| Network Working Group | M. Boucadair |
| Internet-Draft | Orange |
| Intended status: Standards Track | April 12, 2017 |
| Expires: October 14, 2017 |
DHCP Options for Distributed-Denial-of-Service Open Threat Signaling (DOTS)
draft-boucadair-dots-dhcp-01
It may not be possible for a network to determine the cause for an attack, but instead just realize that some resources seem to be under attack. To fill that gap, Distributed-Denial-of-Service Open Threat Signaling (DOTS) allows a network to inform a server that it is under a potential attack so that appropriate mitigation actions are undertaken.
This document specifies DHCP (IPv4 and IPv6) options to configure hosts with DOTS servers.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on October 14, 2017.
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
In many deployments, it may not be possible for a network to determine the cause for a distributed Denial-of-Service (DoS) attack [RFC4732], but instead just realize that some resources seem to be under attack. To fill that gap, the IETF is specifying an architecture, called DDoS Open Threat Signaling (DOTS) [I-D.ietf-dots-architecture], in which a DOTS client can inform a DOTS server that the network is under a potential attack and that appropriate mitigation actions are required. Indeed, because the lack of a common method to coordinate a real-time response among involved actors and network domains inhibits the effectiveness of DDoS attack mitigation, DOTS protocol is meant to carry requests for DDoS attack mitigation, thereby reducing the impact of an attack and leading to more efficient defensive actions. [I-D.ietf-dots-use-cases] identifies a set of scenarios for DOTS; almost all these scenarios involve a CPE.
The basic high-level DOTS architecture is illustrated in Figure 1 ([I-D.ietf-dots-architecture]):
+-----------+ +-------------+
| Mitigator | ~~~~~~~~~~ | DOTS Server |
+-----------+ +-------------+
|
|
|
+---------------+ +-------------+
| Attack Target | ~~~~~~ | DOTS Client |
+---------------+ +-------------+
Figure 1: Basic DOTS Architecture
[I-D.ietf-dots-architecture] specifies that the DOTS client may be provided with a list of DOTS servers; each associated with one or more IP addresses. These addresses may or may not be of the same address family. The DOTS client establishes one or more signaling sessions by connecting to the provided DOTS server addresses.
To that aim, this document defines DHCPv4 [RFC2131] and DHCPv6 [RFC3315] options that can be used to configure hosts, embedding a DOTS client, with DOTS servers' names. These names will be resolved into one or a list of IP addresses.
The use of DHCP for DOTS provisioning is justified because many of the target use cases identified in [I-D.ietf-dots-use-cases] involve CPEs; these devices widely support DHCP.
Also, the use of DHCP to provision a name that will be resolved into one or many unicast address(es) of the appropriate DOTS server instance(s) to contact does not suffer from the complications encountered if a anycast address is used (see Section 3.2.4.1 of [I-D.ietf-dots-architecture]). The use of DHCP ensures a deterministic behavior.
This document makes use of the following terms:
As reported in Section 1.7.2 of [RFC6125], "few certification authorities issue server certificates based on IP addresses, but preliminary evidence indicates that such certificates are a very small percentage (less than 1%) of issued certificates". In order to allow for PKIX-based authentication between a DOTS client and server, this document specifies the DHCP option as a name. One or multiple IP addresses may be returned as a result of name resolution.
Defining the option to include a list of IP addresses would avoid a dependency on an underlying name resolution, but that design requires to also supply a name for PKIX-based authentication purposes.
Because aliasing is to be avoided (Section 7 of [RFC7227]), this document specifies one single option that conveys a DOTS server's name.
The DHCPv6 DOTS option is used to configure a name of the DOTS server. The format of this option is shown in Figure 2.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OPTION_V6_DOTS | Option-length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | | dots-server-name (FQDN) | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: DHCPv6 DOTS option
Figure 2 are as follows:
Figure 3. This example conveys the FQDN "dots.example.com.".
