Subject: [Dots] draft-ietf-dots-data-channel: Filter Activation

From: <[email-masked]>
Date: Wed, 14 Feb 2018 08:17:46 +0000

Hi all,

As agreed during the interim, there are some issues that need fixes in the data-channel spec. We would like to hear from the WG to know what to record in the document.

Issue description: Do we assume that all filtering rules, communicated by DOTS clients, are activated by default or only when a mitigation is active?

Below a proposal for discussion:

-    We should support both:

o    Immediate activation is useful in deployment cases where filtering is used to anticipate some attacks and therefore avoid that access resources are abused when an attack become effective. This is typically the case where DOTS server is deployed by access providers.

o    The reasoning may not be the same if the DOTS service is on the cloud.

-    The intended action will be governed by a new attribute called "activation-type" which can be set to "immediate" or "mitigation-time". This parameter will be supplied by a DOTS client in a filter creation request.

-    Which default value to use if no "activation-type" is supplied by a client?

Please comment.

Cheers,

Med

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 15 Feb 2018 15:42:23 +0000

I agree with the proposal. In most use cases during peace time, the DOTS client can enforce the black-list/white-list filtering rules in its domain, so the default value of "mitigation-time" for the activation-type.

Cheers,
-Tiru
From: Dots [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, February 14, 2018 1:48 PM
To: [email-masked]
Subject: [Dots] draft-ietf-dots-data-channel: Filter Activation

Hi all,

Please comment.

Cheers,

Med

---

From: "Jon Shallow" <[email-masked]>
Date: Fri, 16 Feb 2018 12:33:23 -0000

I also agree with the proposal for the default of "mitigation-time".

However, when "immediate" is used, is this to be client specific, or across
globally the whole of the domain?

- this effects how the destination prefix is going to be checked /
instantiated.

Regards

Jon

From: Dots [mailto: [email-masked]] On Behalf Of Konda, Tirumaleswar
Reddy
Sent: 15 February 2018 15:42
To: [email-masked]; [email-masked]
Subject: Re: [Dots] draft-ietf-dots-data-channel: Filter Activation

I agree with the proposal. In most use cases during peace time, the DOTS
client can enforce the black-list/white-list filtering rules in its domain,
so the default value of "mitigation-time" for the activation-type. 

Cheers,

-Tiru

From: Dots [mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Wednesday, February 14, 2018 1:48 PM
To: [email-masked]
Subject: [Dots] draft-ietf-dots-data-channel: Filter Activation

Hi all, 

As agreed during the interim, there are some issues that need fixes in the
data-channel spec. We would like to hear from the WG to know what to record
in the document. 

Issue description: Do we assume that all filtering rules, communicated by
DOTS clients, are activated by default or only when a mitigation is active?

o    Immediate activation is useful in deployment cases where filtering is
used to anticipate some attacks and therefore avoid that access resources
are abused when an attack become effective. This is typically the case where
DOTS server is deployed by access providers. 

-    The intended action will be governed by a new attribute called
"activation-type" which can be set to "immediate" or "mitigation-time". This
parameter will be supplied by a DOTS client in a filter creation request. 

-    Which default value to use if no "activation-type" is supplied by a
client?

Please comment. 

Cheers,

Med

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Fri, 16 Feb 2018 13:24:31 +0000

From: Jon Shallow [mailto:[email-masked]]
Sent: Friday, February 16, 2018 6:03 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; [email-masked]; [email-masked]
Subject: RE: [Dots] draft-ietf-dots-data-channel: Filter Activation

However, when "immediate" is used, is this to be client specific, or across globally the whole of the domain?
[TR] client specific, destination-ipv4-network should be specified in the request.

-Tiru

- this effects how the destination prefix is going to be checked / instantiated.

Regards

Jon

From: Dots [mailto: [email-masked]<mailto:[email-masked]>] On Behalf Of Konda, Tirumaleswar Reddy
Sent: 15 February 2018 15:42
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Dots] draft-ietf-dots-data-channel: Filter Activation

Cheers,
-Tiru

From: Dots [mailto:[email-masked]] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Wednesday, February 14, 2018 1:48 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [Dots] draft-ietf-dots-data-channel: Filter Activation

Hi all,

Please comment.

Cheers,

Med

---

From: <[email-masked]>
Date: Fri, 16 Feb 2018 13:24:49 +0000

Re-,

Please see inline.

Cheers,
Med

De : Jon Shallow [mailto:[email-masked]]
Envoyé : vendredi 16 février 2018 13:33
À : 'Konda, Tirumaleswar Reddy'; BOUCADAIR Mohamed IMT/OLN; [email-masked]
Objet : RE: [Dots] draft-ietf-dots-data-channel: Filter Activation

[Med] Noted.

However, when "immediate" is used, is this to be client specific, or across globally the whole of the domain?
[Med] The filter will be applied on whatever criteria indicated by the client.

Regards

Jon

Cheers,
-Tiru

Hi all,

Please comment.

Cheers,

Med