| DOTS | M. Boucadair |
| Internet-Draft | Orange |
| Intended status: Standards Track | T. Reddy |
| Expires: December 28, 2019 | McAfee |
| June 26, 2019 |
Distributed-Denial-of-Service Open Threat Signaling (DOTS) Server Discovery
draft-ietf-dots-server-discovery-04
It may not be possible for a network to determine the cause for an attack, but instead just realize that some resources seem to be under attack. To fill that gap, Distributed-Denial-of-Service Open Threat Signaling (DOTS) allows a network to inform a DOTS server that it is under a potential attack so that appropriate mitigation actions are undertaken.
This document specifies mechanisms to configure DOTS clients with DOTS servers. The discovery procedure also covers the DOTS Signal Channel Call Home.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on December 28, 2019.
Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
DDoS Open Threat Signaling (DOTS) [I-D.ietf-dots-architecture] specifies an architecture, in which a DOTS client can inform a DOTS server that the network is under a potential attack and that appropriate mitigation actions are required. Indeed, because the lack of a common method to coordinate a real-time response among involved actors and network domains inhibits the effectiveness of DDoS attack mitigation, DOTS signal channel protocol [I-D.ietf-dots-signal-channel] is meant to carry requests for DDoS attack mitigation, thereby reducing the impact of an attack and leading to more efficient defensive actions in various deployment scenarios such as those discussed in [I-D.ietf-dots-use-cases]. Moreover, DOTS clients can instruct a DOTS server to install filtering rules by means of DOTS data channel [I-D.ietf-dots-data-channel].
The basic high-level DOTS architecture is illustrated in Figure 1 ([I-D.ietf-dots-architecture]):
+-----------+ +-------------+
| Mitigator | ~~~~~~~~~~ | DOTS Server |
+-----------+ +-------------+
|
|
|
+---------------+ +-------------+
| Attack Target | ~~~~~~ | DOTS Client |
+---------------+ +-------------+
Figure 1: Basic DOTS Architecture
[I-D.ietf-dots-architecture] specifies that the DOTS client may be provided with a list of DOTS servers; each associated with one or more IP addresses. These addresses may or may not be of the same address family. The DOTS client establishes one or more DOTS sessions by connecting to the provided DOTS server addresses.
This document specifies methods for DOTS clients to discover their DOTS server(s). The rationale for specifying multiple discovery mechanisms is discussed in Section 3.
The discovery methods can also be used by a DOTS server to locate a DOTS client in the context of DOTS Signal Channel Call Home [I-D.ietf-dots-signal-call-home].
Considerations for the selection of DOTS server(s) by multi-homed DOTS clients is out of scope; the reader should refer to [I-D.ietf-dots-multihoming] for more details.
This document assumes that security credentials to authenticate DOTS server(s) are provisioned to a DOTS client using a variety of means such as (but not limited to) those discussed in [I-D.ietf-netconf-zerotouch] or [I-D.ietf-anima-bootstrapping-keyinfra]. DOTS clients use those credentials for authentication purposes following the rules documented in [I-D.ietf-dots-signal-channel].
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119][RFC8174] when, and only when, they appear in all capitals, as shown here.
The reader should be familiar with the terms defined in [I-D.ietf-dots-architecture] and [RFC3958].
DHCP refers to both DHCPv4 [RFC2131] and DHCPv6 [RFC8415].
"Peer DOTS agent" refers to the peer DOTS server (normal DOTS operation) or to a peer DOTS client (for DOTS Signal Channel Call Home).
It is tempting to specify one single discovery mechanism for DOTS. Nevertheless, the analysis of the various use cases sketched in [I-D.ietf-dots-use-cases] reveals that it is unlikely that one single discovery method can be suitable for all the sample deployments. Concretely:
Consequently, this document describes a unified discovery logic (Section 4) which involves the following mechanisms:
A key point in the deployment of DOTS is the ability of network operators to be able to configure DOTS clients with the correct DOTS server(s) information consistently. To accomplish this, operators will need a consistent set of ways in which DOTS clients can discover this information, and a consistent priority among these options. If some devices prefer manual configuration over dynamic discovery, while others prefer dynamic discovery over manual configuration, the result will be a process of "whack-a-mole", where the operator must find devices that are using the wrong DOTS server(s), determine how to ensure the devices are configured properly, and then reconfigure the device through the preferred method.
All DOTS clients MUST support at least one of the three mechanisms below to determine a DOTS server list. All DOTS clients SHOULD implement all three, or as many as are practical for any specific device, of these ways to discover DOTS servers, in order to facilitate the deployment of DOTS in large scale environments:
Some of these mechanisms imply the use of DNS to resolve the IP address(es) of the DOTS server, while others imply an IP address of the relevant DOTS server is obtained directly. Implementation options may vary on a per device basis, as some devices may not have DNS capabilities and/or proper configuration.
DOTS clients will prefer information received from the discovery methods in the order listed.
On hosts with more than one interface or address family (IPv4/v6), the DOTS server discovery procedure has to be performed for each combination of interface and address family. A client MAY choose to perform the discovery procedure only for a desired interface/address combination if the client does not wish to discover a DOTS server for all combinations of interface and address family.
The above procedure MUST also be followed by a DOTS gateway. Likewise, this procedure MUST be followed by a DOTS server in the context of DOTS Signal Channel Call Home [I-D.ietf-dots-signal-call-home].
The discovery method MUST be reiterated upon the following events:
As reported in Section 1.7.2 of [RFC6125]:
In order to allow for PKIX-based authentication between a DOTS client and server while accommodating for the current best practices for issuing certificates, this document allows for configuring names to DOTS clients. These names can be used for two purposes: to retrieve the list of IP addresses of a DOTS server or to be presented as a reference identifier for authentication purposes.
Defining the option to include a list of IP addresses would avoid a dependency on an underlying name resolution, but that design requires to also supply a name for PKIX-based authentication purposes.
The design assumes that the same peer DOTS agent is used for establishing both signal and data channels. For more customized configurations (e.g., transport-specific configuration, distinct DOTS servers for the signal and the data channels), an operator can supply only a DOTS reference identifier that will be then passed to the procedure described in Section 6.
The DHCPv6 DOTS Reference Identifier option is used to configure a name of the DOTS server (or the name of the DOTS client for DOTS Signal Channel Call Home). The format of this option is shown in Figure 2.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OPTION_V6_DOTS_RI | Option-length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | | dots-agent-name (FQDN) | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: DHCPv6 DOTS Reference Identifier Option
Figure 2 are as follows:
Figure 3. This example conveys the FQDN "dots.example.com.".
+------+------+------+------+------+------+------+------+------+
| 0x04 | d | o | t | s | 0x07 | e | x | a |
+------+------+------+------+------+------+------+------+------+
| m | p | l | e | 0x03 | c | o | m | 0x00 |
+------+------+------+------+------+------+------+------+------+
Figure 3: An example of the dots-agent-name Encoding
The DHCPv6 DOTS Address option can be used to configure a list of IPv6 addresses of a DOTS server (or a DOTS client for DOTS Signal Channel Call Home). The format of this option is shown in Figure 4. As a reminder, this format follows the guidelines for creating new DHCPv6 options (Section 5.1 of [RFC7227]).
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OPTION_V6_DOTS_ADDRESS | Option-length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | | DOTS ipv6-address | | | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | | DOTS ipv6-address | | | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 4: DHCPv6 DOTS Address Option
Figure 4 are as follows:
DHCP clients MAY request options OPTION_V6_DOTS_RI and OPTION_V6_DOTS_ADDRESS, as defined in [RFC8415], Sections 18.2.1, 18.2.2, 18.2.4, 18.2.5, 18.2.6, and 21.7. As a convenience to the reader, it is mentioned here that the DHCP client includes the requested option codes in the Option Request Option.
If the DHCP client receives more than one instance of OPTION_V6_DOTS_RI (or OPTION_V6_DOTS_ADDRESS) option, it MUST use only the first instance of that option.
If the DHCP client receives both OPTION_V6_DOTS_RI and OPTION_V6_DOTS_ADDRESS, the content of OPTION_V6_DOTS_RI is used as reference identifier for authentication purposes (e.g., PKIX [RFC6125]), while the addresses included in OPTION_V6_DOTS_ADDRESS are used to reach the peer DOTS agent. In other words, the name conveyed in OPTION_V6_DOTS_RI MUST NOT be passed to underlying resolution library in the presence of OPTION_V6_DOTS_ADDRESS in a response.
If the DHCP client receives OPTION_V6_DOTS_RI only, but OPTION_V6_DOTS_RI option contains more than one name, as distinguished by the presence of multiple root labels, the DHCP client MUST use only the first name. Once the name is validated (Section 8 of [RFC8415]), the name is passed to a name resolution library. Moreover, that name is also used as a reference identifier for authentication purposes.
If the DHCP client receives OPTION_V6_DOTS_ADDRESS only, the address(es) included in OPTION_V6_DOTS_ADDRESS is used to reach the peer DOTS agent. In addition, these addresses can be used as identifiers for authentication.
The DHCP client MUST silently discard multicast and host loopback addresses [RFC6890] conveyed in OPTION_V6_DOTS_ADDRESS.
The DHCPv4 DOTS Reference Identifier option is used to configure a name of the peer DOTS agent. The format of this option is illustrated in Figure 5.
Code Length Peer DOTS agent name
+-----+-----+-----+-----+-----+-----+-----+--
|TBA3 | n | s1 | s2 | s3 | s4 | s5 | ...
+-----+-----+-----+-----+-----+-----+-----+--
The values s1, s2, s3, etc. represent the domain name labels in the
domain name encoding.
Figure 5: DHCPv4 DOTS Reference Identifier Option
The fields of the option shown in Figure 5 are as follows:
The DHCPv4 DOTS Address option can be used to configure a list of IPv4 addresses of a peer DOTS agent. The format of this option is illustrated in Figure 6.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Code=TBA4 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | List-Length | List of | +-+-+-+-+-+-+-+-+ DOTS | / IPv4 Addresses / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ --- | List-Length | List of | | +-+-+-+-+-+-+-+-+ DOTS | | / IPv4 Addresses / | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | . ... . optional +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | List-Length | List of | | +-+-+-+-+-+-+-+-+ DOTS | | / IPv4 Addresses / | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ---
Figure 6: DHCPv4 DOTS Address Option
0 8 16 24 32 40 48
+-----+-----+-----+-----+-----+-----+--
| a1 | a2 | a3 | a4 | a1 | a2 | ...
+-----+-----+-----+-----+-----+-----+--
IPv4 Address 1 IPv4 Address 2 ...
The fields of the option shown in Figure 6 are as follows:
This format assumes that an IPv4 address is encoded as a1.a2.a3.a4.
Figure 7: Format of the List of DOTS IPv4 Addresses
[RFC3396] MUST be used if OPTION_V4_DOTS_ADDRESS exceeds the maximum DHCPv4 option size of 255 octets.
To discover a peer DOTS agent, the DHCPv4 client MUST include both OPTION_V4_DOTS_RI and OPTION_V4_DOTS_ADDRESS in a Parameter Request List Option [RFC2132].
If the DHCP client receives more than one instance of OPTION_V4_DOTS_RI (or OPTION_V4_DOTS_ADDRESS) option, it MUST use only the first instance of that option.
If the DHCP client receives both OPTION_V4_DOTS_RI and OPTION_V4_DOTS_ADDRESS, the content of OPTION_V6_DOTS_RI is used as reference identifier for authentication purposes, while the addresses included in OPTION_V4_DOTS_ADDRESS are used to reach the peer DOTS agent. In other words, the name conveyed in OPTION_V4_DOTS_RI MUST NOT be passed to underlying resolution library in the presence of OPTION_V4_DOTS_ADDRESS in a response.
