Subject: RE: [midcom] Out-of-Path Midcom Agents in framework-02

From: "Fleischman, Eric W" <[email-masked]>
Date: Mon, 18 Jun 2001 11:17:35 -0700

No, I am not making any claims vis-a-vis ALGs. Indeed, my own thinking
had not matured to the extent that I identified OOP agents as being
transparent ALGs and in-band agents as being non-transparent
ALGs. Are you sure that such an equation is complete and accurate?

In any case, I am rather concerned about crackers creating attack platforms 
which resemble ALGs. It is my belief that such devices are inherently 
more "stealthy" when acting as OOP agents. 

We can satisfy my concerns by building in protections so that OOP agents
are known (e.g., their IP addresses can not be spoofed and we can be
guaranteed to be able to accurately identify and authenticate them) and
that we have devised provisions to reduce the DoS threat from such
agents. I haven't seen any postings which make me think that we have been
concerned about DoS attacks yet. Certainly, my earlier posting about
the need to make midcom as stateless as possible was partly motivated
by DoS concerns.

>	I find this puzzling. To my way of thinking, an OOP agent
>is (or is very close to) a pretty ordinary transparent application
>layer gateway that's been taught how to talk to a middlebox to
>fast-path traffic. In In-Path agent is a non-transparent application
>layer gateway with the same teaching.

>	Are you claiming that a transparent ALG is in some way
>easier to fool/spoof/hack than a non-transparent one?

>	What am I missing?

>		Andrew

>P.S. I am of, course, aware that MIDCOM Agent is not actually synonymous
>with ALG. It just seems to me that most implementations will tend to
>fall somewhat along these lines.

_______________________________________________
midcom mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/midcom

---

From: Pyda Srisuresh <[email-masked]>
Date: Tue, 19 Jun 2001 09:57:44 -0700 (PDT)

> ALGs. Are you sure that such an equation is complete and accurate?
In-Path agents (ex: Proxies) are visible to the end-hosts. So, in-path 
agents are not transparent. 
OOP agent are not visible to end-hosts. So, an OOP agent is transparent.   

> the need to make midcom as stateless as possible was partly motivated

We could certainly mention security concerns in the context of
OOP agents. But, as Andrew points out, any intermediate agent 
(transparent or non-transparent) could fool/spoof/hack, if it
chose to do so.
 
> >fall somewhat along these lines.

=====

__________________________________________________
Do You Yahoo!?
Spot the hottest trends in music, movies, and more.
http://buzz.yahoo.com/

---

From: "Melinda Shore" <[email-masked]>
Date: Tue, 19 Jun 2001 13:43:37 -0400

> OOP agent are not visible to end-hosts. So, an OOP agent is transparent.   

I wouldn't agree that one follows from the other.
If the out-of-path agent effects a change in the behavior
of the data/application/what-have-you, it's not transparent.

Melinda

---

From: Pyda Srisuresh <[email-masked]>
Date: Tue, 19 Jun 2001 10:53:20 -0700 (PDT)

> of the data/application/what-have-you, it's not transparent.

Sure, I meant that as being implied.

> Melinda

cheers,
suresh