< draft-ietf-dots-server-discovery-04.txt   draft-ietf-dots-server-discovery-05.txt >
DOTS M. Boucadair DOTS M. Boucadair
Internet-Draft Orange Internet-Draft Orange
Intended status: Standards Track T. Reddy Intended status: Standards Track T. Reddy
Expires: December 28, 2019 McAfee Expires: February 6, 2020 McAfee
June 26, 2019 August 5, 2019
Distributed-Denial-of-Service Open Threat Signaling (DOTS) Server Distributed-Denial-of-Service Open Threat Signaling (DOTS) Agent
Discovery Discovery
draft-ietf-dots-server-discovery-04 draft-ietf-dots-server-discovery-05
Abstract Abstract
It may not be possible for a network to determine the cause for an It may not be possible for a network to determine the cause for an
attack, but instead just realize that some resources seem to be under attack, but instead just realize that some resources seem to be under
attack. To fill that gap, Distributed-Denial-of-Service Open Threat attack. To fill that gap, Distributed-Denial-of-Service Open Threat
Signaling (DOTS) allows a network to inform a DOTS server that it is Signaling (DOTS) allows a network to inform a DOTS server that it is
under a potential attack so that appropriate mitigation actions are under a potential attack so that appropriate mitigation actions are
undertaken. undertaken.
skipping to change at page 1, line 41 skipping to change at page 1, line 41
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on December 28, 2019. This Internet-Draft will expire on February 6, 2020.
Copyright Notice Copyright Notice
Copyright (c) 2019 IETF Trust and the persons identified as the Copyright (c) 2019 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Why Multiple Discovery Mechanisms? . . . . . . . . . . . . . 4 3. Why Multiple Discovery Mechanisms? . . . . . . . . . . . . . 5
4. Unified DOTS Discovery Procedure . . . . . . . . . . . . . . 5 4. Unified DOTS Discovery Procedure . . . . . . . . . . . . . . 6
5. DHCP Options for DOTS Agent Discovery . . . . . . . . . . . . 7 5. DHCP Options for DOTS Agent Discovery . . . . . . . . . . . . 8
5.1. DHCPv6 DOTS Options . . . . . . . . . . . . . . . . . . . 8 5.1. DHCPv6 DOTS Options . . . . . . . . . . . . . . . . . . . 8
5.1.1. Format of DOTS Reference Identifier Option . . . . . 8 5.1.1. Format of DOTS Reference Identifier Option . . . . . 8
5.1.2. Format of DOTS Address Option . . . . . . . . . . . . 8 5.1.2. Format of DOTS Address Option . . . . . . . . . . . . 9
5.1.3. DHCPv6 Client Behavior . . . . . . . . . . . . . . . 9 5.1.3. DHCPv6 Client Behavior . . . . . . . . . . . . . . . 10
5.2. DHCPv4 DOTS Options . . . . . . . . . . . . . . . . . . . 10 5.2. DHCPv4 DOTS Options . . . . . . . . . . . . . . . . . . . 11
5.2.1. Format of DOTS Reference Identifier Option . . . . . 10 5.2.1. Format of DOTS Reference Identifier Option . . . . . 11
5.2.2. Format of DOTS Address Option . . . . . . . . . . . . 11 5.2.2. Format of DOTS Address Option . . . . . . . . . . . . 12
5.2.3. DHCPv4 Client Behavior . . . . . . . . . . . . . . . 12 5.2.3. DHCPv4 Client Behavior . . . . . . . . . . . . . . . 12
6. Discovery using Service Resolution . . . . . . . . . . . . . 13 6. Discovery using Service Resolution . . . . . . . . . . . . . 13
7. DNS Service Discovery . . . . . . . . . . . . . . . . . . . . 15 7. DNS Service Discovery . . . . . . . . . . . . . . . . . . . . 15
8. Security Considerations . . . . . . . . . . . . . . . . . . . 16 8. Security Considerations . . . . . . . . . . . . . . . . . . . 16
8.1. DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . 16 8.1. DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . 16
8.2. Service Resolution . . . . . . . . . . . . . . . . . . . 16 8.2. Service Resolution . . . . . . . . . . . . . . . . . . . 16
8.3. DNS Service Discovery . . . . . . . . . . . . . . . . . . 16 8.3. DNS Service Discovery . . . . . . . . . . . . . . . . . . 16
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 17 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 17
9.1. DHCPv6 Option . . . . . . . . . . . . . . . . . . . . . . 17 9.1. DHCPv6 Option . . . . . . . . . . . . . . . . . . . . . . 17
9.2. DHCPv4 Option . . . . . . . . . . . . . . . . . . . . . . 17 9.2. DHCPv4 Option . . . . . . . . . . . . . . . . . . . . . . 17
skipping to change at page 3, line 22 skipping to change at page 3, line 22
involved actors and network domains inhibits the effectiveness of involved actors and network domains inhibits the effectiveness of
DDoS attack mitigation, DOTS signal channel protocol DDoS attack mitigation, DOTS signal channel protocol
[I-D.ietf-dots-signal-channel] is meant to carry requests for DDoS [I-D.ietf-dots-signal-channel] is meant to carry requests for DDoS
attack mitigation, thereby reducing the impact of an attack and attack mitigation, thereby reducing the impact of an attack and
leading to more efficient defensive actions in various deployment leading to more efficient defensive actions in various deployment
scenarios such as those discussed in [I-D.ietf-dots-use-cases]. scenarios such as those discussed in [I-D.ietf-dots-use-cases].
Moreover, DOTS clients can instruct a DOTS server to install Moreover, DOTS clients can instruct a DOTS server to install
filtering rules by means of DOTS data channel filtering rules by means of DOTS data channel
[I-D.ietf-dots-data-channel]. [I-D.ietf-dots-data-channel].
