Subject: [IPP] RFC: Recommend same port/origin policy for resources in IPP Everywhere v1.1

From: Michael Sweet <[email-masked]>
Date: Thu, 23 Aug 2018 09:45:56 -0400

All,

I've had some recent discussions internally at Apple concerning some network management issues with IPP printers that serve their resource files over a different port (typically port 80) than their IPP endpoint.  Basically, it is "easy" to whitelist communications over port 631 (or 443, as is still often the case) for IPP but less desirable to whitelist port 80 which is also used for web content.

Effectively this means that we'd like to see printers advertise their printer-icc-profiles, printer-icons, printer-more-info, printer-strings-uri, and printer-supply-info-uri URLs with the same host and port as in printer-uri-supported and printer-xri-supported, which is supposed to match the HTTP Host header.  We can't make this a requirement in IPP Everywhere v1.1, but I'd like to add it as an explicit recommendation (Printers SHOULD ...) in sections 5.3 and 5.4, and note that the port number should also be included in section 5.1.1 which talks about using the HTTP Host header value.

I also notice that printer-more-info should be listed as a Printer Status attribute and we need to add the missing printer-strings-uri and printer-strings-languages-supported attributes as RECOMMENDED...

Thoughts?

_________________________________________________________
Michael Sweet, Senior Printing System Engineer

_______________________________________________
ipp mailing list
[email-masked]
https://www.pwg.org/mailman/listinfo/ipp

---

From: Ira McDonald <[email-masked]>
Date: Thu, 23 Aug 2018 09:51:34 -0400

Hi Mike,

Yes, I agree with this basic security improvement as a RECOMMENDATION.

Cheers,
- Ira
Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Jan-April: 579 Park Place  Saline, MI  48176  734-944-0094
May-Dec: PO Box 221  Grand Marais, MI 49839  906-494-2434

On Thu, Aug 23, 2018 at 9:46 AM Michael Sweet <[email-masked]> wrote:

> All,
>
> I've had some recent discussions internally at Apple concerning some
> network management issues with IPP printers that serve their resource files
> over a different port (typically port 80) than their IPP endpoint.
> Basically, it is "easy" to whitelist communications over port 631 (or 443,
> as is still often the case) for IPP but less desirable to whitelist port 80
> which is also used for web content.
>
> Effectively this means that we'd like to see printers advertise their
> printer-icc-profiles, printer-icons, printer-more-info,
> printer-strings-uri, and printer-supply-info-uri URLs with the same host
> and port as in printer-uri-supported and printer-xri-supported, which is
> supposed to match the HTTP Host header.  We can't make this a requirement
> in IPP Everywhere v1.1, but I'd like to add it as an explicit
> recommendation (Printers SHOULD ...) in sections 5.3 and 5.4, and note that
> the port number should also be included in section 5.1.1 which talks about
> using the HTTP Host header value.
>
> I also notice that printer-more-info should be listed as a Printer Status
> attribute and we need to add the missing printer-strings-uri and
> printer-strings-languages-supported attributes as RECOMMENDED...
>
> Thoughts?
>

---

From: Uli Wehner <[email-masked]>
Date: Thu, 23 Aug 2018 13:57:44 +0000

Mike,

This sounds reasonable. 

One note: many customers use IPP/SSL for print data encryption, which uses the same certificate as Port 443. From a security perspective this is advantageous I think. Port 80 is often turned off, which has been an issue for airprint.

regards

Uli Wehner
[email-masked]

-----Original Message-----
From: ipp <[email-masked]> On Behalf Of Michael Sweet
Sent: Thursday, August 23, 2018 9:46 AM
To: PWG Workgroup <[email-masked]>
Subject: [IPP] RFC: Recommend same port/origin policy for resources in IPP Everywhere v1.1[EXTERNAL]

All,

Thoughts?

_______________________________________________
ipp mailing list
[email-masked]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.pwg.org_mailman_listinfo_ipp&d=DwICAg&c=5hYF0Zu0Yz-C6S-kaHDItw&r=Kf2OsKTEH35gSgu0U6HqdHzbU1TrLWRQF9AyGiFJjds&m=5x9aipJWUe-lzWygkP2sKd1ZLZ3v7qj8MfDzGBXKQlc&s=ESHJXS3aCxT2O5PBS8jZzCvb-poiHzyZyGxQ_91koKo&e=
_______________________________________________
ipp mailing list
[email-masked]
https://www.pwg.org/mailman/listinfo/ipp

---

From: "Kennedy, Smith (Wireless & Standards Architect)" <[email-masked]>
Date: Thu, 23 Aug 2018 14:07:20 +0000

Hi Mike,

IPP Implementor's Guide v2 section 7.2 makes this recommendation already, and I'm wholly supportive of adding this (and possibly other recommendations) to IPP Everywhere™ 1.1.

Smith

/**
    Smith Kennedy
    Wireless & Standards Architect - IPG-PPS
    Standards - IEEE ISTO PWG / Bluetooth SIG / Wi-Fi Alliance / NFC Forum / USB-IF
    Chair, IEEE ISTO Printer Working Group
    HP Inc.
*/

> On Aug 23, 2018, at 7:45 AM, Michael Sweet <[email-masked]> wrote:
> 
> All,
> 
> https://www.pwg.org/mailman/listinfo/ipp <https://protect-us.mimecast.com/s/yrXnCwp5B5IG65VvHqvuV1?domain=pwg.org>