One document matched: draft-reddy-dots-signal-channel-02.xml
<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
<?rfc toc="yes"?>
<?rfc tocompact="yes"?>
<?rfc tocdepth="3"?>
<?rfc tocindent="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes"?>
<?rfc comments="yes"?>
<?rfc inline="yes"?>
<?rfc compact="yes"?>
<?rfc subcompact="no"?>
<rfc category="std" docName="draft-reddy-dots-signal-channel-02"
ipr="trust200902">
<front>
<title abbrev="DOTS Signal Channel">Distributed Denial-of-Service Open
Threat Signaling (DOTS) Signal Channel</title>
<author fullname="Tirumaleswar Reddy" initials="T." surname="Reddy">
<organization abbrev="Cisco">Cisco Systems, Inc.</organization>
<address>
<postal>
<street>Cessna Business Park, Varthur Hobli</street>
<street>Sarjapur Marathalli Outer Ring Road</street>
<city>Bangalore</city>
<region>Karnataka</region>
<code>560103</code>
<country>India</country>
</postal>
<email>tireddy@cisco.com</email>
</address>
</author>
<author fullname="Mohamed Boucadair" initials="M." surname="Boucadair">
<organization>Orange</organization>
<address>
<postal>
<street></street>
<city>Rennes</city>
<region></region>
<code>35000</code>
<country>France</country>
</postal>
<email>mohamed.boucadair@orange.com</email>
</address>
</author>
<author fullname="Prashanth Patil" initials="P." surname="Patil">
<organization abbrev="Cisco">Cisco Systems, Inc.</organization>
<address>
<postal>
<street></street>
<street></street>
<city></city>
<country></country>
</postal>
<email>praspati@cisco.com</email>
</address>
</author>
<author fullname="Dan Wing" initials="D." surname="Wing">
<address>
<postal>
<street></street>
<country>USA</country>
</postal>
<email>dwing-ietf@fuggles.com</email>
</address>
</author>
<date />
<workgroup>DOTS</workgroup>
<abstract>
<t>This document specifies a mechanism that a DOTS client can use to
signal that a network is under a Distributed Denial-of-Service (DDoS)
attack to an upstream DOTS server so that appropriate mitigation actions
are undertaken (including, blackhole, drop, rate-limit, or add to watch
list) on the suspect traffic. The document specifies the DOTS signal
channel including Happy Eyeballs considerations. The specification of
the DOTS data channel is elaborated in a companion document.</t>
</abstract>
</front>
<middle>
<section anchor="introduction" title="Introduction">
<t>A distributed denial-of-service (DDoS) attack is an attempt to make
machines or network resources unavailable to their intended users. In
most cases, sufficient scale can be achieved by compromising enough
end-hosts and using those infected hosts to perpetrate and amplify the
attack. The victim in this attack can be an application server, a host,
a router, a firewall, or an entire network.</t>
<t>In many cases, it may not be possible for an enterprise network
administrators to determine the causes of an attack, but instead just
realize that certain resources seem to be under attack. This document,
which adheres to the DOTS architecture <xref
target="I-D.ietf-dots-architecture"></xref>, proposes that, in such
cases, the DOTS client just inform its DOTS server(s) that the
enterprise is under a potential attack and that the mitigator monitor
traffic to the enterprise to mitigate any possible attacks. This
cooperation between DOTS agents contributes to ensure a highly automated
network that is also robust, reliable and secure.</t>
<t>Protocol requirements for DOTS signal channel are obtained from DOTS
requirements <xref target="I-D.ietf-dots-requirements"></xref>.</t>
<t>This document satisfies all the use cases discussed in <xref
target="I-D.ietf-dots-use-cases"></xref> except the Third-party DOTS
notifications use case in Section 3.2.3 of <xref
target="I-D.ietf-dots-use-cases"></xref> which is an optional feature
and not a core use case. Third-party DOTS notifications are not part of
the DOTS requirements document. Moreover, the DOTS architecture does not
assess whether that use case may have an impact on the architecture
itself and/or the DOTS trust model.</t>
<t>This is a companion document to the DOTS data channel specification
<xref target="I-D.reddy-dots-data-channel"></xref>.</t>
</section>
<section anchor="notation" title="Notational Conventions and Terminology">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <xref
target="RFC2119"></xref>.</t>
<t>(D)TLS: For brevity this term is used for statements that apply to
both Transport Layer Security <xref target="RFC5246"></xref> and
Datagram Transport Layer Security <xref target="RFC6347"></xref>.
