Subject: [Dots] I-D Action: draft-ietf-dots-signal-channel-23.txt

From: [email-masked]
Date: Fri, 17 Aug 2018 05:18:41 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the DDoS Open Threat Signaling WG of the IETF.

        Title           : Distributed Denial-of-Service Open Threat Signaling (DOTS) Signal Channel Specification
        Authors         : Tirumaleswar Reddy
                          Mohamed Boucadair
                          Prashanth Patil
                          Andrew Mortensen
                          Nik Teague
	Filename        : draft-ietf-dots-signal-channel-23.txt
	Pages           : 87
	Date            : 2018-08-17

Abstract:
   This document specifies the DOTS signal channel, a protocol for
   signaling the need for protection against Distributed Denial-of-
   Service (DDoS) attacks to a server capable of enabling network
   traffic mitigation on behalf of the requesting client.

   A companion document defines the DOTS data channel, a separate
   reliable communication layer for DOTS management and configuration
   purposes.

Editorial Note (To be removed by RFC Editor)

   Please update these statements within the document with the RFC
   number to be assigned to this document:

   o  "This version of this YANG module is part of RFC XXXX;"

   o  "RFC XXXX: Distributed Denial-of-Service Open Threat Signaling
      (DOTS) Signal Channel Specification";

   o  "| [RFCXXXX] |"

   o  reference: RFC XXXX

   Please update TBD statements with the port number to be assigned to
   DOTS Signal Channel Protocol.

   Also, please update the "revision" date of the YANG module.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dots-signal-channel/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-dots-signal-channel-23
https://datatracker.ietf.org/doc/html/draft-ietf-dots-signal-channel-23

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dots-signal-channel-23

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: <[email-masked]>
Date: Fri, 17 Aug 2018 12:28:08 +0000

Hi all, 

This version follows the recommendations from the core WG: 
* Move Hop-Limit text to a separate I-D: I-D.boucadair-core-hop-limit.
* Abandon the use of 3.00, but use 5.03 instead. 

The good news is that these changes are straightforward and do not hold publication because I-D.boucadair-core-hop-limit is not a normative reference. 

We also updated the text to reflect the recent publication of RFC8446 (TLS 1.3). Changes are tweaked to be aligned with the discussion with Benjamin (thanks). 

Chairs, the token is yours now :)

Cheers,
Med

> -----Message d'origine-----
> De : I-D-Announce [mailto:[email-masked]] De la part de
> [email-masked]
> Envoyé : vendredi 17 août 2018 14:19
> À : [email-masked]
> Cc : [email-masked]
> Objet : I-D Action: draft-ietf-dots-signal-channel-23.txt
> 
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Sat, 18 Aug 2018 14:18:26 +0000

Minor change:

If PSK is used, (EC)DHE key exchange is required to provide perfect forward secrecy.

OLD:
   o  Raw public keys [RFC7250] or PSK handshake [RFC4279] which reduces
      the size of the ServerHello, and can be used by DOTS agents that
      cannot obtain certificates.

NEW:

   o  Raw public keys [RFC7250] or PSK handshake with (EC)DHE key exchange [RFC4279] which reduces
      the size of the ServerHello, and can be used by DOTS agents that
      cannot obtain certificates.

-Tiru

> -----Original Message-----
> From: Dots <[email-masked]> On Behalf Of
> [email-masked]
> Sent: Friday, August 17, 2018 5:58 PM
> To: [email-masked]
> Subject: Re: [Dots] I-D Action: draft-ietf-dots-signal-channel-23.txt
> 
> 
> 
> Hi all,
> 
> The good news is that these changes are straightforward and do not hold
> publication because I-D.boucadair-core-hop-limit is not a normative reference.
> 
> We also updated the text to reflect the recent publication of RFC8446 (TLS 1.3).
> Changes are tweaked to be aligned with the discussion with Benjamin (thanks).
> 
> > [email-masked] Envoyé : vendredi 17 août 2018 14:19 À :
> > [email-masked] Cc : [email-masked] Objet : I-D Action:
> > draft-ietf-dots-signal-channel-23.txt
> >
> >
> > Please note that it may take a couple of minutes from the time of
> > submission until the htmlized version and diff are available at tools.ietf.org.
> >
> > Internet-Draft directories: http://www.ietf.org/shadow.html or
> > ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> 
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots

---

From: Roman Danyliw <[email-masked]>
Date: Tue, 21 Aug 2018 14:33:02 +0000

Hi Tiru!

Do you want to roll this clarifying change into a quick -24?

Roman

> From: Dots [mailto:[email-masked]] On Behalf Of Konda,
> Tirumaleswar Reddy
> Sent: Saturday, August 18, 2018 10:18 AM
> To: [email-masked]; [email-masked]
> > The good news is that these changes are straightforward and do not
> > hold publication because I-D.boucadair-core-hop-limit is not a normative
> reference.
> >
> > > De : I-D-Announce [mailto:[email-masked]] De la part
> > > de [email-masked] Envoyé : vendredi 17 août 2018 14:19 À :
> > > https://datatracker.ietf.org/doc/html/draft-ietf-dots-signal-channel
> > > -2
> > > 3
> > >

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 21 Aug 2018 14:59:08 +0000

> From: Roman Danyliw <[email-masked]>
> Sent: Tuesday, August 21, 2018 8:03 PM
> To: Konda, Tirumaleswar Reddy <[email-masked]>
> Cc: [email-masked]; [email-masked]
> Subject: RE: I-D Action: draft-ietf-dots-signal-channel-23.txt
> 
> This email originated from outside of the organization. Do not click links or
> open attachments unless you recognize the sender and know the content is safe.
> 
> Hi Tiru!
> 

Sure, will do.

-Tiru

> > > We also updated the text to reflect the recent publication of
> > > RFC8446 (TLS
> > 1.3).
> > > > De : I-D-Announce [mailto:[email-masked]] De la
> > > > part de [email-masked] Envoyé : vendredi 17 août 2018 14:19 À :
> > > > This draft is a work item of the DDoS Open Threat Signaling WG of
> > > > the
> > IETF.
> > > >

---

From: kaname nishizuka <[email-masked]>
Date: Tue, 28 Aug 2018 17:28:13 +0900

Hi,

I did a review on -23 of the signal channel draft:

1. [correction] GET request can be without 'sid' Uri-Path parameter.
<
    If a non-zero value of Max-Age Option is received by a DOTS client,
    it MUST issue a GET request with 'sid' Uri-Path parameter to retrieve
    the current and acceptable configuration before the expiry of the
    value enclosed in the Max-Age option.
    If a non-zero value of Max-Age Option is received by a DOTS client,
    it MUST issue a GET request to retrieve
    the current and acceptable configuration before the expiry of the
    value enclosed in the Max-Age option.

2. [proposal] Adding trigger-mitigation to several example figures about mitigation request

Figure 7.
{
  "ietf-dots-signal-channel:mitigation-scope": {
    "scope": [
      {
        "target-prefix": [
           "2001:db8:6401::1/128",
           "2001:db8:6401::2/128"
         ],
        "target-port-range": [
          {
            "lower-port": 80
          },
          {
            "lower-port": 443
          },
          {
             "lower-port": 8080
          }
         ],
         "target-protocol": [
           6
         ],
        "lifetime": 3600,
        "trigger-mitigation": true
      }
    ]
  }
}

Figure 8.
A1                                      # map(1)
    01                                   # unsigned(1)
    A1                                   # map(1)
       02                                # unsigned(2)
       81                                # array(1)
          A5                             # map(5)
             06                          # unsigned(6)
             82                          # array(2)
                74                       # text(20)
                   323030313A6462383A363430313A3A312F313238 # "2001:db8:6401::1/128"
                74                       # text(20)
                   323030313A6462383A363430313A3A322F313238 # "2001:db8:6401::2/128"
             07                          # unsigned(7)
             83                          # array(3)
                A1                       # map(1)
                   08                    # unsigned(8)
                   18 50                 # unsigned(80)
                A1                       # map(1)
                   08                    # unsigned(8)
                   19 01BB               # unsigned(443)
                A1                       # map(1)
                   08                    # unsigned(8)
                   19 1F90               # unsigned(8080)
             0A                          # unsigned(10)
             81                          # array(1)
                06                       # unsigned(6)
             0E                          # unsigned(14)
             19 0E10                     # unsigned(3600)
             18 2D                       # unsigned(45)
             F5                          # primitive(21)

thanks,
Kaname

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 28 Aug 2018 13:42:56 +0000

Hi Kaname,

Please see inline.

From: Dots <[email-masked]> On Behalf Of kaname nishizuka
Sent: Tuesday, August 28, 2018 1:58 PM
To: [email-masked]
Subject: Re: [Dots] I-D Action: draft-ietf-dots-signal-channel-23.txt

CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

________________________________
Hi,

<

[TR] The proposed line is not correct. The client has to use GET request with ‘sid’ to refresh the configuration parameters it had previously negotiated.

[TR] The default value of trigger-mitigation is ‘true’, I don’t see the need to explicitly convey the attribute in the mitigation request.

-Tiru

Figure 7.

{

   "scope": [

     {

       "target-prefix": [

          "2001:db8:6401::1/128",

          "2001:db8:6401::2/128"

        ],

       "target-port-range": [

         {

           "lower-port": 80

         },

         {

           "lower-port": 443

         },

         {

            "lower-port": 8080

         }

        ],

        "target-protocol": [

          6

        ],

       "lifetime": 3600,

     }

   ]

 }

}

Figure 8.

A1                                      # map(1)

   01                                   # unsigned(1)

   A1                                   # map(1)

      02                                # unsigned(2)

      81                                # array(1)

         A5                             # map(5)

            06                          # unsigned(6)

            82                          # array(2)

               74                       # text(20)

               74                       # text(20)

            07                          # unsigned(7)

            83                          # array(3)

               A1                       # map(1)

                  08                    # unsigned(8)

                  18 50                 # unsigned(80)

               A1                       # map(1)

                  08                    # unsigned(8)

                  19 01BB               # unsigned(443)

               A1                       # map(1)

                  08                    # unsigned(8)

                  19 1F90               # unsigned(8080)

            0A                          # unsigned(10)

            81                          # array(1)

               06                       # unsigned(6)

            0E                          # unsigned(14)

            19 0E10                     # unsigned(3600)

            18 2D                       # unsigned(45)

            F5                          # primitive(21)

thanks,

Kaname

On 2018/08/17 21:28, [email-masked]<mailto:[email-masked]> wrote:

Hi all,

Cheers,

Med

-----Message d'origine-----

[email-masked]<mailto:[email-masked]>

À : [email-masked]<mailto:[email-masked]>

Cc : [email-masked]<mailto:[email-masked]>

A New Internet-Draft is available from the on-line Internet-Drafts

directories.

        Title           : Distributed Denial-of-Service Open Threat Signaling

(DOTS) Signal Channel Specification

                          Mohamed Boucadair

                          Prashanth Patil

                          Andrew Mortensen

                          Nik Teague

  Pages           : 87

  Date            : 2018-08-17

Abstract:

   purposes.

   o  "| [RFCXXXX] |"

   o  reference: RFC XXXX

[email-masked]<mailto:[email-masked]>

Dots mailing list

[email-masked]<mailto:[email-masked]>