+------+------+------+------+------+------+------+------+------+
| 0x04 | d | o | t | s | 0x07 | e | x | a |
+------+------+------+------+------+------+------+------+------+
| m | p | l | e | 0x03 | c | o | m | 0x00 |
+------+------+------+------+------+------+------+------+------+
Figure 3: An example
Clients MAY request option OPTION_V6_DOTS, as defined in [RFC3315], Sections 17.1.1, 18.1.1, 18.1.3, 18.1.4, 18.1.5, and 22.7. As a convenience to the reader, we mention here that the client includes requested option codes in the Option Request Option.
If the DHCP client receives more than one OPTION_V6_DOTS option, it MUST use only the first instance of that option.
If the OPTION_V6_DOTS option contains more than one name, as distinguished by the presence of multiple root labels, the DHCP client MUST use only the first name. Once the name is validated (Section 8 of [RFC3315]), the name is passed to a name resolution library.
The DHCPv4 DOTS option is used to configure a name of the DOTS server. The format of this option is illustrated in Figure 4.
Code Length DOTS server name
+-----+-----+-----+-----+-----+-----+-----+--
| TBA | n | s1 | s2 | s3 | s4 | s5 | ...
+-----+-----+-----+-----+-----+-----+-----+--
The values s1, s2, s3, etc. represent the domain name labels in the
domain name encoding.
Figure 4: DHCPv4 DOTS option
The fields of the option shown in Figure 4 are as follows:
To discover a DOTS server, the DHCPv4 client MUST include OPTION_V4_DOTS in a Parameter Request List Option [RFC2132].
If the DHCP client receives more than one OPTION_V4_DOTS option, it MUST use only the first instance of that option.
If the OPTION_V4_DOTS option contains more than one name, as distinguished by the presence of multiple root labels, the DHCP client MUST use only the first FQDN. Once the name is validated (Section 8 of [RFC3315]), the name is passed to a name resolution library.
The security considerations in [RFC2131] and [RFC3315] are to be considered.
DOTS-related security considerations are discussed in Section 4 of [I-D.ietf-dots-architecture].
IANA is requested to assign the following new DHCPv6 Option Code in the registry maintained in http://www.iana.org/assignments/dhcpv6-parameters:
| Option Name | Value |
|---|---|
| OPTION_V6_DOTS | TBA |
IANA is requested to assign the following new DHCPv4 Option Code in the registry maintained in http://www.iana.org/assignments/bootp-dhcp-parameters/:
| Option Name | Value | Data length | Meaning |
|---|---|---|---|
| OPTION_V4_DOTS | TBA | Variable; the maximum length is 255 octets. | Includes the name of the DOTS server. |
Many thanks to Tiru Reddy for his comments.
| [I-D.ietf-dots-architecture] | Mortensen, A., Andreasen, F., Reddy, T., christopher_gray3@cable.comcast.com, c., Compton, R. and N. Teague, "Distributed-Denial-of-Service Open Threat Signaling (DOTS) Architecture", Internet-Draft draft-ietf-dots-architecture-01, October 2016. |
| [RFC2119] | Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997. |
| [RFC2131] | Droms, R., "Dynamic Host Configuration Protocol", RFC 2131, DOI 10.17487/RFC2131, March 1997. |
| [RFC2132] | Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor Extensions", RFC 2132, DOI 10.17487/RFC2132, March 1997. |
| [RFC3315] | Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C. and M. Carney, "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", RFC 3315, DOI 10.17487/RFC3315, July 2003. |
| [I-D.ietf-dots-use-cases] | Dobbins, R., Fouant, S., Migault, D., Moskowitz, R., Teague, N., Xia, L. and K. Nishizuka, "Use cases for DDoS Open Threat Signaling", Internet-Draft draft-ietf-dots-use-cases-04, March 2017. |
| [RFC4732] | Handley, M., Rescorla, E. and IAB, "Internet Denial-of-Service Considerations", RFC 4732, DOI 10.17487/RFC4732, December 2006. |
| [RFC6125] | Saint-Andre, P. and J. Hodges, "Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)", RFC 6125, DOI 10.17487/RFC6125, March 2011. |
| [RFC7227] | Hankins, D., Mrugalski, T., Siodelski, M., Jiang, S. and S. Krishnan, "Guidelines for Creating New DHCPv6 Options", BCP 187, RFC 7227, DOI 10.17487/RFC7227, May 2014. |