< draft-ietf-dots-server-discovery-01.txt   draft-ietf-dots-server-discovery-02.txt >
DOTS M. Boucadair DOTS M. Boucadair
Internet-Draft Orange Internet-Draft Orange
Intended status: Standards Track T. Reddy Intended status: Standards Track T. Reddy
Expires: October 19, 2019 McAfee Expires: November 7, 2019 McAfee
P. Patil P. Patil
Cisco Cisco
April 17, 2019 May 6, 2019
Distributed-Denial-of-Service Open Threat Signaling (DOTS) Server Distributed-Denial-of-Service Open Threat Signaling (DOTS) Server
Discovery Discovery
draft-ietf-dots-server-discovery-01 draft-ietf-dots-server-discovery-02
Abstract Abstract
It may not be possible for a network to determine the cause for an It may not be possible for a network to determine the cause for an
attack, but instead just realize that some resources seem to be under attack, but instead just realize that some resources seem to be under
attack. To fill that gap, Distributed-Denial-of-Service Open Threat attack. To fill that gap, Distributed-Denial-of-Service Open Threat
Signaling (DOTS) allows a network to inform a DOTS server that it is Signaling (DOTS) allows a network to inform a DOTS server that it is
under a potential attack so that appropriate mitigation actions are under a potential attack so that appropriate mitigation actions are
undertaken. undertaken.
skipping to change at page 1, line 42 skipping to change at page 1, line 42
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on October 19, 2019. This Internet-Draft will expire on November 7, 2019.
Copyright Notice Copyright Notice
Copyright (c) 2019 IETF Trust and the persons identified as the Copyright (c) 2019 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 22 skipping to change at page 2, line 22
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Why Multiple Discovery Mechanisms? . . . . . . . . . . . . . 4 3. Why Multiple Discovery Mechanisms? . . . . . . . . . . . . . 4
4. Unified DOTS Discovery Procedure . . . . . . . . . . . . . . 5 4. Unified DOTS Discovery Procedure . . . . . . . . . . . . . . 5
5. DHCP Options for DOTS . . . . . . . . . . . . . . . . . . . . 7 5. DHCP Options for DOTS . . . . . . . . . . . . . . . . . . . . 7
5.1. DHCPv6 DOTS Options . . . . . . . . . . . . . . . . . . . 7 5.1. DHCPv6 DOTS Options . . . . . . . . . . . . . . . . . . . 8
5.1.1. Format of DOTS Reference Identifier Option . . . . . 7 5.1.1. Format of DOTS Reference Identifier Option . . . . . 8
5.1.2. Format of DOTS Address Option . . . . . . . . . . . . 8 5.1.2. Format of DOTS Address Option . . . . . . . . . . . . 8
5.1.3. DHCPv6 Client Behavior . . . . . . . . . . . . . . . 9 5.1.3. DHCPv6 Client Behavior . . . . . . . . . . . . . . . 9
5.2. DHCPv4 DOTS Options . . . . . . . . . . . . . . . . . . . 10 5.2. DHCPv4 DOTS Options . . . . . . . . . . . . . . . . . . . 10
5.2.1. Format of DOTS Reference Identifier Option . . . . . 10 5.2.1. Format of DOTS Reference Identifier Option . . . . . 10
5.2.2. Format Format of DOTS Address Option . . . . . . . . 11 5.2.2. Format of DOTS Address Option . . . . . . . . . . . . 11
5.2.3. DHCPv4 Client Behavior . . . . . . . . . . . . . . . 12 5.2.3. DHCPv4 Client Behavior . . . . . . . . . . . . . . . 12
6. Discovery using Service Resolution . . . . . . . . . . . . . 13 6. Discovery using Service Resolution . . . . . . . . . . . . . 13
7. DNS Service Discovery . . . . . . . . . . . . . . . . . . . . 15 7. DNS Service Discovery . . . . . . . . . . . . . . . . . . . . 15
8. Security Considerations . . . . . . . . . . . . . . . . . . . 15 8. Security Considerations . . . . . . . . . . . . . . . . . . . 15
8.1. DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . 15 8.1. DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . 15
8.2. Service Resolution . . . . . . . . . . . . . . . . . . . 15 8.2. Service Resolution . . . . . . . . . . . . . . . . . . . 15
8.3. DNS Service Discovery . . . . . . . . . . . . . . . . . . 15 8.3. DNS Service Discovery . . . . . . . . . . . . . . . . . . 15
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16
9.1. DHCPv6 Option . . . . . . . . . . . . . . . . . . . . . . 16 9.1. DHCPv6 Option . . . . . . . . . . . . . . . . . . . . . . 16
9.2. DHCPv4 Option . . . . . . . . . . . . . . . . . . . . . . 16 9.2. DHCPv4 Option . . . . . . . . . . . . . . . . . . . . . . 16
9.3. Application Service & Application Protocol Tags . . . . . 16 9.3. Application Service & Application Protocol Tags . . . . . 16
9.3.1. DOTS Application Service Tag Registration . . . . . . 16 9.3.1. DOTS Application Service Tag Registration . . . . . . 16
9.3.2. signal.udp Application Protocol Tag Registration . . 17 9.3.2. signal.udp Application Protocol Tag Registration . . 17
9.3.3. signal.tcp Application Protocol Tag Registration . . 17 9.3.3. signal.tcp Application Protocol Tag Registration . . 17
9.3.4. data.tcp Application Protocol Tag Registration . . . 17 9.3.4. data.tcp Application Protocol Tag Registration . . . 17
10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 17 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 17
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 17 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 18
11.1. Normative References . . . . . . . . . . . . . . . . . . 18 11.1. Normative References . . . . . . . . . . . . . . . . . . 18
11.2. Informative References . . . . . . . . . . . . . . . . . 19 11.2. Informative References . . . . . . . . . . . . . . . . . 19
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 20 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 20
1. Introduction 1. Introduction
DDoS Open Threat Signaling (DOTS) [I-D.ietf-dots-architecture] DDoS Open Threat Signaling (DOTS) [I-D.ietf-dots-architecture]
specifies an architecture, in which a DOTS client can inform a DOTS specifies an architecture, in which a DOTS client can inform a DOTS
server that the network is under a potential attack and that server that the network is under a potential attack and that
appropriate mitigation actions are required. Indeed, because the appropriate mitigation actions are required. Indeed, because the
skipping to change at page 3, line 47 skipping to change at page 3, line 47
[I-D.ietf-dots-architecture] specifies that the DOTS client may be [I-D.ietf-dots-architecture] specifies that the DOTS client may be
provided with a list of DOTS servers; each associated with one or provided with a list of DOTS servers; each associated with one or
more IP addresses. These addresses may or may not be of the same more IP addresses. These addresses may or may not be of the same
address family. The DOTS client establishes one or more DOTS address family. The DOTS client establishes one or more DOTS
sessions by connecting to the provided DOTS server addresses. sessions by connecting to the provided DOTS server addresses.
This document specifies methods for DOTS clients to discover their This document specifies methods for DOTS clients to discover their
DOTS server(s). The rationale for specifying multiple discovery DOTS server(s). The rationale for specifying multiple discovery
mechanisms is discussed in Section 3. mechanisms is discussed in Section 3.
The discovery methods can also used by a DOTS server to locate a DOTS
client in the context of DOTS Call Home
[I-D.ietf-dots-signal-call-home].
Considerations for the selection of DOTS server(s) by multi-homed Considerations for the selection of DOTS server(s) by multi-homed
DOTS clients is out of scope; the reader should refer to DOTS clients is out of scope; the reader should refer to
[I-D.ietf-dots-multihoming] for more details. [I-D.ietf-dots-multihoming] for more details.
Likewise, happy eyeballs considerations for DOTS signal channel Likewise, happy eyeballs considerations for DOTS signal channel
protocol are out of scope. The reader should refer to Section 4 of protocol are out of scope. The reader should refer to Section 4 of
[I-D.ietf-dots-signal-channel]. [I-D.ietf-dots-signal-channel].