The basic high-level DOTS architecture is illustrated in Figure 1 The basic high-level DOTS architecture is illustrated in Figure 1:
([I-D.ietf-dots-architecture]):
+-----------+ +-------------+ +-----------+ +-------------+
| Mitigator | ~~~~~~~~~~ | DOTS Server | | Mitigator | ~~~~~~~~~~ | DOTS Server |
+-----------+ +-------------+ +-----------+ +------+------+
| |
| |
| |
+---------------+ +-------------+ +---------------+ +------+------+
| Attack Target | ~~~~~~ | DOTS Client | | Attack Target | ~~~~~~ | DOTS Client |
+---------------+ +-------------+ +---------------+ +-------------+
Figure 1: Basic DOTS Architecture Figure 1: Basic DOTS Architecture
[I-D.ietf-dots-architecture] specifies that the DOTS client may be [I-D.ietf-dots-architecture] specifies that the DOTS client may be
provided with a list of DOTS servers; each associated with one or provided with a list of DOTS servers; each associated with one or
more IP addresses. These addresses may or may not be of the same more IP addresses. These addresses may or may not be of the same
address family. The DOTS client establishes one or more DOTS address family. The DOTS client establishes one or more DOTS
sessions by connecting to the provided DOTS server addresses. sessions by connecting to the provided DOTS server addresses.
This document specifies methods for DOTS clients to discover their This document specifies methods for DOTS clients to discover their
DOTS server(s). The rationale for specifying multiple discovery DOTS server(s). The rationale for specifying multiple discovery
mechanisms is discussed in Section 3. mechanisms is discussed in Section 3.
The discovery methods can also be used by a DOTS server to locate a The discovery methods can also be used by a DOTS server to locate a
DOTS client in the context of DOTS Signal Channel Call Home DOTS client in the context of DOTS Signal Channel Call Home
[I-D.ietf-dots-signal-call-home]. [I-D.ietf-dots-signal-call-home]. The basic high-level DOTS Call
Home architecture is illustrated in Figure 2:
+---------------+ +-------------+
| Alert/DMS/ | ~~~~~~ | Call Home |
| Peer DMS/... | | DOTS client |
+---------------+ +------+------+
|
|
|
+---------------+ +------+------+
| Attack | ~~~~~~ | Call Home |
| Source(s) | | DOTS server |
+---------------+ +-------------+
Figure 2: Basic DOTS Signal Channel Call Home Functional Architecture
A DOTS agent may be used to establish base DOTS channels, DOTS Call
Home, or both. This specification accommodates all these deployment
cases.
Considerations for the selection of DOTS server(s) by multi-homed Considerations for the selection of DOTS server(s) by multi-homed
DOTS clients is out of scope; the reader should refer to DOTS clients is out of scope; the reader should refer to
[I-D.ietf-dots-multihoming] for more details. [I-D.ietf-dots-multihoming] for more details.
This document assumes that security credentials to authenticate DOTS This document assumes that security credentials to authenticate DOTS
server(s) are provisioned to a DOTS client using a variety of means server(s) are provisioned to a DOTS client using a variety of means
such as (but not limited to) those discussed in such as (but not limited to) those discussed in
[I-D.ietf-netconf-zerotouch] or [I-D.ietf-netconf-zerotouch] or
[I-D.ietf-anima-bootstrapping-keyinfra]. DOTS clients use those [I-D.ietf-anima-bootstrapping-keyinfra]. DOTS clients use those
skipping to change at page 4, line 26 skipping to change at page 4, line 44
2. Terminology 2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP "OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119][RFC8174] when, and only when, they appear in all 14 [RFC2119][RFC8174] when, and only when, they appear in all
capitals, as shown here. capitals, as shown here.
The reader should be familiar with the terms defined in The reader should be familiar with the terms defined in
[I-D.ietf-dots-architecture] and [RFC3958]. [I-D.ietf-dots-architecture], [RFC3958], and
[I-D.ietf-dots-signal-call-home].
DHCP refers to both DHCPv4 [RFC2131] and DHCPv6 [RFC8415]. DHCP refers to both DHCPv4 [RFC2131] and DHCPv6 [RFC8415].
"Peer DOTS agent" refers to the peer DOTS server (normal DOTS "Peer DOTS agent" refers to the peer DOTS server (base DOTS
operation) or to a peer DOTS client (for DOTS Signal Channel Call operation) or to a peer Call Home DOTS client (for DOTS Signal
Home). Channel Call Home).
3. Why Multiple Discovery Mechanisms? 3. Why Multiple Discovery Mechanisms?
It is tempting to specify one single discovery mechanism for DOTS. It is tempting to specify one single discovery mechanism for DOTS.
Nevertheless, the analysis of the various use cases sketched in Nevertheless, the analysis of the various use cases sketched in
[I-D.ietf-dots-use-cases] reveals that it is unlikely that one single [I-D.ietf-dots-use-cases] reveals that it is unlikely that one single
discovery method can be suitable for all the sample deployments. discovery method can be suitable for all the sample deployments.
Concretely: Concretely:
o Many use cases discussed in [I-D.ietf-dots-use-cases] do involve a o Many use cases discussed in [I-D.ietf-dots-use-cases] do involve a
skipping to change at page 6, line 13 skipping to change at page 6, line 33
some devices prefer manual configuration over dynamic discovery, some devices prefer manual configuration over dynamic discovery,
while others prefer dynamic discovery over manual configuration, the while others prefer dynamic discovery over manual configuration, the
result will be a process of "whack-a-mole", where the operator must result will be a process of "whack-a-mole", where the operator must
find devices that are using the wrong DOTS server(s), determine how find devices that are using the wrong DOTS server(s), determine how
to ensure the devices are configured properly, and then reconfigure to ensure the devices are configured properly, and then reconfigure
the device through the preferred method. the device through the preferred method.
