Distributed-Denial-of-Service
Open Threat Signaling (DOTS) Agent DiscoveryOrangeRennes35000Francemohamed.boucadair@orange.comMcAfee, Inc.Embassy Golf Link Business ParkBangaloreKarnataka560071IndiaTirumaleswarReddy_Konda@McAfee.comDOTSAutomationProvisioningConfigurationLocationDeploymentMultihomingDDoSSecurityThis document specifies mechanisms to configure Distributed Denial of
Service Open Threat Signaling (DOTS) clients with their DOTS servers.
The discovery procedure also covers the DOTS Signal Channel Call Home.
Knowing the appropriate DOTS server for a given location can be useful
to engage mitigation actions even in cases where the DOTS client cannot
localize the attack, but only knows that some resources are under attack
and that help is needed.DDoS Open Threat Signaling (DOTS)
specifies an architecture, in which a DOTS client can inform a DOTS
server that the network is under a potential attack and that appropriate
mitigation actions are required. Indeed, because the lack of a common
method to coordinate a real-time response among involved actors and
network domains inhibits the effectiveness of DDoS attack mitigation,
the DOTS signal channel protocol is meant
to carry requests for DDoS attack mitigation. With this approach, DOTS
can reduce the impact of an attack and lead to more efficient defensive
actions in various deployment scenarios such as those discussed in . Moreover, DOTS clients can
instruct a DOTS server to install named filtering rules by means of the
DOTS data channel protocol .The basic high-level DOTS architecture is illustrated in . specifies that the DOTS client may be
provided with a list of DOTS servers, each associated with one or more
IP addresses. These addresses may or may not be of the same address
family. The DOTS client establishes one or more DOTS sessions by
connecting to the provided DOTS server addresses.This document specifies methods for DOTS clients to discover their
DOTS server(s). The rationale for specifying multiple discovery
mechanisms is discussed in .The discovery methods can also be used by a DOTS server to locate a
DOTS client in the context of DOTS Signal Channel Call Home . The basic high-level
DOTS Call Home architecture is illustrated in .A DOTS agent may be used to establish base DOTS channels, DOTS Call
Home, or both. This specification accommodates all these deployment
cases.Considerations for the selection of DOTS server(s) by multi-homed
DOTS clients are out of this document scope; readers should refer to
for more details.This document assumes that security credentials to authenticate DOTS
server(s) are pre-provisioned to a DOTS client using a mechanism such as
(but not limited to) those discussed in
or . DOTS
clients use those credentials for authentication purposes following the
rules documented in .The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP 14
when, and
only when, they appear in all capitals, as shown here.The reader should be familiar with the terms defined in .DHCP refers to both DHCPv4 and DHCPv6
."DOTS client" refers to a DOTS-aware software module responsible for
requesting attack response coordination with other DOTS-aware
elements."DOTS server" is a DOTS-aware software module handling and responding
to messages from DOTS clients. The DOTS server enables mitigation on
behalf of the DOTS client, if requested, by communicating the DOTS
client's request to the mitigator and returning selected mitigator
feedback to the requesting DOTS client."Call Home DOTS client" (or "Call Home DOTS server") refers to a DOTS
client (or DOTS server) deployed in a Call Home scenario ()."DOTS agent" is any DOTS-aware software module capable of
participating in a DOTS channel."Peer DOTS agent" refers to the peer DOTS server (base DOTS
operation) or to a peer Call Home DOTS client (for DOTS Signal Channel
Call Home).Analysis of the various use cases sketched in reveals that it is unlikely
that one single discovery method can be suitable for all the sample
deployments. Concretely:Many of the use cases discussed in do involve a Customer
Premises Equipment (CPE) device. Multiple CPEs, connected to
distinct network providers, may even be considered. It is intuitive
to leverage existing mechanisms such as discovery using service
resolution or DHCP to provision the CPE acting as a DOTS client with
the DOTS server(s).Resolving a DOTS server domain name offered by an upstream
transit provider provisioned to a DOTS client into IP address(es)
requires the use of the appropriate DNS resolvers; otherwise,
resolving those names will fail. The use of protocols such as DHCP
does allow associating provisioned DOTS server domain names with a
