Routing WG V. Gill Internet-Draft J. Heasley Obsoletes: 3682 (if approved) D. Meyer Intended status: Standards Track P.
SavolaSavola, Ed. Expires: May 26,June 16, 2007 November 22,C. Pignataro December 13, 2006 The Generalized TTL Security Mechanism (GTSM) draft-ietf-rtgwg-rfc3682bis-07.txtdraft-ietf-rtgwg-rfc3682bis-08.txt Status of this Memo By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on May 26,June 16, 2007. Copyright Notice Copyright (C) The IETF Trust (2006). Abstract The use of a packet's Time to Live (TTL) (IPv4) or Hop Limit (IPv6) to verify whether the packet was originated within the sameby an adjacent node on a connected link has been used in many recent protocols. This document generalizes this technique. This document obsoletes RFC 3682. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Assumptions Underlying GTSM . . . . . . . . . . . . . . . . . 3 2.1. GTSM Negotiation . . . . . . . . . . . . . . . . . . . . . 4 2.2. Assumptions on Attack Sophistication . . . . . . . . . . . 4 3. GTSM Procedure . . . . . . . . . . . . . . . . . . . . . . . . 5 4. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 67 5. Security Considerations . . . . . . . . . . . . . . . . . . . 67 5.1. TTL (Hop Limit) Spoofing . . . . . . . . . . . . . . . . . 7 5.2. Tunneled Packets . . . . . . . . . . . . . . . . . . . . . 7 5.2.1. IP inTunneled over IP . . . . . . . . . . . . . . . . . 8 5.2.2. IP Tunneled over MPLS . . . . . . 7 5.2.2. IP in MPLS. . . . . . . . . . 9 5.3. Onlink Attackers . . . . . . . . . . . . 8 5.3.. . . . . . . . . 11 5.4. Fragmentation Considerations . . . . . . . . . . . . . . . 11 5.5. Multi-Hop Protocol Sessions . . . . . . . . . . . . . . . 912 6. Applicability Statement . . . . . . . . . . . . . . . . . . . 912 6.1. Backwards Compatibility . . . . . . . . . . . . . . . . . 1012 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 1013 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 1013 8.1. Normative References . . . . . . . . . . . . . . . . . . . 1013 8.2. Informative References . . . . . . . . . . . . . . . . . . 1114 Appendix A. MultihopMulti-hop GTSM . . . . . . . . . . . . . . . . . . . 1114 Appendix B. Changes Since RFC3682 . . . . . . . . . . . . . . . 1214 Appendix C. Draft Changelog . . . . . . . . . . . . . . . . . . 1214 Appendix C.1. Changes between -07 and -08 . . . . . . . . . . . . 15 Appendix C.2. Changes between -06 and -07 . . . . . . . . . . . . 1215 Appendix C.2.C.3. Changes between -05 and -06 . . . . . . . . . . . . 1215 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 1316 Intellectual Property and Copyright Statements . . . . . . . . . . 1417 1. Introduction The Generalized TTL Security Mechanism (GTSM) is designed to protect a router's IP based control plane from CPU-utilization based attacks. In particular, while cryptographic techniques can protect the router- based infrastructure (e.g., BGP [RFC4271], [RFC4272]) from a wide variety of attacks, many attacks based on CPU overload can be prevented by the simple mechanism described in this document. Note that the same technique protects against other scarce-resource attacks involving a router's CPU, such as attacks against processor- line card bandwidth. GTSM is based on the fact that the vast majority of protocol peerings are established between routers that are adjacent .adjacent. Thus most protocol peerings are either directly between connected interfaces or at the worst case, are between loopback and loopback, with static routes to loopbacks. Since TTL spoofing is considered nearly impossible, a mechanism based on an expected TTL value can provide a simple and reasonably robust defense from infrastructure attacks based on forged protocol packets from outside the network. Note, however, that GTSM is not a substitute for authentication mechanisms. In particular, it does not secure against insider on-the-wire attacks, such as packet spoofing or replay. Finally, the GTSM mechanism is equally applicable to both TTL (IPv4) and Hop Limit (IPv6), and from the perspective of GTSM, TTL and Hop Limit have identical semantics. As a result, in the remainder of this document the term "TTL" is used to refer to both TTL or Hop Limit (as appropriate). The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. 2. Assumptions Underlying GTSM GTSM is predicated upon the following assumptions: 1. The vast majority of protocol peerings are between adjacent routers. 