Distributed-Denial-of-Service Open
Threat Signaling (DOTS) Server DiscoveryOrangeRennes35000Francemohamed.boucadair@orange.comMcAfee, Inc.Embassy Golf Link Business ParkBangaloreKarnataka560071IndiaTirumaleswarReddy_Konda@McAfee.comCisco Systems, Inc.praspati@cisco.comIt may not be possible for a network to determine the cause for an
attack, but instead just realize that some resources seem to be under
attack. To fill that gap, Distributed-Denial-of-Service Open Threat
Signaling (DOTS) allows a network to inform a DOTS server that it is
under a potential attack so that appropriate mitigation actions are
undertaken.This document specifies mechanisms to configure nodes with DOTS
servers.In many deployments, it may not be possible for a network to
determine the cause for a distributed Denial-of-Service (DoS) attack
, but instead just realize that some
resources seem to be under attack. To fill that gap, the IETF is
specifying an architecture, called DDoS Open Threat Signaling (DOTS)
, in which a DOTS
client can inform a DOTS server that the network is under a potential
attack and that appropriate mitigation actions are required. Indeed,
because the lack of a common method to coordinate a real-time response
among involved actors and network domains inhibits the effectiveness of
DDoS attack mitigation, DOTS protocol is meant to carry requests for
DDoS attack mitigation, thereby reducing the impact of an attack and
leading to more efficient defensive actions. identifies a set of scenarios
for DOTS.The basic high-level DOTS architecture is illustrated in (): specifies that the
DOTS client may be provided with a list of DOTS servers; each associated
with one or more IP addresses. These addresses may or may not be of the
same address family. The DOTS client establishes one or more DOTS
sessions by connecting to the provided DOTS server addresses. The logic
for connecting to one or multiple IP addresses is out of scope of this
document.This document specifies methods for DOTS clients to discover their
DOTS server(s). The rationale for specifying multiple discovery
mechanisms is discussed in .Considerations for the selection of DOTS server(s) by multi-homed
DOTS clients is out of scope; the reader should refer to for more details.Likewise, happy eyeballs considerations for DOTS are out of scope.
The reader should refer to Section 4 of .The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119.This document makes use of the following terms:DDoS: A distributed Denial-of-Service attack, in which traffic
originating from multiple sources are directed at a target on a
network. DDoS attacks are intended to cause a negative impact on the
availability of servers, services, applications, and/or other
functionality of an attack target.DHCP refers to both DHCPv4 and
DHCPv6 .DHCP client denotes a node that initiates requests to obtain
configuration parameters from one or more DHCP servers.DHCP server refers to a node that responds to requests from DHCP
clients.DOTS client: A DOTS-aware software module responsible for
requesting attack response coordination with other DOTS-aware
elements.DOTS server: A DOTS-aware software module handling and responding
to messages from DOTS clients. The DOTS server should enable
mitigation on behalf of the DOTS client, if requested, by
communicating the DOTS client's request to the mitigator and
returning selected mitigator feedback to the requesting DOTS client.
A DOTS server may also be a mitigator.DOTS gateway: A DOTS-aware software module that is logically
equivalent to a DOTS client back-to-back with a DOTS server.Furthermore, the reader should be familiar with other terms defined
in and .It is tempting to specify one single discovery mechanism for DOTS.
