Re: [Dots] Yangdoctors last call review of draft-ietf-dots-signal-call-home-11

mohamed.boucadair@orange.com Wed, 02 December 2020 08:24 UTC

Return-Path: <mohamed.boucadair@orange.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F87A3A0B97; Wed, 2 Dec 2020 00:24:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.118
X-Spam-Level:
X-Spam-Status: No, score=-2.118 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4z3zXeFac5Vt; Wed, 2 Dec 2020 00:24:37 -0800 (PST)
Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.70.36]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A9F13A09F1; Wed, 2 Dec 2020 00:24:34 -0800 (PST)
Received: from opfednr05.francetelecom.fr (unknown [xx.xx.xx.69]) by opfednr25.francetelecom.fr (ESMTP service) with ESMTP id 4CmBpS4XRfzCqvZ; Wed, 2 Dec 2020 09:24:32 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1606897472; bh=NBVT/ryZwCOGXQ3+STQsIc4hqg0EZM74+/8/N+Vim3M=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version; b=AtNAXW1bLcGjT85TF+Mx8rj7L/wFsBqz4KQmqS4vG4uahWkuY0X2r88qazypgc4qK hn1YxiguLfjR0Z628GlztcVxId2EWD0d8+vGoSV0mXZ5+H14gID2PFbZxeIUFeXOCt yLczkNCuAvGMhWeajVlFuVpa/bNBguVF2L6YxQeqktmfNgVTfrszIbxDW7DotGqVHR 3xGyXufrF077Q8ywjvmPW2ORf3W0iRbAMmxd+eIx/Y4+18uf35DYFKdUxhsF+q6kQQ 86vjvZNMVrGRwTCcOVgK3NLG22euy//aRBGNIJUNgvCC5fqvwT+0rcXDjIZxMtnZZd oCRxy6T7V//xA==
Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.45]) by opfednr05.francetelecom.fr (ESMTP service) with ESMTP id 4CmBpS3DLTzyQN; Wed, 2 Dec 2020 09:24:32 +0100 (CET)
From: <mohamed.boucadair@orange.com>
To: Ebben Aries <ebben.aries@nokia.com>, "yang-doctors@ietf.org" <yang-doctors@ietf.org>
CC: "last-call@ietf.org" <last-call@ietf.org>, "dots@ietf.org" <dots@ietf.org>, "draft-ietf-dots-signal-call-home.all@ietf.org" <draft-ietf-dots-signal-call-home.all@ietf.org>
Thread-Topic: Yangdoctors last call review of draft-ietf-dots-signal-call-home-11
Thread-Index: AQHWyFDypo2ub2EOoEeUMFmG0Z4QvanjV/ZQ
Date: Wed, 2 Dec 2020 08:24:32 +0000
Message-ID: <26007_1606897472_5FC74F40_26007_281_3_787AE7BB302AE849A7480A190F8B9330315947A3@OPEXCAUBMA2.corporate.adroot.infra.ftgroup>
References: <160687530080.19371.6938919650571126245@ietfa.amsl.com>
In-Reply-To: <160687530080.19371.6938919650571126245@ietfa.amsl.com>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.114.13.247]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/mSTeH2Cbj572s29zWfTGXbDJXm8>
Subject: Re: [Dots] Yangdoctors last call review of draft-ietf-dots-signal-call-home-11
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Dec 2020 08:24:40 -0000

Hi Ebben, 

Many thanks for the comments. 

Please see inline. 

