Re: [secdir] SecDir Review of draft-ietf-pcp-anycast-06

[Yoav Nir <[e-mail]>]

> On Jun 10, 2015, at 12:33 AM, Christian Huitema <[e-mail]> wrote:
> 
>> There are two specific concerns about this method (other than the usual
>> anycast or pcp concerns). The first is that information about the internal
>> network might leak to a PCP service outside the network. 
> 
> In fact, it is almost guaranteed to leak outside of the network. In the initial deployments, first hop routers will not be aware of the anycast address...
> 
>> ... Whereas a failure of
>> a service whose address is given in DHCP will result in black-holed packets,
>> failure of a service with an anycast address will cause the packets to be
>> forwarded to some random PCP server on the Internet. Section 5.1 discusses
>> this and recommends filtering in perimeter gateways and reduced TTL. I
>> believe this addresses that threat adequately.
> 
> I would find the TTL mitigation would be more convincing if the draft actually specified a recommended TTL value.

Doesn’t that depend on the depth (diameter?) of the network?  The TTL should be high enough to reach the legitimate service but no higher. It does seem like a very fiddly thing. You’d need to re-adjust the TTL sent by all clients if you rearranged your servers a bit. I can see operators not taking the risk and just using the OS default TTL that’s high enough to take a packet to any network on the Internet.

Expecting the NAT device / firewall to filter sounds more plausible to me.