If the DHCP client receives OPTION_V4_DOTS_RI only, but OPTION_V4_DOTS_RI option contains more than one name, as distinguished by the presence of multiple root labels, the DHCP client MUST use only the first name. Once the name is validated (Section 10 of [RFC8415]), the name is passed to a name resolution library. Moreover, that name is also used as a reference identifier for authentication purposes.
If the DHCP client receives OPTION_V4_DOTS_ADDRESS only, the address(es) included in OPTION_V4_DOTS_ADDRESS is used to reach the peer DOTS server. In addition, these addresses can be used as identifiers for authentication.
The DHCP client MUST silently discard multicast and host loopback addresses conveyed in OPTION_V4_DOTS_ADDRESS.
This mechanism is performed in two steps:
Once the DOTS client has retrieved client's DNS domain or discovered the peer DOTS agent name that needs to be resolved (e.g., Section 5), an S-NAPTR lookup with 'DOTS' application service and the desired protocol tag is made to obtain information necessary to connect to the authoritative DOTS server within the given domain.
This specification defines "DOTS" and "DOTS-CALL-HOME" as application service tags (Sections 9.3.1 and 9.3.2). It also defines "signal.udp" (Section 9.3.3), "signal.tcp" (Section 9.3.4), and "data.tcp" (Section 9.3.5) as application protocol tags. An example is provided in Figure 8.
In the example below, for domain 'example.net', the resolution
algorithm will result in IP address(es), port, tag and protocol
tuples as follows:
example.net.
IN NAPTR 100 10 "" DOTS:signal.udp "" signal.example.net.
IN NAPTR 200 10 "" DOTS:signal.tcp "" signal.example.net.
IN NAPTR 300 10 "" DOTS:data.tcp "" data.example.net.
signal.example.net.
IN NAPTR 100 10 "s" DOTS:signal.udp "" _dots._signal._udp.example.net.
IN NAPTR 200 10 "s" DOTS:signal.tcp "" _dots._signal._tcp.example.net.
data.example.net.
IN NAPTR 100 10 "s" DOTS:data.tcp "" _dots._data._tcp.example.net.
_dots._signal._udp.example.net.
IN SRV 0 0 5000 a.example.net.
_dots._signal._tcp.example.net.
IN SRV 0 0 5001 a.example.net.
_dots._data._tcp.example.net.
IN SRV 0 0 5002 a.example.net.
a.example.net.
IN AAAA 2001:db8::1
+-------+----------+-------------+------+--------+
| Order | Protocol | IP address | Port | Tag |
+-------+----------+-------------+------+--------+
| 1 | UDP | 2001:db8::1 | 5000 | Signal |
| 2 | TCP | 2001:db8::1 | 5001 | Signal |
| 3 | TCP | 2001:db8::1 | 5002 | Data |
+-------+----------+-------------+------+--------+
Figure 8: Sample Example
An example is provided in Figure 9 for the Call Home case.
In the example below, for domain 'example.net', the resolution
algorithm will result in IP address(es), port, tag and protocol
tuples as follows:
example.net.
IN NAPTR 100 10 "" DOTS-CALL-HOME:signal.udp "" signal.example.net.
IN NAPTR 200 10 "" DOTS-CALL-HOME:signal.tcp "" signal.example.net.
signal.example.net.
IN NAPTR 100 10 "s" DOTS-CALL-HOME:signal.udp ""
_dots-call-home._signal._udp.example.net.
IN NAPTR 200 10 "s" DOTS-CALL-HOME:signal.tcp ""
_dots-call-home._signal._tcp.example.net.
_dots-call-home._signal._udp.example.net.
IN SRV 0 0 6000 b.example.net.
_dots-call-home._signal._tcp.example.net.
IN SRV 0 0 6001 b.example.net.
b.example.net.
