Subject: RE: SOAP/XML Protocol and filtering, etc.

From: Bora Akyol <[email-masked]>
Date: Mon, 7 May 2001 17:46:38 -0700

Why would a firewall or a firewall admin trust the packet to indicate 
what it really is?

Bora

At 2:50 PM -0700 5/7/01, Henrik Frystyk Nielsen wrote:
>The meaning of SOAPAction is not to say that "this is a stockquote
>service" but to say that "I am sending you a SOAP message of a type that
>is part of a stock quote service".
>
>The difference is that one is a destination which is carried in HTTP by
>the request-URI but the other is a hint about what is in the message.
>This is why SOAPAction is a separate parameter.
>
>Henrik
>
>>>  On Sun, May 06, 2001 at 03:12:08PM -0400, Keith Moore wrote:
>>>  > and client APIs.  It also keeps HTTP servers from having to know
>>>  > specifically whether a particular URI corresponds with a SOAP
>>>  > request (in which case it might have to look at the SOAPAction
>>>  > header in order to know how to handle it) or not (in which case the
>
>>>  > SOAPAction header should be ignored).
>>>
>>>  Yep; seems to me that Content-Type ss more appropriate for dispatch,
>>>  if doing it in a header is desireable.
>  >
>  >ugh.  only if you must.  the URL is *far* better for this purpose.

---

From: "James Binder" <[email-masked]>
Date: Mon, 7 May 2001 18:00:44 -0700

Only if the application (e.g., protocol) is signed and cross-certified by a
trusted CA could I see this occurring.

/jsb

 -----Original Message-----
From: 	Bora Akyol [mailto:[email-masked]]
Sent:	Monday, May 07, 2001 5:47 PM
To:	Henrik Frystyk Nielsen
Cc:	[email-masked]
Subject:	RE: SOAP/XML Protocol and filtering, etc.

Bora

---

From: "Gary E. Miller" <[email-masked]>
Date: Mon, 7 May 2001 19:18:31 -0700 (PDT)

Yo James!

> trusted CA could I see this occurring.

Yeah, like a Microsoft certificate from Verisign.  NOT!

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 20340 Empire Ave, Suite E-3, Bend, OR 97701
	[email-masked]  Tel:+1(541)382-8588 Fax: +1(541)382-8676

---

From: "James Binder" <[email-masked]>
Date: Mon, 7 May 2001 19:48:12 -0700

Hey, could be a BEA, Computer Assoc., IBM; pick your poison!

/jsb

-----Original Message-----
From: Gary E. Miller [mailto:[email-masked]]
Sent: Monday, May 07, 2001 7:19 PM
To: James Binder
Cc: [email-masked]
Subject: RE: SOAP/XML Protocol and filtering, etc.

Yo James!

RGDS
GARY

---

From: [email-masked]
Date: Tue, 08 May 2001 00:48:57 -0400

On Mon, 07 May 2001 19:48:12 PDT, James Binder said:
>> Gary Miller said:

The crucial difference here is that I'm not aware of BEA, CA,
or IBM being quite so publicly caught telling Verisign "yes,
that's a valid key request" and then having to ship patches
to work around the problems with CRL's.

I'm surprised that nobody's mentioned the issues with trying
to have a firewall filter SOAPAction's if the connection is
via https:// rather than http://.... 

				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

---

From: Mike Fisk <[email-masked]>
Date: Tue, 8 May 2001 06:40:00 -0700 (PDT)

A content-filtering firewall depends on the ability to interpret traffic
the same way the receiver would.  If you assume a malicious insider that
will parse something differently then how it is labelled, then they can
always tunnel, encrypt, or obfuscate traffic into something that is
permitted (IP over HTTP, e-mail, covert channels, etc.).  

Note that if the header field is not used to dispatch on the recipient,
and is just a hint to the firewall, then it is trivial to subvert the
firewall and filtering based on that header field is a worthless.

For example, if you have a policy that blocks ActiveX and a firewall that
filters that MIME type, I can always mis-label my ActiveX as a GIF or text
and send it.  But then only a colluding recipient would execute it as
ActiveX.  However, if the receiver doesn't use the MIME type, but handles
the content based on something else like filename suffix, then filtering
on MIME types is pointless.

-- 
Mike Fisk, RADIANT Team, Network Engineering Group, Los Alamos National Lab
See http://home.lanl.gov/mfisk/ for contact information

---

From: "Gary E. Miller" <[email-masked]>
Date: Tue, 8 May 2001 13:29:09 -0700 (PDT)

Yo Mike!

> on MIME types is pointless.

Not true.  Many of the recent Windows exploits have depended on the fact
that M$ often executes a downloaded file depending on file magic instead
of the MIME type or file extention.  They fool the firewall and virus
scanner in to thinking a malicious file is one that in non-excutable, then
M$ goes and excutes it.

RGDS
GARY