Subject: [midcom] Precedence of wildcards

From: Mark Duffy <[email-masked]>
Date: Thu, 13 Sep 2001 18:16:40 -0400

(subject line changed -- this is really a resumption of a thread from last
week)

At 02:34 PM 9/13/01 -0700, Christian Huitema wrote:
>OK, there is a confusion in my initial phrasing. Try this:
>
>R86: It should possible to define rulesets that contain a more specific
>filter than an overlapping ruleset, and a different set of attributes.
>This should allow Midcom agent to request that a subset of the traffic
>that would be allowed by the overlapping ruleset be specifically
>disallowed. 
>
>Reasoning: this is required for rapid response to intrusion detection.

Christian, thanks.  That sounds better.  I agree with the requirement.

>To answer Mark question, yes I expect that "when the filters of two
>rulesets overlap, the middlebox only executes the actions specified by
>the most specific ruleset."

This is where we get back to the earlier thread about precedence of
wildcards and  a fixed canonical ordering scheme as you have proposed.

Consider a firewall which usually has the following rule to permit access
from the Internet to a web server:
   Rule1: SA=*, DA=1.2.3.4, prot=tcp, SP=*, DP=80: permit all incoming

Now there is some kind of attack from 5.6.7.8.  If I understand the
motivation here, one might want to add a "rapid response" rule to block any
acces from that host, i.e.:
   Rule2: SA=5.6.7.8, DA=*, prot=*, SP=*, DP=*: deny all

Clearly we want Rule2 to be applied in preference to Rule1 when both may
match.  Now if I understand the canonical ordering idea, we pick some fixed
significance order for the 5-tuple fields, such as
  MSB-->   SA|DA|prot|SP|DP   <--LSB
so we have:
            SA      DA prot SP  DP
  Rule1: *.*.*.*.1.2.3.4.6.*.*.0.80
  Rule2: 5.6.7.8.*.*.*.*.*.*.*.*.*

Now I gather we order the rules according to:
   '1' bit > '0' bit > 'dont care' bit
which means Rule2 > Rule1 and any traffic from 5.6.7.8 is therefore denied.
 In this case that is exactly what we want.  But how can we be confident
that this algorithm will give the desired result in all cases?  Suppose the
"usual" rule only allowed server access from subnet 8.9.10/24.  Now we have
   Rule1a: SA=8.9.10.*, DA=1.2.3.4, prot=tcp, SP=*, DP=80: permit all incoming
Now Rule1a > Rule2 and the rapid response ruledoesn't get the desired
preference!

Perhaps I am misunderstanding how the canonical ordering would be imposed?

I know you advocate Interior/Exterior address and port view rather than
Source/Dest but I do not believe that alters the basic question in this case.

--Mark

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom