idnits 2.17.1 draft-boucadair-dots-dhcp-01.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (April 12, 2017) is 2543 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: A later version (-18) exists of draft-ietf-dots-architecture-01 ** Downref: Normative reference to an Informational draft: draft-ietf-dots-architecture (ref. 'I-D.ietf-dots-architecture') ** Obsolete normative reference: RFC 3315 (Obsoleted by RFC 8415) == Outdated reference: A later version (-25) exists of draft-ietf-dots-use-cases-04 -- Obsolete informational reference (is this intentional?): RFC 6125 (Obsoleted by RFC 9525) Summary: 2 errors (**), 0 flaws (~~), 3 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group M. Boucadair 3 Internet-Draft Orange 4 Intended status: Standards Track April 12, 2017 5 Expires: October 14, 2017 7 DHCP Options for Distributed-Denial-of-Service Open Threat Signaling 8 (DOTS) 9 draft-boucadair-dots-dhcp-01 11 Abstract 13 It may not be possible for a network to determine the cause for an 14 attack, but instead just realize that some resources seem to be under 15 attack. To fill that gap, Distributed-Denial-of-Service Open Threat 16 Signaling (DOTS) allows a network to inform a server that it is under 17 a potential attack so that appropriate mitigation actions are 18 undertaken. 20 This document specifies DHCP (IPv4 and IPv6) options to configure 21 hosts with DOTS servers. 23 Requirements Language 25 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 26 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 27 document are to be interpreted as described in RFC 2119 [RFC2119]. 29 Status of This Memo 31 This Internet-Draft is submitted in full conformance with the 32 provisions of BCP 78 and BCP 79. 34 Internet-Drafts are working documents of the Internet Engineering 35 Task Force (IETF). Note that other groups may also distribute 36 working documents as Internet-Drafts. The list of current Internet- 37 Drafts is at http://datatracker.ietf.org/drafts/current/. 39 Internet-Drafts are draft documents valid for a maximum of six months 40 and may be updated, replaced, or obsoleted by other documents at any 41 time. It is inappropriate to use Internet-Drafts as reference 42 material or to cite them other than as "work in progress." 44 This Internet-Draft will expire on October 14, 2017. 46 Copyright Notice 48 Copyright (c) 2017 IETF Trust and the persons identified as the 49 document authors. All rights reserved. 51 This document is subject to BCP 78 and the IETF Trust's Legal 52 Provisions Relating to IETF Documents 53 (http://trustee.ietf.org/license-info) in effect on the date of 54 publication of this document. Please review these documents 55 carefully, as they describe your rights and restrictions with respect 56 to this document. Code Components extracted from this document must 57 include Simplified BSD License text as described in Section 4.e of 58 the Trust Legal Provisions and are provided without warranty as 59 described in the Simplified BSD License. 61 Table of Contents 63 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 64 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 65 3. Design Rationale . . . . . . . . . . . . . . . . . . . . . . 4 66 4. DHCPv6 DOTS Option . . . . . . . . . . . . . . . . . . . . . 4 67 4.1. Format . . . . . . . . . . . . . . . . . . . . . . . . . 4 68 4.2. DHCPv6 Client Behavior . . . . . . . . . . . . . . . . . 5 69 5. DHCPv4 DOTS Option . . . . . . . . . . . . . . . . . . . . . 6 70 5.1. Format . . . . . . . . . . . . . . . . . . . . . . . . . 6 71 5.2. DHCPv4 Client Behavior . . . . . . . . . . . . . . . . . 6 72 6. Security Considerations . . . . . . . . . . . . . . . . . . . 6 73 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7 74 7.1. DHCPv6 Option . . . . . . . . . . . . . . . . . . . . . . 7 75 7.2. DHCPv4 Option . . . . . . . . . . . . . . . . . . . . . . 7 76 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 7 77 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 7 78 9.1. Normative References . . . . . . . . . . . . . . . . . . 7 79 9.2. Informative References . . . . . . . . . . . . . . . . . 8 80 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 8 82 1. Introduction 84 In many deployments, it may not be possible for a network to 85 determine the cause for a distributed Denial-of-Service (DoS) attack 86 [RFC4732], but instead just realize that some resources seem to be 87 under attack. To fill that gap, the IETF is specifying an 88 architecture, called DDoS Open Threat Signaling (DOTS) 89 [I-D.ietf-dots-architecture], in which a DOTS client can inform a 90 DOTS server that the network is under a potential attack and that 91 appropriate mitigation actions are required. Indeed, because the 92 lack of a common method to coordinate a real-time response among 93 involved actors and network domains inhibits the effectiveness of 94 DDoS attack mitigation, DOTS protocol is meant to carry requests for 95 DDoS attack mitigation, thereby reducing the impact of an attack and 96 leading to more efficient defensive actions. 