All DOTS clients MUST support at least one of the three mechanisms All DOTS clients MUST support at least one of the three mechanisms
below to determine a DOTS server list. All DOTS clients SHOULD below to determine a DOTS server list. All DOTS clients SHOULD
implement all three, or as many as are practical for any specific implement all three, or as many as are practical for any specific
device, of these ways to discover DOTS servers, in order to device (e.g., a CPE will support the first two mechanisms, a host
facilitate the deployment of DOTS in large scale environments: within a LAN will support the last two mechanisms, or an application
server will support a local configuration. More samples are
discussed in Section 3), of these ways to discover DOTS servers, in
order to facilitate the deployment of DOTS in large scale
environments:
1. Explicit configuration: 1. Explicit configuration:
* Local/Manual configuration: A DOTS client, will learn the DOTS * Local/Manual configuration: A DOTS client, will learn the DOTS
server(s) by means of local or manual DOTS configuration server(s) by means of local or manual DOTS configuration
(i.e., DOTS servers configured at the system level). (i.e., DOTS servers configured at the system level).
Configuration discovered from a DOTS client application is Configuration discovered from a DOTS client application is
considered as local configuration. considered as local configuration.
An implementation may give the user an opportunity (e.g., by An implementation may give the user an opportunity (e.g., by
means of configuration file options or menu items) to specify means of configuration file options or menu items) to specify
DOTS server(s) for each address family. These MAY be DOTS server(s) for each address family. These may be
specified either as IP addresses or the DNS name of a DOTS specified either as IP addresses or the DNS name of a DOTS
server. When only DOTS server's IP addresses are configured, server. When only DOTS server's IP addresses are configured,
a reference identifier must also be configured for a reference identifier must also be configured for
authentication purposes. authentication purposes.
* Automatic configuration (e.g., DHCP, an automation system): * Automatic configuration (e.g., DHCP, an automation system):
The DOTS client attempts to discover DOTS server(s) names and/ The DOTS client attempts to discover DOTS server(s) names and/
or addresses from DHCP, as described in Section 5. or addresses from DHCP, as described in Section 5.
2. Service Resolution : The DOTS client attempts to discover DOTS 2. Service Resolution : The DOTS client attempts to discover DOTS
skipping to change at page 7, line 7 skipping to change at page 7, line 30
address(es) of the DOTS server, while others imply an IP address of address(es) of the DOTS server, while others imply an IP address of
the relevant DOTS server is obtained directly. Implementation the relevant DOTS server is obtained directly. Implementation
options may vary on a per device basis, as some devices may not have options may vary on a per device basis, as some devices may not have
DNS capabilities and/or proper configuration. DNS capabilities and/or proper configuration.
DOTS clients will prefer information received from the discovery DOTS clients will prefer information received from the discovery
methods in the order listed. methods in the order listed.
On hosts with more than one interface or address family (IPv4/v6), On hosts with more than one interface or address family (IPv4/v6),
the DOTS server discovery procedure has to be performed for each the DOTS server discovery procedure has to be performed for each
combination of interface and address family. A client MAY choose to combination of interface and address family. A DOTS client may
perform the discovery procedure only for a desired interface/address choose to perform the discovery procedure only for a desired
combination if the client does not wish to discover a DOTS server for interface/address combination if the client does not wish to discover
all combinations of interface and address family. a DOTS server for all combinations of interface and address family.
The above procedure MUST also be followed by a DOTS gateway. This procedure is also followed by a Call Home DOTS server to
Likewise, this procedure MUST be followed by a DOTS server in the discover its Call Home DOTS client in the context of
context of DOTS Signal Channel Call Home
[I-D.ietf-dots-signal-call-home]. [I-D.ietf-dots-signal-call-home].
The discovery method MUST be reiterated upon the following events: The discovery method is reiterated by a DOTS agent upon the following
events:
o Expiry of a lease associated with a discovered DOTS server. o Expiry of a lease associated with a discovered DOTS agent.
o Expiry of a DOTS server's certificate currently in use. o Expiry of a peer DOTS agent's certificate currently in use.
o Attachment to a new network. o Attachment to a new network.
5. DHCP Options for DOTS Agent Discovery 5. DHCP Options for DOTS Agent Discovery
As reported in Section 1.7.2 of [RFC6125]: As reported in Section 1.7.2 of [RFC6125]:
"few certification authorities issue server certificates based on "few certification authorities issue server certificates based on
IP addresses, but preliminary evidence indicates that such IP addresses, but preliminary evidence indicates that such
certificates are a very small percentage (less than 1%) of issued certificates are a very small percentage (less than 1%) of issued
skipping to change at page 8, line 5 skipping to change at page 8, line 32
dependency on an underlying name resolution, but that design requires dependency on an underlying name resolution, but that design requires
to also supply a name for PKIX-based authentication purposes. to also supply a name for PKIX-based authentication purposes.
The design assumes that the same peer DOTS agent is used for The design assumes that the same peer DOTS agent is used for
establishing both signal and data channels. For more customized establishing both signal and data channels. For more customized
configurations (e.g., transport-specific configuration, distinct DOTS configurations (e.g., transport-specific configuration, distinct DOTS
servers for the signal and the data channels), an operator can supply servers for the signal and the data channels), an operator can supply
only a DOTS reference identifier that will be then passed to the only a DOTS reference identifier that will be then passed to the
procedure described in Section 6. procedure described in Section 6.
The design allows to terminate the base DOTS channels and DOTS Call
Home on the same or distinct peer DOTS agents. If distinct peer DOTS
agents are deployed, the DHCP option can return, for example, a list
of IP addresses to a requesting DOTS agent. This list includes the
IP address to be used for the base DOTS channels and the IP address
for the DOTS Call Home. The DOTS client (or the Call Home DOTS
server) will then use the address selection specified in Section 4.3
of [I-D.ietf-dots-signal-channel] to identify the IP address of the
peer DOTS server (or Call Home Client).
5.1. DHCPv6 DOTS Options 5.1. DHCPv6 DOTS Options
5.1.1. Format of DOTS Reference Identifier Option 5.1.1. Format of DOTS Reference Identifier Option
The DHCPv6 DOTS Reference Identifier option is used to configure a The DHCPv6 DOTS Reference Identifier option is used to configure a
name of the DOTS server (or the name of the DOTS client for DOTS name of the DOTS server (or the name of the Call Home DOTS client).
Signal Channel Call Home). The format of this option is shown in The format of this option is shown in Figure 3.
Figure 2.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_V6_DOTS_RI | Option-length | | OPTION_V6_DOTS_RI | Option-length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | | |
| dots-agent-name (FQDN) | | dots-agent-name (FQDN) |
| | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: DHCPv6 DOTS Reference Identifier Option Figure 3: DHCPv6 DOTS Reference Identifier Option
The fields of the option shown in Figure 2 are as follows: The fields of the option shown in Figure 3 are as follows:
o Option-code: OPTION_V6_DOTS_RI (TBA1, see Section 9.1) o Option-code: OPTION_V6_DOTS_RI (TBA1, see Section 9.1)
o Option-length: Length of the dots-server-name field in octets. o Option-length: Length of the dots-agent-name field in octets.
o dots-agent-name: A fully qualified domain name of the peer DOTS o dots-agent-name: A fully qualified domain name of the peer DOTS
agent. This field is formatted as specified in Section 10 of agent. This field is formatted as specified in Section 10 of
[RFC8415]. [RFC8415].
An example of the dots-agent-name encoding is shown in Figure 3. An example of the dots-agent-name encoding is shown in Figure 4.
This example conveys the FQDN "dots.example.com.". This example conveys the FQDN "dots.example.com.".
+------+------+------+------+------+------+------+------+------+ +------+------+------+------+------+------+------+------+------+
| 0x04 | d | o | t | s | 0x07 | e | x | a | | 0x04 | d | o | t | s | 0x07 | e | x | a |
+------+------+------+------+------+------+------+------+------+ +------+------+------+------+------+------+------+------+------+
| m | p | l | e | 0x03 | c | o | m | 0x00 | | m | p | l | e | 0x03 | c | o | m | 0x00 |
+------+------+------+------+------+------+------+------+------+ +------+------+------+------+------+------+------+------+------+
Figure 3: An example of the dots-agent-name Encoding Figure 4: An example of the dots-agent-name Encoding
5.1.2. Format of DOTS Address Option 5.1.2. Format of DOTS Address Option
The DHCPv6 DOTS Address option can be used to configure a list of The DHCPv6 DOTS Address option can be used to configure a list of
IPv6 addresses of a DOTS server (or a DOTS client for DOTS Signal IPv6 addresses of a DOTS server (or a Call Home DOTS client). The
Channel Call Home). The format of this option is shown in Figure 4. format of this option is shown in Figure 5. As a reminder, this
As a reminder, this format follows the guidelines for creating new format follows the guidelines for creating new DHCPv6 options
DHCPv6 options (Section 5.1 of [RFC7227]). (Section 5.1 of [RFC7227]).
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_V6_DOTS_ADDRESS | Option-length | | OPTION_V6_DOTS_ADDRESS | Option-length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | | |
| DOTS ipv6-address | | DOTS ipv6-address |
| | | |
| | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | | |
| DOTS ipv6-address | | DOTS ipv6-address |
| | | |
| | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... | | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 4: DHCPv6 DOTS Address Option Figure 5: DHCPv6 DOTS Address Option
The fields of the option shown in Figure 4 are as follows: The fields of the option shown in Figure 5 are as follows:
o Option-code: OPTION_V6_DOTS_ADDRESS (TBA2, see Section 9.1) o Option-code: OPTION_V6_DOTS_ADDRESS (TBA2, see Section 9.1)
o Option-length: Length of the 'DOTS ipv6-address(es)' field in o Option-length: Length of the 'DOTS ipv6-address(es)' field in
octets. MUST be a multiple of 16. octets. MUST be a multiple of 16.
o DOTS ipv6-address: Includes one or more IPv6 addresses [RFC4291] o DOTS ipv6-address: Includes one or more IPv6 addresses [RFC4291]
of the peer DOTS agent to be used by a DOTS agent for establishing of the peer DOTS agent to be used by a DOTS agent for establishing
a DOTS session. a DOTS session.
Note, IPv4-mapped IPv6 addresses (Section 2.5.5.2 of [RFC4291]) Note, IPv4-mapped IPv6 addresses (Section 2.5.5.2 of [RFC4291])
are allowed to be included in this option. are allowed to be included in this option.
To return more than one DOTS agents to the requesting DHCPv6 client,
the DHCPv6 server returns multiple instances of
OPTION_V6_DOTS_ADDRESS.
5.1.3. DHCPv6 Client Behavior 5.1.3. DHCPv6 Client Behavior
DHCP clients MAY request options OPTION_V6_DOTS_RI and DHCP clients MAY request options OPTION_V6_DOTS_RI and
OPTION_V6_DOTS_ADDRESS, as defined in [RFC8415], Sections 18.2.1, OPTION_V6_DOTS_ADDRESS, as defined in [RFC8415], Sections 18.2.1,
18.2.2, 18.2.4, 18.2.5, 18.2.6, and 21.7. As a convenience to the 18.2.2, 18.2.4, 18.2.5, 18.2.6, and 21.7. As a convenience to the
reader, it is mentioned here that the DHCP client includes the reader, it is mentioned here that the DHCP client includes the
requested option codes in the Option Request Option. requested option codes in the Option Request Option.
