Re: [Dots] Adoption call for draft-reddy-dots-home-network-04
"Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com> Wed, 24 April 2019 12:56 UTC
Return-Path: <TirumaleswarReddy_Konda@mcafee.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C272F120045; Wed, 24 Apr 2019 05:56:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.301
X-Spam-Level:
X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DyOubttZFQ44; Wed, 24 Apr 2019 05:56:16 -0700 (PDT)
Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CAF30120019; Wed, 24 Apr 2019 05:56:15 -0700 (PDT)
X-NAI-Header: Modified by McAfee Email Gateway (5500)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1556110201; h=From: To:CC:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:authentication-results: x-originating-ip:x-ms-publictraffictype:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: x-microsoft-antispam-prvs:x-forefront-prvs: x-forefront-antispam-report:received-spf:x-ms-exchange-senderadcheck: x-microsoft-antispam-message-info:Content-Type: Content-Transfer-Encoding:MIME-Version:X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-CrossTenant-mailboxtype: X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Level: X-NAI-Spam-Threshold:X-NAI-Spam-Score:X-NAI-Spam-Version; bh=9bQiZBk9TzM6q2LHSfJYXQpGVR05KBcTAUI2Uy ed9NE=; b=Kvp9h6JzXuEf+xA47UcpRQZktfvSekOXdtAW54To xBFEhmMGibiNIwY2b6JFAelZ5+sAF1umNpjEg5kD8YjgL515DK +hy11TJW/SvLJnDtuiu00SKkFJxVRVY5ULvKSCrWfheLPyn1LN 4Wi19FwPBsCfgceGq/jrxvSw/Npz59M=
Received: from DNVEXAPP1N05.corpzone.internalzone.com (unknown [10.44.48.89]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 05c4_3067_b9c9d57d_f11a_4c2e_92e2_431cfb49d7a6; Wed, 24 Apr 2019 06:50:00 -0600
Received: from DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 24 Apr 2019 06:55:32 -0600
Received: from DNVO365EDGE2.corpzone.internalzone.com (10.44.176.74) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Wed, 24 Apr 2019 06:55:32 -0600
Received: from NAM05-DM3-obe.outbound.protection.outlook.com (10.44.176.241) by edge.mcafee.com (10.44.176.74) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 24 Apr 2019 06:55:31 -0600
Received: from BYAPR16MB2790.namprd16.prod.outlook.com (20.178.233.91) by BYAPR16MB2645.namprd16.prod.outlook.com (20.177.228.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1813.16; Wed, 24 Apr 2019 12:55:30 +0000
Received: from BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::4873:7200:9e57:9e62]) by BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::4873:7200:9e57:9e62%5]) with mapi id 15.20.1813.017; Wed, 24 Apr 2019 12:55:30 +0000
From: "Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com>
To: "mohamed.boucadair@orange.com" <mohamed.boucadair@orange.com>, Valery Smyslov <valery@smyslov.net>, "dots@ietf.org" <dots@ietf.org>
CC: "dots-chairs@ietf.org" <dots-chairs@ietf.org>, "kaduk@mit.edu" <kaduk@mit.edu>
Thread-Topic: [Dots] Adoption call for draft-reddy-dots-home-network-04
Thread-Index: AdTuHVZNyfDh6IMnTiyfhZP8vM2pOAMPXcMAAAHlewAAACVi8AABQijQAAj4x4AAAJCXsAADitfg
Date: Wed, 24 Apr 2019 12:55:30 +0000
Message-ID: <BYAPR16MB27902B9175E96A2062D06E83EA3C0@BYAPR16MB2790.namprd16.prod.outlook.com>
References: <023d01d4ee1f$c2bcb190$483614b0$@smyslov.net> <019001d4fa5a$cf08fb60$6d1af220$@smyslov.net> <787AE7BB302AE849A7480A190F8B93302EA648E7@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <BYAPR16MB27907ABC5E91DD572EBE7807EA3C0@BYAPR16MB2790.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302EA649DB@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <BYAPR16MB2790ED963937C8C15B319F63EA3C0@BYAPR16MB2790.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302EA64C46@OPEXCAUBMA2.corporate.adroot.infra.ftgroup>
In-Reply-To: <787AE7BB302AE849A7480A190F8B93302EA64C46@OPEXCAUBMA2.corporate.adroot.infra.ftgroup>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
dlp-product: dlpe-windows
dlp-version: 11.2.0.6
dlp-reaction: no-action
authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com;
