Re: [secdir] SecDir review of draft-ietf-ipfix-mib-variable-export.

[Juergen Schoenwaelder <[e-mail]>]

On Wed, Nov 18, 2015 at 05:06:26PM +0100, Benoit Claise wrote:
> On 11/18/2015 11:13 AM, Juergen Schoenwaelder wrote:
> >On Sat, Nov 14, 2015 at 02:17:20AM +0900, Warren Kumari wrote:
> >>Be ye not afraid...
> >>I have reviewed this document as part of the security directorate's
> >>ongoing effort to review all IETF documents being processed by the
> >>IESG.  These comments were written primarily for the benefit of the
> >>security area directors.  Document editors and WG chairs should treat
> >>these comments just like any other last call comments.
> >>
> >>Version reviewed: draft-ietf-ipfix-mib-variable-export-09 - Exporting
> >>MIB Variables using the IPFIX Protocol
> >>
> >>Summary:
> >>LGTM, Security AD attention not required, modulo questions below.
> >>
> >>I'm not quite sure what:
> >>"However if the exporter is a client of an SNMP engine on the same
> >>  device it MUST abide by existing SNMP security rules." is supposed to
> >>mean. What exactly are "existing SNMP security rules"? Those defined
> >>in RFCs? Configured on the device?
> >I agree that this statement is a bit confusing. In the SNMP world, a
> >client must authenticate against the agent and then the agent uses the
> >clients authenticated identity to apply access control rules. This text
> >talks about a client of an "SNMP engine", which is a bit confusing.
> >
> >Perhaps the sentence was meant to say this:
> >
> >      However, if the exporter is implemented as an SNMP manager
> >      accessing an SNMP agent, it MUST authenticate itself to the SNMP
> >      agent and the SNMP agent MUST enforce SNMP access control rules
> >      as it would for any other SNMP manager.
> Yes, that was the meaning.
> For example, we can't export via IPFIX a MIB object for which we're not 
> granted access, completely bypassing the SNMP access control rules

Well, this is not exactly what the I-D says in section 10. The I-D
forsees two implementation options:

a) The exporter acts as an SNMP manager retrieving data from an SNMP
   agent. In this case, the usual SNMP procedures concerning
   authentication and authorization apply

b) The exporter is generating or capturing the field values itself.
   In this case the IPFIX approach applies that the IPFIX exporter
   defines what is exported to whom.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <http://www.jacobs-university.de/>