Clearer langauge for DNS query "monitoring" (46abdf71) · Commits · STAN4CRA / EN 304 620 Virtual Private Networks Part 1

clauses/5.Requirements.md

+2 −2

Original line number	Diff line number	Diff line
		@@ -891,11 +891,11 @@ The VPN client shall route all requests that use well-known DNS query ports thro
		* UC-6: not required
		* UC-7: required

		### 5.7.9 REQ-CON-09 (MI-DNSL-5) Monitoring of DNS configuration
		### 5.7.9 REQ-CON-09 (MI-DNSL-5) DNS configuration consistency

		#### 5.7.9.1 Requirement

		The VPN client shall monitor changes in the local DNS configuration and take a user-configurable action when it detects that the DNS configuration has changed from the one the VPN client specified. By default, the configurable option shall be to disable network traffic outside the system.
		The VPN client shall respond in a timely manner to changes to local configuration which result in DNS query routing that conflicts with the configured setting. By default, the response shall be to prevent DNS queries from being routed in ways which would violate that configuration.

		#### 5.7.9.2 Applicability

+3 −3

Original line number	Diff line number	Diff line
		@@ -1218,15 +1218,15 @@ Otherwise FAIL

		A packet capture showing that no DNS query using well-known ports is transmitted outside the VPN tunnel.

		### 6.7.9 REQ-CON-09 (MI-DNSL-5) Monitoring of DNS configuration
		### 6.7.9 REQ-CON-09 (MI-DNSL-5) DNS configuration consistency

		#### 6.7.9.1 Objective

		Prevent plaintext DNS query leaks outside of VPN connection.
		Prevent unintended plaintext DNS query leaks outside of VPN connection.

		#### 6.7.9.2 Preparation

		Configure the VPN client to use exclusive DNS routing to authorized DNS servers
		Configure the VPN client to use exclusive DNS routing to authorized DNS servers.

		#### 6.7.9.3 Activities