2. It is common practice for many serviceService providers tomay or may not configure strict ingress filter (deny) packets that have the provider's loopback addressesfiltering [RFC3704] on non-trusted links. If maximal protection is desired, such filtering is necessary as the source IP address.described in Section 2.2. 3. Use of GTSM is OPTIONAL, and can be configured on a per-peer (group) basis. 4. The peer routers both implement GTSM. 5. The router supports a method to use separate resource pools (e.g., queues, processing quotas) for differently classified traffic. Note that this document does not prescribe further restrictions that a router may apply to the packets not matching the GTSM filtering rules, such as dropping packets that do not match any configured protocol session and rate-limiting the rest. This document also does not suggest the actual means of resource separation, as those are hardware and implementation-specific. The possibility of DoSdenial-of-service (DoS) attack prevention, however, is based on the assumption that packet classification and separation of their paths is done before they go through a scarce resource in the system. In practice, this means that, the closer GTSM processing is done to the line-rate hardware, the more resistant the system is to the DoS attacks. 2.1. GTSM Negotiation This document assumes that, when used with existing protocols, GTSM will be manually configured between protocol peers. That is, no automatic GTSM capability negotiation, such as is envisionedprovided by RFC 3392 [RFC3392] is assumed or defined. If a new protocol is designed with built-in GTSM support, then it is recommended that procedures are always used for sending and validating received protocol packets (GTSM is always on, see for example [RFC2461]). If, however, dynamic negotiation of GTSM support is necessary, protocol messages used for such negotiation MUST be authenticated using other security mechanisms to prevent DoS attacks. Also note that this specification does not offer a generic GTSM capability negotiation mechanism, so messages of the protocol augmented with the GTSM behavior will need to be used if dynamic negotiation is deemed necessary. 2.2. Assumptions on Attack Sophistication Throughout this document, we assume that potential attackers have evolved in both sophistication and access to the point that they can send control traffic to a protocol session, and that this traffic appears to be valid control traffic (i.e., has the source/destination of configured peer routers). We also assume that each router in the path between the attacker and the victim protocol speaker decrements TTL properly (clearly, if either the path or the adjacent peer is compromised, then there are worse problems to worry about). For maximal protection, ingress filtering should be applied before the packet goes through the scarce resource. Otherwise an attacker directly connected to one interface could disturb a GTSM-protected session on the same or another interface. Interfaces which aren't configured with this filtering (e.g., backbone links) are assumed to not have such attackers (i.e., trusted). As a specific instance of such interfaces, we assume that tunnels are not a back-door for allowing TTL-spoofing on protocol packets for a GTSM-protected peering session with a directly connected neighbor. We assume that: 1) there are no tunneled packets terminating on the router, 2) tunnels terminating on the router are assumed to be secure and endpoints are trusted, 3) tunnel decapsulation includes source address spoofing prevention [RFC3704], or 4) the GTSM-enabled session does not allow protocol packets coming from a tunnel. Since the vast majority of peerings are between adjacent routers, we can set the TTL on the protocol packets to 255 (the maximum possible for IP) and then reject any protocol packets that come in from configured peers which do NOT have an inbound TTL of 255. GTSM can be disabled for applications such as route-servers and other multi-hop peerings. In the event that an attack comes in from a compromised multi-hop peering, that peering can be shut down. 3. GTSM Procedure If GTSM is not built into the protocol and used as an additional feature (e.g., for BGP, LDP, or MSDP), it SHOULD NOT be enabled by default.default in order to be backward-compatible with the unmodified protocol. If GTSM is enabled for a protocol session, the following steps are added to the IP packet sending and reception procedures: Sending protocol packets: The TTL field in all IP packets used for transmission of messages associated with GTSM-enabled protocol sessions MUST be set to 255. This also applies to related error handling