Distributed Denial-of-Service Open
Threat Signaling (DOTS) Signal ChannelCisco Systems, Inc.Cessna Business Park, Varthur HobliSarjapur Marathalli Outer Ring RoadBangaloreKarnataka560103Indiatireddy@cisco.comOrangeRennes35000Francemohamed.boucadair@orange.comCisco Systems, Inc.praspati@cisco.comArbor Networks, Inc.2727 S. State StAnn Arbor, MI48104United Statesamortensen@arbor.netVerisign, Inc.United Statesnteague@verisign.comDOTSThis document specifies the DOTS signal channel, a protocol for
signaling the need for protection against Distributed Denial-of-Service
(DDoS) attacks to a server capable of enabling network traffic
mitigation on behalf of the requesting client. A companion document
defines the DOTS data channel, a separate reliable communication layer
for DOTS management and configuration.A distributed denial-of-service (DDoS) attack is an attempt to make
machines or network resources unavailable to their intended users. In
most cases, sufficient scale can be achieved by compromising enough
end-hosts and using those infected hosts to perpetrate and amplify the
attack. The victim in this attack can be an application server, a host,
a router, a firewall, or an entire network.In many cases, it may not be possible for an network administrators
to determine the causes of an attack, but instead just realize that
certain resources seem to be under attack. This document defines a
lightweight protocol permitting a DOTS client to request mitigation from
one or more DOTS servers for protection against detected, suspected, or
anticipated attacks . This protocol enables cooperation between DOTS
agents to permit a highly-automated network defense that is robust,
reliable and secure.The requirements for DOTS signal channel protocol are obtained from
.This document satisfies all the use cases discussed in except the Third-party DOTS
notifications use case in Section 3.2.3 of which is an optional feature
and not a core use case. Third-party DOTS notifications are not part of
the DOTS requirements document. Moreover, the DOTS architecture does not
assess whether that use case may have an impact on the architecture
itself and/or the DOTS trust model.This is a companion document to the DOTS data channel specification
that defines a
configuration and bulk data exchange mechanism supporting the DOTS
signal channel.The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in .(D)TLS: For brevity this term is used for statements that apply to
both Transport Layer Security and
Datagram Transport Layer Security .
Specific terms will be used for any statement that applies to either
protocol alone.The reader should be familiar with the terms defined in .Network applications have finite resources like CPU cycles, number of
processes or threads they can create and use, maximum number of
simultaneous connections it can handle, limited resources of the control
plane, etc. When processing network traffic, such applications are
supposed to use these resources to offer the intended task in the most
efficient fashion. However, an attacker may be able to prevent an
application from performing its intended task by causing the application
to exhaust the finite supply of a specific resource.TCP DDoS SYN-flood, for example, is a memory-exhaustion attack on the
victim and ACK-flood is a CPU exhaustion attack on the victim (). Attacks on the link are carried out by
sending enough traffic such that the link becomes excessively congested,
and legitimate traffic suffers high packet loss. Stateful firewalls can
also be attacked by sending traffic that causes the firewall to hold
excessive state. The firewall then runs out of memory, and can no longer
instantiate the state required to pass legitimate flows. Other possible
DDoS attacks are discussed in .In each of the cases described above, the possible arrangements
between the DOTS client and DOTS server to mitigate the attack are
discussed in . An example
of network diagram showing a deployment of these elements is shown in
. Architectural relationships between involved
DOTS agents is explained in . In this example, the DOTS
server is operating on the access network.The DOTS server can also be running on the Internet, as depicted in
.In typical deployments, the DOTS client belongs to a different
administrative domain than the DOTS server. For example, the DOTS client
is a firewall protecting services owned and operated by an domain, while
the DOTS server is owned and operated by a different domain providing
DDoS mitigation services. That domain providing DDoS mitigation service
might, or might not, also provide Internet access service to the website
operator.The DOTS server may (not) be co-located with the DOTS mitigator. In
typical deployments, the DOTS server belongs to the same administrative
domain as the mitigator.The DOTS client can communicate directly with the DOTS server or
indirectly via a DOTS gateway.This document focuses on the DOTS signal channel.DOTS signaling can happen with DTLS
over UDP and TLS over TCP. A DOTS client
can use DNS to determine the IP address(es) of a DOTS server or a DOTS
client may be provided with the list of DOTS server IP addresses. The
DOTS client MUST know a DOTS server's domain name; hard-coding the
domain name of the DOTS server into software is NOT RECOMMENDED in case
the domain name is not valid or needs to change for legal or other
reasons. The DOTS client performs A and/or AAAA record lookup of the
domain name and the result will be a list of IP addresses, each of which
can be used to contact the DOTS server using UDP and TCP.If an IPv4 path to reach a DOTS server is found, but the DOTS
server's IPv6 path is not working, a dual-stack DOTS client can
experience a significant connection delay compared to an IPv4-only DOTS
client. The other problem is that if a middlebox between the DOTS client
and DOTS server is configured to block UDP, the DOTS client will fail to
establish a DTLS session with the DOTS server and will, then, have to
fall back to TLS over TCP incurring significant connection delays. discusses that DOTS client
and server will have to support both connectionless and
connection-oriented protocols.To overcome these connection setup problems, the DOTS client can try
connecting to the DOTS server using both IPv6 and IPv4, and try both