Specific terms will be used for any statement that applies to either
protocol alone.</t>
<t>The reader should be familiar with the terms defined in <xref
target="I-D.ietf-dots-architecture"></xref>.</t>
</section>
<section title="Solution Overview">
<t>Network applications have finite resources like CPU cycles, number of
processes or threads they can create and use, maximum number of
simultaneous connections it can handle, limited resources of the control
plane, etc. When processing network traffic, such applications are
supposed to use these resources to offer the intended task in the most
efficient fashion. However, an attacker may be able to prevent an
application from performing its intended task by causing the application
to exhaust the finite supply of a specific resource.</t>
<t>TCP DDoS SYN-flood, for example, is a memory-exhaustion attack on the
victim and ACK-flood is a CPU exhaustion attack on the victim (<xref
target="RFC4987"></xref>). Attacks on the link are carried out by
sending enough traffic such that the link becomes excessively congested,
and legitimate traffic suffers high packet loss. Stateful firewalls can
also be attacked by sending traffic that causes the firewall to hold
excessive state and the firewall runs out of memory, and can no longer
instantiate the state required to pass legitimate flows. Other possible
DDoS attacks are discussed in <xref target="RFC4732"></xref>.</t>
<t>In each of the cases described above, the possible arrangements
between the DOTS client and DOTS server to mitigate the attack are
discussed in <xref target="I-D.ietf-dots-use-cases"></xref>. An example
of network diagram showing a deployment of these elements is shown in
<xref target="fig"></xref>. Architectural relationships between involved
DOTS agents is explained in <xref
target="I-D.ietf-dots-architecture"></xref>. In this example, the DOTS
server is operating on the access network.</t>
<figure align="center" anchor="fig">
<artwork><![CDATA[
Network
Resource CPE router Access network __________
+-----------+ +--------------+ +-------------+ / \
| |____| |_______| |___ | Internet |
|DOTS client| | DOTS gateway | | DOTS server | | |
| | | | | | | |
+-----------+ +--------------+ +-------------+ \__________/ ]]></artwork>
</figure>
<t></t>
<t>The DOTS server can also be running on the Internet, as depicted in
<xref target="fig_blah"></xref>.</t>
<figure align="center" anchor="fig_blah">
<artwork><![CDATA[ Network DDoS mitigation
Resource CPE router __________ service
+-----------+ +-------------+ / \ +-------------+
| |____| |_______| |___ | |
|DOTS client| |DOTS gateway | | Internet | | DOTS server |
| | | | | | | | |
+-----------+ +-------------+ \__________/ +-------------+
]]></artwork>
</figure>
<t></t>
<t>In typical deployments, the DOTS client belongs to a different
administrative domain than the DOTS server. For example, the DOTS client
is a web server serving content owned and operated by an domain, while
the DOTS server is owned and operated by a different domain providing
DDoS mitigation services. That domain providing DDoS mitigation service
might, or might not, also provide Internet access service to the website
operator.</t>
<t>The DOTS server may (not) be co-located with the DOTS mitigator. In
typical deployments, the DOTS server belongs to the same administrative
domain as the mitigator.</t>
<t>The DOTS client can communicate directly with the DOTS server or
indirectly via a DOTS gateway.</t>
<t>This document focuses on the DOTS signal channel.</t>
</section>
<section title="Happy Eyeballs for DOTS Signal Channel">
<t>DOTS signaling can happen with DTLS <xref target="RFC6347"></xref>
over UDP and TLS <xref target="RFC5246"></xref> over TCP. A DOTS client
can use DNS to determine the IP address(es) of a DOTS server or a DOTS
client may be provided with the list of DOTS server IP addresses. The
DOTS client MUST know a DOTS server's domain name; hard-coding the
domain name of the DOTS server into software is NOT RECOMMENDED in case
the domain name is not valid or needs to change for legal or other
reasons. The DOTS client performs A and/or AAAA record lookup of the
domain name and the result will be a list of IP addresses, each of which
can be used to contact the DOTS server using UDP and TCP.</t>
<t>If an IPv4 path to reach a DOTS server is found, but the DOTS
server's IPv6 path is not working, a dual-stack DOTS client can
experience a significant connection delay compared to an IPv4-only DOTS
client. The other problem is that if a middlebox between the DOTS client
and DOTS server is configured to block UDP, the DOTS client will fail to
establish a DTLS session with the DOTS server and will, then, have to
fall back to TLS over TCP incurring significant connection delays. <xref
target="I-D.ietf-dots-requirements"></xref> discusses that DOTS client
and server will have to support both connectionless and
connection-oriented protocols.</t>
<t>To overcome these connection setup problems, the DOTS client can try
connecting to the DOTS server using both IPv6 and IPv4, and try both
DTLS over UDP and TLS over TCP in a fashion similar to the Happy
Eyeballs mechanism <xref target="RFC6555"></xref>. These connection
attempts are performed by the DOTS client when its initializes, and the
client uses that information for its subsequent alert to the DOTS
server. In order of preference (most preferred first), it is UDP over
IPv6, UDP over IPv4, TCP over IPv6, and finally TCP over IPv4, which
adheres to <xref target="RFC6724">address preference order</xref> and
the DOTS preference that UDP be used over TCP (to avoid TCP's head of
line blocking).</t>
<t><figure anchor="fig_happy_eyeballs" title="Happy Eyeballs">
<artwork align="center"><![CDATA[
DOTS client DOTS server
| |
|--DTLS ClientHello, IPv6 ---->X |
|--TCP SYN, IPv6-------------->X |
|--DTLS ClientHello, IPv4 ---->X |
|--TCP SYN, IPv4----------------------------------------->|
|--DTLS ClientHello, IPv6 ---->X |
|--TCP SYN, IPv6-------------->X |
|<-TCP SYNACK---------------------------------------------|
|--DTLS ClientHello, IPv4 ---->X |
|--TCP ACK----------------------------------------------->|
|<------------Establish TLS Session---------------------->|
|----------------DOTS signal----------------------------->|
| |
]]></artwork>
</figure></t>
<t>In reference to <xref target="fig_happy_eyeballs"></xref>, the DOTS
client sends two TCP SYNs and two DTLS ClientHello messages at the same
time over IPv6 and IPv4. In this example, it is assumed that the IPv6
path is broken and UDP is dropped by a middle box but has little impact
to the DOTS client because there is no long delay before using IPv4 and
TCP. The IPv6 path and UDP over IPv6 and IPv4 is retried until the DOTS
client gives up.</t>
</section>
<section title="DOTS Signal Channel">
<section title="Overview">
<t>Constrained Application Protocol (CoAP) <xref
target="RFC7252"></xref> is used for DOTS signal channel (<xref
target="fig_dots"></xref>). COAP was designed according to the REST
architecture, and thus exhibits functionality similar to that of HTTP,
it is quite straightforward to map from CoAP to HTTP and from HTTP to
CoAP. CoAP has been defined to make use of both DTLS over UDP and TLS
over TCP. The advantages of COAP are: (1) Like HTTP, CoAP is based on
the successful REST model, (2) CoAP is designed to use minimal
resources, (3) CoAP integrates with JSON, CBOR or any other data
format, (4) asynchronous message exchanges, (5) includes a congestion
control mechanism (6) allows configuration of message transmission
parameters specific to the application environment (including
dynamically adjusted values, see Section 4.8.1 in <xref
target="RFC7252"></xref>) etc.</t>
<t><figure anchor="fig_dots"
title="Abstract Layering of DOTS signal channel over CoAP over (D)TLS">
<artwork align="center"><![CDATA[ +--------------+
| DOTS |
+--------------+
| CoAP |
+--------------+
| TLS | DTLS |
+--------------+
| TCP | UDP |
+--------------+
| IP |
+--------------+
]]></artwork>
</figure></t>
<t>A single DOTS signal channel between DOTS agents can be used to
exchange multiple DOTS signal messages. To reduce DOTS client and DOTS
server workload, DOTS client SHOULD re-use the (D)TLS session.</t>
<t>JSON <xref target="RFC7159"></xref> payloads are used to convey
signal channel specific payload messages that convey request
parameters and response information such as errors.</t>
<t>TBD: Do we want to use CBOR [RFC7049] instead of JSON?</t>
</section>
<section anchor="m_req" title="Mitigation Service Requests">
<t>The following APIs define the means to convey a DOTS signal from a
DOTS client to a DOTS server:<list style="hanging">
<t hangText="POST requests:">are used to convey the DOTS signal
from a DOTS client to a DOTS server over the signal channel,
possibly traversing a DOTS gateway, indicating the DOTS client's
need for mitigation, as well as the scope of any requested
mitigation (<xref target="post"></xref>). DOTS gateway act as a
CoAP-to-CoAP Proxy (explained in <xref
target="RFC7252"></xref>).</t>
<t hangText="DELETE requests:">are used by the DOTS client to
withdraw the request for mitigation from the DOTS server (<xref
target="del"></xref>).</t>
<t hangText="GET requests:">are used by the DOTS client to
retrieve the DOTS signal(s) it had conveyed to the DOTS server
(<xref target="get"></xref>).</t>
<t hangText="PUT requests:">are used by the DOTS client to convey
mitigation efficacy updates to the DOTS server (<xref
target="put"></xref>).</t>
</list></t>
<t>Reliability is provided to the POST, DELETE, GET, and PUT requests
by marking them as Confirmable (CON) messages. As explained in Section
2.1 of <xref target="RFC7252"></xref>, a Confirmable message is
retransmitted using a default timeout and exponential back-off between
retransmissions, until the DOTS server sends an Acknowledgement
message (ACK) with the same Message ID conveyed from the DOTS client.
