Subject: [Dots] draft-ietf-dots-filter-control: acl updates

From: <[email-masked]>
Date: Tue, 14 May 2019 14:43:56 +0000

Hi all,

The current version of the draft allows to include acl attributes in requests with new or existing 'mid's. By "existing mid', we meant an existing request which does not include acl attributes when the request was initially created. For such requests, the activation-type of the same acl can be changed as the attack evolve or even control other ACLs. This is supposed to be covered by this text:

   When acl-* attributes are to be
   included in a mitigation request with an existing 'mid', the DOTS
   client MUST repeat all the other parameters as sent in the original
   mitigation request (i.e., having that 'mid') apart from a possible
   change to the lifetime parameter value.

For example:
T0: R(mid)
T1: R(mid, acl1, activation-type=value1)
T2: R(mid, acl2, activation-type=value2)
T3: R(mid, acl1, activation-type=value2)
T4: R(mid)
...

Now, if acl attributes are included in a request with a new mid, we need to specify how activation-type (and acl-list in general) can be updated. We do have two options:

(1) Update the draft with this NEW text:

   If 'acl-list', 'acl-name', and 'activation-type' attributes are

   included in the initial mitigation request (that is, a mitigation

   request with a new 'mid'), the DOTS client may update the

   'acl-list' as an active attack evolves.  To do so, the DOTS

   client MUST repeat all the other parameters as sent in the original

   mitigation request apart from a possible change to the 'acl-list'

   and the lifetime parameter values.

   And the signal channel spec as follows:

   For a mitigation request to continue beyond the initial negotiated

   lifetime, the DOTS client has to refresh the current mitigation

   request by sending a new PUT request.  This PUT request MUST use the

   same 'mid' value, and MUST repeat all the other parameters as sent in

   the original mitigation request apart from a possible change to the

   lifetime parameter value or other changes to attributes defined in future extensions.

                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

For example:
T0: R(mid, acl1, activation-type=value1)
T1: R(mid, acl2, activation-type=value2)
T2: R(mid, acl1, activation-type=value2)
..

(2)Require a new mid each time a client has to insert acl attributes.

For example:
T0: R(mid0)
T1: R(mid1, acl1, activation-type=value1)
T2: R(mid2, acl2, activation-type=value2)
T3: R(mid3, acl1, activation-type=value2)
...

Thoughts?

Cheers,
Med

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 15 May 2019 07:10:44 +0000

I don’t think approach (1) is a good idea because of out of order delivery of packets. Further, the anti-relay detection technique in DTLS uses sliding windows procedure. An MITM can possibility cache and drop the packets from the client, and replay the cached packets that fall within the sliding window. For instance in the below example, the server could receive packets in the order T0, T4, T1, T2.

Monotonically increasing ‘mid’ is the only defense against this mechanism, and I don’t think the signal channel draft needs any update.

Cheers,
-Tiru

From: Dots <[email-masked]> On Behalf Of [email-masked]
Sent: Tuesday, May 14, 2019 8:14 PM
To: [email-masked]
Subject: [Dots] draft-ietf-dots-filter-control: acl updates

CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

________________________________
Hi all,

The current version of the draft allows to include acl attributes in requests with new or existing ‘mid’s. By “existing mid’, we meant an existing request which does not include acl attributes when the request was initially created. For such requests, the activation-type of the same acl can be changed as the attack evolve or even control other ACLs. This is supposed to be covered by this text:

For example:
T0: R(mid)

  1.  Update the draft with this NEW text:

   mitigation request apart from a possible change to the 'acl-list’

   request by sending a new PUT request..  This PUT request MUST use the

For example:

  1.  Require a new mid each time a client has to insert acl attributes.

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

---

From: <[email-masked]>
Date: Wed, 15 May 2019 07:28:03 +0000

Hi Tiru,

Agree.

Looking forward to hear  more.

FWIW, the changes to implement (2) can be seen at:
https://github.com/boucadair/filter-control/blob/master/wdiff%20draft-ietf-dots-signal-filter-control-00.txt%20draft-ietf-dots-signal-filter-control-01.pdf

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : mercredi 15 mai 2019 09:11
À : BOUCADAIR Mohamed TGI/OLN; [email-masked]
Objet : RE: draft-ietf-dots-filter-control: acl updates

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

---

From: kaname nishizuka <[email-masked]>
Date: Wed, 15 May 2019 16:59:08 +0900

Hi Tiru, Med,

I agree with Tiru.

