Re: [Dots] WGLC on draft-ietf-dots-architecture-08

"Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com> Mon, 03 December 2018 14:40 UTC

Return-Path: <TirumaleswarReddy_Konda@mcafee.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C086130F2D for <dots@ietfa.amsl.com>; Mon, 3 Dec 2018 06:40:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.761
X-Spam-Level:
X-Spam-Status: No, score=-5.761 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.46, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gT_PfNZlYJ8g for <dots@ietfa.amsl.com>; Mon, 3 Dec 2018 06:40:00 -0800 (PST)
Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1C41130E92 for <dots@ietf.org>; Mon, 3 Dec 2018 06:39:59 -0800 (PST)
X-NAI-Header: Modified by McAfee Email Gateway (5500)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1543848008; h=From: To:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:authentication-results: x-originating-ip:x-ms-publictraffictype:x-microsoft-exchange-diagnostics: x-ms-exchange-antispam-srfa-diagnostics:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: x-microsoft-antispam-prvs:x-ms-exchange-senderadcheck: x-exchange-antispam-report-cfa-test:x-forefront-prvs: x-forefront-antispam-report:received-spf:x-microsoft-antispam-message-info: spamdiagnosticoutput:spamdiagnosticmetadata: Content-Type:Content-Transfer-Encoding:MIME-Version: X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Level: X-NAI-Spam-Threshold:X-NAI-Spam-Score:X-NAI-Spam-Version; bh=iMzq1/gE3sBkaWmQq2icPVW2aFfPXWQ7UQv+UW wVLMQ=; b=LDxx2p5lr2GeOIgvUtYfLnpGWXWHKm+Ok1boUFn/ QUEbyU/voON2Vq5pfn07iXoTIBdd3cA7P4k8sjzU5HGp4Gy8YU 7MQMWZzsSdlO0TT42LeNilNFsrXhsIeY+fuf8H0k7p90l2TeOL wbFj54kq7DHlgm2FmeaPy+kmkXfKwpk=
Received: from DNVEXAPP1N04.corpzone.internalzone.com (unknown [10.44.48.88]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 3443_39b1_b0c130bc_a0f5_478f_93d9_ee179cf79761; Mon, 03 Dec 2018 08:40:08 -0600
Received: from DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) by DNVEXAPP1N04.corpzone.internalzone.com (10.44.48.88) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Mon, 3 Dec 2018 07:39:31 -0700
Received: from DNVO365EDGE1.corpzone.internalzone.com (10.44.176.66) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1347.2 via Frontend Transport; Mon, 3 Dec 2018 07:39:31 -0700
Received: from NAM03-BY2-obe.outbound.protection.outlook.com (10.44.176.243) by edge.mcafee.com (10.44.176.66) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Mon, 3 Dec 2018 07:39:30 -0700
Received: from BN6PR16MB1425.namprd16.prod.outlook.com (10.172.207.19) by BN6PR16MB1459.namprd16.prod.outlook.com (10.172.207.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1382.22; Mon, 3 Dec 2018 14:39:29 +0000
Received: from BN6PR16MB1425.namprd16.prod.outlook.com ([fe80::b8de:7bb:cfa3:22ee]) by BN6PR16MB1425.namprd16.prod.outlook.com ([fe80::b8de:7bb:cfa3:22ee%8]) with mapi id 15.20.1382.020; Mon, 3 Dec 2018 14:39:29 +0000
From: "Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com>
To: "mohamed.boucadair@orange.com" <mohamed.boucadair@orange.com>, Roman Danyliw <rdd@cert.org>, "dots@ietf.org" <dots@ietf.org>
Thread-Topic: WGLC on draft-ietf-dots-architecture-08
Thread-Index: AdSGnlgla3cLRB5MRLWQWFaJSQftBABEEW3wAAZceYAAB9nNYAAEkILwAB+EMpAACKXk4AACgplwAAhHgoAAg12NMAAJg9xQAAG5H4AABQ7dgA==
Date: Mon, 03 Dec 2018 14:39:29 +0000
Message-ID: <BN6PR16MB14251466063C92F20ADF9D96EAAE0@BN6PR16MB1425.namprd16.prod.outlook.com>
