Subject: [QUIC] QUIC and firewalls

From: Yoav Nir <[email-masked]>
Date: Tue, 15 Nov 2016 11:50:57 +0900

Hi.

Since this came up in the discussion at the WG session, I wanted to clarify some things

Firewalls are mostly reactive. They are built to handle the traffic that exists on the Internet. So a typical firewall today will not have a classifier function for QUIC. That does not mean that firewalls can not allow QUIC. You can always make a rule like this (and apologies in advance for using my employer’s proprietary terminology):
   Src: Any; Dst: Google; Protocol:UDP-with-dest-port-443; Action: Allow

This is fine, but there are two drawbacks as far as firewall users are concerned. First, is that it requires them to specify the port and IP protocol manually, and second, that this opens a hole through which an endpoint can send anything to a Google server as long as it’s on UDP port 443. In this case the firewall doesn’t make any validation of the content of this traffic to make sure that it is really “QUIC”.

Depending on how the firewall rule is written, the firewall may drop all packets from Google servers with source port 443 because they are out of state until state is successfully created by a packet with a destination port of 443 and a destination IP that is identified as “Google”. This state can be thought of as a quintuple (source, source port; dest, dest port, ipp),

What firewall vendors would like to do is to allow users to configure a rule like this:
   Src: Any; Dst: Google; Protocol:QUIC; action:Allow

Having this label could mean as little as just a macro for UDP-with-dest-port-443, but we’d like better to have more validation. As long as we don’t have protocol-specific parsers for QUIC, we have to maintain state according to BEHAVE recommendations. and that means keeping the state alive for many minutes after traffic has stopped. With a parser we have a better idea of when a “connection” started, when it ends, and how long we have to wait before timing it out.

So firewall vendors will read the specs and implement a parser, but only if we have a good reason to believe that this is something that is going to appear on the Internet. 

Hope this helps,

Yoav
(with firewall vendor hat on)