Re: ttl and authentication

[Pekka Savola <[e-mail]>]

On Thu, 24 Feb 2005, Dave Katz wrote:
>> The same argument seems to apply here.  Speaking as an operator who's using 
>> BFD, I will not be happy if the TTL is not checked first as this opens a 
>> resource exhaustion attack vector which could be easily prevented.
>
> I guess I would counter that if the TTL check is the only thing protecting 
> your infrastructure, then you have bigger problems.  Filtering at the edge of 
> your network has got to be the first line of defense.  Certainly there have 
> got to be similar opportunities to hose things with other protocols for which 
> a TTL check will not help.

That is correct, and in fact in our case, we do have filtering at the 
edge.

However, it is not clear which packets routers implementing BFD will 
demultiplex.  Are the BFD ports open to everyone -- i.e., are you 
requiring that all packets addressed to the any of the routers' 
addressed must be dropped at the borders (that's rather unreasonable 
approach IMHO)?  What if you want to run BFD with eBGP and you cannot 
be protected with border filtering?

All in all, if there is no strong reason to remove the TTL check, I'd 
strongly prefer to put it back in.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings