Re: [Dots] DOTS Interop tests Update

mohamed.boucadair@orange.com Tue, 30 August 2022 14:46 UTC

Return-Path: <mohamed.boucadair@orange.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF470C15257C for <dots@ietfa.amsl.com>; Tue, 30 Aug 2022 07:46:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.104
X-Spam-Level:
X-Spam-Status: No, score=-2.104 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wpFzbXtlN9Xx for <dots@ietfa.amsl.com>; Tue, 30 Aug 2022 07:46:12 -0700 (PDT)
Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.66.40]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D99B6C14CEFC for <dots@ietf.org>; Tue, 30 Aug 2022 07:46:11 -0700 (PDT)
Received: from opfedar05.francetelecom.fr (unknown [xx.xx.xx.7]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by opfedar27.francetelecom.fr (ESMTP service) with ESMTPS id 4MH99D6HlMz2xnG; Tue, 30 Aug 2022 16:46:08 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1661870768; bh=o9+fZ/AzFJF3G4+k2Lg+a04dejp63BHcDg/2XoGj47I=; h=From:To:Subject:Date:Message-ID:Content-Type:MIME-Version; b=QXDKDDMbIYUth3DtJrHKYuPLhTkEDgGuIZaFsD84F+Ka+p4KTuln/uzt/wRa6pLVU G5sYQEeOIDK/yt/MCAwqDiz5Gneii4qMVk6+gVDdz6o0/bexMcPJCCP6lTTBnjEgWX 49GQU4YlHXirOyYkNiVwYBmLrcZ7MslNHiM8tQXdWV/E2UpzbvZhMJR3EuFva5064B 4cjjR0J3Wx6eBvjK8EshhFnNkNB6GY63n/Xr63tXajFABetXrMN1jXtmWPqMhZ/lfA ccgHD0V/JtWRbKhumwTYQ8Zxb0mScfXxaxyGJ6TooyFQVLbRktkUhIAt3sU3JHeVrU gWxKL8AKJHBTw==
From: mohamed.boucadair@orange.com
To: Jon Shallow <supjps-ietf@jpshallow.com>, "dots@ietf.org" <dots@ietf.org>
Thread-Topic: [Dots] DOTS Interop tests Update
Thread-Index: AdizKWdeWs9CbC0GQduqB1je0/G1HgJUyAuQ
Content-Class:
Date: Tue, 30 Aug 2022 14:46:08 +0000
Message-ID: <2498_1661870768_630E22B0_2498_71_12_d1a86663db6e40c08b3dd768a9978d51@orange.com>
References: <05a401d8b329$6780e080$3682a180$@jpshallow.com>
In-Reply-To: <05a401d8b329$6780e080$3682a180$@jpshallow.com>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_07222825-62ea-40f3-96b5-5375c07996e2_Enabled=true; MSIP_Label_07222825-62ea-40f3-96b5-5375c07996e2_SetDate=2022-08-30T14:26:50Z; MSIP_Label_07222825-62ea-40f3-96b5-5375c07996e2_Method=Privileged; MSIP_Label_07222825-62ea-40f3-96b5-5375c07996e2_Name=unrestricted_parent.2; MSIP_Label_07222825-62ea-40f3-96b5-5375c07996e2_SiteId=90c7a20a-f34b-40bf-bc48-b9253b6f5d20; MSIP_Label_07222825-62ea-40f3-96b5-5375c07996e2_ActionId=f50a6a06-97b6-4a0e-ad64-24f1fbd3a7b2; MSIP_Label_07222825-62ea-40f3-96b5-5375c07996e2_ContentBits=0
x-originating-ip: [10.115.26.50]
Content-Type: multipart/alternative; boundary="_000_d1a86663db6e40c08b3dd768a9978d51orangecom_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/Y9NoZtPAFIxx2S8r99b_gwgMqhI>
Subject: Re: [Dots] DOTS Interop tests Update
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 30 Aug 2022 14:46:15 -0000

Hi Jon, Kaname, all,

Thank you for sharing the outcome of this interop.

For items related to draft-ietf-dots-robust-blocks, I suggest to make the edits at: https://tinyurl.com/dots-robust-latest. We may add a note to warrant operators about the need to assess the implications of using non-default values (including for *-wait parameters), but it seems to me that is so obvious.

