Re: [Dots] Suresh Krishnan's Discuss on draft-ietf-dots-data-channel-28: (with DISCUSS and COMMENT)

<mohamed.boucadair@orange.com> Thu, 02 May 2019 06:09 UTC

Return-Path: <mohamed.boucadair@orange.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4A5D120052; Wed, 1 May 2019 23:09:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uWGRa5_LRkpx; Wed, 1 May 2019 23:09:17 -0700 (PDT)
Received: from orange.com (mta134.mail.business.static.orange.com [80.12.70.34]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F71F120006; Wed, 1 May 2019 23:09:17 -0700 (PDT)
Received: from opfednr04.francetelecom.fr (unknown [xx.xx.xx.68]) by opfednr23.francetelecom.fr (ESMTP service) with ESMTP id 44vlG24L8Jz5wFt; Thu, 2 May 2019 08:09:14 +0200 (CEST)
Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.107]) by opfednr04.francetelecom.fr (ESMTP service) with ESMTP id 44vlG23Xrkz1xnr; Thu, 2 May 2019 08:09:14 +0200 (CEST)
Received: from OPEXCAUBMA2.corporate.adroot.infra.ftgroup ([fe80::e878:bd0:c89e:5b42]) by OPEXCAUBM8F.corporate.adroot.infra.ftgroup ([fe80::74f6:8fc8:b1b8:dbba%22]) with mapi id 14.03.0439.000; Thu, 2 May 2019 08:09:14 +0200
From: <mohamed.boucadair@orange.com>
To: Suresh Krishnan <suresh@kaloom.com>, The IESG <iesg@ietf.org>
CC: "draft-ietf-dots-data-channel@ietf.org" <draft-ietf-dots-data-channel@ietf.org>, Roman Danyliw <rdd@cert.org>, "dots-chairs@ietf.org" <dots-chairs@ietf.org>, "dots@ietf.org" <dots@ietf.org>
Thread-Topic: Suresh Krishnan's Discuss on draft-ietf-dots-data-channel-28: (with DISCUSS and COMMENT)
Thread-Index: AQHVAF1OWLN67wiVp0+M8VHsy3FT46ZXTpCQ
Date: Thu, 2 May 2019 06:09:13 +0000
Message-ID: <787AE7BB302AE849A7480A190F8B93302EA689CD@OPEXCAUBMA2.corporate.adroot.infra.ftgroup>
References: <155674287918.725.5059294278452219173.idtracker@ietfa.amsl.com>
In-Reply-To: <155674287918.725.5059294278452219173.idtracker@ietfa.amsl.com>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.114.13.245]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/0bUHjOekLmHFEvnlg9o55DnCcuI>
Subject: Re: [Dots] Suresh Krishnan's Discuss on draft-ietf-dots-data-channel-28: (with DISCUSS and COMMENT)
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 May 2019 06:09:19 -0000

Hi Suresh, 

Please see inline. 

Cheers,
Med

> -----Message d'origine-----
> De : Suresh Krishnan via Datatracker [mailto:noreply@ietf.org]
> Envoyé : mercredi 1 mai 2019 22:35
> À : The IESG
> Cc : draft-ietf-dots-data-channel@ietf.org; Roman Danyliw; dots-
> chairs@ietf.org; rdd@cert.org; dots@ietf.org
> Objet : Suresh Krishnan's Discuss on draft-ietf-dots-data-channel-28: (with
> DISCUSS and COMMENT)
> 
> Suresh Krishnan has entered the following ballot position for
> draft-ietf-dots-data-channel-28: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-dots-data-channel/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> * Section 4.3
> 
> The processing requirements for the tcp flags bitmask is not at all clear.
> Specifically how should an implementation use the values in the flags,
> operator
> and the bitmask fields in the tcp subtree to figure out if a given packet
> matches. An example here could be very helpful.

[Med] The behavior is identical to the one used in BGP Flowspec (RFC5575). 

> 
> "Bitmask values can be encoded as a 1- or 2-byte bitmask."
> 
> How? The bitmask field is a uint16. How would a client indicate a 1 byte
> bitmask?
> 

[Med] A match on values less than 2^8 means implicitly that the match will be on the 13 byte of the TCP header; otherwise this is done on the 12/13 bytes (with data offset being ignored).

We could use a more "explicit" encoding such as the following: 

     |              |     |     +--rw flags-bitmask
     |              |     |     |  +--rw operator?                  operator
     |              |     |     |  +--rw (bitmask)?
     |              |     |     |     +--:(bitmask-one-byte)
     |              |     |     |     |  +--rw bitmask-one-byte?    uint8
     |              |     |     |     +--:(bitmask-two-bytes)
     |              |     |     |        +--rw bitmask-two-bytes?   uint16


> [Also note that there are *nine* flags defined for TCP including the
> experimental NS bit that occurs as bit 7 of Octet 12 and a 1 byte bitmask
> will
> not catch them all]

[Med] Indeed, but we wanted to allow for the same functionality as in BGP Flowspec. We could provid draft-ietf-tcpm-rfc793bis as a pointer to the current flags, but that document is not stable.

> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> How does the flags field in the ipv4 match subtree interact with the bits in
> the fragment side? I can easily see that someone can make a mistake due to
> this
> redundancy and come up with something that is not coherent. e.g. bit "more"
> under flags is set and bit "lf" under fragment-> type is also set .
> 

[Med] This is part of the trivial validation checks. Please note that this is not specific to these two nodes but to other cases such as:
* indicate a protocol at l3 set to 17, but include a tcp l4 container.