Subject: Proxy User Stories

From: Mark Nottingham <[email-masked]>
Date: Thu, 5 Dec 2013 13:02:55 +1100

Just to see if it might be helpful, I've started collecting rough user stories for HTTP proxies here:
   https://github.com/http2/http2-spec/wiki/Proxy-User-Stories

Feel free to add to them, elaborate, etc.

Cheers,

--
Mark Nottingham   http://www.mnot.net/

---

From: William Chan (陈智昌) <[email-masked]>
Date: Wed, 4 Dec 2013 19:01:51 -0800

Awesome list, thanks for putting this together.

---

From: "Martin J. Dürst" <[email-masked]>
Date: Mon, 09 Dec 2013 15:43:25 +0900

> Feel free to add to them, elaborate, etc.

In general, this looks very good!

But please remove (or reword) the parenthetical in
"Henrietta runs an educational institution inside a house of 
incarceration (since they share so many attributes)."

While some may not have the best memories of school, I don't think it's 
appropriate to compare prisons and schools in this way.

What about some text along these lines:

(The example uses both education and incarceration because both kinds of 
institutions may have somewhat similar requirements on proxies, for 
different reasons.)

Regards,   Martin.

---

From: Benjamin Carlyle <[email-masked]>
Date: Mon, 9 Dec 2013 17:53:00 +1000

Sally's SCADA system
Sally remotely operates equipment as part of a national infrastructure
project. Her network is isolated from the internet. It uses dedicated fibre
cores where possible with VPN where fibre is not available. The VPN links
pass through national carriers in remote locations and have high and
variable latency and relatively low bandwidth. Sally deploys caching
proxies at the ends of VPN links to avoid duplicate data transfer and
improve system availability and responsiveness when these links are playing
up. The system is expected to work for 15 to 20 years and will be
maintained by different organisations over this period. Long term
interoperability concerns dominate engineering decision making processes.
Sally doesn't want to add a failure mode to the system where certificates
expire and bring down the system.

---

From: Amos Jeffries <[email-masked]>
Date: Mon, 09 Dec 2013 22:18:46 +1300

LadleNet

LadleNet is a DIY project started by some engineering students which has
grown to span a large metropolitan area. True to its DIY roots the
network is still comprised of a large ad-hoc collection of commercial
devices mixed with home made networking kit or all kinds. Connectivity
within the network is primarily wireless or wired but also includes
other experimental Thing-Thing connectivity relay points added randomly
by users. Underlying link protocols vary widely but are mapped to either
TCP or UDP packets my model software depending on the bandwidth reliability.

HTTP traffic over this unruly collection is governed by a combined
captive-portal and explicit proxy system CookieJar. It is multi-homed in
the truest sense of the word with each users ISP connection providing a
portal to the rest of the Internet with varying amount of available
bandwidth and speed. A custom Ant routing algorithm uses these metrics
along with blacklist rules and PAYG credits exchanged with all
neighbourhood nodes for generating route rules.

Each local household uses explicit proxy configuration on their
end-devices to connect to their node, and other nodes use ad-hoc
discovery via the Ant protocol to connect as well. For security messages
classified as private travelling over LadleNet are always encrypted
individually. But sufficient information to identify final routing
destination and categorize the traffic is always left exposed publicly.
Other messages are always unencrypted. Nodes include AV scanner and
policing software checking classifications randomly.

Amos

---

From: Martin Thomson <[email-masked]>
Date: Mon, 9 Dec 2013 08:43:18 -0800

> LadleNet

I'm not sure what to make of this one.  It sounds a lot like the Internet.

mnot wrote:
> Not every problem needs to be hit with an HTTP-shaped hammer.

---

From: James M Snell <[email-masked]>
Date: Mon, 9 Dec 2013 09:20:42 -0800

On Mon, Dec 9, 2013 at 8:43 AM, Martin Thomson <[email-masked]> wrote:
[snip]
>> Not every problem needs to be hit with an HTTP-shaped hammer.

http://www.youtube.com/watch?v=znGBU5oODz8

---

From: Amos Jeffries <[email-masked]>
Date: Tue, 10 Dec 2013 10:31:14 +1300

On 2013-12-10 05:43, Martin Thomson wrote:
> On 9 December 2013 01:18, Amos Jeffries wrote:
>> LadleNet
> 

Does doesn't it? if the protocol can't support *that*, well ... But no 
its not. Just the microcosm of the whole in one of many Ad-Hoc mobile 
environments.

