Network Working Group M. Boucadair
Internet-Draft Orange
Intended status: Standards Track April 6, 2017
Expires: October 8, 2017
DHCP Options for DDoS Open Threat Signaling (DOTS)
draft-boucadair-dots-dhcp-00
Abstract
It may not be possible for a network to determine the cause for an
attack, but instead just realize that some resources seem to be under
attack. To fill that gap, DDoS Open Threat Signaling (DOTS) allows a
DOTS client to inform a DOTS server that the network is under a
potential attack so that appropriate mitigation actions are
undertaken.
This document specifies DHCP (IPv4 and IPv6) options to configure
hosts with DOTS servers.
Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [RFC2119].
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on October 8, 2017.
Boucadair Expires October 8, 2017 [Page 1]
Internet-Draft DHCP for MPTCP April 2017
Copyright Notice
Copyright (c) 2017 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. DHCPv6 DOTS Option . . . . . . . . . . . . . . . . . . . . . 4
3.1. Format . . . . . . . . . . . . . . . . . . . . . . . . . 4
3.2. DHCPv6 Client Behavior . . . . . . . . . . . . . . . . . 5
4. DHCPv4 DOTS Option . . . . . . . . . . . . . . . . . . . . . 6
4.1. Format . . . . . . . . . . . . . . . . . . . . . . . . . 6
4.2. DHCPv4 Client Behavior . . . . . . . . . . . . . . . . . 7
5. Security Considerations . . . . . . . . . . . . . . . . . . . 7
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
6.1. DHCPv6 Option . . . . . . . . . . . . . . . . . . . . . . 7
6.2. DHCPv4 Option . . . . . . . . . . . . . . . . . . . . . . 8
7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 8
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 8
8.1. Normative References . . . . . . . . . . . . . . . . . . 8
8.2. Informative References . . . . . . . . . . . . . . . . . 9
Appendix A. DHCP Server Configuration Guidelines . . . . . . . . 9
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 10
1. Introduction
In many deployments, it may not be possible for a network to
determine the cause for a distributed Denial-of-Service (DoS) attack
[RFC4732], but instead just realize that some resources seem to be
under attack. To fill that gap, the IETF is specifying an
architecture, called DDoS Open Threat Signaling (DOTS)
[I-D.ietf-dots-architecture], in which a DOTS client can inform a
DOTS server that the network is under a potential attack and that
appropriate mitigation actions are required. Indeed, because the
lack of a common method to coordinate a real-time response among
involved actors and network domains inhibits the effectiveness of
Boucadair Expires October 8, 2017 [Page 2]
Internet-Draft DHCP for MPTCP April 2017
DDoS attack mitigation, DOTS protocol is meant to carry requests for
DDoS attack mitigation, thereby reducing the impact of an attack and
leading to more efficient defensive actions.
[I-D.ietf-dots-use-cases] identifies a set of scenarios for DOTS;
almost all these scenarios involve a CPE.
The basic high-level DOTS architecture is illustrated in Figure 1
([I-D.ietf-dots-architecture]):
+-----------+ +-------------+
| Mitigator | ~~~~~~~~~~ | DOTS Server |
+-----------+ +-------------+
|
|
|
+---------------+ +-------------+
| Attack Target | ~~~~~~ | DOTS Client |
+---------------+ +-------------+
Figure 1: Basic DOTS Architecture
[I-D.ietf-dots-architecture] specifies that the DOTS client may be
provided with a list of DOTS servers; each associated with one or
more IP addresses. These addresses may or may not be of the same
address family. The DOTS client establishes one or more signaling
sessions by connecting to the provided DOTS server addresses.
To that aim, this document defines DHCPv4 [RFC2131] and DHCPv6
[RFC3315] options that can be used to configure hosts, embedding a
DOTS client, with DOTS servers' IP addresses. The use of DHCP for
DOTS provisioning is justified because many of the target use cases
identified in [I-D.ietf-dots-use-cases] involve CPEs; these devices
widely support DHCP.
This specification assumes a DOTS server is reachable through one or
multiple IP addresses. As such, a list of IP addresses can be
returned in the DHCP DOTS option.
