ttl and authentication [Re: I-D ACTION:draft-ietf-bfd-multihop-01.txt]

[Pekka Savola <[e-mail]>]

Hi,

On Tue, 22 Feb 2005 [e-mail] wrote:
> 	Title		: BFD for Multihop Paths
> 	Author(s)	: D. Katz, D. Ward
> 	Filename	: draft-ietf-bfd-multihop-01.txt
> 	Pages		: 6
> 	Date		: 2005-2-22

There was one particularly unnerving change in -01:

5. TTL/Hop Count Issues

    If BFD authentication is not in use, all BFD Control packets for
    sessions operating according to this specification MUST be sent with
    a TTL or Hop Count value of 255.  All received BFD Control packets
    that are demultiplexed to sessions operating according to this
    specification MUST be discarded if the received TTL or Hop Count is
    not equal to 255.  A discussion of this mechanism can be found in
    [GTSM].

    If BFD authentication is in use, any value of TTL/Hop Count MAY be
    used in transmitted packets, and received packets MUST NOT be
    discarded based on the received TTL/Hop Count.

.. this is _not good_, depending on the definition of "BFD 
authentication is in use".

If I interpret this correctly, the routers can not simply drop BFD 
session which are sent to the router with a bogus TTL and bogus 
authentication (e.g., wrong password) based on the TTL check?

For single hop scenarios, I don't see the reason to omit checking for 
TTL or to send any other TTL than 255.  Please elaborate or put it 
back in ASAP :).

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings