| Network Working Group | M. Boucadair |
| Internet-Draft | Orange |
| Intended status: Standards Track | April 6, 2017 |
| Expires: October 8, 2017 |
DHCP Options for DDoS Open Threat Signaling (DOTS)
draft-boucadair-dots-dhcp-00
It may not be possible for a network to determine the cause for an attack, but instead just realize that some resources seem to be under attack. To fill that gap, DDoS Open Threat Signaling (DOTS) allows a DOTS client to inform a DOTS server that the network is under a potential attack so that appropriate mitigation actions are undertaken.
This document specifies DHCP (IPv4 and IPv6) options to configure hosts with DOTS servers.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on October 8, 2017.
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
In many deployments, it may not be possible for a network to determine the cause for a distributed Denial-of-Service (DoS) attack [RFC4732], but instead just realize that some resources seem to be under attack. To fill that gap, the IETF is specifying an architecture, called DDoS Open Threat Signaling (DOTS) [I-D.ietf-dots-architecture], in which a DOTS client can inform a DOTS server that the network is under a potential attack and that appropriate mitigation actions are required. Indeed, because the lack of a common method to coordinate a real-time response among involved actors and network domains inhibits the effectiveness of DDoS attack mitigation, DOTS protocol is meant to carry requests for DDoS attack mitigation, thereby reducing the impact of an attack and leading to more efficient defensive actions. [I-D.ietf-dots-use-cases] identifies a set of scenarios for DOTS; almost all these scenarios involve a CPE.
The basic high-level DOTS architecture is illustrated in Figure 1 ([I-D.ietf-dots-architecture]):
+-----------+ +-------------+
| Mitigator | ~~~~~~~~~~ | DOTS Server |
+-----------+ +-------------+
|
|
|
+---------------+ +-------------+
| Attack Target | ~~~~~~ | DOTS Client |
+---------------+ +-------------+
Figure 1: Basic DOTS Architecture
[I-D.ietf-dots-architecture] specifies that the DOTS client may be provided with a list of DOTS servers; each associated with one or more IP addresses. These addresses may or may not be of the same address family. The DOTS client establishes one or more signaling sessions by connecting to the provided DOTS server addresses.
To that aim, this document defines DHCPv4 [RFC2131] and DHCPv6 [RFC3315] options that can be used to configure hosts, embedding a DOTS client, with DOTS servers' IP addresses. The use of DHCP for DOTS provisioning is justified because many of the target use cases identified in [I-D.ietf-dots-use-cases] involve CPEs; these devices widely support DHCP.
This specification assumes a DOTS server is reachable through one or multiple IP addresses. As such, a list of IP addresses can be returned in the DHCP DOTS option.
The use of DHCP to provision the unicast address(es) of the appropriate DOTS server instance(s) to contact does not suffer from the complications encountered if a anycast address is used (see Section 3.2.4.1 of [I-D.ietf-dots-architecture]). The use of DHCP ensures a deterministic behavior even when the network is under a DoS attack.
This document makes use of the following terms:
The DHCPv6 DOTS option can be used to configure a list of IPv6 addresses of a DOTS server. The format of this option is shown in Figure 2.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OPTION_V6_DOTS | Option-length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | | DOTS ipv6-address | | | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | | DOTS ipv6-address | | | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: DHCPv6 DOTS option
Figure 2 are as follows:
Clients MAY request option OPTION_V6_DOTS, as defined in [RFC3315], Sections 17.1.1, 18.1.1, 18.1.3, 18.1.4, 18.1.5, and 22.7. As a convenience to the reader, we mention here that the client includes requested option codes in the Option Request Option.
The DHCPv6 client MUST be prepared to receive multiple instances of OPTION_V6_DOTS; each instance is to be treated separately as it corresponds to a given DOTS server: there are as many DOTS servers as instances of the OPTION_V6_DOTS option.
If an IPv4-mapped IPv6 address is received in OPTION_V6_DOTS, it indicates that the DOTS server has the corresponding IPv4 address.
The DHCPv6 client MUST silently discard multicast and host loopback addresses [RFC6890] conveyed in OPTION_V6_DOTS.
