rfc9132.original   rfc9132.txt 
DOTS M. Boucadair, Ed. Internet Engineering Task Force (IETF) M. Boucadair, Ed.
Internet-Draft Orange Request for Comments: 9132 Orange
Obsoletes: 8782 (if approved) J. Shallow Obsoletes: 8782 J. Shallow
Intended status: Standards Track Category: Standards Track
Expires: December 5, 2021 T. Reddy.K ISSN: 2070-1721 T. Reddy.K
McAfee Akamai
June 3, 2021 August 2021
Distributed Denial-of-Service Open Threat Signaling (DOTS) Signal Distributed Denial-of-Service Open Threat Signaling (DOTS) Signal
Channel Specification Channel Specification
draft-ietf-dots-rfc8782-bis-08
Abstract Abstract
This document specifies the Distributed Denial-of-Service Open Threat This document specifies the Distributed Denial-of-Service Open Threat
Signaling (DOTS) signal channel, a protocol for signaling the need Signaling (DOTS) signal channel, a protocol for signaling the need
for protection against Distributed Denial-of-Service (DDoS) attacks for protection against Distributed Denial-of-Service (DDoS) attacks
to a server capable of enabling network traffic mitigation on behalf to a server capable of enabling network traffic mitigation on behalf
of the requesting client. of the requesting client.
A companion document defines the DOTS data channel, a separate A companion document defines the DOTS data channel, a separate
reliable communication layer for DOTS management and configuration reliable communication layer for DOTS management and configuration
purposes. purposes.
This document obsoletes RFC 8782. This document obsoletes RFC 8782.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This is an Internet Standards Track document.
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months This document is a product of the Internet Engineering Task Force
and may be updated, replaced, or obsoleted by other documents at any (IETF). It represents the consensus of the IETF community. It has
time. It is inappropriate to use Internet-Drafts as reference received public review and has been approved for publication by the
material or to cite them other than as "work in progress." Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 7841.
This Internet-Draft will expire on December 5, 2021. Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
https://www.rfc-editor.org/info/rfc9132.
Copyright Notice Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the Copyright (c) 2021 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 5 2. Terminology
3. Design Overview . . . . . . . . . . . . . . . . . . . . . . . 6 3. Design Overview
3.1. Backward Compatibility Considerations . . . . . . . . . . 9 3.1. Backward Compatibility Considerations
4. DOTS Signal Channel: Messages & Behaviors . . . . . . . . . . 10 4. DOTS Signal Channel: Messages & Behaviors
4.1. DOTS Server(s) Discovery . . . . . . . . . . . . . . . . 10 4.1. DOTS Server(s) Discovery
4.2. CoAP URIs . . . . . . . . . . . . . . . . . . . . . . . . 10 4.2. CoAP URIs
4.3. Happy Eyeballs for DOTS Signal Channel . . . . . . . . . 11 4.3. Happy Eyeballs for DOTS Signal Channel
4.4. DOTS Mitigation Methods . . . . . . . . . . . . . . . . . 13 4.4. DOTS Mitigation Methods
4.4.1. Request Mitigation . . . . . . . . . . . . . . . . . 14 4.4.1. Request Mitigation
4.4.1.1. Building Mitigation Requests . . . . . . . . . . 14 4.4.1.1. Building Mitigation Requests
4.4.1.2. Server-domain DOTS Gateways . . . . . . . . . . . 22 4.4.1.2. Server-Domain DOTS Gateways
4.4.1.3. Processing Mitigation Requests . . . . . . . . . 24 4.4.1.3. Processing Mitigation Requests
4.4.2. Retrieve Information Related to a Mitigation . . . . 30 4.4.2. Retrieve Information Related to a Mitigation
4.4.2.1. DOTS Servers Sending Mitigation Status . . . . . 36 4.4.2.1. DOTS Servers Sending Mitigation Status
4.4.2.2. DOTS Clients Polling for Mitigation Status . . . 38 4.4.2.2. DOTS Clients Polling for Mitigation Status
4.4.3. Efficacy Update from DOTS Clients . . . . . . . . . . 39 4.4.3. Efficacy Update from DOTS Clients
4.4.4. Withdraw a Mitigation . . . . . . . . . . . . . . . . 41 4.4.4. Withdraw a Mitigation
4.5. DOTS Signal Channel Session Configuration . . . . . . . . 42 4.5. DOTS Signal Channel Session Configuration
4.5.1. Discover Configuration Parameters . . . . . . . . . . 44 4.5.1. Discover Configuration Parameters
4.5.2. Convey DOTS Signal Channel Session Configuration . . 48 4.5.2. Convey DOTS Signal Channel Session Configuration
4.5.3. Configuration Freshness and Notifications . . . . . . 54 4.5.3. Configuration Freshness and Notifications
4.5.4. Delete DOTS Signal Channel Session Configuration . . 55 4.5.4. Delete DOTS Signal Channel Session Configuration
4.6. Redirected Signaling . . . . . . . . . . . . . . . . . . 56 4.6. Redirected Signaling
4.7. Heartbeat Mechanism . . . . . . . . . . . . . . . . . . . 58 4.7. Heartbeat Mechanism
5. DOTS Signal Channel YANG Modules . . . . . . . . . . . . . . 61 5. DOTS Signal Channel YANG Modules
5.1. Tree Structure . . . . . . . . . . . . . . . . . . . . . 61 5.1. Tree Structure
5.2. IANA DOTS Signal Channel YANG Module . . . . . . . . . . 64 5.2. IANA DOTS Signal Channel YANG Module
5.3. IETF DOTS Signal Channel YANG Module . . . . . . . . . . 68 5.3. IETF DOTS Signal Channel YANG Module
6. YANG/JSON Mapping Parameters to CBOR . . . . . . . . . . . . 81 6. YANG/JSON Mapping Parameters to CBOR
7. (D)TLS Protocol Profile and Performance Considerations . . . 85 7. (D)TLS Protocol Profile and Performance Considerations
7.1. (D)TLS Protocol Profile . . . . . . . . . . . . . . . . . 85 7.1. (D)TLS Protocol Profile
7.2. (D)TLS 1.3 Considerations . . . . . . . . . . . . . . . . 87 7.2. (D)TLS 1.3 Considerations
7.3. DTLS MTU and Fragmentation . . . . . . . . . . . . . . . 89 7.3. DTLS MTU and Fragmentation
8. Mutual Authentication of DOTS Agents & Authorization of DOTS 8. Mutual Authentication of DOTS Agents & Authorization of DOTS
Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Clients
9. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 91 9. Error Handling
10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 92 10. IANA Considerations
10.1. DOTS Signal Channel UDP and TCP Port Number . . . . . . 92 10.1. DOTS Signal Channel UDP and TCP Port Number
10.2. Well-Known 'dots' URI . . . . . . . . . . . . . . . . . 93 10.2. Well-Known 'dots' URI
10.3. Media Type Registration . . . . . . . . . . . . . . . . 93 10.3. Media Type Registration
10.4. CoAP Content-Formats Registration . . . . . . . . . . . 94 10.4. CoAP Content-Formats Registration
10.5. CBOR Tag Registration . . . . . . . . . . . . . . . . . 95 10.5. CBOR Tag Registration
10.6. DOTS Signal Channel Protocol Registry . . . . . . . . . 95 10.6. DOTS Signal Channel Protocol Registry
10.6.1. DOTS Signal Channel CBOR Key Values Subregistry . . 95 10.6.1. DOTS Signal Channel CBOR Key Values Subregistry
10.6.1.1. Registration Template . . . . . . . . . . . . . 95 10.6.1.1. Registration Template
10.6.1.2. Update Subregistry Content . . . . . . . . . . . 97 10.6.1.2. Update Subregistry Content
10.6.2. Status Codes Subregistry . . . . . . . . . . . . . . 97 10.6.2. Status Codes Subregistry
10.6.3. Conflict Status Codes Subregistry . . . . . . . . . 99 10.6.3. Conflict Status Codes Subregistry
10.6.4. Conflict Cause Codes Subregistry . . . . . . . . . . 100 10.6.4. Conflict Cause Codes Subregistry
10.6.5. Attack Status Codes Subregistry . . . . . . . . . . 101 10.6.5. Attack Status Codes Subregistry
10.7. DOTS Signal Channel YANG Modules . . . . . . . . . . . . 102 10.7. DOTS Signal Channel YANG Modules
11. Security Considerations . . . . . . . . . . . . . . . . . . . 104 11. Security Considerations
12. References . . . . . . . . . . . . . . . . . . . . . . . . . 106 12. References
12.1. Normative References . . . . . . . . . . . . . . . . . . 106 12.1. Normative References
12.2. Informative References . . . . . . . . . . . . . . . . . 109 12.2. Informative References
Appendix A. Summary of Changes From RFC8782 . . . . . . . . . . 114 Appendix A. Summary of Changes From RFC 8782
Appendix B. CUID Generation . . . . . . . . . . . . . . . . . . 115 Appendix B. CUID Generation
Appendix C. Summary of Protocol Recommended/Default Values . . . 115 Appendix C. Summary of Protocol Recommended/Default Values
Appendix D. Acknowledgements . . . . . . . . . . . . . . . . . . 116 Acknowledgements
D.1. Acknowledgements from RFC8782 . . . . . . . . . . . . . . 116 Contributors
Appendix E. Contributors . . . . . . . . . . . . . . . . . . . . 116 Authors' Addresses
E.1. Authors of RFC8782 . . . . . . . . . . . . . . . . . . . 116
E.2. Contributors to RFC8782 . . . . . . . . . . . . . . . . . 117
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 118
1. Introduction 1. Introduction
A Distributed Denial-of-Service (DDoS) attack is a distributed A Distributed Denial-of-Service (DDoS) attack is a distributed
attempt to make machines or network resources unavailable to their attempt to make machines or network resources unavailable to their
intended users. In most cases, sufficient scale for an effective intended users. In most cases, sufficient scale for an effective
attack can be achieved by compromising enough end hosts and using attack can be achieved by compromising enough end hosts and using
those infected hosts to perpetrate and amplify the attack. The those infected hosts to perpetrate and amplify the attack. The
victim in this attack can be an application server, a host, a router, victim in this attack can be an application server, a host, a router,
a firewall, or an entire network. a firewall, or an entire network.
Network applications have finite resources like CPU cycles, the Network applications have finite resources, like CPU cycles, the
number of processes or threads they can create and use, the maximum number of processes or threads they can create and use, the maximum
number of simultaneous connections they can handle, the resources number of simultaneous connections they can handle, the resources
assigned to the control plane, etc. When processing network traffic, assigned to the control plane, etc. When processing network traffic,
such applications are supposed to use these resources to provide the such applications are supposed to use these resources to provide the
intended functionality in the most efficient manner. However, a DDoS intended functionality in the most efficient manner. However, a DDoS
attacker may be able to prevent an application from performing its attacker may be able to prevent an application from performing its
intended task by making the application exhaust its finite resources. intended task by making the application exhaust its finite resources.
A TCP DDoS SYN flood [RFC4987], for example, is a memory-exhausting A TCP DDoS SYN flood [RFC4987], for example, is a memory-exhausting
attack while an ACK flood is a CPU-exhausting attack. Attacks on the attack, while an ACK flood is a CPU-exhausting attack. Attacks on
link are carried out by sending enough traffic so that the link the link are carried out by sending enough traffic so that the link
becomes congested, thereby likely causing packet loss for legitimate becomes congested, thereby likely causing packet loss for legitimate
traffic. Stateful firewalls can also be attacked by sending traffic traffic. Stateful firewalls can also be attacked by sending traffic
that causes the firewall to maintain an excessive number of states that causes the firewall to maintain an excessive number of states
that may jeopardize the firewall's operation overall, in addition to that may jeopardize the firewall's operation overall, in addition to
likely performance impacts. The firewall then runs out of memory, likely performance impacts. The firewall then runs out of memory,
and it can no longer instantiate the states required to process and it can no longer instantiate the states required to process
legitimate flows. Other possible DDoS attacks are discussed in legitimate flows. Other possible DDoS attacks are discussed in
[RFC4732]. [RFC4732].
In many cases, it may not be possible for network administrators to In many cases, it may not be possible for network administrators to
skipping to change at page 4, line 35 skipping to change at line 165
defines a lightweight protocol that allows a DOTS client to request defines a lightweight protocol that allows a DOTS client to request
mitigation from one or more DOTS servers for protection against mitigation from one or more DOTS servers for protection against
detected, suspected, or anticipated attacks. This protocol enables detected, suspected, or anticipated attacks. This protocol enables
cooperation between DOTS agents to permit a highly automated network cooperation between DOTS agents to permit a highly automated network
defense that is robust, reliable, and secure. Note that "secure" defense that is robust, reliable, and secure. Note that "secure"
means the support of the features defined in Section 2.4 of means the support of the features defined in Section 2.4 of
[RFC8612]. [RFC8612].
In typical deployments, the DOTS client belongs to a different In typical deployments, the DOTS client belongs to a different
administrative domain than the DOTS server. For example, the DOTS administrative domain than the DOTS server. For example, the DOTS
client is embedded in a firewall protected services owned and client is embedded in a firewall-protected service owned and operated
operated by a customer, while the DOTS server is owned and operated by a customer, while the DOTS server is owned and operated by a
by a different administrative entity (service provider, typically) different administrative entity (service provider, typically)
providing DDoS mitigation services. The latter might or might not providing DDoS mitigation services. The latter might or might not
provide connectivity services to the network hosting the DOTS client. provide connectivity services to the network hosting the DOTS client.
The DOTS server may or may not be co-located with the DOTS mitigator. The DOTS server may or may not be co-located with the DOTS mitigator.