The use of DHCP to provision the unicast address(es) of the
appropriate DOTS server instance(s) to contact does not suffer from
the complications encountered if a anycast address is used (see
Section 3.2.4.1 of [I-D.ietf-dots-architecture]). The use of DHCP
ensures a deterministic behavior even when the network is under a DoS
attack.
Boucadair Expires October 8, 2017 [Page 3]
Internet-Draft DHCP for MPTCP April 2017
2. Terminology
This document makes use of the following terms:
o DOTS client: A DOTS-aware software module responsible for
requesting attack response coordination with other DOTS-aware
elements.
o DOTS server: A DOTS-aware software module handling and responding
to messages from DOTS clients. The DOTS server should enable
mitigation on behalf of the DOTS client, if requested, by
communicating the DOTS client's request to the mitigator and
returning selected mitigator feedback to the requesting DOTS
client. A DOTS server may also be a mitigator.
o DDoS: A distributed denial-of-service attack, in which traffic
originating from multiple sources are directed at a target on a
network. DDoS attacks are intended to cause a negative impact on
the availability of servers, services, applications, and/or other
functionality of an attack target.
o DHCP refers to both DHCPv4 [RFC2131] and DHCPv6 [RFC3315].
o DHCP client denotes a node that initiates requests to obtain
configuration parameters from one or more DHCP servers.
o DHCP server refers to a node that responds to requests from DHCP
clients.
3. DHCPv6 DOTS Option
3.1. Format
The DHCPv6 DOTS option can be used to configure a list of IPv6
addresses of a DOTS server. The format of this option is shown in
Figure 2.
Boucadair Expires October 8, 2017 [Page 4]
Internet-Draft DHCP for MPTCP April 2017
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_V6_DOTS | Option-length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| DOTS ipv6-address |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| DOTS ipv6-address |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: DHCPv6 DOTS option
The fields of the option shown in Figure 2 are as follows:
o Option-code: OPTION_V6_DOTS (TBA, see Section 6.1)
o Option-length: Length of the 'DOTS ipv6-address(es)' field in
octets. MUST be a multiple of 16.
o DOTS ipv6-address: Includes one or more IPv6 addresses [RFC4291]
of the DOTS server to be used by the DOTS client.
Note, IPv4-mapped IPv6 addresses (Section 2.5.5.2 of [RFC4291])
are allowed to be included in this option.
To return more than one DOTS servers to the requesting DHCPv6 client,
the DHCPv6 server returns multiple instances of OPTION_V6_DOTS.
Configuration recommendations for DHCP servers are listed in
Appendix A.
3.2. DHCPv6 Client Behavior
Clients MAY request option OPTION_V6_DOTS, as defined in [RFC3315],
Sections 17.1.1, 18.1.1, 18.1.3, 18.1.4, 18.1.5, and 22.7. As a
convenience to the reader, we mention here that the client includes
requested option codes in the Option Request Option.
The DHCPv6 client MUST be prepared to receive multiple instances of
OPTION_V6_DOTS; each instance is to be treated separately as it
corresponds to a given DOTS server: there are as many DOTS servers as
instances of the OPTION_V6_DOTS option.
Boucadair Expires October 8, 2017 [Page 5]
Internet-Draft DHCP for MPTCP April 2017
If an IPv4-mapped IPv6 address is received in OPTION_V6_DOTS, it
indicates that the DOTS server has the corresponding IPv4 address.
The DHCPv6 client MUST silently discard multicast and host loopback
addresses [RFC6890] conveyed in OPTION_V6_DOTS.
4. DHCPv4 DOTS Option
4.1. Format
The DHCPv4 DOTS option can be used to configure a list of IPv4
addresses of a DOTS server. The format of this option is illustrated
in Figure 3.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| List-Length | List of |
+-+-+-+-+-+-+-+-+ DOTS |
/ IPv4 Addresses /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ---
| List-Length | List of | |
+-+-+-+-+-+-+-+-+ DOTS | |
/ IPv4 Addresses / |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
. ... . optional
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| List-Length | List of | |
+-+-+-+-+-+-+-+-+ DOTS | |
/ IPv4 Addresses / |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ---
Figure 3: DHCPv4 DOTS option
The fields of the option shown in Figure 3 are as follows:
o Code: OPTION_V4_dots (TBA, see Section 6.2);
o Length: Length of all included data in octets. The minimum length
is 5.
o List-Length: Length of the "List of DOTS IPv4 Addresses" field in
octets; MUST be a multiple of 4.
o List of DOTS IPv4 Addresses: Contains one or more IPv4 addresses
of the DOTS server to be used by the DOTS client. The format of
this field is shown in Figure 4.
