Subject: IPP> SEC - IPP and firewalls

From: Carl-Uno Manros <[email-masked]>
Date: Mon, 30 Jun 1997 10:57:01 PDT

While I was still in the Boston area last week I had the opportunity to
discuss IPP and firewalls with Philip Gladstone who works for Raptor, a
company that specializes in firewalls and other security products for major
corporations.  They are at: 

	http://www.raptor.com

Philip pointed out that firewalls mostly play the role of enforcing
corporate security policies even if the individual servers, in our case the
IPP server, is not configured correctly.  This means that the IPP Printer
can actually report back features in the response to an Get-Attributes
operation which works fine when you operate behind the firewall, but which
may not be allowed if you try to access it from a client outside the firewall.

The firewall would act as a proxy for all IPP Printers behind the firewall
and hence intercept all incoming HTTP Posts from the outside.  The firewall
software would probably need to be able to understand the semantics of the
IPP request and either generate IPP error responses as if it were an IPP
Printer, or alternatively just break off the connection, if the request is
in conflict with the security policy.  Otherwise the request would be
passed on to the IPP Printer.  Likewise, the IPP Printer responses would be
filtered by the firewall software, before it is passed back to the external
IPP Client.

The kind of restrictions that a firewall might impose include:

- Only requests from a set of known TCP/IP address ranges
- Only one copy of each document
- Only black & white printing
- Only documents up to a certain size
- No multiple document jobs
- No print-by-reference jobs

I expect that it is unlikely that the firewall software would be able to
check for features specified in the actual document content (e.g. as
specified in a Postscript statement).

We also discussed whether there were any security features in preparation
that would provide security for print-by-reference.  The answer is NO.

Finally, I asked about whether a separate port for IPP might be useful.
The answer to that is also NO.

Comments?

Carl-Uno

Carl-Uno Manros
Principal Engineer - Advanced Printing Standards - Xerox Corporation
701 S. Aviation Blvd., El Segundo, CA, M/S: ESAE-231
Phone +1-310-333 8273, Fax +1-310-333 5514
Email: [email-masked]

---

From: "Michael W. Bringmann" <[email-masked]>
Date: Mon, 30 Jun 1997 16:27:59 -0500

[snip]
> - Only one copy of each document

Why would a firewall restrict the number of copies of a document?
Would the firewall scan the data stream for the IPP 'copies' attribute
and abort the document if it were present?

> - Only black & white printing

Why and how would a firewall restrict an image to black & white?
This implies examination of the actual document content to me,
something which you later state is probably not going to occur.
Jobs might be limited to black & white due to document size
constraints, but not just because they are color.

> specified in a Postscript statement).

[snip]

Thanks.

----------------------------------------------------------------------
 Michael W. Bringmann                    EMail: [email-masked]
 Senior MTS                              Web:   http://www.qms.com
 Mail:  QMS Incorporated                 Phone: (334) 633-4300 x1765
        Mobile, AL, 36688, USA
----------------------------------------------------------------------

---

From: Philip Gladstone <[email-masked]>
Date: Mon, 30 Jun 1997 18:01:27 -0400

> and abort the document if it were present?

The general principal is that the firewall (or choke point) is the one
place where corporate policy can be enforced. If the scenario of
having a a printer which behaves like a fax machine (for receiving
inbound
messages), then it may be that the firewall would want to ensure that 
documents received from the outside are 'well behaved'. 

In the ideal world, this would merely be a configuration issue for the
print server, but we see (in the real world) that not every
implementation
is adequate. For example (in the browser area), corporate policy might
be that each user must be running a 'safe' version of a browser in order
to get external access. The firewall can enforce this by checking the
User-agent header field in each request to ensure that this rule is
being obeyed. [In the ideal world, the browsers would not be buggy!]

If you have a large number of individual destinations (or sources) then
it may be easier to apply control at the choke point, rather than hope
that all the end systems are configured correctly, and the appropriate
set of patches applied.

> > - Only black & white printing

I would like to be able to enforce any restrictions by performing
very simple manipulation of the data. Inserting/removing fields at
the front of the document is nice (read: easy).

Philip
-- 
Philip Gladstone                           +1 617 487 7700
Raptor Systems, Waltham, MA         http://www.raptor.com/