IETF Logo Mail Archive

RE: Blocking Quic traffic

"Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com> Mon, 19 August 2019 09:29 UTC

Return-Path: <tirumaleswarreddy_konda@mcafee.com>
X-Original-To: quic@ietfa.amsl.com
Delivered-To: quic@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0A98120816 for <quic@ietfa.amsl.com>; Mon, 19 Aug 2019 02:29:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.7
X-Spam-Level:
X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RReo8quDVWY0 for <quic@ietfa.amsl.com>; Mon, 19 Aug 2019 02:29:27 -0700 (PDT)
Received: from us-smtp-delivery-140.mimecast.com (us-smtp-delivery-140.mimecast.com [216.205.24.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C0AD0120804 for <quic@ietf.org>; Mon, 19 Aug 2019 02:29:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=mimecast20190606; t=1566206965; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=RcHuSN4GQEJnLkWP50Oqx4h+aSWvmLdsm5XinhzuQFE=; b=XhcNlo5svRjx911c0udY41QODtALI6pir1ReBxwNIzNRfBA0EC43yq0zRVwEjiJbCgI2es sz9SjUCyvh0dLOWVJwex6dhJHJbA2nFYfnHN6EzZ7Jbfpt1Re+cqg5xEAnj72O4q8T4Z4V Y5qpiPcxy7X0FttKRcVXhnYcSdVhw4w=
Received: from MIVWSMAILOUT1.mcafee.com (mivwsmailout1.mcafee.com [161.69.47.167]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-337-UswNtG4YNJePFpQynUIdyg-1; Mon, 19 Aug 2019 05:29:22 -0400
Received: from DNVEXAPP1N04.corpzone.internalzone.com (DNVEXAPP1N04.corpzone.internalzone.com [10.44.48.88]) by MIVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 1fac_6410_6251837a_b896_466a_91f1_a5c3fdd007ce; Mon, 19 Aug 2019 05:30:06 -0400
Received: from DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) by DNVEXAPP1N04.corpzone.internalzone.com (10.44.48.88) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 19 Aug 2019 03:28:49 -0600
Received: from DNVO365EDGE2.corpzone.internalzone.com (10.44.176.74) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Mon, 19 Aug 2019 03:28:49 -0600
Received: from NAM01-SN1-obe.outbound.protection.outlook.com (10.44.176.242) by edge.mcafee.com (10.44.176.74) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 19 Aug 2019 03:28:48 -0600
Received: from DM5PR16MB1705.namprd16.prod.outlook.com (10.172.44.147) by DM5PR16MB1609.namprd16.prod.outlook.com (10.173.211.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Mon, 19 Aug 2019 09:28:48 +0000
Received: from DM5PR16MB1705.namprd16.prod.outlook.com ([fe80::532:f001:84e1:55ba]) by DM5PR16MB1705.namprd16.prod.outlook.com ([fe80::532:f001:84e1:55ba%10]) with mapi id 15.20.2178.018; Mon, 19 Aug 2019 09:28:48 +0000
From: "Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com>
To: Christian Meutes <christian@errxtx.net>
CC: IETF QUIC WG <quic@ietf.org>
Subject: RE: Blocking Quic traffic
Thread-Topic: Blocking Quic traffic
Thread-Index: AQHVUe2wfsrAib4GYkCEHYQQKVuPIab5dhwAgAAEFwCABeBjgIAAetnUgACd/QCAABy7+IAAM7KAgAAyg1CAAB8JgIAA8dWAgAAPGQCAAB/tYA==
Date: Mon, 19 Aug 2019 09:28:48 +0000
Message-ID: <DM5PR16MB1705E6CBCED4C18B0679C6EBEAA80@DM5PR16MB1705.namprd16.prod.outlook.com>
References: <95198D4B-63F4-4363-B49C-AB254CF24030@ericsson.com> <CALZ3u+bktoY3-CgCG7Mx_95=V_SmSeD66LL8NjxoQ50Dtq6+=Q@mail.gmail.com> <CAKcm_gOkfeuMJAd8ZaGe1asO2GKqzm8Z-Rsq69P_TXnGjft0CA@mail.gmail.com> <CAGQwDbd5x2V=PiooLnKdEWCJgMX=6MZaHmaxoY19P17-Tm_mAw@mail.gmail.com> <9CBEED96-1419-4CB0-A8B4-D2A548FD06F1@cisco.com> <CAGQwDbct5cNo_OuasBK1zXg45smvbirGRVqALdL0Hm7TQYT14A@mail.gmail.com> <09AF1E5B-47BD-406A-885B-AE1FFA2B511E@cisco.com> <d93d7ae0-c768-23ee-63f3-e0e3c60db6ab@cs.tcd.ie> <C3BF1FCD-9F2F-4117-8785-AF1A61181E80@cisco.com> <1118E0BB-7631-4D29-9264-22FE33E46FDD@huitema.net> <DM5PR16MB1705767B004E5D32574D04C1EAA80@DM5PR16MB1705.namprd16.prod.outlook.com> <CAGQwDbeXJgSeP=0ZgM6dPuH7p5Ki-5dfvBmGzBNvoy71aozjBw@mail.gmail.com>
In-Reply-To: <CAGQwDbeXJgSeP=0ZgM6dPuH7p5Ki-5dfvBmGzBNvoy71aozjBw@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
dlp-product: dlpe-windows
dlp-version: 11.3.0.17
dlp-reaction: no-action
x-originating-ip: [103.245.47.20]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: a0a5c9ff-ba0e-45f6-4905-08d72487a3b6
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM5PR16MB1609;
x-ms-traffictypediagnostic: DM5PR16MB1609:
x-ms-exchange-purlcount: 4
x-microsoft-antispam-prvs: <DM5PR16MB16093C282A94A0B949A5E966EAA80@DM5PR16MB1609.namprd16.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:9508;
x-forefront-prvs: 0134AD334F
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(346002)(396003)(366004)(136003)(376002)(189003)(199004)(32952001)(476003)(76116006)(53936002)(6916009)(66066001)(66946007)(6246003)(53546011)(6436002)(2906002)(66446008)(64756008)(66476007)(102836004)(80792005)(3846002)(6116002)(66556008)(790700001)(25786009)(4326008)(256004)(14444005)(5024004)(52536014)(236005)(478600001)(74316002)(86362001)(14454004)(11346002)(55016002)(446003)(486006)(5660300002)(966005)(7696005)(76176011)(7116003)(26005)(6506007)(606006)(186003)(99286004)(71190400001)(71200400001)(8936002)(33656002)(229853002)(54896002)(6306002)(9686003)(316002)(8676002)(7736002)(3480700005)(81166006)(81156014)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR16MB1609; H:DM5PR16MB1705.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: dWuh80/Bff7a+DARgaRjnvvX3QFVfOdFuQ4Hgxfthu8P0YgBFgXxrKwVbtcTsVRVLvQPRlQDFXbTSKYfWdH9gSsHpjU4hKvrjCjFfuUC7eZu9tz8iISNo+3E2ojFDsI6fpJxgD5gHWsXsaKGcDbS8RB8xSpjxHlbj5ddayszV8qKAJeBDfcDIq9MTmvLKi3upwY3CkKwPEranF2qE5p6yuEatqXnibjr+ni/XJNWMl0LQ0M31erVPbWc6KlSBiz28XudcznlJiS2x+8pyhKefRR7Q0Ck9fQ9seCI5PToCgMo2IQNEOKh96upuNbmDqdUJNQEDDLY2gnA/7S8/YMspELIBzsYuHe/fuv2cP5rG4OiN5sdOYXJRuNNq+8SWb34VBx0Cs8nabK113GgrG92xsf61xjFImI4kNZTQuPX1jA=
x-ms-exchange-transport-forked: True
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: a0a5c9ff-ba0e-45f6-4905-08d72487a3b6
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Aug 2019 09:28:48.1622 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: P9DIy0oaMVws3mN3n14nmwkyM7ViAZW6TSN6gZmfVaiXWUpGrQTXfKgb6eR5ogWvLmQseoy35t4ali9o4IWX3H9i1Hwbups0UImnUMSZi8J41bxI0R3zvYtLlkysMrLD
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR16MB1609
X-OriginatorOrg: mcafee.com
X-NAI-Spam-Flag: NO
X-NAI-Spam-Threshold: 15
X-NAI-Spam-Score: 0
X-NAI-Spam-Version: 2.3.0.9418 : core <6614> : inlines <7135> : streams <1830549> : uri <2886169>
X-MC-Unique: UswNtG4YNJePFpQynUIdyg-1
X-Mimecast-Spam-Score: 0
Content-Type: multipart/alternative; boundary="_000_DM5PR16MB1705E6CBCED4C18B0679C6EBEAA80DM5PR16MB1705namp_"
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic/Pd0JquVhAsppQW5HKpLxoorLRzU>
X-BeenThere: quic@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Main mailing list of the IETF QUIC working group <quic.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic>, <mailto:quic-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic/>
List-Post: <mailto:quic@ietf.org>
List-Help: <mailto:quic-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic>, <mailto:quic-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 19 Aug 2019 09:29:30 -0000

