Distributed Denial-of-Service Open
Threat Signaling (DOTS) Signal ChannelMcAfee, Inc.Embassy Golf Link Business ParkBangaloreKarnataka560071Indiakondtir@gmail.comOrangeRennes35000Francemohamed.boucadair@orange.comCisco Systems, Inc.praspati@cisco.comArbor Networks, Inc.2727 S. State StAnn Arbor, MI48104United Statesamortensen@arbor.netVerisign, Inc.United Statesnteague@verisign.comDOTSsecuritymitigationservice deliveryconnectivityanti-DDoSautomationcooperationThis document specifies the DOTS signal channel, a protocol for
signaling the need for protection against Distributed Denial-of-Service
(DDoS) attacks to a server capable of enabling network traffic
mitigation on behalf of the requesting client.A companion document defines the DOTS data channel, a separate
reliable communication layer for DOTS management and configuration.Please update these statements with the RFC number to be assigned to
this document:"This version of this YANG module is part of RFC XXXX;""RFC XXXX: Distributed Denial-of-Service Open Threat Signaling
(DOTS) Signal Channel";"| 3.00 | Alternate server | [RFCXXXX] |"reference: RFC XXXXA distributed denial-of-service (DDoS) attack is an attempt to make
machines or network resources unavailable to their intended users. In
most cases, sufficient scale can be achieved by compromising enough
end-hosts and using those infected hosts to perpetrate and amplify the
attack. The victim in this attack can be an application server, a host,
a router, a firewall, or an entire network.Network applications have finite resources like CPU cycles, number of
processes or threads they can create and use, maximum number of
simultaneous connections it can handle, limited resources of the control
plane, etc. When processing network traffic, such applications are
supposed to use these resources to offer the intended task in the most
efficient fashion. However, a DDoS attacker may be able to prevent an
application from performing its intended task by causing the application
to exhaust the finite supply of a specific resource.TCP DDoS SYN-flood, for example, is a memory-exhaustion attack on the
victim and ACK-flood is a CPU exhaustion attack on the victim . Attacks on the link are carried out by sending
enough traffic such that the link becomes excessively congested, and
legitimate traffic suffers high packet loss. Stateful firewalls can also
be attacked by sending traffic that causes the firewall to hold
excessive state. The firewall then runs out of memory, and can no longer
instantiate the state required to pass legitimate flows. Other possible
DDoS attacks are discussed in .In many cases, it may not be possible for network administrators to
determine the causes of an attack, but instead just realize that certain
resources seem to be under attack. This document defines a lightweight
protocol permitting a DOTS client to request mitigation from one or more
DOTS servers for protection against detected, suspected, or anticipated
attacks. This protocol enables cooperation between DOTS agents to permit
a highly-automated network defense that is robust, reliable and
secure.An example of network diagram showing a deployment of DOTS agents is
shown in . In this example, the DOTS server
is operating on the access network.The DOTS server can also be running on the Internet, as depicted in
.In typical deployments, the DOTS client belongs to a
different administrative domain than the DOTS server. For example, the
DOTS client is a firewall protecting services owned and operated by an
domain, while the DOTS server is owned and operated by a different
domain providing DDoS mitigation services. That domain providing DDoS
mitigation service might, or might not, also provide Internet access
service to the website operator.The DOTS server may (not) be co-located with the DOTS mitigator. In
typical deployments, the DOTS server belongs to the same administrative
domain as the mitigator. The DOTS client can communicate directly with
the DOTS server or indirectly via a DOTS gateway.The document adheres to the DOTS architecture . The requirements for DOTS
signal channel protocol are obtained from . This document satisfies all
the use cases discussed in .This document focuses on the DOTS signal channel. This is a companion
document to the DOTS data channel specification that defines a configuration
and bulk data exchange mechanism supporting the DOTS signal channel.The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in .(D)TLS: For brevity this term is used for statements that apply to
both Transport Layer Security and
Datagram Transport Layer Security .
Specific terms will be used for any statement that applies to either
protocol alone.The reader should be familiar with the terms defined in .The meaning of the symbols in YANG tree diagrams is defined in .The DOTS signal channel is built on top of the Constrained
Application Protocol (CoAP) , a
lightweight protocol originally designed for constrained devices and
networks. CoAP’s expectation of packet loss, support for
asynchronous non-confirmable messaging, congestion control, small
message overhead limiting the need for fragmentation, use of minimal
resources, and support for (D)TLS make it a good foundation on which to
build the DOTS signaling mechanism.The DOTS signal channel is layered on existing standards ().By default, DOTS signal channel MUST run over port number TBD as
defined in , for both UDP and TCP, unless the
DOTS server has mutual agreement with its DOTS clients to use a port
other than TBD for DOTS signal channel, or DOTS clients supports means
to dynamically discover the ports used by their DOTS servers. In order
to use a distinct port number (vs. TBD), DOTS clients and servers should
support a configurable parameter to supply the port number to use.The signal channel is initiated by the DOTS client (). Once the signal channel is established, the
DOTS agents periodically send heartbeats to keep the channel active
(). At any time, the DOTS client may send a
mitigation request message to a DOTS server over the active channel.
While mitigation is active, due to the higher likelihood of packet loss
during a DDoS attack, the DOTS server periodically sends status messages
to the client, including basic mitigation feedback details. Mitigation
remains active until the DOTS client explicitly terminates mitigation,
or the mitigation lifetime expires.DOTS signaling can happen with DTLS
over UDP and TLS over TCP. Likewise,
requests may be sent using IPv4 or IPv6 transfer capabilities. A Happy
Eyeballs procedure for DOTS signal channel is specified in .Messages exchanged between DOTS clients and servers are serialized
using Concise Binary Object Representation (CBOR) , CBOR is a binary encoding designed for small
code and message size. CBOR encoded payloads are used to convey signal
channel specific payload messages that convey request parameters and
response information such as errors. This specification uses the
encoding rules defined in
for representing mitigation scope and DOTS signal channel session
configuration data defined using YANG () as
CBOR data.In order to prevent fragmentation, DOTS agents must follow the
recommendations in Section 4.6 of . Refer
to for more details.DOTS agents MUST support GET, PUT, and DELETE CoAP methods. The
payload included in CoAP responses with 2.xx and 3.xx Response Codes
MUST be of content type "application/cbor" (Section 5.5.1 of ). CoAP responses with 4.xx and 5.xx error
Response Codes MUST include a diagnostic payload (Section 5.5.2 of ). The Diagnostic Payload may contain additional
information to aid troubleshooting.This document assumes that DOTS clients are provisioned with the
reachability information of their DOTS server(s) using a variety of
means (e.g., local configuration, or dynamic means such as DHCP).
