Re: [Dots] I-D Action: draft-ietf-dots-signal-channel-29.txt

["Konda, Tirumaleswar Reddy" <[e-mail]>]

> -----Original Message-----
> From: [e-mail] <[e-mail]>
> Sent: Thursday, February 28, 2019 2:45 PM
> To: Konda, Tirumaleswar Reddy <[e-mail]>
> Cc: [e-mail]
> Subject: RE: [Dots] I-D Action: draft-ietf-dots-signal-channel-29.txt
> 
> 
> 
> Hi Tiru,
> 
> 'idle' time is not when no attack traffic is present, but when no attack
> mitigation is active. We have drawn this distinction in -15.
> 
> The idle and mitigation times are introduced in the draft. I made this change to
> avoid misinterpretation:
> 
>    The same or distinct configuration sets may be used during times when
>    a mitigation is active ('mitigating-config') and when no mitigation
>    is active ('idle-config').  This is particularly useful for DOTS
>    servers that might want to reduce heartbeat frequency or cease
>    heartbeat exchanges when an active DOTS client has not requested
>    mitigation.  If distinct configurations are used, DOTS agents MUST
>    follow the appropriate configuration set as a function of the
>    mitigation activity (e.g., if no mitigation request is active (also
>                                                                  ^^^^^^
>    referred to as 'idle' time), 'idle-config'-related values must be
>    ^^^^^^^^^^^^^^^^^^^^^^^^^^
>    followed).  Additionally, DOTS agents MUST automatically switch to
>    the other configuration upon a change in the mitigation activity
>    (e.g., if an attack mitigation is launched after an 'idle' time, the
>    DOTS agent switches from 'idle-config' to 'mitigating-config'-related
>    values).
> 
> Better?

Thanks, update looks good.