DTLS over UDP and TLS over TCP in a fashion similar to the Happy
Eyeballs mechanism . These connection
attempts are performed by the DOTS client when its initializes, and the
client uses that information for its subsequent alert to the DOTS
server. In order of preference (most preferred first), it is UDP over
IPv6, UDP over IPv4, TCP over IPv6, and finally TCP over IPv4, which
adheres to address preference order and
the DOTS preference that UDP be used over TCP (to avoid TCP's head of
line blocking).X |
|--TCP SYN, IPv6-------------->X |
|--DTLS ClientHello, IPv4 ---->X |
|--TCP SYN, IPv4----------------------------------------->|
|--DTLS ClientHello, IPv6 ---->X |
|--TCP SYN, IPv6-------------->X |
|<-TCP SYNACK---------------------------------------------|
|--DTLS ClientHello, IPv4 ---->X |
|--TCP ACK----------------------------------------------->|
|<------------Establish TLS Session---------------------->|
|----------------DOTS signal----------------------------->|
| |
]]>In reference to , the DOTS
client sends two TCP SYNs and two DTLS ClientHello messages at the same
time over IPv6 and IPv4. In this example, it is assumed that the IPv6
path is broken and UDP is dropped by a middle box but has little impact
to the DOTS client because there is no long delay before using IPv4 and
TCP. The DOTS client repeats the mechanism to discover if DOTS signaling
with DTLS over UDP becomes available from the DOTS server, so the DOTS
client can migrate the DOTS signal channel from TCP to UDP, but such
probing SHOULD NOT be done more frequently than every 24 hours and MUST
NOT be done more frequently than every 5 minutes.The DOTS signal channel is built on top of the Constrained
Application Protocol (CoAP) , a
lightweight protocol originally designed for constrained devices and
networks. CoAP’s expectation of packet loss, support for
asynchronous non-confirmable messaging, congestion control, small
message overhead limiting the need for fragmentation, use of minimal
resources, and support for (D)TLS make it a good foundation on which
to build the DOTS signaling mechanism. The DOTS signal channel is layered on existing standards (). The signal channel is initiated by the DOTS client. Once the signal
channel is established, the DOTS agents periodically send heartbeats
to keep the channel active. At any time, the DOTS client may send a
mitigation request message to the DOTS server over the active channel.
While mitigation is active, the DOTS server periodically sends status
messages to the client, including basic mitigation feedback details.
Mitigation remains active until the DOTS client explicitly terminates
mitigation, or the mitigation lifetime expires.Messages exchanged between DOTS client and server are serialized
using Concise Binary Object Representation (CBOR) , CBOR is a binary encoding designed for small
code and message size. CBOR encoded payloads are used to convey signal
channel specific payload messages that convey request parameters and
response information such as errors. This specification uses the
encoding rules defined in for representing mitigation
scope and DOTS signal channel session configuration data defined using
YANG () as CBOR data.This document defines a YANG data
model for mitigation scope and DOTS signal channel session
configuration data.This document defines the YANG module "ietf-dots-signal", which
has the following structure: file "ietf-dots-signal@2016-11-28.yang"
module ietf-dots-signal {
namespace "urn:ietf:params:xml:ns:yang:ietf-dots-signal";
prefix "signal";
import ietf-inet-types {
prefix "inet";
}
organization "Cisco Systems, Inc.";
contact "Tirumaleswar Reddy ";
description
"This module contains YANG definition for DOTS
signal sent by the DOTS client to the DOTS server";
revision 2016-11-28 {
reference
"https://tools.ietf.org/html/draft-reddy-dots-signal-channel";
}
container mitigation-scope {
description "top level container for mitigation request";
list scope {
key policy-id;
description "Identifier for the mitigation request";
leaf policy-id {
type int32;
description "policy identifier";
}
leaf-list target-ip {
type inet:ip-address;
description "IP address";
}
leaf-list target-prefix {
type inet:ip-prefix;
description "prefix";
}
list target-port-range {
key "lower-port upper-port";
description "Port range. When only lower-port is present,
it represents a single port.";
leaf lower-port {
type inet:port-number;
mandatory true;
description "lower port";
}
leaf upper-port {
type inet:port-number;
must ". >= ../lower-port" {
error-message
"The upper-port must be greater than or
equal to lower-port";
}
description "upper port";
}
}
leaf-list target-protocol {
type uint8;
description "Internet Protocol number";
}
leaf-list FQDN {
type inet:domain-name;
description "FQDN";
}
leaf-list URI {
type inet:uri;
description "URI";
}
leaf-list alias {
type string;
description "alias name";
}
leaf lifetime {
type int32;
description "lifetime";
}
}
}
}
]]>This document defines the YANG module "ietf-dots-signal-config",
which has the following structure: file "ietf-dots-signal-config@2016-11-28.yang"
module ietf-dots-signal-config {
namespace "urn:ietf:params:xml:ns:yang:ietf-dots-signal-config";
prefix "config";
organization "Cisco Systems, Inc.";
contact "Tirumaleswar Reddy ";
description
"This module contains YANG definition for DOTS
signal channel session configuration";
revision 2016-11-28 {
reference
"https://tools.ietf.org/html/draft-reddy-dots-signal-channel";
}
container signal-config {
description "top level container for DOTS signal channel session
configuration";
leaf policy-id {
type int32;
description "Identifier for the DOTS signal channel
session configuration data";
}
leaf heartbeat-timeout {
type int16;
description "heartbeat timeout";
}
leaf max-retransmit {
type int16;
description "Maximum number of retransmissions";
}
leaf ack-timeout {
type int16;
description "Initial retransmission timeout value";
}
leaf ack-random-factor {
type decimal64 {
fraction-digits 2;
}
description "Random factor used to influence the timing of
retransmissions";
}
}
}
]]>The following methods are used to request or withdraw mitigation
requests:DOTS clients use the PUT method to request
mitigation (). During active
mitigation, DOTS clients may use PUT requests to convey mitigation
efficacy updates to the DOTS server ().
DOTS clients use the DELETE method to
withdraw a request for mitigation from the DOTS server ().DOTS clients may use the GET method to
subscribe to DOTS server status messages, or to retrieve the list
of existing mitigations (). Mitigation request and response messages are marked as
Non-confirmable messages. DOTS agents should follow the data
transmission guidelines discussed in Section 3.1.3 of and control transmission
behavior by not sending on average more than one UDP datagram per RTT
to the peer DOTS agent. Requests marked by the DOTS client as
Non-confirmable messages are sent at regular intervals until a
response is received from the DOTS server and if the DOTS client
cannot maintain a RTT estimate then it SHOULD NOT send more than one
Non-confirmable request every 3 seconds, and SHOULD use an even less
aggressive rate when possible (case 2 in Section 3.1.3 of ). When a DOTS client requires mitigation for any reason, the DOTS
client uses CoAP PUT method to send a mitigation request to the DOTS
server (, illustrated in JSON
diagnostic notation). The DOTS server can enable mitigation on
behalf of the DOTS client by communicating the DOTS client's request
to the mitigator and relaying selected mitigator feedback to the
requesting DOTS client. The parameters are described below.Identifier for the mitigation request
represented using an integer. This identifier MUST be unique for
each mitigation request bound to the DOTS client, i.e., the
policy-id parameter value in the mitigation request needs to be
unique relative to the policy-id parameter values of active
mitigation requests conveyed from the DOTS client to the DOTS
server. This identifier MUST be generated by the DOTS client.
This document does not make any assumption about how this
identifier is generated. This is a mandatory attribute.A list of IP addresses under attack.
This is an optional attribute.A list of prefixes under attack.
Prefixes are represented using CIDR notation . This is an optional attribute.A list of ports under attack.
The port range, lower-port for lower port number and upper-port
for upper port number. When only lower-port is present, it
represents a single port. For TCP, UDP, SCTP, or DCCP: the range
of ports (e.g., 1024-65535). This is an optional attribute.A list of protocols under attack.
Internet Protocol numbers. This is an optional attribute.A list of Fully Qualified Domain Names.
Fully Qualified Domain Name (FQDN) is the full name of a system,
rather than just its hostname. For example, "venera" is a
hostname, and "venera.isi.edu" is an FQDN. This is an optional
attribute.A list of Uniform Resource Identifiers
(URI). This is an optional attribute.A list of aliases (see Section 3.1.1 in
). This is an
optional attribute.Lifetime of the mitigation request in
seconds. Upon the expiry of this lifetime, and if the request is
not refreshed, the mitigation request is removed. The request
can be refreshed by sending the same request again. The default
lifetime of the mitigation request is 3600 seconds (60 minutes)
-- this value was chosen to be long enough so that refreshing is
not typically a burden on the DOTS client, while expiring the
request where the client has unexpectedly quit in a timely
manner. A lifetime of zero indicates indefinite lifetime for the
mitigation request. The server MUST always indicate the actual
lifetime in the response and the remaining lifetime in status
messages sent to the client. This is an optional attribute in
the request.The CBOR key values for the parameters are defined in . The IANA Considerations section defines
how the CBOR key values can be allocated to standards bodies and
vendors. In the PUT request at least one of the attributes target-ip
or target-prefix or FQDN or URI or alias MUST be present. DOTS
agents can safely ignore Vendor-Specific parameters they don't
understand. The relative order of two mitigation requests from a
DOTS client is determined by comparing their respective policy-id
values. If two mitigation requests have overlapping mitigation
scopes the mitigation request with higher numeric policy-id value
will override the mitigation request with a lower numeric policy-id
value. The Uri-Path option carries a major and minor version
nomenclature to manage versioning and DOTS signal channel in this
specification uses v1 major version.In both DOTS signal and data channel sessions, the DOTS client
MUST authenticate itself to the DOTS server (). The DOTS server couples the DOTS signal
and data channel sessions using the DOTS client identity, so the
DOTS server can validate whether the aliases conveyed in the
mitigation request were indeed created by the same DOTS client using
the DOTS data channel session. If the aliases were not created by
the DOTS client then the DOTS server returns 4.00 (Bad Request) in
the response. The DOTS server couples the DOTS signal channel
sessions using the DOTS client identity, the DOTS server uses
policy-id parameter value to detect duplicate mitigation
requests. shows a PUT request example to
signal that ports 80, 8080, and 443 on the servers 2002:db8:6401::1
and 2002:db8:6401::2 are being attacked (illustrated in JSON
diagnostic notation).The DOTS server indicates the result of processing the
PUT request using CoAP response codes. CoAP 2.xx codes are success.
