Subject: TTL/Hop Limit Issues in BFD for on a single hop

From: "Bhatia, Manav \(Manav\)" <[email-masked]>
Date: Sun, 23 Nov 2008 07:03:28 +0530

Hi,

This is wrt the text in Section 5 of draft-ietf-bfd-v4v6-1hop-08.txt.

It states that that BFD Control packets for the session MUST be sent
with a TTL or Hop Limit value of 255 irrespective of whether BFD auth is
being used or not. Fair enough. Now why is it that when auth is being
used the recover *MAY* (and not MUST) reject BFD control packets
received with TTL/Hop Limit value other than 255?

Why is it not a "MUST" the way it is for un-authenticated sessions?

Second, the draft should unequivocally state that the sanity of TTL/Hop
Limit MUST be checked first before the authentication data is verified.
You don't want the receiver to compute the hash only to later drop the
packet because the TTL/Hop limit was incorrect or not within the
acceptable range.

Cheers, Manav

--
Manav Bhatia,
IP Division, Alcatel-Lucent,
Bangalore - India

---

From: Nitin Bahadur <[email-masked]>
Date: Sun, 23 Nov 2008 21:01:38 -0800

> packet because the TTL/Hop limit was incorrect or not within the

The above is an implementation optimization. I don't see any need for the
spec to specify that. The spec should not dictate implementation details.
Someone could design a system that does MD5/SHA1 checksums in hardware and
in that case they might end up running the hash first.....and if you change
the spec, then that implementation will be out of spec.

Thanks
Nitin

---

From: "Bhatia, Manav \(Manav\)" <[email-masked]>
Date: Mon, 24 Nov 2008 13:08:06 +0530

Fair enough. How about a milder "MAY" to help the guileless
implementations then?

Cheers, Manav

> -----Original Message-----
> From: Nitin Bahadur [mailto:[email-masked]] 
> Sent: Monday, November 24, 2008 10.32 AM
> To: Bhatia, Manav (Manav); [email-masked]
> Subject: Re: TTL/Hop Limit Issues in BFD for on a single hop
> 
>