Boucadair Expires October 8, 2017 [Page 6]
Internet-Draft DHCP for MPTCP April 2017
o OPTION_V4_DOTS can include multiple lists of DOTS IPv4 addresses;
each list is treated separately as it corresponds to a given DOTS
server.
When several lists of DOTS IPv4 addresses are to be included,
"List-Length" and "DOTS IPv4 Addresses" fields are repeated.
0 8 16 24 32 40 48
+-----+-----+-----+-----+-----+-----+--
| a1 | a2 | a3 | a4 | a1 | a2 | ...
+-----+-----+-----+-----+-----+-----+--
IPv4 Address 1 IPv4 Address 2 ...
This format assumes that an IPv4 address is encoded as a1.a2.a3.a4.
Figure 4: Format of the List of DOTS IPv4 Addresses
OPTION_V4_DOTS is a concatenation-requiring option. As such, the
mechanism specified in [RFC3396] MUST be used if OPTION_V4_DOTS
exceeds the maximum DHCPv4 option size of 255 octets.
4.2. DHCPv4 Client Behavior
To discover one or more DOTS servers, the DHCPv4 client MUST include
OPTION_V4_DOTS in a Parameter Request List Option [RFC2132].
The DHCPv4 client MUST be prepared to receive multiple lists of DOTS
IPv4 addresses in the same OPTION_V4_DOTS; each list is to be treated
as a separate DOTS server instance.
The DHCPv4 client MUST silently discard multicast and host loopback
addresses [RFC6890] conveyed in OPTION_V4_DOTS.
5. Security Considerations
The security considerations in [RFC2131] and [RFC3315] are to be
considered.
DOTS-related security considerations are discussed in Section 4 of
[I-D.ietf-dots-architecture].
6. IANA Considerations
6.1. DHCPv6 Option
IANA is requested to assign the following new DHCPv6 Option Code in
the registry maintained in http://www.iana.org/assignments/
dhcpv6-parameters:
Boucadair Expires October 8, 2017 [Page 7]
Internet-Draft DHCP for MPTCP April 2017
Option Name Value
-------------- -----
OPTION_V6_DOTS TBA
6.2. DHCPv4 Option
IANA is requested to assign the following new DHCPv4 Option Code in
the registry maintained in http://www.iana.org/assignments/bootp-
dhcp-parameters/:
Option Name Value Data length Meaning
-------------- ----- ------------ -----------------------------------
OPTION_V4_DOTS TBA Variable; Includes one or multiple lists of
the minimum DOTS IP addresses; each list is
length is 5. treated as a separate DOTS server.
7. Acknowledgements
TBC
8. References
8.1. Normative References
[I-D.ietf-dots-architecture]
Mortensen, A., Andreasen, F., Reddy, T.,
christopher_gray3@cable.comcast.com, c., Compton, R., and
N. Teague, "Distributed-Denial-of-Service Open Threat
Signaling (DOTS) Architecture", draft-ietf-dots-
architecture-01 (work in progress), October 2016.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC2131] Droms, R., "Dynamic Host Configuration Protocol",
RFC 2131, DOI 10.17487/RFC2131, March 1997,
<http://www.rfc-editor.org/info/rfc2131>.
[RFC2132] Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor
Extensions", RFC 2132, DOI 10.17487/RFC2132, March 1997,
<http://www.rfc-editor.org/info/rfc2132>.
[RFC3315] Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins,
C., and M. Carney, "Dynamic Host Configuration Protocol
for IPv6 (DHCPv6)", RFC 3315, DOI 10.17487/RFC3315, July
2003, <http://www.rfc-editor.org/info/rfc3315>.