CoAP 4.xx codes are some sort of invalid requests. COAP 5.xx codes
are returned if the DOTS server has erred or is currently
unavailable to provide mitigation in response to the mitigation
request from the DOTS client. If the DOTS server does not find the
policy-id parameter value conveyed in the PUT request in its
configuration data then the server MAY accept the mitigation
request, and a 2.01 (Created) response is returned to the DOTS
client, and the DOTS server will try to mitigate the attack. If the
DOTS server finds the policy-id parameter value conveyed in the PUT
request in its configuration data then the server MAY update the
mitigation request, and a 2.04 (Changed) response is returned to
indicate a successful updation of the mitigation request. If the
request is missing one or more mandatory attributes, then 4.00 (Bad
Request) will be returned in the response or if the request contains
invalid or unknown parameters then 4.02 (Invalid query) will be
returned in the response. For responses indicating a client or
server error, the payload explains the error situation of the result
of the requested action (Section 5.5 in ).A DELETE request is used to withdraw a DOTS signal from a DOTS
server (). If the DOTS server does not find the policy-id parameter value
conveyed in the DELETE request in its configuration data, then it
responds with a 4.04 (Not Found) error response code. The DOTS
server successfully acknowledges a DOTS client's request to withdraw
the DOTS signal using 2.02 (Deleted) response code, and ceases
mitigation activity as quickly as possible.To protect against route or DNS flapping caused by a client
rapidly toggling mitigation, and to dampen the effect of oscillating
attacks, DOTS servers MAY continue mitigation for a period of up to
fifteen minutes after acknowledging a DOTS client's withdrawal of a
mitigation request. During this period, DOTS server mitigation
status messages SHOULD indicate that mitigation is active but
terminating. After the fifteen-minute period elapses, the DOTS
server MUST treat the mitigation as terminated, as the DOTS client
is no longer responsible for the mitigation.A GET request is used to retrieve information and status of a
DOTS signal from a DOTS server (). If
the DOTS server does not find the policy-id parameter value conveyed
in the GET request in its configuration data, then it responds with
a 4.04 (Not Found) error response code. The 'c' (content) parameter
and its permitted values defined in can be used to retrieve
non-configuration data or configuration data or both. shows a response example of all
the active mitigation requests associated with the DOTS client on
the DOTS server and the mitigation status of each mitigation
request.The mitigation status parameters are described below.The total dropped byte count for
the mitigation request. This is a optional attribute.The average dropped bytes per second
for the mitigation request. This is a optional attribute.The total dropped packet count for
the mitigation request. This is a optional attribute.The average dropped packets per
second for the mitigation request. This is a optional
attribute.Status of attack mitigation. The 'status'
parameter is a mandatory attribute.The various possible values of 'status' parameter are explained
below:The observe option defined in
extends the CoAP core protocol with a mechanism for a CoAP client to
"observe" a resource on a CoAP server: the client retrieves a
representation of the resource and requests this representation be
updated by the server as long as the client is interested in the
resource. A DOTS client conveys the observe option set to 0 in the
GET request to receive unsolicited notifications of attack
mitigation status from the DOTS server. Unidirectional notifications
within the bidirectional signal channel allows unsolicited message
delivery, enabling asynchronous notifications between the agents. A
DOTS client that is no longer interested in receiving notifications
from the DOTS server can simply "forget" the observation. When the
DOTS server then sends the next notification, the DOTS client will
not recognize the token in the message and thus will return a Reset
message. This causes the DOTS server to remove the associated
entry. |
| Token: 0x4a | Registration
| Observe: 0 |
+-------------------------->|
| |
| 2.05 Content |
| Token: 0x4a | Notification of
| Observe: 12 | the current state
| status: "mitigation |
| in progress" |
|<--------------------------+
| 2.05 Content |
| Token: 0x4a | Notification upon
| Observe: 44 | a state change
| status: "mitigation |
| complete" |
|<--------------------------+
| 2.05 Content |
| Token: 0x4a | Notification upon
| Observe: 60 | a state change
| status: "attack stopped" |
|<--------------------------+
| |
]]>A DOTS client retrieves the information about a DOTS signal at
frequent intervals to determine the status of an attack. If the
DOTS server has been able to mitigate the attack and the attack
has stopped, the DOTS server indicates as such in the status, and
the DOTS client recalls the mitigation request.A DOTS client should react to the status of the attack from the
DOTS server and not the fact that it has recognized, using its own
