[secdir] draft-ietf-masque-connect-udp-listen-12 ietf last call Secdir review

[Yaroslav Rosomakho via Datatracker <[e-mail]>]

Document: draft-ietf-masque-connect-udp-listen
Title: Proxying Bound UDP in HTTP
Reviewer: Yaroslav Rosomakho
Review result: Has Nits

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG. These comments
were written primarily for the benefit of the security area directors. Document
editors and WG chairs should treat these comments just like any other last call
comments.

Overall, the document is in a good shape. I believe there are few minor
improvements to security considerations worth considering:

1. Authorization discussion in the second part of the security considerations
compares checks for uncompressed datagrams with targeted CONNECT-UDP requests.
It might be worth mentioning that the same authorization logic should apply
during accepting compression contexts.

2. Limit on number of open contexts. Third part of the security considerations
already require a limit on buffered responses, but do not mention risks of
accepting too many compression contexts.

Nits:

1. Section 3.1: "In such a case, the proxy opening contexts results in tuples
not desired by the client reaching it thereby nullifying the IP restriction
property of uncompressed compression close as described in Section 8.1." reads
way too compressed to me. It took several re-reads to decompress the meaning.
Perhaps it is worth rephrasing it to something less compressed along the lines
of "Allowing the proxy to do so would permit traffic from source tuples not
selected by the client, defeating the restriction described in Section 8.1".
Hopefully I uncompressed it correctly.

2. Section 9: "COMPRESSION_ACK OR COMPRESSION_CLOSE" => "COMPRESSION_ACK or
COMPRESSION_CLOSE"