values (please correct me I am wrong).

TTL=1   implies the packet probably originated in this link.
TTL=255 implies the packet can live for another 254 hops.

I addition I believe the LLv4 draft is restrictive enough so that the
particular 
TTL value is a non-issue.

1.  Section 2.6 Source Address Selection
    "... The host MUST NOT send the
   packet to any router for forwarding. "

2. 2.7 Link-Local Packets Are Not Forwarded
    "An IPv4 packet whose source and/or destination address is in the
   169.254/16 prefix MUST NOT be sent to any router for forwarding, and
   any network device receiving such a packet MUST NOT forward it,
   regardless of the TTL in the IP header."

Subrata 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Stuart Cheshire
> Sent: Wednesday, March 12, 2003 11:23 PM
> To: Zeroconf
> Subject: Re: Oppose: LL29 Link-local sources should specify TTL=1
> 
> 
> Robert Elz wrote:
> >Sure. I just don't see a TTL=255 check helping any. LL 
> addresses have 
> >no value as a secrity measure and people should not be bamboozled to 
> >think that they have.
>

---

From: John Schnizlein <[email-masked]>
Date: Thu, 13 Mar 2003 12:48:10 -0500

At 12:28 PM 3/13/2003, Subrata Goswami wrote:
>... explanation of the TTL=255 choice would be good for the list.
>As far as I can tell, the following is the normal interpretation 
>of different TTL values (please correct me I am wrong).
>

Actually, just that if Link-Local hosts set TTL=1, normal router 
behavior will enforce the requirement that these packets not be
forwarded to other links.

>particular TTL value is a non-issue.

The problem with relying on the following is that
1) hosts cannot tell if the response to an ARP came from a router, and
2) it is not reasonable to expect the whole Internet to comply with 
   the new requirement to check for this 169.254/16 prefix.

>    "... The host MUST NOT send the packet to any router for forwarding. "
>

---

From: "Subrata Goswami" <[email-masked]>
Date: Thu, 13 Mar 2003 10:25:53 -0800

I agree on the view that the whole "Internet" does not need to be
adjusted to handle LLv4. 
In that sense, TTL=1 , seems to me to be a logical choice.

Subrata

> From: John Schnizlein [mailto:[email-masked]]
> Sent: Thursday, March 13, 2003 9:48 AM
> To: Subrata Goswami
> Cc: 'Zeroconf'
> Subject: RE: Oppose: LL29 Link-local sources should specify TTL=1
> 
> 
> >... explanation of the TTL=255 choice would be good for the list. As
> >far as I can tell, the following is the normal interpretation of 
> >different TTL values (please correct me I am wrong).
> >
> behavior will enforce the requirement that these packets not 
> be forwarded to other links.
>

---

From: Vincent Lubet <[email-masked]>
Date: Thu, 13 Mar 2003 10:40:13 -0800

> TTL=1   implies the packet probably originated in this link.

Not at all, the packet may have come from up to 254 hops away!

> TTL=255 implies the packet can live for another 254 hops.

More importantly, if TTL=255 on reception, you are sure the packet 
originated from this link.

Vincent