References: <359EC4B99E040048A7131E0F4E113AFC0184C49169@marathon> <787AE7BB302AE849A7480A190F8B93302E04F649@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <BN6PR16MB1425AD85A67FFE5A0EA5A769EAD20@BN6PR16MB1425.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302E04F981@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <BN6PR16MB1425D2A6BED037A18098CF54EAD20@BN6PR16MB1425.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302E04FF7F@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <BN6PR16MB1425379772574B34E678406DEAD30@BN6PR16MB1425.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302E050207@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <DM5PR16MB1436848B4B3EC35B6EF67D9BEAD30@DM5PR16MB1436.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302E050B73@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <BN6PR16MB1425A44F8819DA7516AD0AB6EAAE0@BN6PR16MB1425.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302E050F35@OPEXCLILMA3.corporate.adroot.infra.ftgroup>
In-Reply-To: <787AE7BB302AE849A7480A190F8B93302E050F35@OPEXCLILMA3.corporate.adroot.infra.ftgroup>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
dlp-product: dlpe-windows
dlp-version: 11.1.0.61
dlp-reaction: no-action
authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com;
x-originating-ip: [185.221.69.46]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; BN6PR16MB1459; 6:D0BdsiXyOhA/KKhsiaZET3kq8J+kA7+wSUgbCgMSRWYlbxsXLBnYbzvpEW+SaxgbFqp4B5vJV3vMdZDMZrg2Bi1Y+/DpXek1+cRG9ECQLeatECSO7FcX24FCeYEEz2qcZGDYFngwSY4dYoOKJ7u2wvUd561YJs/nsu9wlTuj5uVfv7WwGiQXp0m7qi9T3LbH47QoBPPel1TCs3O+8eWt+x8eTPv+dERRtlStrF57vvklju5jlkw2gRAVWgLNco8QL0AamogC7tD86tX4uqNHiaYwIR3t/Wo5w6n+N/d3LlRB3+o6C+s+4dEf6nUf7/1sYUiuk95AAQAeMwKT1ogH35R0tm/OPQjDbcMhqhRJyBOyrp6Lzi4mapnlspO0NODtnEnH31VxwpiAGSjEKm4jUgZjz7mvHEAgQyj6iFT99UlIeFEI1YLJfhdsOmXhvhG185V1uQLEuugms0D1yggrtQ==; 5:qtxOSclOVYusdGag3WVlEETRyeEFYUn79/nibPOnKEA5m0jcCKlcv4Gn8lwmvNXh711ymcY/xbDk0WMcEUPF9xRKWR+PpTc9AhmCMFYbMWia3yjzQx6WUX6I+q8xjlxJPM+H7h7JAx/M8Zcthf3mboO+z1sevflh/BKzB+69s7A=; 7:HeRuN0mDKN29T8Rk0czrzLOakAJv0fzoDooBuz5s3eSF2QZjfHuWr8OLuNZvoYpl7cHp2/KF073c12Mb5Sof6MHnnd6KwIAOVHSe6sbmvlt1taSzmDYcvkDQlDsQVs+M1u7znBJTxJSLIYU8OGeyBQ==
x-ms-exchange-antispam-srfa-diagnostics: SOS;
x-ms-office365-filtering-correlation-id: 9cfaf517-e6f8-44dc-a894-08d6592d2198
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390098)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:BN6PR16MB1459;
x-ms-traffictypediagnostic: BN6PR16MB1459:
x-microsoft-antispam-prvs: <BN6PR16MB145902131AD2B592807CADB0EAAE0@BN6PR16MB1459.namprd16.prod.outlook.com>
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231455)(999002)(944501493)(52105112)(3002001)(10201501046)(148016)(149066)(150057)(6041310)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(20161123558120)(201708071742011)(7699051)(76991095); SRVR:BN6PR16MB1459; BCL:0; PCL:0; RULEID:; SRVR:BN6PR16MB1459;
x-forefront-prvs: 08756AC3C8
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(39860400002)(396003)(366004)(376002)(136003)(55784004)(13464003)(199004)(189003)(32952001)(80792005)(8936002)(102836004)(14454004)(5024004)(14444005)(256004)(74316002)(53546011)(6506007)(55016002)(305945005)(7736002)(33656002)(6306002)(25786009)(3846002)(9686003)(72206003)(7696005)(966005)(76176011)(6116002)(66066001)(476003)(106356001)(105586002)(11346002)(99286004)(446003)(66574009)(316002)(97736004)(93886005)(2501003)(68736007)(478600001)(71190400001)(71200400001)(186003)(229853002)(26005)(5660300001)(81166006)(8676002)(486006)(110136005)(81156014)(6246003)(86362001)(2906002)(53936002)(6436002)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:BN6PR16MB1459; H:BN6PR16MB1425.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts)