Cheers,
Med

> -----Message d'origine-----
> De : Ebben Aries via Datatracker [mailto:noreply@ietf.org]
> Envoyé : mercredi 2 décembre 2020 03:15
> À : yang-doctors@ietf.org
> Cc : last-call@ietf.org; dots@ietf.org; draft-ietf-dots-signal-call-
> home.all@ietf.org
> Objet : Yangdoctors last call review of draft-ietf-dots-signal-call-
> home-11
> 
> Reviewer: Ebben Aries
> Review result: Almost Ready
> 
> 1 module in this draft:
> - ietf-dots-call-home@2020-10-15.yang
> 
> YANG compiler errors or warnings (pyang 2.4.0, yanglint 1.9.2)
> - No compiler errors or warnings however pyang 2.4.0 is currently
> the only
>   compiler verified to emit YANG sx:structure data in tree format.
> Instance
>   data could not yet easily be validated given the current
> linters/compilers.
> 
> General comments/clarifications on the draft/modules:
> ------------------------------------------------------
> - My first thoughts after reading through the draft is some use of
> terminology
>   that I find confusing or rather need some clarification.  This
> draft
>   reverses the TCP/TLS or DTLS connection initiation but the DOTS
> roles of
>   client/server remain the same.  If that is the case, then I ask
> why does the
>   terminology need to deviate that of the DOTS signal channel
> terminology to
>   make use of 'Call Home DOTS client' and 'Call Home DOTS server'
> (Starting in
>   Section 1.2)?

[Med] We used to have the same terminology in previous versions but reviewers were confused about that, which is a fair comment BTW for the following reasons:
* the differences about how the sessions are established and maintained (heartbeats). 
* the base reference architecture is different from the on in RFC8811.
* the call home can be used with or without the base signal channel. 
* the checks done by a "DOTS client/server" in the base spec are not the same as those in the call home.

To address these comments, we went with the current terminology in the draft. This terminology has the advantage to help to better articulate the co-existence considerations (see Section 4).  

> 
> - Regarding 'redirected-signal' for alternate call home clients.
> 
>   What occurs if 'alt-ch-client-record' is populated with a list of
> IP
>   addresses in addition to the mandatory 'alt-ch-client' FQDN?

[Med] The old session is closed and a new one is established with the alternate call home client.

  If
> DTLS or TLS
>   connections are unable to be satisfied to the client after the PUT
> request,
>   is there any sort of fallback when the TTL cache expires?

[Med] Yes. This is covered by this text: 
"The processing of the TTL is defined in Section 4.6 of [I-D.ietf-dots-rfc8782-bis]."

+ Section 4.6 of rfc8782-bis says the following: 

   This fallback mechanism is triggered immediately upon
   expiry of the TTL, except when a DDoS attack is active. 

  From
> what I
>   gather, the 'alt-ch-client-record' takes precedence over resolving
> the
>   mandatory FQDN attribute and/or acts like a static host record
> should both
>   be encapsulated in the PUT request.

[Med] Yes. One of the reasons for this design is discussed in Section 4.6 of [I-D.ietf-dots-rfc8782-bis]:

   During a DDoS attack, the DNS server may be the target of another
   DDoS attack, the alternate DOTS server's IP addresses conveyed in the
   5.03 response help the DOTS client skip the DNS lookup of the
   alternate DOTS server, at the cost of trusting the first DOTS server
   to provide accurate information. 

> 
> - Regarding the structure augment of 'source' nodes.  It seems to me
> (and this
>   may be a misinterpretation) that this is not entirely specific to
> 'call
>   home'.

[Med] I confirm. This is explicitly mentioned in the draft: 

"This is an optional attribute for the base DOTS signal channel operations."

  Is there any reason why these nodes do not exist directly
> in
>   rfc8782-bis or can you help clarify why this is specific to this
> scenario
>   only?

[Med] This was on purpose. RFC8782 was scoped to convey the minimal required information to seek for mitigation. We don't change that scope in 8782-bis.  

> 
> 
> Module ietf-dots-call-home:
> ------------------------------------------------------
> - Node 'alt-ch-client' is targeted to represent a FQDN with a loose
> string
>   type.  Should this rather be of type 'inet:domain-name'?

[Med] Good catch. Will be fixed. 

  Looking
> at other
>   usage among dots related modeling is mixed between the 2 types for
>   representing a FQDN so this comment can also apply to my alternate
> dots YD
>   review.

[Med] We are using inet:domain-name for target-fqdn but not alt-server. Will fix that as well. 

> 
> Overall, from a YANG module/structure standpoint it appears on the
> right track for complementing the 'ietf-dots-signal-channel' module
> and see no major issues.
> 

[Med] Thank you for your careful review. 



_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.