Re: Entropy in headers for connection identification at a stateful firewall

Mikkel Fahnøe Jørgensen <mikkelfj@gmail.com> Tue, 06 November 2018 09:25 UTC

Return-Path: <mikkelfj@gmail.com>
X-Original-To: quic@ietfa.amsl.com
Delivered-To: quic@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E48DF130DC5 for <quic@ietfa.amsl.com>; Tue, 6 Nov 2018 01:25:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.998
X-Spam-Level:
X-Spam-Status: No, score=-0.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LZV-My1xpu_8 for <quic@ietfa.amsl.com>; Tue, 6 Nov 2018 01:25:54 -0800 (PST)
Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8414C128A6E for <quic@ietf.org>; Tue, 6 Nov 2018 01:25:54 -0800 (PST)
Received: by mail-io1-xd2f.google.com with SMTP id q18-v6so8701311iod.5 for <quic@ietf.org>; Tue, 06 Nov 2018 01:25:54 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:in-reply-to:references:mime-version:date:message-id:subject:to :cc; bh=AGzO1/VgyXY1/OeJWU1IeQn+T2SiTJG6IHkXnzX/xfo=; b=PXGCyuW/JzfR2XITfOr6IOXTYRYW7WrQyaa8VGp3ZgkTyO9MfelhNY5fDGEu2uRJ2b 6l0kap7auZchMxUArxuA4pv5jrj187qUadJZ6ugqvgzjhedqE61JOB9YjcxU6tcHAW7h oP+HT/mTAkM97uOi4IfwalMEJosjguUzA8ehW29buYXJbFspcEx6Ydx8h8FDon7upKM3 ZYgxAjfX0TuSCnk6WufMnYAEgmb/M8/4EMwsLKr0goEYHXjdKzYbnToGoCCLTqxmZKDE 1mbz5zH/LgKgbm3vAe3kOvtQRizMAVytGhlt8To8AcgYJC5HjQC4eMKiz7GS4WpJ/r0w QTuQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:in-reply-to:references:mime-version:date :message-id:subject:to:cc; bh=AGzO1/VgyXY1/OeJWU1IeQn+T2SiTJG6IHkXnzX/xfo=; b=ZAY+msb0/OX1w8s+VngXfnK+ZkdDIcLxXoMV79MAzeT1ALxEBiDOMebyVfLoHD3lfF DEXVwEyGRjOjSA3P9/ImKs9QPLkiSSs6sfYjNzSQ8jPIweVT+O/4JgNUx9BU/nzSxTSR dn+bglAGDHBwT9pLJkyEAwTyZl5R/IQvGMKCjkIIXQuYjZbII9+AMqGg1XcAQC8Jo0Ja 8JzeHgZZJtFsKd5X6fy7OaxHJfLfBD8z5Nx8h6J0EN0XYfzCEEbWPYySl4KX5ay9IPf2 Dlt1RE8WEcC/J0Xy4sHq7Am2H0UOIMC8nLodPkaanQ9cDmqstu+Mp9k5skCjprEQLDHs elvA==
X-Gm-Message-State: AGRZ1gKOKQ08G+QVVz1zKcoHV3RiIbIDYncWTnKJSYh2fy/akueWR7Eu ZsCQ/vH/C/k6/zBAHs7goCONXpeoMY2EGBExSP4=
X-Google-Smtp-Source: AJdET5dX9UmFLAAt6el2s2/CQBR73mJQUe/kIr7b8TF4CCiZhaE10OKQWcPT1IxiRCk2RcArJgY3oFExJWCAgtDq7MU=
X-Received: by 2002:a6b:f014:: with SMTP id w20-v6mr19698475ioc.12.1541496353884; Tue, 06 Nov 2018 01:25:53 -0800 (PST)
Received: from 1058052472880 named unknown by gmailapi.google.com with HTTPREST; Tue, 6 Nov 2018 01:25:53 -0800
From: =?UTF-8?Q?Mikkel_Fahn=C3=B8e_J=C3=B8rgensen?= <mikkelfj@gmail.com>
In-Reply-To: <CALZ3u+YUDz50LVWZRX0i8dmqgvBKqqHiMgBwjdQUBBQB6O=CyA@mail.gmail.com>
References: <CALZ3u+ZXhEtkLUiebQq=uy+cTU+k5sG9Hbe4eaKKcdm-usGiqQ@mail.gmail.com> <CAN1APddd06DLjPMT2ZHCedgk_DnqGmv8DW+vtqOZa2juc4ndig@mail.gmail.com> <CALZ3u+YUDz50LVWZRX0i8dmqgvBKqqHiMgBwjdQUBBQB6O=CyA@mail.gmail.com>
X-Mailer: Airmail (420)
MIME-Version: 1.0
Date: Tue, 6 Nov 2018 01:25:53 -0800
Message-ID: <CAN1APdeq0g0ZXCQqCYffiAGKpDc5stWmtzU9TrgikMSW=SyeMg@mail.gmail.com>
Subject: Re: Entropy in headers for connection identification at a stateful firewall
To: =?UTF-8?Q?T=C3=B6ma_Gavrichenkov?= <ximaera@gmail.com>
Cc: quic@ietf.org
Content-Type: multipart/alternative; boundary="0000000000009891710579fb96c2"
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic/x4jLczLGA5zDryJHwiIhSeQuLHM>
X-BeenThere: quic@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Main mailing list of the IETF QUIC working group <quic.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic>, <mailto:quic-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic/>
List-Post: <mailto:quic@ietf.org>
List-Help: <mailto:quic-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic>, <mailto:quic-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 06 Nov 2018 09:25:56 -0000

On 6 November 2018 at 10.22.40, Töma Gavrichenkov (ximaera@gmail.com) wrote:

Well, like I said, there wouldn't be any problem with the middlebox,
it would be able to handle virtually any possible load. It's the
client who wouldn't.



That is also what I meant: the middlebox could observe excess load on a
specific 3- or 5- tuple without itself being overloaded.