Nevertheless, the analysis of the various use cases sketched in reveals that it is unlikely
that one single discovery method can be suitable for all the sample
deployments (). Concretely:Some of the use cases may allow DOTS clients to have direct
communications with upstream DOTS servers; that is no DOTS gateway
is involved. Leveraging on existing features that do not require
specific feature on the node embedding the DOTS client may ease DOTS
deployment. Typically, the use of Straightforward-Naming Authority
Pointer (S-NAPTR) lookups allows the
DOTS server administrators provision the preferred DOTS signal
channel transport protocol between the DOTS client and the DOTS
server and allows the DOTS client to discover this preference.Resolving a DOTS server domain name offered by the upstream
transit provider provisioned to a DOTS client into IP address(es)
require the use of the appropriate DNS resolvers; otherwise,
resolving those names will fail. The use of protocols such as DHCP
does allow to associate provisioned DOTS server domain names with a
list of DNS servers to be used for name resolution.The upstream network provider is not the DDoS mitigation provider
for some of these use cases. The use of anycast is not appropriate
for this use case, in particular. It is safe to assume that for such
deployments, the DOTS server(s) domain name is provided during the
service subscription (i.e., manual/local configuration).Multiple DOTS clients may be enabled within a network (e.g.,
enterprise network). Automatic means to discover DOTS servers in a
deterministic manner are interesting from an operational
standpoint.Some of the use cases may involve a DOTS gateway that is
responsible for forking requests received from DOTS clients to
upstream DOTS servers or for selecting the appropriate DOTS server.
Particularly, the use of anycast may simplify the operations within
the enterprise network to discover a DOTS gateway, if the enterprise
network is single-homed.Many use cases discussed in do involve a CPE device.
Multiple CPEs, connected to distinct network providers may even be
considered. It is intuitive to leverage on existing mechanisms such
as discovery using service resolution or DHCP or anycast to
provision the CPE acting as a DOTS client with the DOTS
server(s).Use CaseRequires a CPEThe Network Provider is also the DDoS Mitigation
ProviderEnd-customer with single or multiple upstream transit provider(s)
offering DDoS mitigation servicesYes (Intelligent DDoS mitigation system (IDMS) acting as a DOTS
client may be co-located on the CPE)YesEnd-customer with an overlay DDoS mitigation managed security
service provider (MSSP)Yes (DDOS Detector acting as a DOTS client may be co-located on the
CPE)NoEnd-customer operating an application or service with an integrated
DOTS clientYes (CPE may act as a DOTS gateway)Yes/NoEnd-customer operating a CPE network infrastructure device with an
integrated DOTS clientYes (CPE acts as a DOTS client)YesSuppression of outbound DDoS traffic originating from a consumer
broadband access networkYes (CPE acts as a DOTS server)YesDDoS OrchestrationNoN/AConsequently, this document describes the following mechanisms for
discovery:A resolution mechanism based on straightforward Naming Authority
Pointer (S-NAPTR) resource records in the Domain Name System
(DNS).DNS Service Discovery.Discovery using DHCP Options.A mechanism based on anycast address for DOTS usage.A key point in the deployment of DOTS is the ability of network
operators to be able to configure DOTS clients with the correct server
information consistently. To accomplish this, operators will need a
consistent set of ways in which DOTS clients can discover this
information, and a consistent priority among these options. If some
devices prefer manual configuration over DNS discovery, while others
prefer DNS discovery over manual configuration, the result will be a
process of "whack-a-mole", where the operator must find devices that are
using the wrong DOTS server, determine how to ensure the devices are
configured properly, and then reconfigure the device through the
preferred method.All DOTS clients MUST support at least one of the four mechanisms
below to determine a DOTS server list. All DOTS clients SHOULD implement
all four, or as many as are practical for any specific device, of these
ways to discover DOTS servers, in order to facilitate the deployment of
DOTS in large scale environments:Explicit configuration:Local/Manual configuration: A DOTS client, will learn the
DOTS server(s) by means of local or manual DOTS configuration
(i.e., DOTS servers configured at the system level).