In typical deployments, the DOTS server belongs to the same In typical deployments, the DOTS server belongs to the same
administrative domain as the mitigator. The DOTS client can administrative domain as the mitigator. The DOTS client can
communicate directly with a DOTS server or indirectly via a DOTS communicate directly with a DOTS server or indirectly via a DOTS
gateway. gateway.
An example of a network diagram that illustrates a deployment of DOTS An example of a network diagram that illustrates a deployment of DOTS
agents is shown in Figure 1. In this example, a DOTS server is agents is shown in Figure 1. In this example, a DOTS server is
operating on the access network. A DOTS client is located on the LAN operating on the access network. A DOTS client is located on the
(Local Area Network), while a DOTS gateway is embedded in the CPE Local Area Network (LAN), while a DOTS gateway is embedded in the
(Customer Premises Equipment). Customer Premises Equipment (CPE).
Network Network
Resource CPE Router Access Network __________ Resource CPE Router Access Network __________
+-------------+ +--------------+ +-------------+ / \ +-------------+ +--------------+ +-------------+ / \
| | | | | | | Internet | | | | | | | | Internet |
| DOTS Client +---+ DOTS Gateway +---+ DOTS Server +----+ | | DOTS Client +---+ DOTS Gateway +---+ DOTS Server +----+ |
| | | | | | | | | | | | | | | |
+-------------+ +--------------+ +-------------+ \__________/ +-------------+ +--------------+ +-------------+ \__________/
Figure 1: Sample DOTS Deployment (1) Figure 1: Sample DOTS Deployment (1)
DOTS servers can also be reachable over the Internet, as depicted in DOTS servers can also be reachable over the Internet, as depicted in
Figure 2. Figure 2.
Network DDoS Mitigation Network DDoS Mitigation
Resource CPE Router _________ Service Resource CPE Router _________ Service
+-------------+ +--------------+ / \ +-------------+ +-------------+ +--------------+ / \ +-------------+
| | | | | | | | | | | | | | | |
| DOTS Client +---+ DOTS Gateway +---+ Internet +---+ DOTS Server | | DOTS Client +---+ DOTS Gateway +---+ Internet +---+ DOTS Server |
| | | | | | | | | | | | | | | |
+-------------+ +--------------+ \_________/ +-------------+ +-------------+ +--------------+ \_________/ +-------------+
Figure 2: Sample DOTS Deployment (2) Figure 2: Sample DOTS Deployment (2)
This document adheres to the DOTS architecture [RFC8811]. The This document adheres to the DOTS architecture [RFC8811]. The
requirements for DOTS signal channel protocol are documented in requirements for the DOTS signal channel protocol are documented in
[RFC8612]. This document satisfies all the use cases discussed in [RFC8612]. This document satisfies all the use cases discussed in
[RFC8903]. [RFC8903].
This document focuses on the DOTS signal channel. This is a This document focuses on the DOTS signal channel. This is a
companion document of the DOTS data channel specification [RFC8783] companion document of the DOTS data channel specification [RFC8783]
that defines a configuration and a bulk data exchange mechanism that defines a configuration and a bulk data exchange mechanism
supporting the DOTS signal channel. supporting the DOTS signal channel.
Backward compatibility (including upgrade) considerations are Backward compatibility (including upgrade) considerations are
discussed in Section 3.1. discussed in Section 3.1.
2. Terminology 2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP "OPTIONAL" in this document are to be interpreted as described in
14 [RFC2119][RFC8174] when, and only when, they appear in all BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here. capitals, as shown here.
(D)TLS is used for statements that apply to both Transport Layer (D)TLS is used for statements that apply to both Transport Layer
Security [RFC5246] [RFC8446] and Datagram Transport Layer Security Security [RFC5246] [RFC8446] and Datagram Transport Layer Security
[RFC6347]. Specific terms are used for any statement that applies to [RFC6347]. Specific terms are used for any statement that applies to
either protocol alone. either protocol alone.
The reader should be familiar with the terms defined in [RFC8612] and The reader should be familiar with the terms defined in [RFC8612] and
[RFC7252]. [RFC7252].
skipping to change at page 6, line 25 skipping to change at line 252
originally designed for constrained devices and networks. The many originally designed for constrained devices and networks. The many
features of CoAP (expectation of packet loss, support for features of CoAP (expectation of packet loss, support for
asynchronous Non-confirmable messaging, congestion control, small asynchronous Non-confirmable messaging, congestion control, small
message overhead limiting the need for fragmentation, use of minimal message overhead limiting the need for fragmentation, use of minimal
resources, and support for (D)TLS) make it a good candidate upon resources, and support for (D)TLS) make it a good candidate upon
which to build the DOTS signaling mechanism. which to build the DOTS signaling mechanism.
DOTS clients and servers behave as CoAP endpoints. By default, a DOTS clients and servers behave as CoAP endpoints. By default, a
DOTS client behaves as a CoAP client and a DOTS server behaves as DOTS client behaves as a CoAP client and a DOTS server behaves as
CoAP server. Nevertheless, a DOTS client (or server) behaves as a CoAP server. Nevertheless, a DOTS client (or server) behaves as a
CoAP server (or client) for specific operations such as DOTS CoAP server (or client) for specific operations, such as DOTS
heartbeat operations (Section 4.7). heartbeat operations (Section 4.7).
The DOTS signal channel is layered on existing standards (see The DOTS signal channel is layered on existing standards (see
Figure 3). Figure 3).
+---------------------+ +---------------------+
| DOTS Signal Channel | | DOTS Signal Channel |
+---------------------+ +---------------------+
| CoAP | | CoAP |
+----------+----------+ +----------+----------+
| TLS | DTLS | | TLS | DTLS |
+----------+----------+ +----------+----------+
| TCP | UDP | | TCP | UDP |
+----------+----------+ +----------+----------+
| IP | | IP |
+---------------------+ +---------------------+
Figure 3: Abstract Layering of DOTS Signal Channel over CoAP over Figure 3: Abstract Layering of DOTS Signal Channel over CoAP over
(D)TLS (D)TLS
In some cases, a DOTS client and server may have a mutual agreement In some cases, a DOTS client and server may have a mutual agreement
to use a specific port number, such as by explicit configuration or to use a specific port number, such as by explicit configuration or
dynamic discovery [RFC8973]. Absent such mutual agreement, the DOTS dynamic discovery [RFC8973]. Absent such mutual agreement, the DOTS
signal channel MUST run over port number 4646 as defined in signal channel MUST run over port number 4646, as defined in
Section 10.1, for both UDP and TCP (that is, the DOTS server listens Section 10.1, for both UDP and TCP (that is, the DOTS server listens
on port number 4646). In order to use a distinct port number (as on port number 4646). In order to use a distinct port number (as
opposed to 4646), DOTS clients and servers SHOULD support a opposed to 4646), DOTS clients and servers SHOULD support a
configurable parameter to supply the port number to use. configurable parameter to supply the port number to use.
| Note: The rationale for not using the default port number 5684 | Note: The rationale for not using the default port number 5684
| ((D)TLS CoAP) is to avoid the discovery of services and | ((D)TLS CoAP) is to avoid the discovery of services and
| resources discussed in [RFC7252] and allow for differentiated | resources discussed in [RFC7252] and allow for differentiated
| behaviors in environments where both a DOTS gateway and an | behaviors in environments where both a DOTS gateway and an
| Internet of Things (IoT) gateway (e.g., Figure 3 of [RFC7452]) | Internet of Things (IoT) gateway (e.g., Figure 3 of [RFC7452])
| are co-located. | are co-located.
| |
| Particularly, the use of a default port number is meant to | Particularly, the use of a default port number is meant to
| simplify DOTS deployment in scenarios where no explicit IP | simplify DOTS deployment in scenarios where no explicit IP
| address configuration is required. For example, the use of the | address configuration is required. For example, the use of the
| default router as the DOTS server aims to ease DOTS deployment | default router as the DOTS server aims to ease DOTS deployment
| within LANs (in which CPEs embed a DOTS gateway as illustrated | within LANs (in which CPEs embed a DOTS gateway, as illustrated
| in Figures 1 and 2) without requiring a sophisticated discovery | in Figures 1 and 2) without requiring a sophisticated discovery
| method and configuration tasks within the LAN. It is also | method and configuration tasks within the LAN. It is also
| possible to use anycast addresses for DOTS servers to simplify | possible to use anycast addresses for DOTS servers to simplify
| DOTS client configuration, including service discovery. In | DOTS client configuration, including service discovery. In
| such an anycast-based scenario, a DOTS client initiating a DOTS | such an anycast-based scenario, a DOTS client initiating a DOTS
| session to the DOTS server anycast address may, for example, be | session to the DOTS server anycast address may, for example, be
| (1) redirected to the DOTS server unicast address to be used by | (1) redirected to the DOTS server unicast address to be used by
| the DOTS client following the procedure discussed in | the DOTS client following the procedure discussed in
| Section 4.6 or (2) relayed to a unicast DOTS server. | Section 4.6 or (2) relayed to a unicast DOTS server.
skipping to change at page 8, line 18 skipping to change at line 340
in Section 4.3. in Section 4.3.
A DOTS client is entitled to access only the resources it creates. A DOTS client is entitled to access only the resources it creates.
In particular, a DOTS client cannot retrieve data related to In particular, a DOTS client cannot retrieve data related to
mitigation requests created by other DOTS clients of the same DOTS mitigation requests created by other DOTS clients of the same DOTS
client domain. client domain.
Messages exchanged between DOTS agents are serialized using Concise Messages exchanged between DOTS agents are serialized using Concise
Binary Object Representation (CBOR) [RFC8949], a binary encoding Binary Object Representation (CBOR) [RFC8949], a binary encoding
scheme designed for small code and message size. CBOR-encoded scheme designed for small code and message size. CBOR-encoded
payloads are used to carry signal channel-specific payload messages payloads are used to carry signal-channel-specific payload messages
that convey request parameters and response information such as that convey request parameters and response information, such as
errors. In order to allow the reusing of data models across errors. In order to allow the reusing of data models across
protocols, [RFC7951] specifies the JavaScript Object Notation (JSON) protocols, [RFC7951] specifies the JavaScript Object Notation (JSON)
encoding of YANG-modeled data. A similar effort for CBOR is defined encoding of YANG-modeled data. A similar effort for CBOR is defined
in [I-D.ietf-core-yang-cbor]. in [CORE-YANG-CBOR].
DOTS agents determine that a CBOR data structure is a DOTS signal DOTS agents determine that a CBOR data structure is a DOTS signal
channel object from the application context, such as from the port channel object from the application context, such as from the port
number assigned to the DOTS signal channel. The other method DOTS number assigned to the DOTS signal channel. The other method DOTS
agents use to indicate that a CBOR data structure is a DOTS signal agents use to indicate that a CBOR data structure is a DOTS signal
channel object is the use of the "application/dots+cbor" content type channel object is the use of the "application/dots+cbor" content type
(Section 10.3). (Section 10.3).
This document specifies a YANG module for representing DOTS This document specifies a YANG module for representing DOTS
mitigation scopes, DOTS signal channel session configuration data, mitigation scopes, DOTS signal channel session configuration data,
and DOTS redirected signaling (Section 5). All parameters in the and DOTS redirected signaling (Section 5). All parameters in the
payload of the DOTS signal channel are mapped to CBOR types as payload of the DOTS signal channel are mapped to CBOR types, as
specified in Table 5 (Section 6). specified in Table 5 (Section 6).
In order to prevent fragmentation, DOTS agents must follow the In order to prevent fragmentation, DOTS agents must follow the
recommendations documented in Section 4.6 of [RFC7252]. Refer to recommendations documented in Section 4.6 of [RFC7252]. Refer to
Section 7.3 for more details. Section 7.3 for more details.
DOTS agents MUST support GET, PUT, and DELETE CoAP methods. The DOTS agents MUST support GET, PUT, and DELETE CoAP methods. The
payload included in CoAP responses with 2.xx Response Codes MUST be payload included in CoAP responses with 2.xx Response Codes MUST be
of content type "application/dots+cbor". CoAP responses with 4.xx of content type "application/dots+cbor". CoAP responses with 4.xx
and 5.xx error Response Codes MUST include a diagnostic payload and 5.xx error Response Codes MUST include a diagnostic payload
(Section 5.5.2 of [RFC7252]). The diagnostic payload may contain (Section 5.5.2 of [RFC7252]). The diagnostic payload may contain
additional information to aid troubleshooting. additional information to aid troubleshooting.
In deployments where multiple DOTS clients are enabled in a single In deployments where multiple DOTS clients are enabled in a single
network and administrative domain (called, DOTS client domain), the network and administrative domain (called DOTS client domain), the
DOTS server may detect conflicting mitigation requests from these DOTS server may detect conflicting mitigation requests from these
clients. This document does not aim to specify a comprehensive list clients. This document does not aim to specify a comprehensive list
of conditions under which a DOTS server will characterize two of conditions under which a DOTS server will characterize two
mitigation requests from distinct DOTS clients as conflicting, nor mitigation requests from distinct DOTS clients as conflicting, nor
does it recommend a DOTS server behavior for processing conflicting does it recommend a DOTS server behavior for processing conflicting
mitigation requests. Those considerations are implementation and mitigation requests. Those considerations are implementation and
deployment specific. Nevertheless, this document specifies the deployment specific. Nevertheless, this document specifies the
mechanisms to notify DOTS clients when conflicts occur, including the mechanisms to notify DOTS clients when conflicts occur, including the
conflict cause (Section 4.4). conflict cause (Section 4.4.1.3).
In deployments where one or more translators (e.g., Traditional NAT In deployments where one or more translators (e.g., Traditional NAT
[RFC3022], CGN [RFC6888], NAT64 [RFC6146], NPTv6 [RFC6296]) are [RFC3022], CGN [RFC6888], NAT64 [RFC6146], NPTv6 [RFC6296]) are
enabled between the client's network and the DOTS server, any DOTS enabled between the client's network and the DOTS server, any DOTS
signal channel messages forwarded to a DOTS server MUST NOT include signal channel messages forwarded to a DOTS server MUST NOT include
internal IP addresses/prefixes and/or port numbers; instead, external internal IP addresses/prefixes and/or port numbers; instead, external
addresses/prefixes and/or port numbers as assigned by the translator addresses/prefixes and/or port numbers as assigned by the translator
MUST be used. This document does not make any recommendations about MUST be used. This document does not make any recommendations about
possible translator discovery mechanisms. The following are some possible translator discovery mechanisms. The following are some
(non-exhaustive) deployment examples that may be considered: (non-exhaustive) deployment examples that may be considered:
o Port Control Protocol (PCP) [RFC6887] or Session Traversal * Port Control Protocol (PCP) [RFC6887] or Session Traversal
Utilities for NAT (STUN) [RFC8489] may be used by the client to Utilities for NAT (STUN) [RFC8489] may be used by the client to
retrieve the external addresses/prefixes and/or port numbers. retrieve the external addresses/prefixes and/or port numbers.
Information retrieved by means of PCP or STUN will be used to feed Information retrieved by means of PCP or STUN will be used to feed
the DOTS signal channel messages that will be sent to a DOTS the DOTS signal channel messages that will be sent to a DOTS
server. server.
o A DOTS gateway may be co-located with the translator. The DOTS * A DOTS gateway may be co-located with the translator. The DOTS
gateway will need to update the DOTS messages based upon the local gateway will need to update the DOTS messages based upon the local
translator's binding table. translator's binding table.
3.1. Backward Compatibility Considerations 3.1. Backward Compatibility Considerations
The main changes to [RFC8782] are listed in Appendix A. These The main changes to [RFC8782] are listed in Appendix A. These
modifications are made with the constraint to avoid changes to the modifications are made with the constraint to avoid changes to the
mapping table defined in Table 5 of [RFC8782] (see also Section 6 of mapping table defined in Table 5 of [RFC8782] (see also Section 6 of
the present document). the present document).
For both legacy [RFC8782] and implementations that follow the present For both legacy [RFC8782] and implementations that follow the present
specification, a DOTS signal channel attribute will thus have the specification, a DOTS signal channel attribute will thus have the
same CBOR key value and CBOR major type. The only upgrade that is same CBOR key value and CBOR major type. The only upgrade that is
required to [RFC8782] implementations is to handle the CBOR key value required to [RFC8782] implementations is to handle the CBOR key value
range "128-255" as comprehension-optional instead of comprehension- range "128-255" as comprehension-optional instead of comprehension-
required. Note that this range is anticipated to be used by the DOTS required. Note that this range is anticipated to be used by the DOTS
telemetry [I-D.ietf-dots-telemetry] in which the following means are telemetry [DOTS-TELEMETRY] in which the following means are used to
used to prevent message processing failure of a DOTS signal channel prevent message processing failure of a DOTS signal channel message
message enriched with telemetry data: (1) DOTS agents use dedicated enriched with telemetry data: (1) DOTS agents use dedicated (new)
(new) path suffixes (Section 5 of [I-D.ietf-dots-telemetry]) and (2) path suffixes (Section 5 of [DOTS-TELEMETRY]) and (2) a DOTS server
a DOTS server won't include telemetry attributes in its responses won't include telemetry attributes in its responses unless it is
unless it is explicitly told to do so by a DOTS client (Section 6.1.2 explicitly told to do so by a DOTS client (Section 6.1.2 of
of [I-D.ietf-dots-telemetry]). [DOTS-TELEMETRY]).
Future DOTS extensions that request a CBOR value in the range Future DOTS extensions that request a CBOR value in the range
"128-255" MUST support means similar to the aforementioned DOTS "128-255" MUST support means similar to the aforementioned DOTS
telemetry ones. telemetry ones.
4. DOTS Signal Channel: Messages & Behaviors 4. DOTS Signal Channel: Messages & Behaviors
4.1. DOTS Server(s) Discovery 4.1. DOTS Server(s) Discovery
This document assumes that DOTS clients are provisioned with the This document assumes that DOTS clients are provisioned with the
reachability information of their DOTS server(s) using any of a reachability information of their DOTS server(s) using any of a
variety of means (e.g., local configuration or dynamic means such as variety of means (e.g., local configuration or dynamic means, such as
DHCP [RFC8973]). The description of such means is out of scope of DHCP [RFC8973]). The description of such means is out of scope of
this document. this document.
Likewise, it is out of the scope of this document to specify the Likewise, it is out of the scope of this document to specify the
behavior to be followed by a DOTS client in order to send DOTS behavior to be followed by a DOTS client in order to send DOTS
requests when multiple DOTS servers are provisioned (e.g., contact requests when multiple DOTS servers are provisioned (e.g., contact
all DOTS servers, select one DOTS server among the list). Such all DOTS servers, select one DOTS server among the list). Such
behavior is specified in other documents (e.g., behavior is specified in other documents (e.g., [DOTS-MULTIHOMING]).
[I-D.ietf-dots-multihoming]).
4.2. CoAP URIs 4.2. CoAP URIs
The DOTS server MUST support the use of the path prefix of "/.well- The DOTS server MUST support the use of the path prefix of "/.well-
known/" as defined in [RFC8615] and the registered name of "dots". known/" as defined in [RFC8615] and the registered name of "dots".
Each DOTS operation is denoted by a path suffix that indicates the Each DOTS operation is denoted by a path suffix that indicates the
intended operation. The operation path (Table 1) is appended to the intended operation. The operation path (Table 1) is appended to the
path prefix to form the URI used with a CoAP request to perform the path prefix to form the URI used with a CoAP request to perform the
desired DOTS operation. desired DOTS operation.
+-----------------------+----------------+-------------+ +=======================+================+=============+
| Operation | Operation Path | Details | | Operation | Operation Path | Details |
+=======================+================+=============+ +=======================+================+=============+
| Mitigation | /mitigate | Section 4.4 | | Mitigation | /mitigate | Section 4.4 |
+-----------------------+----------------+-------------+ +-----------------------+----------------+-------------+
| Session configuration | /config | Section 4.5 | | Session configuration | /config | Section 4.5 |
+-----------------------+----------------+-------------+ +-----------------------+----------------+-------------+
| Heartbeat | /hb | Section 4.7 | | Heartbeat | /hb | Section 4.7 |
+-----------------------+----------------+-------------+ +-----------------------+----------------+-------------+
Table 1: Operations and Corresponding URIs Table 1: Operations and Corresponding URIs
skipping to change at page 11, line 44 skipping to change at line 505
tries both DTLS over UDP and TLS over TCP following a DOTS Happy tries both DTLS over UDP and TLS over TCP following a DOTS Happy
Eyeballs approach. To some extent, this approach is similar to the Eyeballs approach. To some extent, this approach is similar to the
Happy Eyeballs mechanism defined in [RFC8305]. The connection Happy Eyeballs mechanism defined in [RFC8305]. The connection
attempts are performed by the DOTS client when it initializes or, in attempts are performed by the DOTS client when it initializes or, in
general, when it has to select an address family and transport to general, when it has to select an address family and transport to
contact its DOTS server. The results of the Happy Eyeballs procedure contact its DOTS server. The results of the Happy Eyeballs procedure
are used by the DOTS client for sending its subsequent messages to are used by the DOTS client for sending its subsequent messages to
the DOTS server. The differences in behavior with respect to the the DOTS server. The differences in behavior with respect to the
Happy Eyeballs mechanism [RFC8305] are listed below: Happy Eyeballs mechanism [RFC8305] are listed below:
o The order of preference of the DOTS signal channel address family * The order of preference of the DOTS signal channel address family
and transport protocol (most preferred first) is the following: and transport protocol (most preferred first) is the following:
UDP over IPv6, UDP over IPv4, TCP over IPv6, and finally TCP over UDP over IPv6, UDP over IPv4, TCP over IPv6, and finally TCP over
IPv4. This order adheres to the address preference order IPv4. This order adheres to the address preference order
specified in [RFC6724] and the DOTS signal channel preference that specified in [RFC6724] and the DOTS signal channel preference that
promotes the use of UDP over TCP (to avoid TCP's head of line promotes the use of UDP over TCP (to avoid TCP's head of line
blocking). blocking).
o After successfully establishing a connection, the DOTS client MUST * After successfully establishing a connection, the DOTS client MUST
cache information regarding the outcome of each connection attempt cache information regarding the outcome of each connection attempt
for a specific time period; it uses that information to avoid for a specific time period; it uses that information to avoid
thrashing the network with subsequent attempts. The cached thrashing the network with subsequent attempts. The cached
information is flushed when its age exceeds a specific time period information is flushed when its age exceeds a specific time period
on the order of few minutes (e.g., 10 min). Typically, if the on the order of few minutes (e.g., 10 min). Typically, if the
DOTS client has to reestablish the connection with the same DOTS DOTS client has to reestablish the connection with the same DOTS
server within a few seconds after the Happy Eyeballs mechanism is server within a few seconds after the Happy Eyeballs mechanism is
completed, caching avoids thrashing the network especially in the completed, caching avoids thrashing the network especially in the
presence of DDoS attack traffic. presence of DDoS attack traffic.
o If a DOTS signal channel session is established with TLS (but DTLS * If a DOTS signal channel session is established with TLS (but DTLS
failed), the DOTS client periodically repeats the mechanism to failed), the DOTS client periodically repeats the mechanism to
discover whether DOTS signal channel messages with DTLS over UDP discover whether DOTS signal channel messages with DTLS over UDP
become available from the DOTS server; this is so the DOTS client become available from the DOTS server; this is so the DOTS client
can migrate the DOTS signal channel from TCP to UDP. Such probing can migrate the DOTS signal channel from TCP to UDP. Such probing
SHOULD NOT be done more frequently than every 24 hours and MUST SHOULD NOT be done more frequently than every 24 hours and MUST
NOT be done more frequently than every 5 minutes. NOT be done more frequently than every 5 minutes.
When connection attempts are made during an attack, the DOTS client When connection attempts are made during an attack, the DOTS client
SHOULD use a "Connection Attempt Delay" [RFC8305] set to 100 ms. SHOULD use a "Connection Attempt Delay" [RFC8305] set to 100 ms.
skipping to change at page 13, line 11 skipping to change at line 567
* T1-T0=T2-T1=T3-T2= Connection Attempt Delay. * T1-T0=T2-T1=T3-T2= Connection Attempt Delay.
Figure 4: DOTS Happy Eyeballs (Sample Flow) Figure 4: DOTS Happy Eyeballs (Sample Flow)
A single DOTS signal channel between DOTS agents can be used to A single DOTS signal channel between DOTS agents can be used to
exchange multiple DOTS signal messages. To reduce DOTS client and exchange multiple DOTS signal messages. To reduce DOTS client and
DOTS server workload, DOTS clients SHOULD reuse the (D)TLS session. DOTS server workload, DOTS clients SHOULD reuse the (D)TLS session.
4.4. DOTS Mitigation Methods 4.4. DOTS Mitigation Methods
The following methods are used by a DOTS client to request, withdraw, The following methods are used by a DOTS client to request, retrieve,
or retrieve the status of mitigation requests: or withdraw the status of mitigation requests:
PUT: DOTS clients use the PUT method to request mitigation from a PUT: DOTS clients use the PUT method to request mitigation from a
DOTS server (Section 4.4.1). During active mitigation, DOTS DOTS server (Section 4.4.1). During active mitigation, DOTS
clients may use PUT requests to carry mitigation efficacy clients may use PUT requests to carry mitigation efficacy
updates to the DOTS server (Section 4.4.3). updates to the DOTS server (Section 4.4.3).
GET: DOTS clients may use the GET method to retrieve the list of GET: DOTS clients may use the GET method to retrieve the list of
its mitigations maintained by a DOTS server (Section 4.4.2) its mitigations maintained by a DOTS server (Section 4.4.2)
or to receive asynchronous DOTS server status messages or to receive asynchronous DOTS server status messages
(Section 4.4.2.1). (Section 4.4.2.1).
DELETE: DOTS clients use the DELETE method to withdraw a request for DELETE: DOTS clients use the DELETE method to withdraw a request for
mitigation from a DOTS server (Section 4.4.4). mitigation from a DOTS server (Section 4.4.4).
Mitigation request and response messages are marked as Non- Mitigation request and response messages are marked as Non-
confirmable messages (Section 2.2 of [RFC7252]). confirmable messages (Section 2.2 of [RFC7252]).
DOTS agents MUST NOT send more than one UDP datagram per round-trip DOTS agents MUST NOT send more than one UDP datagram per round-trip
time (RTT) to the peer DOTS agent on average following the data time (RTT) to the peer DOTS agent on average following the data
transmission guidelines discussed in Section 3.1.3 of [RFC8085]. transmission guidelines discussed in Section 3.1.3 of [RFC8085].
Requests marked by the DOTS client as Non-confirmable messages are Requests marked by the DOTS client as Non-confirmable messages are
sent at regular intervals until a response is received from the DOTS sent at regular intervals until a response is received from the DOTS
server. If the DOTS client cannot maintain an RTT estimate, it MUST server. If the DOTS client cannot maintain an RTT estimate, it MUST
NOT send more than one Non-confirmable request every 3 seconds, and NOT send more than one Non-confirmable request every 3 seconds and
SHOULD use an even less aggressive rate whenever possible (case 2 in SHOULD use an even less aggressive rate whenever possible (case 2 in
Section 3.1.3 of [RFC8085]). Mitigation requests MUST NOT be delayed Section 3.1.3 of [RFC8085]). Mitigation requests MUST NOT be delayed
because of checks on probing rate (Section 4.7 of [RFC7252]). because of checks on probing rate (Section 4.7 of [RFC7252]).
