DHCP Options for
Distributed-Denial-of-Service Open Threat Signaling (DOTS)OrangeRennes35000Francemohamed.boucadair@orange.comIt may not be possible for a network to determine the cause for an
attack, but instead just realize that some resources seem to be under
attack. To fill that gap, Distributed-Denial-of-Service Open Threat
Signaling (DOTS) allows a network to inform a server that it is under a
potential attack so that appropriate mitigation actions are
undertaken.This document specifies DHCP (IPv4 and IPv6) options to configure
hosts with DOTS servers.The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119.In many deployments, it may not be possible for a network to
determine the cause for a distributed Denial-of-Service (DoS) attack
, but instead just realize that some
resources seem to be under attack. To fill that gap, the IETF is
specifying an architecture, called DDoS Open Threat Signaling (DOTS)
, in which a DOTS
client can inform a DOTS server that the network is under a potential
attack and that appropriate mitigation actions are required. Indeed,
because the lack of a common method to coordinate a real-time response
among involved actors and network domains inhibits the effectiveness of
DDoS attack mitigation, DOTS protocol is meant to carry requests for
DDoS attack mitigation, thereby reducing the impact of an attack and
leading to more efficient defensive actions. identifies a set of scenarios
for DOTS; almost all these scenarios involve a CPE.The basic high-level DOTS architecture is illustrated in (): specifies that the
DOTS client may be provided with a list of DOTS servers; each associated
with one or more IP addresses. These addresses may or may not be of the
same address family. The DOTS client establishes one or more signaling
sessions by connecting to the provided DOTS server addresses.To that aim, this document defines DHCPv4 and DHCPv6
options that can be used to configure hosts, embedding a DOTS client,
with DOTS servers' names. These names will be resolved into one or a
list of IP addresses. The use of DHCP for DOTS provisioning is justified because many of
the target use cases identified in involve CPEs; these devices
widely support DHCP.Also, the use of DHCP to provision a name that will be resolved into
one or many unicast address(es) of the appropriate DOTS server
instance(s) to contact does not suffer from the complications
encountered if a anycast address is used (see Section 3.2.4.1 of ). The use of DHCP ensures a
deterministic behavior.This document makes use of the following terms:DOTS client: A DOTS-aware software module responsible for
requesting attack response coordination with other DOTS-aware
elements.DOTS server: A DOTS-aware software module handling and responding
to messages from DOTS clients. The DOTS server should enable
mitigation on behalf of the DOTS client, if requested, by
communicating the DOTS client's request to the mitigator and
returning selected mitigator feedback to the requesting DOTS client.
A DOTS server may also be a mitigator.DDoS: A distributed Denial-of-Service attack, in which traffic
originating from multiple sources are directed at a target on a
network. DDoS attacks are intended to cause a negative impact on the
availability of servers, services, applications, and/or other
functionality of an attack target.DHCP refers to both DHCPv4 and
DHCPv6 .DHCP client denotes a node that initiates requests to obtain
configuration parameters from one or more DHCP servers.DHCP server refers to a node that responds to requests from DHCP
clients.As reported in Section 1.7.2 of , "few
certification authorities issue server certificates based on IP
addresses, but preliminary evidence indicates that such certificates are
a very small percentage (less than 1%) of issued certificates". In order
to allow for PKIX-based authentication between a DOTS client and server,
this document specifies the DHCP option as a name. One or multiple IP
addresses may be returned as a result of name resolution.Defining the option to include a list of IP addresses would avoid a
dependency on an underlying name resolution, but that design requires to
also supply a name for PKIX-based authentication purposes. Because aliasing is to be avoided (Section 7 of ), this document specifies one single option
that conveys a DOTS server's name.The DHCPv6 DOTS option is used to configure a name of the DOTS
server. The format of this option is shown in .The fields of the option shown in are as follows:Option-code: OPTION_V6_DOTS (TBA, see )Option-length: Length of the dots-server-name field in
octets.dots-server-name: A fully qualified domain name of the DOTS
server. This field is formatted as specified in Section 8 of .An example of the dots-server-name encoding
is shown in . This example conveys the FQDN
"dots.example.com.".Clients MAY request option OPTION_V6_DOTS, as defined in , Sections 17.1.1, 18.1.1, 18.1.3, 18.1.4,
18.1.5, and 22.7. As a convenience to the reader, we mention here that
the client includes requested option codes in the Option Request
Option.If the DHCP client receives more than one OPTION_V6_DOTS option, it
MUST use only the first instance of that option.If the OPTION_V6_DOTS option contains more than one name, as
distinguished by the presence of multiple root labels, the DHCP client
MUST use only the first name. Once the name is validated (Section 8 of
), the name is passed to a name
resolution library.The DHCPv4 DOTS option is used to configure a name of the DOTS
server. The format of this option is illustrated in .The fields of the option shown in
are as follows:Code: OPTION_V4_DOTS (TBA, see );Length: Includes the length of the "DOTS server name" field in
octets; the maximum length is 255 octets.DOTS server name: The domain name of the DOTS server. This
field is formatted as specified in Section 8 of .To discover a DOTS server, the DHCPv4 client MUST include
OPTION_V4_DOTS in a Parameter Request List Option .If the DHCP client receives more than one OPTION_V4_DOTS option, it
MUST use only the first instance of that option.If the OPTION_V4_DOTS option contains more than one name, as
distinguished by the presence of multiple root labels, the DHCP client
MUST use only the first FQDN. Once the name is validated (Section 8 of
), the name is passed to a name
resolution library.The security considerations in and
are to be considered.DOTS-related security considerations are discussed in Section 4 of
.IANA is requested to assign the following new DHCPv6 Option Code in
the registry maintained in
http://www.iana.org/assignments/dhcpv6-parameters:Option NameValueOPTION_V6_DOTSTBAIANA is requested to assign the following new DHCPv4 Option Code in
the registry maintained in
http://www.iana.org/assignments/bootp-dhcp-parameters/:Option NameValueData lengthMeaningOPTION_V4_DOTSTBAVariable; the maximum length is 255 octets.Includes the name of the DOTS server.Many thanks to Tiru Reddy for his comments.