Message transmission parameters are defined in Section 4.8 of <xref
target="RFC7252"></xref>. Reliability is provided to the responses by
marking them as Confirmable (CON) messages. The DOTS server can either
piggback the response in the acknowledgement message or if the DOTS
server is not able to respond immediately to a request carried in a
Confirmable message, it simply responds with an Empty Acknowledgement
message so that the DOTS client can stop retransmitting the request.
Empty Acknowledgement message is explained in Section 2.2 of <xref
target="RFC7252"></xref>. When the response is ready, the server sends
it in a new Confirmable message which then in turn needs to be
acknowledged by the DOTS client (see Sections 5.2.1 and Sections 5.2.2
in <xref target="RFC7252"></xref>).</t>
<t>Implementation Note: A DOTS client that receives a response in a
CON message may want to clean up the message state right after sending
the ACK. If that ACK is lost and the DOTS server retransmits the CON,
the DOTS client may no longer have any state to which to correlate
this response, making the retransmission an unexpected message; the
DOTS client will send a Reset message so it does not receive any more
retransmissions. This behavior is normal and not an indication of an
error (see Section 5.3.2 in <xref target="RFC7252"></xref> for more
details).</t>
<section anchor="post" title="Convey DOTS Signals">
<t>When suffering an attack and desiring DoS/DDoS mitigation, a DOTS
signal is sent by the DOTS client to the DOTS server. A POST request
is used to convey a DOTS signal to the DOTS server (<xref
target="Figure1"></xref>). The DOTS server can enable mitigation on
behalf of the DOTS client by communicating the DOTS client's request
to the mitigator and relaying any mitigator feedback to the
requesting DOTS client.</t>
<t><figure anchor="Figure1" title="POST to convey DOTS signals">
<artwork align="left"><![CDATA[ Header: POST (Code=0.02)
Uri-Host: "host"
Uri-Path: ".well-known"
Uri-Path: "DOTS-signal"
Uri-Path: "version"
Content-Type: "application/json"
{
"policy-id": "integer",
"target-ip": "string",
"target-port": "string",
"target-protocol": "string",
"FQDN": "string",
"URI": "string",
"E.164": "string",
"alias": "string"
"lifetime": "number"
}
]]></artwork>
</figure></t>
<t>The header fields are described below.</t>
<t><list style="hanging">
<t hangText="policy-id:">Identifier of the policy represented
using an integer. This identifier MUST be unique for each policy
bound to the DOTS client, i.e. ,the policy-id needs to be unique
relative to the active policies with the DOTS server. This
identifier MUST be generated by the DOTS client. This document
does not make any assumption about how this identifier is
generated. This is a mandatory attribute.</t>
<t hangText="target-ip:">A list of IP addresses or prefixes
under attack. IP addresses and prefixes are separated by commas.
Prefixes are represented using CIDR notation <xref
target="RFC4632"></xref>. This is an optional attribute.</t>
<t hangText="target-port:">A list of ports under attack. Ports
are separated by commas and port number range (using "-"). For
TCP, UDP, SCTP, or DCCP: the range of ports (e.g., 1024-65535).
This is an optional attribute.</t>
<t hangText="target-protocol:">A list of protocols under attack.
Valid protocol values include tcp, udp, sctp, and dccp. Protocol
values are separated by commas. This is an optional
attribute.</t>
<t hangText="FQDN: ">Fully Qualified Domain Name, is the full
name of a system, rather than just its hostname. For example,
"venera" is a hostname, and "venera.isi.edu" is an FQDN. This is
an optional attribute.</t>
<t hangText="URI: ">Uniform Resource Identifier (URI). This is
an optional attribute.</t>
<t hangText="E.164: ">E.164 number. This is an optional
attribute.</t>
<t hangText="alias:">Name of the alias (see Section 3.1.1 in
<xref target="I-D.reddy-dots-data-channel"></xref>). This is an
optional attribute.</t>
<t hangText="lifetime: ">Lifetime of the mitigation request
policy in seconds. Upon the expiry of this lifetime, and if the
request is not refreshed, the mitigation request is removed. The
request can be refreshed by sending the same request again. The
default lifetime of the policy is 60 minutes -- this value was
chosen to be long enough so that refreshing is not typically a
burden on the DOTS client, while expiring the policy where the
client has unexpectedly quit in a timely manner. A lifetime of
zero indicates indefinite lifetime for the mitigation request.
