Subject: [Dots] Data Channel DOTS Gateways

From: "Jon Shallow" <[email-masked]>
Date: Fri, 2 Mar 2018 13:06:51 -0000

Hi there,

I'm currently having an implementation challenge when using a DOTS gateway
in the data channel.

If the DOTS Gateway knows about 2 upstream DOTS servers (perhaps 2 different
ISPs), what should be done when an alias/acl update comes in from the
original DOTS clients.  Should the request be forwarded on to both servers?

With the signal channel, I am currently sending the mitigation request to
the first defined server that is "alive".

The current text reads

3.  DOTS Data Channel: Design Overview

Some paragraphs later

   If a DOTS gateway is involved, the DOTS gateway verifies that the

   DOTS client is authorized to undertake a data channel action (e.g.,

   instantiate filtering rules).  If the DOTS client is authorized, it

   propagates the rules to the upstream DOTS server.  Likewise, the DOTS

   server verifies that the DOTS gateway is authorized to relay data

   channel actions.  For example, to create or purge filters, a DOTS

   client sends its request to its DOTS gateway.  The DOTS gateway

   validates the rules in the request and proxies the requests

   containing the filtering rules to its DOTS server.  When the DOTS

   gateway receives the associated response from the DOTS server, it

   propagates the response back to the DOTS client.

where both "propagate" and "proxies" are used.   If the request is
propagated to both Servers, but one server sends back a different response
code, what should be done?

Do we just take the first valid server?

- I think the answer is no, but what do we do?

What happens about synchronization of the alias/acl information (I know that
this is in one sense out of scope, but..) between all the final DOTs servers
if there are multiple servers - possibly across multiple DOTS mitigation
services(ISPs)?

Regards

Jon

---

From: <[email-masked]>
Date: Fri, 2 Mar 2018 13:48:04 +0000

Hi Jon,

Please see inline.

Cheers,
Med

De : Dots [mailto:[email-masked]] De la part de Jon Shallow
Envoyé : vendredi 2 mars 2018 14:07
À : [email-masked]
Objet : [Dots] Data Channel DOTS Gateways

Hi there,

I'm currently having an implementation challenge when using a DOTS gateway in the data channel.

If the DOTS Gateway knows about 2 upstream DOTS servers (perhaps 2 different ISPs), what should be done when an alias/acl update comes in from the original DOTS clients.  Should the request be forwarded on to both servers?

[Med] It depends. Please check https://tools.ietf.org/html/draft-boucadair-dots-multihoming-02 (the discussion about PI/PA).

With the signal channel, I am currently sending the mitigation request to the first defined server that is "alive".

[Med] Idem as above, sending a request to a server which cannot act on a given resource is not helpful. Please refer to the multi-homing I-D.

The current text reads

[Med] Please note that this text is mainly for single-homed GWs. How a request is forked or how a server is selected to place a request are not covered here. Those considerations are discussed in draft-boucadair-dots-multihoming.

where both "propagate" and "proxies" are used.   If the request is propagated to both Servers, but one server sends back a different response code, what should be done?
Do we just take the first valid server?
- I think the answer is no, but what do we do?

[Med] For client-domain GWs, this may make sense if, in addition, partial failure is managed directly by the GW to fix some issues (e.g., fix a conflict that may prevent a request to be honoured by one of the servers). In such case, the GW does not need to propagate an error to the client.

What happens about synchronization of the alias/acl information (I know that this is in one sense out of scope, but..) between all the final DOTs servers if there are multiple servers - possibly across multiple DOTS mitigation services(ISPs)?
[Med] This is a yet to be defined behavior. Comments and inputs to draft-boucadair-dots-multihoming are more than welcome.

Regards

Jon