| Network Working Group | M. Boucadair |
| Internet-Draft | Orange |
| Intended status: Standards Track | T. Reddy |
| Expires: January 1, 2018 | McAfee |
| P. Patil | |
| Cisco | |
| June 30, 2017 |
Distributed-Denial-of-Service Open Threat Signaling (DOTS) Server Discovery
draft-boucadair-dots-server-discovery-01
It may not be possible for a network to determine the cause for an attack, but instead just realize that some resources seem to be under attack. To fill that gap, Distributed-Denial-of-Service Open Threat Signaling (DOTS) allows a network to inform a server that it is under a potential attack so that appropriate mitigation actions are undertaken.
This document specifies mechanisms to configure nodes with DOTS servers.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on January 1, 2018.
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
In many deployments, it may not be possible for a network to determine the cause for a distributed Denial-of-Service (DoS) attack [RFC4732], but instead just realize that some resources seem to be under attack. To fill that gap, the IETF is specifying an architecture, called DDoS Open Threat Signaling (DOTS) [I-D.ietf-dots-architecture], in which a DOTS client can inform a DOTS server that the network is under a potential attack and that appropriate mitigation actions are required. Indeed, because the lack of a common method to coordinate a real-time response among involved actors and network domains inhibits the effectiveness of DDoS attack mitigation, DOTS protocol is meant to carry requests for DDoS attack mitigation, thereby reducing the impact of an attack and leading to more efficient defensive actions. [I-D.ietf-dots-use-cases] identifies a set of scenarios for DOTS; almost all these scenarios involve a CPE.
The basic high-level DOTS architecture is illustrated in Figure 1 ([I-D.ietf-dots-architecture]):
+-----------+ +-------------+
| Mitigator | ~~~~~~~~~~ | DOTS Server |
+-----------+ +-------------+
|
|
|
+---------------+ +-------------+
| Attack Target | ~~~~~~ | DOTS Client |
+---------------+ +-------------+
Figure 1: Basic DOTS Architecture
[I-D.ietf-dots-architecture] specifies that the DOTS client may be provided with a list of DOTS servers; each associated with one or more IP addresses. These addresses may or may not be of the same address family. The DOTS client establishes one or more signaling sessions by connecting to the provided DOTS server addresses. The logic for connecting to one or multiple IP addresses is out of scope of this document.
This document specifies methods for DOTS clients to discover their DOTS server(s). The rationale for specifying multiple discovery mechanisms is discussed in Section 4.
Considerations for the selection of DOTS server(s) by multi-homed DOTS client is out of scope; the reader should refer to [I-D.boucadair-dots-multihoming] for more details.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
This document makes use of the following terms:
The reader should be familiar with other terms defined in [I-D.ietf-dots-architecture] and [RFC3958].
It is tempting to specify one single discovery mechanism for DOTS. Nevertheless, the analysis of the various use cases sketched in [I-D.ietf-dots-use-cases] reveals that it is unlikely that one single discovery method can be suitable for all the sample deployments (Table 1). Concretely:
| Use Case | Requires a CPE | The Network Provider is also the DDoS Mitigation Provider |
|---|---|---|
| Enterprise with an upstream transit provider DDoS mitigation Service | Yes | Yes |
| Enterprise with a Cloud DDoS Mitigation Provider | Yes | No |
| Homenet DDoS Detection Collaboration for ISP network management | Yes | Yes |
| DDoS Orchestration | No | N/A |
Consequently:Section 5.
A common logic to build the DOTS servers list is elaborated in
In order to encourage consistent DOTS behaviors while allowing for automated DOTS server discovery, the following procedure MUST be followed by a DOTS client to built a DOTS server(s) list to contact:
The above procedure MUST also be followed by a DOTS gateway.
Details specific to each aforementioned step are elaborated in Sections 6, 7, 8, and 9.
As reported in Section 1.7.2 of [RFC6125], "few certification authorities issue server certificates based on IP addresses, but preliminary evidence indicates that such certificates are a very small percentage (less than 1%) of issued certificates". In order to allow for PKIX-based authentication between a DOTS client and server, this document specifies the DHCP option as a name. One or multiple IP addresses may be returned as a result of name resolution.
Defining the option to include a list of IP addresses would avoid a dependency on an underlying name resolution, but that design requires to also supply a name for PKIX-based authentication purposes.
Because aliasing is to be avoided (Section 7 of [RFC7227]), this document specifies one single option that conveys a DOTS server's name.
This specification assumes that the same name is used to contact the DOTS server for both signal and data channels needs. The selection of the transport protocols to be used and the companion service port numbers are assumed to be by default determined by the DOTS client as specified in [I-D.ietf-dots-signal-channel] and [I-D.ietf-dots-data-channel]. The provisioned DOTS name is passed to the DOTS client that in its turn pass it to an underlying resolution library (e.g., DNS).