 > https://github.com/boucadair/filter-control/blob/master/wdiff%20draft-ietf-dots-signal-filter-control-00.txt%20draft-ietf-dots-signal-filter-control-01.pdf
Could you specify where it is?
(2) is taken account as the current version of the draft allows to include acl attributes in requests with new ‘mid’s.

regards,
Kaname

On 2019/05/15 16:28, [email-masked] wrote:
> *De :*Konda, Tirumaleswar Reddy [mailto:[email-masked]]
> *Envoyé :* mercredi 15 mai 2019 09:11
> *À :* BOUCADAIR Mohamed TGI/OLN; [email-masked]
> *Objet :* RE: draft-ietf-dots-filter-control: acl updates
>
> *From:*Dots <[email-masked]> *On Behalf Of [email-masked]
> *Sent:* Tuesday, May 14, 2019 8:14 PM
> *To:* [email-masked]
> *Subject:* [Dots] draft-ietf-dots-filter-control: acl updates
>
> *CAUTION*:External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.
>
> ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Hi all,
>
>  2. Require a new mid each time a client has to insert acl attributes.
>
> For example:
>
> T0: R(mid0)
>
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots

---

From: <[email-masked]>
Date: Wed, 15 May 2019 08:04:41 +0000

Re-,

Thank you for sharing your thoughts.

-00 allows to use both a new or existing ‘mid’. With (2) taken into account, we need the following change:

OLD:

   A DOTS client may include acl-* attributes in a mitigation request
   having a new or an existing 'mid'.  When acl-* attributes are to be
   included in a mitigation request with an existing 'mid', the DOTS
   client MUST repeat all the other parameters as sent in the original
   mitigation request (i.e., having that 'mid') apart from a possible
   change to the lifetime parameter value.

NEW:
   During an attack time, DOTS clients may include 'acl-list', 'acl-
   name', and 'activation-type' attributes in a mitigation request.
   This request may be the initial mitigation request for a given
   mitigation scope or a new one overriding an existing request.  In
   both case, a new 'mid' MUST be used.

   As the attack evolves, DOTS clients can adjust the 'activation-type'
   of an ACL conveyed in a mitigation request or control other filters
   as necessary.  This can be achieved by sending a PUT request with a
   new 'mid' value.

Cheers,
Med

De : kaname nishizuka [mailto:[email-masked]]
Envoyé : mercredi 15 mai 2019 09:59
À : BOUCADAIR Mohamed TGI/OLN; Konda, Tirumaleswar Reddy; [email-masked]
Objet : Re: [Dots] draft-ietf-dots-filter-control: acl updates

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname
On 2019/05/15 16:28, [email-masked]<mailto:[email-masked]> wrote:
Hi Tiru,

Agree.

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : mercredi 15 mai 2019 09:11
À : BOUCADAIR Mohamed TGI/OLN; [email-masked]<mailto:[email-masked]>
Objet : RE: draft-ietf-dots-filter-control: acl updates

Cheers,
-Tiru

From: Dots <[email-masked]><mailto:[email-masked]> On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Tuesday, May 14, 2019 8:14 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [Dots] draft-ietf-dots-filter-control: acl updates

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

[email-masked]<mailto:[email-masked]>

---

From: "Jon Shallow" <[email-masked]>
Date: Wed, 15 May 2019 10:55:30 +0100

Hi Guys,

I concur with (2).

I think that we have the ‘mid’ wrap properly covered (more likely to occur now with lots of ‘tweaks’ to the mitigation when trying out different acl-lists).

With (2) changing the activation-types, it is possible that some packets may not get through, and so an activation-type may be in an unexpected state.  I know  that we encourage regular monitor of the status of a mitigation (by signal channel observing), but  am unable to find as to whether acl-list etc. is returned on signal channel GET response (there are no GET signal channel response examples).  There was discussion about this on the mailing list, but it did not get a final resolution.

Regards

Jon

From: Dots [mailto: [email-masked]] On Behalf Of [email-masked]
Sent: 15 May 2019 09:05
To: kaname nishizuka; Konda, Tirumaleswar Reddy; [email-masked]
Subject: Re: [Dots] draft-ietf-dots-filter-control: acl updates

Re-,

OLD:

NEW:

   new 'mid' value.

Cheers,

Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Hi Tiru, 

Agree. 

 <https://github.com/boucadair/filter-control/blob/master/wdiff%20draft-ietf-dots-signal-filter-control-00.txt%20draft-ietf-dots-signal-filter-control-01.pdf> https://github.com/boucadair/filter-control/blob/master/wdiff%20draft-ietf-dots-signal-filter-control-00.txt%20draft-ietf-dots-signal-filter-control-01.pdf 

Cheers,

Med

Cheers,

-Tiru

From: Dots  <mailto:[email-masked]> <[email-masked]> On Behalf Of [email-masked]
Sent: Tuesday, May 14, 2019 8:14 PM
To: [email-masked]
Subject: [Dots] draft-ietf-dots-filter-control: acl updates

  _____  

Hi all, 

For example: 

T0: R(mid)

T4: R(mid)

...

For example: 

..

For example: 

T0: R(mid0)

...

Thoughts?

Cheers,

Med

---

From: <[email-masked]>
Date: Wed, 15 May 2019 11:21:43 +0000

Re-,

Noted. Thanks.

With regards to your second point, we do have the following in the draft:

   If, during an active mitigation, the 'activation-type' is changed at
   the DOTS server (e.g., as a result of an external action) for an ACL
   bound to a DOTS client, the DOTS server notifies that DOTS client
   with the change by including the corresponding ACL parameters in an
   asynchronous notification (the DOTS client is observing the active
   mitigation) or in a response to a polling request (Section 4.4.2.2 of
   [I-D.ietf-dots-signal-channel]).

Do we need to say more?

Cheers,
Med

De : Jon Shallow [mailto:[email-masked]]
Envoyé : mercredi 15 mai 2019 11:56
À : BOUCADAIR Mohamed TGI/OLN; kaname nishizuka; Konda, Tirumaleswar Reddy; [email-masked]
Objet : RE: [Dots] draft-ietf-dots-filter-control: acl updates

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

---

From: "Jon Shallow" <[email-masked]>
Date: Wed, 15 May 2019 14:52:16 +0100

Hi Med,

I think that covers it.  Now I have access to my emails, it was the PUT that I was thinking about, not the GET.

Regards

Jon

From: Dots [mailto: [email-masked]] On Behalf Of [email-masked]
Sent: 15 May 2019 12:22
To: Jon Shallow; [email-masked]
Subject: Re: [Dots] draft-ietf-dots-filter-control: acl updates

Re-, 

Noted. Thanks. 

Do we need to say more? 

Cheers,

Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

   new 'mid' value.

Cheers,

Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Hi Tiru, 

Agree. 

Cheers,

Med

Cheers,

-Tiru

  _____  

Hi all, 

For example: 

T0: R(mid)

T4: R(mid)

...

For example: 

..

For example: 

T0: R(mid0)

...

Thoughts?

Cheers,

Med

---

From: <[email-masked]>
Date: Wed, 15 May 2019 14:37:21 +0000

Re-,

The draft does not include any text about the response to a PUT because we assume that we don’t change the base spec.

One related point, we may need to be specific about the behavior of the server, e.g., when it can do the mitigation but fails (for some reason) to apply the filter update. Should we discard the request with 5.03 or should we allow for some flexibility by accepting the mitigation but without the filter update?

Cheers,
Med

De : Jon Shallow [mailto:[email-masked]]
Envoyé : mercredi 15 mai 2019 15:52
À : BOUCADAIR Mohamed TGI/OLN; [email-masked]
Objet : RE: [Dots] draft-ietf-dots-filter-control: acl updates

Hi Med,

Regards

Jon

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

---

From: "Jon Shallow" <[email-masked]>
Date: Wed, 15 May 2019 15:46:25 +0100

Hi Med,

Interesting question – certainly the DOTS signal server should be properly communicating with the DOTS data server, but I guess there can be a failure here.

I think to reject a PUT that is the first mitigation request, but includes an Acl-List with a 5.03 could be unfair – the DOTS client would need to get taught that it needs to send a new PUT (+mid) without the Acl-List if it gets a 5.03 – which could be for a whole host of reasons.

Could we send back some sort of conflict code (i.e. failure code) in this case to be a bit more flexible?

Regards

Jon

Sent: 15 May 2019 15:37

Re-,

Cheers,

Med

Hi Med,

Regards

Jon

Re-, 

Noted. Thanks. 

Do we need to say more? 

Cheers,

Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

   new 'mid' value.

Cheers,

Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Hi Tiru, 

Agree. 

Cheers,

Med

Cheers,

-Tiru

  _____  

Hi all, 

For example: 

T0: R(mid)

T4: R(mid)

...

For example: 

..

For example: 

T0: R(mid0)

...

Thoughts?

Cheers,

Med

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 16 May 2019 04:43:19 +0000

DOTS signal channel protocol does not support handling of partial failures because of the complexity. If the filtering rules cannot be updated, the request should be rejected with appropriate error message (e.g. 4.22 (Unprocessable Entity), https://tools.ietf.org/html/rfc8132)

Cheers,
-Tiru

From: Dots <[email-masked]> On Behalf Of Jon Shallow
Sent: Wednesday, May 15, 2019 8:16 PM
To: [email-masked]; [email-masked]
Subject: Re: [Dots] draft-ietf-dots-filter-control: acl updates

Regards

Jon

From: Dots [mailto: [email-masked]<mailto:[email-masked]>] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: 15 May 2019 15:37
To: Jon Shallow; [email-masked]<mailto:[email-masked]>
Subject: Re: [Dots] draft-ietf-dots-filter-control: acl updates

Re-,

Cheers,
Med

Hi Med,

Regards

Jon

From: Dots [mailto: [email-masked]<mailto:[email-masked]>] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: 15 May 2019 12:22
To: Jon Shallow; [email-masked]<mailto:[email-masked]>
Subject: Re: [Dots] draft-ietf-dots-filter-control: acl updates

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

De : Jon Shallow [mailto:[email-masked]]
Envoyé : mercredi 15 mai 2019 11:56
À : BOUCADAIR Mohamed TGI/OLN; kaname nishizuka; Konda, Tirumaleswar Reddy; [email-masked]<mailto:[email-masked]>
Objet : RE: [Dots] draft-ietf-dots-filter-control: acl updates

Hi Guys,

I concur with (2).

Regards

Jon

From: Dots [mailto: [email-masked]<mailto:[email-masked]>] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: 15 May 2019 09:05
To: kaname nishizuka; Konda, Tirumaleswar Reddy; [email-masked]<mailto:[email-masked]>
Subject: Re: [Dots] draft-ietf-dots-filter-control: acl updates

Re-,

OLD:

NEW:

Cheers,
Med

De : kaname nishizuka [mailto:[email-masked]]
Envoyé : mercredi 15 mai 2019 09:59
À : BOUCADAIR Mohamed TGI/OLN; Konda, Tirumaleswar Reddy; [email-masked]<mailto:[email-masked]>
Objet : Re: [Dots] draft-ietf-dots-filter-control: acl updates

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

---

From: <[email-masked]>
Date: Thu, 16 May 2019 07:20:59 +0000

Hi Tiru, all,

The error is at the server side, so 4.22 is not appropriate here.

What about recommending against including acl attributes in an initial request or when the client adjusts the mitigation scope? Once a mitigation without acls is successfully placed, the client can then send a new request with the same mitigation scope but with acl attributes. Any failure reported by the server will be then linked to the acl instructions.

5.03 will be returned if a failure is encountered to process a request with acls.

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : jeudi 16 mai 2019 06:43
À : Jon Shallow; BOUCADAIR Mohamed TGI/OLN; [email-masked]
Objet : RE: [Dots] draft-ietf-dots-filter-control: acl updates

Cheers,
-Tiru

Regards

Jon

Re-,

Cheers,
Med

Hi Med,

Regards

Jon

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 16 May 2019 09:19:53 +0000

No, 4.22 error is also at the server side, please see https://tools.ietf.org/html/rfc8132

Unprocessable request:  This situation occurs when the payload of a
      FETCH request is determined to be valid (i.e., well-formed and
      supported) but the server is unable to or is incapable of
      processing the request.  The server can return a 4.22
      (Unprocessable Entity) CoAP error.

Cheers,
-Tiru

From: [email-masked] <[email-masked]>
Sent: Thursday, May 16, 2019 12:51 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; Jon Shallow <[email-masked]>; [email-masked]
Subject: RE: [Dots] draft-ietf-dots-filter-control: acl updates

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : jeudi 16 mai 2019 06:43
À : Jon Shallow; BOUCADAIR Mohamed TGI/OLN; [email-masked]<mailto:[email-masked]>
Objet : RE: [Dots] draft-ietf-dots-filter-control: acl updates

Cheers,
-Tiru

From: Dots <[email-masked]<mailto:[email-masked]>> On Behalf Of Jon Shallow
Sent: Wednesday, May 15, 2019 8:16 PM
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Dots] draft-ietf-dots-filter-control: acl updates

Regards

Jon

Re-,

Cheers,
Med

Hi Med,

Regards

Jon

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

---

From: <[email-masked]>
Date: Thu, 16 May 2019 09:42:20 +0000

Re-,

The signal channel spec says the following:

“CoAP 4.xx codes are some sort of invalid requests (client errors).”

and

“The error response code 5.03 (Service Unavailable) is
   returned if the DOTS server has erred or is incapable of performing
   the mitigation.”

The main concern is the unfairness for rejecting a mitigation because of acls. This is problematic for initial requests with acls as rightfully mentioned by Jon.

I do think this is solved with the proposal below. 5.03 will be OK, then.

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : jeudi 16 mai 2019 11:20
À : BOUCADAIR Mohamed TGI/OLN; Jon Shallow; [email-masked]
Objet : RE: [Dots] draft-ietf-dots-filter-control: acl updates

Cheers,
-Tiru

Cheers,
Med

Cheers,
-Tiru

Regards

Jon

Re-,

Cheers,
Med

Hi Med,

Regards

Jon

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 16 May 2019 10:32:34 +0000

What if the server service is really unavailable when the second mitigation request with the ACL is conveyed ?

-Tiru

From: [email-masked] <[email-masked]>
Sent: Thursday, May 16, 2019 3:12 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; Jon Shallow <[email-masked]>; [email-masked]
Subject: RE: [Dots] draft-ietf-dots-filter-control: acl updates

and

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : jeudi 16 mai 2019 11:20
À : BOUCADAIR Mohamed TGI/OLN; Jon Shallow; [email-masked]<mailto:[email-masked]>
Objet : RE: [Dots] draft-ietf-dots-filter-control: acl updates

Cheers,
-Tiru

From: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>
Sent: Thursday, May 16, 2019 12:51 PM
To: Konda, Tirumaleswar Reddy <[email-masked]<mailto:[email-masked]>>; Jon Shallow <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: RE: [Dots] draft-ietf-dots-filter-control: acl updates

Cheers,
Med

Cheers,
-Tiru

Regards

Jon

Re-,

Cheers,
Med

Hi Med,

Regards

Jon

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

---

From: <[email-masked]>
Date: Thu, 16 May 2019 11:36:00 +0000

Re-,

Overall, the same behavior as with mitigation without acls will be followed in that case. For example, the client can infer from the diagnostic payload that the server is unavailable and a redirect is provided. Isn’t it?

In case of a failure due to acl update, we can be explicit that the server to return the failed acl update in the 5.03 response. A client which receives a 5.03 with failed acl, should immediately send a new request without acl attributes so that the mitigation starts, and waits Max-Age before retrying with the same acl update.

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : jeudi 16 mai 2019 12:33
À : BOUCADAIR Mohamed TGI/OLN; Jon Shallow; [email-masked]
Objet : RE: [Dots] draft-ietf-dots-filter-control: acl updates

-Tiru

and

Cheers,
Med

Cheers,
-Tiru

Cheers,
Med

Cheers,
-Tiru

Regards

Jon

Re-,

Cheers,
Med

Hi Med,

Regards

Jon

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 16 May 2019 12:27:32 +0000

Failure scenarios to activate/de-active the ACL look rare (or uncommon). Why not let the client convey the mitigation request with the ACL and if the server returns 5.03, based on the diagnostic payload, re-send the mitigation request without the ACL ?

Cheers,
-Tiru

From: [email-masked] <[email-masked]>
Sent: Thursday, May 16, 2019 5:06 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; Jon Shallow <[email-masked]>; [email-masked]
Subject: RE: [Dots] draft-ietf-dots-filter-control: acl updates

Cheers,
Med

-Tiru

and

Cheers,
Med

Cheers,
-Tiru

Cheers,
Med

Cheers,
-Tiru

Regards

Jon

Re-,

Cheers,
Med

Hi Med,

Regards

Jon

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

---

From: <[email-masked]>
Date: Thu, 16 May 2019 12:47:39 +0000

Re-,

It can:

   both cases, a new 'mid' MUST be used.

But in order to avoid delays to start a mitigation because of acl failures, it makes sense to recommend clients to send first the request without ACLs followed by a new one with acl included. We may add the following:

   Nevertheless, it is NOT
   RECOMMENDED to include ACL attributes in an initial mitigation
   request for a given mitigation scope or in a mitigation request
   adjusting the mitigation scope.

The server does not care whether a request including acl is an initial request or not; the same processing is followed:

   If, for some reason, the DOTS server
   fails to apply the filter update, it MUST respond with 5.03 (Service
   Unavailable) error response code and include the failed 'acl-name'
   update in the diagnostic payload of the response.  Else, the DOTS
   server replies with the appropriate response code defined in
   Section 4.4.1 of [I-D.ietf-dots-signal-channel].

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : jeudi 16 mai 2019 14:28
À : BOUCADAIR Mohamed TGI/OLN; Jon Shallow; [email-masked]
Objet : RE: [Dots] draft-ietf-dots-filter-control: acl updates

Cheers,
-Tiru

Cheers,
Med

-Tiru

and

Cheers,
Med

Cheers,
-Tiru

Cheers,
Med

Cheers,
-Tiru

Regards

Jon

Re-,

Cheers,
Med

Hi Med,

Regards

Jon

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 16 May 2019 13:38:53 +0000

Okay, proposed text looks good to me.

-Tiru

From: [email-masked] <[email-masked]>
Sent: Thursday, May 16, 2019 6:18 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; Jon Shallow <[email-masked]>; [email-masked]
Subject: RE: [Dots] draft-ietf-dots-filter-control: acl updates

It can:

   Nevertheless, it is NOT

Cheers,
Med

Cheers,
-Tiru

Cheers,
Med

-Tiru

and

Cheers,
Med

Cheers,
-Tiru

Cheers,
Med

Cheers,
-Tiru

Regards

Jon

Re-,

Cheers,
Med

Hi Med,

Regards

Jon

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

---

From: kaname nishizuka <[email-masked]>
Date: Fri, 17 May 2019 10:42:15 +0900

I'm okay with the proposed text because "NOT RECOMMENDED" is covering the issue raised here.
However error code would be 4.22 as Tiru said.

4.22 error is also at the server side, please see https://tools.ietf.org/html/rfc8132

Regards,
Kaname

On 2019/05/16 22:38, Konda, Tirumaleswar Reddy wrote:
> *From:[email-masked] <[email-masked]>
> *Sent:* Thursday, May 16, 2019 6:18 PM
> *To:* Konda, Tirumaleswar Reddy <[email-masked]>; Jon Shallow <[email-masked]>; [email-masked]
> *Subject:* RE: [Dots] draft-ietf-dots-filter-control: acl updates
>
> *Envoyé :* jeudi 16 mai 2019 14:28
> *À :* BOUCADAIR Mohamed TGI/OLN; Jon Shallow; [email-masked] <mailto:[email-masked]>
> *Objet :* RE: [Dots] draft-ietf-dots-filter-control: acl updates
>
> *From:[email-masked] <mailto:[email-masked]> <[email-masked] <mailto:[email-masked]>>
> *Sent:* Thursday, May 16, 2019 5:06 PM
> *To:* Konda, Tirumaleswar Reddy <[email-masked] <mailto:[email-masked]>>; Jon Shallow <[email-masked] <mailto:[email-masked]>>; [email-masked] <mailto:[email-masked]>
> *Subject:* RE: [Dots] draft-ietf-dots-filter-control: acl updates
>
> *Envoyé :* jeudi 16 mai 2019 12:33
> *À :* BOUCADAIR Mohamed TGI/OLN; Jon Shallow; [email-masked] <mailto:[email-masked]>
> *Objet :* RE: [Dots] draft-ietf-dots-filter-control: acl updates
>
> *From:[email-masked] <mailto:[email-masked]> <[email-masked] <mailto:[email-masked]>>
> *Sent:* Thursday, May 16, 2019 3:12 PM
> *To:* Konda, Tirumaleswar Reddy <[email-masked] <mailto:[email-masked]>>; Jon Shallow <[email-masked] <mailto:[email-masked]>>; [email-masked] <mailto:[email-masked]>
> *Subject:* RE: [Dots] draft-ietf-dots-filter-control: acl updates
>
> *Envoyé :* jeudi 16 mai 2019 11:20
> *À :* BOUCADAIR Mohamed TGI/OLN; Jon Shallow; [email-masked] <mailto:[email-masked]>
> *Objet :* RE: [Dots] draft-ietf-dots-filter-control: acl updates
>
> *From:[email-masked] <mailto:[email-masked]> <[email-masked] <mailto:[email-masked]>>
> *Sent:* Thursday, May 16, 2019 12:51 PM
> *To:* Konda, Tirumaleswar Reddy <[email-masked] <mailto:[email-masked]>>; Jon Shallow <[email-masked] <mailto:[email-masked]>>; [email-masked] <mailto:[email-masked]>
> *Subject:* RE: [Dots] draft-ietf-dots-filter-control: acl updates
>
> *Envoyé :* jeudi 16 mai 2019 06:43
> *À :* Jon Shallow; BOUCADAIR Mohamed TGI/OLN; [email-masked] <mailto:[email-masked]>
> *Objet :* RE: [Dots] draft-ietf-dots-filter-control: acl updates
>
> DOTS signal channel protocol does not support handling of partial failures because of the complexity. If the filtering rules cannot be updated, the request should be rejected with appropriate error message (e.g. 4.22 (Unprocessable Entity), https://tools.ietf.org/html/rfc8132 <https://tools.ietf.org/html/rfc8132>)
>
> Cheers,
>
> -Tiru
>
> *From:*Dots <[email-masked] <mailto:[email-masked]>> *On Behalf Of *Jon Shallow
> *Sent:* Wednesday, May 15, 2019 8:16 PM
> *To:* [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
> *Subject:* Re: [Dots] draft-ietf-dots-filter-control: acl updates
>
> *From:*Dots [mailto: [email-masked] <mailto:[email-masked]>] *On Behalf Of [email-masked] <mailto:[email-masked]>
> *Sent:* 15 May 2019 15:37
> *To:* Jon Shallow; [email-masked] <mailto:[email-masked]>
> *Subject:* Re: [Dots] draft-ietf-dots-filter-control: acl updates
>
> Re-,
>
> *De :*Jon Shallow [mailto:[email-masked] <mailto:[email-masked]>]
> *Envoyé :* mercredi 15 mai 2019 15:52
> *À :* BOUCADAIR Mohamed TGI/OLN; [email-masked] <mailto:[email-masked]>
> *Objet :* RE: [Dots] draft-ietf-dots-filter-control: acl updates
>
> Hi Med,
>
> *From:*Dots [mailto: [email-masked] <mailto:[email-masked]>] *On Behalf Of [email-masked] <mailto:[email-masked]>
> *Sent:* 15 May 2019 12:22
> *To:* Jon Shallow; [email-masked] <mailto:[email-masked]>
> *Subject:* Re: [Dots] draft-ietf-dots-filter-control: acl updates
>
> Re-,
>
> Noted. Thanks.
>
> *De :*Jon Shallow [mailto:[email-masked]]
> *Envoyé :* mercredi 15 mai 2019 11:56
> *À :* BOUCADAIR Mohamed TGI/OLN; kaname nishizuka; Konda, Tirumaleswar Reddy; [email-masked] <mailto:[email-masked]>
> *Objet :* RE: [Dots] draft-ietf-dots-filter-control: acl updates
>
> Hi Guys,
>
> I concur with (2).
>
> *From:*Dots [mailto: [email-masked] <mailto:[email-masked]>] *On Behalf Of [email-masked] <mailto:[email-masked]>
> *Sent:* 15 May 2019 09:05
> *To:* kaname nishizuka; Konda, Tirumaleswar Reddy; [email-masked] <mailto:[email-masked]>
> *Subject:* Re: [Dots] draft-ietf-dots-filter-control: acl updates
>
> Re-,
>
> *De :*kaname nishizuka [mailto:[email-masked]]
> *Envoyé :* mercredi 15 mai 2019 09:59
> *À :* BOUCADAIR Mohamed TGI/OLN; Konda, Tirumaleswar Reddy; [email-masked] <mailto:[email-masked]>
> *Objet :* Re: [Dots] draft-ietf-dots-filter-control: acl updates
>
> Hi Tiru, Med,
>
> I agree with Tiru.
>
> On 2019/05/15 16:28, [email-masked] <mailto:[email-masked]> wrote:
>
>     Hi Tiru,
>
>     Agree.
>
>     *À :* BOUCADAIR Mohamed TGI/OLN; [email-masked] <mailto:[email-masked]>
>     *From:*Dots <[email-masked]> <mailto:[email-masked]> *On Behalf Of [email-masked] <mailto:[email-masked]>
>     *To:* [email-masked] <mailto:[email-masked]>
>     [email-masked] <mailto:[email-masked]>
>

---

From: <[email-masked]>
Date: Fri, 17 May 2019 05:51:39 +0000

Hi Kaname,

OK, thanks.

Failure to honor a mitigation with ACLs is still a mitigation failure. We need to be aligned with base signal-channel spec which says the following:

   The error response code 5.03 (Service Unavailable) is
   returned if the DOTS server has erred or is incapable of performing
   the mitigation.

Cheers,
Med

De : kaname nishizuka [mailto:[email-masked]]
Envoyé : vendredi 17 mai 2019 03:42
À : Konda, Tirumaleswar Reddy; BOUCADAIR Mohamed TGI/OLN; Jon Shallow; [email-masked]
Objet : Re: [Dots] draft-ietf-dots-filter-control: acl updates

Regards,
Kaname

-Tiru

From: [email-masked]<mailto:[email-masked]> <[email-masked]><mailto:[email-masked]>
Sent: Thursday, May 16, 2019 6:18 PM
To: Konda, Tirumaleswar Reddy <[email-masked]><mailto:[email-masked]>; Jon Shallow <[email-masked]><mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: RE: [Dots] draft-ietf-dots-filter-control: acl updates

It can:

   Nevertheless, it is NOT

Cheers,
Med

Cheers,
-Tiru

Cheers,
Med

-Tiru

and

Cheers,
Med

Cheers,
-Tiru

Cheers,
Med

Cheers,
-Tiru

Regards

Jon

Re-,

Cheers,
Med

Hi Med,

Regards

Jon

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

Dots mailing list

---

From: kaname nishizuka <[email-masked]>
Date: Fri, 17 May 2019 18:59:39 +0900

Hi,

As the conclusion of the discussion about ACL Stats issue, there will be a draft about retrieving ACL Stats over the signal-channel WITHOUT respect to whether ACLs are activated via signal-filter-control.

I'd like to note that when it came out, the GET response spec in signal-filter-control would be subject to change.
Basically, this current specification introduces implementation complexity.

regards,
Kaname

On 2019/05/15 22:52, Jon Shallow wrote:
> *From:*Dots [mailto: [email-masked]] *On Behalf Of [email-masked]
> *To:* Jon Shallow; [email-masked]
> *À :* BOUCADAIR Mohamed TGI/OLN; kaname nishizuka; Konda, Tirumaleswar Reddy; [email-masked]
> *From:*Dots [mailto: [email-masked]] *On Behalf Of [email-masked]
> *To:* kaname nishizuka; Konda, Tirumaleswar Reddy; [email-masked]
> *À :* BOUCADAIR Mohamed TGI/OLN; Konda, Tirumaleswar Reddy; [email-masked]

---

From: <[email-masked]>
Date: Fri, 17 May 2019 11:16:48 +0000

Re-,

That excerpt from the filter-control draft is not related to acl stats.

Can you please clarify what would be the implications on the filter-control draft if acl-stats are allowed to be returned in GET responses?

Thank you.

Cheers,
Med

De : Dots [mailto:[email-masked]] De la part de kaname nishizuka
Envoyé : vendredi 17 mai 2019 12:00
À : Jon Shallow; BOUCADAIR Mohamed TGI/OLN; [email-masked]
Objet : Re: [Dots] draft-ietf-dots-filter-control: acl updates

Hi,

regards,
Kaname

Regards

Jon

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

Dots mailing list

---

From: kaname nishizuka <[email-masked]>
Date: Fri, 24 May 2019 18:02:48 +0900

Right, acl stats is not related to the excerpt spec.

But I'm not fully convinced that the observe of the 'activation-type' will be used.
Notification of the current state of 'activation-type' can be lost in attack time even though it's very important if an external action on DOTS server is unintended by the DOTS client.
So I prefer to use a polling request in 4.4.2.2.
It's an implementation specific, but I've just been wondering if there is an alternate to drop the specification of 'activation-type' observation.

regards,
Kaname

On 2019/05/17 20:16, [email-masked] wrote:
> *De :*Dots [mailto:[email-masked]] *De la part de* kaname nishizuka
> *Envoyé :* vendredi 17 mai 2019 12:00
> *À :* Jon Shallow; BOUCADAIR Mohamed TGI/OLN; [email-masked]

---

From: <[email-masked]>
Date: Fri, 24 May 2019 12:52:37 +0000

Hi Kaname,

The same notification can be sent many times to be sure the notification is successfully delivered.

In both modes:

·         the server needs to track changes on acls bound to a DOTS client. How the tracking is done is implementation-specific.

·         the client needs to be prepared to receive acl attributes in the response.

No?

Cheers,
Med

De : Dots [mailto:[email-masked]] De la part de kaname nishizuka
Envoyé : vendredi 24 mai 2019 11:03
À : BOUCADAIR Mohamed TGI/OLN; Jon Shallow; [email-masked]
Objet : Re: [Dots] draft-ietf-dots-filter-control: acl updates

regards,
Kaname
On 2019/05/17 20:16, [email-masked]<mailto:[email-masked]> wrote:
Re-,

Thank you.

Cheers,
Med

Hi,

regards,
Kaname

Regards

Jon

Re-,

Noted. Thanks.

Do we need to say more?

Cheers,
Med

Hi Guys,

I concur with (2).

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Tiru, Med,

I agree with Tiru.

regards,
Kaname

Agree.

Cheers,
Med

Cheers,
-Tiru

For example:
T0: R(mid)

For example:

For example:
T0: R(mid0)

Thoughts?

Cheers,
Med

Dots mailing list

Dots mailing list