Subject: [secdir] SECDIR review: draft-ietf-ipfix-mib-08

From: Love Hörnquist Åstrand <[email-masked]>
Date: Tue, 01 Dec 2009 23:06:54 -0800

Hello all,

I have reviewed this document as part of the security directorate's  ongoing effort to review all IETF documents being processed by the  IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

ipfixSelectionProcessTable is left undefined, so it could possibly contain parameters that should not be exposed.

Other then that I didn't find any problems.

Love

---

From: "Thomas Dietz" <[email-masked]>
Date: Wed, 2 Dec 2009 16:30:47 +0100

Dear Love,

thank you for your review of our draft. Unfortunately I do not get your
point. The ipfixSelectionProcessTable is well defined in the IPFIX MIB. We
don't see any security implications in exposing the objects defined within
this table. They should not contain any sensitive data. Thus, we did not
explicitly mention this table in the security consideration section. Could
you please explain your concern in greater detail?

Best Regards,

Thomas

-- 
Thomas Dietz                 E-mail: [email-masked]
NEC Europe Ltd.              Phone:  +49 6221 4342-128
NEC Laboratories Europe      Fax:    +49 6221 4342-155
Network Research Division
Kurfuersten-Anlage 36
69115 Heidelberg, Germany    http://www.nw.neclab.eu

NEC Europe Limited           Registered in England 2832014
Registered Office: NEC House, 1 Victoria Road, London W3 6BL

> -----Original Message-----
> From: Love Hörnquist Åstrand [mailto:[email-masked]]
> Sent: Mittwoch, 2. Dezember 2009 08:07
> To: [email-masked]; [email-masked]; [email-masked]; Thomas
> Dietz
> Cc: IESG -; Security-Directorat Directorat; [email-masked]
> Subject: SECDIR review: draft-ietf-ipfix-mib-08
> 
> Hello all,
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> ipfixSelectionProcessTable is left undefined, so it could possibly
> contain parameters that should not be exposed.
>

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Wed, 02 Dec 2009 16:51:13 +0100

Thomas,

Sorry, I think I really was after ipfixSelectorFunctions

           Since IPFIX does not define any Selector Function (except
           selecting every packet) this is a placeholder for future
           use and a guideline for implementing enterprise specific
           Selector Function objects.

but lost myself in the indirection between ipfixSelectionProcessTable and ipfixSelectionFunctions.

Since ipfixSelectionFunctions is part of security consideration I was just confused and you can disregard my mail.

Love