The DHCPv6 DOTS option is used to configure a name of the DOTS server. The format of this option is shown in Figure 2.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OPTION_V6_DOTS | Option-length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | | dots-server-name (FQDN) | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: DHCPv6 DOTS option
Figure 2 are as follows:
Figure 3. This example conveys the FQDN "dots.example.com.".
+------+------+------+------+------+------+------+------+------+
| 0x04 | d | o | t | s | 0x07 | e | x | a |
+------+------+------+------+------+------+------+------+------+
| m | p | l | e | 0x03 | c | o | m | 0x00 |
+------+------+------+------+------+------+------+------+------+
Figure 3: An example of the dots-server-name encoding
DHCP clients MAY request option OPTION_V6_DOTS, as defined in [RFC3315], Sections 17.1.1, 18.1.1, 18.1.3, 18.1.4, 18.1.5, and 22.7. As a convenience to the reader, it is mentioned here that the DHCP client includes the requested option codes in the Option Request Option.
If the DHCP client receives more than one OPTION_V6_DOTS option, it MUST use only the first instance of that option.
If the OPTION_V6_DOTS option contains more than one name, as distinguished by the presence of multiple root labels, the DHCP client MUST use only the first name. Once the name is validated (Section 8 of [RFC3315]), the name is passed to a name resolution library.
The DHCPv4 DOTS option is used to configure a name of the DOTS server. The format of this option is illustrated in Figure 4.
Code Length DOTS server name
+-----+-----+-----+-----+-----+-----+-----+--
| TBA | n | s1 | s2 | s3 | s4 | s5 | ...
+-----+-----+-----+-----+-----+-----+-----+--
The values s1, s2, s3, etc. represent the domain name labels in the
domain name encoding.
Figure 4: DHCPv4 DOTS option
The fields of the option shown in Figure 4 are as follows:
To discover a DOTS server, the DHCPv4 client MUST include OPTION_V4_DOTS in a Parameter Request List Option [RFC2132].
If the DHCP client receives more than one OPTION_V4_DOTS option, it MUST use only the first instance of that option.
If the OPTION_V4_DOTS option contains more than one name, as distinguished by the presence of multiple root labels, the DHCP client MUST use only the first FQDN. Once the name is validated (Section 8 of [RFC3315]), the name is passed to a name resolution library.
This mechanism is performed in two steps:
A DOTS client has to determine the domain in which it is located. The following section describes the means to obtain the domain name from DHCP. Other means of retrieving domain names may be used, which are outside the scope of this document, e.g., local configuration.
Implementations MAY allow the user to specify a default name that is used, if no specific name has been configured.
DHCP can be used to determine the domain name related to an interface's point of network attachment. Network operators may provide the domain name to be used for service discovery within an access network using DHCP. Sections 3.2 and 3.3 of [RFC5986] define DHCP IPv4 and IPv6 access network domain name options, OPTION_V4_ACCESS_DOMAIN and OPTION_V6_ACCESS_DOMAIN respectively, to identify a domain name that is suitable for service discovery within the access network.
For IPv4, the discovery procedure MUST request the access network domain name option in a Parameter Request List option, as described in [RFC2131]. [RFC2132] defines the DHCP IPv4 domain name option; while this option is less suitable, a client MAY request for it if the access network domain name defined in [RFC5986] is not available.
For IPv6, the discovery procedure MUST request for the access network domain name option in an Options Request Option (ORO) within an Information-request message, as described in [RFC3315].
If neither option can be retrieved the procedure fails for this interface. If a result can be retrieved it will be used as an input for S-NAPTR resolution.
Once the DOTS client has retrieved domain names, an S-NAPTR lookup with 'DOTS' application service and the desired protocol tag is made to obtain information necessary to connect to the authoritative DOTS server within the given domain. S-NAPTR lookup lets the DOTS server administrators provision the preferred DOTS transport protocol between the client and the server and allows the DOTS client to discover this preference.
This specification defines "DOTS" as an application service tag (Section 11.3.1) and "signal.udp" (Section 11.3.2), "signal.tcp" (Section 11.3.3), and "data.tcp" (Section 11.3.4) as application protocol tags.
(Proposal-1)
In the example below, for domain 'example.net', the resolution
algorithm will result in IP address(es), port, tag and protocol tuples as
follows:
example.net.
IN NAPTR 100 10 "" DOTS:signal.udp "" signal.example.net.
IN NAPTR 200 10 "" DOTS:signal.tcp "" signal.example.net.
IN NAPTR 300 10 "" DOTS:data.tcp "" data.example.net.
signal.example.net.
IN NAPTR 100 10 S DOTS:signal.udp "" _dots._signal._udp.example.net.