97 [I-D.ietf-dots-use-cases] identifies a set of scenarios for DOTS; 98 almost all these scenarios involve a CPE. 100 The basic high-level DOTS architecture is illustrated in Figure 1 101 ([I-D.ietf-dots-architecture]): 103 +-----------+ +-------------+ 104 | Mitigator | ~~~~~~~~~~ | DOTS Server | 105 +-----------+ +-------------+ 106 | 107 | 108 | 109 +---------------+ +-------------+ 110 | Attack Target | ~~~~~~ | DOTS Client | 111 +---------------+ +-------------+ 113 Figure 1: Basic DOTS Architecture 115 [I-D.ietf-dots-architecture] specifies that the DOTS client may be 116 provided with a list of DOTS servers; each associated with one or 117 more IP addresses. These addresses may or may not be of the same 118 address family. The DOTS client establishes one or more signaling 119 sessions by connecting to the provided DOTS server addresses. 121 To that aim, this document defines DHCPv4 [RFC2131] and DHCPv6 122 [RFC3315] options that can be used to configure hosts, embedding a 123 DOTS client, with DOTS servers' names. These names will be resolved 124 into one or a list of IP addresses. 126 The use of DHCP for DOTS provisioning is justified because many of 127 the target use cases identified in [I-D.ietf-dots-use-cases] involve 128 CPEs; these devices widely support DHCP. 130 Also, the use of DHCP to provision a name that will be resolved into 131 one or many unicast address(es) of the appropriate DOTS server 132 instance(s) to contact does not suffer from the complications 133 encountered if a anycast address is used (see Section 3.2.4.1 of 134 [I-D.ietf-dots-architecture]). The use of DHCP ensures a 135 deterministic behavior. 137 2. Terminology 139 This document makes use of the following terms: 141 o DOTS client: A DOTS-aware software module responsible for 142 requesting attack response coordination with other DOTS-aware 143 elements. 144 o DOTS server: A DOTS-aware software module handling and responding 145 to messages from DOTS clients. The DOTS server should enable 146 mitigation on behalf of the DOTS client, if requested, by 147 communicating the DOTS client's request to the mitigator and 148 returning selected mitigator feedback to the requesting DOTS 149 client. A DOTS server may also be a mitigator. 150 o DDoS: A distributed Denial-of-Service attack, in which traffic 151 originating from multiple sources are directed at a target on a 152 network. DDoS attacks are intended to cause a negative impact on 153 the availability of servers, services, applications, and/or other 154 functionality of an attack target. 155 o DHCP refers to both DHCPv4 [RFC2131] and DHCPv6 [RFC3315]. 156 o DHCP client denotes a node that initiates requests to obtain 157 configuration parameters from one or more DHCP servers. 158 o DHCP server refers to a node that responds to requests from DHCP 159 clients. 161 3. Design Rationale 163 As reported in Section 1.7.2 of [RFC6125], "few certification 164 authorities issue server certificates based on IP addresses, but 165 preliminary evidence indicates that such certificates are a very 166 small percentage (less than 1%) of issued certificates". In order to 167 allow for PKIX-based authentication between a DOTS client and server, 168 this document specifies the DHCP option as a name. One or multiple 169 IP addresses may be returned as a result of name resolution. 171 Defining the option to include a list of IP addresses would avoid a 172 dependency on an underlying name resolution, but that design requires 173 to also supply a name for PKIX-based authentication purposes. 175 Because aliasing is to be avoided (Section 7 of [RFC7227]), this 176 document specifies one single option that conveys a DOTS server's 177 name. 179 4. DHCPv6 DOTS Option 181 4.1. Format 183 The DHCPv6 DOTS option is used to configure a name of the DOTS 184 server. The format of this option is shown in Figure 2. 186 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 187 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 188 | OPTION_V6_DOTS | Option-length | 189 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 190 | | 191 | dots-server-name (FQDN) | 192 | | 193 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 195 Figure 2: DHCPv6 DOTS option 197 The fields of the option shown in Figure 2 are as follows: 199 o Option-code: OPTION_V6_DOTS (TBA, see Section 7.1) 200 o Option-length: Length of the dots-server-name field in octets. 201 o dots-server-name: A fully qualified domain name of the DOTS 202 server. This field is formatted as specified in Section 8 of 203 [RFC3315]. 205 An example of the dots-server-name encoding is shown in Figure 3. 206 This example conveys the FQDN "dots.example.com.". 208 +------+------+------+------+------+------+------+------+------+ 209 | 0x04 | d | o | t | s | 0x07 | e | x | a | 210 +------+------+------+------+------+------+------+------+------+ 211 | m | p | l | e | 0x03 | c | o | m | 0x00 | 212 +------+------+------+------+------+------+------+------+------+ 214 Figure 3: An example 216 4.2. DHCPv6 Client Behavior 218 Clients MAY request option OPTION_V6_DOTS, as defined in [RFC3315], 219 Sections 17.1.1, 18.1.1, 18.1.3, 18.1.4, 18.1.5, and 22.7. As a 220 convenience to the reader, we mention here that the client includes 221 requested option codes in the Option Request Option. 