Re: [secdir] secdir review of draft-ietf-mif-mpvd-arch

[Kathleen Moriarty <[e-mail]>]

Sean & Ted,

Sean, thank you for your review of the draft!

On Wed, Feb 18, 2015 at 1:00 PM, Ted Lemon <[e-mail]> wrote:

> On Feb 18, 2015, at 9:17 AM, Sean Turner <[e-mail]> wrote:
> > 3. s5.2.1: Makes me hope that the if there’s two connections and one is
> a VPN that lookups meant for that connection is only done over that
> connection and not leaked out.  I think this is covered later in the
> section though.
>
> I think you may have used the wrong preposition here, and consequently I'm
> having trouble parsing this.   Can you restate?
>

I'm reading the text in 4.2 as addressing the concern in 5.2.1 that Sean
raises.  Yes, I agree on the comparison to the VPN leak RFC, but having
this statement prevents the need for a similar on on this topic.

   The routing to IP addresses reachable within this PvD will
   be set up via the VPN connection, and the routing of packets to
   addresses outside the scope of this PvD will remain unaffected.


But in 5.1, you may need a clause at the end of this sentence to make sure
the same PvD is used to prevent such issues (it is implied, but may be
better stated explicitly).
From:

   As an example, a node administrator could inject a DNS server which
   is not ISP-specific into PvDs for use on any of the networks that the
   node could attach to.  Such creation / augmentation of PvD(s) could
   be static or dynamic.

To:

   As an example, a node administrator could inject a DNS server which
   is not ISP-specific into PvDs for use on any of the networks that the
   node could attach to via the same PvD.  Such creation /
augmentation of PvD(s) could
   be static or dynamic.


For Sean's comment on 5.2.1, I think the above modified text in combination
with this text in 5.2.1 (plus what's in 4.2) is sufficient to address the
concern.

   In either case, by default a node uses information obtained via a
   name service lookup to establish connections only within the same PvD
   as the lookup results were obtained.


   For clarification, when it is written that the name service lookup
   results were obtained "from a PvD", it should be understood to mean
   that the name service query was issued against a name service which
   is configured for use in a particular PvD.  In that sense, the
   results are "from" that particular PvD.


-- 

Best regards,
Kathleen