Internet DRAFT - draft-boucadair-dots-dhcp

draft-boucadair-dots-dhcp







Network Working Group                                       M. Boucadair
Internet-Draft                                                    Orange
Intended status: Standards Track                          April 12, 2017
Expires: October 14, 2017


  DHCP Options for Distributed-Denial-of-Service Open Threat Signaling
                                 (DOTS)
                      draft-boucadair-dots-dhcp-01

Abstract

   It may not be possible for a network to determine the cause for an
   attack, but instead just realize that some resources seem to be under
   attack.  To fill that gap, Distributed-Denial-of-Service Open Threat
   Signaling (DOTS) allows a network to inform a server that it is under
   a potential attack so that appropriate mitigation actions are
   undertaken.

   This document specifies DHCP (IPv4 and IPv6) options to configure
   hosts with DOTS servers.

Requirements Language

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [RFC2119].

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on October 14, 2017.







Boucadair               Expires October 14, 2017                [Page 1]

Internet-Draft               DHCP for MPTCP                   April 2017


Copyright Notice

   Copyright (c) 2017 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  Design Rationale  . . . . . . . . . . . . . . . . . . . . . .   4
   4.  DHCPv6 DOTS Option  . . . . . . . . . . . . . . . . . . . . .   4
     4.1.  Format  . . . . . . . . . . . . . . . . . . . . . . . . .   4
     4.2.  DHCPv6 Client Behavior  . . . . . . . . . . . . . . . . .   5
   5.  DHCPv4 DOTS Option  . . . . . . . . . . . . . . . . . . . . .   6
     5.1.  Format  . . . . . . . . . . . . . . . . . . . . . . . . .   6
     5.2.  DHCPv4 Client Behavior  . . . . . . . . . . . . . . . . .   6
   6.  Security Considerations . . . . . . . . . . . . . . . . . . .   6
   7.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   7
     7.1.  DHCPv6 Option . . . . . . . . . . . . . . . . . . . . . .   7
     7.2.  DHCPv4 Option . . . . . . . . . . . . . . . . . . . . . .   7
   8.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .   7
   9.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   7
     9.1.  Normative References  . . . . . . . . . . . . . . . . . .   7
     9.2.  Informative References  . . . . . . . . . . . . . . . . .   8
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   8

1.  Introduction

   In many deployments, it may not be possible for a network to
   determine the cause for a distributed Denial-of-Service (DoS) attack
   [RFC4732], but instead just realize that some resources seem to be
   under attack.  To fill that gap, the IETF is specifying an
   architecture, called DDoS Open Threat Signaling (DOTS)
   [I-D.ietf-dots-architecture], in which a DOTS client can inform a
   DOTS server that the network is under a potential attack and that
   appropriate mitigation actions are required.  Indeed, because the
   lack of a common method to coordinate a real-time response among
   involved actors and network domains inhibits the effectiveness of



Boucadair               Expires October 14, 2017                [Page 2]

Internet-Draft               DHCP for MPTCP                   April 2017


   DDoS attack mitigation, DOTS protocol is meant to carry requests for
   DDoS attack mitigation, thereby reducing the impact of an attack and
   leading to more efficient defensive actions.
   [I-D.ietf-dots-use-cases] identifies a set of scenarios for DOTS;
   almost all these scenarios involve a CPE.

   The basic high-level DOTS architecture is illustrated in Figure 1
   ([I-D.ietf-dots-architecture]):

          +-----------+            +-------------+
          | Mitigator | ~~~~~~~~~~ | DOTS Server |
          +-----------+            +-------------+
                                          |
                                          |
                                          |
          +---------------+        +-------------+
          | Attack Target | ~~~~~~ | DOTS Client |
          +---------------+        +-------------+

                     Figure 1: Basic DOTS Architecture

   [I-D.ietf-dots-architecture] specifies that the DOTS client may be
   provided with a list of DOTS servers; each associated with one or
   more IP addresses.  These addresses may or may not be of the same
   address family.  The DOTS client establishes one or more signaling
   sessions by connecting to the provided DOTS server addresses.

   To that aim, this document defines DHCPv4 [RFC2131] and DHCPv6
   [RFC3315] options that can be used to configure hosts, embedding a
   DOTS client, with DOTS servers' names.  These names will be resolved
   into one or a list of IP addresses.

   The use of DHCP for DOTS provisioning is justified because many of
   the target use cases identified in [I-D.ietf-dots-use-cases] involve
   CPEs; these devices widely support DHCP.

   Also, the use of DHCP to provision a name that will be resolved into
   one or many unicast address(es) of the appropriate DOTS server
   instance(s) to contact does not suffer from the complications
   encountered if a anycast address is used (see Section 3.2.4.1 of
   [I-D.ietf-dots-architecture]).  The use of DHCP ensures a
   deterministic behavior.