-Tiru

> 
> Cheers,
> Med
> 
> > -----Message d'origine-----
> > De : Konda, Tirumaleswar Reddy
> > [mailto:[e-mail]]
> > Envoyé : mercredi 27 février 2019 07:56 À : BOUCADAIR Mohamed TGI/OLN
> > Cc : [e-mail] Objet : RE: [Dots] I-D Action:
> > draft-ietf-dots-signal-channel-29.txt
> >
> > Hi Med,
> >
> > Please see inline
> >
> > > -----Original Message-----
> > > From: [e-mail]
> <[e-mail]>
> > > Sent: Tuesday, February 26, 2019 8:42 PM
> > > To: Konda, Tirumaleswar Reddy <[e-mail]>
> > > Cc: [e-mail]
> > > Subject: RE: [Dots] I-D Action:
> > > draft-ietf-dots-signal-channel-29.txt
> > >
> > >
> > >
> > > Hi Tiru,
> > >
> > > Please see inline.
> > >
> > > Cheers,
> > > Med
> > >
> > > > -----Message d'origine-----
> > > > De : Dots [mailto:[e-mail]] De la part de Konda,
> > > > Tirumaleswar Reddy Envoyé : vendredi 22 février 2019 17:20 À :
> > > > [e-mail]; [e-mail] Objet : Re: [Dots] I-D Action:
> > > > draft-ietf-dots-signal-channel-29.txt
> > > >
> > > > Hi Med,
> > > >
> > > > Couple of Nits:
> > > >
> > > > 1)
> > > > OLD:
> > > > Likewise, 'sid' value is
> > > > monotonically increased by the DOTS client for each configuration
> > > > session, attackers replaying configuration requests with lower
> > > > numeric 'sid' values will be rejected by the DOTS server if it
> > > > maintains a higher numeric 'sid' value for this DOTS client.
> > > >
> > > > NEW:
> > > > Likewise, 'sid' value is
> > > > monotonically increased by the DOTS client for each configuration
> > > > request, attackers replaying configuration requests with lower
> > > > numeric 'sid' values will be rejected by the DOTS server if it
> > > > maintains a higher numeric 'sid' value for this DOTS client.
> > > >
> > >
> > > [Med] OK for s/session/request.
> > >
> > > > 2)
> > > > Define 'idle' time (i.e. when no attack traffic is present).
> > >
> > > [Med] This one is not needed, IMHO. We do already have the following
> > > in the
> > > draft:
> > >
> > >    The same or distinct configuration sets may be used during times when
> > >                                                               ^^^^^^^^^^
> > >    a mitigation is active ('mitigating-config') and when no
> > > mitigation
> > >
> > >
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > ^^^^
> > >    is active ('idle-config').  This is particularly useful for DOTS
> > >    ^^^^^^^^^^^^^^^^^
> >
> > The above lines do not define the term 'idle'.
> > We just have to append "(i.e. when no attack traffic is present)" to 'idle'
> > time.
> >
> > Cheers,
> > -Tiru
> >
> > >    servers that might want to reduce heartbeat frequency or cease
> > >    heartbeat exchanges when an active DOTS client has not requested
> > >    mitigation.  If distinct configurations are used, DOTS agents MUST
> > >    follow the appropriate configuration set as a function of the
> > >    mitigation activity (e.g., if no mitigation request is active, 'idle-
> > >    config'-related values must be followed).  Additionally, DOTS agents
> > >    MUST automatically switch to the other configuration upon a change in
> > >    the mitigation activity (e.g., if an attack mitigation is launched
> > >    after an 'idle' time, the DOTS agent switches from 'idle-config' to
> > >    'mitigating-config'-related values).
> > >
> > > >
> > > > -Tiru
> > > >
> > > > > -----Original Message-----
> > > > > From: Dots <[e-mail]> On Behalf Of
> > > > > [e-mail]
> > > > > Sent: Friday, February 22, 2019 9:00 PM
> > > > > To: [e-mail]
> > > > > Cc: [e-mail]
> > > > > Subject: [Dots] I-D Action:
> > > > > draft-ietf-dots-signal-channel-29.txt
> > > > >
> > > > > This email originated from outside of the organization. Do not
> > > > > click links
> > > > or
> > > > > open attachments unless you recognize the sender and know the
> > > > > content is
> > > > safe.
> > > > >
> > > > >
> > > > > A New Internet-Draft is available from the on-line
> > > > > Internet-Drafts
> > > > directories.
> > > > > This draft is a work item of the DDoS Open Threat Signaling WG
> > > > > of the
> > IETF.
> > > > >
> > > > >         Title           : Distributed Denial-of-Service Open Threat
> > > > Signaling (DOTS)
> > > > > Signal Channel Specification
> > > > >         Authors         : Tirumaleswar Reddy
> > > > >                           Mohamed Boucadair
> > > > >                           Prashanth Patil
> > > > >                           Andrew Mortensen
> > > > >                           Nik Teague
> > > > > 	Filename        : draft-ietf-dots-signal-channel-29.txt
> > > > > 	Pages           : 99
> > > > > 	Date            : 2019-02-22
> > > > >
> > > > > Abstract:
> > > > >    This document specifies the DOTS signal channel, a protocol for
> > > > >    signaling the need for protection against Distributed Denial-of-
> > > > >    Service (DDoS) attacks to a server capable of enabling network
> > > > >    traffic mitigation on behalf of the requesting client.
> > > > >
> > > > >    A companion document defines the DOTS data channel, a separate
> > > > >    reliable communication layer for DOTS management and
> configuration
> > > > >    purposes.
> > > > >
> > > > > Editorial Note (To be removed by RFC Editor)
> > > > >
> > > > >    Please update these statements within the document with the RFC
> > > > >    number to be assigned to this document:
> > > > >
> > > > >    o  "This version of this YANG module is part of RFC XXXX;"
> > > > >
> > > > >    o  "RFC XXXX: Distributed Denial-of-Service Open Threat Signaling
> > > > >       (DOTS) Signal Channel Specification";
> > > > >
> > > > >    o  "| [RFCXXXX] |"
> > > > >
> > > > >    o  reference: RFC XXXX
> > > > >
> > > > >    Please update this statement with the RFC number to be assigned to
> > > > >    the following documents:
> > > > >
> > > > >    o  "RFC YYYY: Distributed Denial-of-Service Open Threat Signaling
> > > > >       (DOTS) Data Channel Specification (used to be I-D.ietf-dots-data-
> > > > >       channel)
> > > > >
> > > > >    Please update TBD/TBD1/TBD2 statements with the assignments
> made by
> > > > >    IANA to DOTS Signal Channel Protocol.
> > > > >
> > > > >    Also, please update the "revision" date of the YANG modules.
> > > > >
> > > > >
> > > > > The IETF datatracker status page for this draft is:
> > > > > https://datatracker.ietf.org/doc/draft-ietf-dots-signal-channel/
> > > > >
> > > > > There are also htmlized versions available at:
> > > > > https://tools.ietf.org/html/draft-ietf-dots-signal-channel-29
> > > > > https://datatracker.ietf.org/doc/html/draft-ietf-dots-signal-cha
> > > > > nnel
> > > > > -29
> > > > >
> > > > > A diff from the previous version is available at:
> > > > > https://www.ietf.org/rfcdiff?url2=draft-ietf-dots-signal-channel
> > > > > -29
> > > > >
> > > > >
> > > > > Please note that it may take a couple of minutes from the time
> > > > > of
> > > > submission
> > > > > until the htmlized version and diff are available at tools.ietf.org.
> > > > >
> > > > > Internet-Drafts are also available by anonymous FTP at:
> > > > > ftp://ftp.ietf.org/internet-drafts/
> > > > >
> > > > > _______________________________________________
> > > > > Dots mailing list
> > > > > [e-mail]
> > > > > https://www.ietf.org/mailman/listinfo/dots
> > > >
> > > > _______________________________________________
> > > > Dots mailing list
> > > > [e-mail]
> > > > https://www.ietf.org/mailman/listinfo/dots