messages associated with said session, such as TCP RSTs or ICMP errors. On some architectures, the TTL of control plane originated traffic is under some configurations decremented in the forwarding plane. The TTL of GTSM-enabled sessions MUST NOT be decremented. Receiving protocol packets: The GTSM packet identification step associates each received packet addressed to the router's control plane with one of the following three trustworthiness categories: + Unknown: these are packets that cannot be associated with any registered GTSM-enabled session, and hence GTSM cannot make any judgement on the level of risk associated with them. + Trusted: these are packets that have been identified as belonging to one of the GTSM-enabled sessions, and their TTL values are within the expected range. + Dangerous: these are packets that have been identified as belonging to one of the GTSM-enabled sessions, but their TTL values are NOT within the expected range, and hence GTSM believes there is a risk that the packets have been spoofed. The exact policies applied to packets of different classifications are not postulated in this document and are expected to be configurable. Configurability is likely necessary particular with the treatment of related messages such as ICMP errors and TCP RSTs. It should be noted that fragmentation may restrict the amount of information available to the classification. However, by default, the implementations: + SHOULD ensure that packets classified as Dangerous do not compete for resources with packets classified as Trusted or Unknown. + MUST NOT drop (as part of GTSM processing) packets classified as Trusted or Unknown. + MAY drop packets classified as Dangerous. 4. Acknowledgments The use of the TTL field to protect BGP originated with many different people, including Paul Traina and Jon Stewart. Ryan McDowell also suggested a similar idea. Steve Bellovin, Jay Borkenhagen, Randy Bush, Alfred Hoenes, Vern Paxon, Robert Raszuk and Alex Zinin also provided useful feedback on earlier versions of this document. David Ward provided insight on the generalization of the original BGP-specific idea. Alex Zinin, Alia Atlas, and John Scudder provided significant amount of feedback for the newer versions of the document. 5. Security Considerations GTSM is a simple procedure that protects single hop protocol sessions, except in those cases in which the peer has been compromised. In particular, it does not protect against the wide range of on-the-wire attacks; protection from these attacks requires more rigorous security mechanisms. 5.1. TTL (Hop Limit) Spoofing The approach described here is based on the observation that a TTL (or Hop Limit) value of 255 is non-trivial to spoof, since as the packet passes through routers towards the destination, the TTL is decremented by one per router. As a result, when a router receives a packet, it may not be able to determine if the packet's IP address is valid, but it can determine how many router hops away it is (again, assuming none of the routers in the path are compromised in such a way that they would reset the packet's TTL). Note, however, that while engineering a packet's TTL such that it has a particular value when sourced from an arbitrary location is difficult (but not impossible), engineering a TTL value of 255 from non-directly connected locations is not possible (again, assuming none of the directly connected neighbors are compromised, the packet hasn't been tunneled to the decapsulator, and the intervening routers are operating in accordance with RFC 791 [RFC0791]). 5.2. Tunneled Packets The security of any tunneling technique depends heavily on authentication at the tunnel endpoints, as well as how the tunneled packets are protected in flight. Such mechanisms are, however, beyond the scope of this memo. An exception to the observation that a packet with TTL of 255 is difficult to spoof may occur when a protocol packet is tunneled and the tunnel is not integrity-protected (i.e., the lower layer is compromised). When the protocol packet is tunneled directly to the protocol peer (the protocol peer is the decapsulator), the GTSM provides nosome limited added protection as the security depends entirely on the integrity of the tunnel. When theFor protocol packet is tunneled toadjacencies over a tunnel, if the penultimate hop whichtunnel itself is deemed secure (e.g., the underlying infrastructure is deemed secure, and the tunnel offers degrees of protection against spoofing such as keys or cryptographic security), the GTSM can serve as a