Re: [Spud] What middleboxes are allowed to know (Re: [Stackevo-discuss] Fwd: Possible WG-forming follow-on to SPUD BoF)

[Brian Trammell <[e-mail]>]

hi Toerless,

> On 23 May 2016, at 15:43, Toerless Eckert <[e-mail]> wrote:
> 
> 
> Mirja: Your answer below "i don't want the middleboxes to require anything here"
> is letting me totally confused. If PLUS wants to define how talk with the
> middlebox (or however you want to call it "pass info to it, get info from it"),
> then it is clear that the resut of this interaction is that you will not
> achieve desirable outcomes if you do not send specific info to the middlebox
> 
> Please give me an example how you think PLUS will help firewall middleboxes
> to decide whether or not to less some traffic flow pass. Lets assume that
> same firewall today is using TCP port number policies and/or DPI. What
> in your opinion should the firewall do.

I don't think this is what we're trying to do with PLUS: declarative information about network traffic *properties* doesn't match well to policies described in terms of particular fields in headers. Certainly, port number based firewall rules would still work for applications over PLUS if PLUS itself doesn't use UDP port numbers to identify itself (which, IMO, it shouldn't -- I'm a big fan of magic numbers for this).

One could certainly ask for an "application ID" as an application to path key for firewall use, but among indistinguishable applications, this is simply an invitation to lie, so I'm not optimistic about its usefulness.

Cheers,

Brian

> 
> 
>>> What i really want to see is this:
>>> 
>>> - Allow the application to learn from the network devices what information
>>> it must present in the clear to have its traffic be passed through
>>> and/or receive additional treatment by the network.
>>> 
>>> Aka: "Security guard: Sure, you can go through this door if you show me your <credential> else not"
>>> 
>>> Then the app can decide if it wants to show <credential>. Otherwise the
>>> apps have to operate like corporate drones, carrying around their corp-ID
>>> in the open all the time hoping that thats the right credential.
>>> 
>>> Or to rephrase: if we do not even attempt to overcome TCP port numbers as
>>> credentials then we're lame and will not be successful.
>> 
>> Okay??? I first of all have to simply say no here. I don???t want the middleboxes to require anything here, because why would a middlebox not just say ???either you show me all you content in plain or I don???t transport you data???. I believe that???s something we all don???t want and building a mechanism that could lead to this, it the last thing I want. I know what you intention is here, but we have to be more than careful here and the way you???ve just phrased it, I can just disagree. However, I would propose to have this discussion in a separate thread.
> 
> _______________________________________________
> Spud mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/spud