list of DNS servers to be used for name resolution. Furthermore,
DHCP allows directly providing IP addresses therefore avoiding the
need for extra lookup delays.Some of the use cases may allow DOTS clients to have direct
communications with upstream DOTS servers, that is, no DOTS gateway
is involved. Leveraging existing protocol behaviors that do not
require specific features on the node embedding the DOTS client may
ease DOTS deployment. Typically, the use of Straightforward-Naming
Authority Pointer (S-NAPTR) lookups
allows the DOTS server administrators to provision the preferred
DOTS transport protocol between the DOTS client and the DOTS server
and allows the DOTS client to discover this preference.The upstream network provider is not the DDoS mitigation provider
for some of these use cases. It is safe to assume that for such
deployments, the DOTS server(s) domain name is provided during the
service subscription (i.e., manual/local configuration).Multiple DOTS clients may be enabled within a network (e.g.,
enterprise network). Dynamic discovery needs to be deterministic
from an operational standpoint.Some of the use cases may involve a DOTS gateway that is
responsible for selecting the appropriate DOTS server(s) to relay
requests received from DOTS clients.Consequently, this document describes a unified discovery logic
() which involves the following
mechanisms:Dynamic discovery using DHCP ().A resolution mechanism based on Straightforward Naming Authority
Pointer (S-NAPTR) resource records in the Domain Name System (DNS)
().DNS Service Discovery ().Operators will need a consistent set of ways in which DOTS clients
can discover this information and a consistent priority among these
options. If some devices prefer manual configuration over dynamic
discovery, while others prefer dynamic discovery over manual
configuration, the result will be a process where the operator must find
devices that are using the wrong DOTS server(s), determine how to ensure
the devices are configured properly, and then reconfigure the device
through the preferred method.All DOTS clients MUST support at least one of the three mechanisms
below to determine a DOTS server list. All DOTS clients SHOULD implement
all three, or as many as are practical for any specific device, of the
following ways to discover DOTS servers in order to facilitate the
deployment of DOTS in large scale environments. For example, a CPE will
support the first two mechanisms, a host within a LAN will support the
last two mechanisms, or an application server will support a local
configuration. More examples are discussed in . DOTS clients will prefer information
received from the discovery methods in the order listed below.Explicit configuration:Local/Manual configuration: A DOTS client will learn the DOTS
server(s) by means of local or manual DOTS configuration (i.e.,
DOTS servers configured at the system level). Configuration
discovered from a DOTS client application is considered as local
configuration.An implementation may
give the user an opportunity (e.g., by means of configuration
file options or menu items) to specify DOTS server(s) for each
address family. These may be specified either as a list of IP
addresses or the DNS name of a DOTS server. When only DOTS
server IP addresses are configured, a reference identifier must
also be configured for authentication purposes.Automatic configuration (e.g., DHCP): The DOTS client
attempts to discover DOTS server(s) names and/or addresses from
DHCP, as described in .Service Resolution : The DOTS client attempts to discover DOTS
server name(s) using service resolution, as specified in .DNS SD: DNS Service Discovery. The DOTS client attempts to
discover DOTS server name(s) using DNS service discovery, as
specified in .Some of these mechanisms imply the use of DNS to resolve the IP
address(es) of the DOTS server, while others imply an IP address of the
relevant DOTS server is obtained directly. Implementation options may
vary on a per device basis, as some devices may not have DNS
capabilities and/or suitable DNS configuration.On hosts with more than one interface or address family (IPv4/IPv6),
the DOTS server discovery procedure has to be performed for each
interface/address-family combination. A DOTS client may choose to
perform the discovery procedure only for a desired interface/address
combination if the client does not wish to discover a DOTS server for
all interface/address-family combinations.This procedure is also followed by a Call Home DOTS server to
discover its Call Home DOTS client in the context of .The discovery method is performed upon bootstrapping of a DOTS agent,
