Re: [secdir] Sec-Dir review of draft-ietf-opsec-vpn-leakages-02

[Fernando Gont <[e-mail]>]

Hi, Kathleen,

Thanks so much for your feedback! Please find my comments in-line...

On 12/09/2013 07:21 PM, Moriarty, Kathleen wrote:
> The reference to VPN, never distinguishes if the document is
> referring to an IPSec or TLS VPN. 

That's intentional. At the end of the day, what you use to tunnel your
packets  does not really affect the underlying issues.


> I suspect IPSec from the document,
> but making this clear would be helpful to the reader.  TLS has become
> popular when providing restricted access and may be just an encrypted
> session to a particular service as opposed to a full VPN with routed
> traffic using IPSec.  Unfortunately, language has blurred here,
> mostly because of marketing, so clarity would be helpful to avoid
> possible confusion for the reader.

As noted above, this is actually intentional, and I'd personally leave
this "as is" -- put please let me know what you think.



> I would recommend introducing the comparison of slit-tunneling
> earlier in the document as this is a similar issue (IPv6 getting
> routed separately from the VPN traffic), although split-tunneling is
> an intentional configuration option.

Could you please clarify what you have in mind?



> Is the draft intended for developers/implementers or operational
> teams/VPN users -- or both?

Both.


> The proposed fixes could be done by the
> VPN software or operators could disable interfaces, the former would
> obviously be preferred and the abstract mentions products, so you may
> want to repeat that preference later in the document.

So far, the I-D proposes that the fixes should be implemented by the VPN
client. ONly the "Security Considerations" section mentions "disabling
IPv6" as a mitigation (i.e., "last resort" thing).

I guess possible options are:

1) Leaving the I-D "as is", or,

2) Have a "Mitigations" section where the current Section 6
("Mitigations to VPN traffic-leakage vulnerabilities") is incorporated
as subsection 6.1 (and possibly renamed "Fixing VPN client software"),
and then adding another subsection entitled "Operational mitigations" or
the like, essentially discussing manually disabling IPv6 on the local
system.

I'm inclined to "1)", but nevertheless open to "2)".

Thoughts?

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492