These means are out of scope of this document.Likewise, it is out of scope of this document to specify the
behavior to follow by a DOTS client to place its requests (e.g.,
contact all servers, select one server among the list) when multiple
DOTS servers are provisioned.The DOTS server MUST support the use of the path-prefix of "/.well-
known/" as defined in and the
registered name of "dots". Each DOTS operation is indicated by a
path-suffix that indicates the intended operation.OperationOperation pathDetails Mitigation/v1/mitigateSession configuration/v1/configDOTS signaling can happen with DTLS over UDP and TLS over TCP. A
DOTS client can use DNS to determine the IP address(es) of a DOTS
server or a DOTS client may be provided with the list of DOTS server
IP addresses. The DOTS client MUST know a DOTS server's domain name;
hard-coding the domain name of the DOTS server into software is NOT
RECOMMENDED in case the domain name is not valid or needs to change
for legal or other reasons. The DOTS client performs A and/or AAAA
record lookup of the domain name and the result will be a list of IP
addresses, each of which can be used to contact the DOTS server using
UDP and TCP.If an IPv4 path to reach a DOTS server is found, but the DOTS
server's IPv6 path is not working, a dual-stack DOTS client can
experience a significant connection delay compared to an IPv4-only
DOTS client. The other problem is that if a middlebox between the DOTS
client and DOTS server is configured to block UDP, the DOTS client
will fail to establish a DTLS session with the DOTS server and will,
then, have to fall back to TLS over TCP incurring significant
connection delays.
discusses that DOTS client and server will have to support both
connectionless and connection-oriented protocols.To overcome these connection setup problems, the DOTS client can
try connecting to the DOTS server using both IPv6 and IPv4, and try
both DTLS over UDP and TLS over TCP in a fashion similar to the Happy
Eyeballs mechanism . These connection
attempts are performed by the DOTS client when its initializes, and
the client uses that information for its subsequent alert to the DOTS
server. In order of preference (most preferred first), it is UDP over
IPv6, UDP over IPv4, TCP over IPv6, and finally TCP over IPv4, which
adheres to address preference order and
the DOTS preference that UDP be used over TCP (to avoid TCP's head of
line blocking).In reference to , the DOTS
client sends two TCP SYNs and two DTLS ClientHello messages at the
same time over IPv6 and IPv4. In this example, it is assumed that the
IPv6 path is broken and UDP is dropped by a middlebox but has little
impact to the DOTS client because there is no long delay before using
IPv4 and TCP. The DOTS client repeats the mechanism to discover if
DOTS signaling with DTLS over UDP becomes available from the DOTS
server, so the DOTS client can migrate the DOTS signal channel from
TCP to UDP, but such probing SHOULD NOT be done more frequently than
every 24 hours and MUST NOT be done more frequently than every 5
minutes.The following methods are used by a DOTS client to request,
withdraw, or retrieve the status of mitigation requests:DOTS clients use the PUT method to request
mitigation from a DOTS server ().
During active mitigation, DOTS clients may use PUT requests to
convey mitigation efficacy updates to the DOTS server ().DOTS clients use the DELETE method to
withdraw a request for mitigation from the DOTS server ().DOTS clients may use the GET method to
subscribe to DOTS server status messages, or to retrieve the list
of existing mitigations ().Mitigation request and response messages are marked as
Non-confirmable messages. DOTS agents SHOULD follow the data
transmission guidelines discussed in Section 3.1.3 of and control transmission behavior by not
sending on average more than one UDP datagram per RTT to the peer DOTS
agent.Requests marked by the DOTS client as Non-confirmable messages are
sent at regular intervals until a response is received from the DOTS
server. If the DOTS client cannot maintain an RTT estimate, it SHOULD
NOT send more than one Non-confirmable request every 3 seconds, and
SHOULD use an even less aggressive rate when possible (case 2 in
Section 3.1.3 of ).When a DOTS client requires mitigation for any reason, the DOTS
client uses CoAP PUT method to send a mitigation request to the DOTS
server(s) (, illustrated in JSON
diagnostic notation). If this DOTS client is entitled to solicit the
DOTS service, the DOTS server can enable mitigation on behalf of the
DOTS client by communicating the DOTS client's request to the
mitigator and relaying selected mitigator feedback to the requesting
DOTS client.The parameters are described below:The client identifier MAY be
conveyed by the DOTS gateway to propagate the DOTS client
identity from the gateway's client-side to the gateway's
server-side, and from the gateway's server-side to the DOTS
server. This allows the final DOTS server to accept mitigation
requests with scopes which the DOTS client is authorized to
manage. The 'client-identifier' value
MUST be assigned by the DOTS gateway in a manner that ensures
that there is no probability that the same value will be
assigned to a different DOTS client. The DOTS gateway MUST
obscure potentially sensitive DOTS client identity information.
The client-identifier attribute SHOULD NOT to be generated and
included by the DOTS client. This is an
optional attribute.Identifier for the mitigation
request represented using an integer. This identifier MUST be
unique for each mitigation request bound to the DOTS client,
i.e., the mitigation-id parameter value in the mitigation
request needs to be unique relative to the mitigation-id
parameter values of active mitigation requests conveyed from the
DOTS client to the DOTS server. This identifier MUST be
generated by the DOTS client. This document does not make any
assumption about how this identifier is generated. This is a
mandatory attribute.A list of IP addresses under attack.
This is an optional attribute.A list of prefixes under attack.
Prefixes are represented using CIDR notation . This is an optional attribute.A list of ports under attack.
The port range, lower-port for lower port number and upper-port
for upper port number. When only lower-port is present, it
represents a single port. For TCP, UDP, Stream Control
Transmission Protocol (SCTP) , or
Datagram Congestion Control Protocol (DCCP) : the range of ports (e.g., 1024-65535).
This is an optional attribute.A list of protocols under attack.
Values are taken from the IANA protocol registry . The value 0 has a special
meaning for 'all protocols'. This is an optional attribute.A list of Fully Qualified Domain Names.
