Subject: [Dots] Reminder -- WGLC on draft-ietf-dots-data-channel-18

From: Roman Danyliw <[email-masked]>
Date: Tue, 21 Aug 2018 22:03:55 +0000

Hello!

The WGLC on draft-ietf-dots-data-channel ends Tuesday, August 27.  Please provide input on the mailing list by this deadline.

Roman

> -----Original Message-----
> From: Dots [mailto:[email-masked]] On Behalf Of Roman Danyliw
> Sent: Friday, August 10, 2018 4:30 PM
> To: [email-masked]
> Subject: [Dots] WGLC on draft-ietf-dots-data-channel-18
> 
> Hello!
> 
> Consistent with our discussion at the Montreal meeting, we are starting a
> working group last call (WGLC) for the DOTS Data Channel draft:
> 
> DOTS Data Channel Specification
> draft-ietf-dots-data-channel-18
> https://tools.ietf.org/html/draft-ietf-dots-data-channel-18
> 
> Please send comments to the DOTS mailing list -- feedback on remaining
> issues or needed changes; as well as endorsements that this draft is ready.
> 
> This WGLC will end on August 27, 2018.
> 
> Thanks,
> Roman
> 
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 24 Aug 2018 15:53:27 -0400

I did a quick read, sorry I didn't have time for a closer review and
noticed the following:

Section 3.5:

   This
   behavior is required for topology hiding purposes but also to
   minimizing potential conflicts that may arise if overlapping
   information is used in distinct DOTS domains (e.g., private IPv4
   addresses, non globally unique aliases).

s/minimizing/minimize/

Then in the Security Considerations (Privacy)...

I don't see any explicit privacy considerations and am thinking IP
address/host information of attackers could be sensitive as they often
indicate compromised systems.  The compromise may extend further than the
use of the system in a DDoS attack and there could also be reputation
considerations.

The controls already listed are the most that can be applied considering
the protocols, so thank you for that.

Best regards,
Kathleen

On Tue, Aug 21, 2018 at 6:03 PM, Roman Danyliw <[email-masked]> wrote:

> Hello!
>
> The WGLC on draft-ietf-dots-data-channel ends Tuesday, August 27.  Please
> provide input on the mailing list by this deadline.
>
> Roman
>

-- 

Best regards,
Kathleen

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Sat, 25 Aug 2018 14:56:01 +0000

Hi Kathleen,

Security vendors already provide feeds of malicious domain names and IP addresses to black-list traffic (e.g. block botnets) and provide reputation scores for white-listing and grey-listing for content inspection. I don’t think sharing the attacker details with the DOTS server over a secure communication channel to black-list traffic has any privacy implications.

Cheers,
-Tiru

From: Dots <[email-masked]> On Behalf Of Kathleen Moriarty
Sent: Saturday, August 25, 2018 1:23 AM
To: Roman Danyliw <[email-masked]>
Cc: [email-masked]
Subject: Re: [Dots] Reminder -- WGLC on draft-ietf-dots-data-channel-18

CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

________________________________
I did a quick read, sorry I didn't have time for a closer review and noticed the following:

Section 3.5:

   This

I don't see any explicit privacy considerations and am thinking IP address/host information of attackers could be sensitive as they often indicate compromised systems.  The compromise may extend further than the use of the system in a DDoS attack and there could also be reputation considerations.

The controls already listed are the most that can be applied considering the protocols, so thank you for that.

Best regards,
Kathleen

On Tue, Aug 21, 2018 at 6:03 PM, Roman Danyliw <[email-masked]<mailto:[email-masked]>> wrote:
Hello!

Roman

> From: Dots [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Roman Danyliw
> To: [email-masked]<mailto:[email-masked]>
> [email-masked]<mailto:[email-masked]>

_______________________________________________
Dots mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dots

--

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 27 Aug 2018 10:25:00 -0400

Hi Tirumaleswar,

Sent from my mobile device

> On Aug 25, 2018, at 10:56 AM, Konda, Tirumaleswar Reddy <[email-masked]> wrote:
> 
> Hi Kathleen,
>  

Yes, as I had said in my review, the controls cover the consideration.  What I was suggesting is that the consideration is mentioned in terms of privacy.  This matters more in some regions (Germany) than others.  I suspect if it’s not added now, it’s likely to be requested when the draft goes through IESG review.  I’m just trying to save you time later.

Best regards,
Kathleen

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 28 Aug 2018 06:24:34 +0000

Got it, will update draft.

