Re: [Dots] clarification questions from the hackathon

[<[e-mail]>]

Hi Kaname,

Please see inline.

Cheers,
Med

> -----Message d'origine-----
> De : kaname nishizuka [mailto:[e-mail]]
> Envoyé : vendredi 29 mars 2019 10:02
> À : BOUCADAIR Mohamed TGI/OLN; Jon Shallow; [e-mail]
> Objet : Re: [Dots] clarification questions from the hackathon
> 
> Hi,
> 
> please see inline.
> 
> regards,
> Kaname
> 
> On 2019/03/29 4:28, [e-mail] wrote:
> > Re-,
> >
> > Please see inline.
> >
> > Cheers,
> > Med
> >
> >> -----Message d'origine-----
> >> De : Jon Shallow [mailto:[e-mail]]
> >> Envoyé : jeudi 28 mars 2019 18:05
> >> À : BOUCADAIR Mohamed TGI/OLN; kaname nishizuka; [e-mail]
> >> Objet : RE: [Dots] clarification questions from the hackathon
> >>
> >> Hi All,
> >>
> >> See inline
> >>
> >> Regards
> >>
> >> Jon
> >>
> >>> -----Original Message-----
> >>> From: Dots [mailto: [e-mail]] On Behalf Of ietf-
> >>> [e-mail]
> >>> Sent: 28 March 2019 13:39
> >>> To: kaname nishizuka; [e-mail]
> >>> Subject: Re: [Dots] clarification questions from the hackathon
> >>>
> >>> Re-,
> >>>
> >>> Please see inline.
> >>>
> >>> Cheers,
> >>> Med
> >>>
> >>>> -----Message d'origine-----
> >>>> De : Dots [mailto:[e-mail]] De la part de kaname nishizuka
> >>>> Envoyé : jeudi 28 mars 2019 11:38
> >>>> À : [e-mail]
> >>>> Objet : [Dots] clarification questions from the hackathon
> >>>>
> >>>> Hi,
> >>>>
> >>>> I'd like to continue discussion of these topics in the ML.
> >>>>
> >>>> #1: Questions about signal-control-filtering
> >>>>    1. Should a mitigation request create a mitigation before doing a PUT
> +
> >>>> acl-list [{acl-name, activation-type}] against the active mitigation, or
> >> is a
> >>>> ‘PUT + acl-list [{acl-name, activation-type}]’ allowed to create a new
> >>>> mitigation?
> >>> [Med] Both are currently allowed in the draft. I don't still a valid
> reason
> >> to
> >>> restrict this.
> >> [Jon] As per draft
> >>     A DOTS client MUST NOT use the filtering control over DOTS signal
> >>     channel if no attack (mitigation) is active;
> >>
> > [Med] What is meant actually is:
> >
> >     A DOTS client MUST NOT use the filtering control over DOTS signal
> >     channel in 'idle' time;
> >
> > Will update the text.
> >
> [kaname]
> in order to make what I and Jon raised clearer,
> 
>     A DOTS client MUST NOT use the filtering control over DOTS signal
>     channel in 'idle' time.
>     If a mitigation request which includes both valid mitigation scope and
> acl-*
>     for the first time in idle time, it should be treated as it's already in
> attack time.
> 
> Or, simply I'm wondering if it is possible to drop the sentence because acl-*
> is always accompany with a mitigation scope so there is no way to enable it
> by itself in idle time?
> 

[Med] I prefer to leave the sentence because it was added to address a comment from Franck. He was concerned with the use of the feature when no attack is ongoing. That text does make that clear. 

I updated it as follows:

   A DOTS client MUST NOT use the filtering control over DOTS signal
   channel in 'idle' time; such requests MUST be discarded by the DOTS
   server with 4.00 (Bad Request).  By default, ACL-related operations
   are achieved using the DOTS data channel [I-D.ietf-dots-data-channel]
   when no attack is ongoing.