x-microsoft-antispam-message-info: zfkRaQK9nvDg3JlAgLk+gr/6J7XYBRnnOGknAPJIKyCtqnhvcqgOnkFP7H/NSxD/599h+3xXvDD7WsyCP3YymL8qEhLC3GHAiN+ibzZGsX+izPVFX2QT487zVF5BJhIRgjD3pdbPinbW0YCy5XmYepomVI+dD8OTsEOzAb8zlhzfWZR68GWyUv7JbnQ5DUejAhve+YK8Nxs5sxrD1h4WoRTxEHgmGt/86E98lK62gvdTbIuVo/olBftgYnOKQ/Xk/xKjjqYrxSTjbkdY85IkCeXybhwGGszf8gRZQ0TILtoeWCAqyH7xVw2w1aTD0l2myUmXtT24w5IdieleKOc0Sd/rLtdbD8uqwV+UIv++S94=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 9cfaf517-e6f8-44dc-a894-08d6592d2198
X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Dec 2018 14:39:29.0746 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR16MB1459
X-OriginatorOrg: mcafee.com
X-NAI-Spam-Flag: NO
X-NAI-Spam-Level:
X-NAI-Spam-Threshold: 15
X-NAI-Spam-Score: 0.5
X-NAI-Spam-Version: 2.3.0.9418 : core <6431> : inlines <6975> : streams <1806061> : uri <2759516>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/MxrvVjn1ugRy76bciVwnhKITzFA>
Subject: Re: [Dots] WGLC on draft-ietf-dots-architecture-08
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 03 Dec 2018 14:40:10 -0000

> -----Original Message-----
> From: mohamed.boucadair@orange.com <mohamed.boucadair@orange.com>
> Sent: Monday, December 3, 2018 5:50 PM
> To: Konda, Tirumaleswar Reddy <TirumaleswarReddy_Konda@McAfee.com>;
> Roman Danyliw <rdd@cert.org>; dots@ietf.org
> Subject: RE: WGLC on draft-ietf-dots-architecture-08
> 
> This email originated from outside of the organization. Do not click links or
> open attachments unless you recognize the sender and know the content is safe.
> 
> Re-,
> 
> OK.
> 
> As per redirected signaling, the WG has only this requirement for the signal
> channel (SIG-005).

SIG-005 is explicitly discussing redirected signaling because of the attack condition.
I don't see a reason why redirect signaling is not applicable to DOTS data channel to increase the DOTS server
operational flexibility and scalability.

-Tiru

> 
> Cheers,
> Med
> 
> > -----Message d'origine-----
> > De : Dots [mailto:dots-bounces@ietf.org] De la part de Konda,
> > Tirumaleswar Reddy Envoyé : lundi 3 décembre 2018 12:18 À : BOUCADAIR
> > Mohamed TGI/OLN; Roman Danyliw; dots@ietf.org Objet : Re: [Dots] WGLC
> > on draft-ietf-dots-architecture-08
> >
> > Thanks Med, update looks good; just one Nit Redirected signaling is
> > also applicable to DOTS data channel (replace "DOTS signal channel
> > session" with "DOTS session").
> >
> > -Tiru
> >
> > > -----Original Message-----
> > > From: mohamed.boucadair@orange.com
> <mohamed.boucadair@orange.com>
> > > Sent: Monday, December 3, 2018 12:17 PM
> > > To: Konda, Tirumaleswar Reddy
> <TirumaleswarReddy_Konda@McAfee.com>;
> > > Roman Danyliw <rdd@cert.org>; dots@ietf.org
> > > Subject: RE: WGLC on draft-ietf-dots-architecture-08
> > >
> > >
> > >
> > > Hi Tiru,
> > >
> > > I updated the file to take into account your feedback:
> > >
> > > Xml:
> > > https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/draft-
> > ietf-
> > > dots-architecture-09.xml
> > > Diff: https://github.com/boucadair/IETF-Drafts-
> > > Reviews/blob/master/wdiff%20draft-ietf-dots-architecture-09.txt%20dr
> > > aft-
> > ietf-
> > > dots-architecture-09.pdf
> > >
> > > Cheers,
> > > Med
> > >
> > > > -----Message d'origine-----
> > > > De : Dots [mailto:dots-bounces@ietf.org] De la part de Konda,
> > > > Tirumaleswar Reddy Envoyé : vendredi 30 novembre 2018 17:14 À :
> > > > BOUCADAIR Mohamed TGI/OLN; Roman Danyliw; dots@ietf.org Objet :
> Re:
> > > > [Dots] WGLC on draft-ietf-dots-architecture-08
> > > >
> > > > Hi Med,
> > > >
> > > > I don't fully agree with some of the updates.  I propose the
> > > > following
> > > > changes:
> > > >
> > > > [1] Replace " A DOTS session can be a DOTS data channel session or
> > > > a DOTS signal channel session" with "A DOTS session can be a DOTS
> > > > data channel session or a DOTS signal channel session or both."