Fully Qualified Domain Name (FQDN) is the full name of a system,
rather than just its hostname. For example, "venera" is a
hostname, and "venera.isi.edu" is an FQDN. This is an optional
attribute.A list of Uniform Resource Identifiers
(URI). This is an optional attribute.A list of aliases. Aliases can be
created using the DOTS data channel (Section 3.1.1 of ) or direct
configuration, or other means and then used in subsequent signal
channel exchanges to refer more efficiently to the resources
under attack. This is an optional attribute.Lifetime of the mitigation request in
seconds. The RECOMMENDED lifetime of a mitigation request is
3600 seconds (60 minutes) -- this value was chosen to be long
enough so that refreshing is not typically a burden on the DOTS
client, while expiring the request where the client has
unexpectedly quit in a timely manner. A
lifetime of negative one (-1) indicates indefinite lifetime for
the mitigation request. A lifetime of 0 in the request is an
invalid value.DOTS clients MUST include
this parameter in their mitigation requests. Upon the expiry of
this lifetime, and if the request is not refreshed, the
mitigation request is removed. The request can be refreshed by
sending the same request again. The server MAY refuse indefinite
lifetime, for policy reasons; the granted lifetime value is
returned in the response. DOTS clients MUST be prepared to not
be granted mitigations with indefinite lifetimes. The server
MUST always indicate the actual lifetime in the response and the
remaining lifetime in status messages sent to the client. This
is a mandatory attribute.The CBOR key values for the parameters are defined in . defines how
the CBOR key values can be allocated to standards bodies and
vendors.FQDN and URI mitigation scopes may be thought of as a form of
scope alias, in which the addresses to which the domain name or URI
resolve represent the full scope of the mitigation.In the PUT request at least one of the attributes 'target-ip' or
'target-prefix' or 'fqdn' or 'uri 'or 'alias-name' MUST be present.
If the attribute value is empty, then the attribute MUST NOT be
present in the request. DOTS agents can safely ignore
Vendor-Specific parameters they don't understand.The relative order of two mitigation requests from a DOTS client
is determined by comparing their respective 'mitigation-id' values.
If two mitigation requests have overlapping mitigation scopes, the
mitigation request with higher numeric 'mitigation-id' value will
override the mitigation request with a lower numeric 'mitigation-id'
value. Two mitigation-ids from a DOTS client are overlapping if
there is a common IP address, IP prefix, FQDN, URI, or alias-name.
To avoid maintaining a long list of overlapping mitigation requests
from a DOTS client and avoid error-prone provisioning of mitigation
requests from a DOTS client, the overlapped lower numeric
'mitigation-id' MUST be automatically deleted and no longer
available at the DOTS server.The Uri-Path option carries a major and minor version
nomenclature to manage versioning and DOTS signal channel in this
specification uses v1 major version.If the DOTS client is using the certificate provisioned by the
Enrollment over Secure Transport (EST) server in the DOTS gateway-domain to authenticate
itself to the DOTS gateway, then the 'client-identifier' value can
be the output of a cryptographic hash algorithm whose input is the
DER-encoded ASN.1 representation of the Subject Public Key Info
(SPKI) of an X.509 certificate. In this version of the
specification, the cryptographic hash algorithm used is SHA-256
. The output of the cryptographic hash
algorithm is truncated to 16 bytes; truncation is done by stripping
off the final 16 bytes. The truncated output is base64url encoded.
If the 'client-identifier' value is already present in the
mitigation request received from the DOTS client, the DOTS gateway
MAY compute the 'client-identifier' value, as discussed above, and
add the computed 'client-identifier' value to the end of the
'client-identifier' list. The DOTS server MUST NOT use the
‘client-identifier’ for the DOTS client authentication
process.In both DOTS signal and data channel sessions, the DOTS client
MUST authenticate itself to the DOTS server (). The DOTS server may use the algorithm in
Section 7 of to derive the DOTS
client identity or username from the client certificate. The DOTS
client identity allows the DOTS server to accept mitigation requests
with scopes which the DOTS client is authorized to manage. The DOTS
server couples the DOTS signal and data channel sessions using the
DOTS client identity and the 'client-identifier' parameter value, so
the DOTS server can validate whether the aliases conveyed in the
mitigation request were indeed created by the same DOTS client using
the DOTS data channel session. If the aliases were not created by
the DOTS client, the DOTS server returns 4.00 (Bad Request) in the
response.The DOTS server couples the DOTS signal channel sessions using
the DOTS client identity and the 'client-identifier' parameter
value, and the DOTS server uses 'mitigation-id' parameter value to
detect duplicate mitigation requests. If the mitigation request
contains both alias-name and other parameters identifying the target
resources (such as, 'target-ip', 'target-prefix',
'target-port-range', 'fqdn', or 'uri'), then the DOTS server appends
the parameter values in 'alias-name' with the corresponding
parameter values in 'target-ip', 'target-prefix',
'target-port-range', 'fqdn', or 'uri'. shows a PUT request example to
signal that ports 80, 8080, and 443 on the servers 2001:db8:6401::1
and 2001:db8:6401::2 are being attacked (illustrated in JSON
diagnostic notation).The DOTS server indicates the result of processing the PUT
request using CoAP response codes. CoAP 2.xx codes are success. CoAP
4.xx codes are some sort of invalid requests (client errors). COAP
5.xx codes are returned if the DOTS server has erred or is currently
unavailable to provide mitigation in response to the mitigation
request from the DOTS client. shows an example of a PUT
request that is successfully processed (i.e., CoAP 2.xx response
codes).If the DOTS server does not find the 'mitigation-id' parameter
value conveyed in the PUT request in its configuration data, then
the server MAY accept the mitigation request by sending back a 2.01
(Created) response to the DOTS client; the DOTS server will
consequently try to mitigate the attack.If the DOTS server finds the 'mitigation-id' parameter value
conveyed in the PUT request in its configuration data, then the
server MAY update the mitigation request, and a 2.04 (Changed)
response is returned to indicate a successful update of the
mitigation request.If the request is missing one or more mandatory attributes, then
4.00 (Bad Request) will be returned in the response or if the
request contains invalid or unknown parameters then 4.02 (Invalid
query) is returned in the response.For a mitigation request to continue beyond the initial
negotiated lifetime, the DOTS client need to refresh the current
mitigation request by sending a new PUT request. The PUT request
MUST use the same 'mitigation-id' value, and MUST repeat all the
other parameters as sent in the original mitigation request apart
from a possible change to the lifetime parameter value.A DOTS gateway MUST update the ‘client-identifier’
list in the response to remove the 'client-identifier' value it had
added in the corresponding request before forwarding the response to
the DOTS client.A DELETE request is used to withdraw a DOTS mitigation request
from a DOTS server ().The DOTS server immediately acknowledges a DOTS client's request
to withdraw the DOTS signal using 2.02 (Deleted) response code with
no response payload. A 2.02 (Deleted) Response Code is returned even
if the 'mitigation-id' parameter value conveyed in the DELETE
request does not exist in its configuration data before the
request.If the DOTS server finds the 'mitigation-id' parameter value
conveyed in the DELETE request in its configuration data, then to
protect against route or DNS flapping caused by a client rapidly
toggling mitigation, and to dampen the effect of oscillating
attacks, DOTS servers MAY allow mitigation to continue for a limited
period after acknowledging a DOTS client's withdrawal of a
mitigation request. During this period, the DOTS server status
messages SHOULD indicate that mitigation is active but terminating.
