Subject: Re: Oppose: LL29 Link-local sources should specify TTL=1

From: Stuart Cheshire <[email-masked]>
Date: Tue, 4 Mar 2003 15:23:46 -0800

>Your claim that the particular value of TTL=1 that would actually enforce 
>the goal of keeping link-local traffic from being forwarded beyond the 
>link is "about the same" as all the values from 2 through 254 is 
>disingenuous. Your previous fair treatment of opinions that differ 
>from your own leads me to expect a more direct argument from you.

Fair criticism. I apologize. Let me try again:

TTL=1. Should a packet be sent to a router for forwarding, TTL=1 prevents 
leakage. A packet may be sent to a router for forwarding deliberately (a 
software bug) or unintentionally (the router is indiscriminately 
answering every 169.254/16 ARP request). Does not allow recipient to 
confirm that packet originated on-link.

TTL=2...254. Doesn't prevent leakage. Does not allow recipient to confirm 
that packet originated on-link.

TTL=255. Doesn't prevent leakage. Allows recipient to confirm that packet 
originated on-link.

Now that I have stated the properties (I hope) more fairly, let me say 
why I count the benefit of TTL=1 as being less than the benefit of 
TTL=255:

LL packets should NEVER be sent to a router for forwarding. If it is done 
deliberately, then that's a bug and should be fixed. If it happens 
because of a device doing indiscriminate proxy ARP, then that device is 
(in my opinion) a major headache and should be fixed or removed. If your 
DHCP server fails and hosts try to use IPv4LL, then the indiscriminate 
proxy ARP box is going to completely sabotage that and prevent any useful 
communication. If your DHCP server is a headless box and the only way to 
connect to it to fix the problem is via IPv4LL, then the indiscriminate 
proxy ARP box has just painted you into a corner from which you cannot 
escape. In such a scenario of total network failure, a few failed TCP 
SYNs leaking out into the wider network is (in my opinion) irrelevant 
alongside the far greater problem that you have total network failure.

Stuart Cheshire <[email-masked]>
 * Wizard Without Portfolio, Apple Computer, Inc.
 * www.stuartcheshire.org

---

From: Mika Liljeberg <[email-masked]>
Date: 05 Mar 2003 01:43:45 +0200

> confirm that packet originated on-link.

Two points:

- Due to recent decisions, a packet intended for the local link might
have a mix of routable and LL addresses (any of the 4 combinations).

- A proxy ARP router could be configured to recognize 169.254/16 as
being on-link. This would allow configuration of LL addresses.

The first point alone allows leakage, which TTL=1 would prevent. The
second point just shows that there is a legitimate proxy ARP
configuration that could cause problems.

> TTL=255. Doesn't prevent leakage. Allows recipient to confirm that packet 

A LL destination address in a packet is good enough for me. Damned hard
to send one from off-link.

On the other hand, if the destination address is routable, you shouldn't
be basing your security on the TTL value.

	MikaL