This document assumes that security credentials to authenticate DOTS This document assumes that security credentials to authenticate DOTS
server(s) are provisioned to a DOTS client using a variety of means server(s) are provisioned to a DOTS client using a variety of means
skipping to change at page 8, line 7 skipping to change at page 8, line 14
5.1. DHCPv6 DOTS Options 5.1. DHCPv6 DOTS Options
5.1.1. Format of DOTS Reference Identifier Option 5.1.1. Format of DOTS Reference Identifier Option
The DHCPv6 DOTS option is used to configure a name of the DOTS The DHCPv6 DOTS option is used to configure a name of the DOTS
server. The format of this option is shown in Figure 2. server. The format of this option is shown in Figure 2.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_V6_DOTS | Option-length | | OPTION_V6_DOTS_RI | Option-length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | | |
| dots-server-name (FQDN) | | dots-server-name (FQDN) |
| | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: DHCPv6 DOTS Reference Identifier option Figure 2: DHCPv6 DOTS Reference Identifier Option
The fields of the option shown in Figure 2 are as follows: The fields of the option shown in Figure 2 are as follows:
o Option-code: OPTION_V6_DOTS_RI (TBA1, see Section 9.1) o Option-code: OPTION_V6_DOTS_RI (TBA1, see Section 9.1)
o Option-length: Length of the dots-server-name field in octets. o Option-length: Length of the dots-server-name field in octets.
o dots-server-name: A fully qualified domain name of the DOTS o dots-server-name: A fully qualified domain name of the DOTS
server. This field is formatted as specified in Section 10 of server. This field is formatted as specified in Section 10 of
[RFC8415]. [RFC8415].
An example of the dots-server-name encoding is shown in Figure 3. An example of the dots-server-name encoding is shown in Figure 3.
This example conveys the FQDN "dots.example.com.". This example conveys the FQDN "dots.example.com.".
+------+------+------+------+------+------+------+------+------+ +------+------+------+------+------+------+------+------+------+
| 0x04 | d | o | t | s | 0x07 | e | x | a | | 0x04 | d | o | t | s | 0x07 | e | x | a |
+------+------+------+------+------+------+------+------+------+ +------+------+------+------+------+------+------+------+------+
| m | p | l | e | 0x03 | c | o | m | 0x00 | | m | p | l | e | 0x03 | c | o | m | 0x00 |
+------+------+------+------+------+------+------+------+------+ +------+------+------+------+------+------+------+------+------+
Figure 3: An example of the dots-server-name encoding Figure 3: An example of the dots-server-name Encoding
5.1.2. Format of DOTS Address Option 5.1.2. Format of DOTS Address Option
The DHCPv6 DOTS option can be used to configure a list of IPv6 The DHCPv6 DOTS option can be used to configure a list of IPv6
addresses of a DOTS server. The format of this option is shown in addresses of a DOTS server. The format of this option is shown in
Figure 4. As a reminder, this format follows the guidelines for Figure 4. As a reminder, this format follows the guidelines for
creating new DHCPv6 options (Section 5.1 of [RFC7227]). creating new DHCPv6 options (Section 5.1 of [RFC7227]).
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_V6_DOTS | Option-length | | OPTION_V6_DOTS_ADDRESS | Option-length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | | |
| DOTS ipv6-address | | DOTS ipv6-address |
| | | |
| | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | | |
| DOTS ipv6-address | | DOTS ipv6-address |
| | | |
| | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 4: DHCPv6 DOTS Address option Figure 4: DHCPv6 DOTS Address Option
The fields of the option shown in Figure 4 are as follows: The fields of the option shown in Figure 4 are as follows:
o Option-code: OPTION_V6_DOTS_ADDRESS (TBA2, see Section 9.1) o Option-code: OPTION_V6_DOTS_ADDRESS (TBA2, see Section 9.1)
o Option-length: Length of the 'DOTS ipv6-address(es)' field in o Option-length: Length of the 'DOTS ipv6-address(es)' field in
octets. MUST be a multiple of 16. octets. MUST be a multiple of 16.
o DOTS ipv6-address: Includes one or more IPv6 addresses [RFC4291] o DOTS ipv6-address: Includes one or more IPv6 addresses [RFC4291]
of the DOTS server to be used by the DOTS client. of the DOTS server to be used by the DOTS client.