If the DHCP client receives more than one instance of If the DHCP client receives more than one instance of
OPTION_V6_DOTS_RI (or OPTION_V6_DOTS_ADDRESS) option, it MUST use OPTION_V6_DOTS_RI (or OPTION_V6_DOTS_ADDRESS) option, it MUST use
skipping to change at page 10, line 23 skipping to change at page 11, line 18
If the DHCP client receives OPTION_V6_DOTS_RI only, but If the DHCP client receives OPTION_V6_DOTS_RI only, but
OPTION_V6_DOTS_RI option contains more than one name, as OPTION_V6_DOTS_RI option contains more than one name, as
distinguished by the presence of multiple root labels, the DHCP distinguished by the presence of multiple root labels, the DHCP
client MUST use only the first name. Once the name is validated client MUST use only the first name. Once the name is validated
(Section 8 of [RFC8415]), the name is passed to a name resolution (Section 8 of [RFC8415]), the name is passed to a name resolution
library. Moreover, that name is also used as a reference identifier library. Moreover, that name is also used as a reference identifier
for authentication purposes. for authentication purposes.
If the DHCP client receives OPTION_V6_DOTS_ADDRESS only, the If the DHCP client receives OPTION_V6_DOTS_ADDRESS only, the
address(es) included in OPTION_V6_DOTS_ADDRESS is used to reach the address(es) included in OPTION_V6_DOTS_ADDRESS are used to reach the
peer DOTS agent. In addition, these addresses can be used as peer DOTS agent. In addition, these addresses can be used as
identifiers for authentication. identifiers for authentication.
The DHCP client MUST silently discard multicast and host loopback The DHCP client MUST silently discard multicast and host loopback
addresses [RFC6890] conveyed in OPTION_V6_DOTS_ADDRESS. addresses [RFC6890] conveyed in OPTION_V6_DOTS_ADDRESS.
5.2. DHCPv4 DOTS Options 5.2. DHCPv4 DOTS Options
5.2.1. Format of DOTS Reference Identifier Option 5.2.1. Format of DOTS Reference Identifier Option
The DHCPv4 DOTS Reference Identifier option is used to configure a The DHCPv4 DOTS Reference Identifier option is used to configure a
name of the peer DOTS agent. The format of this option is name of the peer DOTS agent. The format of this option is
illustrated in Figure 5. illustrated in Figure 6.
Code Length Peer DOTS agent name Code Length Peer DOTS agent name
+-----+-----+-----+-----+-----+-----+-----+-- +-----+-----+-----+-----+-----+-----+-----+--
|TBA3 | n | s1 | s2 | s3 | s4 | s5 | ... |TBA3 | n | s1 | s2 | s3 | s4 | s5 | ...
+-----+-----+-----+-----+-----+-----+-----+-- +-----+-----+-----+-----+-----+-----+-----+--
The values s1, s2, s3, etc. represent the domain name labels in the The values s1, s2, s3, etc. represent the domain name labels in the
domain name encoding. domain name encoding.
Figure 5: DHCPv4 DOTS Reference Identifier Option Figure 6: DHCPv4 DOTS Reference Identifier Option
The fields of the option shown in Figure 5 are as follows: The fields of the option shown in Figure 6 are as follows:
o Code: OPTION_V4_DOTS_RI (TBA3, see Section 9.2); o Code: OPTION_V4_DOTS_RI (TBA3, see Section 9.2).
o Length: Includes the length of the "DOTS server name" field in o Length: Includes the length of the "Peer DOTS agent name" field in
octets; the maximum length is 255 octets. octets; the maximum length is 255 octets.
o Peer DOTS agent name: The domain name of the peer DOTS agent. o Peer DOTS agent name: The domain name of the peer DOTS agent.
This field is formatted as specified in Section 10 of [RFC8415]. This field is formatted as specified in Section 10 of [RFC8415].
5.2.2. Format of DOTS Address Option 5.2.2. Format of DOTS Address Option
The DHCPv4 DOTS Address option can be used to configure a list of The DHCPv4 DOTS Address option can be used to configure a list of
IPv4 addresses of a peer DOTS agent. The format of this option is IPv4 addresses of a peer DOTS agent. The format of this option is
illustrated in Figure 6. illustrated in Figure 7.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code=TBA4 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| List-Length | List of |
+-+-+-+-+-+-+-+-+ DOTS |
/ IPv4 Addresses /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ---
| List-Length | List of | |
+-+-+-+-+-+-+-+-+ DOTS | |
/ IPv4 Addresses / |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
. ... . optional
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| List-Length | List of | |
+-+-+-+-+-+-+-+-+ DOTS | |
/ IPv4 Addresses / |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ---
Figure 6: DHCPv4 DOTS Address Option
The fields of the option shown in Figure 6 are as follows:
o Code: OPTION_V4_DOTS_ADDRESS (TBA4, see Section 9.2);
o Length: Length of all included data in octets. The minimum length
is 5.
o List-Length: Length of the "List of DOTS IPv4 Addresses" field in
octets; MUST be a multiple of 4.
o List of DOTS IPv4 Addresses: Contains one or more IPv4 addresses
of the peer DOTS agent to be used by a DOTS agent. The format of
this field is shown in Figure 7.
o OPTION_V4_DOTS_ADDRESS can include multiple lists of DOTS IPv4
addresses; each list is treated separately as it corresponds to a
given peer DOTS agent.
