Re: [Dots] WGLC for draft-dots-use-cases-19

[H Y <[e-mail]>]

Hi

Please see inline.

2019年8月6日(火) 21:16 <[e-mail]>:
>
> Re-,
>
> Please see inline.
>
> Cheers,
> Med
>
> > -----Message d'origine-----
> > De : Konda, Tirumaleswar Reddy [mailto:[e-mail]]
> > Envoyé : mardi 6 août 2019 13:52
> > À : BOUCADAIR Mohamed TGI/OLN; Valery Smyslov; [e-mail]
> > Cc : Xialiang (Frank, Network Standard & Patent Dept)
> > Objet : RE: [Dots] WGLC for draft-dots-use-cases-19
> >
> > > -----Original Message-----
> > > From: [e-mail]
> > > <[e-mail]>
> > > Sent: Tuesday, August 6, 2019 3:15 PM
> > > To: Konda, Tirumaleswar Reddy
> > > <[e-mail]>; Valery Smyslov
> > > <[e-mail]>; [e-mail]
> > > Cc: Xialiang (Frank, Network Standard & Patent Dept)
> > > <[e-mail]>
> > > Subject: RE: [Dots] WGLC for draft-dots-use-cases-19
> > >
> > >
> > >
> > > Re-,
> > >
> > > Please see inline.
> > >
> > > Cheers,
> > > Med
> > >
> > > > -----Message d'origine-----
> > > > De : Konda, Tirumaleswar Reddy
> > > > [mailto:[e-mail]]
> > > > Envoyé : mardi 6 août 2019 11:29
> > > > À : BOUCADAIR Mohamed TGI/OLN; Valery Smyslov; [e-mail] Cc :
> > > > Xialiang (Frank, Network Standard & Patent Dept) Objet : RE: [Dots]
> > > > WGLC for draft-dots-use-cases-19
> > > >
> > > > > -----Original Message-----
> > > > > From: [e-mail]
> > > > > <[e-mail]>
> > > > > Sent: Tuesday, August 6, 2019 2:50 PM
> > > > > To: Konda, Tirumaleswar Reddy
> > > > > <[e-mail]>; Valery Smyslov
> > > > > <[e-mail]>; [e-mail]
> > > > > Cc: Xialiang (Frank, Network Standard & Patent Dept)
> > > > > <[e-mail]>
> > > > > Subject: RE: [Dots] WGLC for draft-dots-use-cases-19
> > > > >
> > > > > This email originated from outside of the organization. Do not click
> > > > links or
> > > > > open attachments unless you recognize the sender and know the
> > > > > content is safe.
> > > > >
> > > > > Re-,
> > > > >
> > > > > Please see inline.
> > > > >
> > > > > Cheers,
> > > > > Med
> > > > >
> > > > > > -----Message d'origine-----
> > > > > > De : Konda, Tirumaleswar Reddy
> > > > > > [mailto:[e-mail]]
> > > > > > Envoyé : mardi 6 août 2019 11:15
> > > > > > À : BOUCADAIR Mohamed TGI/OLN; Valery Smyslov; [e-mail] Cc :
> > > > > > Xialiang (Frank, Network Standard & Patent Dept) Objet : RE:
> > > > > > [Dots] WGLC for draft-dots-use-cases-19
> > > > > >
> > > > > > > -----Original Message-----
> > > > > > > From: [e-mail]
> > > > > > > <[e-mail]>
> > > > > > > Sent: Tuesday, August 6, 2019 2:00 PM
> > > > > > > To: Konda, Tirumaleswar Reddy
> > > > > > > <[e-mail]>; Valery Smyslov
> > > > > > > <[e-mail]>; [e-mail]
> > > > > > > Cc: Xialiang (Frank, Network Standard & Patent Dept)
> > > > > > > <[e-mail]>
> > > > > > > Subject: RE: [Dots] WGLC for draft-dots-use-cases-19
> > > > > > >
> > > > > > > This email originated from outside of the organization. Do not
> > > > > > > click
> > > > > > links or
> > > > > > > open attachments unless you recognize the sender and know the
> > > > > > > content is safe.
> > > > > > >
> > > > > > > Re-,
> > > > > > >
> > > > > > > Please see inline.
> > > > > > >
> > > > > > > Cheers,
> > > > > > > Med
> > > > > > >
> > > > > > > > -----Message d'origine-----
> > > > > > > > De : Konda, Tirumaleswar Reddy
> > > > > > > > [mailto:[e-mail]]
> > > > > > > > Envoyé : mardi 6 août 2019 10:14 À : BOUCADAIR Mohamed
> > > > > > > > TGI/OLN; Valery Smyslov; [e-mail] Cc :
> > > > > > > > Xialiang (Frank, Network Standard & Patent Dept) Objet : RE:
> > > > > > > > [Dots] WGLC for draft-dots-use-cases-19
> > > > > > > >
> > > > > > > > Hi Med,
> > > > > > > >
> > > > > > > > No, the orchestrator is not ignoring the mitigation hints.
> > > > > > >
> > > > > > > [Med] Why? The text is clear the orchestrator acts as DOTS
> > server.
> > > > > > > As
> > > > > > such, it
> > > > > > > can ignore/accept hints.
> > > > > > >
> > > > > > >  It is sending
> > > > > > > > filtering rules to block or rate-limit traffic to routers
> > > > > > > > (last but one line in the new paragraph).
> > > > > > >
> > > > > > > [Med] Yes. That filtering rule is that would be applied by the
> > > > > > > DMS if it
> > > > > > has
> > > > > > > sufficient resources.
> > > > > > >
> > > > > > >  The adverse impact is legitimate users whose
> > > > > > > > IP addresses were spoofed
> > > > > > > > cannot access the services of the target server.
