Subject: Re: [Dots] DOTS Gateways Challenges

From: "Teague, Nik" <[email-masked]>
Date: Tue, 10 Oct 2017 10:39:39 +0000

Hi,

And that sort of holds with the concept that the DOTS gateway isn’t a thru path but the logical concatenation we laid out in the architecture draft…

Thanks,

-Nik

On 10/10/2017, 10:23, "Dots on behalf of Jon Shallow" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

Hi Kaname,

I do not think that information necessarily needs to be the original client identity.  The GW Client side will have its own identity which the DOTS Server can use to differentiate between DOTS (GW) Clients.

So, yes, a hashed set of names can be used – it is up to the DOTS GW Client side to make sure that there are no hash collisions.  Or it could be a simple list such as C1, C2 …Cn.

Regards

Jon

From: Dots [mailto: [email-masked]] On Behalf Of kaname nishizuka
Sent: 10 October 2017 04:19
To: Konda, Tirumaleswar Reddy; Jon Shallow; [email-masked]; [email-masked]; Roland Dobbins
Subject: Re: [Dots] DOTS Gateways Challenges

Hi,

> I agree the below problems are applicable for server-side DOTS gateway, it must convey the “client identity” to the DOTS server.
I agree with this server-side DOTS gateway case.
At the same time, I agree with below:
> I agree that is not a good thing to “leak” out internal information when passing through a DOTS GW,

Then, should DOTS GW send “client identity” (i.e. certificates of DOTS clients) itself or hashed(“client identity”) to DOTS server?
If later, how can DOTS server react to the ambiguous information of the hashed(“client identity”).

regards,
Kaname

On 2017/10/09 22:34, Konda, Tirumaleswar Reddy wrote:
Hi Jon,

I agree the below problems are applicable for server-side DOTS gateway, it must convey the “client identity” to the DOTS server. But for the client-side DOTS gateway, it should resolve conflicting rules b/w DOTS clients (e.g. one client installing black-list ACL for an IP address but the other client installs white-list ACL for the same IP address, same alias-names for different mitigation scopes). I don’t see the need for a client-side DOTS gateway to convey the “client identity” to the server-side DOTS gateway or DOTS server.

-Tiru

From: Jon Shallow [mailto:[email-masked]]
Sent: Saturday, October 7, 2017 2:07 PM
To: Konda, Tirumaleswar Reddy <[email-masked]><mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; Roland Dobbins <[email-masked]><mailto:[email-masked]>
Subject: RE: [Dots] DOTS Gateways Challenges

Hi Tiru,

This discussion goes beyond just the mitigation request.  We need to consider what happens with both alias-name and acl-name (data channel)

The simple case of a mitigation request with no alias-name does not require any knowledge of the original client.

However, if the mitigation request uses alias-name, then there are 3 ways of handling this

a)       The DOTS GW replaces the alias-name with its actual definition (target-ips etc. merged as appropriate), so alias-name is not forwarded on to Server – just the expanded mitigation request is forwarded

b)      The DOTS GW updates the alias-name with a unique alias-name that is forwarded (and has to do the same thing when the alias-name is configured on the data channel) – to handle 2 or more clients defining the same alias-name which have different characteristics

c)       The DOTS GW recognises that alias-name is not unique and adds in ”additional-client-info” (I think I prefer this “-info” name to client-id or original-client-id as “-id” is too closely  associated with Client Identity derived from the DOTS GW Client certificate)
We have agreed that when a client requests mitigation status, the “alias-name” should be returned as “alias-name” and not the substituted alias-name configuration (this does need to be stated in the spec for clarity).  This makes (a) difficult to be handled by DOTS GW which then raises the question – do we really need alias-name?

The definition and association of ACLs/Filters of the data channel is more difficult – the Server must install / apply the appropriate ACLs on a per (Original) Client basis when mitigation is invoked.
Client 1’s concept of a Whitelist IP could be Client 2’s concept of a Blacklist IP.  The Server needs to know which client is requesting the mitigation and install the correct ACLs – if there was no ”additional-client-info”, the Server only knows that he has to install ALL of the ACLs (i.e. both the Black and White list of the same IP as defined by Client 1 and Client 2) as defined by his client (DOTS GW) when his client requests a mitigation.  Here, I think that if there is more than one client for the DOTS GW, ”additional-client-info” is required.