Note, IPv4-mapped IPv6 addresses (Section 2.5.5.2 of [RFC4291]) Note, IPv4-mapped IPv6 addresses (Section 2.5.5.2 of [RFC4291])
skipping to change at page 9, line 47 skipping to change at page 9, line 47
5.1.3. DHCPv6 Client Behavior 5.1.3. DHCPv6 Client Behavior
DHCP clients MAY request options OPTION_V6_DOTS_RI and DHCP clients MAY request options OPTION_V6_DOTS_RI and
OPTION_V6_DOTS_ADDRESS, as defined in [RFC8415], Sections 18.2.1, OPTION_V6_DOTS_ADDRESS, as defined in [RFC8415], Sections 18.2.1,
18.2.2, 18.2.4, 18.2.5, 18.2.6, and 21.7. As a convenience to the 18.2.2, 18.2.4, 18.2.5, 18.2.6, and 21.7. As a convenience to the
reader, it is mentioned here that the DHCP client includes the reader, it is mentioned here that the DHCP client includes the
requested option codes in the Option Request Option. requested option codes in the Option Request Option.
If the DHCP client receives more than one instance of If the DHCP client receives more than one instance of
OPTION_V6_DOTS_RI (resp. OPTION_V6_DOTS_ADDRESS) option, it MUST use OPTION_V6_DOTS_RI (or OPTION_V6_DOTS_ADDRESS) option, it MUST use
only the first instance of that option. only the first instance of that option.
If the DHCP client receives both OPTION_V6_DOTS_RI and If the DHCP client receives both OPTION_V6_DOTS_RI and
OPTION_V6_DOTS_ADDRESS, the content of OPTION_V6_DOTS_RI is used as OPTION_V6_DOTS_ADDRESS, the content of OPTION_V6_DOTS_RI is used as
reference identifier for authentication purposes (e.g., PKIX reference identifier for authentication purposes (e.g., PKIX
[RFC6125]), while the addresses included in OPTION_V6_DOTS_ADDRESS [RFC6125]), while the addresses included in OPTION_V6_DOTS_ADDRESS
are used to reach the DOTS server. In other words, the name conveyed are used to reach the DOTS server. In other words, the name conveyed
in OPTION_V6_DOTS_RI MUST NOT be passed to underlying resolution in OPTION_V6_DOTS_RI MUST NOT be passed to underlying resolution
library in the presence of OPTION_V6_DOTS_ADDRESS in a response. library in the presence of OPTION_V6_DOTS_ADDRESS in a response.
skipping to change at page 10, line 41 skipping to change at page 10, line 41
server. The format of this option is illustrated in Figure 5. server. The format of this option is illustrated in Figure 5.
Code Length DOTS server name Code Length DOTS server name
+-----+-----+-----+-----+-----+-----+-----+-- +-----+-----+-----+-----+-----+-----+-----+--
|TBA3 | n | s1 | s2 | s3 | s4 | s5 | ... |TBA3 | n | s1 | s2 | s3 | s4 | s5 | ...
+-----+-----+-----+-----+-----+-----+-----+-- +-----+-----+-----+-----+-----+-----+-----+--
The values s1, s2, s3, etc. represent the domain name labels in the The values s1, s2, s3, etc. represent the domain name labels in the
domain name encoding. domain name encoding.
Figure 5: DHCPv4 DOTS Reference Identifier option Figure 5: DHCPv4 DOTS Reference Identifier Option
The fields of the option shown in Figure 5 are as follows: The fields of the option shown in Figure 5 are as follows:
o Code: OPTION_V4_DOTS_RI (TBA3, see Section 9.2); o Code: OPTION_V4_DOTS_RI (TBA3, see Section 9.2);
o Length: Includes the length of the "DOTS server name" field in o Length: Includes the length of the "DOTS server name" field in
octets; the maximum length is 255 octets. octets; the maximum length is 255 octets.
o DOTS server name: The domain name of the DOTS server. This field o DOTS server name: The domain name of the DOTS server. This field
is formatted as specified in Section 10 of [RFC8415]. is formatted as specified in Section 10 of [RFC8415].
