The Register ®

Biting the hand that feeds IT

The Register » Software » Developer »

Original URL: http://www.theregister.co.uk/2007/08/24/everything_over_http/

Governance in the Web 2.0 world

By Nick Kew
Published Friday 24th August 2007 09:54 GMT

There are some forces that just cannot be stopped. Block the path, and they'll just go round some other way. Fortunately, here in Devon, where Dartmoor has had no difficulty absorbing the recent rain, that's not a topical observation about the state of my living room. But it is certainly topical on the net.

The classic seven-layer network model has served us well, and continues to do so. Each network interface has an IP address and a lot of ports, some of them allocated by policy to specific network services, others unused. The purpose of having lots of different ports is that different services, having different architectures and semantics for different applications, can use different ports. That way they run independent of each other and without interference on the same network. Simple, secure, and elegant.

What may lie behind a port is another story altogether, and many network services involve components that are very far from secure. Some hark back to another age, when security was not a concern. Others were never written with internet exposure in mind. Or are just badly-written. Even those that are designed to be exposed to the full rigours of today's net require vigilance: your Apache server should be secure against known exploits, but applications you run on it may be much weaker.

Fortunately, nowadays we have firewalls. Packet-filtering firewalls, very simple to understand and deploy. You don't need to be a professional network administrator - just buy a modem/router and you have one that's almost certainly secured by default (all incoming connections are rejected). Thus, the unwashed masses get a measure of protection from their own ignorance. This is a good thing.

But like many good things, it has a downside. The firewall is so simple and useful that it gets into company policies. The systems manager is commonly devalued to a low-skill operator-grade role. A typical policy goes something like, "this is a webserver. We open ports 80 and 443, and firewall everything else". This is a good policy...up to a point. The point in question is where you have a need to run a service for which HTTP is not well-suited.

At this point, the firewall policy and the company's needs are in conflict. Do you (and perhaps your insurers and lawyers) trust your PFY-grade sysop to exercise discretion with your security? For what it's worth, you probably should. Opening a port on a firewall really is that simple (though it does raise a "slippery slope" argument). Or do you allocate a large budget to hire high-powered consultants to tell you what's OK (and p*** off your sysop)? Or do you look for a workaround?

Consider, for example, a thoroughly ordinary requirement - symmetric, stateful two-way communication over a persistent connection. It could be anything from simple chat to a fancy VPN. It can be done over HTTP. There are many ways to deal with state, at the cost of some complexity.

Server-driven communication goes back to Netscape's Server Push in 1995, and lives on in pseudo-protocols such as "Comet" (http://alex.dojotoolkit.org/?p=545) [what do you call something that looks like an embryonic protocol but lacks things like an RFC or other published spec?] today. But it's a complete mismatch with the HTTP Request-Response model, and implementing it on top of HTTP implies significant extra complexity over running a dedicated service on a different port.

A Comet application is a Heath-Robinson construction to drive a non-HTTP network application over HTTP [I expect an advocate for Comet could give us excellent reasons as to why that's a foul calumny]. In a sensible world it would run over its own port, independent of the HTTP server. But security policies stand in the way of that. So the world routes around the firewall using Comet instead. And in doing so introduces more complexity, more scope for bugs and security vulnerabilities.

This is a bad thing. And there's a whole culture of it: the demand is such that we're getting generic tools and a name. How long will it be before there are off-the-shelf applications that only support Comet, so that even a company with a pragmatic and informed firewall policy is driven to use it? Clientside support is assured too. From a browser point of view it's just another potentially-useful capability in an AJAX world.

So why should one choose Comet over not only a rational open-another-port strategy, but also over transparent tunneling with the HTTP CONNECT method? I don't know the answer, but CONNECT is widely feared because everyone understands that it breaches the firewall, and indeed shifts the responsibility from the firewall layer to the server. Perhaps people need something less transparent?

Arguably yet more bizarre are the clutch of XML-over-HTTP protocols in and around "web services". The complexity here lies in the XML layer of packaging rather than the HTTP layer as such, but the underlying reason looks much the same - no one wants to open their firewall to RPC, so they use XMLRPC instead (or, more usually, more complex, and highly-developed WS-protocols).

In the case of webservices, wrapping in XML and routing through HTTP does serve a useful purpose. In the case of RPC, it's a much higher and more complex risk than merely opening a port on the firewall, so the problem it deals with is not just one of policy. The webserver itself can become an application firewall (e.g. with mod_security), and can become part of the application (e.g. with mod_publisher). Or both. Additionally, it can be used to enforce things like access control policies and bandwidth management. In short, the application gets the benefit of Apache's modular framework. Or whatever benefits another server may offer.

Still, the bottom line is that when a traditional path gets closed, the world will route around it. On balance, it's hard to call this a good thing or a bad thing, it's just inevitable.

But there's a critically important caveat - don't fall into a false sense of security. Any vulnerabilities in your application won't go away just because it's tunneled over HTTP!

And if your local Cassandra says you should open a new port in the firewall rather than tunnel over HTTP, perhaps you really should listen. If you want, you can even keep Apache at the server end of your non-HTTP application, using a custom protocol module. ®

© Copyright 2008