[Masque] Erik Kline's No Objection on draft-ietf-masque-connect-udp-14: (with COMMENT)

[Erik Kline via Datatracker <[e-mail]>]

Erik Kline has entered the following ballot position for
draft-ietf-masque-connect-udp-14: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-masque-connect-udp/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

# Internet AD comments for {draft-ietf-masque-connect-udp-14}
CC @ekline

## Comments

### S3.5

* Should the 2xx discussion here include additional reference to the extended
  commentary in masque-h3-datagram#section-3.2?

### S7

* I *really* wish there could be more said about tunnel security.  I was
  tempted to try to formulate some DISCUSS on the matter, but I cannot
  seem to see where any more extensive text was ever written for the CONNECT
  method.

  Nevertheless, there are plenty of concerns that could be mentioned, like
  what should a proxy do if the target_host is one if its own IP addresses,
  or a link-local address, and so on.

  I'm not entirely convinced that it suffices to claim that because the
  tunnel is not an IP-in-IP tunnel certain considerations don't apply.
  Anything and everything can be tunneled over UDP, especially if RFC 8086
  GRE-in-UDP is what the payloads carry (or ESP, of course).  It seems like
  most of the points raised in RFC 6169 apply; perhaps worth a mention.

  But as I said, I think all these concerns apply equally to CONNECT (in
  principle, anyway), and the text here is commensurate with the text for
  its TCP cousin (that I could find, anyway).