Subject: Re: Oppose: LL29 Link-local sources should specify TTL=1

From: Stuart Cheshire <[email-masked]>
Date: Tue, 4 Mar 2003 19:04:10 -0800

John Schnizlein wrote:

>Since ordinary Internet-compliant routers enforce TTL=1, 
>and only ZeroConf hosts could enforce TTL=255, the mechanism
>most likely to be in place is TTL=1.

Since the only devices sending packets according to this spec are those 
that implement this spec, none of those devices will send packets for 
forwarding at all, so the point is irrelevant.

>And if all hosts (unless they have a particular purpose, as
>Christian proposed and I agreed) that intend link-local traffic
>were to set TTL=1, there would be no such traffic "out there"
>to leak in.

Malicious traffic "out there" may still leak in (and may be more 
successful in doing so, because with a spec that says compliant hosts 
must set TTL=1, there is less incentive for router vendors to think it 
necessary put in rules to block incoming spoof LL traffic).

>There was a long thread about supposed security benefits of checking
>TTL=255, with the conclusion that no security claims were valid enough
>to continue that thread.

You are mistaken. The (tentative) conclusion was that there were small 
but non-zero benefits to checking TTL=255.

If this conclusion is not agreed, we may need to re-open the debate 
concerning whether the security benefit is zero or non-zero.

I strongly doubt that any debate concerning the precise magnitude of the 
non-zero security benefit will lead to any consensus.

Stuart Cheshire <[email-masked]>
 * Wizard Without Portfolio, Apple Computer, Inc.
 * www.stuartcheshire.org

---

From: Thomas Narten <[email-masked]>
Date: Wed, 05 Mar 2003 07:43:12 -0500

> necessary put in rules to block incoming spoof LL traffic).

We need to separate this into two cases. One, where the destination is
LL. In those cases, it is not obvious to me how traffic will be routed
to a particular remote link. Presumably, the remote link won't be
injecting the LL prefix into routing protocols and advertising a route
for that prefix...

If the case at issue is LL source and non-LL destination, yes, I can
see traffic being delivered to a remote link. But return traffic won't
go back to the actual sender. This seems very similar to general IP
address spoofing, where an intruder sends packets using a false source
address. If this is the case, what new vulnerabilities are we
introducing with LL and why is it critical that they closed off?
(Also, in the case of non-LL and LL addressing being used in
communication I don't think we can use the 255 check anyway, so I
wonder if this is a Red Herring case?)

> but non-zero benefits to checking TTL=255.

Some would say "epsilon" benefit, that is, so close to 0 as to not be
worth mentioning.

> non-zero security benefit will lead to any consensus.

The question that the group needs to answer is whether the benefit is
high enough to require something like the TTL=255 check. And the
question is not just about security. E.g., we know that implementing
it today would result in non-interoperabilty with some deployed
platforms. That is also something to be factored into the discussion.

Thomas