[secdir] Secdir last call review of draft-ietf-nfsv4-layoutwcc-04

Benjamin Schwartz via Datatracker <noreply@ietf.org> Thu, 31 October 2024 19:19 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: Benjamin Schwartz via Datatracker <noreply@ietf.org>
To: secdir@ietf.org
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <173040237779.57191.9072111440920309915@dt-datatracker-84cf84bdcc-hlxgg>
Date: Thu, 31 Oct 2024 12:19:37 -0700
Message-ID-Hash: 75NF3SKBSYIUCUXA5GFHFYBHBSQEJOPL
CC: draft-ietf-nfsv4-layoutwcc.all@ietf.org, last-call@ietf.org, nfsv4@ietf.org
Reply-To: Benjamin Schwartz <ietf@bemasc.net>
Subject: [secdir] Secdir last call review of draft-ietf-nfsv4-layoutwcc-04
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/V36kcGuj9uPbmGL6g-HbwxJWSS0>

Reviewer: Benjamin Schwartz
Review result: Ready

This specification is not highly security-relevant, and it does not have any
content in its Security Considerations.

In general, allowing file metadata, including size and ownership, to be
desynchronized from the file contents, does carry significant security
implications.  For example, understating the size of the file could lead to a
buffer overflow in an incautious client.  If these considerations have already
been addressed in another document, I think a specific citation to that text
would be appropriate here.

[secdir] Secdir last call review of draft-ietf-nf… Benjamin Schwartz via Datatracker
[secdir] Re: Secdir last call review of draft-iet… Thomas Haynes