JSON encoding of YANG modeled data [RFC7951] is used to illustrate JSON encoding of YANG-modeled data [RFC7951] is used to illustrate
the various methods defined in the following subsections. Also, the the various methods defined in the following subsections. Also, the
examples use the Labels defined in Sections 10.6.2, 10.6.3, 10.6.4, examples use the Labels defined in Sections 10.6.2, 10.6.3, 10.6.4,
and 10.6.5. and 10.6.5.
The DOTS client MUST authenticate itself to the DOTS server The DOTS client MUST authenticate itself to the DOTS server
(Section 8). The DOTS server MAY use the algorithm presented in (Section 8). The DOTS server MAY use the algorithm presented in
Section 7 of [RFC7589] to derive the DOTS client identity or username Section 7 of [RFC7589] to derive the DOTS client identity or username
from the client certificate. The DOTS client identity allows the from the client certificate. The DOTS client identity allows the
DOTS server to accept mitigation requests with scopes that the DOTS DOTS server to accept mitigation requests with scopes that the DOTS
client is authorized to manage. client is authorized to manage.
skipping to change at page 14, line 31 skipping to change at line 636
Uri-Path: "dots" Uri-Path: "dots"
Uri-Path: "mitigate" Uri-Path: "mitigate"
Uri-Path: "cuid=dz6pHjaADkaFTbjr0JGBpw" Uri-Path: "cuid=dz6pHjaADkaFTbjr0JGBpw"
Uri-Path: "mid=123" Uri-Path: "mid=123"
Content-Format: "application/dots+cbor" Content-Format: "application/dots+cbor"
{ {
... ...
} }
Figure 5: PUT to Convey DOTS Mitigation Requests Figure 5: PUT to Convey DOTS Mitigation Requests
The order of the Uri-Path options is important as it defines the CoAP The order of the Uri-Path options is important, as it defines the
resource. In particular, 'mid' MUST follow 'cuid'. CoAP resource. In particular, 'mid' MUST follow 'cuid'.
The additional Uri-Path parameters to those defined in Section 4.2 The additional Uri-Path parameters to those defined in Section 4.2
are as follows: are as follows:
cuid: Stands for Client Unique Identifier. A globally unique cuid: Stands for Client Unique Identifier. A globally unique
identifier that is meant to prevent collisions among DOTS identifier that is meant to prevent collisions among DOTS
clients, especially those from the same domain. It MUST be clients, especially those from the same domain. It MUST be
generated by DOTS clients. generated by DOTS clients.
For the reasons discussed in Appendix B, implementations SHOULD For the reasons discussed in Appendix B, implementations
set 'cuid' using the following procedure: first, the DOTS SHOULD set 'cuid' using the following procedure: first, the
client inputs one of the following into the SHA-256 [RFC6234] DOTS client inputs one of the following into the SHA-256
cryptographic hash: the DER-encoded ASN.1 representation of the [RFC6234] cryptographic hash: the DER-encoded ASN.1
Subject Public Key Info (SPKI) of its X.509 certificate representation of the Subject Public Key Info (SPKI) of its
[RFC5280], its raw public key [RFC7250], the "Pre-Shared Key X.509 certificate [RFC5280], its raw public key [RFC7250], the
(PSK) identity" it uses in the TLS 1.2 ClientKeyExchange "Pre-Shared Key (PSK) identity" it uses in the TLS 1.2
message, or the "identity" it uses in the "pre_shared_key" TLS ClientKeyExchange message, or the "identity" it uses in the
1.3 extension. Then, the output of the cryptographic hash "pre_shared_key" TLS 1.3 extension. Then, the output of the
algorithm is truncated to 16 bytes; truncation is done by cryptographic hash algorithm is truncated to 16 bytes;
stripping off the final 16 bytes. The truncated output is truncation is done by stripping off the final 16 bytes. The
base64url encoded (Section 5 of [RFC4648]) with the two truncated output is base64url encoded (Section 5 of [RFC4648])
trailing "=" removed from the encoding, and the resulting value with the two trailing "=" removed from the encoding, and the
used as the 'cuid'. resulting value used as the 'cuid'.
The 'cuid' is intended to be stable when communicating with a The 'cuid' is intended to be stable when communicating with a
given DOTS server, i.e., the 'cuid' used by a DOTS client given DOTS server, i.e., the 'cuid' used by a DOTS client
SHOULD NOT change over time. Distinct 'cuid' values MAY be SHOULD NOT change over time. Distinct 'cuid' values MAY be
used by a single DOTS client per DOTS server. used by a single DOTS client per DOTS server.
If a DOTS client has to change its 'cuid' for some reason, it If a DOTS client has to change its 'cuid' for some reason, it
MUST NOT do so when mitigations are still active for the old MUST NOT do so when mitigations are still active for the old
'cuid'. The 'cuid' SHOULD be 22 characters to avoid DOTS 'cuid'. The 'cuid' SHOULD be 22 characters to avoid DOTS
signal message fragmentation over UDP. Furthermore, if that signal message fragmentation over UDP. Furthermore, if that
DOTS client created aliases and filtering entries at the DOTS DOTS client created aliases and filtering entries at the DOTS
server by means of the DOTS data channel, it MUST delete all server by means of the DOTS data channel, it MUST delete all
the entries bound to the old 'cuid' and reinstall them using the entries bound to the old 'cuid' and reinstall them using
the new 'cuid'. the new 'cuid'.
DOTS servers MUST return 4.09 (Conflict) error code to a DOTS DOTS servers MUST return 4.09 (Conflict) error code to a DOTS
peer to notify that the 'cuid' is already in use by another peer to notify that the 'cuid' is already in use by another
DOTS client. Upon receipt of that error code, a new 'cuid' DOTS client. Upon receipt of that error code, a new 'cuid'
MUST be generated by the DOTS peer (e.g., using [RFC4122]). MUST be generated by the DOTS peer (e.g., using [RFC4122]).
Client-domain DOTS gateways MUST handle 'cuid' collision Client-domain DOTS gateways MUST handle 'cuid' collision
directly and it is RECOMMENDED that 'cuid' collision is handled directly, and it is RECOMMENDED that 'cuid' collision is
directly by server-domain DOTS gateways. handled directly by server-domain DOTS gateways.
DOTS gateways MAY rewrite the 'cuid' used by peer DOTS clients. DOTS gateways MAY rewrite the 'cuid' used by peer DOTS
Triggers for such rewriting are out of scope. clients. Triggers for such rewriting are out of scope.
This is a mandatory Uri-Path parameter. This is a mandatory Uri-Path parameter.
mid: Identifier for the mitigation request represented with an mid: Identifier for the mitigation request represented with an
integer. This identifier MUST be unique for each mitigation integer. This identifier MUST be unique for each mitigation
request bound to the DOTS client, i.e., the 'mid' parameter request bound to the DOTS client, i.e., the 'mid' parameter
value in the mitigation request needs to be unique (per 'cuid' value in the mitigation request needs to be unique (per 'cuid'
and DOTS server) relative to the 'mid' parameter values of and DOTS server) relative to the 'mid' parameter values of
active mitigation requests conveyed from the DOTS client to the active mitigation requests conveyed from the DOTS client to
DOTS server. the DOTS server.
In order to handle out-of-order delivery of mitigation In order to handle out-of-order delivery of mitigation
requests, 'mid' values MUST increase monotonically. requests, 'mid' values MUST increase monotonically.
If the 'mid' value has reached 3/4 of (2^(32) - 1) (i.e., If the 'mid' value has reached 3/4 of (2^(32) - 1) (i.e.,
3221225471) and no attack is detected, the DOTS client MUST 3221225471) and no attack is detected, the DOTS client MUST
reset 'mid' to 0 to handle 'mid' rollover. If the DOTS client reset 'mid' to 0 to handle 'mid' rollover. If the DOTS client
maintains mitigation requests with preconfigured scopes, it maintains mitigation requests with preconfigured scopes, it
MUST recreate them with the 'mid' restarting at 0. MUST recreate them with the 'mid' restarting at 0.
This identifier MUST be generated by the DOTS client. This identifier MUST be generated by the DOTS client.
This is a mandatory Uri-Path parameter. This is a mandatory Uri-Path parameter.
'cuid' and 'mid' MUST NOT appear in the PUT request message body 'cuid' and 'mid' MUST NOT appear in the PUT request message body
(Figure 6). The schema in Figure 6 uses the types defined in (Figure 6). The schema in Figure 6 uses the types defined in
Section 6. Note that this figure (and other similar figures Section 6. Note that this figure (and other similar figures
depicting a schema) are non-normative sketches of the structure of depicting a schema) are nonnormative sketches of the structure of the
the message. message.
{ {
"ietf-dots-signal-channel:mitigation-scope": { "ietf-dots-signal-channel:mitigation-scope": {
"scope": [ "scope": [
{ {
"target-prefix": [ "target-prefix": [
"string" "string"
], ],
"target-port-range": [ "target-port-range": [
{ {
skipping to change at page 16, line 49 skipping to change at line 751
"alias-name": [ "alias-name": [
"string" "string"
], ],
"lifetime": number, "lifetime": number,
"trigger-mitigation": true|false "trigger-mitigation": true|false
} }
] ]
} }
} }
Figure 6: PUT to Convey DOTS Mitigation Requests (Message Body Figure 6: PUT to Convey DOTS Mitigation Requests (Message Body
Schema) Schema)
The parameters in the CBOR body (Figure 6) of the PUT request are The parameters in the CBOR body (Figure 6) of the PUT request are
described below: described below:
target-prefix: A list of prefixes identifying resources under target-prefix: A list of prefixes identifying resources under
attack. Prefixes are represented using Classless Inter-Domain attack. Prefixes are represented using Classless Inter-Domain
Routing (CIDR) notation [RFC4632]. Routing (CIDR) notation [RFC4632].
The prefix length must be less than or equal to 32 for IPv4 and The prefix length must be less than or equal to 32 for IPv4 and
skipping to change at page 17, line 26 skipping to change at line 775
addresses. These addresses are considered to be invalid values. addresses. These addresses are considered to be invalid values.
In addition, the DOTS server MUST validate that target prefixes In addition, the DOTS server MUST validate that target prefixes
are within the scope of the DOTS client domain. Other validation are within the scope of the DOTS client domain. Other validation
checks may be supported by DOTS servers. checks may be supported by DOTS servers.
This is an optional attribute. This is an optional attribute.
target-port-range: A list of port numbers bound to resources under target-port-range: A list of port numbers bound to resources under
attack. attack.
A port range is defined by two bounds, a lower port number A port range is defined by two bounds: a lower port number
('lower-port') and an upper port number ('upper-port'). When only ('lower-port') and an upper port number ('upper-port'). When only
'lower-port' is present, it represents a single port number. 'lower-port' is present, it represents a single port number.
For TCP, UDP, Stream Control Transmission Protocol (SCTP) For TCP, UDP, Stream Control Transmission Protocol (SCTP)
[RFC4960], or Datagram Congestion Control Protocol (DCCP) [RFC4960], or Datagram Congestion Control Protocol (DCCP)
[RFC4340], a range of ports can be, for example, 0-1023, [RFC4340], a range of ports can be, for example, 0-1023,
1024-65535, or 1024-49151. 1024-65535, or 1024-49151.
This is an optional attribute. This is an optional attribute.
skipping to change at page 18, line 36 skipping to change at line 834
alias-name: A list of aliases of resources for which the mitigation alias-name: A list of aliases of resources for which the mitigation
is requested. Aliases can be created using the DOTS data channel is requested. Aliases can be created using the DOTS data channel
(Section 6.1 of [RFC8783]), direct configuration, or other means. (Section 6.1 of [RFC8783]), direct configuration, or other means.
An alias is used in subsequent signal channel exchanges to refer An alias is used in subsequent signal channel exchanges to refer
more efficiently to the resources under attack. more efficiently to the resources under attack.
This is an optional attribute. This is an optional attribute.
lifetime: Lifetime of the mitigation request in seconds. The lifetime: Lifetime of the mitigation request in seconds. The
RECOMMENDED lifetime of a mitigation request is 3600 seconds: this RECOMMENDED lifetime of a mitigation request is 3600 seconds; this
value was chosen to be long enough so that refreshing is not value was chosen to be long enough so that refreshing is not
typically a burden on the DOTS client, while still making the typically a burden on the DOTS client while still making the
request expire in a timely manner when the client has unexpectedly request expire in a timely manner when the client has unexpectedly
quit. DOTS clients MUST include this parameter in their quit. DOTS clients MUST include this parameter in their
mitigation requests. mitigation requests.
A lifetime of '0' in a mitigation request is an invalid value. A lifetime of '0' in a mitigation request is an invalid value.
A lifetime of negative one (-1) indicates indefinite lifetime for A lifetime of negative one (-1) indicates indefinite lifetime for
the mitigation request. The DOTS server MAY refuse an indefinite the mitigation request. The DOTS server MAY refuse an indefinite
lifetime, for policy reasons; the granted lifetime value is lifetime, for policy reasons; the granted lifetime value is
returned in the response. DOTS clients MUST be prepared to not be returned in the response. DOTS clients MUST be prepared to not be
skipping to change at page 19, line 42 skipping to change at line 886
specification does not allow the inclusion of multiple mitigation specification does not allow the inclusion of multiple mitigation
requests in the same PUT request. Concretely, a DOTS client MUST NOT requests in the same PUT request. Concretely, a DOTS client MUST NOT
include multiple entries in the 'scope' array of the same PUT include multiple entries in the 'scope' array of the same PUT
request. request.