and is reiterated by the DOTS agent upon the following events:Expiry of a validity timer (e.g., DHCP lease, DHCP information
refresh time, DNS TTL) associated with a discovered DOTS agent.Expiry of the certificate of a peer DOTS agent currently in
use.Attachment to a new network.As reported in Section 1.7.2 of :"Some certification authorities issue server certificates based
on IP addresses, but preliminary evidence indicates that such
certificates are a very small percentage (less than 1%) of issued
certificates".In order to allow for PKIX-based authentication between a DOTS client
and server while accommodating the current best practices for issuing
certificates, this document allows DOTS agents to retrieve the names of
their peer DOTS agents. These names can be used for two purposes: to
retrieve the list of IP addresses of a peer DOTS agent or to be
presented as a reference identifier for authentication purposes.Defining the option to include a list of IP addresses would avoid a
dependency on an underlying name resolution, but that design requires
also supplying a name for PKIX-based authentication purposes.Given that DOTS gateways can be involved in a DOTS session, a peer
DOTS agent can be reachable using a link-local address. Such addresses
can also be discovered using the options defined in .The list of the IP addresses returned by DHCP servers is typically
used to feed the DOTS server selection procedure including when DOTS
agents are provided with primary and backup IP addresses of their peer
DOTS agents. An example of DOTS server selection procedure is specified
in Section 4.3 of .The design assumes that the same peer DOTS agent is used for
establishing both signal and data channels. For more customized
configurations (e.g., transport-specific configuration, distinct DOTS
servers for the signal and the data channels), an operator can supply
only a DOTS reference identifier that will be then passed to the
procedure described in .The design allows terminating the base DOTS channels and DOTS Call
Home on the same or distinct peer DOTS agents. If distinct peer DOTS
agents are deployed, the DHCP option can return, for example, a list of
IP addresses to a requesting DOTS agent. This list includes the IP
address to be used for the base DOTS channels and the IP address for the
DOTS Call Home. The DOTS client (or Call Home DOTS server) will then use
the address selection procedure specified in Section 4.3 of to identify the IP address of the peer DOTS
server (or Call Home DOTS client). For example: Let's consider that the DOTS server is reachable at
2001:db8:122:300::1 while the Call Home DOTS client is reachable at
2001:db8:122:300::2. The DHCP server will then return one DOTS
reference identifier and a list that includes both
2001:db8:122:300::1 and 2001:db8:122:300::2 to a requesting DHCP
client. That list is passed to the DOTS client (or Call Home DOTS
server) which will try to establish connections to the addresses of
that list and destination port number 4646 (or the Call Home port
number). As a result, the DOTS client (or Call Home DOTS server)
will select 2001:db8:122:300::1 (or 2001:db8:122:300::2) as a DOTS
server (or Call Home DOTS client).The DHCPv6 DOTS Reference Identifier option is used to configure
a name of the DOTS server (or the name of the Call Home DOTS
client). The format of this option is shown in .The fields of the option shown in are as follows:Option-code: OPTION_V6_DOTS_RI (TBA1, see )Option-length: Length of the dots-agent-name field in
octets.dots-agent-name: A fully qualified domain name of the peer
DOTS agent. This field is formatted as specified in Section 10
of .An example of the dots-agent-name
encoding is shown in . This example
conveys the FQDN "dots.example.com.”, and the resulting
Option-length field is 18.The DHCPv6 DOTS Address option can be used to configure a list of
IPv6 addresses of a DOTS server (or a Call Home DOTS client). The
format of this option is shown in .The fields of the option shown in are as follows:Option-code: OPTION_V6_DOTS_ADDRESS (TBA2, see )Option-length: Length of the 'DOTS ipv6-address(es)' field in
octets. MUST be a multiple of 16.DOTS ipv6-address(es): Includes one or more IPv6 addresses
of the peer DOTS agent to be used
by a DOTS agent for establishing a DOTS session. The addresses
are listed in the order of preference for use by the DOTS
agent.Note, IPv4-mapped IPv6 addresses
(Section 2.5.5.2 of ) may be
included in this option when there is no DHCPv4 server able to
advertise the DHCPv4 DOTS options () and when only IPv4 connectivity is