means, that the attack has been mitigated. This ensures that the
DOTS client does not recall a mitigation request in a premature
fashion because it is possible that the DOTS client does not sense
the DDOS attack on its resources but the DOTS server could be
actively mitigating the attack and the attack is not completely
averted.While DDoS mitigation is active, a DOTS client MAY frequently
transmit DOTS mitigation efficacy updates to the relevant DOTS
server. An PUT request () is used to
convey the mitigation efficacy update to the DOTS server. The PUT
request MUST include all the parameters used in the PUT request to
convey the DOTS signal (). The 'attack-status' parameter is a mandatory attribute. The
various possible values contained in the 'attack-status' parameter
are explained below:The DOTS server indicates the result of processing the PUT
request using CoAP response codes. The response code 2.04 (Changed)
will be returned in the response if the DOTS server has accepted the
mitigation efficacy update. If the DOTS server does not find the
policy-id parameter value conveyed in the PUT request in its
configuration data then the server MAY accept the mitigation request
and will try to mitigate the attack, resulting in a 2.01 (Created)
Response Code. The 5.xx response codes are returned if the DOTS
server has erred or is incapable of performing the mitigation.The DOTS client can negotiate, configure and retrieve the DOTS
signal channel session behavior. The DOTS signal channel can be used,
for example, to configure the following:Heartbeat timeout: DOTS agents regularly send heartbeats
(Ping/Pong) to each other after mutual authentication in order to
keep the DOTS signal channel open, heartbeat timeout is the time
to wait for a Pong in milliseconds.Acceptable signal loss ratio: Maximum retransmissions,
retransmission timeout value and other message transmission
parameters for the DOTS signal channel.Reliability is provided to requests and responses by marking them
as Confirmable (CON) messages. DOTS signal channel session
configuration requests and responses are marked as Confirmable (CON)
messages. As explained in Section 2.1 of , a Confirmable message is retransmitted using
a default timeout and exponential back-off between retransmissions,
until the DOTS server sends an Acknowledgement message (ACK) with the
same Message ID conveyed from the DOTS client. Message transmission
parameters are defined in Section 4.8 of . Reliability is provided to the responses by
marking them as Confirmable (CON) messages. The DOTS server can either
piggyback the response in the acknowledgement message or if the DOTS
server is not able to respond immediately to a request carried in a
Confirmable message, it simply responds with an Empty Acknowledgement
message so that the DOTS client can stop retransmitting the request.
Empty Acknowledgement message is explained in Section 2.2 of . When the response is ready, the server sends
it in a new Confirmable message which then in turn needs to be
acknowledged by the DOTS client (see Sections 5.2.1 and Sections 5.2.2
in ). Requests and responses exchanged
between DOTS agents during peacetime are marked as Confirmable
messages.Implementation Note: A DOTS client that receives a response in a
CON message may want to clean up the message state right after sending
the ACK. If that ACK is lost and the DOTS server retransmits the CON,
the DOTS client may no longer have any state to which to correlate
this response, making the retransmission an unexpected message; the
DOTS client will send a Reset message so it does not receive any more
retransmissions. This behavior is normal and not an indication of an
error (see Section 5.3.2 in for more
details).A GET request is used to obtain acceptable configuration
parameters on the DOTS server for DOTS signal channel session
configuration. shows how to obtain
acceptable configuration parameters for the server.The DOTS server in the 2.05 (Content) response conveys the
minimum and maximum attribute values acceptable by the DOTS
server.A POST request is used to convey the configuration parameters for
the signaling channel (e.g., heartbeat timeout, maximum
retransmissions etc). Message transmission parameters for CoAP are
defined in Section 4.8 of . If the
DOTS agent wishes to change the default values of message
transmission parameters then it should follow the guidance given in
Section 4.8.1 of . The DOTS agents
MUST use the negotiated values for message transmission parameters
and default values for non-negotiated message transmission
parameters. The signaling channel session configuration is
applicable to a single DOTS signal channel session between the DOTS
agents. The parameters are described below:Identifier for the DOTS signal channel
session configuration data represented as an integer. This
identifier MUST be generated by the DOTS client. This document
does not make any assumption about how this identifier is
generated. This is a mandatory attribute.Heartbeat timeout is the time
to wait for a response in milliseconds to check the DOTS peer
health. This is an optional attribute.Maximum number of retransmissions
for a message (referred to as MAX_RETRANSMIT parameter in CoAP).
