Subject: Re: interception proxies

From: Vernon Schryver <[email-masked]>
Date: Mon, 17 Apr 2000 23:51:05 -0600 (MDT)

> From: Joe Touch <[email-masked]>

> ...
> redirection proxy and set of web caches redirected to - are responsible
> for maintaining the IP ID uniqueness, since they, as a whole, intend to
> represent a single IP address.
>
> (in the trivial case I outlined, that uniqueness is ensured by the use
> of source-determined demux; anytime packets with the same source/dest
> pair can go to the different endpoints, uniqueness must be otherwise
> avoided, e.g., out of band messages between the endpoints.)
>
> The same applies, BTW, for port reuse and TCP sequence spaces. Sets of
> endpoints aliasing as a single must coordinate and ensure uniqueness.

yep.
As long as local system maintains the illusion to the remote peer of being
a correctly functioning host, everything else, including geographical
dispersion is an irrelevant internal implementation detail.

IPSEC and application layer security are canaries that swoon early when
third parties try to improve the situation.

> > A NAT box can also do the wrong thing with IP fragmentation, and in more
> > plausible scenarioes than 600 byte URL's or PUT's.  Consider two client
> ...

> Hmmm - is that observation in the NAT specs? If not, is it something
> that should be addressed separately there, or in the Transparency
> Hazards doc??

As I understand your document, it's off topic.
I understand it as "Third Party Redirection Proxies Considered Harmful."
The bit about third party HTTP redirection proxies being based on
replay attacks exemplifies the sense.

Vernon Schryver    [email-masked]

---

From: Joe Touch <[email-masked]>
Date: Mon, 17 Apr 2000 23:47:55 -0700

> replay attacks exemplifies the sense.

The only question is whether there is something similar between NATs and
transparent proxies. Maybe "modifying IP packets considered harmful".
The issue with NATs may best be added under "even within the same AD,
transparent proxies are dangerous because..." including the IP ID and
TCP port and sequence number issues there seems on-topic. (?)

Joe

---

From: Keith Moore <[email-masked]>
Date: Tue, 18 Apr 2000 09:42:12 -0400

> Maybe "modifying IP packets considered harmful".

I think this is the right tack.  Anything you do to modify an IP packet
in transit - in ways not anticipated by the design of IP - should
at least be considered suspect, because the chances are good that it
will break *something*.  There are cases for which such practices
will do only minimal harm, but the only way to find out where the 
safe territory lies is to analyze the kinds of harm that can be done 
and to identify conditions where the harm done doesn't actually
cause real problems.

Keith