possible to the peer DOTS agent.DHCP clients MAY request options OPTION_V6_DOTS_RI and
OPTION_V6_DOTS_ADDRESS, as defined in , Sections 18.2.1, 18.2.2, 18.2.4, 18.2.5,
18.2.6, and 21.7. As a convenience to the reader, it is mentioned
here that the DHCP client includes the requested option codes in the
Option Request Option.If the DHCP client receives more than one instance of
OPTION_V6_DOTS_RI (or OPTION_V6_DOTS_ADDRESS) option, it MUST use
only the first instance of that option.The DHCP client MUST silently discard multicast and host loopback
addresses conveyed in
OPTION_V6_DOTS_ADDRESS.If the DHCP client receives and validates both OPTION_V6_DOTS_RI
and OPTION_V6_DOTS_ADDRESS, the content of OPTION_V6_DOTS_RI is used
as the reference identifier for authentication purposes (e.g., PKIX
), while the valid addresses included
in OPTION_V6_DOTS_ADDRESS are used to reach the peer DOTS agent. In
other words, the name conveyed in OPTION_V6_DOTS_RI MUST NOT be
passed to an underlying resolution library in the presence of valid
OPTION_V6_DOTS_ADDRESS in a response.If the DHCP client receives OPTION_V6_DOTS_RI only, but
OPTION_V6_DOTS_RI contains more than one name, the DHCP client MUST
use only the first name. Once the name is validated (Section 10 of
), the name is passed to a name
resolution library. Moreover, that name is also used as a reference
identifier for authentication purposes.If the DHCP client receives OPTION_V6_DOTS_ADDRESS only, the
address(es) included in OPTION_V6_DOTS_ADDRESS are used to reach the
peer DOTS agent. In addition, these addresses can be used as
identifiers for authentication.The DHCPv4 DOTS Reference
Identifier option is used to configure a name of the peer DOTS
agent. The format of this option is illustrated in .The fields of the option shown in are as follows:Code: OPTION_V4_DOTS_RI (TBA3, see ).Length: Includes the length of the "Peer DOTS agent name"
field in octets.Peer DOTS agent name: The domain name of the peer DOTS agent.
This field is formatted as specified in Section 10 of .The DHCPv4 DOTS Address option can be used to configure a list of
IPv4 addresses of a peer DOTS agent. The format of this option is
illustrated in .The fields of the option shown in are as follows:Code: OPTION_V4_DOTS_ADDRESS (TBA4, see ).Length: is set to 4*N, where N is the number of IPv4
addresses included in the option.DOTS IPv4 Address(es): Contains one or more IPv4 addresses of
the peer DOTS agent to be used by a DOTS agent. The addresses
are listed in the order of preference for use by the DOTS
agent.OPTION_V4_DOTS_ADDRESS is a
concatenation-requiring option. As such, the mechanism specified in
MUST be used if
OPTION_V4_DOTS_ADDRESS exceeds the maximum DHCPv4 option size of 255
octets.To discover a peer DOTS agent, the DHCPv4 client MUST include
both OPTION_V4_DOTS_RI and OPTION_V4_DOTS_ADDRESS in a Parameter
Request List Option .If the DHCP client receives more than one instance of
OPTION_V4_DOTS_RI option, it MUST use only the first instance of
that option.The DHCP client MUST silently discard multicast and host loopback
addresses conveyed in
OPTION_V4_DOTS_ADDRESS.If the DHCP client receives and validates both OPTION_V4_DOTS_RI
and OPTION_V4_DOTS_ADDRESS, the content of OPTION_V4_DOTS_RI is used
as the reference identifier for authentication purposes (e.g., PKIX
), while the valid addresses included
in OPTION_V4_DOTS_ADDRESS are used to reach the peer DOTS agent. In
other words, the name conveyed in OPTION_V4_DOTS_RI MUST NOT be
passed to underlying resolution library in the presence of valid
OPTION_V4_DOTS_ADDRESS in a response.If the DHCP client receives OPTION_V4_DOTS_RI only, but
OPTION_V4_DOTS_RI option contains more than one name, as
distinguished by the presence of multiple root labels, the DHCP
client MUST use only the first name. Once the name is validated
(Section 10 of ), the name is passed
to a name resolution library. Moreover, that name is also used as a
reference identifier for authentication purposes.If the DHCP client receives OPTION_V4_DOTS_ADDRESS only, the
address(es) included in OPTION_V4_DOTS_ADDRESS are used to reach the
peer DOTS server. In addition, these addresses can be used as
identifiers for authentication.This mechanism is performed in two steps:A DNS domain name is retrieved for each combination of interface
and address family. A DOTS agent has to determine the domain in
which it is located relying on dynamic means such as DHCP (). Implementations may allow the user to
specify a default name that is used, if no specific name has been
configured.Retrieved DNS domain names are then used for S-NAPTR lookups
. Further DNS lookups may be necessary