When several lists of DOTS IPv4 addresses are to be included, 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
"List-Length" and "DOTS IPv4 Addresses" fields are repeated. +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code=TBA4 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ DOTS IPv4 Address |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ---
| | |
+ DOTS IPv4 Address | |
| | optional
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
. ... . |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ---
0 8 16 24 32 40 48 Figure 7: DHCPv4 DOTS Address Option
+-----+-----+-----+-----+-----+-----+--
| a1 | a2 | a3 | a4 | a1 | a2 | ...
+-----+-----+-----+-----+-----+-----+--
IPv4 Address 1 IPv4 Address 2 ...
This format assumes that an IPv4 address is encoded as a1.a2.a3.a4. The fields of the option shown in Figure 7 are as follows:
Figure 7: Format of the List of DOTS IPv4 Addresses o Code: OPTION_V4_DOTS_ADDRESS (TBA4, see Section 9.2).
o Length: is set to 4*N, where N is the number of IPv4 addresses
included in the option.
o DOTS IPv4 Address(es): Contains one or more IPv4 addresses of the
peer DOTS agent to be used by a DOTS agent.
OPTION_V4_DOTS_ADDRESS is a concatenation-requiring option. As such, OPTION_V4_DOTS_ADDRESS is a concatenation-requiring option. As such,
the mechanism specified in [RFC3396] MUST be used if the mechanism specified in [RFC3396] MUST be used if
OPTION_V4_DOTS_ADDRESS exceeds the maximum DHCPv4 option size of 255 OPTION_V4_DOTS_ADDRESS exceeds the maximum DHCPv4 option size of 255
octets. octets.
5.2.3. DHCPv4 Client Behavior 5.2.3. DHCPv4 Client Behavior
To discover a peer DOTS agent, the DHCPv4 client MUST include both To discover a peer DOTS agent, the DHCPv4 client MUST include both
OPTION_V4_DOTS_RI and OPTION_V4_DOTS_ADDRESS in a Parameter Request OPTION_V4_DOTS_RI and OPTION_V4_DOTS_ADDRESS in a Parameter Request
skipping to change at page 12, line 50 skipping to change at page 13, line 22
If the DHCP client receives OPTION_V4_DOTS_RI only, but If the DHCP client receives OPTION_V4_DOTS_RI only, but
OPTION_V4_DOTS_RI option contains more than one name, as OPTION_V4_DOTS_RI option contains more than one name, as
distinguished by the presence of multiple root labels, the DHCP distinguished by the presence of multiple root labels, the DHCP
client MUST use only the first name. Once the name is validated client MUST use only the first name. Once the name is validated
(Section 10 of [RFC8415]), the name is passed to a name resolution (Section 10 of [RFC8415]), the name is passed to a name resolution
library. Moreover, that name is also used as a reference identifier library. Moreover, that name is also used as a reference identifier
for authentication purposes. for authentication purposes.
If the DHCP client receives OPTION_V4_DOTS_ADDRESS only, the If the DHCP client receives OPTION_V4_DOTS_ADDRESS only, the
address(es) included in OPTION_V4_DOTS_ADDRESS is used to reach the address(es) included in OPTION_V4_DOTS_ADDRESS are used to reach the
peer DOTS server. In addition, these addresses can be used as peer DOTS server. In addition, these addresses can be used as
identifiers for authentication. identifiers for authentication.
The DHCP client MUST silently discard multicast and host loopback The DHCP client MUST silently discard multicast and host loopback
addresses conveyed in OPTION_V4_DOTS_ADDRESS. addresses conveyed in OPTION_V4_DOTS_ADDRESS.
6. Discovery using Service Resolution 6. Discovery using Service Resolution
This mechanism is performed in two steps: This mechanism is performed in two steps:
1. A DNS domain name is retrieved for each combination of interface 1. A DNS domain name is retrieved for each combination of interface
and address family. A DOTS client has to determine the domain in and address family. A DOTS agent has to determine the domain in
which it is located relying on dynamic means such as DHCP which it is located relying on dynamic means such as DHCP
(Section 5) . Implementations MAY allow the user to specify a (Section 5) . Implementations may allow the user to specify a
default name that is used, if no specific name has been default name that is used, if no specific name has been
configured. configured.
2. Retrieved DNS domain names are then used for S-NAPTR lookups 2. Retrieved DNS domain names are then used for S-NAPTR lookups
[RFC3958]. Further DNS lookups may be necessary to determine [RFC3958]. Further DNS lookups may be necessary to determine the
DOTS server IP address(es). peer DOTS agent IP address(es).
Once the DOTS client has retrieved client's DNS domain or discovered Once the DOTS agent has retrieved its DNS domain or discovered the
the peer DOTS agent name that needs to be resolved (e.g., Section 5), peer DOTS agent name that needs to be resolved (e.g., Section 5), an
an S-NAPTR lookup with 'DOTS' application service and the desired S-NAPTR lookup with 'DOTS' application service and the desired
protocol tag is made to obtain information necessary to connect to protocol tag is made to obtain information necessary to connect to
the authoritative DOTS server within the given domain. the authoritative peer DOTS agent within the given domain.
This specification defines "DOTS" and "DOTS-CALL-HOME" as application This specification defines "DOTS" and "DOTS-CALL-HOME" as application
service tags (Sections 9.3.1 and 9.3.2). It also defines service tags (Sections 9.3.1 and 9.3.2). It also defines
"signal.udp" (Section 9.3.3), "signal.tcp" (Section 9.3.4), and "signal.udp" (Section 9.3.3), "signal.tcp" (Section 9.3.4), and
"data.tcp" (Section 9.3.5) as application protocol tags. An example "data.tcp" (Section 9.3.5) as application protocol tags. An example
is provided in Figure 8. is provided in Figure 8.