check that the protocol packet did not originate beyond the head-end of the tunnel. In addition, if the protocol peer can receive packets for the GTSM-protected protocol session from outside the tunnel, the GTSM can help thwart attacks from beyond the adjacent router. When the tunnel tail-end decapsulates the protocol packet and then forwardsIP-forwards the packet to a directly connected protocol peer, TTL is decremented as described below except in some myriad Bump-in-the- Wire (BITW)below. This means that the tunnel decapsulator is the penultimate node from the GTSM-protected protocol peer's perspective. As a result, the GTSM check protects from attackers encapsulating packets to your peers. However, specific cases [BITW].arise when the connection from the tunnel decapsulator node to the protocol peer is not an IP forwarding hop, where TTL-decrementing does not happen (e.g., layer-2 tunneling, bridging, etc). In IP-in-MPLS cases described below,the TTLIPsec architecture [RFC4301], another example is always decremented by at least one.the use of Bump-in- the-Wire (BITW) [BITW]. 5.2.1. IP inTunneled over IP Protocol packets may be tunneled over IP directly to a protocol peer, or to a decapsulator (tunnel endpoint) that then forwards the packet to a directly connected protocol peer (e.g., inpeer. Examples of tunneling IP over IP include IP-in-IP [RFC2003], GRE [RFC2784], or various forms of IPv6-in-IPv4 (e.g., [RFC4213]). These cases are depicted below. Peer router ---------- Tunnel endpoint router and peer TTL=255 [tunnel] [TTL=255 at ingress] [TTL=255 at egress]processing] Peer router -------- Tunnel endpoint router ----- On-link peer TTL=255 [tunnel] [TTL=255 at ingress] [TTL=254 at ingress] [TTL=254 at egress] In both cases, the first case, in which the encapsulated packetencapsulator (origination tunnel endpoint) is tunneled directly tothe (supposed) sending protocol peer, the encapsulated packet'speer. The TTL in the inner IP datagram can be set to an arbitrary value. In the second case, in which the encapsulated packet is tunneled to a decapsulator (tunnel endpoint) which then forwards it to a directly connected protocol peer,255, since RFC 2003 specifies the following behavior: When encapsulating a datagram, the TTL in the inner IP header is decremented by one if the tunneling is being done as part of forwarding the datagram; otherwise, the inner header TTL is not changed during encapsulation. If the resulting TTL inIn the inner IP header is 0,first case, the datagramencapsulated packet is discarded and an ICMP Time Exceeded message SHOULD be returnedtunneled directly to the sender. An encapsulator MUST NOT encapsulateprotocol peer (also a datagram with TTL = 0. Hence the inner IP packet header's TTL, as seen bytunnel endpoint), and therefore the decapsulator,encapsulated packet's TTL can be set to anreceived by the protocol peer with an arbitrary value, including 255. In the second case, the encapsulated packet is tunneled to a decapsulator (tunnel endpoint) which then forwards it to a directly connected protocol peer. For IP-in-IP tunnels, RFC 2003 specifies the following decapsulator behaviour: The TTL in the inner IP header is not changed when decapsulating. If, after decapsulation, the inner datagram has TTL = 0, the decapsulator MUST discard the datagram. If, after decapsulation, the decapsulator forwards the datagram to one of its network interfaces, it will decrement the TTL as a result of doing normal IP forwarding. See also Section 4.4. And similarly, for GRE tunnels, RFC 2784 specifies the following decapsulator behaviour: When a tunnel endpoint decapsulates a GRE packet which has an IPv4 packet as the payload, the destination address in the IPv4 payload packet header MUST be used to forward the packet and the TTL of the payload packet MUST be decremented. Hence the inner IP packet header's TTL, as seen by the decapsulator, can be set to an arbitrary value (in particular, 255), however as255). If the decapsulator forwardsis also the protocol peer, it is possible to deliver the protocol packet to it with a TTL of 255 (first case). On the other hand, if the decapsulator needs to forward the protocol packet to a directly connected protocol peer, the TTL will be decremented.decremented (second case). 