The key parts for HTTP to operate over this environment are:

* message transparency to the node proxy classification filtering 
regardless of encryption or other security overlays on the application 
payload.

* HTTPS encryption is not an option both because it breaks the node 
classification and prevents fast per-message re-routing when 
edge/gateway nodes disappear or move.

* "Just use HTTP/1" is the worst of undesirables. Limited/slow bandwidth 
and CPU already pressures heavy erasure of HTTP/1 meta data and content 
compression at the edges.

>> Not every problem needs to be hit with an HTTP-shaped hammer.

Maybe not. But HTTP is used to traverse this one and for certain types 
of inter-node exchanges there are limitations to be met.

Amos

---

From: Martin Thomson <[email-masked]>
Date: Mon, 9 Dec 2013 13:40:41 -0800

On 9 December 2013 13:31, Amos Jeffries <[email-masked]> wrote:
> * "Just use HTTP/1" is the worst of undesirables. Limited/slow bandwidth and
> CPU already pressures heavy erasure of HTTP/1 meta data and content

My answer was going to be "just use IP".

The reason I noted this was it wasn't clear (to me at least) why
routers need access to application-layer data.  Can you expand a
little more on this?

---

From: Amos Jeffries <[email-masked]>
Date: Tue, 10 Dec 2013 11:09:21 +1300

On 2013-12-10 10:40, Martin Thomson wrote:
> On 9 December 2013 13:31, Amos Jeffries wrote:

The node/gateway access to Internet depends on more than simply the IP 
level route being up/down. Those darn per-user rules get in the way. 
Relaying on messages to the nearest alternative gateway if their 
Internet access is down or not permitted is necessary based on 
application-layer classification.

Also (at present) the gateway emitting the message to Internet needs to 
be able to reconstruct enough elided HTTP headers for Internet systems 
to accept it (adding faked User-Agent, conversion from Secure-HTTP to 
HTTPS etc). I am hoping HTTP/2 can remove the need to erase those in the 
first place but one never knows.

HTTP is one of the relative few protocols which provide a triple 
benefits of; TCP reliability, proxies to re-route stateless messages, 
and wide compatibility with the Internet as a whole. IP is already used 
as the underlying L2 transport and UDP as much as possible where 
reliability and timeliness have low importance.

Amos

---

From: Martin Thomson <[email-masked]>
Date: Mon, 9 Dec 2013 14:20:21 -0800

On 9 December 2013 14:09, Amos Jeffries <[email-masked]> wrote:
> HTTP is one of the relative few protocols which provide a triple benefits
> of; TCP reliability, proxies to re-route stateless messages, and wide
> compatibility with the Internet as a whole.

I'm not sure where reliability comes in with the architecture you
describe.  You might have reliability on a per-hop basis, but that's
not reliability in any useful sense.  Is there some overarching
reliability protocol in place?

The rest all seems fairly standard for IP.  Even the per-user flow
classification stuff.

---

From: "Nicolas Mailhot" <[email-masked]>
Date: Wed, 11 Dec 2013 11:45:56 +0100

Some other stories

Ann runs bigcorp proxy. The proxy agregates internet traffic of all
bigcorp users, with an anonymizing effect (third parties can only track
traffic to the outbound proxy ips). That suits Ann fine as what her users
do is none of the business of third parties. However bigcorp gives lots of
freedom to its users on how they use the company Internet access, as long
as it does not impact company performance. But it does not wish to be
liable for the offences its employees may commit as part of their
non-professional browsing. Therefore bigcorp requires them to sign an
ethical chart, but realises this alone has no strong deterrent effect. As
a consequence Ann requires user auth on the proxy, logs all outbound
traffic, and the chart warns users that judges can subpoena their traffic
in case of problems.

Bill runs company proxy. Company worries about employees that use modern
communication tools to run a second activity during work time. Therefore
Bill requires user auth on the proxy, logs all outbound traffic, and
internal regulation warn users their managers can request their outbound
logs (subject to internal checks to avoid abuses).

Celia runs corp proxy. Corp knows that part of its users are completely
overwhelmed by modern tools and do not realise the implications of some
web services that lie or hide relevant information to their users to avoid
worrying them about "complex security decisions". Therefore Celia has to
log all outbound traffic and require proxy auth, so in case of data breach
on one web sites other users of this web site can be identified to check
if they also contributed to leaks.

