Subject: Re: Topology, pinholes and policy roles (was RE: [midcom] policy &duration)

From: Andrew Molitor <[email-masked]>
Date: Wed, 15 Aug 2001 16:01:33 -0500 (CDT)

On Wed, 15 Aug 2001, Eliot Lear wrote:

> Right.  This is nearly what I wrote a week ago.  The only difference was
> that I put it in terms of policy;
> 
> > A middle box SHOULD understand, at a minimum, policy conditions that
> > contain the interfaces involved, protocol, source address and port,
> > destination address and port, all of which with the exception of protocol
> > and interfaces MUST be capable of being expressed as a range of values. 
> > This is the trivial case, necessary to deploy a middlebox without the
> > assistance of a policy server.
> 
> I think you are looking for the following substitution:
> 
> s/source/internal/
> s/destination/external/

	Source and Destination are not interchangeable with Internal
versus External. Communications are often bidirectional, as you know.
Internal and External are notions that should be bound to the two
sides of a 5-tuple, source and destination are not.

	Unless by source you mean something like 'the end that sends
the first packet of a communication' or something, and even then I
think it's not powerful enough absent some discussion of interface
(such as Internal and External).

> 
> remove interface for purposes of protocol discussion.

	If the MIDCOM protocol doesn't talk about interfaces, it
becomes a mere can opener which hackers can use to punch arbitrary
holes in your firewall. _vide_ my earlier note on forged INVITES
and your internal NFS server.

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: Eliot Lear <[email-masked]>
Date: Thu, 16 Aug 2001 01:53:27 -0700

> sides of a 5-tuple, source and destination are not.

Right.  We're not disagreeing here.  It's what that implies that causes us
some grief.  How would you reference an interface in the protocol?  By
name?  How would you determine which interface to name, even if you knew
their names?

Your earlier example, by the way, did NOT require interfaces.  Rather, it
required that the midcom box take responsibility for understanding the
security implications of the service it provides.
--
Eliot Lear
[email-masked]