5.2.2. IP inTunneled over MPLS Protocol packets may also be tunneled over MPLS Label Switched Paths (LSPs) to a protocol peer which either the penultimate hop (when the penultimate hop popping (PHP) is employed [RFC3032]) orpeer. The following diagram depicts the final hop These cases are depicted below.topology. Peer router -------- Penultimate Hop (PH) and peer TTL=255 [tunnel] [TTL=255 at ingress] [TTL<=254 at egress] PeerLSP Termination router -------- Penultimate Hop -------- On-linkand peer TTL=255 [tunnel] [TTL=255 at ingress] [TTL <=254MPLS LSP [TTL=x at ingress] [TTL<=254 at egress]MPLS LSPs can operate in Uniform or Pipe tunneling models. The TTL handling for these casesmodels is described in RFC 3032.3443 [RFC3443] that updates RFC 3032 states that when the IP packet is first labeled: ... the[RFC3032] in regards to TTL field ofprocessing in MPLS networks. RFC 3443 specifies the label stack entry MUST BE setTTL processing in both Uniform and Pipe Models, which in turn can used with or without penultimate hop popping (PHP). The TTL processing in these cases results in different behaviors, and therefore are analyzed separately. Please refer to Section 3.1 through Section 3.3 of RFC 3443. The main difference from a TTL processing perspective between Uniform and Pipe Models at the LSP termination node resides in how the incoming TTL (iTTL) is determined. The tunneling model determines the iTTL: For Uniform Model LSPs, the iTTL is the value of the IPTTL field. (Iffield from the popped MPLS header (encapsulating header), whereas for Pipe Model LSPs, the iTTL is the value of the IPTTL field needs to be decremented, as part offrom the IP processing, it is assumedexposed header (encapsulated header). For Uniform Model LSPs, RFC 3443 states that this has already been done.) Whenat ingress: For each pushed Uniform Model label, the label is popped: When a labelTTL is popped, andcopied from the resulting label stack is empty, thenlabel/IP-packet immediately underneath it. From this point, the valueinner TTL (TTL of the tunneled IP datagram) represents non-meaningful information, and at the egress node or during PHP, the ingress TTL field SHOULD BE replaced with(iTTL) is equal to the outgoingTTL value, as defined above. In IPv4 this also requires modificationof the IPpopped MPLS header checksum. where(see Section 3.1 of RFC 3443). In consequence, for Uniform Model LSPs of more than one hop, the TTL at ingress (iTTL) will be less than 255 (x <= 254), and as a result the definitioncheck described in Section 3 of "outgoing TTL" is:this document will fail. The "incoming TTL" ofTTL treatment is identical between Short Pipe Model LSPs without PHP and Pipe Model LSPs (without PHP only). For these cases, RFC 3443 states that: For each pushed Pipe Model or Short Pipe Model label, the TTL field is set to a labeled packetvalue configured by the network operator. In most implementations, this value is definedset to be255 by default. In these models, the forwarding treatment at egress is based on the tunneled packet as opposed to the encapsulation packet. The ingress TTL (iTTL) is the value of the TTL field of the top label stack entry when the packetheader that is exposed, that is received.the tunneled IP datagram's TTL. The "outgoing TTL" ofprotocol packet's TTL as seen be the LSP termination can therefore be set to an arbitrary value (including 255). If the LSP termination router is also the protocol peer, it is possible to deliver the protocol packet with a labeledTTL of 255 (x = 255). Finally, for Short Pipe Model LSPs with PHP, the TTL of the tunneled packet is definedunchanged after the PHP operation. Therefore, the same conclusions drawn regarding the Short Pipe Model LSPs without PHP and Pipe Model LSPs (without PHP only) apply to bethis case. For Short Pipe Model LSPs, the larger of: a) one less thanTTL at egress has the incoming TTL, b) zero.same value with or without PHP. In eitherconclusion, GTSM-checks are possible for IP tunneled over Pipe model LSPs, but not for IP tunneled over Uniform model LSPs. Additionally, for all tunneling modes, if the LSP termination router needs to forward the protocol packet to a directly connected protocol peer, it is not possible to deliver the protocol packet to the protocol peer with a TTL of these cases,255. If the minimum valuepacket is further forwarded, the outgoing TTL (oTTL) is calculated by decrementing iTTL by one. 5.3. Onlink Attackers As described in Section 2, an attacker directly connected to one interface can disturb a GTSM-protected session on the same or another interface (by spoofing a GTSM peer's address) unless ingress filtering has been applied on the connecting interface. As a result, interfaces which do not include such protection need to be trusted not to originate attacks on the TTL couldrouter. 