Re: [Dots] WGLC for draft-dots-use-cases-19

["Konda, Tirumaleswar Reddy" <[e-mail]>]

> -----Original Message-----
> From: [e-mail]
> <[e-mail]>
> Sent: Tuesday, August 6, 2019 3:15 PM
> To: Konda, Tirumaleswar Reddy
> <[e-mail]>; Valery Smyslov
> <[e-mail]>; [e-mail]
> Cc: Xialiang (Frank, Network Standard & Patent Dept)
> <[e-mail]>
> Subject: RE: [Dots] WGLC for draft-dots-use-cases-19
> 
> 
> 
> Re-,
> 
> Please see inline.
> 
> Cheers,
> Med
> 
> > -----Message d'origine-----
> > De : Konda, Tirumaleswar Reddy
> > [mailto:[e-mail]]
> > Envoyé : mardi 6 août 2019 11:29
> > À : BOUCADAIR Mohamed TGI/OLN; Valery Smyslov; [e-mail] Cc :
> > Xialiang (Frank, Network Standard & Patent Dept) Objet : RE: [Dots]
> > WGLC for draft-dots-use-cases-19
> >
> > > -----Original Message-----
> > > From: [e-mail]
> > > <[e-mail]>
> > > Sent: Tuesday, August 6, 2019 2:50 PM
> > > To: Konda, Tirumaleswar Reddy
> > > <[e-mail]>; Valery Smyslov
> > > <[e-mail]>; [e-mail]
> > > Cc: Xialiang (Frank, Network Standard & Patent Dept)
> > > <[e-mail]>
> > > Subject: RE: [Dots] WGLC for draft-dots-use-cases-19
> > >
> > > This email originated from outside of the organization. Do not click
> > links or
> > > open attachments unless you recognize the sender and know the
> > > content is safe.
> > >
> > > Re-,
> > >
> > > Please see inline.
> > >
> > > Cheers,
> > > Med
> > >
> > > > -----Message d'origine-----
> > > > De : Konda, Tirumaleswar Reddy
> > > > [mailto:[e-mail]]
> > > > Envoyé : mardi 6 août 2019 11:15
> > > > À : BOUCADAIR Mohamed TGI/OLN; Valery Smyslov; [e-mail] Cc :
> > > > Xialiang (Frank, Network Standard & Patent Dept) Objet : RE:
> > > > [Dots] WGLC for draft-dots-use-cases-19
> > > >
> > > > > -----Original Message-----
> > > > > From: [e-mail]
> > > > > <[e-mail]>
> > > > > Sent: Tuesday, August 6, 2019 2:00 PM
> > > > > To: Konda, Tirumaleswar Reddy
> > > > > <[e-mail]>; Valery Smyslov
> > > > > <[e-mail]>; [e-mail]
> > > > > Cc: Xialiang (Frank, Network Standard & Patent Dept)
> > > > > <[e-mail]>
> > > > > Subject: RE: [Dots] WGLC for draft-dots-use-cases-19
> > > > >
> > > > > This email originated from outside of the organization. Do not
> > > > > click
> > > > links or
> > > > > open attachments unless you recognize the sender and know the
> > > > > content is safe.
> > > > >
> > > > > Re-,
> > > > >
> > > > > Please see inline.
> > > > >
> > > > > Cheers,
> > > > > Med
> > > > >
> > > > > > -----Message d'origine-----
> > > > > > De : Konda, Tirumaleswar Reddy
> > > > > > [mailto:[e-mail]]
> > > > > > Envoyé : mardi 6 août 2019 10:14 À : BOUCADAIR Mohamed
> > > > > > TGI/OLN; Valery Smyslov; [e-mail] Cc :
> > > > > > Xialiang (Frank, Network Standard & Patent Dept) Objet : RE:
> > > > > > [Dots] WGLC for draft-dots-use-cases-19
> > > > > >
> > > > > > Hi Med,
> > > > > >
> > > > > > No, the orchestrator is not ignoring the mitigation hints.
> > > > >
> > > > > [Med] Why? The text is clear the orchestrator acts as DOTS server.
> > > > > As
> > > > such, it
> > > > > can ignore/accept hints.
> > > > >
> > > > >  It is sending
> > > > > > filtering rules to block or rate-limit traffic to routers
> > > > > > (last but one line in the new paragraph).
> > > > >
> > > > > [Med] Yes. That filtering rule is that would be applied by the
> > > > > DMS if it
> > > > has
> > > > > sufficient resources.
> > > > >
> > > > >  The adverse impact is legitimate users whose
> > > > > > IP addresses were spoofed
> > > > > > cannot access the services of the target server.
> > > > >
> > > > > [Med] This is a check at the DMS side. This check applies
> > > > > independently
> > > > of **
> > > > > where ** the filters are applied. This is not specific to this
> > > > > NEW
> > text.
> > > >
> > > > If the orchestrator is sending filtering rules to block traffic,
> > > > checks are required to ensure spoofed IP address are not conveyed
> > > > by
> > the
> > > DMS.
> > >
> > > [Med] Yes, but the current text describes the case where the DMS
> > supplies
> > > "its blocked traffic information":
> > >
> > >   the DDoS mitigation system can send mitigation requests
> > >   with additional hints such as its blocked traffic information to the
> > >                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^
> > >   orchestrator.
> > >
> > > So, the DMS has already done that check.
> >
> > The blocked traffic information will include attack traffic from both
> > spoofed and attacker IP addresses.
> >
> 
> [Med] If you are saying that there is an issue if the DMS does not check, you
> are right. But, again, this is not specific to the NEW text. This is a general
> problem (that is outside DOTS, BTW).

No, DMS will anyway check and try not block legitimate traffic from users whose IP addresses have been spoofed.

> 
> 
> > >
> > >  If
> > > > the orchestrator delegates the mitigation to a separate domain
> > > > (recursive signaling), the attack information provided by DMS can
> > > > include spoofed IP addresses (so the new mitigator in the separate
> > > > domain learns the attack traffic is coming from spoofed IP addresses).
> > >
> > > [Med] This is not specific to this case, but applies each time there
> > > is
> > recursive
> > > signaling.
> >
> > My comment is to using the attack information of spoofed IP addresses
> > to filter traffic would penalize legitimate users, and the text is not
> > clear me. I suggest adding a line for clarity, DMS may supply both
> > spoofed and attacker IP addresses in the attack information to the
> > orchestrator. The orchestrator will only use the non-spoofed IP
> > addresses to enforce filtering rules on routers.
> 
> [Med] I was assuming this is already done by the DMS to generate "its
> blocked traffic information", but if you prefer the text to be explicit, it will
> need to be generic:
> 
> the check is not specific to the NEW text but applies also in the general DMS
> case (without offloading).

When DMS generates the attack traffic information it should include both spoofed and attacker IP addresses (tagged with whether the IP address is spoofed or not). If the orchestrator is delegating the mitigation to a separate domain, it can propagate the attack information so the mitigator in the separate domain has knowledge that the attacker is using spoofed IP addresses and the mitigator can optionally use the attack information to determine the mitigation strategy. However If orchestrator is enforcing filtering rules on routers, it should create the black-list rules based on the non-spoofed attacker IP address and not use the spoofed victim IP addresses.

Cheers,
-Tiru