FQDN and URI mitigation scopes may be thought of as a form of scope FQDN and URI mitigation scopes may be thought of as a form of scope
alias, in which the addresses associated with the domain name or URI alias, in which the addresses associated with the domain name or URI
(as resolved by the DOTS server) represent the scope of the (as resolved by the DOTS server) represent the scope of the
mitigation. Particularly, the IP addresses to which the host mitigation. Particularly, the IP addresses to which the host
subcomponent of authority component of a URI resolves represent the subcomponent of authority component of a URI resolves represent the
'target-prefix', the URI scheme represents the 'target-protocol', the 'target-prefix', the URI scheme represents the 'target-protocol', and
port subcomponent of authority component of a URI represents the the port subcomponent of authority component of a URI represents the
'target-port-range'. If the optional port information is not present 'target-port-range'. If the optional port information is not present
in the authority component, the default port defined for the URI in the authority component, the default port defined for the URI
scheme represents the 'target-port'. scheme represents the 'target-port'.
In the PUT request, at least one of the attributes 'target-prefix', In the PUT request, at least one of the attributes 'target-prefix',
'target-fqdn','target-uri', or 'alias-name' MUST be present. 'target-fqdn','target-uri', or 'alias-name' MUST be present.
Attributes and Uri-Path parameters with empty values MUST NOT be Attributes and Uri-Path parameters with empty values MUST NOT be
present in a request as an empty value will render the entire request present in a request, as an empty value will render the entire
invalid. request invalid.
Figure 7 shows a PUT request example to signal that servers Figure 7 shows a PUT request example to signal that servers
2001:db8:6401::1 and 2001:db8:6401::2 are receiving attack traffic on 2001:db8:6401::1 and 2001:db8:6401::2 are receiving attack traffic on
TCP port numbers 80, 8080, and 443. The presence of 'cdid' indicates TCP port numbers 80, 8080, and 443. The presence of 'cdid' indicates
that a server-domain DOTS gateway has modified the initial PUT that a server-domain DOTS gateway has modified the initial PUT
request sent by the DOTS client. Note that 'cdid' MUST NOT appear in request sent by the DOTS client. Note that 'cdid' MUST NOT appear in
the PUT request message body. the PUT request message body.
Header: PUT (Code=0.03) Header: PUT (Code=0.03)
Uri-Path: ".well-known" Uri-Path: ".well-known"
skipping to change at page 21, line 42 skipping to change at line 943
], ],
"target-protocol": [ "target-protocol": [
6 6
], ],
"lifetime": 3600 "lifetime": 3600
} }
] ]
} }
} }
Figure 7: PUT for DOTS Mitigation Request (An Example) Figure 7: PUT for DOTS Mitigation Request (An Example)
The corresponding CBOR encoding format for the payload is shown in The corresponding CBOR encoding format for the payload is shown in
Figure 8. Figure 8.
A1 # map(1) A1 # map(1)
01 # unsigned(1) 01 # unsigned(1)
A1 # map(1) A1 # map(1)
02 # unsigned(2) 02 # unsigned(2)
81 # array(1) 81 # array(1)
A4 # map(4) A4 # map(4)
skipping to change at page 22, line 34 skipping to change at line 977
19 01BB # unsigned(443) 19 01BB # unsigned(443)
A1 # map(1) A1 # map(1)
08 # unsigned(8) 08 # unsigned(8)
19 1F90 # unsigned(8080) 19 1F90 # unsigned(8080)
0A # unsigned(10) 0A # unsigned(10)
81 # array(1) 81 # array(1)
06 # unsigned(6) 06 # unsigned(6)
0E # unsigned(14) 0E # unsigned(14)
19 0E10 # unsigned(3600) 19 0E10 # unsigned(3600)
Figure 8: PUT for DOTS Mitigation Request (CBOR) Figure 8: PUT for DOTS Mitigation Request (CBOR)
4.4.1.2. Server-domain DOTS Gateways 4.4.1.2. Server-Domain DOTS Gateways
In deployments where server-domain DOTS gateways are enabled, In deployments where server-domain DOTS gateways are enabled,
identity information about the origin source client domain ('cdid') identity information about the origin source client domain ('cdid')
SHOULD be propagated to the DOTS server. That information is meant SHOULD be propagated to the DOTS server. That information is meant
to assist the DOTS server in enforcing some policies such as grouping to assist the DOTS server in enforcing some policies, such as
DOTS clients that belong to the same DOTS domain, limiting the number grouping DOTS clients that belong to the same DOTS domain, limiting
of DOTS requests, and identifying the mitigation scope. These the number of DOTS requests, and identifying the mitigation scope.
policies can be enforced per client, per client domain, or both. These policies can be enforced per client, per client domain, or
Also, the identity information may be used for auditing and debugging both. Also, the identity information may be used for auditing and
purposes. debugging purposes.
Figure 9 shows an example of a request relayed by a server-domain Figure 9 shows an example of a request relayed by a server-domain
DOTS gateway. DOTS gateway.
Header: PUT (Code=0.03) Header: PUT (Code=0.03)
Uri-Path: ".well-known" Uri-Path: ".well-known"
Uri-Path: "dots" Uri-Path: "dots"
Uri-Path: "mitigate" Uri-Path: "mitigate"
Uri-Path: "cdid=7eeaf349529eb55ed50113" Uri-Path: "cdid=7eeaf349529eb55ed50113"
Uri-Path: "cuid=dz6pHjaADkaFTbjr0JGBpw" Uri-Path: "cuid=dz6pHjaADkaFTbjr0JGBpw"
Uri-Path: "mid=123" Uri-Path: "mid=123"
Content-Format: "application/dots+cbor" Content-Format: "application/dots+cbor"
{ {
... ...
} }
Figure 9: PUT for DOTS Mitigation Request as Relayed by a DOTS Figure 9: PUT for DOTS Mitigation Request as Relayed by a DOTS
Gateway Gateway
A server-domain DOTS gateway SHOULD add the following Uri-Path A server-domain DOTS gateway SHOULD add the following Uri-Path
parameter: parameter:
cdid: Stands for Client Domain Identifier. The 'cdid' is conveyed by cdid: Stands for Client Domain Identifier. The 'cdid' is conveyed
a server-domain DOTS gateway to propagate the source domain by a server-domain DOTS gateway to propagate the source domain
identity from the gateway's client-facing side to the gateway's identity from the gateway's client-facing side to the
server-facing side, and from the gateway's server-facing side gateway's server-facing side and from the gateway's server-
to the DOTS server. 'cdid' may be used by the final DOTS facing side to the DOTS server. 'cdid' may be used by the
server for policy enforcement purposes (e.g., enforce a quota final DOTS server for policy-enforcement purposes (e.g.,
on filtering rules). These policies are deployment specific. enforce a quota on filtering rules). These policies are
deployment specific.
Server-domain DOTS gateways SHOULD support a configuration Server-domain DOTS gateways SHOULD support a configuration
option to instruct whether 'cdid' parameter is to be inserted. option to instruct whether the 'cdid' parameter is to be
inserted.
In order to accommodate deployments that require enforcing per- In order to accommodate deployments that require enforcing
client policies, per-client domain policies, or a combination per-client policies, per-client domain policies, or a
thereof, server-domain DOTS gateways instructed to insert the combination thereof, server-domain DOTS gateways instructed to
'cdid' parameter MUST supply the SPKI hash of the DOTS client insert the 'cdid' parameter MUST supply the SPKI hash of the
X.509 certificate, the DOTS client raw public key, or the hash DOTS client X.509 certificate, the DOTS client raw public key,
of the "PSK identity" in the 'cdid', following the same rules or the hash of the "PSK identity" in the 'cdid', following the
for generating the hash conveyed in 'cuid', which is then used same rules for generating the hash conveyed in 'cuid', which
by the ultimate DOTS server to determine the corresponding is then used by the ultimate DOTS server to determine the
client's domain. The 'cdid' generated by a server-domain corresponding client's domain. The 'cdid' generated by a
gateway is likely to be the same as the 'cuid' except the case server-domain gateway is likely to be the same as the 'cuid'
in which the DOTS message was relayed by a client-domain DOTS except the case in which the DOTS message was relayed by a
gateway or the 'cuid' was generated by a rogue DOTS client. client-domain DOTS gateway or the 'cuid' was generated by a
rogue DOTS client.
If a DOTS client is provisioned, for example, with distinct If a DOTS client is provisioned, for example, with distinct
certificates to use to peer with distinct server-domain DOTS certificates to use to peer with distinct server-domain DOTS
gateways that peer to the same DOTS server, distinct 'cdid' gateways that peer to the same DOTS server, distinct 'cdid'
values may be supplied by the server-domain DOTS gateways to values may be supplied by the server-domain DOTS gateways to
the server. The ultimate DOTS server MUST treat those 'cdid' the server. The ultimate DOTS server MUST treat those 'cdid'
values as equivalent. values as equivalent.
The 'cdid' attribute MUST NOT be generated and included by DOTS The 'cdid' attribute MUST NOT be generated and included by
clients. DOTS clients.
DOTS servers MUST ignore 'cdid' attributes that are directly DOTS servers MUST ignore 'cdid' attributes that are directly
supplied by source DOTS clients or client-domain DOTS gateways. supplied by source DOTS clients or client-domain DOTS
This implies that first server-domain DOTS gateways MUST strip gateways. This implies that first server-domain DOTS gateways
'cdid' attributes supplied by DOTS clients. DOTS servers MUST strip 'cdid' attributes supplied by DOTS clients. DOTS
SHOULD support a configuration parameter to identify DOTS servers SHOULD support a configuration parameter to identify
gateways that are trusted to supply 'cdid' attributes. DOTS gateways that are trusted to supply 'cdid' attributes.
Only single-valued 'cdid' are defined in this document. That Only single-valued 'cdid' are defined in this document. That
is, only the first on-path server-domain DOTS gateway can is, only the first on-path server-domain DOTS gateway can
insert a 'cdid' value. This specification does not allow insert a 'cdid' value. This specification does not allow
multiple server-domain DOTS gateways, whenever involved in the multiple server-domain DOTS gateways, whenever involved in the
path, to insert a 'cdid' value for each server-domain gateway. path, to insert a 'cdid' value for each server-domain gateway.
This is an optional Uri-Path. When present, 'cdid' MUST be This is an optional Uri-Path. When present, 'cdid' MUST be
positioned before 'cuid'. positioned before 'cuid'.
A DOTS gateway SHOULD add the CoAP Hop-Limit Option [RFC8768]. A DOTS gateway SHOULD add the CoAP Hop-Limit Option [RFC8768].
4.4.1.3. Processing Mitigation Requests 4.4.1.3. Processing Mitigation Requests
The DOTS server couples the DOTS signal and data channel sessions The DOTS server couples the DOTS signal and data channel sessions
using the DOTS client identity and optionally the 'cdid' parameter using the DOTS client identity and optionally the 'cdid' parameter
value, so the DOTS server can validate whether the aliases conveyed value, so the DOTS server can validate whether the aliases conveyed
in the mitigation request were indeed created by the same DOTS client in the mitigation request were indeed created by the same DOTS client
using the DOTS data channel session. If the aliases were not created using the DOTS data channel session. If the aliases were not created
skipping to change at page 26, line 12 skipping to change at line 1148
prefix, FQDN, URI, or alias. To avoid maintaining a long list of prefix, FQDN, URI, or alias. To avoid maintaining a long list of
overlapping mitigation requests (i.e., requests with the same overlapping mitigation requests (i.e., requests with the same
'trigger-mitigation' type and overlapping scopes) from a DOTS client 'trigger-mitigation' type and overlapping scopes) from a DOTS client
and to avoid error-prone provisioning of mitigation requests from a and to avoid error-prone provisioning of mitigation requests from a
DOTS client, the overlapped lower numeric 'mid' MUST be automatically DOTS client, the overlapped lower numeric 'mid' MUST be automatically
deleted and no longer available at the DOTS server. For example, if deleted and no longer available at the DOTS server. For example, if
the DOTS server receives a mitigation request that overlaps with an the DOTS server receives a mitigation request that overlaps with an
existing mitigation with a higher numeric 'mid', the DOTS server existing mitigation with a higher numeric 'mid', the DOTS server
rejects the request by returning 4.09 (Conflict) to the DOTS client. rejects the request by returning 4.09 (Conflict) to the DOTS client.
The response MUST include enough information for a DOTS client to The response MUST include enough information for a DOTS client to
recognize the source of the conflict as described below in the recognize the source of the conflict, as described below in the
'conflict-information' subtree (Section 5.1) with only the relevant 'conflict-information' subtree (Section 5.1), with only the relevant
nodes listed: nodes listed:
conflict-information: Indicates that a mitigation request is conflict-information: Indicates that a mitigation request is
conflicting with another mitigation request. This attribute has conflicting with another mitigation request. This attribute has
the following structure: the following structure:
conflict-cause: Indicates the cause of the conflict. The conflict-cause: Indicates the cause of the conflict. The
following value MUST be returned: following value MUST be returned:
1: Overlapping targets. 'conflict-scope' provides more details 1: Overlapping targets. 'conflict-scope' provides more details
about the conflicting target clauses. about the conflicting target clauses.
conflict-scope: Characterizes the exact conflict scope. It may conflict-scope: Characterizes the exact conflict scope. It may
include a list of IP addresses, a list of prefixes, a list of include a list of IP addresses, a list of prefixes, a list of
target protocols, a list of FQDNs, a list of URIs, a list of target protocols, a list of FQDNs, a list of URIs, a list of
aliases, or a 'mid'. A list of port numbers may also be aliases, or a 'mid'. A list of port numbers may also be
included if there is a common IP address, IP prefix, FQDN, URI, included if there is a common IP address, IP prefix, FQDN, URI,
or alias. or alias.
If the DOTS server receives a mitigation request that overlaps with If the DOTS server receives a mitigation request that overlaps with
an active mitigation request, but both have distinct 'trigger- an active mitigation request, but both have distinct 'trigger-
skipping to change at page 27, line 34 skipping to change at line 1217
enough information for a DOTS client to recognize the source of the enough information for a DOTS client to recognize the source of the
conflict as described below: conflict as described below:
conflict-information: Indicates that a mitigation request is conflict-information: Indicates that a mitigation request is
conflicting with another mitigation request(s) from other DOTS conflicting with another mitigation request(s) from other DOTS
client(s). This attribute has the following structure: client(s). This attribute has the following structure:
conflict-status: Indicates the status of a conflicting mitigation conflict-status: Indicates the status of a conflicting mitigation
request. The following values are defined: request. The following values are defined:
1: DOTS server has detected conflicting mitigation requests 1: DOTS server has detected conflicting mitigation requests
from different DOTS clients. This mitigation request is from different DOTS clients. This mitigation request is
currently inactive until the conflicts are resolved. currently inactive until the conflicts are resolved.
Another mitigation request is active. Another mitigation request is active.
2: DOTS server has detected conflicting mitigation requests 2: DOTS server has detected conflicting mitigation requests
from different DOTS clients. This mitigation request is from different DOTS clients. This mitigation request is
currently active. currently active.
3: DOTS server has detected conflicting mitigation requests 3: DOTS server has detected conflicting mitigation requests
from different DOTS clients. All conflicting mitigation from different DOTS clients. All conflicting mitigation
requests are inactive. requests are inactive.
conflict-cause: Indicates the cause of the conflict. The conflict-cause: Indicates the cause of the conflict. The
following values are defined: following values are defined:
1: Overlapping targets. 'conflict-scope' provides more details 1: Overlapping targets. 'conflict-scope' provides more
about the conflicting target clauses. details about the conflicting target clauses.
2: Conflicts with an existing accept-list. This code is 2: Conflicts with an existing accept-list. This code is
returned when the DDoS mitigation detects source addresses/ returned when the DDoS mitigation detects source
prefixes in the accept-listed ACLs are attacking the addresses/prefixes in the accept-listed Access Control
target. Lists (ACLs) are attacking the target.
3: CUID Collision. This code is returned when a DOTS client 3: CUID Collision. This code is returned when a DOTS client
uses a 'cuid' that is already used by another DOTS client. uses a 'cuid' that is already used by another DOTS
This code is an indication that the request has been client. This code is an indication that the request has
rejected and a new request with a new 'cuid' is to be re- been rejected and a new request with a new 'cuid' is to
sent by the DOTS client (see the example shown in be re-sent by the DOTS client (see the example shown in
Figure 11). Note that 'conflict-status', 'conflict-scope', Figure 11). Note that 'conflict-status', 'conflict-
and 'retry-timer' MUST NOT be returned in the error scope', and 'retry-timer' MUST NOT be returned in the
response. error response.
conflict-scope: Characterizes the exact conflict scope. It may conflict-scope: Characterizes the exact conflict scope. It may
include a list of IP addresses, a list of prefixes, a list of include a list of IP addresses, a list of prefixes, a list of
target protocols, a list of FQDNs, a list of URIs, a list of target protocols, a list of FQDNs, a list of URIs, a list of
aliases, or references to conflicting ACLs (by an 'acl-name', aliases, or references to conflicting ACLs (by an 'acl-name',
typically [RFC8783]). A list of port numbers may also be typically [RFC8783]). A list of port numbers may also be
included if there is a common IP address, IP prefix, FQDN, URI, included if there is a common IP address, IP prefix, FQDN, URI,
or alias. or alias.
retry-timer: Indicates, in seconds, the time after which the DOTS retry-timer: Indicates, in seconds, the time after which the DOTS
skipping to change at page 30, line 26 skipping to change at line 1347
Uri-Path parameters with empty values MUST NOT be present in a Uri-Path parameters with empty values MUST NOT be present in a
request. request.
The same considerations for manipulating the 'cdid' parameter by The same considerations for manipulating the 'cdid' parameter by
server-domain DOTS gateways specified in Section 4.4.1 MUST be server-domain DOTS gateways specified in Section 4.4.1 MUST be
followed for GET requests. followed for GET requests.
The 'c' Uri-Query option is used to control selection of The 'c' Uri-Query option is used to control selection of
configuration and non-configuration data nodes. Concretely, the 'c' configuration and non-configuration data nodes. Concretely, the 'c'
(content) parameter and its permitted values defined in Table 2 (content) parameter and its permitted values defined in Table 2 of
[I-D.ietf-core-comi] can be used to retrieve non-configuration data [CORE-COMI] can be used to retrieve non-configuration data (attack
(attack mitigation status), configuration data, or both. The DOTS mitigation status), configuration data, or both. The DOTS server MAY
server MAY support this optional filtering capability. It can safely support this optional filtering capability. It can safely ignore it
ignore it if not supported. If the DOTS client supports the optional if not supported. If the DOTS client supports the optional filtering
filtering capability, it SHOULD use "c=n" query (to get back only the capability, it SHOULD use "c=n" query (to get back only the
dynamically changing data) or "c=c" query (to get back the static dynamically changing data) or "c=c" query (to get back the static
configuration values) when the DDoS attack is active to limit the configuration values) when the DDoS attack is active to limit the
size of the response. size of the response.
+-------+-----------------------------------------------------+ +=======+=====================================================+
| Value | Description | | Value | Description |
+=======+=====================================================+ +=======+=====================================================+
| c | Return only configuration descendant data nodes | | c | Return only configuration descendant data nodes |
+-------+-----------------------------------------------------+ +-------+-----------------------------------------------------+
| n | Return only non-configuration descendant data nodes | | n | Return only non-configuration descendant data nodes |
+-------+-----------------------------------------------------+ +-------+-----------------------------------------------------+
| a | Return all descendant data nodes | | a | Return all descendant data nodes |
+-------+-----------------------------------------------------+ +-------+-----------------------------------------------------+
Table 2: Permitted Values of the 'c' Parameter Table 2: Permitted Values of the 'c' Parameter
The DOTS client can use block-wise transfer [RFC7959] to get the list The DOTS client can use block-wise transfer [RFC7959] to get the list
of all its mitigations maintained by a DOTS server, it can send a of all its mitigations maintained by a DOTS server; it can send a
Block2 Option in a GET request with NUM = 0 to aid in limiting the Block2 Option in a GET request with NUM = 0 to aid in limiting the
size of the response. If the representation of all the active size of the response. If the representation of all the active
mitigation requests associated with the DOTS client does not fit mitigation requests associated with the DOTS client does not fit
within a single datagram, the DOTS server MUST use the Block2 Option within a single datagram, the DOTS server MUST use the Block2 Option
with NUM = 0 in the GET response. The Size2 Option may be conveyed with NUM = 0 in the GET response. The Size2 Option may be conveyed
in the response to indicate the total size of the resource in the response to indicate the total size of the resource
representation. The DOTS client retrieves the rest of the representation. The DOTS client retrieves the rest of the
representation by sending additional GET requests with Block2 Options representation by sending additional GET requests with Block2 Options
containing NUM values greater than zero. The DOTS client MUST adhere containing NUM values greater than zero. The DOTS client MUST adhere
to the block size preferences indicated by the DOTS server in the to the block size preferences indicated by the DOTS server in the
response. If the DOTS server uses the Block2 Option in the GET response. If the DOTS server uses the Block2 Option in the GET
response, and the response is for a dynamically changing resource response, and the response is for a dynamically changing resource
(e.g., "c=n" or "c=a" query), the DOTS server MUST include the ETag (e.g., "c=n" or "c=a" query), the DOTS server MUST include the ETag
Option in the response. The DOTS client MUST include the same ETag Option in the response. The DOTS client MUST include the same ETag
value in subsequent GET requests to retrieve the rest of the value in subsequent GET requests to retrieve the rest of the
representation. representation.
The following examples illustrate how a DOTS client retrieves active The following examples illustrate how a DOTS client retrieves active
mitigation requests from a DOTS server. In particular: mitigation requests from a DOTS server. In particular:
o Figure 12 shows the example of a GET request to retrieve all DOTS * Figure 12 shows the example of a GET request to retrieve all DOTS
mitigation requests signaled by a DOTS client. mitigation requests signaled by a DOTS client.
o Figure 13 shows the example of a GET request to retrieve a * Figure 13 shows the example of a GET request to retrieve a
specific DOTS mitigation request signaled by a DOTS client. The specific DOTS mitigation request signaled by a DOTS client. The
configuration data to be reported in the response is formatted in configuration data to be reported in the response is formatted in
the same order as it was processed by the DOTS server in the the same order as it was processed by the DOTS server in the
original mitigation request. original mitigation request.
These two examples assume the default of "c=a"; that is, the DOTS These two examples assume the default of "c=a"; that is, the DOTS
client asks for all data to be reported by the DOTS server. client asks for all data to be reported by the DOTS server.
Header: GET (Code=0.01) Header: GET (Code=0.01)
Uri-Path: ".well-known" Uri-Path: ".well-known"
skipping to change at page 32, line 16 skipping to change at line 1433
the GET request in its configuration data for the requesting DOTS the GET request in its configuration data for the requesting DOTS
client, it MUST respond with a 4.04 (Not Found) error Response Code. client, it MUST respond with a 4.04 (Not Found) error Response Code.
Likewise, the same error MUST be returned as a response to a request Likewise, the same error MUST be returned as a response to a request
to retrieve all mitigation records (i.e., 'mid' Uri-Path is not to retrieve all mitigation records (i.e., 'mid' Uri-Path is not
defined) of a given DOTS client if the DOTS server does not find any defined) of a given DOTS client if the DOTS server does not find any
mitigation record for that DOTS client. As a reminder, a DOTS client mitigation record for that DOTS client. As a reminder, a DOTS client
is identified by its identity (e.g., client certificate, 'cuid') and is identified by its identity (e.g., client certificate, 'cuid') and
optionally the 'cdid'. optionally the 'cdid'.
Figure 14 shows a response example of all active mitigation requests Figure 14 shows a response example of all active mitigation requests
associated with the DOTS client as maintained by the DOTS server. associated with the DOTS client, as maintained by the DOTS server.
The response indicates the mitigation status of each mitigation The response indicates the mitigation status of each mitigation
request. request.
{ {
"ietf-dots-signal-channel:mitigation-scope": { "ietf-dots-signal-channel:mitigation-scope": {
"scope": [ "scope": [
{ {
"mid": 12332, "mid": 12332,
"mitigation-start": "1507818434", "mitigation-start": "1507818434",
"target-prefix": [ "target-prefix": [
skipping to change at page 35, line 5 skipping to change at line 1531
This is an optional attribute. This is an optional attribute.
pps-dropped: The average number of dropped packets per second for pps-dropped: The average number of dropped packets per second for
the mitigation request since the attack mitigation was triggered. the mitigation request since the attack mitigation was triggered.
This average SHOULD be over five-minute intervals (that is, This average SHOULD be over five-minute intervals (that is,
measuring packets into five-minute buckets and then averaging measuring packets into five-minute buckets and then averaging
these buckets over the time since the mitigation was triggered). these buckets over the time since the mitigation was triggered).
This is an optional attribute. This is an optional attribute.
+-----------+----------------------------------------------------+ +===========+====================================================+
| Parameter | Description | | Parameter | Description |
| Value | | | Value | |
+===========+====================================================+ +===========+====================================================+
| 1 | Attack mitigation setup is in progress (e.g., | | 1 | Attack mitigation setup is in progress (e.g., |
| | changing the network path to redirect the inbound | | | changing the network path to redirect the inbound |
| | traffic to a DOTS mitigator). | | | traffic to a DOTS mitigator). |
+-----------+----------------------------------------------------+ +-----------+----------------------------------------------------+
| 2 | Attack is being successfully mitigated (e.g., | | 2 | Attack is being successfully mitigated (e.g., |
| | traffic is redirected to a DDoS mitigator and | | | traffic is redirected to a DDoS mitigator and |
| | attack traffic is dropped). | | | attack traffic is dropped). |
+-----------+----------------------------------------------------+ +-----------+----------------------------------------------------+
| 3 | Attack has stopped and the DOTS client can | | 3 | Attack has stopped and the DOTS client can |
| | withdraw the mitigation request. This status code | | | withdraw the mitigation request. This status code |
| | will be transmitted for immediate mitigation | | | will be transmitted for immediate mitigation |
| | requests till the mitigation is withdrawn or the | | | requests till the mitigation is withdrawn or the |
| | lifetime expires. For mitigation requests with | | | lifetime expires. For mitigation requests with |
| | preconfigured scopes (i.e., 'trigger-mitigation' | | | preconfigured scopes (i.e., 'trigger-mitigation' |
| | set to 'false'), this status code will be | | | set to 'false'), this status code will be |
| | transmitted four times and then transition to "8". | | | transmitted four times and then transition to '8'. |
+-----------+----------------------------------------------------+ +-----------+----------------------------------------------------+
| 4 | Attack has exceeded the mitigation provider | | 4 | Attack has exceeded the mitigation provider |
| | capability. | | | capability. |
+-----------+----------------------------------------------------+ +-----------+----------------------------------------------------+
| 5 | DOTS client has withdrawn the mitigation request | | 5 | DOTS client has withdrawn the mitigation request |
| | and the mitigation is active but terminating. | | | and the mitigation is active but terminating. |
+-----------+----------------------------------------------------+ +-----------+----------------------------------------------------+
| 6 | Attack mitigation is now terminated. | | 6 | Attack mitigation is now terminated. |
+-----------+----------------------------------------------------+ +-----------+----------------------------------------------------+
| 7 | Attack mitigation is withdrawn (by the DOTS | | 7 | Attack mitigation is withdrawn (by the DOTS |
| | server). If a mitigation request with 'trigger- | | | server). If a mitigation request with 'trigger- |
| | mitigation' set to 'false' is withdrawn because it | | | mitigation' set to 'false' is withdrawn because it |
| | overlaps with an immediate mitigation request, | | | overlaps with an immediate mitigation request, |
| | this status code will be transmitted four times | | | this status code will be transmitted four times |
| | and then transition to "8" for the mitigation | | | and then transition to '8' for the mitigation |
| | request with preconfigured scopes. | | | request with preconfigured scopes. |
+-----------+----------------------------------------------------+ +-----------+----------------------------------------------------+
| 8 | Attack mitigation will be triggered for the | | 8 | Attack mitigation will be triggered for the |
| | mitigation request only when the DOTS signal | | | mitigation request only when the DOTS signal |
| | channel session is lost. | | | channel session is lost. |
+-----------+----------------------------------------------------+ +-----------+----------------------------------------------------+
Table 3: Values of 'status' Parameter Table 3: Values of 'status' Parameter
4.4.2.1. DOTS Servers Sending Mitigation Status 4.4.2.1. DOTS Servers Sending Mitigation Status
The Observe Option defined in [RFC7641] extends the CoAP core The Observe Option defined in [RFC7641] extends the CoAP core
protocol with a mechanism for a CoAP client to "observe" a resource protocol with a mechanism for a CoAP client to "observe" a resource
skipping to change at page 36, line 22 skipping to change at line 1592
implementations MUST support the Observe Option for both 'mitigate' implementations MUST support the Observe Option for both 'mitigate'
and 'config' (Section 4.2). and 'config' (Section 4.2).
A DOTS client conveys the Observe Option set to '0' in the GET A DOTS client conveys the Observe Option set to '0' in the GET
request to receive asynchronous notifications of attack mitigation request to receive asynchronous notifications of attack mitigation
status from the DOTS server. status from the DOTS server.
Unidirectional mitigation notifications within the bidirectional Unidirectional mitigation notifications within the bidirectional
signal channel enables asynchronous notifications between the agents. signal channel enables asynchronous notifications between the agents.
[RFC7641] indicates that (1) a notification can be sent in a [RFC7641] indicates that (1) a notification can be sent in a
Confirmable or a Non-confirmable message, and (2) the message type Confirmable or a Non-confirmable message and (2) the message type
used is typically application dependent and may be determined by the used is typically application dependent and may be determined by the
server for each notification individually. For the DOTS server server for each notification individually. For the DOTS server
application, the message type MUST always be set to Non-confirmable application, the message type MUST always be set to Non-confirmable
even if the underlying CoAP library elects a notification to be sent even if the underlying CoAP library elects a notification to be sent
in a Confirmable message. This overrides the behavior defined in in a Confirmable message. This overrides the behavior defined in
Section 4.5 of [RFC7641] to send a Confirmable message instead of a Section 4.5 of [RFC7641] to send a Confirmable message instead of a
Non-confirmable message at least every 24 hours for the following Non-confirmable message at least every 24 hours for the following
reasons: First, the DOTS signal channel uses a heartbeat mechanism to reasons: First, the DOTS signal channel uses a heartbeat mechanism to
determine if the DOTS client is alive. Second, Confirmable messages determine if the DOTS client is alive. Second, Confirmable messages
are not suitable during an attack. are not suitable during an attack.
Due to the higher likelihood of packet loss during a DDoS attack, the Due to the higher likelihood of packet loss during a DDoS attack, the
DOTS server periodically sends attack mitigation status to the DOTS DOTS server periodically sends attack mitigation status to the DOTS
client and also notifies the DOTS client whenever the status of the client and also notifies the DOTS client whenever the status of the
attack mitigation changes. If the DOTS server cannot maintain an RTT attack mitigation changes. If the DOTS server cannot maintain an RTT
estimate, it MUST NOT send more than one asynchronous notification estimate, it MUST NOT send more than one asynchronous notification
every 3 seconds, and SHOULD use an even less aggressive rate whenever every 3 seconds and SHOULD use an even less aggressive rate whenever
possible (case 2 in Section 3.1.3 of [RFC8085]). possible (case 2 in Section 3.1.3 of [RFC8085]).
When conflicting requests are detected, the DOTS server enforces the When conflicting requests are detected, the DOTS server enforces the
corresponding policy (e.g., accept all requests, reject all requests, corresponding policy (e.g., accept all requests, reject all requests,
accept only one request but reject all the others). It is assumed accept only one request but reject all the others). It is assumed
that this policy is supplied by the DOTS server administrator or that that this policy is supplied by the DOTS server administrator or that
it is a default behavior of the DOTS server implementation. Then, it is a default behavior of the DOTS server implementation. Then,
the DOTS server sends a notification message(s) to the DOTS client(s) the DOTS server sends a notification message(s) to the DOTS client(s)
at the origin of the conflict (refer to the conflict parameters at the origin of the conflict (refer to the conflict parameters
defined in Section 4.4.1). A conflict notification message includes defined in Section 4.4.1). A conflict notification message includes
information about the conflict cause, scope, and the status of the information about the conflict cause, scope, and the status of the
mitigation request(s). For example: mitigation request(s). For example:
o A notification message with 'status' code set to '7 (Attack * A notification message with 'status' code set to '7 (Attack
mitigation is withdrawn)' and 'conflict-status' set to '1' is sent mitigation is withdrawn)' and 'conflict-status' set to '1' is sent
to a DOTS client to indicate that an active mitigation request is to a DOTS client to indicate that an active mitigation request is
deactivated because a conflict is detected. deactivated because a conflict is detected.
o A notification message with 'status' code set to '1 (Attack * A notification message with 'status' code set to '1 (Attack
mitigation is in progress)' and 'conflict-status' set to '2' is mitigation is in progress)' and 'conflict-status' set to '2' is
sent to a DOTS client to indicate that this mitigation request is sent to a DOTS client to indicate that this mitigation request is
in progress, but a conflict is detected. in progress, but a conflict is detected.
Upon receipt of a conflict notification message indicating that a Upon receipt of a conflict notification message indicating that a
mitigation request is deactivated because of a conflict, a DOTS mitigation request is deactivated because of a conflict, a DOTS
client MUST NOT resend the same mitigation request before the expiry client MUST NOT resend the same mitigation request before the expiry
of 'retry-timer'. It is also recommended that DOTS clients support of 'retry-timer'. It is also recommended that DOTS clients support
the means to alert administrators about mitigation conflicts. the means to alert administrators about mitigation conflicts.
skipping to change at page 37, line 35 skipping to change at line 1653
message. This causes the DOTS server to remove the associated entry. message. This causes the DOTS server to remove the associated entry.
Alternatively, the DOTS client can explicitly de-register itself by Alternatively, the DOTS client can explicitly de-register itself by
issuing a GET request that has the Token field set to the token of issuing a GET request that has the Token field set to the token of
the observation to be canceled and includes an Observe Option with the observation to be canceled and includes an Observe Option with
the value set to '1' (de-register). The latter is more deterministic the value set to '1' (de-register). The latter is more deterministic
and, thus, is RECOMMENDED. and, thus, is RECOMMENDED.
Figure 15 shows an example of a DOTS client requesting a DOTS server Figure 15 shows an example of a DOTS client requesting a DOTS server
to send notifications related to a mitigation request. Note that for to send notifications related to a mitigation request. Note that for
mitigations with preconfigured scopes (i.e., 'trigger-mitigation' set mitigations with preconfigured scopes (i.e., 'trigger-mitigation' set
to 'false'), the state will need to transition from 3 (attack- to 'false'), the state will need to transition from '3' (attack-
stopped) to 8 (attack-mitigation-signal-loss). stopped) to '8' (attack-mitigation-signal-loss).
+-----------+ +-----------+ +-----------+ +-----------+
|DOTS Client| |DOTS Server| |DOTS Client| |DOTS Server|
+-----------+ +-----------+ +-----------+ +-----------+
| | | |
| GET /<mid> | | GET /<mid> |
| Token: 0x4a | Registration | Token: 0x4a | Registration
| Observe: 0 | | Observe: 0 |
+----------------------------------------->| +----------------------------------------->|
| | | |
skipping to change at page 38, line 34 skipping to change at line 1685
|<-----------------------------------------+ |<-----------------------------------------+
| | | |
| 2.05 Content | | 2.05 Content |
| Token: 0x4a | Notification upon | Token: 0x4a | Notification upon
| Observe: 60 | a state change | Observe: 60 | a state change
| status: "attack-stopped" | | status: "attack-stopped" |
|<-----------------------------------------+ |<-----------------------------------------+
| | | |
... ...
Figure 15: Notifications of Attack Mitigation Status Figure 15: Notifications of Attack Mitigation Status
4.4.2.2. DOTS Clients Polling for Mitigation Status 4.4.2.2. DOTS Clients Polling for Mitigation Status
The DOTS client can send the GET request at frequent intervals The DOTS client can send the GET request at frequent intervals
without the Observe Option to retrieve the configuration data of the without the Observe Option to retrieve the configuration data of the
mitigation request and non-configuration data (i.e., the attack mitigation request and non-configuration data (i.e., the attack
status). DOTS clients MAY be configured with a policy indicating the status). DOTS clients MAY be configured with a policy indicating the
frequency of polling DOTS servers to get the mitigation status. This frequency of polling DOTS servers to get the mitigation status. This
frequency MUST NOT be more than one UDP datagram per RTT as discussed frequency MUST NOT be more than one UDP datagram per RTT, as
in Section 3.1.3 of [RFC8085]. discussed in Section 3.1.3 of [RFC8085].
If the DOTS server has been able to mitigate the attack and the If the DOTS server has been able to mitigate the attack and the
attack has stopped, the DOTS server indicates as such in the status. attack has stopped, the DOTS server indicates as such in the status.
In such case, the DOTS client withdraws the mitigation request by In such case, the DOTS client withdraws the mitigation request by
issuing a DELETE request for this mitigation request (Section 4.4.4). issuing a DELETE request for this mitigation request (Section 4.4.4).
A DOTS client SHOULD react to the status of the attack per the A DOTS client SHOULD react to the status of the attack per the
information sent by the DOTS server rather than performing its own information sent by the DOTS server rather than performing its own
detection that the attack has been mitigated. This ensures that the detection that the attack has been mitigated. This ensures that the
DOTS client does not withdraw a mitigation request prematurely DOTS client does not withdraw a mitigation request prematurely
skipping to change at page 39, line 22 skipping to change at line 1722
While DDoS mitigation is in progress, due to the likelihood of packet While DDoS mitigation is in progress, due to the likelihood of packet
loss, a DOTS client MAY periodically transmit DOTS mitigation loss, a DOTS client MAY periodically transmit DOTS mitigation
efficacy updates to the relevant DOTS server. A PUT request is used efficacy updates to the relevant DOTS server. A PUT request is used
to convey the mitigation efficacy update to the DOTS server. This to convey the mitigation efficacy update to the DOTS server. This
PUT request is treated as a refresh of the current mitigation. PUT request is treated as a refresh of the current mitigation.
The 'attack-status' parameter is a mandatory attribute when The 'attack-status' parameter is a mandatory attribute when
performing an efficacy update. The various possible values contained performing an efficacy update. The various possible values contained
in the 'attack-status' parameter are described in Table 4. in the 'attack-status' parameter are described in Table 4.
+-----------+-------------------------------------+ +===========+=====================================+
| Parameter | Description | | Parameter | Description |
| Value | | | Value | |
+===========+=====================================+ +===========+=====================================+
| 1 | The DOTS client determines that it | | 1 | The DOTS client determines that it |
| | is still under attack. | | | is still under attack. |
+-----------+-------------------------------------+ +-----------+-------------------------------------+
| 2 | The DOTS client determines that the | | 2 | The DOTS client determines that the |
| | attack is successfully mitigated | | | attack is successfully mitigated |
| | (e.g., attack traffic is not seen). | | | (e.g., attack traffic is not seen). |
+-----------+-------------------------------------+ +-----------+-------------------------------------+
Table 4: Values of 'attack-status' Parameter Table 4: Values of 'attack-status' Parameter
The PUT request used for the efficacy update MUST include all the The PUT request used for the efficacy update MUST include all the
parameters used in the PUT request to carry the DOTS mitigation parameters used in the PUT request to carry the DOTS mitigation
request (Section 4.4.1) unchanged apart from the 'lifetime' parameter request (Section 4.4.1) unchanged apart from the 'lifetime' parameter
value. If this is not the case, the DOTS server MUST reject the value. If this is not the case, the DOTS server MUST reject the
skipping to change at page 40, line 47 skipping to change at line 1795
], ],
"target-protocol": [ "target-protocol": [
6 6
], ],
"attack-status": "under-attack" "attack-status": "under-attack"
} }
] ]
} }
} }
Figure 16: An Example of Efficacy Update Figure 16: An Example of Efficacy Update
The DOTS server indicates the result of processing a PUT request The DOTS server indicates the result of processing a PUT request
using CoAP Response Codes. The Response Code 2.04 (Changed) is using CoAP Response Codes. The Response Code 2.04 (Changed) is
returned if the DOTS server has accepted the mitigation efficacy returned if the DOTS server has accepted the mitigation efficacy
update. The error Response Code 5.03 (Service Unavailable) is update. The error Response Code 5.03 (Service Unavailable) is
returned if the DOTS server has erred or is incapable of performing returned if the DOTS server has erred or is incapable of performing
the mitigation. As specified in [RFC7252], 5.03 uses Max-Age Option the mitigation. As specified in [RFC7252], 5.03 uses Max-Age Option
to indicate the number of seconds after which to retry. to indicate the number of seconds after which to retry.