IN NAPTR 200 10 S DOTS:signal.tcp "" _dots._signal._tcp.example.net.
data.example.net.
IN NAPTR 100 10 S DOTS:data.tcp "" _dots._data._tcp.example.net.
_dots._signal._udp.example.net.
IN SRV 0 0 5000 a.example.net.
_dots._signal._tcp.example.net.
IN SRV 0 0 5001 a.example.net.
_dots._data._tcp.example.net.
IN SRV 0 0 5002 a.example.net.
a.example.net.
IN AAAA 2001:db8::1
+-------+----------+-------------+------+--------+
| Order | Protocol | IP address | Port | Tag |
+-------+----------+-------------+------+--------+
| 1 | UDP | 2001:db8::1 | 5000 | Signal |
| 2 | TCP | 2001:db8::1 | 5001 | Signal |
| 3 | TCP | 2001:db8::1 | 5002 | Data |
+-------+----------+-------------+------+--------+
(Proposal-2)
In the example below, for domain 'example.net', the resolution
algorithm will result in IP address(es), port, tag and protocol tuples as
follows:
example.net.
IN NAPTR 100 10 "" DOTS-SIGNAL:dots.udp "" signal.example.net.
IN NAPTR 200 10 "" DOTS-SIGNAL:dots.tcp "" signal.example.net.
IN NAPTR 300 10 "" DOTS-DATA:dots.tcp "" data.example.net.
signal.example.net.
IN NAPTR 100 10 S DOTS:signal.udp "" _dots._signal._udp.example.net.
IN NAPTR 200 10 S DOTS:signal.tcp "" _dots._signal._tcp.example.net.
data.example.net.
IN NAPTR 100 10 S DOTS:data.tcp "" _dots._data._tcp.example.net.
_dots._signal._udp.example.net.
IN SRV 0 0 5000 a.example.net.
_dots._signal._tcp.example.net.
IN SRV 0 0 5001 a.example.net.
_dots._data._tcp.example.net.
IN SRV 0 0 5003 a.example.net.
a.example.net.
IN AAAA 2001:db8::1
+-------+----------+-------------+------+--------+
| Order | Protocol | IP address | Port | Tag |
+-------+----------+-------------+------+--------+
| 1 | UDP | 2001:db8::1 | 5000 | Signal |
| 2 | TCP | 2001:db8::1 | 5001 | Signal |
| 3 | TCP | 2001:db8::1 | 5003 | Data |
+-------+----------+-------------+------+--------+
If no DOTS-specific S-NAPTR records can be retrieved, the discovery procedure fails for this domain name (and the corresponding interface and IP protocol version). If more domain names are known, the discovery procedure MAY perform the corresponding S-NAPTR lookups immediately. However, before retrying a lookup that has failed, a DOTS client MUST wait a time period that is appropriate for the encountered error (e.g., NXDOMAIN, timeout, etc.).
DNS-based Service Discovery (DNS-SD) [RFC6763] and Multicast DNS (mDNS) [RFC6762] provide generic solutions for discovering services. DNS-SD/mDNS define a set of naming rules for certain DNS record types that they use for advertising and discovering services.
Section 4.1 of [RFC6763] specifies that a service instance name in DNS-SD has the following structure:
<Instance> . <Service> . <Domain>
The <Domain> portion specifies the DNS sub-domain where the service instance is registered. It may be "local.", indicating the mDNS local domain, or it may be a conventional domain name such as "example.com.".
The <Service> portion of the DOTS service instance name MUST be "_dots._signal._udp" or "_dots._signal._tcp" or "_dots._data._tcp".
A DOTS client can proactively discover DOTS servers being advertised in the site by multicasting a PTR query to one or all of the following:
A DOTS server can send out gratuitous multicast DNS answer packets whenever it starts up, wakes from sleep, or detects a change in network configuration. DOTS clients receive these gratuitous packets and cache information contained in it.
IP anycast can also be used for DOTS service discovery. A packet sent to an anycast address is delivered to the 'topologically nearest' network interface with the anycast address.
When a DOTS client requires DOTS services, it attempts to establish a signaling session with the assigned anycast address(es) defined in Sections 11.4 and 11.5. A DOTS server, that receives a DOTS request with an anycast address, SHOULD redirect the DOTS client to the appropriate DOTS unicast server(s) using the mechanism described in Section 5.5 of [I-D.ietf-dots-signal-channel], unless it is configured otherwise. Indeed, a DOTS server SHOULD be configurable to maintain all DOTS communications using anycast. DOTS redirect is not made mandatory because the use of anycast is not problematic for some deployment scenarios such as an enterprise network deploying one single DOTS gateway connected to one single network provider.
[I-D.boucadair-dots-multihoming] identifies a set of deployment schemes in which the use of anycast is not recommended.
