Re: [Dots] WGLC on draft-ietf-dots-architecture-08

<mohamed.boucadair@orange.com> Tue, 04 December 2018 12:16 UTC

Return-Path: <mohamed.boucadair@orange.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFC5D128A6E for <dots@ietfa.amsl.com>; Tue, 4 Dec 2018 04:16:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wbKs509zyRzC for <dots@ietfa.amsl.com>; Tue, 4 Dec 2018 04:15:59 -0800 (PST)
Received: from orange.com (mta239.mail.business.static.orange.com [80.12.66.39]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F067128DFD for <dots@ietf.org>; Tue, 4 Dec 2018 04:15:59 -0800 (PST)
Received: from opfedar01.francetelecom.fr (unknown [xx.xx.xx.2]) by opfedar27.francetelecom.fr (ESMTP service) with ESMTP id 438LRx44wDz2y4V; Tue, 4 Dec 2018 13:15:57 +0100 (CET)
Received: from Exchangemail-eme2.itn.ftgroup (unknown [xx.xx.31.13]) by opfedar01.francetelecom.fr (ESMTP service) with ESMTP id 438LRx31HXzBrLM; Tue, 4 Dec 2018 13:15:57 +0100 (CET)
Received: from OPEXCLILMA3.corporate.adroot.infra.ftgroup ([fe80::60a9:abc3:86e6:2541]) by OPEXCLILM6D.corporate.adroot.infra.ftgroup ([fe80::54f9:a6c3:c013:cbc7%19]) with mapi id 14.03.0415.000; Tue, 4 Dec 2018 13:15:57 +0100
From: mohamed.boucadair@orange.com
To: "Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com>, Roman Danyliw <rdd@cert.org>, "dots@ietf.org" <dots@ietf.org>
Thread-Topic: WGLC on draft-ietf-dots-architecture-08
Thread-Index: AdSGnlgla3cLRB5MRLWQWFaJSQftBABEEW3wAAZceYAAB9nNYAAEkILwAB+EMpAACKXk4AACgplwAAhHgoAAg12NMAAJg9xQAAG5H4AABQ7dgAAtle+Q
Date: Tue, 04 Dec 2018 12:15:56 +0000
Message-ID: <787AE7BB302AE849A7480A190F8B93302E051A1F@OPEXCLILMA3.corporate.adroot.infra.ftgroup>
References: <359EC4B99E040048A7131E0F4E113AFC0184C49169@marathon> <787AE7BB302AE849A7480A190F8B93302E04F649@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <BN6PR16MB1425AD85A67FFE5A0EA5A769EAD20@BN6PR16MB1425.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302E04F981@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <BN6PR16MB1425D2A6BED037A18098CF54EAD20@BN6PR16MB1425.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302E04FF7F@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <BN6PR16MB1425379772574B34E678406DEAD30@BN6PR16MB1425.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302E050207@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <DM5PR16MB1436848B4B3EC35B6EF67D9BEAD30@DM5PR16MB1436.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302E050B73@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <BN6PR16MB1425A44F8819DA7516AD0AB6EAAE0@BN6PR16MB1425.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302E050F35@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <BN6PR16MB14251466063C92F20ADF9D96EAAE0@BN6PR16MB1425.namprd16.prod.outlook.com>
In-Reply-To: <BN6PR16MB14251466063C92F20ADF9D96EAAE0@BN6PR16MB1425.namprd16.prod.outlook.com>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.168.234.4]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/gnUTwYhfXywQx0ksaf7Tw489OUs>
Subject: Re: [Dots] WGLC on draft-ietf-dots-architecture-08
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 04 Dec 2018 12:16:06 -0000

Tiru, 

We don't have the same constraints for the data channel compared to those of the signal channel. As such, when a problem is encountered to contact a DOTS server, another server may be used following some local logic (e.g., sequential through a list). 

I suggest we keep the architecture aligned with the requirements agreed so far by the WG: that is, redirect signaling is only a requirements for the signal channel.

Thank you. 