The server MUST always indicate the actual lifetime in the
response. This is an optional attribute in the request.</t>
</list></t>
<t>In the POST request at least one of the attributes target-ip or
target-port or target-protocol or FQDN or URI or E.164 or alias MUST
be present. The relative order of two mitigation requests is
determined by comparing their respective policy identifiers. The
mitigation request with higher numeric policy identifier value has
higher precedence (and thus will match before) than the mitigation
request with lower numeric policy identifier value.</t>
<t>To avoid DOTS signal message fragmentation and the consequently
decreased probability of message delivery, DOTS agents MUST ensure
that the DTLS record MUST fit within a single datagram. If the Path
MTU is not known to the DOTS server, an IP MTU of 1280 bytes SHOULD
be assumed. The length of the URL MUST NOT exceed 256 bytes. If UDP
is used to convey the DOTS signal messages then the DOTS client must
consider the amount of record expansion expected by the DTLS
processing when calculating the size of CoAP message that fits
within the path MTU. Path MTU MUST be greater than or equal to [CoAP
message size + DTLS overhead of 13 octets + authentication overhead
of the negotiated DTLS cipher suite + block padding (Section 4.1.1.1
of <xref target="RFC6347"></xref>]. If the request size exceeds the
Path MTU then the DOTS client MUST split the DOTS signal into
separate messages, for example the list of addresses in the
'target-ip' field could be split into multiple lists and each list
conveyed in a new POST request.</t>
<t>Implementation Note: DOTS choice of message size parameters works
well with IPv6 and with most of today's IPv4 paths. However, with
IPv4, it is harder to absolutely ensure that there is no IP
fragmentation. If IPv4 support on unusual networks is a
consideration and path MTU is unknown, implementations may want to
limit themselves to more conservative IPv4 datagram sizes such as
576 bytes, as per <xref target="RFC0791"></xref> IP packets up to
576 bytes should never need to be fragmented, thus sending a maximum
of 500 bytes of DOTS signal over a UDP datagram will generally avoid
IP fragmentation.</t>
<t><xref target="Figure2"></xref> shows a POST request to signal
that ports 80, 8080, and 443 on the servers 2002:db8:6401::1 and
2002:db8:6401::2 are being attacked.</t>
<t><figure anchor="Figure2" title="POST for DOTS signal">
<artwork align="left"><![CDATA[ Header: POST (Code=0.02)
Uri-Host: "www.example.com"
Uri-Path: ".well-known"
Uri-Path: "v1"
Uri-Path: "DOTS-signal"
Content-Format: "application/json"
{
"policy-id":123321333242,
"target-ip":[
"2002:db8:6401::1",
"2002:db8:6401::2"
],
"target-port":[
"80",
"8080",
"443"
],
"target-protocol":"tcp"
}]]></artwork>
</figure></t>
<t>The DOTS server indicates the result of processing the POST
request using CoAP response codes. CoAP 2.xx codes are success, CoAP
4.xx codes are some sort of invalid requests and 5.xx codes are
returned if the DOTS server has erred or is incapable of performing
the mitigation. Response code 2.01 (Created) will be returned in the
response if the DOTS server has accepted the mitigation request and
will try to mitigate the attack. If the request is missing one or
more mandatory attributes, then 4.00 (Bad Request) will be returned
in the response or if the request contains invalid or unknown
parameters then 4.02 (Invalid query) will be returned in the
response. The CoAP response will include the JSON body received in
the request.</t>
</section>
<section anchor="del" title="Withdraw a DOTS Signal">
<t>A DELETE request is used to withdraw a DOTS signal from a DOTS
server (<xref target="Figure3"></xref>).</t>
<figure anchor="Figure3" title="Withdraw DOTS signal">
<artwork align="left"><![CDATA[ Header: DELETE (Code=0.04)
Uri-Host: "host"
Uri-Path: ".well-known"
Uri-Path: "version"
Uri-Path: "DOTS-signal"
Content-Format: "application/json"
{
"policy-id": "number"
}
]]></artwork>
</figure>
<t>If the DOTS server does not find the policy number conveyed in
the DELETE request in its policy state data, then it responds with a
4.04 (Not Found) error response code. The DOTS server successfully
acknowledges a DOTS client's request to withdraw the DOTS signal
using 2.02 (Deleted) response code, and ceases mitigation activity
as quickly as possible.</t>
</section>
<section anchor="get" title="Retrieving a DOTS Signal">
<t>A GET request is used to retrieve information and status of a
DOTS signal from a DOTS server (<xref target="Figure4"></xref>). If
the DOTS server does not find the policy number conveyed in the GET
request in its policy state data, then it responds with a 4.04 (Not
Found) error response code.</t>
<figure anchor="Figure4" title="GET to retrieve the rules">
<artwork align="left"><![CDATA[1) To retrieve all DOTS signals signaled by the DOTS client.
Header: GET (Code=0.01)
Uri-Host: "host"
Uri-Path: ".well-known"
Uri-Path: "version"
Uri-Path: "DOTS-signal"
Observe : 0
2) To retrieve a specific DOTS signal signaled by the DOTS client.
The policy information in the response will be formatted in the
same order it was processed at the DOTS server.
