Re: ttl and authentication

[Pekka Savola <[e-mail]>]

On Wed, 23 Feb 2005, Dave Katz wrote:
> On Feb 23, 2005, at 12:15 PM, Pekka Savola wrote:
>> If I interpret this correctly, the routers can not simply drop BFD session 
>> which are sent to the router with a bogus TTL and bogus authentication 
>> (e.g., wrong password) based on the TTL check?
>
> I should have been a bit more specific here.  The intent was that an 
> appropriately authenticated packet needn't be "authenticated" based on the 
> TTL.  I don't quite understand your concern;  obviously if the packet fails 
> authentication, it must be discarded, so it's not as though the MUST NOT 
> language forces you to accept the packet.

The concern is which is done first: TTL check or authentication check.

Compare the situation to BGP with MD5.  Folks can easily DoS a router 
by sending bogus MD5-signed BGP packets to spend all the CPU's 
computational resources.  Using TTL=255 check _first_ prevents this 
particular attack vector, except from the on-link neighbors.

The same argument seems to apply here.  Speaking as an operator who's 
using BFD, I will not be happy if the TTL is not checked first as this 
opens a resource exhaustion attack vector which could be easily 
prevented.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings