Subject: Re: Oppose: LL29 Link-local sources should specify TTL=1

From: Stuart Cheshire <[email-masked]>
Date: Tue, 4 Mar 2003 19:02:07 -0800

Mika Liljeberg wrote:

>- Due to recent decisions, a packet intended for the local link might
>have a mix of routable and LL addresses (any of the 4 combinations).
>
>- A proxy ARP router could be configured to recognize 169.254/16 as
>being on-link. This would allow configuration of LL addresses.
>
>The first point alone allows leakage

No it doesn't. If you think it does, please describe an exact scenario 
using LL-compliant hosts. (Any mention of non-compliant hosts here is a 
red-herring, because we control neither what they do with packets, nor 
what TTL they set.)

>The second point just shows that there is a legitimate proxy ARP
>configuration that could cause problems.

The meaning of the word "proxy" is very clear:

    Proxy:

    A person authorized to act for another; an agent or substitute. 
    The authority to act for another. 
    The written authorization to act in place of another. 

When an entity is authorized to act on my behalf, it is a proxy.

When an entity takes it upon itself to act on my behalf without authority 
and gets it wrong, that is not a "legitimate proxy".

>A LL destination address in a packet is good enough for me.
>Damned hard to send one from off-link.

Hard, but not impossible. Security includes protecting against attacks 
that are hard to do (but not necessarily against attacks that are 
impossible to do).

>So here's a challenge for you: whip out your hacker toolbox and send me
>a packet that has a LL destination address. I guarantee you I'll never
>see it, much less get to check its TTL.

Mika, defining a standard for the whole world is about more than what 
works on YOUR network.

The question is not whether YOUR router will let in packets addressed to 
169.254/16, but whether ANY routers will advertently let in packets 
addressed to 169.254/16. Unless you can categorically say no, for every 
router in the world, there is a risk of attack.

Stuart Cheshire <[email-masked]>
 * Wizard Without Portfolio, Apple Computer, Inc.
 * www.stuartcheshire.org

---

From: Mika Liljeberg <[email-masked]>
Date: 05 Mar 2003 10:44:51 +0200

> red-herring, because we control neither what they do with packets, nor 

You're right, it's unlikely that compliant nodes would knowingly send a
LL packet to a router. A proxy ARP router is the more plausible
scenario.

I don't claim leakage would be rampant but configuration errors do
happen and bugs do crop up. If we have to say something about the TTL
(and I'd be quite happy not saying anything at all), setting TTL=1
sounds like the only even marginally useful thing to do.

> When an entity is authorized to act on my behalf, it is a proxy.

Proxy ARP does not require your authorization. Your point, I guess, is
that you can fix your own router. Not everybody can.

> that are hard to do (but not necessarily against attacks that are 

Sure. I just don't see a TTL=255 check helping any. LL addresses have no
value as a secrity measure and people should not be bamboozled to think
that they have.

> Mika, defining a standard for the whole world is about more than what 

Stuart, I could throw that comment back in your face, word for word, in
the context of a proxy ARP router. I'll spare us that.

My network is utterly insignificant, a mere example, but John would
still have to cross "the whole world" to get here.

> router in the world, there is a risk of attack.

There's a non-zero probability that I will get hit in the head by a
meteor but I don't go around wearing a hard hat.

The truth of the matter is, we're like two salesmen planning to sell
fridges to eskimos and we're arguing whether we should put in an ice box
or leave more room for vegetables.

	MikaL

---

From: Thomas Narten <[email-masked]>
Date: Wed, 05 Mar 2003 07:36:47 -0500

> that are hard to do (but not necessarily against attacks that are 

Security is about risk vs. cost. One protects against attacks where
the cost of the protection is a prudent investment compared with the
potential damages associated with the attack (and it's likelyhood of
being exploited).

I am still trying  to understand what attacks would be  opened up if
the TTL=255 check on receipt were not done. So far, I haven't seen a
clear example that raises alarm bells in my head.

It would be good if folk could provide clear examples, rather than
using general arguments and handwaving. Right now, I don't know that
there is even agreement in the WG on what the actual
risks/vulnerabilities are. 

Thomas