223 If the DHCP client receives more than one OPTION_V6_DOTS option, it 224 MUST use only the first instance of that option. 226 If the OPTION_V6_DOTS option contains more than one name, as 227 distinguished by the presence of multiple root labels, the DHCP 228 client MUST use only the first name. Once the name is validated 229 (Section 8 of [RFC3315]), the name is passed to a name resolution 230 library. 232 5. DHCPv4 DOTS Option 234 5.1. Format 236 The DHCPv4 DOTS option is used to configure a name of the DOTS 237 server. The format of this option is illustrated in Figure 4. 239 Code Length DOTS server name 240 +-----+-----+-----+-----+-----+-----+-----+-- 241 | TBA | n | s1 | s2 | s3 | s4 | s5 | ... 242 +-----+-----+-----+-----+-----+-----+-----+-- 244 The values s1, s2, s3, etc. represent the domain name labels in the 245 domain name encoding. 247 Figure 4: DHCPv4 DOTS option 249 The fields of the option shown in Figure 4 are as follows: 251 o Code: OPTION_V4_DOTS (TBA, see Section 7.2); 252 o Length: Includes the length of the "DOTS server name" field in 253 octets; the maximum length is 255 octets. 254 o DOTS server name: The domain name of the DOTS server. This field 255 is formatted as specified in Section 8 of [RFC3315]. 257 5.2. DHCPv4 Client Behavior 259 To discover a DOTS server, the DHCPv4 client MUST include 260 OPTION_V4_DOTS in a Parameter Request List Option [RFC2132]. 262 If the DHCP client receives more than one OPTION_V4_DOTS option, it 263 MUST use only the first instance of that option. 265 If the OPTION_V4_DOTS option contains more than one name, as 266 distinguished by the presence of multiple root labels, the DHCP 267 client MUST use only the first FQDN. Once the name is validated 268 (Section 8 of [RFC3315]), the name is passed to a name resolution 269 library. 271 6. Security Considerations 273 The security considerations in [RFC2131] and [RFC3315] are to be 274 considered. 276 DOTS-related security considerations are discussed in Section 4 of 277 [I-D.ietf-dots-architecture]. 279 7. IANA Considerations 281 7.1. DHCPv6 Option 283 IANA is requested to assign the following new DHCPv6 Option Code in 284 the registry maintained in http://www.iana.org/assignments/ 285 dhcpv6-parameters: 287 Option Name Value 288 -------------- ----- 289 OPTION_V6_DOTS TBA 291 7.2. DHCPv4 Option 293 IANA is requested to assign the following new DHCPv4 Option Code in 294 the registry maintained in http://www.iana.org/assignments/bootp- 295 dhcp-parameters/: 297 Option Name Value Data length Meaning 298 -------------- ----- ------------------------- ---------------------- 299 OPTION_V4_DOTS TBA Variable; the maximum Includes the name of 300 length is 255 octets. the DOTS server. 302 8. Acknowledgements 304 Many thanks to Tiru Reddy for his comments. 306 9. References 308 9.1. Normative References 310 [I-D.ietf-dots-architecture] 311 Mortensen, A., Andreasen, F., Reddy, T., 312 christopher_gray3@cable.comcast.com, c., Compton, R., and 313 N. Teague, "Distributed-Denial-of-Service Open Threat 314 Signaling (DOTS) Architecture", draft-ietf-dots- 315 architecture-01 (work in progress), October 2016. 317 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 318 Requirement Levels", BCP 14, RFC 2119, 319 DOI 10.17487/RFC2119, March 1997, 320 . 322 [RFC2131] Droms, R., "Dynamic Host Configuration Protocol", 323 RFC 2131, DOI 10.17487/RFC2131, March 1997, 324 . 326 [RFC2132] Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor 327 Extensions", RFC 2132, DOI 10.17487/RFC2132, March 1997, 328 . 330 [RFC3315] Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins, 331 C., and M. Carney, "Dynamic Host Configuration Protocol 332 for IPv6 (DHCPv6)", RFC 3315, DOI 10.17487/RFC3315, July 333 2003, . 335 9.2. Informative References 337 [I-D.ietf-dots-use-cases] 338 Dobbins, R., Fouant, S., Migault, D., Moskowitz, R., 339 Teague, N., Xia, L., and K. Nishizuka, "Use cases for DDoS 340 Open Threat Signaling", draft-ietf-dots-use-cases-04 (work 341 in progress), March 2017. 343 [RFC4732] Handley, M., Ed., Rescorla, E., Ed., and IAB, "Internet 344 Denial-of-Service Considerations", RFC 4732, 345 DOI 10.17487/RFC4732, December 2006, 346 . 348 [RFC6125] Saint-Andre, P. and J. Hodges, "Representation and 349 Verification of Domain-Based Application Service Identity 350 within Internet Public Key Infrastructure Using X.509 351 (PKIX) Certificates in the Context of Transport Layer 352 Security (TLS)", RFC 6125, DOI 10.17487/RFC6125, March 353 2011, . 355 [RFC7227] Hankins, D., Mrugalski, T., Siodelski, M., Jiang, S., and 356 S. Krishnan, "Guidelines for Creating New DHCPv6 Options", 357 BCP 187, RFC 7227, DOI 10.17487/RFC7227, May 2014, 358 . 360 Author's Address 362 Mohamed Boucadair 363 Orange 364 Rennes 35000 365 France 367 Email: mohamed.boucadair@orange.com