It looks the “selective proxying” topic requires a full document to analyze it. The co-authors discussed and it would be a good idea to remove it from this draft. We will made the updates.
The concern is valid that "there's no guarantee that the server will respond to the client the same way it did to the proxy, or even that the identity the server presented to the proxy is the server's real identity”. We also have to dive into the details about which piece of server responded information is being used for selective proxying, and how often/what to do when that changes. The "malicious client and cooperating server” problem exists outside of a TLS proxy deployment. There are many ways to circumvent a TLS proxy if one controls both sides. The document touched it in Section 5.2<https://tools.ietf.org/html/draft-wang-opsec-tls-proxy-bp-00#section-5.2>. Some TLS proxy implementations violated the RFC in the past, but nothing in our draft suggests that a modern TLS proxy does or should violate the TLS spec. It was the motivation of this draft to help reduce/prevent non-compliance, as mentioned earlier. On Jul 28, 2020, at 5:34 PM, Nick Harper <nharper=40google....@dmarc.ietf.org<mailto:nharper=40google....@dmarc.ietf.org>> wrote: On Tue, Jul 28, 2020 at 2:19 PM Eric Wang (ejwang) <ejwang=40cisco....@dmarc.ietf.org<mailto:40cisco....@dmarc.ietf.org>> wrote: Thank you for the detailed comments. The scope of the document is limited to proxy at the TLS layer. Explicitly out of the scope is inspection of the proxied record data. Will clean up derivations from this scope. It was the intention to cover selective proxying however, because that is a practical requirement for an actual deployment. The intention was to discuss the TLS layer attributes (e.g. SNI, Server Cert) that could be used as input for the decision. The document also stated the requirement to gracefully remove the proxy from the session when needed (and possible). But the criteria for selective proxying decision, being compliance, privacy, risk level,... are out of the scope. The decision making often falls under the larger “policy” domain and is controlled at system level outside of the proxy. It also left out discussion on the detailed mechanism which was deemed as implementation specific. In any case, the proxy has to conduct selective proxying in a safe, non-disruptive manner. This may require more design work as you pointed out. The document could describe possible mechanisms so that an acceptable practice could be discussed. We are open to other ways to shape it. An acceptable practice MUST include not violating the protocol invariants in RFC 8446. It is not possible for a proxy to obey the protocol invariants and selectively proxy based on the contents of the TLS handshake between the proxy and the server a client wishes to connect to. More inline... Probably the worst problem is rooted in Section 5.1. The introduction establishes this as being about proxying, but there are several places that talk about not-proxying sometimes. Selective non-proxying opens the document up to a whole new set of problems that arise from poor designs for deciding not to proxy. There is not nearly enough detail here to address this problem properly. A "good" design for selective TLS proxying does not seem to be the basis of the recommendations. I'll give a few examples of problems. From the Section 4.8 again: the TLS proxy MUST conduct proper TLS protocol checks to avoid false identification of TLS handshakes, while taking special care not to contribute to protocol ossification. This practice has been directly responsible for more ossification than intermediation, no matter what qualification exists. If per-destination not-proxying is required, the proxy can connect to a server, determine that the server is on a non-proxy list, and then complete the handshake with the client (with a caveat regarding ECH here). I can guess why this doesn't happen (it's expensive and see also Section 5.4), but that doesn't excuse the practice. The following text from Section 5.3 is deeply problematic: A decryption policy decision MAY be made based on the server certificate or other trustworthy parameters. To verify possession of private keys that are associated with a particular server certificate, the proxy SHOULD complete an out-of-band TLS handshake with the same TLS server IP address and TCP port as targeted by the TLS client. It is possible that the authors misunderstand how TLS works, but this check won't work. Not only because TLS 1.3 encrypts information, but because this is only necessary if the proxy forwards a ClientHello from the client to the server. At that point, it is too late and the damage has been done (see Andrei's review). Unless I misunderstood it, the document is suggesting the same as you listed. Basically, the proxy makes a separate connection to the server as a client (“out-of-band” wrt to the originating client-server connection), retrieves the server’s certificate from the proxy-server handshake, and determines whether the server is on a non-proxying list or not. If on the list, the proxy forwards the originating client CH as is to the server, and steps aways from the originating client-server handshake. The proxy MUST generate a fresh ClientHello when doing this (something Andrei and I previously mentioned). When the proxy makes its separate connection to the server, the server can behave differently when responding to the proxy compared to when it responds to the client, and could present itself to the proxy as something innocuous that should not be proxied. Assuming at this point that the proxy has held onto the client's ClientHello (waiting for the response from the server to the proxy's ClientHello), the proxy decides either to intercept this connection or allow the client's ClientHello to go through to the server. When the proxy allows the client's ClientHello to go through to the server (without interception), there's no guarantee that the server will respond to the client the same way it did to the proxy, or even that the identity the server presented to the proxy is the server's real identity. If the proxy copies extensions unknown to it from the client's ClientHello to its own, then it will not be able to parse the response from the server when the server acts on those unknown extensions. This caused a year of delay in finishing TLS 1.3, and is bad for everyone. A malicious client and cooperating server don't even need to use an extensibility point unknown to the proxy to evade a proxy selectively terminating connections based on the TLS handshake between the proxy and server. This sort of selective proxying is fundamentally broken and should not be recommended as a best practice. There are additional considerations in this approach (latency etc.). The document intentionally left out the details to implementations, but could also cover them if needed. There are a bunch of places where pure proxying - as described in the introduction - is not assumed. This leads to the same problems already cited. For instance, in Section 4.2: The proxy MAY remove cipher suites from a client-initiated Client Hello message, add new cipher suites, and re-order them in the proxy-initiated Client Hello message. Will clean up those texts based on this and other discussions. Best, -Eric _______________________________________________ OPSEC mailing list op...@ietf.org<mailto:op...@ietf.org> https://www.ietf.org/mailman/listinfo/opsec _______________________________________________ TLS mailing list TLS@ietf.org<mailto:TLS@ietf.org> https://www.ietf.org/mailman/listinfo/tls
_______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