This is an optional attribute.Timeout value in seconds used to
calculate the intial retransmission timeout value (referred to
as ACK_TIMEOUT parameter in CoAP). This is an optional
attribute.Random factor used to
influence the timing of retransmissions (referred to as
ACK_RANDOM_FACTOR parameter in CoAP). This is an optional
attribute.In the POST request at least one of the attributes
heartbeat-timeout or max-retransmit or ack-timeout or
ack-random-factor MUST be present. The POST request with higher
numeric policy-id value over-rides the DOTS signal channel session
configuration data installed by a POST request with a lower numeric
policy-id value. shows a POST request example to
convey the configuration parameters for the DOTS signal channel.The DOTS server indicates the result of processing the POST
request using CoAP response codes. The CoAP response will include
the CBOR body received in the request. Response code 2.01 (Created)
will be returned in the response if the DOTS server has accepted the
configuration parameters. If the request is missing one or more
mandatory attributes then 4.00 (Bad Request) will be returned in the
response or if the request contains invalid or unknown parameters
then 4.02 (Invalid query) will be returned in the response. Response
code 4.22 (Unprocessable Entity) will be returned in the response if
any of the heartbeat-timeout, max-retransmit, target-protocol,
ack-timeout and ack-random-factor attribute values is not acceptable
to the DOTS server. The DOTS server in the error response conveys
the minimum and maximum attribute values acceptable by the DOTS
server. The DOTS client can re-try and send the POST request with
updated attribute values acceptable to the DOTS server.A DELETE request is used to delete the installed DOTS signal
channel session configuration data (). If the DOTS server does not find the policy-id parameter value
conveyed in the DELETE request in its configuration data, then it
responds with a 4.04 (Not Found) error response code. The DOTS
server successfully acknowledges a DOTS client's request to remove
the DOTS signal channel session configuration using 2.02 (Deleted)
response code.A GET request is used to retrieve the installed DOTS signal
channel session configuration data from a DOTS server. shows how to retrieve the DOTS signal
channel session configuration data. Redirected Signaling is discussed in detail in Section 3.2.2 of
. If the DOTS server
wants to redirect the DOTS client to an alternative DOTS server for a
signaling session then the response code 3.00 (alternate server) will
be returned in the response to the client. The DOTS server can return
the error response code 3.00 in response to a POST or PUT request from
the DOTS client or convey the error response code 3.00 in a
unidirectional notification response from the DOTS server.The DOTS server in the error response conveys the alternate DOTS
server FQDN, and the alternate DOTS server IP addresses and TTL (time
to live) values in the CBOR body.The parameters are described below:FQDN of alternate DOTS server.IP address of alternate DOTS server.Time to live represented as an integer number
of seconds. shows a 3.00 response example
to convey the DOTS alternate server www.example-alt.com, its IP
addresses 2002:db8:6401::1 and 2002:db8:6401::2, and TTL values 3600
and 1800.When the DOTS client receives 3.00 response, it considers the
current request as having failed, but SHOULD try the request with the
alternate DOTS server. During a DDOS attack, the DNS server may be
subjected to DDOS attack, alternate DOTS server IP addresses conveyed
in the 3.00 response help the DOTS client to skip DNS lookup of the
alternate DOTS server and can try to establish UDP or TCP session with
the alternate DOTS server IP addresses. The DOTS client SHOULD
implement DNS64 function to handle the scenario where IPv6-only DOTS
client communicates with IPv4-only alternate DOTS server.While the communication between the DOTS agents is quiescent, the
DOTS client will probe the DOTS server to ensure it has maintained
cryptographic state and vice versa. Such probes can also keep alive
firewall or NAT bindings. This probing reduces the frequency of
needing a new handshake when a DOTS signal needs to be conveyed to the
DOTS server. In DOTS over UDP, heartbeat messages can be exchanged
between the DOTS agents using the “COAP ping” mechanism
(Section 4.2 in ). The DOTS agent sends
an Empty Confirmable message and the peer DOTS agent will respond by
sending an Reset message. In DOTS over TCP, heartbeat messages can be
exchanged between the DOTS agents using the Ping and Pong messages
(Section 4.4 in ).
The DOTS agent sends an Ping message and the peer DOTS agent will
respond by sending an single Pong message.All parameters in DOTS signal channel are mapped to CBOR types as
follows and are given an integer key value to save space.This section defines the (D)TLS protocol profile of DOTS signal
channel over (D)TLS and DOTS data channel over TLS.There are known attacks on (D)TLS, such as machine-in-the-middle and
protocol downgrade. These are general attacks on (D)TLS and not specific
to DOTS over (D)TLS; please refer to the (D)TLS RFCs for discussion of
these security issues. DOTS agents MUST adhere to the (D)TLS
implementation recommendations and security considerations of except with respect to (D)TLS version. Since
encryption of DOTS using (D)TLS is virtually a green-field deployment
DOTS agents MUST implement only (D)TLS 1.2 or later.Implementations compliant with this profile MUST implement all of the
following items:DOTS agents MUST support DTLS record replay detection (Section
3.3 in ) to protect against replay
attacks.DOTS client can use (D)TLS session resumption without server-side
state to resume session and convey
the DOTS signal.Raw public keys which reduce the
size of the ServerHello, and can be used by servers that cannot
obtain certificates (e.g., DOTS gateways on private networks).Implementations compliant with this profile SHOULD implement all of
the following items to reduce the delay required to deliver a DOTS
signal:TLS False Start which reduces
round-trips by allowing the TLS second flight of messages
(ChangeCipherSpec) to also contain the DOTS signal.Cached Information Extension which
avoids transmitting the server's certificate and certificate chain
