Re: [Spud] Can Malicious users can use PLUS layer to force their traffic through firewalls in the network?

Hi Linda,

thanks for you  question. Please see below.

> Am 20.08.2016 um 00:32 schrieb Linda Dunbar <linda.dunbar@huawei.com>:
> 
> Brian, etc, 
>  
> I have a couple of questions for PLUS: 
>  
> ·        PLUS allowing end points to expose more information to middle boxes. But how do end points know what kind of middle boxes their traffic will traverse through?

In the usual case not at all. Because we are mostly talking about declarative signaling where endpoints provide information to the path that could be used by an network element if present on this path. However, there is no guarantee that a certain treatment will be performed.

Depending on what PLUS might look like in future there could also be mechanism that enables it to identify a specific middlebox on the path and talk to it directly. However, I would rather see that you’d have a separate out-of band mechanism for that.

>  
> ·        Malicious users  can use this PLUS layer to force their traffic through firewalls in the network. How can middle boxes trust the bits encoded in the PLUS layer?

Here we mostly rely on the same mechanism as used today e.g. with firewall that reply on TCP semantics. However, the goal is to enable the same kind of firewall treatment for non-TCP in a transport-idenpendent way such that the firewall would not need to update for each new protocol separately (and delaying deployment of new protocols). The details here are something we are currently working on, however, the solution will still reply on un-trusted bits that support state management in middleboxes, e.g. by demonstrating cooperation between both endpoints.

Mirja and Brian

>  
> Thanks, Linda Dunbar
>  
> _______________________________________________
> Spud mailing list
> Spud@ietf.org
> https://www.ietf.org/mailman/listinfo/spud