Re: [Dots] clarification questions from the hackathon

[<[e-mail]>]

Hi Tiru, 

I entered a new issue for the ACL stats: https://github.com/boucadair/filter-control/issues/1 

Cheers,
Med

> -----Message d'origine-----
> De : Dots [mailto:[e-mail]] De la part de Konda, Tirumaleswar
> Reddy
> Envoyé : lundi 1 avril 2019 17:27
> À : BOUCADAIR Mohamed TGI/OLN; Jon Shallow; kaname nishizuka; [e-mail]
> Objet : Re: [Dots] clarification questions from the hackathon
> 
> 
> 
> > -----Original Message-----
> > From: [e-mail]
> > <[e-mail]>
> > Sent: Monday, April 1, 2019 7:32 PM
> > To: Konda, Tirumaleswar Reddy <[e-mail]>;
> > Jon Shallow <[e-mail]>; kaname nishizuka
> > <[e-mail]>; [e-mail]
> > Subject: RE: [Dots] clarification questions from the hackathon
> >
> > This email originated from outside of the organization. Do not click links
> or
> > open attachments unless you recognize the sender and know the content is
> > safe.
> >
> > Hi Tiru,
> >
> > Please see inline.
> >
> > Cheers,
> > Med
> >
> > > -----Message d'origine-----
> > > De : Konda, Tirumaleswar Reddy
> > > [mailto:[e-mail]]
> > > Envoyé : lundi 1 avril 2019 15:31
> > > À : BOUCADAIR Mohamed TGI/OLN; Jon Shallow; kaname nishizuka;
> > > [e-mail] Objet : RE: [Dots] clarification questions from the
> > > hackathon
> > >
> > > Update looks good, couple of points to consider:
> > >
> > > 1> when the mitigation request is successfully applied, the response
> > > 1> must
> > > include the acl-* attributes conveyed in the request (as per RFC7252
> > > 5.9.1.1).
> >
> > [Med] I hesitated to add this one. What is the purpose of returning the
> acl-*
> > in the response given that 2.01/2.04 are explicit that the type was
> > successfully updated. Receiving a response such as the one in Figure 10 of
> > the signal channel is straightforward.
> 
> Yup.
> 
> >
> > > 2> It looks useful to return the activated ACL statistics, for example
> > > 2> If the
> > > client activates a rate-limit ACL, the ACL could be applied at the PE
> > > router (because the DMS is not capable of handling the attack volume).
> > > The rate- limit ACL will rate-limit both legitimate and attack
> > > traffic, and the DMS will scrub the rate-limited traffic and drop the
> > > attack traffic. The client may want to know the statistics of the
> > > traffic dropped because of the rate- limit ACL.
> >
> > [Med] This one needs more discussion, IMO. I suggest to leave this one open
> > for future revisions.
> 
> Sure, please add to github issues for tracking purpose.
> 
> -Tiru
> 
> >
> > >
> > > -Tiru
> > >
> > > > -----Original Message-----
> > > > From: Dots <[e-mail]> On Behalf Of
> > > > [e-mail]
> > > > Sent: Monday, April 1, 2019 4:43 PM
> > > > To: Jon Shallow <[e-mail]>; kaname nishizuka
> > > > <[e-mail]>; [e-mail]
> > > > Subject: Re: [Dots] clarification questions from the hackathon
> > > >
> > > > This email originated from outside of the organization. Do not click
> > > > links
> > > or
> > > > open attachments unless you recognize the sender and know the
> > > > content is safe.
> > > >
> > > > Jon, Kaname, all,
> > > >
> > > > FWIW, a proposal to integrate the interop comments is available at:
> > > > https://github.com/boucadair/filter-control/blob/master/wdiff%20draf
> > > > t-
> > > > nishizuka-dots-signal-control-filtering-05.txt%20draft-nishizuka-dot
> > > > s-
> > > signal-
> > > > control-filtering-06.pdf
> > > >
> > > > Cheers,
> > > > Med
> > > >
> > > > > > >
> > > > > > > > -----Message d'origine-----
> > > > > > > > De : Dots [mailto:[e-mail]] De la part de
> > > > > > > > kaname nishizuka Envoyé : jeudi 28 mars 2019 11:38 À :
> > > > > > > > [e-mail] Objet : [Dots] clarification questions from
> > > > > > > > the hackathon
> > > > > > > >
> > > > > > > > Hi,
> > > > > > > >
> > > > > > > > I'd like to continue discussion of these topics in the ML.
> > > > > > > >
> > > > > > > > #1: Questions about signal-control-filtering
> > > > > > > >   1. Should a mitigation request create a mitigation before
> > > > > > > > doing a PUT
> > > > > +
> > > > > > > > acl-list [{acl-name, activation-type}] against the active
> > > > > > > > mitigation,
> > > > > or
> > > > > > is a
> > > > > > > > ‘PUT + acl-list [{acl-name, activation-type}]’ allowed to
> > > > > > > > create a new mitigation?
> > > > > > >
> > > > > > > [Med] Both are currently allowed in the draft. I don't still a
> > > > > > > valid
> > > > > reason
> > > > > > to
> > > > > > > restrict this.
> > > > > >
> > > > > > [Jon] As per draft
> > > > > >    A DOTS client MUST NOT use the filtering control over DOTS
> signal
> > > > > >    channel if no attack (mitigation) is active;
> > > > > >
> > > > >
> > > > > [Med] What is meant actually is:
> > > > >
> > > > >    A DOTS client MUST NOT use the filtering control over DOTS signal
> > > > >    channel in 'idle' time;
> > > > >
> > > > > Will update the text.
> > > > >
> > > > > > [Jon] then needs to be reworded as there is no active mitigation
> > > > > > until the PUT is done...
> > > > > > I believe that both cases should be supported.
> > > > > > >
> > > > > > > >   2. Should the response to a GET (or Observed GET) include
> > > > > > > > the
> > > > > > > > acl-
> > > > > list
> > > > > > > > [{acl-name, activation-type}] if the PUT included it?
> > > > > > >
> > > > > > > [Med] The current spec says "no". That's said, what would be
> > > > > > > the value in returning it? Then, why not allowing to return
> > > > > > > the references to all ACLs
> > > > > > that
> > > > > > > are enabled during the mitigation time?
> > > > > > >
> > > > > > [Jon] When observing the mitigation request, if the
> > > > > > activation-type is changed externally, the client will then know
> about
> > the change.
> > > > > > Assuming
> > > > > the
> > > > > > response got back to the client, this is effectively an ACK to
> > > > > > the fact
> > > > > that
> > > > > > the ACL change got through.
> > > > >
> > > > > [Med] The observe case makes sense, indeed.
> > > > >
> > > > > >
> > > > > > Interesting concept about knowing about all the relevant ACLs as
> > > > > > returned over the signal channel.  More work for the server to
> > > > > > do in determining
> > > > > which
> > > > > > ACLs are valid for, say, a specific IP address that is being
> mitigated.
> > > > > Not
> > > > > > entirely convinced of the benefit of this as this generally is
> > > > > > available
> > > > > over
> > > > > > the data channel.
> > > > > >
> > > > >
> > > > > [Med] I'm not convinced, either.
> > > > >
> > > > _______________________________________________
> > > > Dots mailing list
> > > > [e-mail]
> > > > https://www.ietf.org/mailman/listinfo/dots
> _______________________________________________
> Dots mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dots