In the example below, for domain 'example.net', the resolution In the example below, for domain 'example.net', the resolution
algorithm will result in IP address(es), port, tag and protocol algorithm will result in IP address(es), port, tag and protocol
tuples as follows: tuples as follows:
skipping to change at page 16, line 34 skipping to change at page 16, line 34
considered valid according to the [I-D.ietf-dots-signal-channel]. considered valid according to the [I-D.ietf-dots-signal-channel].
8.1. DHCP 8.1. DHCP
The security considerations in [RFC2131] and [RFC8415] are to be The security considerations in [RFC2131] and [RFC8415] are to be
considered. considered.
8.2. Service Resolution 8.2. Service Resolution
The primary attack against the methods described in Section 6 is one The primary attack against the methods described in Section 6 is one
that would lead to impersonation of a DOTS server. An attacker could that would lead to impersonation of a peer DOTS agent. An attacker
attempt to compromise the S-NAPTR resolution. The use of mutual could attempt to compromise the S-NAPTR resolution. The use of
authentication makes it difficult to redirect a DOTS client to an mutual authentication makes it difficult to redirect a DOTS client
illegitimate DOTS server. (or a Call Home DOTS server) to an illegitimate DOTS server (or a
Call Home DOTS client).
8.3. DNS Service Discovery 8.3. DNS Service Discovery
Since DNS-SD is just a specification for how to name and use records Since DNS-SD is a specification for how to name and use records in
in the existing DNS system, it has no specific additional security the existing DNS system, it has no specific additional security
requirements over and above those that already apply to DNS queries requirements over and above those that already apply to DNS queries
and DNS updates. For DNS queries, DNS Security Extensions (DNSSEC) and DNS updates. For DNS queries, DNS Security Extensions (DNSSEC)
[RFC4033] SHOULD be used where the authenticity of information is [RFC4033] SHOULD be used where the authenticity of information is
important. For DNS updates, secure updates [RFC2136][RFC3007] SHOULD important. For DNS updates, secure updates [RFC2136][RFC3007] SHOULD
generally be used to control which clients have permission to update generally be used to control which clients have permission to update
DNS records. DNS records.
9. IANA Considerations 9. IANA Considerations
IANA is requested to allocate the SRV service name of "_dots._signal" IANA is requested to allocate the SRV service name of "_dots._signal"
skipping to change at page 17, line 27 skipping to change at page 17, line 27
Value Description Client ORO Singleton Option Value Description Client ORO Singleton Option
TBD1 OPTION_V6_DOTS_RI Yes Yes TBD1 OPTION_V6_DOTS_RI Yes Yes
TBD2 OPTION_V6_DOTS_ADDRESS Yes No TBD2 OPTION_V6_DOTS_ADDRESS Yes No
9.2. DHCPv4 Option 9.2. DHCPv4 Option
IANA is requested to assign the following new DHCPv4 Option Code in IANA is requested to assign the following new DHCPv4 Option Code in
the registry maintained in: http://www.iana.org/assignments/bootp- the registry maintained in: http://www.iana.org/assignments/bootp-
dhcp-parameters/. dhcp-parameters/.
Option Name Value Data length Meaning Option Name Value Data length Meaning
---------------------- ----- ------------ --------------------------- ---------------------- ----- -------------------- -------------------
OPTION_V4_DOTS_RI TBA3 Variable; Includes the name of the OPTION_V4_DOTS_RI TBA3 Variable; the Includes the name
the maximum DOTS server. maximum length is of the DOTS server.
length is
255 octets. 255 octets.
OPTION_V4_DOTS_ADDRESS TBA4 Variable; Includes one or multiple OPTION_V4_DOTS_ADDRESS TBA4 Variable Includes one or
the minimum lists of DOTS IP addresses; more DOTS IP
length is 5. each list is treated as a addresses.
separate DOTS server.
9.3. Application Service & Application Protocol Tags 9.3. Application Service & Application Protocol Tags
This document requests IANA to make the following allocations from This document requests IANA to make the following allocations from
the registry available at: https://www.iana.org/assignments/s-naptr- the registry available at: https://www.iana.org/assignments/s-naptr-
parameters/s-naptr-parameters.xhtml. parameters/s-naptr-parameters.xhtml.
9.3.1. DOTS Application Service Tag Registration 9.3.1. DOTS Application Service Tag Registration
o Application Protocol Tag: DOTS o Application Protocol Tag: DOTS
skipping to change at page 19, line 12 skipping to change at page 19, line 12
Email: praspati@cisco.com Email: praspati@cisco.com
11. Acknowledgements 11. Acknowledgements
Thanks to Brian Carpenter for the review of the BRSKI text. Thanks to Brian Carpenter for the review of the BRSKI text.
Many thanks to Russ White for the review, comments, and text Many thanks to Russ White for the review, comments, and text
contribution. contribution.
Thanks for Dan Wing and Pei Wei for the review and comments. Thanks for Dan Wing, Pei Wei, and Valery Smyslov for the review and
comments.
Thanks to Bernie Volz for the review of the DHCP section. Thanks to Bernie Volz for the review of the DHCP section.
12. References 12. References
12.1. Normative References 12.1. Normative References
[I-D.ietf-dots-signal-call-home]
K, R., Boucadair, M., and J. Shallow, "Distributed Denial-
of-Service Open Threat Signaling (DOTS) Signal Channel
Call Home", draft-ietf-dots-signal-call-home-05 (work in
progress), July 2019.
[I-D.ietf-dots-signal-channel] [I-D.ietf-dots-signal-channel]
K, R., Boucadair, M., Patil, P., Mortensen, A., and N. K, R., Boucadair, M., Patil, P., Mortensen, A., and N.
Teague, "Distributed Denial-of-Service Open Threat Teague, "Distributed Denial-of-Service Open Threat
Signaling (DOTS) Signal Channel Specification", draft- Signaling (DOTS) Signal Channel Specification", draft-
ietf-dots-signal-channel-34 (work in progress), May 2019. ietf-dots-signal-channel-37 (work in progress), July 2019.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997, DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>. <https://www.rfc-editor.org/info/rfc2119>.
[RFC2131] Droms, R., "Dynamic Host Configuration Protocol", [RFC2131] Droms, R., "Dynamic Host Configuration Protocol",
RFC 2131, DOI 10.17487/RFC2131, March 1997, RFC 2131, DOI 10.17487/RFC2131, March 1997,
<https://www.rfc-editor.org/info/rfc2131>. <https://www.rfc-editor.org/info/rfc2131>.
skipping to change at page 20, line 27 skipping to change at page 20, line 36
[RFC8415] Mrugalski, T., Siodelski, M., Volz, B., Yourtchenko, A., [RFC8415] Mrugalski, T., Siodelski, M., Volz, B., Yourtchenko, A.,
Richardson, M., Jiang, S., Lemon, T., and T. Winters, Richardson, M., Jiang, S., Lemon, T., and T. Winters,
"Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)",
RFC 8415, DOI 10.17487/RFC8415, November 2018, RFC 8415, DOI 10.17487/RFC8415, November 2018,
<https://www.rfc-editor.org/info/rfc8415>. <https://www.rfc-editor.org/info/rfc8415>.
12.2. Informative References 12.2. Informative References
[I-D.ietf-anima-bootstrapping-keyinfra] [I-D.ietf-anima-bootstrapping-keyinfra]
Pritikin, M., Richardson, M., Behringer, M., Bjarnason, Pritikin, M., Richardson, M., Behringer, M., and K.
S., and K. Watsen, "Bootstrapping Remote Secure Key Watsen, "Bootstrapping Remote Secure Key Infrastructures
Infrastructures (BRSKI)", draft-ietf-anima-bootstrapping- (BRSKI)", draft-ietf-anima-bootstrapping-keyinfra-24 (work
keyinfra-21 (work in progress), June 2019. in progress), July 2019.
[I-D.ietf-dots-architecture] [I-D.ietf-dots-architecture]
Mortensen, A., K, R., Andreasen, F., Teague, N., and R. Mortensen, A., K, R., Andreasen, F., Teague, N., and R.
Compton, "Distributed-Denial-of-Service Open Threat Compton, "Distributed-Denial-of-Service Open Threat
Signaling (DOTS) Architecture", draft-ietf-dots- Signaling (DOTS) Architecture", draft-ietf-dots-
architecture-14 (work in progress), May 2019. architecture-14 (work in progress), May 2019.
[I-D.ietf-dots-data-channel] [I-D.ietf-dots-data-channel]
Boucadair, M. and R. K, "Distributed Denial-of-Service Boucadair, M. and R. K, "Distributed Denial-of-Service
Open Threat Signaling (DOTS) Data Channel Specification", Open Threat Signaling (DOTS) Data Channel Specification",
draft-ietf-dots-data-channel-29 (work in progress), May draft-ietf-dots-data-channel-31 (work in progress), July
2019. 2019.
[I-D.ietf-dots-multihoming] [I-D.ietf-dots-multihoming]
Boucadair, M. and R. K, "Multi-homing Deployment Boucadair, M., K, R., and W. Pan, "Multi-homing Deployment
Considerations for Distributed-Denial-of-Service Open Considerations for Distributed-Denial-of-Service Open
Threat Signaling (DOTS)", draft-ietf-dots-multihoming-01 Threat Signaling (DOTS)", draft-ietf-dots-multihoming-02
(work in progress), January 2019. (work in progress), July 2019.
[I-D.ietf-dots-signal-call-home]
K, R., Boucadair, M., and J. Shallow, "Distributed Denial-
of-Service Open Threat Signaling (DOTS) Signal Channel
Call Home", draft-ietf-dots-signal-call-home-02 (work in
progress), May 2019.
[I-D.ietf-dots-use-cases] [I-D.ietf-dots-use-cases]
Dobbins, R., Migault, D., Fouant, S., Moskowitz, R., Dobbins, R., Migault, D., Fouant, S., Moskowitz, R.,
Teague, N., Xia, L., and K. Nishizuka, "Use cases for DDoS Teague, N., Xia, L., and K. Nishizuka, "Use cases for DDoS
Open Threat Signaling", draft-ietf-dots-use-cases-17 (work Open Threat Signaling", draft-ietf-dots-use-cases-19 (work
in progress), January 2019. in progress), July 2019.
[I-D.ietf-netconf-zerotouch] [I-D.ietf-netconf-zerotouch]
Watsen, K., Abrahamsson, M., and I. Farrer, "Secure Zero Watsen, K., Abrahamsson, M., and I. Farrer, "Secure Zero
Touch Provisioning (SZTP)", draft-ietf-netconf- Touch Provisioning (SZTP)", draft-ietf-netconf-
zerotouch-29 (work in progress), January 2019. zerotouch-29 (work in progress), January 2019.
[RFC2136] Vixie, P., Ed., Thomson, S., Rekhter, Y., and J. Bound, [RFC2136] Vixie, P., Ed., Thomson, S., Rekhter, Y., and J. Bound,
"Dynamic Updates in the Domain Name System (DNS UPDATE)", "Dynamic Updates in the Domain Name System (DNS UPDATE)",
RFC 2136, DOI 10.17487/RFC2136, April 1997, RFC 2136, DOI 10.17487/RFC2136, April 1997,
<https://www.rfc-editor.org/info/rfc2136>. <https://www.rfc-editor.org/info/rfc2136>.
 End of changes. 57 change blocks. 
153 lines changed or deleted 158 lines changed or added

This html diff was produced by rfcdiff 1.47. The latest version is available from http://tools.ietf.org/tools/rfcdiff/