to determine the peer DOTS agent IP address(es).Once the DOTS agent has retrieved its DNS domain or discovered the
peer DOTS agent name that needs to be resolved, an S-NAPTR lookup with
the appropriate application service and the desired protocol tag is made
to obtain information necessary to connect to the authoritative peer
DOTS agent within the given domain.This specification defines 'DOTS' and 'DOTS-CALL-HOME' as application
service tags (Sections
and ). It also defines
"signal.udp" (), "signal.tcp" (), and "data.tcp" ()
as application protocol tags. An example is provided in .In the example below, for domain 'example.net', the resolution
algorithm will result in IP address(es), port, tag, and protocol tuples
listed in Table 1.An example is provided in for the
Call Home case. In this example, the resolution algorithm will result in
IP address(es), port, and protocol listed in Table 2 for domain
'example.net'.Note that customized port numbers are used for the DOTS signal
channel, DOTS data channel, and DOTS signal channel call home in the
examples shown in Figures
and for illustration
purposes. If default port numbers are used in a deployment, the
discovery procedure will return 4646 (DOTS signal channel) and 443 (DOTS
data channel) as DOTS service port numbers.If no DOTS-specific S-NAPTR records can be retrieved, the discovery
procedure fails for this domain name (and the corresponding interface
and IP protocol version). If more domain names are known, the discovery
procedure MAY perform the corresponding S-NAPTR lookups immediately.
However, before retrying a lookup that has failed, a DOTS client MUST
wait a time period that is appropriate for the encountered error (e.g.,
NXDOMAIN, timeout, etc.).DNS-based Service Discovery (DNS-SD)
provides generic solutions for discovering services. DNS-SD defines a
set of naming rules for certain DNS record types that they use for
advertising and discovering services.Section 4.1 of specifies that a
service instance name in DNS-SD has the following structure:The <Domain> portion specifies the DNS sub-domain where the
service instance is registered. It is a conventional domain name such as
"example.com.".The <Service> portion of the DOTS service instance name MUST be
"_dots-signal._udp" or "_dots-signal._tcp" or "_dots-data._tcp" or
"_dots-call-home._udp" or "_dots-call-home._tcp".This document does not define any keys; the TXT record of a DNS-SD
service is thus empty (Section 6 of ). depicts an excerpt of the DNS zone
configuration file listing record examples to discover two DOTS signal
channel servers. In this example, only UDP is supported as transport for
the establishment of the DOTS signal channel.DOTS-related security considerations are discussed in Section 4 of
. As a reminder, DOTS agents must
authenticate each other using (D)TLS before a DOTS session is considered
valid according to the .An attacker may block some protocol messages (e.g., DHCP) to force
the client to use a discovery mechanism with a lower priority. The
security implications of such attack are those inherent to the fallback
discovery mechanism discussed in the following subsections.The results of the discovery procedure are a function of the
interface/address family. Contacting a discovered DOTS server via an
interface to which it is not bound may exacerbate the delay required to
establish a DOTS channel. Moreover, such behavior may reveal that a DOTS
service is enabled by a DOTS client domain and exposes the identity of
the DOTS service provider (that can be inferred from the name and the
destination IP address) to external networks.Security considerations related to how security credentials to
authenticate DOTS server(s) are provisioned to a DOTS client are those
inherent to the mechanism used for that purpose (see for example, ).The security considerations in and
are to be considered. In particular,
issues related to rogue DHCP servers and means to mitigate many of
these attacks are discussed in Section 22 of .An attacker can get a domain name, domain-validated public
certificate from a CA, and host a DOTS agent. An active attacker can
then spoof DHCP responses to include the attacker's DOTS agent. Such
an attacker can also launch other attacks as discussed in Section 22
of . In addition to the mitigations
listed in Section 22 of , a DOTS agent
may be pre-configured with a list of trusted DOTS domain names. If
such a list is pre-configured, a DOTS agent will accept a
DHCP-discovered name if it matches a name in that list. Also, the DOTS
agent has to check that the 'DNS-ID' identifier type within
