Subject: [Dots] WGLC on DOTS Requirements

From: Roman Danyliw <[email-masked]>
Date: Thu, 7 Dec 2017 20:50:47 +0000

Hello!

Consistent with our discussion at the Singapore meeting and with the concurrence of the draft authors, we are starting a working group last call (WGLC) for the DOTS Requirements draft:

Distributed Denial of Service (DDoS) Open Threat Signaling Requirements
draft-ietf-dots-requirements-08
https://tools.ietf.org/html/draft-ietf-dots-requirements-08

Please send all comments to the DOTS mailing list.

This WGLC will end on January 2, 2018 (~3 weeks to account for end-of-the-calendar year vacations).

Thanks,
Roman

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Fri, 8 Dec 2017 07:35:26 +0000

Support!
The draft is good enough and has no issues to be addressed, IMO.

-----邮件原件-----
发件人: Dots [mailto:[email-masked]] 代表 Roman Danyliw
发送时间: 2017年12月8日 4:51
收件人: [email-masked]
主题: [Dots] WGLC on DOTS Requirements

Hello!

Thanks,
Roman

_______________________________________________
Dots mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dots

---

From: <[email-masked]>
Date: Fri, 8 Dec 2017 09:40:59 +0000

Hi all, 

I support this document to be advanced in the publication process.

I have the following comments:  
- Align the text with the outcome of recent discussions: for example, supplying a lifetime is a MUST.
- Add some text about the expected behavior of client-side DOTS gateways to prevent leaking privacy information + server-side DOTS gateways to help servers to enforce policies.
- Add some text about resolution libraries at DOTS servers to handle requests having FQDN/URIs as mitigation scope. 
- Update DM versioning requirement; no need to mention the text about version 1.

The detailed comments and other easy-to-fix nits are available at: https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/draft-ietf-dots-requirements-08-rev%20Med.pdf  

Cheers,
Med

> -----Message d'origine-----
> De : Dots [mailto:[email-masked]] De la part de Roman Danyliw
> Envoyé : jeudi 7 décembre 2017 21:51
> À : [email-masked]
> Objet : [Dots] WGLC on DOTS Requirements
> 
> Hello!
> 
> Consistent with our discussion at the Singapore meeting and with the
> concurrence of the draft authors, we are starting a working group last
> call (WGLC) for the DOTS Requirements draft:
>

---

From: kaname nishizuka <[email-masked]>
Date: Fri, 15 Dec 2017 14:19:00 +0900

Hi,

I support the document to go WGLC process.

I also support the comment from Med which is adding SEC-005. It reflects the latest discussion about the client identifier.
 > - Add some text about the expected behavior of client-side DOTS gateways to prevent leaking privacy information + server-side DOTS gateways to help servers to enforce policies.

thank you,
Kaname

---

From: <[email-masked]>
Date: Tue, 19 Dec 2017 10:15:41 +0000

Re-,

I'm extracting this comment from Jon to be handled as part of the WGLC comments:

==============
Jon said: 

To prevent others getting confused, my suggestion would be to update the following in the various draft specs

"Client-Side DOTS Gateway" to "Client Domain Managed DOTS gateway"
"Server-Side DOTS Gateway" to "Server Domain Managed DOTS gateway"
"DOTS gateway server-side" to "DOTS gateway server-facing-side"
"DOTS gateway client-side" to "DOTS gateway client-facing-side"

The latter 2 should be defined somewhere.
================

Please refer to: https://www.ietf.org/mail-archive/web/dots/current/msg01765.html.

I like the initial wording, but it seems this is not clear enough and may lead to confusion. 

Cheers,
Med

---

From: "Jon Shallow" <[email-masked]>
Date: Tue, 19 Dec 2017 11:53:26 -0000

Hi Roman et all,

I have the following comments on the Requirements Document.

1.1 Context and Motivation
"Once-staggering attack traffic volume is now the norm," makes no sense to me - especially "Once-staggering".  I suggest "High volume (leading to inbound pipe saturating) attacks now frequently occur,"

2. Requirements

I concur with Med's comments (as per his pdf updates).  This section really refers to the signal channel, with a bit of the data channel thrown in (e.g. white/black lists) right at the end.

SIG-003

Original:

In such circumstances, DOTS clients MAY attempt
 to reestablish the signal channel.

Replacement.

In such circumstances, DOTS clients MAY attempt to re-establish the signal channel, but SHOULD continue to send heartbeats so that the DOTS server knows the session is still partially alive.

[see dots signal draft Section 4.7, first bullet point]

SIG-007

IPv4 addresses in dotted quad format
IPv6 addresses [RFC4291][RFC5952]

Are no longer valid now that target-ip has been dropped in the signal / data channels.