Configuration discovered from a DOTS client application is
considered as local configuration. An implementation may give
the user an opportunity (e.g., by means of configuration file
options or menu items) to specify DOTS server(s) for each
address family. These MAY be specified either as IP addresses or
the DNS name of a DOTS server. When only DOTS server' IP
addresses are configured, a reference identifier must also be
configured for authentication purposes.Automatic configuration (e.g., DHCP, an automation system):
The DOTS client attempts to discover DOTS server(s) names and/or
addresses from DHCP, as described in .Service Resolution : The DOTS client attempts to discover DOTS
server name(s) using service resolution, as specified in .DNS SD: DNS Service Discovery. The DOTS client attempts to
discover DOTS server name(s) using DNS service discovery, as
specified in .Anycast : Send DOTS request to establish a DOTS session with the
assigned DOTS server anycast address for each combination of
interface and address family.Some of these mechanisms imply the use of DNS to resolve the IP
address of the DOTS server, while others imply the IP address of the
relevant DOTS server is obtained directly. Implementation options may
vary on a per device basis, as some devices may not have DNS
capabilities and/or proper configuration.Clients will prefer information received from the discovery methods
in the order listed.On hosts with more than one interface or address family (IPv4/v6),
the DOTS server discovery procedure has to be performed for each
combination of interface and address family. A client MAY choose to
perform the discovery procedure only for a desired interface/address
combination if the client does not wish to discover a DOTS server for
all combinations of interface and address family.The above procedure MUST also be followed by a DOTS gateway.Once the DOTS client has retrieved client's DNS domain or discovered
the DOTS server name that needs to be resolved, an S-NAPTR lookup with
'DOTS' application service and the desired protocol tag is made to
obtain information necessary to connect to the authoritative DOTS server
within the given domain.This specification defines "DOTS" as an application service tag
() and "signal.udp" (), "signal.tcp" (),
and "data.tcp" () as application protocol
tags.If no DOTS-specific S-NAPTR records can be retrieved, the discovery
procedure fails for this domain name (and the corresponding interface
and IP protocol version). If more domain names are known, the discovery
procedure MAY perform the corresponding S-NAPTR lookups immediately.
However, before retrying a lookup that has failed, a DOTS client MUST
wait a time period that is appropriate for the encountered error (e.g.,
NXDOMAIN, timeout, etc.).This mechanism is performed in two steps:A DNS domain name is retrieved for each combination of interface
and address family.Retrieved DNS domain names are then used for S-NAPTR lookups.
Further DNS lookups may be necessary to determine DOTS server IP
address(es).A DOTS client has to determine the domain in which it is located.
The following section describes the means to obtain the domain name
from DHCP. Other means of retrieving domain names may be used, which
are outside the scope of this document, e.g., local configuration.Implementations MAY allow the user to specify a default name that
is used, if no specific name has been configured.DHCP can be used to determine the domain name related to an
interface's point of network attachment. Network operators may
provide the domain name to be used for service discovery within an
access network using DHCP. Sections 3.2 and 3.3 of define DHCP IPv4 and IPv6 access network
domain name options, OPTION_V4_ACCESS_DOMAIN and
OPTION_V6_ACCESS_DOMAIN respectively, to identify a domain name that
is suitable for service discovery within the access network.For IPv4, the discovery procedure MUST request the access network
domain name option in a Parameter Request List option, as described
in .
