Re: [secdir] SecDir review of draft-ietf-ipfix-mib-variable-export.

[Benoit Claise <[e-mail]>]

On 11/18/2015 11:13 AM, Juergen Schoenwaelder wrote:
> On Sat, Nov 14, 2015 at 02:17:20AM +0900, Warren Kumari wrote:
>> Be ye not afraid...
>> I have reviewed this document as part of the security directorate's
>> ongoing effort to review all IETF documents being processed by the
>> IESG.  These comments were written primarily for the benefit of the
>> security area directors.  Document editors and WG chairs should treat
>> these comments just like any other last call comments.
>>
>> Version reviewed: draft-ietf-ipfix-mib-variable-export-09 - Exporting
>> MIB Variables using the IPFIX Protocol
>>
>> Summary:
>> LGTM, Security AD attention not required, modulo questions below.
>>
>> I'm not quite sure what:
>> "However if the exporter is a client of an SNMP engine on the same
>>   device it MUST abide by existing SNMP security rules." is supposed to
>> mean. What exactly are "existing SNMP security rules"? Those defined
>> in RFCs? Configured on the device?
> I agree that this statement is a bit confusing. In the SNMP world, a
> client must authenticate against the agent and then the agent uses the
> clients authenticated identity to apply access control rules. This text
> talks about a client of an "SNMP engine", which is a bit confusing.
>
> Perhaps the sentence was meant to say this:
>
>       However, if the exporter is implemented as an SNMP manager
>       accessing an SNMP agent, it MUST authenticate itself to the SNMP
>       agent and the SNMP agent MUST enforce SNMP access control rules
>       as it would for any other SNMP manager.
Yes, that was the meaning.
For example, we can't export via IPFIX a MIB object for which we're not 
granted access, completely bypassing the SNMP access control rules

Regards, Benoit (as a document author)
>
> /js
>