The initial active-but-terminating period SHOULD be sufficiently
long to absorb latency incurred by route propagation. The
active-but-terminating period SHOULD be set by default to 120
seconds. If the client requests mitigation again before the initial
active-but-terminating period elapses, the DOTS server MAY
exponentially increase the active-but- terminating period up to a
maximum of 300 seconds (5 minutes). After the active-but-terminating
period elapses, the DOTS server MUST treat the mitigation as
terminated, as the DOTS client is no longer responsible for the
mitigation. For example, if there is a financial relationship
between the DOTS client and server domains, the DOTS client ceases
incurring cost at this point.A GET request is used to retrieve information (including status)
of a DOTS mitigation from a DOTS server (). If the DOTS server does not find the
'mitigation-id' parameter value conveyed in the GET request in its
configuration data, then it responds with a 4.04 (Not Found) error
response code. The 'c' (content) parameter and its permitted values
defined in can be used to
retrieve non-configuration data (attack mitigation status) or
configuration data or both. The DOTS server SHOULD support this
optional filtering capability but can safely ignore it if not
supported.The examples depicted in assume
the default of "c=a". shows a response example of all
the active mitigation requests associated with the DOTS client on
the DOTS server and the mitigation status of each mitigation
request.The mitigation status parameters are described below.The remaining lifetime of the mitigation
request in seconds.Mitigation start time is
represented in seconds relative to 1970-01-01T00:00Z in UTC time
(Section 2.4.1 of ). The encoding
is modified so that the leading tag 1 (epoch-based date/time)
MUST be omitted.The total dropped byte count for
the mitigation request since the attack mitigation is triggered.
The count wraps around when it reaches the maximum value of
unsigned integer. This is an optional attribute.The average dropped bytes per second
for the mitigation request since the attack mitigation is
triggered. This SHOULD be a five-minute average. This is an
optional attribute.The total dropped packet count for
the mitigation request since the attack mitigation is triggered.
This is an optional attribute.The average dropped packets per
second for the mitigation request since the attack mitigation is
triggered. This SHOULD be a five-minute average. This is an
optional attribute.Status of attack mitigation. The 'status'
parameter is a mandatory attribute.The various possible values of 'status' parameter are explained
in .Parameter valueDescription1Attack mitigation is in progress (e.g., changing the network
path to re-route the inbound traffic to DOTS mitigator). 2Attack is successfully mitigated (e.g., traffic is redirected
to a DDOS mitigator and attack traffic is dropped).3Attack has stopped and the DOTS client an withdraw the
mitigation request. 4Attack has exceeded the mitigation provider capability. 5DOTS client has withdrawn the mitigation request and the
mitigation is active but terminating.The observe option defined in
extends the CoAP core protocol with a mechanism for a CoAP client to
"observe" a resource on a CoAP server: the client retrieves a
representation of the resource and requests this representation be
updated by the server as long as the client is interested in the
resource. A DOTS client conveys the observe option set to '0' in the
GET request to receive unsolicited notifications of attack
mitigation status from the DOTS server. Unidirectional notifications
within the bidirectional signal channel allows unsolicited message
delivery, enabling asynchronous notifications between the agents.
Due to the higher likelihood of packet loss during a DDoS attack,
DOTS server periodically sends attack mitigation status to the DOTS
client and also notifies the DOTS client whenever the status of the
attack mitigation changes. If the DOTS server cannot maintain a RTT
estimate, it SHOULD NOT send more than one unsolicited notification
every 3 seconds, and SHOULD use an even less aggressive rate when
possible (case 2 in Section 3.1.3 of ). A DOTS client that is no longer interested in receiving
notifications from the DOTS server can simply "forget" the
observation. When the DOTS server then sends the next notification,
the DOTS client will not recognize the token in the message and thus
will return a Reset message. This causes the DOTS server to remove
the associated entry. Alternatively, the DOTS client can explicitly
deregister by issuing a GET request that has the Token field set to
the token of the observation to be cancelled and includes an Observe
Option with the value set to '1' (deregister). shows an example of a DOTS client
requesting a DOTS server to send notifications related a given
mitigation request.The DOTS client can send the GET request at frequent intervals
without the Observe option to retrieve the configuration data of
the mitigation request and non-configuration data (i.e., the
attack status). The frequency of polling the DOTS server to get
the mitigation status should follow the transmission guidelines
given in Section 3.1.3 of . If the
DOTS server has been able to mitigate the attack and the attack
has stopped, the DOTS server indicates as such in the status, and
the DOTS client recalls the mitigation request by issuing a DELETE
for the mitigation-id.A DOTS client should react to the status of the attack from the
DOTS server and not the fact that it has recognized, using its own
means, that the attack has been mitigated. This ensures that the
DOTS client does not recall a mitigation request in a premature
fashion because it is possible that the DOTS client does not sense
the DDOS attack on its resources but the DOTS server could be
actively mitigating the attack and the attack is not completely
averted.While DDoS mitigation is active, due to the likelihood of packet
loss, a DOTS client MAY periodically transmit DOTS mitigation
efficacy updates to the relevant DOTS server. A PUT request () is used to convey the mitigation efficacy
update to the DOTS server.The PUT request MUST include all the parameters used in the PUT
request to convey the DOTS signal ()
unchanged apart from the lifetime parameter value. If this is not
the case, the DOTS server MUST reject the request with a 4.02 error
response code.The If-Match Option (Section 5.10.8.1 of ) with an empty value is used to make the
PUT request conditional on the current existence of the mitigation
request. If UDP is used as transport, CoAP requests may arrive
out-of-order. For example, the DOTS client may send a PUT request to
convey an efficacy update to the DOTS server followed by a DELETE
request to withdraw the mitigation request, but the DELETE request
arrives at the DOTS server before the PUT request. To handle
out-of-order delivery of requests, if an If-Match option is present
in the PUT request and the 'mitigation-id' in the request matches a
mitigation request from that DOTS client, then the request is
processed. If no match is found, the PUT request is silently
ignored.The 'attack-status' parameter is a mandatory attribute when doing
a efficacy update. The various possible values contained in the
'attack-status' parameter are described in .Parameter valueDescription1The DOTS client determines that it is still under attack.2The DOTS client determines that the attack is successfully
mitigated (e.g., attack traffic is not seen). The DOTS server indicates the result of processing a PUT request
using CoAP response codes. The response code 2.04 (Changed) is
returned if the DOTS server has accepted the mitigation efficacy
update. The error response code 5.03 (Service Unavailable) is
returned if the DOTS server has erred or is incapable of performing
the mitigation.The DOTS client can negotiate, configure, and retrieve the DOTS
signal channel session behavior. The DOTS signal channel can be used,
for example, to configure the following:Heartbeat interval: DOTS agents regularly send heartbeats (CoAP
Ping/Pong) to each other after mutual authentication in order to
keep the DOTS signal channel open, heartbeat messages are
exchanged between the DOTS agents every heartbeat-interval seconds
to detect the current status of the DOTS signal channel
session.Missing heartbeats allowed: This variable indicates the maximum
number of consecutive heartbeat messages for which a DOTS agent
did not receive a response before concluding that the session is
disconnected or defunct.Acceptable signal loss ratio: Maximum retransmissions,
retransmission timeout value and other message transmission
parameters for the DOTS signal channel.Reliability is provided to requests and responses by marking them
as Confirmable (CON) messages. DOTS signal channel session
configuration requests and responses are marked as Confirmable (CON)
messages. As explained in Section 2.1 of , a Confirmable message is retransmitted using
a default timeout and exponential back-off between retransmissions,
until the DOTS server sends an Acknowledgement message (ACK) with the
same Message ID conveyed from the DOTS client. Message transmission
parameters are defined in Section 4.8 of . Reliability is provided to the responses by
marking them as Confirmable (CON) messages. The DOTS server can either
piggyback the response in the acknowledgement message or if the DOTS
server is not able to respond immediately to a request carried in a
Confirmable message, it simply responds with an Empty Acknowledgement
message so that the DOTS client can stop retransmitting the request.