defines the DHCP IPv4 domain name option; while this option is less
suitable, a client MAY request for it if the access network domain
name defined in is not available.For IPv6, the discovery procedure MUST request for the access
network domain name option in an Options Request Option (ORO) within
an Information-request message, as described in .If neither option can be retrieved the procedure fails for this
interface. If a result can be retrieved it will be used as an input
for S-NAPTR resolution discussed in .DNS-based Service Discovery (DNS-SD)
and Multicast DNS (mDNS) provide generic
solutions for discovering services. DNS-SD/mDNS define a set of naming
rules for certain DNS record types that they use for advertising and
discovering services.Section 4.1 of specifies that a
service instance name in DNS-SD has the following structure:<Instance> . <Service> . <Domain>The <Domain> portion specifies the DNS sub-domain where the
service instance is registered. It may be "local.", indicating the
mDNS local domain, or it may be a conventional domain name such as
"example.com.".The <Service> portion of the DOTS service instance name MUST
be "_dots._signal._udp" or "_dots._signal._tcp" or
"_dots._data._tcp".A DOTS client can proactively discover DOTS servers being
advertised in the site by multicasting a PTR query to one or all of
the following:"_dots._signal._udp.local.""_dots._signal._tcp.local.""_dots._data._tcp.local."A DOTS server can send out gratuitous multicast DNS answer
packets whenever it starts up, wakes from sleep, or detects a change
in network configuration. DOTS clients receive these gratuitous
packets and cache information contained in it.As reported in Section 1.7.2 of :"few certification authorities issue server certificates based on
IP addresses, but preliminary evidence indicates that such
certificates are a very small percentage (less than 1%) of issued
certificates".In order to allow for PKIX-based authentication between a DOTS client
and server while accommodating for the current best practices for
issuing certificates, this document allows for configuring names to DOTS
clients. These names can be used for two purposes: to retrieve the list
of IP addresses of a DOTS server or to be presented as a reference
identifier for authentication purposes.Defining the option to include a list of IP addresses would avoid a
dependency on an underlying name resolution, but that design requires to
also supply a name for PKIX-based authentication purposes.The DHCPv6 DOTS option is used to configure a name of the DOTS
server. The format of this option is shown in .The fields of the option shown in are as follows:Option-code: OPTION_V6_DOTS_RI (TBA1, see )Option-length: Length of the dots-server-name field in
octets.dots-server-name: A fully qualified domain name of the DOTS
server. This field is formatted as specified in Section 8 of
.An example of the dots-server-name
encoding is shown in . This example
conveys the FQDN "dots.example.com.".The DHCPv6 DOTS option can be used to configure a list of IPv6
addresses of a DOTS server. The format of this option is shown in
.The fields of the option shown in are as follows:Option-code: OPTION_V6_DOTS_ADDRESS (TBA2, see )Option-length: Length of the 'DOTS ipv6-address(es)' field in
octets. MUST be a multiple of 16.DOTS ipv6-address: Includes one or more IPv6 addresses of the DOTS server to be used by the
DOTS client. Note, IPv4-mapped IPv6
addresses (Section 2.5.5.2 of )
are allowed to be included in this option.To return more than one DOTS servers to
the requesting DHCPv6 client, the DHCPv6 server returns multiple
instances of OPTION_V6_DOTS.DHCP clients MAY request options OPTION_V6_DOTS_RI and
OPTION_V6_DOTS_ADDRESS, as defined in , Sections 17.1.1, 18.1.1, 18.1.3, 18.1.4,
18.1.5, and 22.7. As a convenience to the reader, it is mentioned
here that the DHCP client includes the requested option codes in the
Option Request Option.If the DHCP client receives more than one instance of
OPTION_V6_DOTS_RI (resp. OPTION_V6_DOTS_ADDRESS) option, it MUST use
only the first instance of that option.If the DHCP client receives both OPTION_V6_DOTS_RI and
OPTION_V6_DOTS_ADDRESS, the content of OPTION_V6_DOTS_RI is used as
reference identifier for authentication purposes (e.g., PKIX ), while the addresses included in
OPTION_V6_DOTS_ADDRESS are used to reach the DOTS server. In other
words, the name conveyed in OPTION_V6_DOTS_RI MUST NOT be passed to