> > > > > > >
> > > > > > > [Med] This is a check at the DMS side. This check applies
> > > > > > > independently
> > > > > > of **
> > > > > > > where ** the filters are applied. This is not specific to this
> > > > > > > NEW
> > > > text.
> > > > > >
> > > > > > If the orchestrator is sending filtering rules to block traffic,
> > > > > > checks are required to ensure spoofed IP address are not conveyed
> > > > > > by
> > > > the
> > > > > DMS.
> > > > >
> > > > > [Med] Yes, but the current text describes the case where the DMS
> > > > supplies
> > > > > "its blocked traffic information":
> > > > >
> > > > >   the DDoS mitigation system can send mitigation requests
> > > > >   with additional hints such as its blocked traffic information to
> > the
> > > > >                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > > >   orchestrator.
> > > > >
> > > > > So, the DMS has already done that check.
> > > >
> > > > The blocked traffic information will include attack traffic from both
> > > > spoofed and attacker IP addresses.
> > > >
> > >
> > > [Med] If you are saying that there is an issue if the DMS does not
> > check, you
> > > are right. But, again, this is not specific to the NEW text. This is a
> > general
> > > problem (that is outside DOTS, BTW).
> >
> > No, DMS will anyway check and try not block legitimate traffic from users
> > whose IP addresses have been spoofed.
> >
>
> [Med] What I'm saying is that the DMS will then follow the same logic when providing the hints to the orchestrator.
>
> > >
> > >
> > > > >
> > > > >  If
> > > > > > the orchestrator delegates the mitigation to a separate domain
> > > > > > (recursive signaling), the attack information provided by DMS can
> > > > > > include spoofed IP addresses (so the new mitigator in the separate
> > > > > > domain learns the attack traffic is coming from spoofed IP
> > addresses).
> > > > >
> > > > > [Med] This is not specific to this case, but applies each time there
> > > > > is
> > > > recursive
> > > > > signaling.
> > > >
> > > > My comment is to using the attack information of spoofed IP addresses
> > > > to filter traffic would penalize legitimate users, and the text is not
> > > > clear me. I suggest adding a line for clarity, DMS may supply both
> > > > spoofed and attacker IP addresses in the attack information to the
> > > > orchestrator. The orchestrator will only use the non-spoofed IP
> > > > addresses to enforce filtering rules on routers.
> > >
> > > [Med] I was assuming this is already done by the DMS to generate "its
> > > blocked traffic information", but if you prefer the text to be explicit,
> > it will
> > > need to be generic:
> > >
> > > the check is not specific to the NEW text but applies also in the
> > general DMS
> > > case (without offloading).
> >
> > When DMS generates the attack traffic information it should include both
> > spoofed and attacker IP addresses (tagged with whether the IP address is
> > spoofed or not).
>
> [Med] Why it should not check?
>
> If the orchestrator is delegating the mitigation to a
> > separate domain, it can propagate the attack information so the mitigator
> > in the separate domain has knowledge that the attacker is using spoofed IP
> > addresses and the mitigator can optionally use the attack information to
> > determine the mitigation strategy.
>
> [Med] The recursive case is not covered in the current text. I don't think we need to elaborate on this further.
>
>  However If orchestrator is enforcing
> > filtering rules on routers, it should create the black-list rules based on
> > the non-spoofed attacker IP address and not use the spoofed victim IP
> > addresses.
> >
>
> [Med] Agree. Whether the check is done at the orchestrator or by the DMS, is not a new concern. The DMS has to proceed with these checks, anyway. I fail to see what is NEW and SPECIFIC to the offload scenario.
[Yuhei]
The NEW point of the offload scenario is that DMS has DOTS client
function in DDoS orchestration usecase, and the orchestrator can take
further actions based on result of DMS's detailed analysis.

Thanks,
Yuhei

> _______________________________________________
> Dots mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dots



-- 
----------------------------------
Yuuhei HAYASHI
08065300884
[e-mail]
[e-mail]
----------------------------------