From: QUIC <quic-bounces@ietf.org> On Behalf Of Christian Meutes
Sent: Monday, August 19, 2019 12:40 PM
To: Konda, Tirumaleswar Reddy <TirumaleswarReddy_Konda@McAfee.com>
Cc: IETF QUIC WG <quic@ietf.org>
Subject: Re: Blocking Quic traffic


CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

________________________________
On Mon 19. Aug 2019 at 08:30, Konda, Tirumaleswar Reddy <TirumaleswarReddy_Konda@mcafee.com<mailto:TirumaleswarReddy_Konda@mcafee.com>> wrote:
Enterprise middle-boxes do not act as TLS proxies for all flows. For example, middle-boxes typically do not act as TLS proxies for domains with high-reputation score (e.g., bank sites). In this case, middle-box may only inspect the TLS handshake to validate the server certificate (e.g., to detect malwares lying about SNI) but looks like middle-boxes will have to proxy all QUIC flows .

Everything they don‘t know is TLS-spoofed (with the exception of transparent implementations without SNI client support), so from a user perspective you cannot trust your communications if you care about your privacy. I don‘t think TLS was meant to be possible to intercept. Browsers in such environments should by definition not letting users believe that their communication is secured end-to-end, because it isn‘t (and they can figure it out).

[TR] These devices are managed by the IT administrator and Enterprise CA is configured on the endpoint, see https://bugzilla.mozilla.org/show_bug.cgi?id=1265113 and https://support.mozilla.org/en-US/products/firefox-enterprise/policies-customization-enterprise/policies-overview-enterprise

Cheers,
-Tiru

v2.46.0 | Report a Bug | By Email | System Status