Regards

Jon

From: Dots [mailto: [email-masked]<mailto:[email-masked]>] On Behalf Of Konda, Tirumaleswar Reddy
Sent: 07 October 2017 04:28
To: Jon Shallow; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; Roland Dobbins
Subject: Re: [Dots] DOTS Gateways Challenges

In case of client-side DOTS gateway, why does the DOTS server need to know which “DOTS client” has conveyed the mitigation request ?
For example, the DOTS client could be a DDoS detector or an Application server, and the client-side gateway will have to resolve the conflicting mitigation requests from the DOTS clients, aggregate the mitigation requests from the DOTS client and send the updated mitigation request to the DOTS server.

-Tiru

From: Jon Shallow [mailto:[email-masked]]
Sent: Friday, October 6, 2017 7:42 PM
To: Konda, Tirumaleswar Reddy <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; Roland Dobbins <[email-masked]<mailto:[email-masked]>>
Subject: RE: [Dots] DOTS Gateways Challenges

Hi Tiru,

Unless I am missing something, how does the Client side of DOTS GW convey to the upstream server a unique “client-id” which is different to the implied client id as derived from the PKI certificate that the DOTS GW’Client uses/presents when communicating to the server?
To me, there needs to be an option such as “original-client-id” or “client-id” (which is confusing when also referring to the client identity as derived from the (DOTS GW) Client’s PKI certificate) as a part of the protocol.

I agree that the DOTS GW can generate its own unique client-id to stop multiple entries being needed.

I agree that is not a good thing to “leak” out internal information when passing through a DOTS GW, so my REQUIRED does not make sense.

Regards

Jon
PS – I am having to deal with other stuff at present – I will get back later on the other issues under discussion

From: Konda, Tirumaleswar Reddy [mailto: [email-masked]<mailto:[email-masked]>]
Sent: 06 October 2017 14:58
To: [email-masked]<mailto:[email-masked]>; Jon Shallow; 'Dobbins, Roland'; [email-masked]<mailto:[email-masked]>
Subject: RE: [Dots] DOTS Gateways Challenges

I don’t see a need for client-side DOTS gateway to convey the “DOTS client identity” to the DOTS server. “DOTS client identity” looks required only for the server-side DOTS gateways. In case of server-side DOTS gateway, it can convey the client-id generated from the “DOTS client identity” to the DOTS server. The DOTS gateway can generate a unique client-id and does not have to send an array of client-ids to the DOTS server to resolve clashes.

-Tiru

_______________________________________________

Dots mailing list

[email-masked]<mailto:[email-masked]>

https://www.ietf.org/mailman/listinfo/dots

---

From: "Jon Shallow" <[email-masked]>
Date: Tue, 10 Oct 2017 12:05:02 +0100

On reflection, the hash, or C1…Cn, needs to be passed from the GW Client side to GW Server side as GW Server side potentially has no knowledge of what is going on GW Client side.

Regards

Jon 

From: Dots [mailto:[email-masked]] On Behalf Of Teague, Nik
Sent: 10 October 2017 11:40
To: Jon Shallow; 'kaname nishizuka'; Konda, Tirumaleswar Reddy; [email-masked]; [email-masked]; Roland Dobbins
Subject: Re: [Dots] DOTS Gateways Challenges

Hi,

Thanks,

-Nik

On 10/10/2017, 10:23, "Dots on behalf of Jon Shallow" <[email-masked] on behalf of [email-masked]> wrote:

Hi Kaname,

Regards

Jon

Hi,

regards,
Kaname

Hi Jon,

-Tiru

From: Jon Shallow [mailto:[email-masked]] 
Sent: Saturday, October 7, 2017 2:07 PM
To: Konda, Tirumaleswar Reddy  <mailto:[email-masked]> <[email-masked]>; [email-masked]; [email-masked]; Roland Dobbins  <mailto:[email-masked]> <[email-masked]>
Subject: RE: [Dots] DOTS Gateways Challenges

Hi Tiru,

Regards

Jon

From: Dots [mailto: [email-masked]] On Behalf Of Konda, Tirumaleswar Reddy
Sent: 07 October 2017 04:28
To: Jon Shallow; [email-masked]; [email-masked]; Roland Dobbins
Subject: Re: [Dots] DOTS Gateways Challenges

-Tiru

From: Jon Shallow [mailto:[email-masked]] 
Sent: Friday, October 6, 2017 7:42 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; [email-masked]; [email-masked]; Roland Dobbins <[email-masked]>
Subject: RE: [Dots] DOTS Gateways Challenges

Hi Tiru,

Regards

Jon

From: Konda, Tirumaleswar Reddy [mailto: [email-masked]] 
Sent: 06 October 2017 14:58
To: [email-masked]; Jon Shallow; 'Dobbins, Roland'; [email-masked]
Subject: RE: [Dots] DOTS Gateways Challenges

-Tiru

[email-masked]