Re: [secdir] SecDir review of draft-ietf-ipfix-mib-variable-export.

[Benoit Claise <[e-mail]>]

On 11/19/2015 4:34 PM, Juergen Schoenwaelder wrote:
> See my latest suggestion which adds a bunch of references to the third
> paragraph - which was the original request of the security directorate
> reviewer.
>
>      However, if the exporter is implemented as an SNMP manager
>      accessing an SNMP agent, it MUST authenticate itself to the SNMP
>      agent [RFC3414], [RFC5591], [RFC5592], RFC6353] and the SNMP agent
>      MUST enforce SNMP access control rules [RFC3415] as required by
>      the SNMP architecture [RFC 3411].
>
> The additional sentence is somewhat unclear:
>
>      [...] An Exporter MUST NOT bypass SNMP access control rules to
>      export a MIB object for which it is not granted access.
>
> Does this apply to any exporter or only to an exporter implemented as
> an SNMP manager accessing an SNMP agent? In the later case, I would
> say this sentence is not needed since the sentence before already says
> that the SNMP agent MUST enforce SNMP access control rules (and this
> is the entity that has knowledge about the access control rules).
Agreed.
> In
> the former case, more information would be needed since in order to
> apply SNMP access control rules, you need to have an authenticated
> identity to work with.
Note that this not part of Stephen's DISCUSS.

Regards, Benoit
>
> /js
>
> On Thu, Nov 19, 2015 at 02:46:22PM +0000, Paul Aitken wrote:
>> I've updated section 10 to capture both of these comments.
>>
>> Note that I haven't yet addressed Sephen Farrell's comment on privacy,
>> which will also be in this section.
>>
>>
>>    10.  Security Considerations
>>
>>       For this extension to the IPFIX protocol, the same security
>>       considerations as for the IPFIX protocol apply [RFC7011].
>>
>>       If the exporter is generating or capturing the field values itself,
>>       e.g. using the MIB objects only as an encoding or type mechanism,
>>       there are no extra security considerations beyond standard IPFIX.
>>
>>       However, if the exporter is implemented as an SNMP manager accessing
>>       an SNMP agent, it MUST authenticate itself to the SNMP agent and the
>>       SNMP agent MUST enforce SNMP access control rules as it would for any
>>       other SNMP manager.  An Exporter MUST NOT bypass SNMP access control
>>       rules to export a MIB object for which it is not granted access.
>>
>>       The access to particular MIB objects is controlled by the
>>       configuration of the IPFIX exporter.  This is consistent with the way
>>       IPFIX controls access to other Information Elements in general.
>>
>>       The configuration of an IPFIX Exporter determines which MIB objects
>>       are included in IPFIX Data Records sent to certain collectors.
>>       Network operators should take care that the only MIB objects which
>>       are included in IPFIX Data Records are ones which the receiving flow
>>       collector is allowed to receive.
>>
>> P.
>>
>> On 18/11/15 16:06, Benoit Claise wrote:
>>> On 11/18/2015 11:13 AM, Juergen Schoenwaelder wrote:
>>>> On Sat, Nov 14, 2015 at 02:17:20AM +0900, Warren Kumari wrote:
>>>>> Be ye not afraid...
>>>>> I have reviewed this document as part of the security directorate's
>>>>> ongoing effort to review all IETF documents being processed by the
>>>>> IESG.  These comments were written primarily for the benefit of the
>>>>> security area directors.  Document editors and WG chairs should treat
>>>>> these comments just like any other last call comments.
>>>>>
>>>>> Version reviewed: draft-ietf-ipfix-mib-variable-export-09 - Exporting
>>>>> MIB Variables using the IPFIX Protocol
>>>>>
>>>>> Summary:
>>>>> LGTM, Security AD attention not required, modulo questions below.
>>>>>
>>>>> I'm not quite sure what:
>>>>> "However if the exporter is a client of an SNMP engine on the same
>>>>>   device it MUST abide by existing SNMP security rules." is supposed to
>>>>> mean. What exactly are "existing SNMP security rules"? Those defined
>>>>> in RFCs? Configured on the device?
>>>> I agree that this statement is a bit confusing. In the SNMP world, a
>>>> client must authenticate against the agent and then the agent uses the
>>>> clients authenticated identity to apply access control rules. This text
>>>> talks about a client of an "SNMP engine", which is a bit confusing.
>>>>
>>>> Perhaps the sentence was meant to say this:
>>>>
>>>>       However, if the exporter is implemented as an SNMP manager
>>>>       accessing an SNMP agent, it MUST authenticate itself to the SNMP
>>>>       agent and the SNMP agent MUST enforce SNMP access control rules
>>>>       as it would for any other SNMP manager.
>>> Yes, that was the meaning.
>>> For example, we can't export via IPFIX a MIB object for which we're
>>> not granted access, completely bypassing the SNMP access control rules
>>>
>>> Regards, Benoit (as a document author)
>>>> /js
>>>>