underlying resolution library in the presence of
OPTION_V6_DOTS_ADDRESS in a response.If the DHCP client receives OPTION_V6_DOTS_RI only, but
OPTION_V6_DOTS_RI option contains more than one name, as
distinguished by the presence of multiple root labels, the DHCP
client MUST use only the first name. Once the name is validated
(Section 8 of ), the name is passed to
a name resolution library. Moreover, that name is also used as a
reference identifier for authentication purposes.If the DHCP client receives OPTION_V6_DOTS_ADDRESS only, the
address(es) included in OPTION_V6_DOTS_ADDRESS is used to reach the
DOTS server. In addition, these addresses can be used as identifiers
for authentication.The DHCPv4 DOTS option is used to configure a name of the DOTS
server. The format of this option is illustrated in .The fields of the option shown in are as follows:Code: OPTION_V4_DOTS_RI (TBA3, see );Length: Includes the length of the "DOTS server name" field
in octets; the maximum length is 255 octets.DOTS server name: The domain name of the DOTS server. This
field is formatted as specified in Section 8 of .The DHCPv4 DOTS option can be used to configure a list of IPv4
addresses of a DOTS server. The format of this option is illustrated
in .The fields of the option shown in are as follows:Code: OPTION_V4_DOTS_ADDRESS (TBA4, see );Length: Length of all included data in octets. The minimum
length is 5.List-Length: Length of the "List of DOTS IPv4 Addresses"
field in octets; MUST be a multiple of 4.List of DOTS IPv4 Addresses: Contains one or more IPv4
addresses of the DOTS server to be used by the DOTS client. The
format of this field is shown in .OPTION_V4_DOTS can include multiple lists of DOTS IPv4
addresses; each list is treated separately as it corresponds to
a given DOTS server. When several lists
of DOTS IPv4 addresses are to be included, "List-Length" and
"DOTS IPv4 Addresses" fields are repeated.OPTION_V4_DOTS is a
concatenation-requiring option. As such, the mechanism specified in
MUST be used if OPTION_V4_DOTS
exceeds the maximum DHCPv4 option size of 255 octets.To discover a DOTS server, the DHCPv4 client MUST include both
OPTION_V4_DOTS_RI and OPTION_V4_DOTS_ADDRESS in a Parameter Request
List Option .If the DHCP client receives more than one instance of
OPTION_V4_DOTS_RI (resp. OPTION_V4_DOTS_ADDRESS) option, it MUST use
only the first instance of that option.If the DHCP client receives both OPTION_V4_DOTS_RI and
OPTION_V4_DOTS_ADDRESS, the content of OPTION_V6_DOTS_RI is used as
reference identifier for authentication purposes, while the
addresses included in OPTION_V4_DOTS_ADDRESS are used to reach the
DOTS server. In other words, the name conveyed in OPTION_V4_DOTS_RI
MUST NOT be passed to underlying resolution library in the presence
of OPTION_V4_DOTS_ADDRESS in a response.If the DHCP client receives OPTION_V4_DOTS_RI only, but
OPTION_V4_DOTS_RI option contains more than one name, as
distinguished by the presence of multiple root labels, the DHCP
client MUST use only the first name. Once the name is validated
(Section 8 of ), the name is passed to
a name resolution library. Moreover, that name is also used as a
reference identifier for authentication purposes.If the DHCP client receives OPTION_V4_DOTS_ADDRESS only, the
address(es) included in OPTION_V4_DOTS_ADDRESS is used to reach the
DOTS server. In addition, these addresses can be used as identifiers
for authentication.IP anycast can also be used for DOTS service discovery. A packet sent
to an anycast address is delivered to the 'topologically nearest'
network interface with the anycast address.When a DOTS client requires DOTS services, it attempts to establish a
signaling session with the assigned anycast address(es) defined in
Sections and . A DOTS server, that receives a
DOTS request with an anycast address, SHOULD redirect the DOTS client to
the appropriate DOTS unicast server(s) using the mechanism described in
Section 5.5 of ,
unless it is configured otherwise. Indeed, a DOTS server SHOULD be
configurable to maintain all DOTS communications using anycast. DOTS
redirect is not made mandatory because the use of anycast is not
problematic for some deployment scenarios such as an enterprise network
deploying one single DOTS gateway connected to one single network
provider. identifies a
set of deployment schemes in which the use of anycast is not
recommended.DOTS-related security considerations are discussed in Section 4 of
is to be considered.