IN AAAA 2001:db8::2
+-------+----------+-------------+------+--------+
| Order | Protocol | IP address | Port | Tag |
+-------+----------+-------------+------+--------+
| 1 | UDP | 2001:db8::2 | 6000 | Signal |
| 2 | TCP | 2001:db8::2 | 6001 | Signal |
+-------+----------+-------------+------+--------+
Figure 9: Sample Example for DOTS Signal Channel Call Home
If no DOTS-specific S-NAPTR records can be retrieved, the discovery procedure fails for this domain name (and the corresponding interface and IP protocol version). If more domain names are known, the discovery procedure MAY perform the corresponding S-NAPTR lookups immediately. However, before retrying a lookup that has failed, a DOTS client MUST wait a time period that is appropriate for the encountered error (e.g., NXDOMAIN, timeout, etc.).
DNS-based Service Discovery (DNS-SD) [RFC6763] provides generic solutions for discovering services. DNS-SD defines a set of naming rules for certain DNS record types that they use for advertising and discovering services.
Section 4.1 of [RFC6763] specifies that a service instance name in DNS-SD has the following structure:
<Instance> . <Service> . <Domain>
The <Domain> portion specifies the DNS sub-domain where the service instance is registered. It may be "local.", indicating the mDNS local domain, or it may be a conventional domain name such as "example.com.".
The <Service> portion of the DOTS service instance name MUST be "_dots._signal._udp" or "_dots._signal._tcp" or "_dots._data._tcp" or "_dots-call-home._signal._udp" or "_dots-call-home._signal._tcp".
DOTS-related security considerations are discussed in Section 4 of [I-D.ietf-dots-architecture] is to be considered. DOTS agents must authenticate each other using (D)TLS before a DOTS session is considered valid according to the [I-D.ietf-dots-signal-channel].
The security considerations in [RFC2131] and [RFC8415] are to be considered.
The primary attack against the methods described in Section 6 is one that would lead to impersonation of a DOTS server. An attacker could attempt to compromise the S-NAPTR resolution. The use of mutual authentication makes it difficult to redirect a DOTS client to an illegitimate DOTS server.
Since DNS-SD is just a specification for how to name and use records in the existing DNS system, it has no specific additional security requirements over and above those that already apply to DNS queries and DNS updates. For DNS queries, DNS Security Extensions (DNSSEC) [RFC4033] SHOULD be used where the authenticity of information is important. For DNS updates, secure updates [RFC2136][RFC3007] SHOULD generally be used to control which clients have permission to update DNS records.
IANA is requested to allocate the SRV service name of "_dots._signal" for DOTS signal channel over UDP or TCP, and the service name of "_dots._data" for DOTS data channel over TCP.
IANA is requested to assign the following new DHCPv6 Option Code in the registry maintained in: http://www.iana.org/assignments/dhcpv6-parameters.
Value Description Client ORO Singleton Option TBD1 OPTION_V6_DOTS_RI Yes Yes TBD2 OPTION_V6_DOTS_ADDRESS Yes No
IANA is requested to assign the following new DHCPv4 Option Code in the registry maintained in: http://www.iana.org/assignments/bootp-dhcp-parameters/.
| Option Name | Value | Data length | Meaning |
|---|---|---|---|
| OPTION_V4_DOTS_RI | TBA3 | Variable; the maximum length is 255 octets. | Includes the name of the DOTS server. |
| OPTION_V4_DOTS_ADDRESS | TBA4 | Variable; the minimum length is 5. | Includes one or multiple lists of DOTS IP addresses; each list is treated as a separate DOTS server. |
This document requests IANA to make the following allocations from the registry available at: https://www.iana.org/assignments/s-naptr-parameters/s-naptr-parameters.xhtml.
Prashanth Patil Cisco Systems, Inc. Email: praspati@cisco.com
Thanks to Brian Carpenter for the review of the BRSKI text.
Many thanks to Russ White for the review, comments, and text contribution.
Thanks for Dan Wing and Pei Wei for the review and comments.
Thanks to Bernie Volz for the review of the DHCP section.