Cheers,
Med

De : Dots <dots-bounces@ietf.org> De la part de Jon Shallow
Envoyé : jeudi 18 août 2022 19:39
À : dots@ietf.org
Objet : [Dots] DOTS Interop tests Update

Hi all,

Over the last 2 days, Kaname and I did some interop tests - in particular to test out the RFC9177 "Constrained Application Protocol (CoAP) Block-Wise Transfer Options Supporting Robust Transmission" and the associated DOTS usage draft https://www.ietf.org/archive/id/draft-ietf-dots-robust-blocks-03.html.

This was between a proprietary implementation and open source go-dots.  Both are using libcoap to provide the underlying CoAP layer.

As ever, there were a few minor issues in the respective DOTS applications implementations which were resolved.  No updates to libcoap were required, but Q-Block was used extensively.

Out of this, several things were raised, which are detailed below.  Kaname, please add to this in case I missed something.

Issue 1:
======

It became obvious that MAX_PAYLOADS must be the same for both the idle-config and mitigating-config definitions.  Otherwise, if there is a mitigating state change at one end, then MAX_PAYLOADS changes and hence we are in violation of (and get significant transmission delays)

RFC9177 7.2. Non-confirmable (NON)
MAX_PAYLOADS should be configurable with a default value of 10. Both CoAP endpoints MUST have the same value (otherwise, there will be transmission delays in one direction),

So, for
draft-ietf-dots-robust-blocks 3. DOTS Attributes for Robust Block Transmission

OLD:
max-payloads:
This attribute echoes the MAX_PAYLOADS parameter in [I-D.ietf-core-new-block].

This is an optional attribute.
NEW:
max-payloads:
This attribute echoes the MAX_PAYLOADS parameter in [RFC9177].

This is an optional attribute.  However, if defined, it MUST have an equal value in the 'idle-config' and 'mitigating-config' configurations.  If only one of the 'idle-config' and 'mitigating-config' definitions are defined in a message exchange, then the other (missing) definition MUST be updated to the same value.
END NEW

Issue 2:
======

NON_PROBING_WAIT and NON_PARTIAL_TIMEOUT

RFC9177 7.2. Non-confirmable (NON) states

    Note that MAX_PAYLOADS, NON_MAX_RETRANSMIT, NON_TIMEOUT, NON_PROBING_WAIT, and
   NON_PARTIAL_TIMEOUT can be negotiated between DOTS peers, e.g., as per [DOTS-QUICK-BLOCKS].
    When explicit values are configured for NON_PROBING_WAIT and NON_PARTIAL_TIMEOUT, these
    values are used without applying any jitter.

draft-ietf-dots-robust-blocks 3. DOTS Attributes for Robust Block Transmission has

    Implementation Note 1:
      'non-probing-wait' ideally should be left having some jitter and so should not be hard-coded
      with an explicit value. It is suggested to use a base value (using NON_TIMEOUT instead of
      NON_TIMEOUT_RANDOM) and, then, the jitter (ACK_RANDOM_FACTOR - 1) is added to each
      time the value is checked.
   Implementation Note 2:
      If any of the signal channel session configuration parameters is updated, the 'non-probing-wait'
      and 'non-partial-timeout' values should be recalculated according to the definition algorithms
      in Section 7.2 of [I-D.ietf-core-new-block].

If 'non-probing-wait' and 'non-partial-timeout' end up with negotiated values that are considerably different from the values as computed by the definition algorithms in Section 7.2 of [RFC9177], then it is likely that the Q-Block recovery mechanisms will fail.  Any recommendations here are definitely out of scope without extensive testing.  It is recommended that 'non-probing-wait' and 'non-partial-timeout' are not negotiated by DOTS, and hence removed from. draft-ietf-dots-robust-blocks all together.

Issue 3:
======

draft-ietf-dots-robust-blocks 3. DOTS Attributes for Robust Block Transmission, typo

OLD:
NON_PROBING_WAIT: is used to limit the potential wait needed calculated when using PROBING_WAIT.
NEW
NON_PROBING_WAIT: is used to limit the potential wait needed calculated when using PROBING_RATE.


Issue 4:
======

RFC9132 4.4.1.3. Processing Mitigation Requests, has

   The DOTS client MUST include the same ETag value in subsequent GET requests to retrieve the rest
   of the representation.

This statement is erroneous and should be deleted to remove confusion as it is likely to return a 2.03 response instead of a 2.05 response as per

RFC7252 5.10.6.2.  ETag as a Request Option

   A server can issue a 2.03 Valid response (Section 5.9.1.3) in place
   of a 2.05 Content response if one of the ETags given is the entity-
   tag for the current representation, i.e., is valid; the 2.03 Valid
   response then echoes this specific ETag in a response option.



Regards

Jon


_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.