Header: GET (Code=0.01)
Uri-Host: "host"
Uri-Path: ".well-known"
Uri-Path: "version"
Uri-Path: "DOTS-signal"
Uri-Path: "policy-id value"
Observe : 0
]]></artwork>
</figure>
<t><xref target="Figure5"></xref> shows the response of all the
active policies on the DOTS server.</t>
<t><figure anchor="Figure5" title="Response body">
<artwork align="left"><![CDATA[{
"policy-data":[
{
"policy-id":123321333242,
"target-protocol":"tcp",
"lifetime":3600,
"status":"mitigation in progress"
},
{
"policy-id":123321333244,
"target-protocol":"udp",
"lifetime":1800,
"status":"mitigation complete"
},
{
"policy-id":123321333245,
"target-protocol":"tcp",
"lifetime":1800,
"status":"attack stopped"
}
]
}]]></artwork>
</figure></t>
<t>The various possible values of status field are explained
below:</t>
<t><list style="hanging">
<t hangText="mitigation in progress:">Attack mitigation is in
progress (e.g., changing the network path to re-route the
inbound traffic to DOTS mitigator).</t>
<t hangText="mitigation complete:">Attack is successfully
mitigated (e.g., attack traffic is dropped).</t>
<t hangText="attack stopped:">Attack has stopped and the DOTS
client can withdraw the mitigation request.</t>
<t hangText="mitigation capacity exceeded:">Attack has exceeded
the mitigation provider capability.</t>
</list></t>
<t>The observe option defined in <xref target="RFC7641"></xref>
extends the CoAP core protocol with a mechanism for a CoAP client to
"observe" a resource on a CoAP server: the client retrieves a
representation of the resource and requests this representation be
updated by the server as long as the client is interested in the
resource. A DOTS client conveys the observe option set to 0 in the
GET request to receive unsolicited notifications of attack
mitigation status from the DOTS server. Unidirectional notifications
within the bidirectional signal channel allows unsolicited message
delivery, enabling asynchronous notifications between the agents. A
DOTS client that is no longer interested in receiving notifications
from the DOTS server can simply "forget" the observation. When the
DOTS server then sends the next notification, the DOTS client will
not recognize the token in the message and thus will return a Reset
message. This causes the DOTS server to remove the associated
entry.</t>
<t><figure anchor="Figure6"
title="Notifications of attack mitigation status">
<artwork align="left"><![CDATA[
DOTS Client DOTS Server
| |
| GET /<policy-id number> |
| Token: 0x4a | Registration
| Observe: 0 |
+-------------------------->|
| |
| 2.05 Content |
| Token: 0x4a | Notification of
| Observe: 12 | the current state
| status: "mitigation |
| in progress" |
|<--------------------------+
| 2.05 Content |
| Token: 0x4a | Notification upon
| Observe: 44 | a state change
| status: "mitigation |
| complete" |
|<--------------------------+
| 2.05 Content |
| Token: 0x4a | Notification upon
| Observe: 60 | a state change
| status: "attack stopped" |
|<--------------------------+
| |
]]></artwork>
</figure></t>
<section title="Mitigation Status">
<t>A DOTS client retrieves the information about a DOTS signal at
frequent intervals to determine the status of an attack. If the
DOTS server has been able to mitigate the attack and the attack
has stopped, the DOTS server indicates as such in the status, and
the DOTS client recalls the mitigation request.</t>
<t>A DOTS client should react to the status of the attack from the
DOTS server and not the fact that it has recognized, using its own
means, that the attack has been mitigated. This ensures that the
DOTS client does not recall a mitigation request in a premature
fashion because it is possible that the DOTS client does not sense
the DDOS attack on its resources but the DOTS server could be
actively mitigating the attack and the attack is not completely
averted.</t>
</section>
</section>
<section anchor="put" title="Efficacy Update from DOTS Client">
<t>While DDoS mitigation is active, a DOTS client MAY frequently
transmit DOTS mitigation efficacy updates to the relevant DOTS
server. An PUT request (<xref target="Figure7"></xref>) is used to
convey the mitigation efficacy update to the DOTS server. The PUT
request MUST include all the header fields used in the POST request
to convey the DOTS signal (<xref target="post"></xref>). If the DOTS
server does not find the policy number conveyed in the PUT request
in its policy state data, it responds with a 4.04 (Not Found) error
response code.</t>
<figure anchor="Figure7" title="Efficacy Update">
<artwork align="left"><![CDATA[ Header: PUT (Code=0.03)
Uri-Host: "host"
Uri-Path: ".well-known"
Uri-Path: "version"
Uri-Path: "DOTS-signal"
Uri-Path: "policy-id value"
Content-Format: "application/json"
{
"target-ip": "string",
"target-port": "string",
"target-protocol": "string",
"FQDN": "string",
"URI": "string",
"E.164": "string",
"alias": "string"
"lifetime": "number",
"attack-status": "string"
}
]]></artwork>
</figure>
<t>The 'attack-status' field is a mandatory attribute. The various
possible values contained in the 'attack-status' field are explained
below:</t>
<t><list style="hanging">
<t hangText="in-progress:">DOTS client determines that it is
still under attack.</t>
<t hangText="terminated:">Attack is successfully mitigated
(e.g., attack traffic is dropped).</t>
</list>The DOTS server indicates the result of processing the PUT
request using CoAP response codes. The response code 2.04 (Changed)
will be returned in the response if the DOTS server has accepted the
mitigation efficacy update. If the DOTS server does not find the
policy number conveyed in the PUT request in its policy state data
then the server MAY accept the mitigation request and will try to
mitigate the attack, resulting in a 2.01 (Created) Response Code.
The 5.xx response codes are returned if the DOTS server has erred or
is incapable of performing the mitigation.</t>
</section>
</section>
<section anchor="sigconfig"
title="DOTS Signal Channel Session Configuration">
<t>The DOTS client can negotiate, configure and retrieve the DOTS
signal channel session behavior. The DOTS signal channel can be used,
for example, to configure the following:<list style="letters">
<t>Heartbeat interval: DOTS agents regularly send heartbeats to
each other after mutual authentication in order to keep the DOTS
signal channel open.</t>
<t>Acceptable signal loss ratio: Maximum retransmissions,
retransmission timeout value and other message transmission
parameters for the DOTS signal channel.</t>
</list></t>
<section title="Discover Acceptable Configuration Parameters">
<t>A GET request is used to obtain acceptable configuration
parameters on the DOTS server for DOTS signal channel session
configuration.. <xref target="Figure18"></xref> shows how to obtain
acceptable configuration parameters for the server.</t>
<figure anchor="Figure18" title="GET to retrieve configuration">
<artwork align="left"><![CDATA[ Header: GET (Code=0.01)
Uri-Host: "host"
Uri-Path: ".well-known"
Uri-Path: "version"
Uri-Path: "DOTS-signal"
Uri-Path: "config"
]]></artwork>
</figure>
<t></t>
<t>The DOTS server in the 2.05 (Content) response conveys the
minumum and maximum attribute values acceptable by the DOTS
server.</t>
<t><figure anchor="Figure19" title="GET response body">
<artwork align="left"><![CDATA[ Content-Format: "application/json"
{
"heartbeat-interval": {"MinValue": 15, "MaxValue" : 60},
"max-retransmit": {"MinValue": 3, "MaxValue" : 15},
"ack-timeout": {"MinValue": 1, "MaxValue" : 30},
"ack-random-factor": {"MinValue": 1.0, "MaxValue" : 4.0}
}
]]></artwork>
</figure></t>
</section>
<section title="Convey DOTS Signal Channel Session Configuration">
<t>A POST request is used to convey the configuration parameters for
the signaling channel (e.g., heartbeat interval, maximum
retransmissions etc). Message transmission parameters for CoAP are
defined in Section 4.8 of <xref target="RFC7252"></xref>. These
parameters can be modified by the DOTS agent (need not be default).