Boucadair Expires October 8, 2017 [Page 8]
Internet-Draft DHCP for MPTCP April 2017
[RFC3396] Lemon, T. and S. Cheshire, "Encoding Long Options in the
Dynamic Host Configuration Protocol (DHCPv4)", RFC 3396,
DOI 10.17487/RFC3396, November 2002,
<http://www.rfc-editor.org/info/rfc3396>.
[RFC4291] Hinden, R. and S. Deering, "IP Version 6 Addressing
Architecture", RFC 4291, DOI 10.17487/RFC4291, February
2006, <http://www.rfc-editor.org/info/rfc4291>.
[RFC6890] Cotton, M., Vegoda, L., Bonica, R., Ed., and B. Haberman,
"Special-Purpose IP Address Registries", BCP 153,
RFC 6890, DOI 10.17487/RFC6890, April 2013,
<http://www.rfc-editor.org/info/rfc6890>.
8.2. Informative References
[I-D.ietf-dots-use-cases]
Dobbins, R., Fouant, S., Migault, D., Moskowitz, R.,
Teague, N., Xia, L., and K. Nishizuka, "Use cases for DDoS
Open Threat Signaling", draft-ietf-dots-use-cases-04 (work
in progress), March 2017.
[RFC4732] Handley, M., Ed., Rescorla, E., Ed., and IAB, "Internet
Denial-of-Service Considerations", RFC 4732,
DOI 10.17487/RFC4732, December 2006,
<http://www.rfc-editor.org/info/rfc4732>.
[RFC7969] Lemon, T. and T. Mrugalski, "Customizing DHCP
Configuration on the Basis of Network Topology", RFC 7969,
DOI 10.17487/RFC7969, October 2016,
<http://www.rfc-editor.org/info/rfc7969>.
Appendix A. DHCP Server Configuration Guidelines
This appendix details a set of non-normative configuration
recommendations.
DHCP servers that support the DHCP DOTS option can be configured with
a list of IP addresses of the DOTS server(s). If multiple IP
addresses are configured, the DHCP server must be explicitly
configured whether all or some of these addresses refer to:
1. the same DOTS server: the DHCP server returns multiple addresses
in the same instance of the DHCP DOTS option.
2. distinct DOTS servers : the DHCP server returns multiple lists of
DOTS IP addresses to the requesting DHCP client (encoded as
Boucadair Expires October 8, 2017 [Page 9]
Internet-Draft DHCP for MPTCP April 2017
multiple OPTION_V6_DOTS or in the same OPTION_V4_DOTS); each list
refers to a distinct DOTS server.
Precisely how DHCP servers are configured to separate lists of IP
addresses according to which DOTS server they refer to is out of
scope for this document. However, DHCP servers must not combine the
IP addresses of multiple DOTS servers and return them to the DHCP
client as if they were belonging to a single DOTS server, and DHCP
servers must not separate the addresses of a single DOTS server and
return them as if they were belonging to distinct DOTS servers. For
example, if an administrator configures the DHCP server by providing
a Fully Qualified Domain Name (FQDN) for a DOTS server, even if that
FQDN resolves to multiple addresses, the DHCP server must deliver
them within a single server address block.
DHCPv6 servers that implement this option and that can populate the
option by resolving FQDNs will need a mechanism for indicating
whether to query A records or only AAAA records. When a query
returns A records, the IP addresses in those records are returned in
the DHCPv6 response as IPv4-mapped IPv6 addresses.
Since this option requires support for IPv4-mapped IPv6 addresses, a
DHCPv6 server implementation will not be complete if it does not
query A records and represent any that are returned as IPv4-mapped
IPv6 addresses in DHCPv6 responses. The mechanism whereby DHCPv6
implementations provide this functionality is beyond the scope of
this document.
For guidelines on providing context-specific configuration
information (e.g., returning a regional-based configuration), and
information on how a DHCP server might be configured with FQDNs that
get resolved on demand, see [RFC7969].
Author's Address
Mohamed Boucadair
Orange
Rennes 35000
France
Email: mohamed.boucadair@orange.com
Boucadair Expires October 8, 2017 [Page 10]