5.4. Fragmentation Considerations As already mentioned, fragmentation may restrict the amount of information available for classification. Since non-initial IP fragments do not contain Layer 4 information, it is highly likely that they cannot be decrementedassociated with a registered GTSM-enabled session. Following the receiving protocol procedures described in Section 3, non-initial IP fragments would likely be one (the network operator prefersclassified with Unknown trustworthiness. And since the IP packet would need to hide its infrastructure by decrementingbe reassembled in order to be processed, the TTL byend result is that the minimum numberinitial-fragment of LSP hops, one, rather than decrementinga GTSM-enabled session effectively receives the treatment of an Unknown-trustworthiness packet, and the complete reassembled packet receives the aggregate of the Unknowns. Further, reassembly requires to wait for all the fragments and therefore likely invalidates or weakens the fifth assumption presented in Section 2: it may not be possible to classify non- initial fragments before going through a scarce resource in the TTL as it traverses its MPLS domain). Assystem, when fragments need to be buffered for reassembly and later processed by a result,CPU. That is, when classification cannot be done with the maximum TTL value at egressrequired granularity, non-initial fragments of GTSM-enabled session packets would not use different resource pools. Consequently, to get practical protection from the MPLS cloudfragment attacks, operators may need to rate-limit or discard all received fragments. As such, it is 254 (255-1),highly recommended for GTSM-protected protocols to avoid fragmentation and reassembly by manual MTU tuning, using adaptive measures such as a result the check described in section 3 will fail. 5.3.Path MTU Discovery (PMTUD), or any other available method. 5.5. Multi-Hop Protocol Sessions WhileGTSM could possibly offer some small though difficult to quantify degree of protection when used with multi-hop protocol sessions (see Appendix A), we do not specify GTSM for multi-hop scenarios dueA). In order to simplicity, lackavoid having to quantify the degree of deploymentprotection and implementation.the resulting applicability of multi-hop, we only describe the single-hop because its security properties are clearer. 6. Applicability Statement GTSM is only applicable to environments with inherently limited topologies (and is most effective in those cases where protocol peers are directly connected). In particular, its application should be limited to those cases in which protocol peers are directly connected. Experimentation on GTSM's applicability and security properties is needed in multi-hop scenarios. The multi-hop scenarios where GTSM might be applicable is expected to have the following characteristics: the topology between peers is fairly static and well known, and in which the intervening network (between the peers) is trusted. 6.1. Backwards Compatibility RFC 3682 did not specify how to handle "related messages" such as TCP RSTs or ICMP errors. This specification mandates setting and verifying TTL=255 of those as well as the main protocol packets. Setting TTL=255 in related messages does not cause issues for RFC 3682 implementations. Requiring TTL=255 in related messages may have impact with RFC 3682 implementations, depending on which default TTL the implementation uses for originated packets; some implementations are known to use 255, while 64 or other values are also used. Related messages from the latter category of RFC 3682 implementations would be discarded.classified as Dangerous and treated as described in Section 3. This is not believed to be a significant problem because protocols do not depend on related messages (e.g., typically having a protocol exchange for closing the session instead of doing a TCP-RST), and indeed the delivery of related messages is not reliable. As such, related messages typically provide an optimization to shorten a protocol keepalive timeout. Regardless of these issues, given that related messages provide a significant attack vector to e.g., reset protocol sessions, making this further restriction seems sensible. 