subjectAltName in the server certificate matches a pre-configured
name. If the DOTS agent is instructed to trust subdomains of the names
in that list as well (e.g., "*.example.com"), a DOTS agent will accept
a DHCP-discovered name that matches a name in the pre-configured list
(e.g., "dots-1.example.com" or "dots-2.example.com").Relying on an underlying resolution library to resolve a supplied
reference identifier has similar security issues as those discussed in
(e.g., an active attacker may modify DNS
messages used to resolve the supplied reference identifier and point
the client to an attacker server).Supplying both an IP address and the reference identifier makes it
easier to use a mis-issued certificate.The primary attack against the methods described in is one that would lead to impersonation of a
peer DOTS agent. An attacker could attempt to compromise the S-NAPTR
resolution.The DOTS client (or a Call Home DOTS server) constructs one
reference identifier for the DOTS server (or a Call Home DOTS client)
based on the domain name which is used for S-NAPTR lookup: DNS-ID. If
the reference identifier is found (as described in Section 6 of ) in the PKIX certificate's subjectAltName
extension, the DOTS client should accept the certificate for the
server.DNS Security Extensions (DNSSEC)
uses cryptographic keys and digital signatures to provide
authentication of DNS data. The information that is retrieved from the
S-NAPTR lookup and that is validated using DNSSEC is thereby proved to
be the authoritative data.Since DNS-SD is a specification for how to name and use records in
the existing DNS system, it has no specific additional security
requirements over and above those that already apply to DNS queries
and DNS updates. For DNS queries, DNSSEC SHOULD be used where the
authenticity of information is important. For DNS updates, secure
updates
SHOULD generally be used to control which clients have permission to
update DNS records.Note that means such as DNS over TLS (DoT) or DNS over HTTPS (DoH) can be used to prevent eavesdroppers from
accessing DNS messages.IANA is requested to allocate the following service names from the
registry available at:
https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml.IANA is requested to update the following entry from the registry
available at:
https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml.IANA is requested to assign the following new DHCPv6 Option Codes
in the registry maintained in:
https://www.iana.org/assignments/dhcpv6-parameters/dhcpv6-parameters.xhtml#dhcpv6-parameters-2.IANA is requested to assign the following new DHCPv4 Option Codes
in the registry maintained in:
https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml#options.NameTagData LengthMeaningReferenceOPTION_V4_DOTS_RITBA3NThe name of the peer DOTS agent.[ThisDocument]OPTION_V4_DOTS_ADDRESSTBA4N (the minimal length is 4)N/4 IPv4 addresses of peer DOTS agent(s).[ThisDocument]This document requests IANA to make the following allocations from
the registries available at:
https://www.iana.org/assignments/s-naptr-parameters/s-naptr-parameters.xhtml#s-naptr-parameters-1
for Application Service Tags and
https://www.iana.org/assignments/s-naptr-parameters/s-naptr-parameters.xhtml#s-naptr-parameters-2
for Application Protocol Tags.Application Service Tag: DOTSIntended Usage: See Security Considerations: See Interoperability considerations: NoneRelevant publications: This documentApplication Service Tag: DOTS-CALL-HOMEIntended Usage: See Security Considerations: See Interoperability considerations: NoneRelevant publications: This documentApplication Protocol Tag: signal.udpIntended Usage: See Security Considerations: See Interoperability considerations: NoneRelevant publications: This documentApplication Protocol Tag: signal.tcpIntended Usage: See Security Considerations: See Interoperability considerations: NoneRelevant publications: This documentApplication Protocol Tag: data.tcpIntended Usage: See Security Considerations: See Interoperability considerations: NoneRelevant publications: This documentThanks to Brian Carpenter for the review of the BRSKI text used be in
previous versions of the specification.Many thanks to Russ White for the review, comments, and text
contribution.Thanks to Dan Wing, Pei Wei, Valery Smyslov, and Jon Shallow for the
review and comments.Thanks to Bernie Volz for the review of the DHCP section.Many thanks to Benjamin Kaduk for the detailed AD review.Thanks to Zhen Cao, Kyle Rose, Nagendra Nainar, and Peter Yee for the
directorate reviews.Thanks to Barry Leiba, Martin Duke, Roman Danyliw, Eric Vyncke, and
Magnus Westerlund for the IESG review.