DOTS-related security considerations are discussed in Section 4 of [I-D.ietf-dots-architecture] is to be considered. DOTS agents must authenticate each other using (D)TLS before a DOTS signaling session is considered valid.
If the DOTS client is explicitly configured with DOTS server(s) then the DOTS client can also be explicitly configured with credentials to authenticate the DOTS server.
The CPE device acting as a DOTS client MAY use Bootstrapping Remote Secure Key Infrastructures (BRSKI) discussed in [I-D.ietf-anima-bootstrapping-keyinfra] to automatically bootstrap using the vendor installed X.509 certificate, in combination with a domain registrar provided by the network provider and vendor's authorizing service. The CPE device authenticates to the network provider using the vendor installed X.509 certificate and the network provider validates the vendor installed certificate on the CPE device using the Manufacturer Authorized Signing Authority (MASA) service. If authentication is successful then the CPE device can request and get a voucher from the MASA service via the domain registrar. The voucher is signed by the MASA service and includes the network provider's trust anchor certificate. The CPE device validates the signed voucher using the manufacturer installed trust anchor associated with the vendor's selected MASA service and stores the network provider's trust anchor certificate. The CPE device then uses Enrollment over Secure Transport (EST) [RFC7030] for certificate enrollment (Section 3.8 in [I-D.ietf-anima-bootstrapping-keyinfra]). The DOTS client on the CPE device can authenticate to the DOTS server using the certificate provisioned by the EST server and the DOTS client can validate the DOTS server certificate using the network provider's trust anchor certificate it had received in the voucher.
The security considerations in [RFC2131] and [RFC3315] are to be considered.
The primary attack against the methods described in Section 7 is one that would lead to impersonation of a DOTS server. An attacker could attempt to compromise the S-NAPTR resolution. The use of mutual authentication makes it difficult to redirect a DOTS client to an illegitimate DOTS server.
Since DNS-SD is just a specification for how to name and use records in the existing DNS system, it has no specific additional security requirements over and above those that already apply to DNS queries and DNS updates. For DNS queries, DNS Security Extensions (DNSSEC) [RFC4033] SHOULD be used where the authenticity of information is important. For DNS updates, secure updates [RFC2136][RFC3007] SHOULD generally be used to control which clients have permission to update DNS records.
For mDNS, in addition to what has been described above, a principal security threat is a security threat inherent to IP multicast routing and any application that runs on it. A rogue system can advertise that it is a DOTS server. Discovery of such rogue systems as DOTS servers, in itself, is not a security threat if the DOTS client authenticates the discovered DOTS servers.
Anycast-related security considerations are discussed in [RFC4786] and [RFC7094].
IANA is requested to allocate the SRV service name of "_dots._signal" for DOTS signal channel over UDP or TCP, and the service name of "_dots._data" for DOTS data channel over TCP.
IANA is requested to assign the following new DHCPv6 Option Code in the registry maintained in http://www.iana.org/assignments/dhcpv6-parameters:
| Option Name | Value |
|---|---|
| OPTION_V6_DOTS | TBA |
IANA is requested to assign the following new DHCPv4 Option Code in the registry maintained in http://www.iana.org/assignments/bootp-dhcp-parameters/:
| Option Name | Value | Data length | Meaning |
|---|---|---|---|
| OPTION_V4_DOTS | TBA | Variable; the maximum length is 255 octets. | Includes the name of the DOTS server. |
This document requests IANA to make the following allocations from the registry available at: https://www.iana.org/assignments/s-naptr-parameters/s-naptr-parameters.xhtml.
IANA has assigned a single IPv4 address from the 192.0.0.0/24 prefix and registered it in the "IANA IPv4 Special-Purpose Address Registry" [RFC6890].
+----------------------+-------------------------------------------+ | Attribute | Value | +----------------------+-------------------------------------------+ | Address Block | TBA | | Name | Distributed-Denial-of-Service Open Threat | | | Signaling (DOTS) Anycast | | RFC | <this document> | | Allocation Date | <date of approval of this document> | | Termination Date | N/A | | Source | True | | Destination | True | | Forwardable | True | | Global | True | | Reserved-by-Protocol | False | +----------------------+-------------------------------------------+
IANA has assigned a single IPv6 address from the 2001:0000::/23 prefix and registered it in the "IANA IPv6 Special-Purpose Address Registry" [RFC6890].
+----------------------+-------------------------------------------+ | Attribute | Value | +----------------------+-------------------------------------------+ | Address Block | TBA | | Name | Distributed-Denial-of-Service Open Threat | | | Signaling (DOTS) Anycast | | RFC | <this document> | | Allocation Date | <date of approval of this document> | | Termination Date | N/A | | Source | True | | Destination | True | | Forwardable | True | | Global | True | | Reserved-by-Protocol | False | +----------------------+-------------------------------------------+
To be completed.