Re: [Dots] AD review of draft-ietf-dots-data-channel-25

[<[e-mail]>]

Re-,

I agree. 

Let's add your proposed text to the architecture I-D. 

Cheers,
Med

> -----Message d'origine-----
> De : Benjamin Kaduk [mailto:[e-mail]]
> Envoyé : mercredi 27 février 2019 15:45
> À : BOUCADAIR Mohamed TGI/OLN
> Cc : [e-mail]; [e-mail]
> Objet : Re: AD review of draft-ietf-dots-data-channel-25
> 
> On Wed, Feb 27, 2019 at 10:25:36AM +0000, [e-mail] wrote:
> > Hi Ben,
> >
> > > >
> > > > [Med] Let's add that text into the architecture I-D.
> > >
> > > Okay.  Tiru had a follow-up about how servers can identify DOTS client's
> > > domains, which is okay but not quite what I was aiming for.  In the text
> > > Tiru quoted, we note that
> > >
> > >    The DOTS server enforces authorization of DOTS clients' signals for
> > >    mitigation.  The mechanism of enforcement is not in scope for this
> > >    document, but is expected to restrict requested mitigation scope to
> > >    addresses, prefixes, and/or services owned by the DOTS client's
> > >    administrative domain, such that a DOTS client from one domain is not
> > >    able to influence the network path to another domain.
> > >
> > > I was hoping to see something like "For a given client (administrative)
> > > domain, the DOTS server needs to be able to determine whether a given
> > > resource is in that domain.  This could take the form of associating a
> set
> > > of IP Prefixes per domain, for example."  But I'm open to being persuaded
> > > that the existing text conveys the same meaning.
> > >
> >
> > [Med] Your proposed wording can be added to the architecture I-D, IMHO.
> >
> > FWIW, we do have this text in the protocol spec:
> >
> >    DOTS servers MUST verify that requesting DOTS clients are entitled to
> >    enforce filtering rules on a given IP prefix.  That is, only
> >    filtering rules on IP resources that belong to the DOTS client's
> >    domain can be authorized by a DOTS server.  The exact mechanism for
> >    the DOTS servers to validate that the target prefixes are within the
> >    scope of the DOTS client's domain is deployment-specific.
> 
> To me that text is just reading that it mandates authorization checks,
> whereas the text in the data-channel document that prompted this comment
> has me thinking that the DOTS server needs an explicit mapping between
> "DOTS client domain" and "this set of IP addresses and/or other
> identifiers", which is a slightly different thing.