Re: [Dots] WGLC for draft-dots-use-cases-19

Hi Med,

No, the orchestrator is not ignoring the mitigation hints. It is sending filtering rules to block or rate-limit traffic to routers (last but one line in the new paragraph). The adverse impact is legitimate users whose IP addresses were spoofed 
cannot access the services of the target server.  

Cheers,
-Tiru

> -----Original Message-----
> From: mohamed.boucadair@orange.com
> <mohamed.boucadair@orange.com>
> Sent: Tuesday, August 6, 2019 12:50 PM
> To: Konda, Tirumaleswar Reddy
> <TirumaleswarReddy_Konda@McAfee.com>; Valery Smyslov
> <valery@smyslov.net>; dots@ietf.org
> Cc: Xialiang (Frank, Network Standard & Patent Dept)
> <frank.xialiang@huawei.com>
> Subject: RE: [Dots] WGLC for draft-dots-use-cases-19
> 
> This email originated from outside of the organization. Do not click links or
> open attachments unless you recognize the sender and know the content is
> safe.
> 
> Hi Tiru,
> 
> The NEW text indicates the following:
> 
> ==
>    In addition to the above DDoS Orchestration, the selected DDoS
>    mitigation systems can return back a mitigation request to the
>    orchestrator as an offloading.
>                      ^^^^^^^^^^^
>    ....
>    the DDoS mitigation system can send mitigation requests
>    with additional hints such as its blocked traffic information to the
>                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^
>    orchestrator.
> ==
> 
> Which means that the DMS is blocking that traffic based on "some"
> information. That same information is passed to an orchestrator so that it can
> filter the traffic. What changes is ** how/where ** filters are installed.
> 
> Like the interface with a mitigator, the interface between the controller and
> underlying routers is out of scope.
> 
> From a DOTS perspective, the information supplied by the DMS to an
> Orchestrator is considered as "additional hints" which is adhering to RFC8612:
> 
> ==
>    GEN-004  Mitigation Hinting: DOTS clients may have access to attack
>       details that can be used to inform mitigation techniques.  Example
>       attack details might include locally collected fingerprints for an
>       on-going attack, or anticipated or active attack focal points
>       based on other threat intelligence.  DOTS clients MAY send
>       mitigation hints derived from attack details to DOTS servers, with
>       the full understanding that the DOTS server MAY ignore mitigation
>       hints.
> ==
> 
> I don't think there are new security considerations induced by the NEW text.
> 
> Cheers,
> Med
> 
> > -----Message d'origine-----
> > De : Dots [mailto:dots-bounces@ietf.org] De la part de Konda,
> > Tirumaleswar Reddy Envoyé : mardi 6 août 2019 08:52 À : Valery
> > Smyslov; dots@ietf.org Cc : Xialiang (Frank, Network Standard & Patent
> > Dept) Objet : Re: [Dots] WGLC for draft-dots-use-cases-19
> >
> > The security implications of the new use case need to be discussed in
> > the draft, please see https://mailarchive.ietf.org/arch/msg/dots/tb-
> > 1ojJ6TmSmRUci6JoUeD-gB1Y
> >
> > Cheers,
> > -Tiru
> >
> > > -----Original Message-----
> > > From: Dots <dots-bounces@ietf.org> On Behalf Of Valery Smyslov
> > > Sent: Tuesday, August 6, 2019 11:56 AM
> > > To: dots@ietf.org
> > > Cc: Xialiang (Frank, Network Standard & Patent Dept)
> > > <frank.xialiang@huawei.com>
> > > Subject: [Dots] WGLC for draft-dots-use-cases-19
> > >
> > >
> > >
> > > Hi,
> > >
> > > this message starts a short WGLC for draft-ietf-dots-use-cases-19 to
> > confirm
> > > the WG consensus regarding the latest addition of a new use case to
> > > the draft.
> > > The WGLS will last one week and will end on Tuesday, 13 August.
> > >
> > > Regards,
> > > Frank & Valery.
> > >
> > > _______________________________________________
> > > Dots mailing list
> > > Dots@ietf.org
> > > https://www.ietf.org/mailman/listinfo/dots
> >
> > _______________________________________________
> > Dots mailing list
> > Dots@ietf.org
> > https://www.ietf.org/mailman/listinfo/dots