2.  Terminology

   This document makes use of the following terms:





Boucadair               Expires October 14, 2017                [Page 3]

Internet-Draft               DHCP for MPTCP                   April 2017


   o  DOTS client: A DOTS-aware software module responsible for
      requesting attack response coordination with other DOTS-aware
      elements.
   o  DOTS server: A DOTS-aware software module handling and responding
      to messages from DOTS clients.  The DOTS server should enable
      mitigation on behalf of the DOTS client, if requested, by
      communicating the DOTS client's request to the mitigator and
      returning selected mitigator feedback to the requesting DOTS
      client.  A DOTS server may also be a mitigator.
   o  DDoS: A distributed Denial-of-Service attack, in which traffic
      originating from multiple sources are directed at a target on a
      network.  DDoS attacks are intended to cause a negative impact on
      the availability of servers, services, applications, and/or other
      functionality of an attack target.
   o  DHCP refers to both DHCPv4 [RFC2131] and DHCPv6 [RFC3315].
   o  DHCP client denotes a node that initiates requests to obtain
      configuration parameters from one or more DHCP servers.
   o  DHCP server refers to a node that responds to requests from DHCP
      clients.

3.  Design Rationale

   As reported in Section 1.7.2 of [RFC6125], "few certification
   authorities issue server certificates based on IP addresses, but
   preliminary evidence indicates that such certificates are a very
   small percentage (less than 1%) of issued certificates".  In order to
   allow for PKIX-based authentication between a DOTS client and server,
   this document specifies the DHCP option as a name.  One or multiple
   IP addresses may be returned as a result of name resolution.

   Defining the option to include a list of IP addresses would avoid a
   dependency on an underlying name resolution, but that design requires
   to also supply a name for PKIX-based authentication purposes.

   Because aliasing is to be avoided (Section 7 of [RFC7227]), this
   document specifies one single option that conveys a DOTS server's
   name.

4.  DHCPv6 DOTS Option

4.1.  Format

   The DHCPv6 DOTS option is used to configure a name of the DOTS
   server.  The format of this option is shown in Figure 2.







Boucadair               Expires October 14, 2017                [Page 4]

Internet-Draft               DHCP for MPTCP                   April 2017


       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |     OPTION_V6_DOTS            |         Option-length         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      |                      dots-server-name (FQDN)                  |
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


                       Figure 2: DHCPv6 DOTS option

   The fields of the option shown in Figure 2 are as follows:

   o  Option-code: OPTION_V6_DOTS (TBA, see Section 7.1)
   o  Option-length: Length of the dots-server-name field in octets.
   o  dots-server-name: A fully qualified domain name of the DOTS
      server.  This field is formatted as specified in Section 8 of
      [RFC3315].

   An example of the dots-server-name encoding is shown in Figure 3.
   This example conveys the FQDN "dots.example.com.".

        +------+------+------+------+------+------+------+------+------+
        | 0x04 |   d  |   o  |   t  |  s   | 0x07 |   e  |   x  |   a  |
        +------+------+------+------+------+------+------+------+------+
        |   m  |   p  |   l  |   e  | 0x03 |   c  |   o  |   m  | 0x00 |
        +------+------+------+------+------+------+------+------+------+

                           Figure 3: An example

4.2.  DHCPv6 Client Behavior

   Clients MAY request option OPTION_V6_DOTS, as defined in [RFC3315],
   Sections 17.1.1, 18.1.1, 18.1.3, 18.1.4, 18.1.5, and 22.7.  As a
   convenience to the reader, we mention here that the client includes
   requested option codes in the Option Request Option.

   If the DHCP client receives more than one OPTION_V6_DOTS option, it
   MUST use only the first instance of that option.

   If the OPTION_V6_DOTS option contains more than one name, as
   distinguished by the presence of multiple root labels, the DHCP
   client MUST use only the first name.  Once the name is validated
   (Section 8 of [RFC3315]), the name is passed to a name resolution
   library.





Boucadair               Expires October 14, 2017                [Page 5]

Internet-Draft               DHCP for MPTCP                   April 2017


5.  DHCPv4 DOTS Option

5.1.  Format

   The DHCPv4 DOTS option is used to configure a name of the DOTS
   server.  The format of this option is illustrated in Figure 4.

            Code  Length   DOTS server name
           +-----+-----+-----+-----+-----+-----+-----+--
           | TBA |  n  |  s1 |  s2 |  s3 |  s4 | s5  |  ...
           +-----+-----+-----+-----+-----+-----+-----+--

     The values s1, s2, s3, etc. represent the domain name labels in the
     domain name encoding.


                       Figure 4: DHCPv4 DOTS option

   The fields of the option shown in Figure 4 are as follows:

   o  Code: OPTION_V4_DOTS (TBA, see Section 7.2);
   o  Length: Includes the length of the "DOTS server name" field in
      octets; the maximum length is 255 octets.
   o  DOTS server name: The domain name of the DOTS server.  This field
      is formatted as specified in Section 8 of [RFC3315].

5.2.  DHCPv4 Client Behavior

   To discover a DOTS server, the DHCPv4 client MUST include
   OPTION_V4_DOTS in a Parameter Request List Option [RFC2132].

   If the DHCP client receives more than one OPTION_V4_DOTS option, it
   MUST use only the first instance of that option.

   If the OPTION_V4_DOTS option contains more than one name, as
   distinguished by the presence of multiple root labels, the DHCP
   client MUST use only the first FQDN.  Once the name is validated
   (Section 8 of [RFC3315]), the name is passed to a name resolution
   library.

6.  Security Considerations

   The security considerations in [RFC2131] and [RFC3315] are to be
   considered.

   DOTS-related security considerations are discussed in Section 4 of
   [I-D.ietf-dots-architecture].




Boucadair               Expires October 14, 2017                [Page 6]

Internet-Draft               DHCP for MPTCP                   April 2017


7.  IANA Considerations

7.1.  DHCPv6 Option

   IANA is requested to assign the following new DHCPv6 Option Code in
   the registry maintained in http://www.iana.org/assignments/
   dhcpv6-parameters:

                              Option Name Value
                           -------------- -----
                           OPTION_V6_DOTS TBA

7.2.  DHCPv4 Option

   IANA is requested to assign the following new DHCPv4 Option Code in
   the registry maintained in http://www.iana.org/assignments/bootp-
   dhcp-parameters/:

      Option Name Value Data length               Meaning
   -------------- ----- ------------------------- ----------------------
   OPTION_V4_DOTS TBA   Variable; the maximum     Includes the name of
                        length is 255 octets.     the DOTS server.

8.  Acknowledgements

   Many thanks to Tiru Reddy for his comments.

9.  References

9.1.  Normative References

   [I-D.ietf-dots-architecture]
              Mortensen, A., Andreasen, F., Reddy, T.,
              christopher_gray3@cable.comcast.com, c., Compton, R., and
              N. Teague, "Distributed-Denial-of-Service Open Threat
              Signaling (DOTS) Architecture", draft-ietf-dots-
              architecture-01 (work in progress), October 2016.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <http://www.rfc-editor.org/info/rfc2119>.

   [RFC2131]  Droms, R., "Dynamic Host Configuration Protocol",
              RFC 2131, DOI 10.17487/RFC2131, March 1997,
              <http://www.rfc-editor.org/info/rfc2131>.





Boucadair               Expires October 14, 2017                [Page 7]

Internet-Draft               DHCP for MPTCP                   April 2017


   [RFC2132]  Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor
              Extensions", RFC 2132, DOI 10.17487/RFC2132, March 1997,
              <http://www.rfc-editor.org/info/rfc2132>.

   [RFC3315]  Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins,
              C., and M. Carney, "Dynamic Host Configuration Protocol
              for IPv6 (DHCPv6)", RFC 3315, DOI 10.17487/RFC3315, July
              2003, <http://www.rfc-editor.org/info/rfc3315>.

9.2.  Informative References

   [I-D.ietf-dots-use-cases]
              Dobbins, R., Fouant, S., Migault, D., Moskowitz, R.,
              Teague, N., Xia, L., and K. Nishizuka, "Use cases for DDoS
              Open Threat Signaling", draft-ietf-dots-use-cases-04 (work
              in progress), March 2017.

   [RFC4732]  Handley, M., Ed., Rescorla, E., Ed., and IAB, "Internet
              Denial-of-Service Considerations", RFC 4732,
              DOI 10.17487/RFC4732, December 2006,
              <http://www.rfc-editor.org/info/rfc4732>.

   [RFC6125]  Saint-Andre, P. and J. Hodges, "Representation and
              Verification of Domain-Based Application Service Identity
              within Internet Public Key Infrastructure Using X.509
              (PKIX) Certificates in the Context of Transport Layer
              Security (TLS)", RFC 6125, DOI 10.17487/RFC6125, March
              2011, <http://www.rfc-editor.org/info/rfc6125>.

   [RFC7227]  Hankins, D., Mrugalski, T., Siodelski, M., Jiang, S., and
              S. Krishnan, "Guidelines for Creating New DHCPv6 Options",
              BCP 187, RFC 7227, DOI 10.17487/RFC7227, May 2014,
              <http://www.rfc-editor.org/info/rfc7227>.

Author's Address

   Mohamed Boucadair
   Orange
   Rennes  35000
   France

   Email: mohamed.boucadair@orange.com









Boucadair               Expires October 14, 2017                [Page 8]