[secdir] Secdir review of draft-ietf-i2nsf-consumer-facing-interface-dm-26

[Charlie Kaufman <[e-mail]>]

Reviewer: Charlie Kaufman
Review result: Ready

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments.

This document specifies a syntax for specifying security policies that apply in a networked environment. It is intended that general policies would be fed into the system in this syntax and then some policy engine would determine which policies need to be enforced by which nodes in the system and appropriate subsets would be distributed. The syntax takes the form of a YANG data model.

The review result I wanted to give was "Mostly Harmless". I am skeptical as to whether the collection of policies specifiable is flexible enough to be usable to manage a real network, but the syntax is easily extensible and this seems as good a place to start as any. If it encourages experimentation with management systems that distribute policies this way, that would be a good thing, and any deficiencies found could be fixed later. I could imagine other groups having very different visions as to how to manage this information, but I would not expect the presence of this document as an RFC would discourage them from experimenting with those visions.

I'm not sufficiently familiar with YANG or with Network Functions Virtualization to have a useful opinion as to how good this design is.

One point I found slightly suspicious was this text from section 3.2:

"Also note that QUIC protocol [RFC9000] is excluded in the data model as it is not considered in the initial I2NSF documents [RFC8329]. The QUIC traffic should not be treated as UDP traffic and will be considered in the future I2NSF documents."

I would think that an implementation that was oblivious to the existence of QUIC would treat it as UDP traffic (contrary to what this says), and could regulate it through that mechanism. As written, the text seems to say that this protocol lacks any ability to control QUIC. But perhaps I misunderstand.

--Charlie