Cheers,
Med

> -----Message d'origine-----
> De : Dots [mailto:dots-bounces@ietf.org] De la part de Konda, Tirumaleswar
> Reddy
> Envoyé : lundi 3 décembre 2018 15:39
> À : BOUCADAIR Mohamed TGI/OLN; Roman Danyliw; dots@ietf.org
> Objet : Re: [Dots] WGLC on draft-ietf-dots-architecture-08
> 
> > -----Original Message-----
> > From: mohamed.boucadair@orange.com <mohamed.boucadair@orange.com>
> > Sent: Monday, December 3, 2018 5:50 PM
> > To: Konda, Tirumaleswar Reddy <TirumaleswarReddy_Konda@McAfee.com>;
> > Roman Danyliw <rdd@cert.org>; dots@ietf.org
> > Subject: RE: WGLC on draft-ietf-dots-architecture-08
> >
> > This email originated from outside of the organization. Do not click links
> or
> > open attachments unless you recognize the sender and know the content is
> safe.
> >
> > Re-,
> >
> > OK.
> >
> > As per redirected signaling, the WG has only this requirement for the
> signal
> > channel (SIG-005).
> 
> SIG-005 is explicitly discussing redirected signaling because of the attack
> condition.
> I don't see a reason why redirect signaling is not applicable to DOTS data
> channel to increase the DOTS server
> operational flexibility and scalability.
> 
> -Tiru
> 
> >
> > Cheers,
> > Med
> >
> > > -----Message d'origine-----
> > > De : Dots [mailto:dots-bounces@ietf.org] De la part de Konda,
> > > Tirumaleswar Reddy Envoyé : lundi 3 décembre 2018 12:18 À : BOUCADAIR
> > > Mohamed TGI/OLN; Roman Danyliw; dots@ietf.org Objet : Re: [Dots] WGLC
> > > on draft-ietf-dots-architecture-08
> > >
> > > Thanks Med, update looks good; just one Nit Redirected signaling is
> > > also applicable to DOTS data channel (replace "DOTS signal channel
> > > session" with "DOTS session").
> > >
> > > -Tiru
> > >
> > > > -----Original Message-----
> > > > From: mohamed.boucadair@orange.com
> > <mohamed.boucadair@orange.com>
> > > > Sent: Monday, December 3, 2018 12:17 PM
> > > > To: Konda, Tirumaleswar Reddy
> > <TirumaleswarReddy_Konda@McAfee.com>;
> > > > Roman Danyliw <rdd@cert.org>; dots@ietf.org
> > > > Subject: RE: WGLC on draft-ietf-dots-architecture-08
> > > >
> > > >
> > > >
> > > > Hi Tiru,
> > > >
> > > > I updated the file to take into account your feedback:
> > > >
> > > > Xml:
> > > > https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/draft-
> > > ietf-
> > > > dots-architecture-09.xml
> > > > Diff: https://github.com/boucadair/IETF-Drafts-
> > > > Reviews/blob/master/wdiff%20draft-ietf-dots-architecture-09.txt%20dr
> > > > aft-
> > > ietf-
> > > > dots-architecture-09.pdf
> > > >
> > > > Cheers,
> > > > Med
> > > >
> > > > > -----Message d'origine-----
> > > > > De : Dots [mailto:dots-bounces@ietf.org] De la part de Konda,
> > > > > Tirumaleswar Reddy Envoyé : vendredi 30 novembre 2018 17:14 À :
> > > > > BOUCADAIR Mohamed TGI/OLN; Roman Danyliw; dots@ietf.org Objet :
> > Re:
> > > > > [Dots] WGLC on draft-ietf-dots-architecture-08
> > > > >
> > > > > Hi Med,
> > > > >
> > > > > I don't fully agree with some of the updates.  I propose the
> > > > > following
> > > > > changes:
> > > > >
> > > > > [1] Replace " A DOTS session can be a DOTS data channel session or
> > > > > a DOTS signal channel session" with "A DOTS session can be a DOTS
> > > > > data channel session or a DOTS signal channel session or both."
> > > > > [2] I thought we agreed to say the following:
> > > > > A DOTS signal channel session is associated with a single
> > > > > transport connection (TCP or UDP session) and an ephemeral
> > > > > security association (e.g. a TLS or DTLS session). Similarly,  a
> > > > > DOTS data channel session is associated with a single TCP
> > > > > connection and an ephemeral TLS security
> > > > association.
> > > > > [3] Direct and recursive signaling is applicable to both DOTS
> > > > > signal and data channel sessions, replace "DOTS signal channel