> > > > [2] I thought we agreed to say the following:
> > > > A DOTS signal channel session is associated with a single
> > > > transport connection (TCP or UDP session) and an ephemeral
> > > > security association (e.g. a TLS or DTLS session). Similarly,  a
> > > > DOTS data channel session is associated with a single TCP
> > > > connection and an ephemeral TLS security
> > > association.
> > > > [3] Direct and recursive signaling is applicable to both DOTS
> > > > signal and data channel sessions, replace "DOTS signal channel
> > > > session" with
> > "DOTS
> > > session".
> > > > [4] In Section 3.1.2, replace "session" with "DOTS session"
> > > > [5] Remove the following line:
> > > > "These sessions may belong to the same or distinct DOTS channels
> > > > (signal or data).
> > > >
> > > > Cheers,
> > > > -Tiru
> > > >
> > > > > -----Original Message-----
> > > > > From: mohamed.boucadair@orange.com
> > > <mohamed.boucadair@orange.com>
> > > > > Sent: Friday, November 30, 2018 5:40 PM
> > > > > To: Konda, Tirumaleswar Reddy
> > > <TirumaleswarReddy_Konda@McAfee.com>;
> > > > > Roman Danyliw <rdd@cert.org>; dots@ietf.org
> > > > > Subject: RE: WGLC on draft-ietf-dots-architecture-08
> > > > >
> > > > > This email originated from outside of the organization. Do not
> > > > > click links
> > > > or
> > > > > open attachments unless you recognize the sender and know the
> > > > > content is
> > > > safe.
> > > > >
> > > > > Re-,
> > > > >
> > > > > OK. Thanks.
> > > > >
> > > > > FWIW, I also made on my side some changes that I'd like to see
> > > > > made to fix
> > > > the
> > > > > issues we discussed so far:
> > > > >
> > > > > Xml:
> > > > > https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/dra
> > > > > ft-
> > > > ietf-
> > > > > dots-architecture-09.xml
> > > > > Diff: https://github.com/boucadair/IETF-Drafts-
> > > > > Reviews/blob/master/wdiff%20draft-ietf-dots-architecture-09.txt%
> > > > > 20dr
> > > > > aft-
> > > > ietf-
> > > > > dots-architecture-09.pdf
> > > > >
> > > > > Feel free to reuse the modified version.
> > > > >
> > > > > (Removing parts that were agreed and focusing on the last
> > > > > pending
> > > > > one)
> > > > >
> > > > > > > > >
> > > > > > > > > > DOTS data channel draft is not using the term "DOTS
> > > > > > > > > > data channel session", we can fix the signal channel
> > > > > > > > > > draft to use "DOTS data channel" instead of "DOTS data
> > > > > > > > > > channel
> > session".
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > > [Med] May be. BTW, this part of the text:
> > > > > > > > >
> > > > > > > > > " Conversely, a
> > > > > > > > >    DOTS session cannot exist without an established
> > > > > > > > > signal channel
> > > > "
> > > > > > > > >
> > > > > > > > > is conflicting with this one:
> > > > > > > > >
> > > > > > > > > "
> > > > > > > > > To allow for DOTS
> > > > > > > > >    service flexibility, neither the order of contact nor
> > > > > > > > > the
> > time
> > > > > > > > >    interval between channel creations is specified.  A
> > > > > > > > > DOTS client
> > > > MAY
> > > > > > > > >    establish signal channel first, and then data
> > > > > > > > > channel, or vice
> > > > > > versa."
> > > > > > >
> > > > > > > [Med] This one is still pending.
> > > > > >
> > > > > > The above line looks clear to me, what is the confusion ?
> > > > > >
> > > > >
> > > > > [Med] The problem is not with the last line with this one:
> > > > >
> > > > > "DOTS session cannot exist without an established signal channel"
> > > > >
> > > > > Which means that dots signal channel session is a pre-requisite
> > > > > for DOTS
> > > > data
> > > > > channel. This is conflict with the other excerpt I cited.
> > > > _______________________________________________
> > > > Dots mailing list
> > > > Dots@ietf.org
> > > > https://www.ietf.org/mailman/listinfo/dots
> > _______________________________________________
> > Dots mailing list
> > Dots@ietf.org
> > https://www.ietf.org/mailman/listinfo/dots