TOC 
D. New
 Invisible Worlds, Inc.
 March 18, 2001

TUNNEL: An Application Proxy Profile
 TOC 

Table of Contents
 TOC 

1. Helpful Reading

TUNNEL Profile

BEEP I-Ds:


 TOC 

2. The Problem

Security clashes with convenience.

Firewalls block all access, but

We want to be able to authorize some access.

How do we distinguish?


 TOC 

3. One Solution: Application Proxy

Runs on firewall machine.

Accepts connections,

   authorizes request,

      establishes requested connection,

         forwards data across firewall.

Makes a stile, not a hole.


 TOC 

4. BEEP Environment

Encryption, Authentication, Applications are orthogonal.

Proxy application reuses standard mechanisms.

(Hence, proxy spec only discusses proxying.)


 TOC 

5. TUNNEL Profile

Defines three basic operations:


 TOC 

6. Connections

Two ways to address next hop.


 TOC 

7. Start an Operation

Originator may or may not require BEEP on final connection.

Empty <tunnel/> element says to require TUNNEL at endpoint.

No empty <tunnel/> element says no BEEP required.

Nested non-empty <tunnel> says more hops to go.


 TOC 

8. Pass Data

Intermediate proxies pass data transparently

  starting immediately after <ok/> element.

Allows TLS to be end-to-end.


 TOC 

9. Example

  <tunnel fqdn="proxy2.example.com"
          port="12345"
    <tunnel 
      endpoint="idxp:AcctDeptMgr"/>
  </tunnel>

 TOC 

10. Example


i       p1     p2    mgr
 -xport->
 <greet>
 -TUNNEL->
        -xport->
        <greet>
        -TUNNEL->
               -xport->
               <greet>
               -TUNNEL->
             <---ok----
    <---ok----
<---ok----
<------- greeting ----->

 TOC 

11. Configuration Options

Require Authentication:

Disallow some routes or routing modes

    (Hide FQDN/IP from sniffers)

Require end-to-end TLS

    (Hide data from proxies)