DOTS agents must authenticate each other using (D)TLS before a DOTS
session is considered valid.If the DOTS client is explicitly configured with DOTS server(s) then
the DOTS client can also be explicitly configured with credentials to
authenticate the DOTS server.The CPE device acting as a DOTS client MAY use Bootstrapping Remote
Secure Key Infrastructures (BRSKI) discussed in to automatically
bootstrap using the vendor installed X.509 certificate, in combination
with a domain registrar provided by the upstream transit provider and
vendor's authorizing service. The CPE device authenticates to the
upstream transit provider using the vendor installed X.509 certificate
and the upstream transit provider validates the vendor installed
certificate on the CPE device using the Manufacturer Authorized Signing
Authority (MASA) service. If authentication is successful then the CPE
device can request and get a voucher from the MASA service via the
domain registrar. The voucher is signed by the MASA service and includes
the upstream transit provider's trust anchor certificate. The CPE device
validates the signed voucher using the manufacturer installed trust
anchor associated with the vendor's selected MASA service and stores the
upstream transit provider's trust anchor certificate. The CPE device
then uses Enrollment over Secure Transport (EST) for certificate enrollment (Section 3.8 in
). The DOTS
client on the CPE device can authenticate to the DOTS server using the
certificate provisioned by the EST server and the DOTS client can
validate the DOTS server certificate using the upstream transit
provider's trust anchor certificate it had received in the voucher.The security considerations in and
are to be considered.The primary attack against the methods described in is one that would lead to impersonation of a DOTS
server. An attacker could attempt to compromise the S-NAPTR
resolution. The use of mutual authentication makes it difficult to
redirect a DOTS client to an illegitimate DOTS server.Since DNS-SD is just a specification for how to name and use
records in the existing DNS system, it has no specific additional
security requirements over and above those that already apply to DNS
queries and DNS updates. For DNS queries, DNS Security Extensions
(DNSSEC) SHOULD be used where the
authenticity of information is important. For DNS updates, secure
updates
SHOULD generally be used to control which clients have permission to
update DNS records.For mDNS, in addition to what has been described above, a principal
security threat is a security threat inherent to IP multicast routing
and any application that runs on it. A rogue system can advertise that
it is a DOTS server. Discovery of such rogue systems as DOTS servers,
in itself, is not a security threat if the DOTS client authenticates
the discovered DOTS servers.Anycast-related security considerations are discussed in and .IANA is requested to allocate the SRV service name of "_dots._signal"
for DOTS signal channel over UDP or TCP, and the service name of
"_dots._data" for DOTS data channel over TCP.IANA is requested to assign the following new DHCPv6 Option Code in
the registry maintained in
http://www.iana.org/assignments/dhcpv6-parameters:Option NameValueOPTION_V6_DOTS_RITBA1OPTION_V6_DOTS_ADDRESSTBA2IANA is requested to assign the following new DHCPv4 Option Code in
the registry maintained in
http://www.iana.org/assignments/bootp-dhcp-parameters/:Option NameValueData lengthMeaningOPTION_V4_DOTS_RITBA3Variable; the maximum length is 255 octets.Includes the name of the DOTS server.OPTION_V4_DOTS_ADDRESSTBA4Variable; the minimum length is 5.Includes one or multiple lists of DOTS IP addresses; each list is
treated as a separate DOTS server.This document requests IANA to make the following allocations from
the registry available at:
https://www.iana.org/assignments/s-naptr-parameters/s-naptr-parameters.xhtml.Application Protocol Tag: DOTSIntended Usage: See Security Considerations: See Contact Information: <one of the authors>Application Protocol Tag: signal.udpIntended Usage: See Security Considerations: See Contact Information: <one of the authors>Application Protocol Tag: signal.tcpIntended Usage: See Security Considerations: See Contact Information: <one of the authors>Application Protocol Tag: data.tcpIntended Usage: See Security Considerations: See Contact Information: <one of the authors>IANA has assigned a single IPv4 address from the 192.0.0.0/24
prefix and registered it in the "IANA IPv4 Special-Purpose Address
Registry" .IANA has assigned a single IPv6 address from the 2001:0000::/23
prefix and registered it in the "IANA IPv6 Special-Purpose Address
Registry" .Thanks to Brian Carpenter for the review of the BRSKI text.Many thanks to Russ White for the review, comments, and text
contribution.