Re: [secdir] SecDir review of draft-ietf-ipfix-mib-variable-export.

[Benoit Claise <[e-mail]>]

Hi Juergen,

> On Wed, Nov 18, 2015 at 05:06:26PM +0100, Benoit Claise wrote:
>> On 11/18/2015 11:13 AM, Juergen Schoenwaelder wrote:
>>> On Sat, Nov 14, 2015 at 02:17:20AM +0900, Warren Kumari wrote:
>>>> Be ye not afraid...
>>>> I have reviewed this document as part of the security directorate's
>>>> ongoing effort to review all IETF documents being processed by the
>>>> IESG.  These comments were written primarily for the benefit of the
>>>> security area directors.  Document editors and WG chairs should treat
>>>> these comments just like any other last call comments.
>>>>
>>>> Version reviewed: draft-ietf-ipfix-mib-variable-export-09 - Exporting
>>>> MIB Variables using the IPFIX Protocol
>>>>
>>>> Summary:
>>>> LGTM, Security AD attention not required, modulo questions below.
>>>>
>>>> I'm not quite sure what:
>>>> "However if the exporter is a client of an SNMP engine on the same
>>>>   device it MUST abide by existing SNMP security rules." is supposed to
>>>> mean. What exactly are "existing SNMP security rules"? Those defined
>>>> in RFCs? Configured on the device?
>>> I agree that this statement is a bit confusing. In the SNMP world, a
>>> client must authenticate against the agent and then the agent uses the
>>> clients authenticated identity to apply access control rules. This text
>>> talks about a client of an "SNMP engine", which is a bit confusing.
>>>
>>> Perhaps the sentence was meant to say this:
>>>
>>>       However, if the exporter is implemented as an SNMP manager
>>>       accessing an SNMP agent, it MUST authenticate itself to the SNMP
>>>       agent and the SNMP agent MUST enforce SNMP access control rules
>>>       as it would for any other SNMP manager.
>> Yes, that was the meaning.
>> For example, we can't export via IPFIX a MIB object for which we're not
>> granted access, completely bypassing the SNMP access control rules
> Well, this is not exactly what the I-D says in section 10. The I-D
> forsees two implementation options:
>
> a) The exporter acts as an SNMP manager retrieving data from an SNMP
>     agent. In this case, the usual SNMP procedures concerning
>     authentication and authorization apply
>
> b) The exporter is generating or capturing the field values itself.
>     In this case the IPFIX approach applies that the IPFIX exporter
>     defines what is exported to whom.
My remark was in the context of a)

Regards, Benoit


>
> /js
>