5.2.2. Format Format of DOTS Address Option 5.2.2. Format of DOTS Address Option
The DHCPv4 DOTS option can be used to configure a list of IPv4 The DHCPv4 DOTS option can be used to configure a list of IPv4
addresses of a DOTS server. The format of this option is illustrated addresses of a DOTS server. The format of this option is illustrated
in Figure 6. in Figure 6.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code=TBA4 | Length | | Code=TBA4 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| List-Length | List of | | List-Length | List of |
skipping to change at page 11, line 30 skipping to change at page 11, line 30
+-+-+-+-+-+-+-+-+ DOTS | | +-+-+-+-+-+-+-+-+ DOTS | |
/ IPv4 Addresses / | / IPv4 Addresses / |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
. ... . optional . ... . optional
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| List-Length | List of | | | List-Length | List of | |
+-+-+-+-+-+-+-+-+ DOTS | | +-+-+-+-+-+-+-+-+ DOTS | |
/ IPv4 Addresses / | / IPv4 Addresses / |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ --- +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ---
Figure 6: DHCPv4 DOTS Address option Figure 6: DHCPv4 DOTS Address Option
The fields of the option shown in Figure 6 are as follows: The fields of the option shown in Figure 6 are as follows:
o Code: OPTION_V4_DOTS_ADDRESS (TBA4, see Section 9.2); o Code: OPTION_V4_DOTS_ADDRESS (TBA4, see Section 9.2);
o Length: Length of all included data in octets. The minimum length o Length: Length of all included data in octets. The minimum length
is 5. is 5.
o List-Length: Length of the "List of DOTS IPv4 Addresses" field in o List-Length: Length of the "List of DOTS IPv4 Addresses" field in
octets; MUST be a multiple of 4. octets; MUST be a multiple of 4.
o List of DOTS IPv4 Addresses: Contains one or more IPv4 addresses o List of DOTS IPv4 Addresses: Contains one or more IPv4 addresses
of the DOTS server to be used by the DOTS client. The format of of the DOTS server to be used by the DOTS client. The format of
this field is shown in Figure 7. this field is shown in Figure 7.
o OPTION_V4_DOTS can include multiple lists of DOTS IPv4 addresses; o OPTION_V4_DOTS_ADDRESS can include multiple lists of DOTS IPv4
each list is treated separately as it corresponds to a given DOTS addresses; each list is treated separately as it corresponds to a
server. given DOTS server.
When several lists of DOTS IPv4 addresses are to be included, When several lists of DOTS IPv4 addresses are to be included,
"List-Length" and "DOTS IPv4 Addresses" fields are repeated. "List-Length" and "DOTS IPv4 Addresses" fields are repeated.
0 8 16 24 32 40 48 0 8 16 24 32 40 48
+-----+-----+-----+-----+-----+-----+-- +-----+-----+-----+-----+-----+-----+--
| a1 | a2 | a3 | a4 | a1 | a2 | ... | a1 | a2 | a3 | a4 | a1 | a2 | ...
+-----+-----+-----+-----+-----+-----+-- +-----+-----+-----+-----+-----+-----+--
IPv4 Address 1 IPv4 Address 2 ... IPv4 Address 1 IPv4 Address 2 ...
This format assumes that an IPv4 address is encoded as a1.a2.a3.a4. This format assumes that an IPv4 address is encoded as a1.a2.a3.a4.
Figure 7: Format of the List of DOTS IPv4 Addresses Figure 7: Format of the List of DOTS IPv4 Addresses
OPTION_V4_DOTS is a concatenation-requiring option. As such, the OPTION_V4_DOTS_ADDRESS is a concatenation-requiring option. As such,
mechanism specified in [RFC3396] MUST be used if OPTION_V4_DOTS the mechanism specified in [RFC3396] MUST be used if
exceeds the maximum DHCPv4 option size of 255 octets. OPTION_V4_DOTS_ADDRESS exceeds the maximum DHCPv4 option size of 255
octets.