The DHCPv4 DOTS option can be used to configure a list of IPv4 addresses of a DOTS server. The format of this option is illustrated in Figure 3.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Code | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | List-Length | List of | +-+-+-+-+-+-+-+-+ DOTS | / IPv4 Addresses / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ --- | List-Length | List of | | +-+-+-+-+-+-+-+-+ DOTS | | / IPv4 Addresses / | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | . ... . optional +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | List-Length | List of | | +-+-+-+-+-+-+-+-+ DOTS | | / IPv4 Addresses / | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ---
Figure 3: DHCPv4 DOTS option
0 8 16 24 32 40 48
+-----+-----+-----+-----+-----+-----+--
| a1 | a2 | a3 | a4 | a1 | a2 | ...
+-----+-----+-----+-----+-----+-----+--
IPv4 Address 1 IPv4 Address 2 ...
The fields of the option shown in Figure 3 are as follows:
This format assumes that an IPv4 address is encoded as a1.a2.a3.a4.
Figure 4: Format of the List of DOTS IPv4 Addresses
[RFC3396] MUST be used if OPTION_V4_DOTS exceeds the maximum DHCPv4 option size of 255 octets.
To discover one or more DOTS servers, the DHCPv4 client MUST include OPTION_V4_DOTS in a Parameter Request List Option [RFC2132].
The DHCPv4 client MUST be prepared to receive multiple lists of DOTS IPv4 addresses in the same OPTION_V4_DOTS; each list is to be treated as a separate DOTS server instance.
The DHCPv4 client MUST silently discard multicast and host loopback addresses [RFC6890] conveyed in OPTION_V4_DOTS.
The security considerations in [RFC2131] and [RFC3315] are to be considered.
DOTS-related security considerations are discussed in Section 4 of [I-D.ietf-dots-architecture].
IANA is requested to assign the following new DHCPv6 Option Code in the registry maintained in http://www.iana.org/assignments/dhcpv6-parameters:
| Option Name | Value |
|---|---|
| OPTION_V6_DOTS | TBA |
IANA is requested to assign the following new DHCPv4 Option Code in the registry maintained in http://www.iana.org/assignments/bootp-dhcp-parameters/:
| Option Name | Value | Data length | Meaning |
|---|---|---|---|
| OPTION_V4_DOTS | TBA | Variable; the minimum length is 5. | Includes one or multiple lists of DOTS IP addresses; each list is treated as a separate DOTS server. |
TBC
| [I-D.ietf-dots-use-cases] | Dobbins, R., Fouant, S., Migault, D., Moskowitz, R., Teague, N., Xia, L. and K. Nishizuka, "Use cases for DDoS Open Threat Signaling", Internet-Draft draft-ietf-dots-use-cases-04, March 2017. |
| [RFC4732] | Handley, M., Rescorla, E. and IAB, "Internet Denial-of-Service Considerations", RFC 4732, DOI 10.17487/RFC4732, December 2006. |
| [RFC7969] | Lemon, T. and T. Mrugalski, "Customizing DHCP Configuration on the Basis of Network Topology", RFC 7969, DOI 10.17487/RFC7969, October 2016. |
This appendix details a set of non-normative configuration recommendations.
DHCP servers that support the DHCP DOTS option can be configured with a list of IP addresses of the DOTS server(s). If multiple IP addresses are configured, the DHCP server must be explicitly configured whether all or some of these addresses refer to:
Precisely how DHCP servers are configured to separate lists of IP addresses according to which DOTS server they refer to is out of scope for this document. However, DHCP servers must not combine the IP addresses of multiple DOTS servers and return them to the DHCP client as if they were belonging to a single DOTS server, and DHCP servers must not separate the addresses of a single DOTS server and return them as if they were belonging to distinct DOTS servers. For example, if an administrator configures the DHCP server by providing a Fully Qualified Domain Name (FQDN) for a DOTS server, even if that FQDN resolves to multiple addresses, the DHCP server must deliver them within a single server address block.
DHCPv6 servers that implement this option and that can populate the option by resolving FQDNs will need a mechanism for indicating whether to query A records or only AAAA records. When a query returns A records, the IP addresses in those records are returned in the DHCPv6 response as IPv4-mapped IPv6 addresses.
Since this option requires support for IPv4-mapped IPv6 addresses, a DHCPv6 server implementation will not be complete if it does not query A records and represent any that are returned as IPv4-mapped IPv6 addresses in DHCPv6 responses. The mechanism whereby DHCPv6 implementations provide this functionality is beyond the scope of this document.
For guidelines on providing context-specific configuration information (e.g., returning a regional-based configuration), and information on how a DHCP server might be configured with FQDNs that get resolved on demand, see [RFC7969].