if the client has cached that information from a previous TLS
handshake.TCP Fast Open can reduce the
number of round-trips to convey DOTS signal.To avoid DOTS signal message fragmentation and the consequently
decreased probability of message delivery, DOTS agents MUST ensure
that the DTLS record MUST fit within a single datagram. If the Path
MTU is not known to the DOTS server, an IP MTU of 1280 bytes SHOULD be
assumed. The length of the URL MUST NOT exceed 256 bytes. If UDP is
used to convey the DOTS signal messages then the DOTS client must
consider the amount of record expansion expected by the DTLS
processing when calculating the size of CoAP message that fits within
the path MTU. Path MTU MUST be greater than or equal to [CoAP message
size + DTLS overhead of 13 octets + authentication overhead of the
negotiated DTLS cipher suite + block padding (Section 4.1.1.1 of ]. If the request size exceeds the Path MTU
then the DOTS client MUST split the DOTS signal into separate
messages, for example the list of addresses in the 'target-ip'
parameter could be split into multiple lists and each list conveyed in
a new POST request.Implementation Note: DOTS choice of message size parameters works
well with IPv6 and with most of today's IPv4 paths. However, with
IPv4, it is harder to absolutely ensure that there is no IP
fragmentation. If IPv4 support on unusual networks is a consideration
and path MTU is unknown, implementations may want to limit themselves
to more conservative IPv4 datagram sizes such as 576 bytes, as per
IP packets up to 576 bytes should never
need to be fragmented, thus sending a maximum of 500 bytes of DOTS
signal over a UDP datagram will generally avoid IP fragmentation.TLS 1.3 provides critical
latency improvements for connection establishment over TLS 1.2. The DTLS
1.3 protocol is based on
the TLS 1.3 protocol and provides equivalent security guarantees. (D)TLS
1.3 provides two basic handshake modes of interest to DOTS signal
channel:Absent packet loss, a full handshake in which the DOTS client is
able to send the DOTS signal message after one round trip and the
DOTS server immediately after receiving the first DOTS signal
message from the client.0-RTT mode in which the DOTS client can authenticate itself and
send DOTS signal message on its first flight, thus reducing
handshake latency. 0-RTT only works if the DOTS client has
previously communicated with that DOTS server, which is very likely
with the DOTS signal channel. The DOTS client SHOULD establish a
(D)TLS session with the DOTS server during peacetime and share a
PSK. During DDOS attack, the DOTS client can use the (D)TLS session
to convey the DOTS signal message and if there is no response from
the server after multiple re-tries then the DOTS client can resume
the (D)TLS session in 0-RTT mode using PSK. A simplified TLS 1.3
handshake with 0-RTT DOTS signal message exchange is shown in .
ServerHello
{EncryptedExtensions}
{ServerConfiguration}
{Certificate}
{CertificateVerify}
{Finished}
<-------- [DOTS signal message]
{Finished} -------->
[DOTS signal message] <-------> [DOTS signal message]
]]>(D)TLS based on client certificate can be used for mutual
authentication between DOTS agents. If a DOTS gateway is involved, DOTS
clients and DOTS gateway MUST perform mutual authentication; only
authorized DOTS clients are allowed to send DOTS signals to a DOTS
gateway. DOTS gateway and DOTS server MUST perform mutual
authentication; DOTS server only allows DOTS signals from authorized
DOTS gateway, creating a two-link chain of transitive authentication
between the DOTS client and the DOTS server.+ +<---------------->+ DOTS |
| | (DOTS client)| | DOTS | | | Server |
| +--------------+ | Gateway | | | |
| +----+--------+ | +---------------+
| ^ |
| | |
| +----------------+ | |
| | DDOS detector | | |
| | (DOTS client) +<--------------+ |
| +----------------+ |
| |
+-------------------------------------------------+
]]>In the example depicted in ,
the DOTS gateway and DOTS clients within the 'example.com' domain
mutually authenticate with each other. After the DOTS gateway validates
the identity of a DOTS client, it communicates with the AAA server in
the 'example.com' domain to determine if the DOTS client is authorized
to request DDOS mitigation. If the DOTS client is not authorized, a 4.01
(Unauthorized) is returned in the response to the DOTS client. In this
example, the DOTS gateway only allows the application server and DDOS
detector to request DDOS mitigation, but does not permit the user of
type 'guest' to request DDOS mitigation.Also, DOTS gateway and DOTS server MUST perform mutual authentication
using certificates. A DOTS server will only allow a DOTS gateway with a
certificate for a particular domain to request mitigation for that
domain. In reference to , the DOTS server
only allows the DOTS gateway to request mitigation for 'example.com'
domain and not for other domains.This specification registers new parameters for DOTS signal channel
and establishes registries for mappings to CBOR.A new registry will be requested from IANA, entitled "DOTS signal
channel CBOR Mappings Registry". The registry is to be created as
Expert Review Required. Parameter names (e.g.,
"target_ip") in the DOTS signal channel. Key value for the
parameter. The key value MUST be an integer in the range of 1 to
65536. The key values in the range of 32768 to 65536 are
assigned for Vendor-Specific parameters. CBOR Major type and
optional tag for the claim. For Standards Track
RFCs, list the "IESG". For others, give the name of the
responsible party. Other details (e.g., postal address, email
address, home page URI) may also be included. Reference to
the document or documents that specify the parameter, preferably
including URIs that can be used to retrieve copies of the
documents. An indication of the relevant sections may also be
