Subject: Re: [MBONED] WGLC for <draft-ietf-mboned-auto-multicast-08.txt>

From: Pekka Savola <[email-masked]>
Date: Fri, 14 Dec 2007 19:43:01 +0200 (EET)

On Thu, 22 Nov 2007, Hiroshi Ohta wrote:
> http://www.ietf.org/internet-drafts/draft-ietf-mboned-auto-multicast-08.txt

I've have not had the time to look at this version carefully.

I just checked two most important issues I've commented in the past. 
The following from Security Considerations is still wrong, IMHO:

    Gateways and relays will accept and decapsulate multicast traffic
    from any source from which regular unicast traffic is accepted.  If
    this is for any reason felt to be a security risk, then additional
    source address based packet filtering MUST be applied:

I strongly suggest rewording this as:

    Gateways and relays will accept and decapsulate multicast traffic
    from any source from which regular unicast traffic is accepted and
    the following source address based packet filtering MUST be
    applied:

The original "If (a a condition the implementation can't test) then 
MUST.." is not good protocol engineering, and this will just open a 
security problem unless the features described in the following 
paragraphs are mandatory in all scenarios.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

_______________________________________________
MBONED mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mboned

---

From: Pekka Savola <[email-masked]>
Date: Fri, 14 Dec 2007 19:43:01 +0200 (EET)