IETF Logo Mail Archive

Re: [radext] Adoption call for draft-perez-radext-radius-fragmentation-06

"Diego R. Lopez" <diego@tid.es> Tue, 03 September 2013 16:09 UTC

Return-Path: <diego@tid.es>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E424821F9D31 for <radext@ietfa.amsl.com>; Tue, 3 Sep 2013 09:09:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.525
X-Spam-Level:
X-Spam-Status: No, score=-4.525 tagged_above=-999 required=5 tests=[AWL=-0.340, BAYES_40=-0.185, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6zAqczP73hwi for <radext@ietfa.amsl.com>; Tue, 3 Sep 2013 09:09:06 -0700 (PDT)
Received: from correo-bck.tid.es (correo-bck.tid.es [195.235.93.200]) by ietfa.amsl.com (Postfix) with ESMTP id E4A8921E814E for <radext@ietf.org>; Tue, 3 Sep 2013 09:09:05 -0700 (PDT)
Received: from sbrightmailg02.hi.inet (Sbrightmailg02.hi.inet [10.95.78.105]) by tid.hi.inet (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTP id <0MSK00M0E4V2BU@tid.hi.inet> for radext@ietf.org; Tue, 03 Sep 2013 18:09:02 +0200 (MEST)
Received: from vanvan (vanvan.hi.inet [10.95.78.49]) by sbrightmailg02.hi.inet (Symantec Messaging Gateway) with SMTP id EC.47.28420.E9906225; Tue, 03 Sep 2013 18:09:02 +0200 (CEST)
Received: from correo.tid.es (mailhost.hi.inet [10.95.64.100]) by tid.hi.inet (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTPS id <0MSK00M024V1BU@tid.hi.inet> for radext@ietf.org; Tue, 03 Sep 2013 18:09:02 +0200 (MEST)
Received: from EX10-MB2-MAD.hi.inet ([169.254.2.165]) by EX10-HTCAS6-MAD.hi.inet ([::1]) with mapi id 14.03.0123.003; Tue, 03 Sep 2013 18:09:01 +0200
Date: Tue, 03 Sep 2013 16:09:00 +0000
From: "Diego R. Lopez" <diego@tid.es>
In-reply-to: <52254709.5030208@deployingradius.com>
X-Originating-IP: [10.95.64.115]
To: Alan DeKok <aland@deployingradius.com>
Message-id: <74B487C3-6385-421F-A1FD-6C75EB7A9C29@tid.es>
Content-id: <A2C47514B16D364A9A73C85D37B31795@hi.inet>
MIME-version: 1.0
Content-type: text/plain; charset="utf-8"
Content-language: en-US
Content-transfer-encoding: base64
Accept-Language: en-US, es-ES
Thread-topic: [radext] Adoption call for draft-perez-radext-radius-fragmentation-06
Thread-index: AQHOqEyuzW56czpYmk+yscMJP0W6O5m0DawA
X-AuditID: 0a5f4e69-b7fe58e000006f04-0e-5226099e8334
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmphkeLIzCtJLcpLzFFi42Lhivcz1J3HqRZk8HWhukXLq5lsDoweS5b8 ZApgjOKySUnNySxLLdK3S+DK2N5cUXBPuOL5i6PsDYxzhLsYOTkkBEwkTn3qYoGwxSQu3FvP 1sXIxSEksJ1R4lXHcSYI5xejxI5JT9khnJmMEvsnz2cFaWERUJV4deoTWDsbkP2o+Tc7iC0s ECLxvm8yI4jNKWAs0X1uAdQKBYk/5x6D2SICWhIL1i8Cs5kF/CWWrmhnA7F5BSwlTr+YwAwR N5N4fPgGVFxQ4sfke0D1HEBxdYkpU3IhSsQlmltvQo1RlJi2qAFsLaOArMS7+RBnigiESjR9 n8MM0ioiYCSxr8Uf4hoBiSV7zjND2KISLx//Y4V4cR+TRPPRZSwTGCVmIbliFpIrZiFcMQvJ FbOQXLGAkXUVo1hxUlFmekZJbmJmTrqBkV5Gpl5mXmrJJkZIzGXuYFy+U+UQowAHoxIPL8Mj 1SAh1sSy4srcQ4wSHMxKIrxbWNWChHhTEiurUovy44tKc1KLDzEycXBKNTCmbLu77bWT8Ryl rZ+u5XO3nViy55t1VemH2+Fr75bMmrTTLe0fVxLHxoMPJ3AGz1jfo8WuUP3wfotMhv/qLxPe pityLeTI8DzzPGyC0kVhq1kqpR9bJpyP2jq92GTt1CObj9gd8Y04dUrOuCLP9MHcO3trPFQ7 Zvk9nxPc0iX8ZyPbs0uLv66wVmIpzkg01GIuKk4EAEldK/WXAgAA
References: <86D0772B-4561-46BD-950D-AF95BED87292@gmail.com> <alpine.WNT.2.00.1308210755460.1748@SMURF> <5224AB2B.7000808@deployingradius.com> <alpine.WNT.2.00.1309020919250.2692@SMURF> <5224F3BE.4070902@deployingradius.com> <alpine.WNT.2.00.1309021811070.2692@SMURF> <52254709.5030208@deployingradius.com>
Cc: "radext@ietf.org" <radext@ietf.org>, Peter Deacon <peterd@iea-software.com>
Subject: Re: [radext] Adoption call for draft-perez-radext-radius-fragmentation-06
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 03 Sep 2013 16:09:11 -0000

Hi,

On 3 Sep 2013, at 04:18 , Alan DeKok wrote:
> Peter Deacon wrote:
>> In this case lack of knowledge is NOT the problem.  The problem is
>> proxies KNOWING something is WRONG and being expected to look the other
>> way and forward the information on anyway.
>
>  Yes.  That's EXACTLY what proxies should be doing.  Anything else
> causes a disaster.
>
>  I explained why I have my opinion, using real-world examples.  Your
> counter-argument is to re-state that this is a problem.
>
>  You don't dispute my examples, and you don't offer a counter-argument
> to them.  I can only conclude that you're disagreeing because of some
> un-named fear.


As I see it, there is a clear rule for proxy behavior with respect to this: Proxies have to behave in the most transparent possible way because they are simply relays for the communication. Validations (for security, semantics or whatever else) should occur only E2E. If you want to have a middlebox that breaks E2E validation for whatever the reason (as much legitimate as it can be) don't claim it to be a proxy.

In brief: Hop-by-hop security MUST be checked at each proxy, of course. But E2E security MUST NOT be checked at a proxy.

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: diego@tid.es
Tel:    +34 913 129 041
Mobile: +34 682 051 091
-----------------------------------------


________________________________

Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo.
This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at:
http://www.tid.es/ES/PAGINAS/disclaimer.aspx

v2.23.0 | Report a Bug | By Email