If the DOTS client wishes to change the default values of message
transmission parameters then it should follow the guidence given in
Section 4.8.1 of <xref target="RFC7252"></xref>. The signaling
channel session configuration is applicable to all DOTS signal
channel sessions between the DOTS agents.</t>
<t><figure anchor="Figure13"
title="POST to convey the DOTS signal channel session configuration data.">
<artwork align="left"><![CDATA[ Header: POST (Code=0.02)
Uri-Host: "host"
Uri-Path: ".well-known"
Uri-Path: "version"
Uri-Path: "DOTS-signal"
Uri-Path: "config"
Content-Format: "application/json"
{
"policy-id": "integer",
"heartbeat-interval": "integer",
"max-retransmit": "integer",
"ack-timeout": "integer",
"ack-random-factor": "Number"
}
]]></artwork>
</figure></t>
<t>The header fields are described below:</t>
<t><list style="hanging">
<t hangText="policy-id:">An identifier of the policy represented
as an integer. This identifier MUST be unique for each policy
bound to the DOTS client, i.e., the policy-id needs to be unique
relative to the active policies with the DOTS server. This
identifier MUST be generated by the DOTS client. This document
does not make any assumption about how this identifier is
generated. This is a mandatory attribute.</t>
<t hangText="heartbeat-interval: ">Heartbeat interval to check
the DOTS peer health. This is an optional attribute.</t>
<t hangText="max-retransmit: ">Maximum number of retransmissions
for a message (referred to as MAX_RETRANSMIT parameter in CoAP).
This is an optional attribute.</t>
<t hangText="ack-timeout: ">Timeout value in seconds used to
calculate the intial retransmission timeout value (referred to
as ACK_TIMEOUT parameter in CoAP). This is an optional
attribute.</t>
<t hangText="ack-random-factor: ">Random factor used to
influence the timing of retransmissions (referred to as
ACK_RANDOM_FACTOR parameter in CoAP). This is an optional
attribute.</t>
</list></t>
<t>In the POST request at least one of the attributes
heartbeat-interval or max-retransmit or ack-timeout or ack-random-
factor MUST be present. The POST request with higher numeric policy
identifier value over-rides the DOTS signal channel session
configuration data installed by a POST request with a lower numeric
policy identifier value.</t>
<t><xref target="Figure14"></xref> shows a POST request to convey
the configuration parameters for the DOTS signal channel.</t>
<t><figure anchor="Figure14"
title="POST to convey the configuration parameters">
<artwork align="left"><![CDATA[ Header: POST (Code=0.02)
Uri-Host: "www.example.com"
Uri-Path: ".well-known"
Uri-Path: "v1"
Uri-Path: "DOTS-signal"
Uri-Path: "config"
Content-Format: "application/json"
{
"policy-id": 1234534333242,
"heartbeat-interval": 30,
"max-retransmit": 7,
"ack-timeout": 5,
"ack-random-factor": 1.5
}
]]></artwork>
</figure></t>
<t>The DOTS server indicates the result of processing the POST
request using CoAP response codes. The CoAP response will include
the JSON body received in the request. Response code 2.01 (Created)
will be returned in the response if the DOTS server has accepted the
configuration parameters. If the request is missing one or more
mandatory attributes then 4.00 (Bad Request) will be returned in the
response or if the request contains invalid or unknown parameters
then 4.02 (Invalid query) will be returned in the response. Response
code 4.22 (Unprocessable Entity) will be returned in the response if
any of the heartbeat-interval, max-retransmit, target-protocol,
ack-timeout and ack-random-factor attribute values is not acceptable
to the DOTS server. The DOTS server in the error response conveys
the minumum and maximum attribute values acceptable by the DOTS
server. The DOTS client can re-try and send the POST request with
updated attribute values acceptable to the DOTS server.</t>
<t><figure anchor="Figure17" title="Error response body">
<artwork align="left"><![CDATA[ Content-Format: "application/json"
{
"policy-id": 1234534333242,
"heartbeat-interval": {"MinValue": 15, "MaxValue" : 60},
"max-retransmit": {"MinValue": 3, "MaxValue" : 15},
"ack-timeout": {"MinValue": 1, "MaxValue" : 30},
"ack-random-factor": {"MinValue": 1.0, "MaxValue" : 4.0}
}
]]></artwork>
</figure></t>
</section>
<section title="Delete DOTS Signal Channel Session Configuration">
<t>A DELETE request is used to delete the installed DOTS signal
channel session configuration data (<xref
target="Figure15"></xref>).</t>
<figure anchor="Figure15" title="DELETE configuration">
<artwork align="left"><![CDATA[ Header: DELETE (Code=0.04)
Uri-Host: "host"
Uri-Path: ".well-known"
Uri-Path: "version"
Uri-Path: "DOTS-signal"
Uri-Path: "config"
Content-Format: "application/json"
{
"policy-id": "number"
}
]]></artwork>
</figure>
<t>If the DOTS server does not find the policy number conveyed in
the DELETE request in its policy state data, then it responds with a
4.04 (Not Found) error response code. The DOTS server successfully
acknowledges a DOTS client's request to remove the DOTS signal
channel session configuration using 2.02 (Deleted) response
code.</t>
</section>
<section title="Retrieving DOTS Signal Channel Session Configuration">
<t>A GET request is used to retrieve the installed DOTS signal
channel session configuration data from a DOTS server. <xref
target="Figure16"></xref> shows how to retrieve the DOTS signal
channel session configuration data.</t>
<figure anchor="Figure16" title="GET to retrieve configuration">
<artwork align="left"><![CDATA[ Header: GET (Code=0.01)
Uri-Host: "host"
Uri-Path: ".well-known"
Uri-Path: "version"
Uri-Path: "DOTS-signal"
Uri-Path: "config"
Uri-Path: "policy-id value"
]]></artwork>
</figure>
</section>
</section>
<section title="Redirected Signaling">
<t>Redirected Signaling is discussed in detail in Section 3.2.2 of
<xref target="I-D.ietf-dots-architecture"></xref>. If the DOTS server
wants to redirect the DOTS client to an alternative DOTS server for a
signaling session then the response code 3.00 (alternate server) will
be returned in the response to the client. </t>
<t>The DOTS server in the error response conveys the alternate DOTS
server FQDN, and the alternate DOTS server IP addresses and TTL (time