Dan runs corp proxy. He's asked to provide a high availability service
since more and more of corp business relies on always on web access.
Therefore he maintains several proxy farms on different physical sites,
and needs his user browsers to switch between those sites in case of
incident. Proxies use auth and can not share auth accross sites for
reliability reasons, so the browsers needs to change network paths without
hammering users with auth requests.

Emma runs corp proxy. For various business reasons proxy requires user
auth. Infinite auth has no security value so Emma's proxy need to notify
web clients to re-auth after a while, including when they're started a tls
sessions.

Fred runs corp proxy. He's asked to provide a high availability service
since more and more of corp business relies on always on web access.
However no capacity planning can cope with the potential volumes of
non-professionnal vidéo browsing. Therefore Fred needs his proxy to
identify all audio/vidéo traffic, TLS or not, and block all the accesses
users have not explicitly declared as necessary for business reasons.

Geraldine runs corp proxy. Her job is to make browsing as fast and safe as
possible. However various third-parties have started tunnelling non-http
traffic over http(s) ports to avoid the security reviews opening a new
port to the outside entails. Geraldine has no love for those "solutions",
she is not authorised to carry non-http traffic, non-http traffic does not
cache, does not match the network profiles she planned for, and is a
security risk. Therefore she wants her proxy to do enough protocol
decoding (including over TLS) to reject those accesses and force the
entities that deploy them to go through the normal security review
process. She knows that quite often her users do not realise the
"convenient browser plugin needed to access our web site" they've
installed will tunnel other protocols, and that they've been lied to by
their partners to avoid worrying them about "complex security decisions".

Hommer runs corp proxy. The load on his equipments went over the roof this
year, his users grumble his proxy sucks, and his budget is running dry. To
understand why he enabled traffic logging and realised none of the new
load was relevant to his company activities, or even to his user's wishes.
A few popular non-professionnal web sites just enabled aggressive ad
cycling and web bugs/monitoring via js tricks to earn a few pennies.
Hommer needs his equipments to be able to identify all the urls accessed
by his users and blackhole ad agencies, returning to normal network load.

Irene runs company proxy. The times are hard and company wishes to limit
the costs of the internet connexion. Therefore it asks its employees to
limit their browsing to reasonable volumes and deployed a web app that
shows them how much they consumed every day. To make this webapp work
Irene needs to authentify accesses and log the corresponding volumes in
her proxy.

Jeremy runs company proxy. Cleaning up malware infections cost a lot to
his company last year, so he's asked to run antivirus checks on all
executable files that go through his gateway. Therefore his proxy needs to
decode in clear all the files with an executable mime type downloaded by
company users. Jeremy needs his browsers to display a message in case of
malware interception so they do not retry the same infected file once its
blocked.

And I'm running out of time so I won't finish the alphabet (but I think I
could)

-- 
Nicolas Mailhot

---

From: "Nicolas Mailhot" <[email-masked]>
Date: Thu, 12 Dec 2013 14:16:37 +0100

A few more :

Khaled runs the gateway protecting the browsing of various VIPs. Those
VIPs have access to various top secret information, but are too important
to go through computer security refreshing courses. The gateway must
protect their systems from malware and other attacks. To make the malware
work more difficult it requires human authentication of web accesses, but
VIPs do not like the hassle of using different passwords and Khaled knows
most of them will reuse internal passwords on the gateway. To limit the
risks of APT Khaled needs the web client to clearly identify the gateway
auth prompt so an attacker can not spoof it. Likewise, web-client to
gateway auth must be encrypted to avoid credential capture by agencies
managing temporary physical access to internal networks.

Lydia handles vast sums of money at work (trader, tax official handling
huge corporations/very rich persons, etc). After several high profile
cases of insider trading/corruption where citizens where asked to foot the
bill enraged deputies voted laws that required monitoring of work
communications of people like Lydia to limit the risks of new occurrences.
Some of the persons Lydia needs to communicate with at work use Google
services. Lydia likes her well-paid job and needs a way to configure her
web clients to expose all her Google traffic to the monitoring system,
without MITM Google CAs leaking to the general public. Since she does not
want to be held responsible for the mistakes of her co-workers she wants
this traffic to be clearly authenticated.

-- 
Nicolas Mailhot