Re: [nfsv4] Erik Kline's No Objection on draft-ietf-nfsv4-rpc-tls-08: (with COMMENT)

[Erik Kline <[e-mail]>]

> > * What mechanism guarantees that (D)TLS traffic can always and easily be
> >  distinguished from RPC traffic on the same port?
>
> The document does not specify any mechanism for making that distinction
> for UDP. The server would have to match ingress datagrams that appear to
> be DTLS traffic to existing DTLS session state. The server treats datagrams
> that fail to match as RPC messages.
>
> For TCP, once a TLS session is established on a connection, the client is
> forbidden from mixing TLS traffic with unprotected traffic on that
> connection. To send unprotected traffic after establishing a session, a
> client would have to establish a separate TCP connection that does not
> have a TLS session.

This might be something worth a few sentences.

> > [[ nits ]]
> >
> > [ section 5.1.1 ]
> >
> > * "When operation is complete" ... In addition to a grammar tweak, you
> >  might repeat a few choice words from section 7.2 about the ability to
> >  send multiple requests over a connection.
>
> I don't understand this comment. Section 7.2 is about user privilege
> separation. What did you have in mind?

I was just thinking that it would be useful to add a sentence to
dispel any ideas that it's a "one TLS connection, one request" system.
7.2 explicitly talks about sending multiple requests per session:

"""
   Moreover, client implementations are free to transmit RPC requests
   for more than one RPC user using the same TLS session.
"""