Subject: IPP> RE: MOD - What is a Firewall?

From: Carl-Uno Manros <[email-masked]>
Date: Tue, 9 Jun 1998 09:51:45 PDT

At 09:38 PM 6/5/98 PDT, Josh Cohen wrote:
>
>
>> -----Original Message-----
>> From: Carl-Uno Manros [mailto:[email-masked]]
>> Sent: Friday, June 05, 1998 11:51 AM
>> To: [email-masked]
>> Subject: MOD - What is a Firewall?
>> 
>> 
>> 1) Host address    TCP/IP address
>> 2) Port number     Default 80 for HTTP
>> 3) Protocol        "http" for HTTP
>> 4) Method          POST etc. for HTTP
>> 5) Content         HTML etc.
>> 
>Lets add a level, so its:
>
> 1) Host address    TCP/IP address
> 2) Port number     Default 80 for HTTP
> 3) Protocol        "http" for HTTP
> 4) Method          POST etc. for HTTP
> 5) Content-type       text/HTML etc.
> 6) content body filtering (Firewall/proxy attempts to parse the IPP body)
>
>I wasnt sure if you meant for 5 to be my 5 or 6.
>Its much easier to filter by the http header content-type: than
>to parse the body and try to filter that way, although both can
>technically be done.
>
>Some proxies can filter the body content, it can, for example,
>strip unwanted HTML tags like embedded scripts or Java references.
>Though it is possible in these products, the task of parsing
>the bodies is such a performance hit, virtually no one uses it
>and proxy implementors tend to stick to the guideline that proxies
>do not parse the entity-body in HTTP.
>(At least the implementors I worked with)
>

What I intended at 5), was that the first few bytes of the content 
is read, which in most cases is enough to determine the kind of
content that follows. It would be a really bad idea to try to read the
WHOLE content.

Carl-Uno
Carl-Uno Manros
Principal Engineer - Advanced Printing Standards - Xerox Corporation
701 S. Aviation Blvd., El Segundo, CA, M/S: ESAE-231
Phone +1-310-333 8273, Fax +1-310-333 5514
Email: [email-masked]

---

From: Josh Cohen <[email-masked]>
Date: Tue, 9 Jun 1998 12:07:19 -0700

> content that follows. It would be a really bad idea to try to read the
I agree, reading the whole content is 'bad', but
it is being done today.  (tag filtering)
So, I think its important to distinguish filtering
by content-type (the header) and entity body
based filtering (like tag filtering).

Content-type filtering doesnt necessarily imply
parsing the body, but could include the sniffing
of the first few bytes.  Sounds like the way unix
does things with /etc/magic.

The final part, tag filtering, is when the proxy
parses and presumably understands the content type.
So, a proxy might see text/html, then invoke
an html parser to complete the filtering.
This very expensive and likely to be resisted
by admins, however it is being used today in certain
cases where it is justified.