Subject: Re: [SIP] CPL

From: Sean Olson <[email-masked]>
Date: Thu, 1 Jun 2000 10:10:58 -0500 (CDT)

> 
> Sean Olson writes:
>  > CPL is best thought of as a wire representation of service logic. It is probable
>  > that most servers will "compile" CPL into a more appropriate internal format for
>  > executing and storing. So to answer your question, I expect that there will be
>  > demand for service creation environments that you can use to build services 
>  > (even dynamically) and one possible output format will be CPL. For example, it
>  > would be trivial to use CGI/ASP to dynamically generate CPL in response to an
>  > HTTP request to retrieve the service logic for a particular user. The utility of
>  > doing so is another question altogether ;)
> 
>    I'm going to show my complete ignorance here,
>    but doesn't this beg the "sandbox" question?
> 
>    Related: how is authorization accomplished?
> 
> 	    Mike
> 

If you really want to take a dive here, I would argue that you re-use everything
that HTTP/HTTPS provides in terms of security and authorization. Of course you
can always sign the CPL script as you would any other XML document for another
layer of security. 

Regarding the sandbox issue, yes, CPL was designed to avoid this by providing a
limited set of capabilities and a simple DAG, etc. etc. You don't lose this by
what I'm suggesting as long as you continue to use CPL as your on the wire format.
(the sandbox on the CPL service execution platform is preserved even if the
 CGI/ASP server is prone to infinite loops or whatever.) Personally, I see the
value in providing a sandbox, but I don't think CPL is the only way to do this.

sean

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Michael Thomas <[email-masked]>
Date: Thu, 1 Jun 2000 12:41:18 -0700 (PDT)

> can always sign the CPL script as you would any other XML document for another

   What I had in mind here is how would a proxy
   know what kinds of actions a given user with
   a given CPL script is allowed to do? It could
   be as simple as a binary decision of if you
   allow CPL at all, you allow any arbitrary 
   script to be executed. 

   My suspicion is that the binary decision is
   too course though, which make the problem
   more difficult.

		Mike

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 02 Jun 2000 01:09:58 -0400

>    allow CPL at all, you allow any arbitrary

The point of CPL is that it can't do too much to begin with. Its a
scripting language - there are no variables, no looping constructs,
nothing. There are six or so basic primitives defined - decision making
primitives that check the caller, callee, time of day, or priority, and
action primitives that can forward, reject, redirect. Thats mostly it.
As a result, CPL is safe to execute, since it simply can't do any damage
to a server. Thus, I believe the binary decision about authorization is
perfectly legitimate. 

That said, you *could* specify that a proxy should not accept CPLs from
user Joe that use the time-of-day switch statement, but why?

For more info on CPL, check out the framework document which just issued
today as RFC2824. It compares CPL to other programming interfaces in
which the program executes in a sandbox, such as servlets.

-Jonathan R.
-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com

---

From: Jonathan Lennox <[email-masked]>
Date: Fri, 2 Jun 2000 11:21:21 -0400 (EDT)

> user Joe that use the time-of-day switch statement, but why?

It *is* possible that a CPL server could not support or be willing to
support certain services for a partiuclar user.  I think the most sensible
example of this would be a server which will only redirect, not proxy
(either in general or for a particular user).  Another example would be a
server which can't or won't proxy to certain URI schemes -- h323 (once
that's defined), tel, etc.

A CPL server needs to validate a script when it is inserted into the server
-- for XML well-formedness, absence of dangling sub references, non-looping
status, etc.  It can (and should) check the script at the same time to make
sure all the actions it specifies are allowed for the associated user, and
reject it if it isn't.  (This rejection mechanism depends on the submission
mechanism; in draft-lennox-sip-reg it would be a 4xx response, for example.)

That said, how the server *knows* which actions are legal for each user is
entirely a local configuration/policy issue for the CPL server.  Yes, the
administrator needs some way of specifying it, but this isn't any different
from all the other policy issues the server administrator needs to be able
to control.

-- 
Jonathan Lennox
[email-masked]