7. IANA Considerations This document requires no action from IANA. 8. References 8.1. Normative References [RFC0791] Postel, J., "Internet Protocol", STD 5, RFC 791, September 1981. [RFC2003] Perkins, C., "IP Encapsulation within IP", RFC 2003, October 1996. [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC2461] Narten, T., Nordmark, E., and W. Simpson, "Neighbor Discovery for IP Version 6 (IPv6)", RFC 2461, December 1998. [RFC2784] Farinacci, D., Li, T., Hanks, S., Meyer, D., and P. Traina, "Generic Routing Encapsulation (GRE)", RFC 2784, March 2000. [RFC3032] Rosen, E., Tappan, D., Fedorkow, G., Rekhter, Y., Farinacci, D., Li, T., and A. Conta, "MPLS Label Stack Encoding", RFC 3032, January 2001. [RFC3392] Chandra, R. and J. Scudder, "Capabilities Advertisement with BGP-4", RFC 3392, November 2002. [RFC3443] Agarwal, P. and B. Akyol, "Time To Live (TTL) Processing in Multi-Protocol Label Switching (MPLS) Networks", RFC 3443, January 2003. [RFC4213] Nordmark, E. and R. Gilligan, "Basic Transition Mechanisms for IPv6 Hosts and Routers", RFC 4213, October 2005. [RFC4271] Rekhter, Y., Li, T., and S. Hares, "A Border Gateway Protocol 4 (BGP-4)", RFC 4271, January 2006. [RFC4272] Murphy, S., "BGP Security Vulnerabilities Analysis",[RFC4301] Kent, S. and K. Seo, "Security Architecture for the Internet Protocol", RFC 4272, January 2006.4301, December 2005. 8.2. Informative References [BITW] "Thread: 'IP-in-IP, TTL decrementing when forwarding and BITW' on int-area list, Message-ID: <Pine.LNX.firstname.lastname@example.org>", June 2006, <http://www1.ietf.org/mail-archive/web/ int-area/current/msg00267.html>. [RFC3704] Baker, F. and P. Savola, "Ingress Filtering for Multihomed Networks", BCP 84, RFC 3704, March 2004. [RFC4272] Murphy, S., "BGP Security Vulnerabilities Analysis", RFC 4272, January 2006. Appendix A. MultihopMulti-hop GTSM NOTE: This is a non-normative part of the specification. The main applicability of GTSM is for directly connected peers. GTSM could be used for non-directly connected sessions as well, where the recipient would check that the TTL is within "TrustRadius" (e.g., 1) of 255 instead of 255. As such deployment is expected to have a more limited applicability and different security implications, it is not specified in this document. Appendix B. Changes Since RFC3682 o New text on GTSM applicability and use in new and existing protocols. o Explicitly require that related messages (e.g., TCP RSTs, ICMP errors) must also be sent and checked to have TTL=255. See Section 6.1 for discussion on backwards compatibility. o Clarifications relating to security with tunneling. o A significant number of editorial improvements and clarifications. Appendix C. Draft Changelog NOTE to the RFC-editor: please remove this section before publication. Appendix C.1. Changes between -07 and -08 o Describe the assumption of ingress filtering to protect against on-link attacks. o Rewrite the IP over MPLS section based on the new MPLS TTL handling procedure (from Carlos Pignataro) to get the details of new MPLS architecture right. o Rephrase IP over IP tunneling section a bit, to make distinction between encapsulation and decapsulation behaviour clearer. o Make it clearer in the tunneling section that unless the tunnel peer is also the protocol peer, GTSM should be able to offer protection. o Describe better the applicability of GTSM when tunneling. o Rephrase Multi-hop GTSM section to mainly refer to the difficult- to-quantify security properties as a reason for exclusion at this point. o Some editorial updates. Appendix C.2. Changes between -06 and -07 o Be more reserved about multi-hop security properties in section 'Multi-Hop Protocol Sessions'. o Clarify IP-in-IP tunnel decapsulation/forwarding as decrementing TTL. o Add text on related messages backwards compatibility. o Editorial updates. Appendix C.2.C.3. Changes between -05 and -06 o Clarify the assumptions wrt. resource separation and protection based on comments from Alex Zinin. o Rewrite the GTSM procedure based on text from Alex Zinin. o Reduce TrustRadius and multi-hop scenarios to a mention in an Appendix. o Describe TCP-RST, ICMP error and "related messages" handling. o Update the tunneling security considerations text. o Editorial updates (e.g., shortening the abstract). Authors' Addresses Vijay Gill Email: email@example.com John Heasley Email: firstname.lastname@example.org David Meyer Email: email@example.com Pekka Savola (editor) Espoo Finland Email: firstname.lastname@example.org Carlos Pignataro Email: email@example.com Full Copyright Statement Copyright (C) The IETF Trust (2006). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Intellectual Property The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79. Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at firstname.lastname@example.org. Acknowledgment Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA).