Subject: [Dots] I-D Action: draft-ietf-dots-architecture-06.txt

From: [email-masked]
Date: Mon, 19 Mar 2018 23:35:56 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the DDoS Open Threat Signaling WG of the IETF.

        Title           : Distributed-Denial-of-Service Open Threat Signaling (DOTS) Architecture
        Authors         : Andrew Mortensen
                          Flemming Andreasen
                          Tirumaleswar Reddy
                          Christopher Gray
                          Rich Compton
                          Nik Teague
	Filename        : draft-ietf-dots-architecture-06.txt
	Pages           : 32
	Date            : 2018-03-19

Abstract:
   This document describes an architecture for establishing and
   maintaining Distributed Denial of Service (DDoS) Open Threat
   Signaling (DOTS) within and between domains.  The document does not
   specify protocols or protocol extensions, instead focusing on
   defining architectural relationships, components and concepts used in
   a DOTS deployment.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dots-architecture/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-dots-architecture-06
https://datatracker.ietf.org/doc/html/draft-ietf-dots-architecture-06

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dots-architecture-06

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Mortensen, Andrew" <[email-masked]>
Date: Tue, 20 Mar 2018 06:37:18 +0000

This revision adds a new NAT considerations section, mostly covering how to address mapping an internal address to a public mitigation scope.

andrew

Begin forwarded message:

From: [email-masked]<mailto:[email-masked]>
Subject: [Dots] I-D Action: draft-ietf-dots-architecture-06.txt
Date: March 20, 2018 at 2:35:56 AM EDT
To: <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>

Abstract:

_______________________________________________
Dots mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dots

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 20 Mar 2018 08:31:23 +0000

Hi Andrew,

Section 3.2.5.2>

1)
If internal resources are behind NAT, they are
mostly likely behind double NAT (NAT444), STUN
discovers the public IP address and port created
by the NAT closest to the server.

The proposed text uses both external address and reflexive transport address (external IP address and port)
You may want to use "reflexive transport address" and point to RFC5389 for its definition.

2)
Public STUN servers typically use clear text, without message-integrity and the response can be modified
by a man-in-the-middle attacker (TRAM WG has recently standardized STUN over DTLS, but I don't think is widely deployed).
ICE connectivity checks is used by the media endpoints to detect the above attack.

The internal resource needs to use a mechanism like ICE, TURN (authenticated TURN server) or secure transport to the STUN server
to validate that the STUN response is authentic.

3)
STUN will not work if the internal resource is behind NAT that uses Address-Dependent Mapping
(see https://tools.ietf.org/html/rfc5780#section-4.3).

4)
You are assuming DOTS client and internal resource are not co-located (An application
can also have an integrated DOTS server).

5)
Section 3.2.5.3, reverse DNS lookup can be spoofed unless the response is signed.

6)
Section 3.2.5.1, How will direct-mapping work in the most deployments where the mapping is dynamic (other than NPTv6) ?

Cheers,
Tiru

From: Dots [mailto:[email-masked]] On Behalf Of Mortensen, Andrew
Sent: Tuesday, March 20, 2018 6:37 AM
To: dots <[email-masked]>
Subject: [Dots] Fwd: I-D Action: draft-ietf-dots-architecture-06.txt

andrew

Begin forwarded message:

To: <[email-masked]<mailto:i-d-announce@ietf..org>>

Abstract:

_______________________________________________
Dots mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dots