Empty Acknowledgement message is explained in Section 2.2 of . When the response is ready, the server sends
it in a new Confirmable message which then in turn needs to be
acknowledged by the DOTS client (see Sections 5.2.1 and 5.2.2 of ). Requests and responses exchanged between
DOTS agents during peacetime are marked as Confirmable messages.Implementation Note: A DOTS client that receives a response in a
CON message may want to clean up the message state right after sending
the ACK. If that ACK is lost and the DOTS server retransmits the CON,
the DOTS client may no longer have any state to which to correlate
this response, making the retransmission an unexpected message; the
DOTS client will send a Reset message so it does not receive any more
retransmissions. This behavior is normal and not an indication of an
error (see Section 5.3.2 of for more
details).A GET request is used to obtain acceptable and current
configuration parameters on the DOTS server for DOTS signal channel
session configuration. shows how to
obtain acceptable configuration parameters for the DOTS server.The DOTS server in the 2.05 (Content) response conveys the
current, minimum and maximum attribute values acceptable by the DOTS
server. shows an example of acceptable
and current configuration parameters on the DOTS server for DOTS
signal channel session configuration.A PUT request is used to convey the configuration parameters for
the signal channel (e.g., heartbeat interval, maximum
retransmissions). Message transmission parameters for CoAP are
defined in Section 4.8 of . The
RECOMMENDED values of transmission parameter values are ack_timeout
(2 seconds), max-retransmit (3), ack-random-factor (1.5). In
addition to those parameters, the RECOMMENDED specific DOTS
transmission parameter values are heartbeat-interval (30 seconds)
and missing-hb-allowed (5).Note: heartbeat-interval should be tweaked to also assist
DOTS messages for NAT traversal (SIG-010 of ). According to , keepalive messages must not be sent
more frequently than once every 15 seconds and should use longer
intervals when possible. Furthermore, recommends NATs to use a state timeout
of 2 minutes or longer, but experience shows that sending
packets every 15 to 30 seconds is necessary to prevent the
majority of middleboxes from losing state for UDP flows. From
that standpoint, this specification recommends a minimum
heartbeat-interval of 15 seconds and a maximum
heartbeat-interval of 240 seconds. The recommended value of 30
seconds is selected to anticipate the expiry of NAT state.A heartbeat-interval of 30 second may be seen as too chatty
in some deployments. For such deployments, DOTS agents may
negotiate longer heartbeat-interval values to avoid overloading
the network with too frequent keepalives.When a confirmable "CoAP ping" is sent, and if there is no
response, the "CoAP ping" will get retransmitted max-retransmit
number of times by the CoAP layer using an initial timeout set to a
random duration between ack_timeout and
(ack-timeout*ack-random-factor) and exponential back-off between
retransmissions. By choosing the recommended transmission
parameters, the "CoAP ping" will timeout after 45 seconds. If the
DOTS agent does not receive any response from the peer DOTS agent
for missing-hb-allowed number of consecutive "CoAP ping" confirmable
messages, then it concludes that the DOTS signal channel session is
disconnected. A DOTS client MUST NOT transmit a "CoAP ping" while
waiting for the previous "CoAP ping" response from the same DOTS
server.If the DOTS agent wishes to change the default values of message
transmission parameters, then it should follow the guidance given in
Section 4.8.1 of . The DOTS agents
MUST use the negotiated values for message transmission parameters
and default values for non-negotiated message transmission
parameters.The signal channel session configuration is applicable to a
single DOTS signal channel session between the DOTS agents.The parameters are described below:Identifier for the DOTS signal channel
session configuration data represented as an integer. This
identifier MUST be generated by the DOTS client. This document
does not make any assumption about how this identifier is
generated. This is a mandatory attribute.Time interval in seconds
between two consecutive heartbeat messages. This is an optional
attribute.Maximum number of consecutive
heartbeat messages for which the DOTS agent did not receive a
response before concluding that the session is disconnected.
This is an optional attribute.Maximum number of retransmissions
for a message (referred to as MAX_RETRANSMIT parameter in CoAP).