> > > > > session" with
> > > "DOTS
> > > > session".
> > > > > [4] In Section 3.1.2, replace "session" with "DOTS session"
> > > > > [5] Remove the following line:
> > > > > "These sessions may belong to the same or distinct DOTS channels
> > > > > (signal or data).
> > > > >
> > > > > Cheers,
> > > > > -Tiru
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: mohamed.boucadair@orange.com
> > > > <mohamed.boucadair@orange.com>
> > > > > > Sent: Friday, November 30, 2018 5:40 PM
> > > > > > To: Konda, Tirumaleswar Reddy
> > > > <TirumaleswarReddy_Konda@McAfee.com>;
> > > > > > Roman Danyliw <rdd@cert.org>; dots@ietf.org
> > > > > > Subject: RE: WGLC on draft-ietf-dots-architecture-08
> > > > > >
> > > > > > This email originated from outside of the organization. Do not
> > > > > > click links
> > > > > or
> > > > > > open attachments unless you recognize the sender and know the
> > > > > > content is
> > > > > safe.
> > > > > >
> > > > > > Re-,
> > > > > >
> > > > > > OK. Thanks.
> > > > > >
> > > > > > FWIW, I also made on my side some changes that I'd like to see
> > > > > > made to fix
> > > > > the
> > > > > > issues we discussed so far:
> > > > > >
> > > > > > Xml:
> > > > > > https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/dra
> > > > > > ft-
> > > > > ietf-
> > > > > > dots-architecture-09.xml
> > > > > > Diff: https://github.com/boucadair/IETF-Drafts-
> > > > > > Reviews/blob/master/wdiff%20draft-ietf-dots-architecture-09.txt%
> > > > > > 20dr
> > > > > > aft-
> > > > > ietf-
> > > > > > dots-architecture-09.pdf
> > > > > >
> > > > > > Feel free to reuse the modified version.
> > > > > >
> > > > > > (Removing parts that were agreed and focusing on the last
> > > > > > pending
> > > > > > one)
> > > > > >
> > > > > > > > > >
> > > > > > > > > > > DOTS data channel draft is not using the term "DOTS
> > > > > > > > > > > data channel session", we can fix the signal channel
> > > > > > > > > > > draft to use "DOTS data channel" instead of "DOTS data
> > > > > > > > > > > channel
> > > session".
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > [Med] May be. BTW, this part of the text:
> > > > > > > > > >
> > > > > > > > > > " Conversely, a
> > > > > > > > > >    DOTS session cannot exist without an established
> > > > > > > > > > signal channel
> > > > > "
> > > > > > > > > >
> > > > > > > > > > is conflicting with this one:
> > > > > > > > > >
> > > > > > > > > > "
> > > > > > > > > > To allow for DOTS
> > > > > > > > > >    service flexibility, neither the order of contact nor
> > > > > > > > > > the
> > > time
> > > > > > > > > >    interval between channel creations is specified.  A
> > > > > > > > > > DOTS client
> > > > > MAY
> > > > > > > > > >    establish signal channel first, and then data
> > > > > > > > > > channel, or vice
> > > > > > > versa."
> > > > > > > >
> > > > > > > > [Med] This one is still pending.
> > > > > > >
> > > > > > > The above line looks clear to me, what is the confusion ?
> > > > > > >
> > > > > >
> > > > > > [Med] The problem is not with the last line with this one:
> > > > > >
> > > > > > "DOTS session cannot exist without an established signal channel"
> > > > > >
> > > > > > Which means that dots signal channel session is a pre-requisite
> > > > > > for DOTS
> > > > > data
> > > > > > channel. This is conflict with the other excerpt I cited.
> > > > > _______________________________________________
> > > > > Dots mailing list
> > > > > Dots@ietf.org
> > > > > https://www.ietf.org/mailman/listinfo/dots
> > > _______________________________________________
> > > Dots mailing list
> > > Dots@ietf.org
> > > https://www.ietf.org/mailman/listinfo/dots
> _______________________________________________
> Dots mailing list
> Dots@ietf.org
> https://www.ietf.org/mailman/listinfo/dots