I agree with Med's comments in his PDF update

SEC-005 - Added in Med's PDF comments.

I disagree with the MUST NOT as in "DOTS Gateways: Client-side DOTS gateways MUST NOT reveal the identity of internal DOTS clients to a DOTS server."

If a Client Managed Domain Gateway has clients that are all public IP addresses, then the Client Domain owner could elect to let the (hashed to obfuscate) client-identifiers through so that the DOTS server can differentiate between the individual clients when matching mitigation-ids, alias-names etc.  I believe that this text should be something similar to

"DOTS Gateways: Client Managed Domain DOTS gateways MUST NOT reveal the identity of internal DOTS clients to a DOTS server if they are not public IP addresses, and SHOULD NOT reveal the internal DOTS clients identity to a DOTS server in a different managed domain."

Otherwise, in general, I support to go to WGLC.

Regards

Jon

-----Original Message-----
From: Dots [mailto: [email-masked]] On Behalf Of kaname nishizuka
Sent: 15 December 2017 05:19
To: [email-masked]; Roman Danyliw; [email-masked]
Subject: Re: [Dots] WGLC on DOTS Requirements

Hi,

thank you,
Kaname

On 2017/12/08 18:40, [email-masked] wrote:
> The detailed comments and other easy-to-fix nits are available at: 
> https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/draft-iet
> f-dots-requirements-08-rev%20Med.pdf
>
> Cheers,
> Med
>
>> Envoyé : jeudi 7 décembre 2017 21:51 À : [email-masked] Objet : [Dots] 
>> WGLC on DOTS Requirements
>>
>> Hello!
>>
>> concurrence of the draft authors, we are starting a working group 
>> last call (WGLC) for the DOTS Requirements draft:
>>
>> This WGLC will end on January 2, 2018 (~3 weeks to account for 
>> end-of-the- calendar year vacations).
>>
>> Thanks,
>> Roman
>>

---

From: "Jon Shallow" <[email-masked]>
Date: Tue, 19 Dec 2017 12:01:33 -0000

Hi Roman and others,

What triggered these term change requests was the difference in
interpretation of the word "side".

'Ahh – the light bulb has gone off – why our discussions had a disconnect.
It is down to the interpretation of the word “side” as used in “Client Side
DOTS gateway”.  To you (i.e. Med) it meant “control or ownership”, to me
(i.e. Jon) “connectivity or position relative to DOTS gateway”'

It actually is recorded in
https://www.ietf.org/mail-archive/web/dots/current/msg01767.html 

Regards

Jon

-----Original Message-----
From: Dots [mailto: [email-masked]] On Behalf Of
[email-masked]
Sent: 19 December 2017 10:16
To: Roman Danyliw; [email-masked]
Subject: Re: [Dots] WGLC on DOTS Requirements

Re-,

I'm extracting this comment from Jon to be handled as part of the WGLC
comments:

==============
Jon said: 

To prevent others getting confused, my suggestion would be to update the
following in the various draft specs

Please refer to:
https://www.ietf.org/mail-archive/web/dots/current/msg01765.html.

I like the initial wording, but it seems this is not clear enough and may
lead to confusion. 

Cheers,
Med

---

From: "Jon Shallow" <[email-masked]>
Date: Wed, 20 Dec 2017 10:09:01 -0000

Hi WG

Thinking about this overnight, I think I prefer

"Client-Side DOTS Gateway" changed to "Client-Domain DOTS gateway"
"Server-Side DOTS Gateway" changed to "Server-Domain DOTS gateway"
"DOTS gateway server-side" changed to "DOTS gateway server-facing-side"
"DOTS gateway client-side" changed to "DOTS gateway client-facing-side"

In all the appropriate documents.

The reason for the latter two (taking the first one as an example) is that
"DOTS gateway server-facing-side" under the hood is the DOTS client
component of the DOTS gateway.  "server-side" - does it refer to the DOTS
server component side of the DOTS gateway, or is it the side of the DOTS
gateway that talks to a DOTS server?

Comments welcome to move forward on this one.

Regards

Jon

-----Original Message-----
From: Dots [mailto: [email-masked]] On Behalf Of Jon Shallow
Sent: 19 December 2017 12:02
To: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Dots] WGLC on DOTS Requirements

Hi Roman and others,

Regards

Jon

-----Original Message-----

Re-,

==============
Jon said: 

Please refer to:

Cheers,
Med

---

From: kaname nishizuka <[email-masked]>
Date: Fri, 22 Dec 2017 13:23:59 +0900

I've carefully read the thread of " client-identifier: Recurisve signaling & Aggregation".
I'm convinced of the advantage of the proposed terminology.
It makes the function of the DOTS gateway clearer. It is worth to change and beneficial to the implementers and the new-readers.

regards,
Kaname