This is an optional attribute.Timeout value in seconds used to
calculate the initial retransmission timeout value (referred to
as ACK_TIMEOUT parameter in CoAP). This is an optional
attribute.Random factor used to
influence the timing of retransmissions (referred to as
ACK_RANDOM_FACTOR parameter in CoAP). This is an optional
attribute.If the parameter value is set
to 'false', then DDoS mitigation is triggered only when the DOTS
signal channel session is lost. Automated mitigation on loss of
signal is discussed in Section 3.3.3 of . If the DOTS client
ceases to respond to heartbeat messages, then the DOTS server
can detect that the DOTS session is lost. The default value of
the parameter is 'true'. This is an optional attribute.In the PUT request at least one of the attributes
heartbeat-interval, missing-hb-allowed, max-retransmit, ack-timeout,
ack-random-factor, and trigger-mitigation MUST be present. The PUT
request with higher numeric session-id value over-rides the DOTS
signal channel session configuration data installed by a PUT request
with a lower numeric session-id value. shows a PUT request example to
convey the configuration parameters for the DOTS signal channel.The DOTS server indicates the result of processing the PUT
request using CoAP response codes:If the DOTS server finds the 'session-id' parameter value
conveyed in the PUT request in its configuration data and if the
DOTS server has accepted the updated configuration parameters,
then 2.04 (Changed) code is returned in the response.If the DOTS server does not find the 'session-id' parameter
value conveyed in the PUT request in its configuration data and
if the DOTS server has accepted the configuration parameters,
then a response code 2.01 (Created) is returned in the
response.If the request is missing one or more mandatory attributes,
then 4.00 (Bad Request) is returned in the response.If the request contains one or more invalid or unknown
parameters, then 4.02 (Invalid query) code is returned in the
response.Response code 4.22 (Unprocessable Entity) is returned in the
response, if any of the heartbeat-interval, missing-hb-allowed,
max-retransmit, target-protocol, ack-timeout, and
ack-random-factor attribute values are not acceptable to the
DOTS server. Upon receipt of the 4.22 error response code, the
DOTS client should request the maximum and minimum attribute
values acceptable to the DOTS server (). The DOTS client may re-try and send
the PUT request with updated attribute values acceptable to the
DOTS server.A DELETE request is used to delete the installed DOTS signal
channel session configuration data ().The DOTS server resets the DOTS signal channel session
configuration back to the default values and acknowledges a DOTS
client's request to remove the DOTS signal channel session
configuration using 2.02 (Deleted) response code.Redirected DOTS signaling is discussed in detail in Section 3.2.2
of . If a DOTS server wants to redirect a DOTS client to an alternative
DOTS server for a signal session, then the response code 3.00
(alternate server) will be returned in the response to the client. The
DOTS server can return the error response code 3.00 in response to a
PUT request from the DOTS client or convey the error response code
3.00 in a unidirectional notification response from the DOTS
server.The DOTS server in the error response conveys the alternate DOTS
server FQDN, and the alternate DOTS server IP addresses and time to
live values in the CBOR body.The parameters are described below:FQDN of an alternate DOTS server.IP address of an alternate DOTS server.Time to live (TTL) represented as an integer
number of seconds. shows a 3.00 response example
to convey the DOTS alternate server www.example-alt.com, its IP
addresses 2001:db8:6401::1 and 2001:db8:6401::2, and TTL values 3600
and 1800.When the DOTS client receives 3.00 response, it considers the
current request as having failed, but SHOULD try the request with the
alternate DOTS server. During a DDOS attack, the DNS server may be
subjected to DDOS attack, alternate DOTS server IP addresses conveyed
in the 3.00 response help the DOTS client to skip DNS lookup of the
alternate DOTS server and can try to establish UDP or TCP session with
the alternate DOTS server IP addresses. The DOTS client SHOULD
implement DNS64 function to handle the scenario where IPv6-only DOTS
client communicates with IPv4-only alternate DOTS server.To provide a metric of signal health and distinguish an 'idle'
signal channel from a 'disconnected' or 'defunct' session, the DOTS
agent sends a heartbeat over the signal channel to maintain its half
of the channel. The DOTS agent similarly expects a heartbeat from its
peer DOTS agent, and may consider a session terminated in the extended
absence of a peer agent heartbeat.While the communication between the DOTS agents is quiescent, the
DOTS client will probe the DOTS server to ensure it has maintained
cryptographic state and vice versa. Such probes can also keep alive
firewall and/or NAT bindings. This probing reduces the frequency of
establishing a new handshake when a DOTS signal needs to be conveyed
to the DOTS server.In case of a volumetric DDoS attack saturating the incoming link to
the DOTS client, all traffic from the DOTS server to the DOTS client
will likely be dropped, although the DOTS server receives heartbeat
requests and DOTS messages from the DOTS client. In this scenario, the
DOTS agents MUST behave differently to handle message transmission and
DOTS session liveliness during link saturation:The DOTS client MUST NOT consider the DOTS session terminated
even after maximum "missing-hb-allowed" threshold is reached. The
DOTS client SHOULD continue to use the current DOTS session, and
send heartbeat requests over the current DOTS session, so the DOTS
server knows the DOTS client has not disconnected the DOTS
session. After the maximum "missing-hb-allowed" threshold is
reached, the DOTS client SHOULD try (D)TLS session resumption. The
DOTS client SHOULD send mitigation requests over the current DOTS
session, and in parallel, try (D)TLS session resumption or 0-RTT
mode in DTLS 1.3 to piggyback the mitigation request in the
ClientHello message. Once the link is no longer statured, if
traffic from the DOTS server reaches the DOTS client over the
current DOTS session, the DOTS client can stop (D)TLS session
resumption or if (D)TLS session resumption is successful then
disconnect the current DOTS session.If the DOTS server does not receive any traffic from the peer
DOTS client, then the DOTS server sends heartbeat requests to the
DOTS client and after maximum "missing-hb-allowed" threshold is
reached, the DOTS server concludes the session is
disconnected.In DOTS over UDP, heartbeat messages may be exchanged between the
DOTS agents using the “COAP ping” mechanism defined in
Section 4.2 of . Concretely, the DOTS
agent sends an Empty Confirmable message and the peer DOTS agent will
respond by sending an Reset message.In DOTS over TCP, heartbeat messages can be exchanged between the
DOTS agents using the Ping and Pong messages specified in Section 4.4
of . That is, the
DOTS agent sends a Ping message and the peer DOTS agent would respond
by sending a single Pong message.This document defines YANG modules for
mitigation scope and DOTS signal channel session configuration data.This document defines the YANG module "ietf-dots-signal" (), which has the following tree
structure:This document defines the YANG module "ietf-dots-signal-config"
(), which has the following
structure:All parameters in the payload in the DOTS signal channel MUST be
mapped to CBOR types as shown in Table 4 and are given an integer key to
save space. The recipient of the payload MAY reject the information if
it is not suitably mapped.This section defines the (D)TLS protocol profile of DOTS signal
channel over (D)TLS and DOTS data channel over TLS.There are known attacks on (D)TLS, such as machine-in-the-middle
and protocol downgrade. These are general attacks on (D)TLS and not
specific to DOTS over (D)TLS; please refer to the (D)TLS RFCs for
discussion of these security issues. DOTS agents MUST adhere to the
(D)TLS implementation recommendations and security considerations of
except with respect to (D)TLS version.