to live) values in the JSON body.</t>
<figure anchor="Figure20" title="Error response body">
<artwork align="left"><![CDATA[{
"alt-server": "string",
"alt-server-record":
[
{
"addr": "string"
"TTL" : "integer",
}
]
}]]></artwork>
</figure>
<t>The header fields are described below:</t>
<t><list style="hanging">
<t hangText="alt-server:">FQDN of alternate DOTS server.</t>
<t hangText="addr:">IP address of alternate DOTS server.</t>
<t hangText="TTL:">Time to live represented as an integer number
of seconds.</t>
</list><xref target="Figure21"></xref> shows a 3.00 response to
convey the DOTS alternate server www.example-alt.com, its IP addresses
2002:db8:6401::1 and 2002:db8:6401::2, and TTL values 3600 and
1800.</t>
<t><figure anchor="Figure21" title="Example of error response body">
<artwork align="left"><![CDATA[{
"alt-server": "www.example-alt.com",
"alt-server-record":
[
{
"TTL" : 3600,
"addr": "2002:db8:6401::1"
},
{
"TTL" : 1800,
"addr": "2002:db8:6401::2"
},
]
}]]></artwork>
</figure></t>
<t>When the DOTS client receives 3.00 response, it considers the
current request as having failed, but SHOULD try the request with the
alternate DOTS server. During a DDOS attack, the DNS server may be
subjected to DDOS attack, alternate DOTS server IP addresses conveyed
in the 3.00 response help the DOTS client to skip DNS lookup of the
alternate DOTS server and can try to establish UDP or TCP session with
the alternate DOTS server IP addresses. The DOTS client SHOULD
implement DNS64 function to handle the scenario where IPv6-only DOTS
client communicates with IPv4-only alternate DOTS server.</t>
</section>
</section>
<section title="(D)TLS Protocol Profile and Performance considerations">
<t>This section defines the (D)TLS protocol profile of DOTS signal
channel over (D)TLS and DOTS data channel over TLS.</t>
<t>There are known attacks on (D)TLS, such as machine-in-the-middle and
protocol downgrade. These are general attacks on (D)TLS and not specific
to DOTS over (D)TLS; please refer to the (D)TLS RFCs for discussion of
these security issues. DOTS agents MUST adhere to the (D)TLS
implementation recommendations and security considerations of <xref
target="RFC7525"></xref> except with respect to (D)TLS version. Since
encryption of DOTS using (D)TLS is virtually a green-field deployment
DOTS agents MUST implement only (D)TLS 1.2 or later.</t>
<t>Implementations compliant with this profile MUST implement all of the
following items:</t>
<t><list style="symbols">
<t>DOTS client can use (D)TLS session resumption without server-side
state <xref target="RFC5077"></xref> to resume session and convey
the DOTS signal.</t>
<t>While the communication to the DOTS server is quiescent, the DOTS
client MAY probe the server to ensure it has maintained
cryptographic state. Such probes can also keep alive firewall or NAT
bindings. This probing reduces the frequency of needing a new
handshake when a DOTS signal needs to be conveyed to the DOTS
server. <list style="symbols">
<t>A <xref target="RFC6520">(D)TLS heartbeat</xref> verifies the
DOTS server still has DTLS state by returning a DTLS message. If
the server has lost state, it returns a DTLS Alert. Upon receipt
of an unauthenticated DTLS Alert, the DTLS client validates the
Alert is within the replay window (Section 4.1.2.6 of <xref
target="RFC6347"></xref>). It is difficult for the DTLS client
to validate the DTLS Alert was generated by the DTLS server in
response to a request or was generated by an on- or off-path
attacker. Thus, upon receipt of an in-window DTLS Alert, the
client SHOULD continue re-transmitting the DTLS packet (in the
event the Alert was spoofed), and at the same time it SHOULD
initiate DTLS session resumption.</t>
<t>TLS runs over TCP, so a simple probe is a 0-length TCP packet
(a "window probe"). This verifies the TCP connection is still
working, which is also sufficient to prove the server has
retained TLS state, because if the server loses TLS state it
abandons the TCP connection. If the server has lost state, a TCP
RST is returned immediately.</t>
<t>Raw public keys <xref target="RFC7250"></xref> which reduce
the size of the ServerHello, and can be used by servers that
cannot obtain certificates (e.g., DOTS gateways on private
networks).</t>
</list></t>
</list></t>
<t>Implementations compliant with this profile SHOULD implement all of
the following items to reduce the delay required to deliver a DOTS
signal:</t>
<section title="MTU and Fragmentation Issues">
<t>To avoid DOTS signal message fragmentation and the consequently
decreased probability of message delivery, DOTS agents MUST ensure
that the DTLS record MUST fit within a single datagram. If the Path
MTU is not known to the DOTS server, an IP MTU of 1280 bytes SHOULD be
assumed. The length of the URL MUST NOT exceed 256 bytes. If UDP is
used to convey the DOTS signal messages then the DOTS client must
consider the amount of record expansion expected by the DTLS
processing when calculating the size of CoAP message that fits within
the path MTU. Path MTU MUST be greater than or equal to [CoAP message
size + DTLS overhead of 13 octets + authentication overhead of the
negotiated DTLS cipher suite + block padding (Section 4.1.1.1 of <xref
target="RFC6347"></xref>]. If the request size exceeds the Path MTU
then the DOTS client MUST split the DOTS signal into separate
messages, for example the list of addresses in the 'target-ip' field
could be split into multiple lists and each list conveyed in a new
POST request.</t>
<t>Implementation Note: DOTS choice of message size parameters works
well with IPv6 and with most of today's IPv4 paths. However, with
IPv4, it is harder to absolutely ensure that there is no IP
fragmentation. If IPv4 support on unusual networks is a consideration
and path MTU is unknown, implementations may want to limit themselves
to more conservative IPv4 datagram sizes such as 576 bytes, as per
<xref target="RFC0791"></xref> IP packets up to 576 bytes should never
need to be fragmented, thus sending a maximum of 500 bytes of DOTS
signal over a UDP datagram will generally avoid IP fragmentation.</t>
</section>
</section>
<section anchor="mutauth"
