Subject: [Dots] I-D Action: draft-ietf-dots-signal-channel-29.txt

From: [email-masked]
Date: Fri, 22 Feb 2019 07:29:30 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the DDoS Open Threat Signaling WG of the IETF.

        Title           : Distributed Denial-of-Service Open Threat Signaling (DOTS) Signal Channel Specification
        Authors         : Tirumaleswar Reddy
                          Mohamed Boucadair
                          Prashanth Patil
                          Andrew Mortensen
                          Nik Teague
	Filename        : draft-ietf-dots-signal-channel-29.txt
	Pages           : 99
	Date            : 2019-02-22

Abstract:
   This document specifies the DOTS signal channel, a protocol for
   signaling the need for protection against Distributed Denial-of-
   Service (DDoS) attacks to a server capable of enabling network
   traffic mitigation on behalf of the requesting client.

   A companion document defines the DOTS data channel, a separate
   reliable communication layer for DOTS management and configuration
   purposes.

Editorial Note (To be removed by RFC Editor)

   Please update these statements within the document with the RFC
   number to be assigned to this document:

   o  "This version of this YANG module is part of RFC XXXX;"

   o  "RFC XXXX: Distributed Denial-of-Service Open Threat Signaling
      (DOTS) Signal Channel Specification";

   o  "| [RFCXXXX] |"

   o  reference: RFC XXXX

   Please update this statement with the RFC number to be assigned to
   the following documents:

   o  "RFC YYYY: Distributed Denial-of-Service Open Threat Signaling
      (DOTS) Data Channel Specification (used to be I-D.ietf-dots-data-
      channel)

   Please update TBD/TBD1/TBD2 statements with the assignments made by
   IANA to DOTS Signal Channel Protocol.

   Also, please update the "revision" date of the YANG modules.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dots-signal-channel/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-dots-signal-channel-29
https://datatracker.ietf.org/doc/html/draft-ietf-dots-signal-channel-29

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dots-signal-channel-29

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Fri, 22 Feb 2019 16:20:26 +0000

Hi Med,

Couple of Nits:

1)
OLD:
Likewise, 'sid' value is	
monotonically increased by the DOTS client for each configuration	
session, attackers replaying configuration requests with lower	
numeric 'sid' values will be rejected by the DOTS server if it	
maintains a higher numeric 'sid' value for this DOTS client.

NEW:
Likewise, 'sid' value is	
monotonically increased by the DOTS client for each configuration	
request, attackers replaying configuration requests with lower	
numeric 'sid' values will be rejected by the DOTS server if it	
maintains a higher numeric 'sid' value for this DOTS client.

2)
Define 'idle' time (i.e. when no attack traffic is present).

-Tiru

> -----Original Message-----
> From: Dots <[email-masked]> On Behalf Of [email-masked]
> Sent: Friday, February 22, 2019 9:00 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [Dots] I-D Action: draft-ietf-dots-signal-channel-29.txt
> 
> This email originated from outside of the organization. Do not click links or
> open attachments unless you recognize the sender and know the content is safe.
> 
> 
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots

---

From: <[email-masked]>
Date: Tue, 26 Feb 2019 15:11:57 +0000

Hi Tiru, 

Please see inline. 

Cheers,
Med

> -----Message d'origine-----
> De : Dots [mailto:[email-masked]] De la part de Konda, Tirumaleswar
> Reddy
> Envoyé : vendredi 22 février 2019 17:20
> À : [email-masked]; [email-masked]
> Objet : Re: [Dots] I-D Action: draft-ietf-dots-signal-channel-29.txt
> 
> Hi Med,
> 
> Couple of Nits:
> 
> 1)
> OLD:
> Likewise, 'sid' value is

[Med] OK for s/session/request. 

> Define 'idle' time (i.e. when no attack traffic is present).

[Med] This one is not needed, IMHO. We do already have the following in the draft: 

   The same or distinct configuration sets may be used during times when
                                                              ^^^^^^^^^^
   a mitigation is active ('mitigating-config') and when no mitigation
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   is active ('idle-config').  This is particularly useful for DOTS
   ^^^^^^^^^^^^^^^^^
   servers that might want to reduce heartbeat frequency or cease
   heartbeat exchanges when an active DOTS client has not requested
   mitigation.  If distinct configurations are used, DOTS agents MUST
   follow the appropriate configuration set as a function of the
   mitigation activity (e.g., if no mitigation request is active, 'idle-
   config'-related values must be followed).  Additionally, DOTS agents
   MUST automatically switch to the other configuration upon a change in
   the mitigation activity (e.g., if an attack mitigation is launched
   after an 'idle' time, the DOTS agent switches from 'idle-config' to
   'mitigating-config'-related values).