Since encryption of DOTS using (D)TLS is virtually a green-field
deployment DOTS agents MUST implement only (D)TLS 1.2 or later.When a DOTS client is configured with a domain name of the DOTS
server, and connects to its configured DOTS server, the server may
present it with a PKIX certificate. In order to ensure proper
authentication, DOTS client MUST verify the entire certification path
per . The DOTS client additionaly uses
validation techniques to compare the
domain name to the certificate provided.A key challenge to deploying DOTS is provisioning DOTS clients,
including the distribution of keying material to DOTS clients to make
possible the required mutual authentication of DOTS agents. EST
defines a method of certificate enrollment by which domains operating
DOTS servers may provision DOTS clients with all necessary
cryptographic keying material, including a private key and certificate
with which to authenticate itself. One deployment option is DOTS
clients to behave as EST clients for certificate enrollment from an
EST server provisioned by the mitigation provider. This document does
not specify which EST mechanism the DOTS client uses to achieve
initial enrollment.Implementations compliant with this profile MUST implement all of
the following items:DTLS record replay detection (Section 3.3 of ) to protect against replay attacks.(D)TLS session resumption without server-side state to resume session and convey the DOTS
signal.Raw public keys or PSK handshake
which reduce the size of the
ServerHello, and can be used by DOTS agents that cannot obtain
certificates (e.g., DOTS clients and DOTS gateways on private
networks).Implementations compliant with this profile SHOULD implement all of
the following items to reduce the delay required to deliver a DOTS
signal:TLS False Start which reduces
round-trips by allowing the TLS second flight of messages
(ChangeCipherSpec) to also contain the DOTS signal.Cached Information Extension
which avoids transmitting the server's certificate and certificate
chain if the client has cached that information from a previous
TLS handshake.TCP Fast Open can reduce the
number of round-trips to convey DOTS signal.To avoid DOTS signal message fragmentation and the consequently
decreased probability of message delivery, DOTS agents MUST ensure
that the DTLS record MUST fit within a single datagram. If the path
MTU is not known to the DOTS server, an IP MTU of 1280 bytes SHOULD be
assumed. The length of the URL MUST NOT exceed 256 bytes. If UDP is
used to convey the DOTS signal messages then the DOTS client must
consider the amount of record expansion expected by the DTLS
processing when calculating the size of CoAP message that fits within
the path MTU. Path MTU MUST be greater than or equal to [CoAP message
size + DTLS overhead of 13 octets + authentication overhead of the
negotiated DTLS cipher suite + block padding (Section 4.1.1.1 of ). If the request size exceeds the path MTU
then the DOTS client MUST split the DOTS signal into separate
messages, for example the list of addresses in the 'target-ip'
parameter could be split into multiple lists and each list conveyed in
a new PUT request.Implementation Note: DOTS choice of message size parameters works
well with IPv6 and with most of today's IPv4 paths. However, with
IPv4, it is harder to absolutely ensure that there is no IP
fragmentation. If IPv4 support on unusual networks is a consideration
and path MTU is unknown, implementations may want to limit themselves
to more conservative IPv4 datagram sizes such as 576 bytes, as per
IP packets up to 576 bytes should never
need to be fragmented, thus sending a maximum of 500 bytes of DOTS
signal over a UDP datagram will generally avoid IP fragmentation.TLS 1.3 provides critical
latency improvements for connection establishment over TLS 1.2. The DTLS
1.3 protocol is based on
the TLS 1.3 protocol and provides equivalent security guarantees. (D)TLS
1.3 provides two basic handshake modes of interest to DOTS signal
channel:Absent packet loss, a full handshake in which the DOTS client is
able to send the DOTS signal message after one round trip and the
DOTS server immediately after receiving the first DOTS signal
message from the client.0-RTT mode in which the DOTS client can authenticate itself and
send DOTS signal message on its first flight, thus reducing
handshake latency. 0-RTT only works if the DOTS client has
previously communicated with that DOTS server, which is very likely
with the DOTS signal channel. The DOTS client SHOULD establish a
(D)TLS session with the DOTS server during peacetime and share a
PSK. During DDOS attack, the DOTS client can use the (D)TLS session
to convey the DOTS signal message and if there is no response from
the server after multiple re-tries then the DOTS client can resume
the (D)TLS session in 0-RTT mode using PSK. A simplified TLS 1.3
handshake with 0-RTT DOTS signal message exchange is shown in .(D)TLS based on client certificate can be used for mutual
authentication between DOTS agents. If a DOTS gateway is involved, DOTS
clients and DOTS gateway MUST perform mutual authentication; only
authorized DOTS clients are allowed to send DOTS signals to a DOTS
gateway. DOTS gateway and DOTS server MUST perform mutual
authentication; DOTS server only allows DOTS signals from authorized
DOTS gateway, creating a two-link chain of transitive authentication
between the DOTS client and the DOTS server.In the example depicted in ,
the DOTS gateway and DOTS clients within the 'example.com' domain
mutually authenticate with each other. After the DOTS gateway validates
the identity of a DOTS client, it communicates with the AAA server in
the 'example.com' domain to determine if the DOTS client is authorized
to request DDOS mitigation. If the DOTS client is not authorized, a 4.01
(Unauthorized) is returned in the response to the DOTS client. In this
example, the DOTS gateway only allows the application server and DDOS
detector to request DDOS mitigation, but does not permit the user of
type 'guest' to request DDOS mitigation.Also, DOTS gateway and DOTS server located in different domains MUST
perform mutual authentication (e.g., using certificates). A DOTS server
will only allow a DOTS gateway with a certificate for a particular
domain to request mitigation for that domain. In reference to , the DOTS server only allows the DOTS gateway
to request mitigation for 'example.com' domain and not for other
domains.This specification registers a default port, new URI suffix in the
Well-Known URIs registry, new CoAP response code, new parameters for
DOTS signal channel and establishes registries for mappings to CBOR.IANA has assigned the port number TBD to the DOTS signal channel
protocol, for both UDP and TCP.This memo registers the 'dots' well-known URI in the Well-Known
URIs registry as defined by .URI suffix: dotsChange controller: IETFSpecification document(s): This RFCRelated information: NoneThe following entry is added to the "CoAP Response Codes"
sub-registry:CodeDescriptionReference3.00Alternate server [RFCXXXX]A new registry will be requested from IANA, entitled "DOTS signal
channel CBOR Mappings Registry". The registry is to be created as
Expert Review Required. Parameter names (e.g.,
"target_ip") in the DOTS signal channel. Key value for the
parameter. The key value MUST be an integer in the range of 1 to
65536. The key values in the range of 32768 to 65536 are
assigned for Vendor-Specific parameters. CBOR Major type and
optional tag for the claim. For Standards Track
RFCs, list the "IESG". For others, give the name of the
responsible party. Other details (e.g., postal address, email
address, home page URI) may also be included. Reference to
the document or documents that specify the parameter, preferably
including URIs that can be used to retrieve copies of the
documents. An indication of the relevant sections may also be