title="Mutual Authentication of DOTS Agents & Authorization of DOTS Clients">
<t>(D)TLS based on client certificate can be used for mutual
authentication between DOTS agents. If a DOTS gateway is involved, DOTS
clients and DOTS gateway MUST perform mutual authentication; only
authorized DOTS clients are allowed to send DOTS signals to a DOTS
gateway. DOTS gateway and DOTS server MUST perform mutual
authentication; DOTS server only allows DOTS signals from authorized
DOTS gateway, creating a two-link chain of transitive authentication
between the DOTS client and the DOTS server.</t>
<t><figure anchor="Figure12"
title="Example of Authentication and Authorization of DOTS Agents">
<artwork align="left"><![CDATA[
+-------------------------------------------------+
| example.com domain +---------+ |
| | AAA | |
| +---------------+ | Server | |
| | Application | +------+--+ |
| | server + ^
| | (DOTS client) |<-----------------+ | |
| +---------------+ + | | example.net domain
| V V |
| +-------------+ | +---------------+
| +--------------+ | | | | |
| | Guest +<-----x----->+ +<---------------->+ DOTS |
| | (DOTS client)| | DOTS | | | Server |
| +--------------+ | Gateway | | | |
| +----+--------+ | +---------------+
| ^ |
| | |
| +----------------+ | |
| | DDOS detector | | |
| | (DOTS client) +<--------------+ |
| +----------------+ |
| |
+-------------------------------------------------+
]]></artwork>
</figure>In the example depicted in <xref target="Figure12"></xref>,
the DOTS gateway and DOTS clients within the 'example.com' domain
mutually authenticate with each other. After the DOTS gateway validates
the identity of a DOTS client, it communicates with the AAA server in
the 'example.com' domain to determine if the DOTS client is authorized
to request DDOS mitigation. If the DOTS client is not authorized, a 4.01
(Unauthorized) is returned in the response to the DOTS client. In this
example, the DOTS gateway only allows the application server and DDOS
detector to request DDOS mitigation, but does not permit the user of
type 'guest' to request DDOS mitigation.</t>
<t>Also, DOTS gateway and DOTS server MUST perform mutual authentication
using certificates. A DOTS server will only allow a DOTS gateway with a
certificate for a particular domain to request mitigation for that
domain. In reference to <xref target="Figure12"></xref>, the DOTS server
only allows the DOTS gateway to request mitigation for 'example.com'
domain and not for other domains.</t>
</section>
<section title="IANA Considerations">
<t>TODO</t>
<t>[TBD: DOTS WG will probably have to do something similar to
https://tools.ietf.org/html/rfc7519#section-10, create JSON DOTS claim
registry and register the JSON attributes defined in this
specification].</t>
</section>
<section anchor="security" title="Security Considerations">
<t>Authenticated encryption MUST be used for data confidentiality and
message integrity. (D)TLS based on client certificate MUST be used for
mutual authentication. The interaction between the DOTS agents requires
Datagram Transport Layer Security (DTLS) and Transport Layer Security
(TLS) with a cipher suite offering confidentiality protection and the
guidance given in <xref target="RFC7525"></xref> MUST be followed to
avoid attacks on (D)TLS.</t>
<t>If TCP is used between DOTS agents, an attacker may be able to inject
RST packets, bogus application segments, etc., regardless of whether TLS
authentication is used. Because the application data is TLS protected,
this will not result in the application receiving bogus data, but it
will constitute a DoS on the connection. This attack can be countered by
using TCP-AO <xref target="RFC5925"></xref>. If TCP-AO is used, then any
bogus packets injected by an attacker will be rejected by the TCP-AO
integrity check and therefore will never reach the TLS layer.</t>
<t>Special care should be taken in order to ensure that the activation
of the proposed mechanism won't have an impact on the stability of the
network (including connectivity and services delivered over that
network).</t>
<t>Involved functional elements in the cooperation system must establish
exchange instructions and notification over a secure and authenticated
channel. Adequate filters can be enforced to avoid that nodes outside a
trusted domain can inject request such as deleting filtering rules.
Nevertheless, attacks can be initiated from within the trusted domain if
an entity has been corrupted. Adequate means to monitor trusted nodes
should also be enabled.</t>
</section>
<section anchor="contr" title="Contributors">
<t>The following individuals have contributed to this document:</t>
<t>Mike Geller Cisco Systems, Inc. 3250 Florida 33309 USA Email:
mgeller@cisco.com</t>
<t>Robert Moskowitz HTT Consulting Oak Park, MI 42837 United States
Email: rgm@htt-consult.com</t>
</section>
<section anchor="ack" title="Acknowledgements">
<t>Thanks to Christian Jacquenet, Roland Dobbins, Andrew Mortensen,
Roman D. Danyliw, and Gilbert Clark for the discussion and comments.</t>
</section>
</middle>
<back>
<references title="Normative References">
<?rfc include="reference.RFC.2119"?>
<?rfc include="reference.RFC.7525"?>
<?rfc include="reference.RFC.6347"?>
<?rfc include="reference.RFC.5246"?>
<?rfc include="reference.RFC.5925"?>
<?rfc include="reference.RFC.7252"?>
<?rfc include="reference.RFC.7250"?>
<?rfc include="reference.RFC.7641"?>
</references>
<references title="Informative References">
<?rfc include="reference.RFC.4732"?>
<?rfc include='reference.RFC.4987'?>
<?rfc include="reference.RFC.7159"?>
<?rfc include="reference.RFC.7413"?>
<?rfc include="reference.RFC.5077"?>
<?rfc include='reference.RFC.6555'?>
<?rfc include='reference.RFC.0791'?>
<?rfc include='reference.RFC.6724'?>
<?rfc include="reference.RFC.6520"?>
<?rfc include="reference.RFC.4632"?>
<?rfc include="reference.I-D.ietf-tls-cached-info"?>
<?rfc include="reference.I-D.ietf-tls-falsestart"?>
<?rfc include="reference.I-D.ietf-dots-requirements"?>
<?rfc include="reference.I-D.ietf-dots-use-cases"?>
<?rfc include="reference.I-D.ietf-dots-architecture"
?>
<?rfc include="reference.I-D.reddy-dots-data-channel"?>
</references>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-24 04:40:46 |