IETF Logo Mail Archive

Re: Security issues with draft-ietf-tsvwg-iana-ports-08

Eliot Lear <lear@cisco.com> Mon, 08 November 2010 12:50 UTC

Return-Path: <lear@cisco.com>
X-Original-To: tsvwg@core3.amsl.com
Delivered-To: tsvwg@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 400143A69DC for <tsvwg@core3.amsl.com>; Mon, 8 Nov 2010 04:50:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -109.266
X-Spam-Level:
X-Spam-Status: No, score=-109.266 tagged_above=-999 required=5 tests=[AWL=1.333, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CkH0F6-Bkdpp for <tsvwg@core3.amsl.com>; Mon, 8 Nov 2010 04:50:35 -0800 (PST)
Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by core3.amsl.com (Postfix) with ESMTP id D38DE3A69D6 for <tsvwg@ietf.org>; Mon, 8 Nov 2010 04:50:34 -0800 (PST)
Authentication-Results: ams-iport-1.cisco.com; dkim=neutral (message not signed) header.i=none
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AvsEAIuA10yQ/khLgWdsb2JhbACDMZ5TFxYiIqIrijGQRoEigzNzBIpV
X-IronPort-AV: E=Sophos;i="4.58,314,1286150400"; d="scan'208";a="68608271"
Received: from ams-core-2.cisco.com ([144.254.72.75]) by ams-iport-1.cisco.com with ESMTP; 08 Nov 2010 12:50:55 +0000
Received: from dhcp-10-61-98-253.cisco.com (dhcp-10-61-98-253.cisco.com [10.61.98.253]) by ams-core-2.cisco.com (8.14.3/8.14.3) with ESMTP id oA8Cotc7032129; Mon, 8 Nov 2010 12:50:55 GMT
Message-ID: <4CD7F244.7000102@cisco.com>
Date: Mon, 08 Nov 2010 13:51:16 +0100
From: Eliot Lear <lear@cisco.com>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6
MIME-Version: 1.0
To: Paul Hoffman <paul.hoffman@vpnc.org>
Subject: Re: Security issues with draft-ietf-tsvwg-iana-ports-08
References: <4CCD6B0B.5040804@isode.com> <p06240842c8f7b9ba2577@[10.20.30.150]> <4CD27ECF.1010500@cisco.com> <p06240802c8f8882552b4@[10.20.30.150]> <4CD2FAEB.5020606@cisco.com> <4CD4B053.8010001@ericsson.com> <p0624082dc8fb3842cc69@[10.20.30.150]> <4CD764F1.9060700@ericsson.com> <p06240844c8fd6ec914fb@[130.129.55.1]>
In-Reply-To: <p06240844c8fd6ec914fb@[130.129.55.1]>
X-Enigmail-Version: 1.1.1
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Cc: Magnus Westerlund <magnus.westerlund@ericsson.com>, "tsvwg@ietf.org" <tsvwg@ietf.org>
X-BeenThere: tsvwg@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Transport Area Working Group <tsvwg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tsvwg>, <mailto:tsvwg-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tsvwg>
List-Post: <mailto:tsvwg@ietf.org>
List-Help: <mailto:tsvwg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tsvwg>, <mailto:tsvwg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 08 Nov 2010 12:50:36 -0000

On 11/8/10 10:18 AM, Paul Hoffman wrote:
> At 10:48 AM +0800 11/8/10, Magnus Westerlund wrote:
>> Also, STARTTLS is not the only way of using TLS on a joint port. If you
>> can de-mux TLS requests and unsecured ones on the same port without
>> needing an initiation command then things would work differently.
> True. Is that done in any IETF protocols? I know people thought about this, but I thought they all had rejected it, but I easily could have missed something.

I think we may be making a mountain out of a mole hill on this one, to
be frank.  Any server multi-threaded server implementation should just
view all of this as another set of attributes on a descriptor.  That is
certainly the case, for example, with dovecot, sendmail, and apache. 
And so while, yes, I don't see as much demuxing INSIDE the application
protocol, roughly the same amount of complexity is there.

Eliot

v2.23.0 | Report a Bug | By Email