5.2.3. DHCPv4 Client Behavior 5.2.3. DHCPv4 Client Behavior
To discover a DOTS server, the DHCPv4 client MUST include both To discover a DOTS server, the DHCPv4 client MUST include both
OPTION_V4_DOTS_RI and OPTION_V4_DOTS_ADDRESS in a Parameter Request OPTION_V4_DOTS_RI and OPTION_V4_DOTS_ADDRESS in a Parameter Request
List Option [RFC2132]. List Option [RFC2132].
If the DHCP client receives more than one instance of If the DHCP client receives more than one instance of
OPTION_V4_DOTS_RI (resp. OPTION_V4_DOTS_ADDRESS) option, it MUST use OPTION_V4_DOTS_RI (or OPTION_V4_DOTS_ADDRESS) option, it MUST use
only the first instance of that option. only the first instance of that option.
If the DHCP client receives both OPTION_V4_DOTS_RI and If the DHCP client receives both OPTION_V4_DOTS_RI and
OPTION_V4_DOTS_ADDRESS, the content of OPTION_V6_DOTS_RI is used as OPTION_V4_DOTS_ADDRESS, the content of OPTION_V6_DOTS_RI is used as
reference identifier for authentication purposes, while the addresses reference identifier for authentication purposes, while the addresses
included in OPTION_V4_DOTS_ADDRESS are used to reach the DOTS server. included in OPTION_V4_DOTS_ADDRESS are used to reach the DOTS server.
In other words, the name conveyed in OPTION_V4_DOTS_RI MUST NOT be In other words, the name conveyed in OPTION_V4_DOTS_RI MUST NOT be
passed to underlying resolution library in the presence of passed to underlying resolution library in the presence of
OPTION_V4_DOTS_ADDRESS in a response. OPTION_V4_DOTS_ADDRESS in a response.
skipping to change at page 16, line 16 skipping to change at page 16, line 16
9. IANA Considerations 9. IANA Considerations
IANA is requested to allocate the SRV service name of "_dots._signal" IANA is requested to allocate the SRV service name of "_dots._signal"
for DOTS signal channel over UDP or TCP, and the service name of for DOTS signal channel over UDP or TCP, and the service name of
"_dots._data" for DOTS data channel over TCP. "_dots._data" for DOTS data channel over TCP.
9.1. DHCPv6 Option 9.1. DHCPv6 Option
IANA is requested to assign the following new DHCPv6 Option Code in IANA is requested to assign the following new DHCPv6 Option Code in
the registry maintained in http://www.iana.org/assignments/ the registry maintained in: http://www.iana.org/assignments/
dhcpv6-parameters: dhcpv6-parameters.
Option Name Value Value Description Client ORO Singleton Option
---------------------- ----- TBD1 OPTION_V6_DOTS_RI Yes Yes
OPTION_V6_DOTS_RI TBA1 TBD2 OPTION_V6_DOTS_ADDRESS Yes No
OPTION_V6_DOTS_ADDRESS TBA2
9.2. DHCPv4 Option 9.2. DHCPv4 Option
IANA is requested to assign the following new DHCPv4 Option Code in IANA is requested to assign the following new DHCPv4 Option Code in
the registry maintained in http://www.iana.org/assignments/bootp- the registry maintained in: http://www.iana.org/assignments/bootp-
dhcp-parameters/: dhcp-parameters/.
Option Name Value Data length Meaning Option Name Value Data length Meaning
---------------------- ----- ------------ --------------------------- ---------------------- ----- ------------ ---------------------------
OPTION_V4_DOTS_RI TBA3 Variable; Includes the name of the OPTION_V4_DOTS_RI TBA3 Variable; Includes the name of the
the maximum DOTS server. the maximum DOTS server.
length is length is
255 octets. 255 octets.