x-originating-ip: [49.37.205.191]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 8bcbb0b4-4c4d-4dcd-718c-08d6c8b421b3
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:BYAPR16MB2645;
x-ms-traffictypediagnostic: BYAPR16MB2645:
x-microsoft-antispam-prvs: <BYAPR16MB2645D02881E781CEC722A274EA3C0@BYAPR16MB2645.namprd16.prod.outlook.com>
x-forefront-prvs: 00179089FD
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(39860400002)(376002)(396003)(366004)(136003)(32952001)(199004)(13464003)(189003)(229853002)(6506007)(256004)(53936002)(14444005)(11346002)(6246003)(25786009)(9686003)(5024004)(55016002)(52536014)(86362001)(2501003)(14454004)(446003)(6116002)(66476007)(478600001)(66946007)(76116006)(66446008)(72206003)(6436002)(71200400001)(64756008)(66556008)(2906002)(73956011)(3846002)(4326008)(71190400001)(8676002)(81166006)(33656002)(5660300002)(76176011)(66066001)(186003)(68736007)(99286004)(81156014)(53546011)(93886005)(80792005)(7736002)(486006)(316002)(110136005)(26005)(102836004)(305945005)(8936002)(97736004)(476003)(74316002)(54906003)(7696005)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR16MB2645; H:BYAPR16MB2790.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: pIGhHbx/KW5n7bSkflEQERYhY1HIbMkqRXrj0EL6wevfx/C5KPchalZJSd1ODrdHsXSI3uIOM2p4CXfZ+DrJ5k4WnT6hfhKSTeJMQvgX2iAGh2FPPYWy52OoRgbhp05jL75dUlvnGjs6403hDMFeJle28xFdAgf7Chsji8BQR20vpl80rFglwiZ7i9mfhksDU/RlFs0KqyEIMHN53dNJJrtMAF/meN/Raypfwv3eG3fBbEVcavE0NFbDi90Hh7zBSC6I2aiYX3v9iEzalPINkY2yXcKLSS8TaJEuYqoee+vTw0FdDpAyPLBHVqTZT2SMt3EcCziMF/pRc0Gs24IM9WRsAmVBlYyDDZox/BPmxGW1zZaUW++rjDVI84BahgZfZLAr179MCmdgcYIQDkW/d1pRtNPZk0W+xEc/UHNvx20=
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 8bcbb0b4-4c4d-4dcd-718c-08d6c8b421b3
X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Apr 2019 12:55:30.3319 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR16MB2645
X-OriginatorOrg: mcafee.com
X-NAI-Spam-Flag: NO
X-NAI-Spam-Level:
X-NAI-Spam-Threshold: 15
X-NAI-Spam-Score: 0.2
X-NAI-Spam-Version: 2.3.0.9418 : core <6531> : inlines <7059> : streams <1819590> : uri <2836499>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/vK7lRRLPUakYEIjx8jaJSkUSMFE>
Subject: Re: [Dots] Adoption call for draft-reddy-dots-home-network-04
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 24 Apr 2019 12:56:19 -0000
> -----Original Message----- > From: mohamed.boucadair@orange.com > <mohamed.boucadair@orange.com> > Sent: Wednesday, April 24, 2019 4:48 PM > To: Konda, Tirumaleswar Reddy > <TirumaleswarReddy_Konda@McAfee.com>; Valery Smyslov > <valery@smyslov.net>; dots@ietf.org > Cc: dots-chairs@ietf.org; kaduk@mit.edu > Subject: RE: [Dots] Adoption call for draft-reddy-dots-home-network-04 > > This email originated from outside of the organization. Do not click links or > open attachments unless you recognize the sender and know the content is > safe. > > Re-, > > Please see inline. > > Cheers, > Med > > > -----Message d'origine----- > > De : Konda, Tirumaleswar Reddy > > [mailto:TirumaleswarReddy_Konda@McAfee.com] > > Envoyé : mercredi 24 avril 2019 13:01 > > À : BOUCADAIR Mohamed TGI/OLN; Valery Smyslov; dots@ietf.org Cc : > > dots-chairs@ietf.org; kaduk@mit.edu Objet : RE: [Dots] Adoption call > > for draft-reddy-dots-home-network-04 > > > > > -----Original Message----- > > > From: mohamed.boucadair@orange.com > > > <mohamed.boucadair@orange.com> > > > Sent: Wednesday, April 24, 2019 12:18 PM > > > To: Konda, Tirumaleswar Reddy > > > <TirumaleswarReddy_Konda@McAfee.com>; Valery Smyslov > > > <valery@smyslov.net>; dots@ietf.org > > > Cc: dots-chairs@ietf.org; kaduk@mit.edu > > > Subject: RE: [Dots] Adoption call for > > > draft-reddy-dots-home-network-04 > > > > > > > > > > > > Re-, > > > > > > Please see inline. > > > > > > Cheers, > > > Med > > > > > > > -----Message d'origine----- > > > > De : Konda, Tirumaleswar Reddy > > > > [mailto:TirumaleswarReddy_Konda@McAfee.com] > > > > Envoyé : mercredi 24 avril 2019 08:13 À : BOUCADAIR Mohamed > > > > TGI/OLN; Valery Smyslov; dots@ietf.org Cc : > > > > dots-chairs@ietf.org; kaduk@mit.edu Objet : RE: [Dots] Adoption > > > > call