included but is not required.Parameter Name: mitigation-scopeCBOR Key Value: 1CBOR Major Type: 5Change Controller: IESGSpecification Document(s): this documentParameter Name: scopeCBOR Key Value: 2CBOR Major Type: 5Change Controller: IESGSpecification Document(s): this documentParameter Name: mitigation-idCBOR Key Value: 3CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name:target-ipCBOR Key Value: 4CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name: target-port-rangeCBOR Key Value: 5CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name: lower-portCBOR Key Value: 6CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: upper-portCBOR Key Value: 7CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: target-protocolCBOR Key Value: 8CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name: fqdnCBOR Key Value: 9CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name: uriCBOR Key Value: 10CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name: alias-nameCBOR Key Value: 11CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name: lifetimeCBOR Key Value: 12CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: attack-statusCBOR Key Value: 13CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: signal-configCBOR Key Value: 14CBOR Major Type: 5Change Controller: IESGSpecification Document(s): this documentParameter Name: heartbeat-intervalCBOR Key Value: 15CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: max-retransmitCBOR Key Value: 16CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: ack-timeoutCBOR Key Value: 17CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: ack-random-factorCBOR Key Value: 18CBOR Major Type: 7Change Controller: IESGSpecification Document(s): this documentParameter Name: MinValueCBOR Key Value: 19CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: MaxValueCBOR Key Value: 20CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: statusCBOR Key Value: 21CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: bytes-droppedCBOR Key Value: 22CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: bps-droppedCBOR Key Value: 23CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: pkts-droppedCBOR Key Value: 24CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: pps-droppedCBOR Key Value: 25CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: session-idCBOR Key Value: 26CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: trigger-mitigationCBOR Key Value: 27CBOR Major Type: 7Change Controller: IESGSpecification Document(s): this documentParameter Name: missing-hb-allowedCBOR Key Value: 28CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name: CurrentValueCBOR Key Value: 29CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentParameter Name:mitigation-startCBOR Key Value: 30CBOR Major Type: 7Change Controller: IESGSpecification Document(s): this documentParameter Name:target-prefixCBOR Key Value: 31CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name:client-identifierCBOR Key Value: 32CBOR Major Type: 2Change Controller: IESGSpecification Document(s): this documentParameter Name:alt-serverCBOR Key Value: 33CBOR Major Type: 2Change Controller: IESGSpecification Document(s): this documentParameter Name:alt-server-recordCBOR Key Value: 34CBOR Major Type: 4Change Controller: IESGSpecification Document(s): this documentParameter Name:addrCBOR Key Value: 35CBOR Major Type: 2Change Controller: IESGSpecification Document(s): this documentParameter Name:ttlCBOR Key Value: 36CBOR Major Type: 0Change Controller: IESGSpecification Document(s): this documentThis document requests IANA to register the following URIs in the
"IETF XML Registry" : This document requests IANA to register the following YANG
modules in the "YANG Module Names" registry .[Note to RFC Editor: Please remove this section and reference to
prior to publication.]This section records the status of known implementations of the
protocol defined by this specification at the time of posting of this
Internet-Draft, and is based on a proposal described in . The description of implementations in this
section is intended to assist the IETF in its decision processes in
progressing drafts to RFCs. Please note that the listing of any
individual implementation here does not imply endorsement by the IETF.
Furthermore, no effort has been spent to verify the information
presented here that was supplied by IETF contributors. This is not
intended as, and must not be construed to be, a catalog of available
implementations or their features. Readers are advised to note that
other implementations may exist.According to , "this will allow
reviewers and working groups to assign due consideration to documents
that have the benefit of running code, which may serve as evidence of
valuable experimentation and feedback that have made the implemented
protocols more mature. It is up to the individual working groups to use
this information as they see fit".NTT Communication is developing a
DOTS client and DOTS server software based on DOTS signal channel
specified in this draft. It will be open-sourced.Early implementation of DOTS protocol.
It is aimed to implement a full DOTS protocol spec in accordance
with maturing of DOTS protocol itself.https://github.com/nttdots/go-dotsIt is a early implementation of
DOTS protocol. Messaging between DOTS clients and DOTS servers has
been tested. Level of maturity will increase in accordance with
maturing of DOTS protocol itself.Capability of DOTS client: sending DOTS
messages to the DOTS server in CoAP over DTLS as dots-signal.
Capability of DOTS server: receiving dots-signal, validating
received dots-signal, starting mitigation by handing over the
dots-signal to DDOS mitigator.It will be open-sourced with BSD
3-clause license.It is implemented in
Go-lang. Core specification of signaling is mature to be
implemented, however, finding good libraries(like DTLS, CoAP) is
rather difficult.Kaname Nishizuka
<kaname@nttv6.jp>Authenticated encryption MUST be used for data confidentiality and
message integrity. (D)TLS based on client certificate MUST be used for
mutual authentication. The interaction between the DOTS agents requires
Datagram Transport Layer Security (DTLS) and Transport Layer Security
(TLS) with a cipher suite offering confidentiality protection and the
guidance given in MUST be followed to
avoid attacks on (D)TLS.A single DOTS signal channel between DOTS agents can be used to
exchange multiple DOTS signal messages. To reduce DOTS client and DOTS
server workload, DOTS client SHOULD re-use the (D)TLS session.If TCP is used between DOTS agents, an attacker may be able to inject
RST packets, bogus application segments, etc., regardless of whether TLS
authentication is used. Because the application data is TLS protected,
this will not result in the application receiving bogus data, but it
will constitute a DoS on the connection. This attack can be countered by
using TCP-AO . If TCP-AO is used, then any
bogus packets injected by an attacker will be rejected by the TCP-AO
integrity check and therefore will never reach the TLS layer.In order to prevent leaking internal information outside a
client-domain, DOTS gateways located in the client-domain SHOULD NOT
reveal the identity of internal DOTS clients (client-identifier) unless
explicitly configured to do so.Special care should be taken in order to ensure that the activation
of the proposed mechanism won't have an impact on the stability of the
network (including connectivity and services delivered over that
network).Involved functional elements in the cooperation system must establish
exchange instructions and notification over a secure and authenticated
channel. Adequate filters can be enforced to avoid that nodes outside a
trusted domain can inject request such as deleting filtering rules.
Nevertheless, attacks can be initiated from within the trusted domain if
an entity has been corrupted. Adequate means to monitor trusted nodes
should also be enabled.The following individuals have contributed to this document:Mike Geller Cisco Systems, Inc. 3250 Florida 33309 USA Email:
mgeller@cisco.comRobert Moskowitz HTT Consulting Oak Park, MI 42837 United States
Email: rgm@htt-consult.comDan Wing Email: dwing-ietf@fuggles.comThanks to Christian Jacquenet, Roland Dobbins, Roman D. Danyliw,
Michael Richardson, Ehud Doron, Kaname Nishizuka, Dave Dolson, Liang
Xia, Jon Shallow, and Gilbert Clark for the discussion and comments.IANA, "Protocol Numbers"