OPTION_V4_DOTS_ADDRESS TBA4 Variable; Includes one or multiple OPTION_V4_DOTS_ADDRESS TBA4 Variable; Includes one or multiple
the minimum lists of DOTS IP addresses; the minimum lists of DOTS IP addresses;
length is 5. each list is treated as a length is 5. each list is treated as a
skipping to change at page 17, line 47 skipping to change at page 17, line 47
10. Acknowledgements 10. Acknowledgements
Thanks to Brian Carpenter for the review of the BRSKI text. Thanks to Brian Carpenter for the review of the BRSKI text.
Many thanks to Russ White for the review, comments, and text Many thanks to Russ White for the review, comments, and text
contribution. contribution.
Thanks for Dan Wing and Pei Wei for the review and comments. Thanks for Dan Wing and Pei Wei for the review and comments.
Thanks to Bernie Volz for the review of the DHCP section.
11. References 11. References
11.1. Normative References 11.1. Normative References
[I-D.ietf-dots-signal-channel] [I-D.ietf-dots-signal-channel]
K, R., Boucadair, M., Patil, P., Mortensen, A., and N. K, R., Boucadair, M., Patil, P., Mortensen, A., and N.
Teague, "Distributed Denial-of-Service Open Threat Teague, "Distributed Denial-of-Service Open Threat
Signaling (DOTS) Signal Channel Specification", draft- Signaling (DOTS) Signal Channel Specification", draft-
ietf-dots-signal-channel-31 (work in progress), March ietf-dots-signal-channel-31 (work in progress), March
2019. 2019.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
skipping to change at page 19, line 37 skipping to change at page 19, line 41
Open Threat Signaling (DOTS) Data Channel Specification", Open Threat Signaling (DOTS) Data Channel Specification",
draft-ietf-dots-data-channel-28 (work in progress), March draft-ietf-dots-data-channel-28 (work in progress), March
2019. 2019.
[I-D.ietf-dots-multihoming] [I-D.ietf-dots-multihoming]
Boucadair, M. and R. K, "Multi-homing Deployment Boucadair, M. and R. K, "Multi-homing Deployment
Considerations for Distributed-Denial-of-Service Open Considerations for Distributed-Denial-of-Service Open
Threat Signaling (DOTS)", draft-ietf-dots-multihoming-01 Threat Signaling (DOTS)", draft-ietf-dots-multihoming-01
(work in progress), January 2019. (work in progress), January 2019.
[I-D.ietf-dots-signal-call-home]
K, R., Boucadair, M., and J. Shallow, "Distributed Denial-
of-Service Open Threat Signaling (DOTS) Signal Channel
Call Home", draft-ietf-dots-signal-call-home-01 (work in
progress), April 2019.
[I-D.ietf-dots-use-cases] [I-D.ietf-dots-use-cases]
Dobbins, R., Migault, D., Fouant, S., Moskowitz, R., Dobbins, R., Migault, D., Fouant, S., Moskowitz, R.,
Teague, N., Xia, L., and K. Nishizuka, "Use cases for DDoS Teague, N., Xia, L., and K. Nishizuka, "Use cases for DDoS
Open Threat Signaling", draft-ietf-dots-use-cases-17 (work Open Threat Signaling", draft-ietf-dots-use-cases-17 (work
in progress), January 2019. in progress), January 2019.
[I-D.ietf-netconf-zerotouch] [I-D.ietf-netconf-zerotouch]
Watsen, K., Abrahamsson, M., and I. Farrer, "Secure Zero Watsen, K., Abrahamsson, M., and I. Farrer, "Secure Zero
Touch Provisioning (SZTP)", draft-ietf-netconf- Touch Provisioning (SZTP)", draft-ietf-netconf-
zerotouch-29 (work in progress), January 2019. zerotouch-29 (work in progress), January 2019.
 End of changes. 26 change blocks. 
32 lines changed or deleted 45 lines changed or added

This html diff was produced by rfcdiff 1.47. The latest version is available from http://tools.ietf.org/tools/rfcdiff/