Re: TTL patch buggy?

[Henrik Nordstrom <hno@marasystems.com>]

On Tue, 6 Jan 2004, John A. Sullivan III wrote:

> Ugh!! I'll have to see if I can find it.  I'm sure I deleted it.  It was
> just an obscure reference to a bug in TTL but was not specific.  We are
> planning to not only use the TTL patch in ISCS to create stealth
> firewalls but also to secure communications between internal and DMZ
> systems by allowing admins to set TTL on a per service basis to allow
> the DMZ <-> Internal flow to only have enough life to live on the site
> and not to be set anywhere else on the Internet.  We think this is a
> pretty interesting feature and hence are keen on the TTL patch working. 

Take care to never increase the TTL value however.

There is no technical problems from artificially decreasing the TTL, but 
increasing should never be done unless you are 200% sure on what you are 
doing (and even then you should not).

The TTL target is dangerous in the sense that it allows the packet ttl to
be set freely with no restrictions. But if combined with a "-m ttl
--ttl-gt NEWVALUE" then you should be safe.

Harald: What do you think about making the patch civilised and restricting
the TTL to be set to lower values only eleminating the need of the above
safeguard match? (simply change "new_ttl != iph->ttl" to "new_ttl < 
iph->ttl")

Regards
Henrik