Re: [Dots] clarification questions from the hackathon

Re-, 

Please see inline. 

Cheers,
Med

> -----Message d'origine-----
> De : Dots [mailto:dots-bounces@ietf.org] De la part de kaname nishizuka
> Envoyé : jeudi 28 mars 2019 11:38
> À : dots@ietf.org
> Objet : [Dots] clarification questions from the hackathon
> 
> Hi,
> 
> I'd like to continue discussion of these topics in the ML.
> 
> #1: Questions about signal-control-filtering
>   1. Should a mitigation request create a mitigation before doing a PUT +
> acl-list [{acl-name, activation-type}] against the active mitigation, or is a
> ‘PUT + acl-list [{acl-name, activation-type}]’ allowed to create a new
> mitigation?

[Med] Both are currently allowed in the draft. I don't still a valid reason to restrict this. 

>   2. Should the response to a GET (or Observed GET) include the acl-list
> [{acl-name, activation-type}] if the PUT included it?

[Med] The current spec says "no". That's said, what would be the value in returning it? Then, why not allowing to return the references to all ACLs that are enabled during the mitigation time?

>   3. Does the response to the PUT (the echoed back response payload of the
> PUT representation https://tools.ietf.org/html/rfc7252#section-5.9.1.1 )
> include the acl-list (if defined) or not?

[Med] It doesn't as we don't change the behavior of the base spec.

>   4. Is the activation change to the ACL a permanent change to the ACL (so a
> GET on the data channel returns the new type)?

[Med] Yes. The draft will be updated to make this clearer. 

>   5. Does the activation change to the ACL count as an ACL refresh (pending-
> lifetime update)?

[Med] Yes. Some text will be added to clarify the refresh point. That's said, as discussed in the data-channel, the dots client may need to send a GET after an attack for sync purposes.

>   6. Is CBOR activation –type comprehension-required or comprehension-
> optional?
> 

[Med] This is a comprehension-required attribute (already discussed in the draft).

> Regarding with the 1st point, we got feedbacks from Med and Tiru that both
> should be allowed.
> If ‘PUT + acl-list [{acl-name, activation-type}]’ allowed to create a new
> mitigation, it should be treated as this is a request in "attack-time".

[Med] I confirm.

> 
> (#2: Data Channel Implicit protocol number was addressed clearly by Med's
> comment.)
> 
> #3: (D)TLS session lifetime
>  From the view point of DOTS server, when to expire the old (D)TLS session is
> implementation specific though, I'd like to hear from experts about
> preferable setting (timer or something else...?)
> 

[Med] For me, this is implementation-specific.  

> thanks,

[Med] Many thanks for sharing the feedback from the hackathon. Much appreciated. 

> Kaname
> 
> _______________________________________________
> Dots mailing list
> Dots@ietf.org
> https://www.ietf.org/mailman/listinfo/dots