for draft-reddy-dots-home-network-04 > > > > > > > > > -----Original Message----- > > > > > From: Dots <dots-bounces@ietf.org> On Behalf Of > > > > > mohamed.boucadair@orange.com > > > > > Sent: Wednesday, April 24, 2019 11:26 AM > > > > > To: Valery Smyslov <valery@smyslov.net>; dots@ietf.org > > > > > Cc: dots-chairs@ietf.org; kaduk@mit.edu > > > > > Subject: Re: [Dots] Adoption call for > > > > > draft-reddy-dots-home-network-04 > > > > > > > > > > This email originated from outside of the organization. Do not > > > > > click links > > > > or > > > > > open attachments unless you recognize the sender and know the > > > > > content is safe. > > > > > > > > > > Re-, > > > > > > > > > > Please see inline. > > > > > > > > > > Cheers, > > > > > Med > > > > > > > > > > > -----Message d'origine----- > > > > > > De : Dots [mailto:dots-bounces@ietf.org] De la part de Valery > > > > > > Smyslov Envoyé : mercredi 24 avril 2019 07:02 À : dots@ietf.org Cc : > > > > > > dots-chairs@ietf.org; kaduk@mit.edu Objet : Re: [Dots] > > > > > > Adoption call for draft-reddy-dots-home-network-04 > > > > > > > > > > > > Hi, > > > > > > > > > > > > we received a lot of replies supporting adoption of the document. > > > > > > So, the document is adopted. Authors, please re-submit it as > > > > > > WG > > draft. > > > > > > > > > > > > A couple of comments. > > > > > > 1. The draft uses few times a keyword "MAY NOT". This > > > > > > combination is > > > not > > > > > > among the list of RFC requirement keywords (it is not > > > > > > listed > > neither > > > > > > in RFC2119, nor in RFC8174). If the intent was to use RFC > > > > requirement > > > > > > language, then I'd suggest replacing it with one of MUST > > > > > > NOT, SHALL NOT, > > > > > > SHOULD NOT. Otherwise please make it lowcase. > > > > > > > > > > > > > > > > [Med] Good catch. Fixed. > > > > > > > > > > > 2. When describing transport, the draft allows both TLS and DTLS. > > What > > > > > > makes me confusing is that the draft describes it several > > > > > > times as "TCP/TLS or DTLS". > > > > > > Why TCP is ever mentioned here? We all know that TLS > > > > > > usually runs > > > > over > > > > > > TCP (however we now have QUICK) and DTLS runs over UDP. > > > > > > The way it is presented in the draft makes me think that > > probably > > > > > > plain TCP is also allowed as a transport, but is seems to > > contradict > > > > > > everything I read about DOTS. Am I missing something here? > > > > > > > > > > > > > > > > [Med] Plain TCP is not allowed. The intent was to be explicit > > > > > that there is > > > > a > > > > > reversal in both TCP and TLS layers, but as you rightfully > > > > > raised this may > > > > be > > > > > confusing since, for the DOTS case, it is trivial that the > > > > > reversal of TLS > > > > roles > > > > > implies the reversal of TCP ones. > > > > > > > > RESTCONF call home only reverses the TCP role but not the TLS > > > > role. In DOTS case, the server has to initiate DTLS handshake for > > > > UDP. To keep the roles same for TCP, TLS handshake is also initiated by > the server. > > > > > > [Med] You missed "for the DOTS case" in my previous reply :-) > > > > > > We do have the following in the draft: > > > > > > DOTS DOTS > > > Server Client > > > | | > > > | 1. (D)TLS connection | > > > |----------------------------------->| > > > | 2. Mitigation request | > > > |<-----------------------------------| > > > | | > > > > > > That can be trivially expanded as follows for the TLS case: > > > > > > DOTS DOTS > > > Server Client > > > | | > > > | 1.1. TCP | > > > |----------------------------------->| > > > | 1.2. TLS | > > > |----------------------------------->| > > > | 2. Mitigation request | > > > |<-----------------------------------| > > > | | > > > > Okay. > > > > > > > > > > > As mentioned earlier, the use of TCP/TLS is OK but it may be > > > confusing as initially raised by Valery. > > > > The updated text is not accurate if TCP is not covered, role reversal > > at TLS does not mean role reversal at