included but is not required.Parameter Name: mitigation-scopeCBOR Key Value: 1CBOR Major Type: 5Change Controller: IESGSpecification Document(s): this documentParameter Name: scopeCBOR Key Value: 2CBOR Major Type: 5Change Controller: IESGSpecification Document(s): this documentParameter Name: policy-idCBOR Key Value: 3CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name:target-ipCBOR Key Value: 4CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name: target-port-rangeCBOR Key Value: 5CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name: lower-portCBOR Key Value: 6CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: upper-portCBOR Key Value: 7CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: target-protocolCBOR Key Value: 8CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name: FQDNCBOR Key Value: 9CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name: URICBOR Key Value: 10CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name: aliasCBOR Key Value: 11CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name: lifetimeCBOR Key Value: 12CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: attack-statusCBOR Key Value: 13CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: signal-configCBOR Key Value: 14CBOR Major Type: 5Change Controller: IESGSpecification Document(s): this documentParameter Name: heartbeat-timeoutCBOR Key Value: 15CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: max-retransmitCBOR Key Value: 16CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: ack-timeoutCBOR Key Value: 17CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: ack-random-factorCBOR Key Value: 18CBOR Major Type: 7Change Controller: IESGSpecification Document(s): this documentParameter Name: MinValueCBOR Key Value: 19CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: MaxValueCBOR Key Value: 20CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: statusCBOR Key Value: 21CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: bytes_droppedCBOR Key Value: 22CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: bps_droppedCBOR Key Value: 23CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: pkts_droppedCBOR Key Value: 24CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: pps_droppedCBOR Key Value: 25CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this document[Note to RFC Editor: Please remove this section and reference to
prior to publication.]This section records the status of known implementations of the
protocol defined by this specification at the time of posting of this
Internet-Draft, and is based on a proposal described in . The description of implementations in this
section is intended to assist the IETF in its decision processes in
progressing drafts to RFCs. Please note that the listing of any
individual implementation here does not imply endorsement by the IETF.
Furthermore, no effort has been spent to verify the information
presented here that was supplied by IETF contributors. This is not
intended as, and must not be construed to be, a catalog of available
implementations or their features. Readers are advised to note that
other implementations may exist.According to , "this will allow
reviewers and working groups to assign due consideration to documents
that have the benefit of running code, which may serve as evidence of
valuable experimentation and feedback that have made the implemented
protocols more mature. It is up to the individual working groups to use
this information as they see fit".NTT Communication is developing a
DOTS client and DOTS server software based on DOTS signal channel
specified in this draft. It will be open-sourced.Early implementation of DOTS protocol.
It is aimed to implement a full DOTS protocol spec in accordance
with maturing of DOTS protocol itself.To be open-sourced.It is a early implementation of
DOTS protocol. Messaging between DOTS clients and DOTS servers has
been tested. Level of maturity will increase in accordance with
maturing of DOTS protocol itself.Capability of DOTS client: sending DOTS
messages to the DOTS server in CoAP over DTLS as dots-signal.
Capability of DOTS server: receiving dots-signal, validating
received dots-signal, starting mitigation by handing over the
dots-signal to DDOS mitigator.It will be open-sourced with BSD
3-clause license.It is implemented in
Go-lang. Core specification of signaling is mature to be
implemented, however, finding good libraries(like DTLS, CoAP) is
rather difficult.Kaname Nishizuka
<kaname@nttv6.jp>Authenticated encryption MUST be used for data confidentiality and
message integrity. (D)TLS based on client certificate MUST be used for
mutual authentication. The interaction between the DOTS agents requires
Datagram Transport Layer Security (DTLS) and Transport Layer Security
(TLS) with a cipher suite offering confidentiality protection and the
guidance given in MUST be followed to
avoid attacks on (D)TLS.A single DOTS signal channel between DOTS agents can be used to
exchange multiple DOTS signal messages. To reduce DOTS client and DOTS
server workload, DOTS client SHOULD re-use the (D)TLS session.If TCP is used between DOTS agents, an attacker may be able to inject
RST packets, bogus application segments, etc., regardless of whether TLS
authentication is used. Because the application data is TLS protected,
this will not result in the application receiving bogus data, but it
will constitute a DoS on the connection. This attack can be countered by
using TCP-AO . If TCP-AO is used, then any
bogus packets injected by an attacker will be rejected by the TCP-AO
integrity check and therefore will never reach the TLS layer.Special care should be taken in order to ensure that the activation
of the proposed mechanism won't have an impact on the stability of the
network (including connectivity and services delivered over that
network).Involved functional elements in the cooperation system must establish
exchange instructions and notification over a secure and authenticated
channel. Adequate filters can be enforced to avoid that nodes outside a
trusted domain can inject request such as deleting filtering rules.
Nevertheless, attacks can be initiated from within the trusted domain if
an entity has been corrupted. Adequate means to monitor trusted nodes
should also be enabled.The following individuals have contributed to this document:Mike Geller Cisco Systems, Inc. 3250 Florida 33309 USA Email:
mgeller@cisco.comRobert Moskowitz HTT Consulting Oak Park, MI 42837 United States
Email: rgm@htt-consult.comDan Wing Email: dwing-ietf@fuggles.comThanks to Christian Jacquenet, Roland Dobbins, Andrew Mortensen,
Roman D. Danyliw, Michael Richardson, Ehud Doron, Kaname Nishizuka, Dave
Dolson and Gilbert Clark for the discussion and comments.