[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: CPEs -- security

On 4 jan 2008, at 19:28, Christian Huitema wrote:
2a) The decision to empower applications rightly belong to the user. The user should make a conscious arbitration between the benefits derived from the application, and the exposure created by running that application. Whether the application uses its own code to achieve that or whether it is built using system components is irrelevant.
I don't think it's always irrelevant. For instance, I suggested at one point that a host would indicate its desire to be unfirewalled through an neighbor discovery option. There is no reasonable way for applications to use such a mechanism.
Also, it could be considered undesirable to have individual applications do things like this without oversight from "the system".
In any case, the IETF should not be concerned with the internal architecture of end systems, and should not engage in a debate on the split of functions between application, OS, libraries, host firewalls and other common services.
Well, obviously someone has to do it, because otherwise there is no standard way for applications to ask for these services.
2b) The solutions that do work well in practice, like STUN and Teredo, are those that do not require any explicit signaling between the end system and the gateways or firewalls. Explicit signaling has a mediocre record of working when the system is directly connected to the gateway -- UPNP, for example, ends up working in maybe two thirds of such deployments. Explicit signaling just does not work when the router is several hops away. If the problem is "how to cross stateful filtering routers", the solution has to be "create state", probably by sending sacrificial packets along the path in order to "open the filters".
You're basically saying that the situation where there is no need for a protocol because systems can trigger the desired action unilaterally is preferable over the situation where two systems need to cooperate so there must be a protocol between them to accomplish this. That is a truism.
However, it doesn't apply here. There is simply no reasonable way to get traffic past a stateful firewall without the cooperation from the firewall. Also, unlike the IPv4 situation, we actually do get to think about this before there are millions of boxes from dozens of vendors out there.
One was to allow IPSEC through by default, with the reasoning that a host implementing IPSEC also has its own internal firewall.
My thinking here was that IPsec is specifically designed to reject unknown traffic and IKE/ISAKMP is specifically designed to operate in a hostile environment, so no additional firewalling is required.