TCP. > > [Med] The updated text is still fine (ref to Figure 1). We don't have any > ambiguity in the procedure part with regards to TCP. We explicitly say the > following: > > If TCP is used, the DOTS server begins by initiating a TCP > connection to the DOTS client. The DOTS client MUST support > accepting TCP connections on the IANA-assigned port number > defined in Section 4.1, but MAY be configured to listen to a > different port number. Using this TCP connection, the DOTS > server initiates a TLS connection to the DOTS client. > > > Similar to (D)TLS, I prefer explicit text to say role reversal at TCP. > > [Med] We already have such text (see the above excerpt). [TR] Yes, but the updated sentences are incomplete/incorrect at various places. I have listed one of the inconsistencies below The one and only role reversal that occurs are at the TLS or DTLS layers; that is, the DOTS server acts as a DTLS client and the DOTS client acts as a DTLS server or the DOTS server acts as a TLS client and the DOTS client acts as a TLS server. The DOTS server initiates TLS handshake or DTLS handshake to the DOTS client. The above update means no role reversal at the TCP layer ! -Tiru > > The > > security considerations section says " DOTS agents MUST authenticate > > each other using (D)TLS before a DOTS signal channel session is > > considered valid.", so clear text DOTS traffic is ruled out. > > [Med] Fully agree.
- [Dots] Adoption call for draft-reddy-dots-home-ne… Valery Smyslov
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Teague, Nik
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Jon Shallow
- Re: [Dots] Adoption call for draft-reddy-dots-hom… 林 裕平
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Prashanth Patil (praspati)
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Andrew Mortensen
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Panwei (William)
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Daniel Migault
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Dan Wing
- Re: [Dots] Adoption call for draft-reddy-dots-hom… MeiLing Chen
- Re: [Dots] Adoption call for draft-reddy-dots-hom… mohamed.boucadair
- Re: [Dots] Adoption call for draft-reddy-dots-hom… kaname nishizuka
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Konda, Tirumaleswar Reddy
- Re: [Dots] Adoption call for draft-reddy-dots-hom… mohamed.boucadair
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Konda, Tirumaleswar Reddy
- Re: [Dots] Adoption call for draft-reddy-dots-hom… mohamed.boucadair
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Valery Smyslov
- Re: [Dots] Adoption call for draft-reddy-dots-hom… mohamed.boucadair
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Konda, Tirumaleswar Reddy
- Re: [Dots] Adoption call for draft-reddy-dots-hom… mohamed.boucadair
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Konda, Tirumaleswar Reddy
- Re: [Dots] Adoption call for draft-reddy-dots-hom… mohamed.boucadair
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Konda, Tirumaleswar Reddy
- Re: [Dots] Adoption call for draft-reddy-dots-hom… mohamed.boucadair
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Konda, Tirumaleswar Reddy
- Re: [Dots] Adoption call for draft-reddy-dots-hom… mohamed.boucadair
- Re: [Dots] Adoption call for draft-reddy-dots-hom… mohamed.boucadair
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Jon Shallow
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Konda, Tirumaleswar Reddy
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Konda, Tirumaleswar Reddy
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Jon Shallow
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Konda, Tirumaleswar Reddy
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Daniel Migault
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Daniel Migault
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Daniel Migault
- Re: [Dots] Adoption call for draft-reddy-dots-hom… mohamed.boucadair
- Re: [Dots] Adoption call for draft-reddy-dots-hom… Daniel Migault