Cheers,
-Tiru

From: Kathleen Moriarty <[email-masked]>
Sent: Monday, August 27, 2018 7:55 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>
Cc: Roman Danyliw <[email-masked]>; [email-masked]
Subject: Re: [Dots] Reminder -- WGLC on draft-ietf-dots-data-channel-18

On Aug 25, 2018, at 10:56 AM, Konda, Tirumaleswar Reddy <[email-masked]<mailto:[email-masked]>> wrote:
Hi Kathleen,

Best regards,
Kathleen

Cheers,
-Tiru

From: Dots <[email-masked]<mailto:[email-masked]>> On Behalf Of Kathleen Moriarty
Sent: Saturday, August 25, 2018 1:23 AM
To: Roman Danyliw <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [Dots] Reminder -- WGLC on draft-ietf-dots-data-channel-18

Section 3.5:

   This

Best regards,
Kathleen

Roman

--

Best regards,
Kathleen

---

From: kaname nishizuka <[email-masked]>
Date: Tue, 28 Aug 2018 17:40:50 +0900

Hi,

 From a quick review, these are tiny nits though...

Figure 4: DOTS Alias Subtree
<
           |  |     |  +--rw upper-port    inet:port-number
           |  |     |  +--rw upper-port    inet:port-number?

Figure 8: DOTS ACLs Subtree (TCP Match)
<
        |              |     |     +--rw flags-bitmask
        |              |     |     +--rw flags-bitmask?

it is to indicate they are optional.

thanks,
Kaname

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 28 Aug 2018 14:19:14 +0000

The subtree is automatically generated from the YANG module using http://www.yangvalidator.com/, upper-port is optional and lower-port is mandatory.

         leaf lower-port {
           type inet:port-number;
           mandatory true;
           description
             "Lower port number of the port range.";
         }
         leaf upper-port {
           type inet:port-number;
           must ". >= ../lower-port" {
             error-message
               "The upper port number must be greater than
                or equal to lower port number.";
           }

-Tiru

> From: Dots <[email-masked]> On Behalf Of kaname nishizuka
> Sent: Tuesday, August 28, 2018 2:11 PM
> To: [email-masked]
>            |  |     |  +--rw upper-port    inet:port-number  >
>         |              |     |     +--rw flags-bitmask  >
> >> Consistent with our discussion at the Montreal meeting, we are
> >> starting a working group last call (WGLC) for the DOTS Data Channel draft:
> >>
> >> Please send comments to the DOTS mailing list -- feedback on
> >> remaining issues or needed changes; as well as endorsements that this draft
> is ready.
> >>

---

From: "Jon Shallow" <[email-masked]>
Date: Tue, 28 Aug 2018 16:08:30 +0100

Hi there,

I have had a reasonably good read through and can find no issues.

>From my perspective, most of it has been implemented and reasonably interop
tested at the last IETF Hackathon.

Regards

Jon

-----Original Message-----
From: Dots [mailto:[email-masked]] On Behalf Of Roman
Danyliw
Sent: 21 August 2018 23:04
To: [email-masked]
Subject: [Dots] Reminder -- WGLC on draft-ietf-dots-data-channel-18

Hello!

Roman

---

From: kaname nishizuka <[email-masked]>
Date: Wed, 29 Aug 2018 15:15:37 +0900

Yes, that's true.
Thus, "?" is required for upper-port in the subtree.

The place of "?" was wrong by my mistake in the previous message.
           |  |     |  +--rw upper-port?    inet:port-number

please see if the automatically generated subtree is consistent with the latest draft.

thanks,
Kaname

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 29 Aug 2018 07:48:23 +0000

Hi Kaname,

The YANG module is correct for both attributes. I am not comfortable manually modifying the YANG tree structure. 

Regards,
-Tiru

> From: kaname nishizuka <[email-masked]>
> Sent: Wednesday, August 29, 2018 11:46 AM
> To: Konda, Tirumaleswar Reddy <[email-masked]>;
> [email-masked]
> This email originated from outside of the organization. Do not click links or
> open attachments unless you recognize the sender and know the content is safe.
> 
> Yes, that's true.
> > The subtree is automatically generated from the YANG module using
> http://www.yangvalidator.com/, upper-port is optional and lower-port is
> mandatory.
> >
> >           leaf lower-port {
> >             type inet:port-number;
> >             mandatory true;
> >             description
> >> Figure 8: DOTS ACLs Subtree (TCP Match) <