> >         Title           : Distributed Denial-of-Service Open Threat
> Signaling (DOTS)
> > Signal Channel Specification

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 27 Feb 2019 06:56:25 +0000

Hi Med,

Please see inline 

> From: [email-masked] <[email-masked]>
> Sent: Tuesday, February 26, 2019 8:42 PM
> To: Konda, Tirumaleswar Reddy <[email-masked]>
> Cc: [email-masked]
> Subject: RE: [Dots] I-D Action: draft-ietf-dots-signal-channel-29.txt
> 
> 
> 
> Hi Tiru,
> 
> Please see inline.
> 
> Cheers,
> Med
> 
> > De : Dots [mailto:[email-masked]] De la part de Konda,
> > Tirumaleswar Reddy Envoyé : vendredi 22 février 2019 17:20 À :
> > [email-masked]; [email-masked] Objet : Re: [Dots] I-D Action:
> > draft-ietf-dots-signal-channel-29.txt
> >
> > Hi Med,
> >
> > Couple of Nits:
> >
> > 1)
> > OLD:
> > Likewise, 'sid' value is
> > session, attackers replaying configuration requests with lower numeric
> > 'sid' values will be rejected by the DOTS server if it maintains a
> > higher numeric 'sid' value for this DOTS client.
> >
> > NEW:
> > Likewise, 'sid' value is
> > request, attackers replaying configuration requests with lower numeric
> > 'sid' values will be rejected by the DOTS server if it maintains a
> > higher numeric 'sid' value for this DOTS client.
> >
> 

The above lines do not define the term 'idle'.
We just have to append "(i.e. when no attack traffic is present)" to 'idle' time. 

Cheers,
-Tiru

> > > This email originated from outside of the organization. Do not click
> > > links
> > or
> > > open attachments unless you recognize the sender and know the
> > > content is
> > safe.
> > >
> > >

---

From: <[email-masked]>
Date: Thu, 28 Feb 2019 09:15:06 +0000

Hi Tiru, 

'idle' time is not when no attack traffic is present, but when no attack mitigation is active. We have drawn this distinction in -15. 

The idle and mitigation times are introduced in the draft. I made this change to avoid misinterpretation:
 
   The same or distinct configuration sets may be used during times when
   a mitigation is active ('mitigating-config') and when no mitigation
   is active ('idle-config').  This is particularly useful for DOTS
   servers that might want to reduce heartbeat frequency or cease
   heartbeat exchanges when an active DOTS client has not requested
   mitigation.  If distinct configurations are used, DOTS agents MUST
   follow the appropriate configuration set as a function of the
   mitigation activity (e.g., if no mitigation request is active (also
                                                                 ^^^^^^ 
   referred to as 'idle' time), 'idle-config'-related values must be
   ^^^^^^^^^^^^^^^^^^^^^^^^^^
   followed).  Additionally, DOTS agents MUST automatically switch to
   the other configuration upon a change in the mitigation activity
   (e.g., if an attack mitigation is launched after an 'idle' time, the
   DOTS agent switches from 'idle-config' to 'mitigating-config'-related
   values).

Better? 

Cheers,
Med

> De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
> Envoyé : mercredi 27 février 2019 07:56
> À : BOUCADAIR Mohamed TGI/OLN
> Cc : [email-masked]
> Objet : RE: [Dots] I-D Action: draft-ietf-dots-signal-channel-29.txt
> 
> Hi Med,
> 
> Please see inline
>

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 28 Feb 2019 10:38:46 +0000

> Sent: Thursday, February 28, 2019 2:45 PM
> 'idle' time is not when no attack traffic is present, but when no attack
> mitigation is active. We have drawn this distinction in -15.
> 

Thanks, update looks good.

-Tiru

> > De : Konda, Tirumaleswar Reddy
> > [mailto:[email-masked]]
> > Envoyé : mercredi 27 février 2019 07:56 À : BOUCADAIR Mohamed TGI/OLN
> > Cc : [email-masked] Objet : RE: [Dots] I-D Action:
> > > [Med] This one is not needed, IMHO. We do already have the following
> > > in the
> > > draft:
> > >
> > > > > This email originated from outside of the organization. Do not
> > > > > click links
> > > > or
> > > > > A New Internet-Draft is available from the on-line
> > > > > Internet-Drafts
> > > > directories.
> > > > > This draft is a work item of the DDoS Open Threat Signaling WG
> > > > > of the
> > IETF.
> > > > >
> > > > > https://datatracker.ietf.org/doc/html/draft-ietf-dots-signal-cha
> > > > > nnel
> > > > > -29
> > > > >
> > > > > Please note that it may take a couple of minutes from the time
> > > > > of
> > > > submission