4.4.4. Withdraw a Mitigation 4.4.4. Withdraw a Mitigation
DELETE requests are used to withdraw DOTS mitigation requests from DELETE requests are used to withdraw DOTS mitigation requests from
DOTS servers (Figure 17). DOTS servers (Figure 17).
'cuid' and 'mid' are mandatory Uri-Path parameters for DELETE 'cuid' and 'mid' are mandatory Uri-Path parameters for DELETE
requests. requests.
The same considerations for manipulating 'cdid' parameter by DOTS The same considerations for manipulating the 'cdid' parameter by DOTS
gateways, as specified in Section 4.4.1, MUST be followed for DELETE gateways, as specified in Section 4.4.1, MUST be followed for DELETE
requests. Uri-Path parameters with empty values MUST NOT be present requests. Uri-Path parameters with empty values MUST NOT be present
in a request. in a request.
Header: DELETE (Code=0.04) Header: DELETE (Code=0.04)
Uri-Path: ".well-known" Uri-Path: ".well-known"
Uri-Path: "dots" Uri-Path: "dots"
Uri-Path: "mitigate" Uri-Path: "mitigate"
Uri-Path: "cuid=dz6pHjaADkaFTbjr0JGBpw" Uri-Path: "cuid=dz6pHjaADkaFTbjr0JGBpw"
Uri-Path: "mid=123" Uri-Path: "mid=123"
Figure 17: Withdraw a DOTS Mitigation Figure 17: Withdraw a DOTS Mitigation
If the DELETE request does not include 'cuid' and 'mid' parameters, If the DELETE request does not include 'cuid' and 'mid' parameters,
the DOTS server MUST reply with a 4.00 (Bad Request). the DOTS server MUST reply with a 4.00 (Bad Request).
Once the request is validated, the DOTS server immediately Once the request is validated, the DOTS server immediately
acknowledges a DOTS client's request to withdraw the DOTS mitigation acknowledges a DOTS client's request to withdraw the DOTS mitigation
request using 2.02 (Deleted) Response Code with no response payload. request using a 2.02 (Deleted) Response Code with no response
A 2.02 (Deleted) Response Code is returned even if the 'mid' payload. A 2.02 (Deleted) Response Code is returned even if the
parameter value conveyed in the DELETE request does not exist in its 'mid' parameter value conveyed in the DELETE request does not exist
configuration data before the request. in its configuration data before the request.
If the DOTS server finds the 'mid' parameter value conveyed in the If the DOTS server finds the 'mid' parameter value conveyed in the
DELETE request in its configuration data for the DOTS client, then to DELETE request in its configuration data for the DOTS client, then to
protect against route or DNS flapping caused by a DOTS client rapidly protect against route or DNS flapping caused by a DOTS client rapidly
removing a mitigation, and to dampen the effect of oscillating removing a mitigation and to dampen the effect of oscillating
attacks, the DOTS server MAY allow mitigation to continue for a attacks, the DOTS server MAY allow mitigation to continue for a
limited period after acknowledging a DOTS client's withdrawal of a limited period after acknowledging a DOTS client's withdrawal of a
mitigation request. During this period, the DOTS server status mitigation request. During this period, the DOTS server status
messages SHOULD indicate that mitigation is active but terminating messages SHOULD indicate that mitigation is active but terminating
(Section 4.4.2). (Section 4.4.2).
The initial active-but-terminating period SHOULD be sufficiently long The initial active-but-terminating period SHOULD be sufficiently long
to absorb latency incurred by route propagation. The active-but- to absorb latency incurred by route propagation. The active-but-
terminating period SHOULD be set by default to 120 seconds. If the terminating period SHOULD be set by default to 120 seconds. If the
client requests mitigation again before the initial active-but- client requests mitigation again before the initial active-but-
skipping to change at page 43, line 30 skipping to change at line 1921
the other configuration upon a change in the mitigation activity the other configuration upon a change in the mitigation activity
(e.g., if an attack mitigation is launched after an 'idle' time, the (e.g., if an attack mitigation is launched after an 'idle' time, the
DOTS agent switches from values related to 'idle-config' to values DOTS agent switches from values related to 'idle-config' to values
related to 'mitigating-config'). related to 'mitigating-config').
CoAP requests and responses are indicated for reliable delivery by CoAP requests and responses are indicated for reliable delivery by
marking them as Confirmable messages. DOTS signal channel session marking them as Confirmable messages. DOTS signal channel session
configuration requests and responses are marked as Confirmable configuration requests and responses are marked as Confirmable
messages. As explained in Section 2.1 of [RFC7252], a Confirmable messages. As explained in Section 2.1 of [RFC7252], a Confirmable
message is retransmitted using a default timeout and exponential message is retransmitted using a default timeout and exponential
backoff between retransmissions, until the DOTS server sends an backoff between retransmissions until the DOTS server sends an
Acknowledgement message (ACK) with the same Message ID conveyed from Acknowledgement message (ACK) with the same Message ID conveyed from
the DOTS client. the DOTS client.
Message transmission parameters are defined in Section 4.8 of Message transmission parameters are defined in Section 4.8 of
[RFC7252]. The DOTS server can either piggyback the response in the [RFC7252]. The DOTS server can either piggyback the response in the
Acknowledgement message or, if the DOTS server cannot respond Acknowledgement message or, if the DOTS server cannot respond
immediately to a request carried in a Confirmable message, it simply immediately to a request carried in a Confirmable message, it simply
responds with an Empty Acknowledgement message so that the DOTS responds with an Empty Acknowledgement message so that the DOTS
client can stop retransmitting the request. Empty Acknowledgement client can stop retransmitting the request. Empty Acknowledgement
messages are explained in Section 2.2 of [RFC7252]. When the messages are explained in Section 2.2 of [RFC7252]. When the
skipping to change at page 44, line 10 skipping to change at line 1943
which, in turn, needs to be acknowledged by the DOTS client (see which, in turn, needs to be acknowledged by the DOTS client (see
Sections 5.2.1 and 5.2.2 of [RFC7252]). Requests and responses Sections 5.2.1 and 5.2.2 of [RFC7252]). Requests and responses
exchanged between DOTS agents during 'idle' time, except heartbeat exchanged between DOTS agents during 'idle' time, except heartbeat
messages, are marked as Confirmable messages. messages, are marked as Confirmable messages.
| Implementation Note: A DOTS client that receives a response in | Implementation Note: A DOTS client that receives a response in
| a Confirmable message may want to clean up the message state | a Confirmable message may want to clean up the message state
| right after sending the ACK. If that ACK is lost and the DOTS | right after sending the ACK. If that ACK is lost and the DOTS
| server retransmits the Confirmable message, the DOTS client may | server retransmits the Confirmable message, the DOTS client may
| no longer have any state that would help it correlate this | no longer have any state that would help it correlate this
| response: from the DOTS client's standpoint, the retransmission | response; from the DOTS client's standpoint, the retransmission
| message is unexpected. The DOTS client will send a Reset | message is unexpected. The DOTS client will send a Reset
| message so it does not receive any more retransmissions. This | message so it does not receive any more retransmissions. This
| behavior is normal and not an indication of an error (see | behavior is normal and not an indication of an error (see
| Section 5.3.2 of [RFC7252] for more details). | Section 5.3.2 of [RFC7252] for more details).
4.5.1. Discover Configuration Parameters 4.5.1. Discover Configuration Parameters
A GET request is used to obtain acceptable (e.g., minimum and maximum A GET request is used to obtain acceptable (e.g., minimum and maximum
values) and current configuration parameters on the DOTS server for values) and current configuration parameters on the DOTS server for
DOTS signal channel session configuration. This procedure occurs DOTS signal channel session configuration. This procedure occurs
skipping to change at page 44, line 32 skipping to change at line 1965
this GET request MUST NOT be relayed by a DOTS gateway. this GET request MUST NOT be relayed by a DOTS gateway.
Figure 18 shows how to obtain configuration parameters that the DOTS Figure 18 shows how to obtain configuration parameters that the DOTS
server will find acceptable. server will find acceptable.
Header: GET (Code=0.01) Header: GET (Code=0.01)
Uri-Path: ".well-known" Uri-Path: ".well-known"
Uri-Path: "dots" Uri-Path: "dots"
Uri-Path: "config" Uri-Path: "config"
Figure 18: GET to Retrieve Configuration Figure 18: GET to Retrieve Configuration
The DOTS server in the 2.05 (Content) response conveys the current, The DOTS server in the 2.05 (Content) response conveys the current,
minimum, and maximum attribute values acceptable by the DOTS server minimum, and maximum attribute values acceptable by the DOTS server
(Figure 19). (Figure 19).
{ {
"ietf-dots-signal-channel:signal-config": { "ietf-dots-signal-channel:signal-config": {
"mitigating-config": { "mitigating-config": {
"heartbeat-interval": { "heartbeat-interval": {
"max-value": number, "max-value": number,
skipping to change at page 50, line 20 skipping to change at line 2240
Uri-Path: ".well-known" Uri-Path: ".well-known"
Uri-Path: "dots" Uri-Path: "dots"
Uri-Path: "config" Uri-Path: "config"
Uri-Path: "sid=123" Uri-Path: "sid=123"
Content-Format: "application/dots+cbor" Content-Format: "application/dots+cbor"
{ {
... ...
} }
Figure 21: PUT to Convey the DOTS Signal Channel Session Figure 21: PUT to Convey the DOTS Signal Channel Session
Configuration Data Configuration Data
The additional Uri-Path parameter to those defined in Table 1 is as The additional Uri-Path parameter to those defined in Table 1 is as
follows: follows:
sid: Session Identifier is an identifier for the DOTS signal channel sid: Session Identifier is an identifier for the DOTS signal channel
session configuration data represented as an integer. This session configuration data represented as an integer. This
identifier MUST be generated by DOTS clients. 'sid' values MUST identifier MUST be generated by DOTS clients. 'sid' values
increase monotonically (when a new PUT is generated by a DOTS MUST increase monotonically (when a new PUT is generated by a
client to convey the configuration parameters for the signal DOTS client to convey the configuration parameters for the
channel). signal channel).
This is a mandatory attribute. This is a mandatory attribute.
{ {
"ietf-dots-signal-channel:signal-config": { "ietf-dots-signal-channel:signal-config": {
"mitigating-config": { "mitigating-config": {
"heartbeat-interval": { "heartbeat-interval": {
"current-value": number "current-value": number
}, },
"missing-hb-allowed": { "missing-hb-allowed": {
"current-value": number "current-value": number
}, },
skipping to change at page 51, line 50 skipping to change at line 2300
"ack-timeout": { "ack-timeout": {
"current-value-decimal": "string" "current-value-decimal": "string"
}, },
"ack-random-factor": { "ack-random-factor": {
"current-value-decimal": "string" "current-value-decimal": "string"
} }
} }
} }
} }
Figure 22: PUT to Convey the DOTS Signal Channel Session Figure 22: PUT to Convey the DOTS Signal Channel Session
Configuration Data (Message Body Schema) Configuration Data (Message Body Schema)
The meaning of the parameters in the CBOR body (Figure 22) is defined The meaning of the parameters in the CBOR body (Figure 22) is defined
in Section 4.5.1. in Section 4.5.1.
At least one of the attributes 'heartbeat-interval', 'missing-hb- At least one of the attributes 'heartbeat-interval', 'missing-hb-
allowed', 'probing-rate', 'max-retransmit', 'ack-timeout', and 'ack- allowed', 'probing-rate', 'max-retransmit', 'ack-timeout', and 'ack-
random-factor' MUST be present in the PUT request. Note that random-factor' MUST be present in the PUT request. Note that
'heartbeat-interval', 'missing-hb-allowed', 'probing-rate', 'max- 'heartbeat-interval', 'missing-hb-allowed', 'probing-rate', 'max-
retransmit', 'ack-timeout', and 'ack-random-factor', if present, do retransmit', 'ack-timeout', and 'ack-random-factor', if present, do
not need to be provided for both 'mitigating-config', and 'idle- not need to be provided for both 'mitigating-config' and 'idle-
config' in a PUT request. A request does not need to include both config' in a PUT request. A request does not need to include both
'mitigating-config' and 'idle-config' attributes. 'mitigating-config' and 'idle-config' attributes.
The PUT request with a higher numeric 'sid' value overrides the DOTS The PUT request with a higher numeric 'sid' value overrides the DOTS
signal channel session configuration data installed by a PUT request signal channel session configuration data installed by a PUT request
with a lower numeric 'sid' value. That is, the configuration with a lower numeric 'sid' value. That is, the configuration
parameters that are included in the PUT request with a higher numeric parameters that are included in the PUT request with a higher numeric
'sid' value will be used instead of the DOTS server's defaults. To 'sid' value will be used instead of the DOTS server's defaults. To
avoid maintaining a long list of 'sid' requests from a DOTS client, avoid maintaining a long list of 'sid' requests from a DOTS client,
the lower numeric 'sid' MUST be automatically deleted and no longer the lower numeric 'sid' MUST be automatically deleted and no longer
skipping to change at page 54, line 8 skipping to change at line 2380
} }
} }
} }
} }
Figure 23: PUT to Convey the Configuration Parameters Figure 23: PUT to Convey the Configuration Parameters
The DOTS server indicates the result of processing the PUT request The DOTS server indicates the result of processing the PUT request
using CoAP Response Codes: using CoAP Response Codes:
o If the request is missing a mandatory attribute, does not include * If the request is missing a mandatory attribute, does not include
a 'sid' Uri-Path, or contains one or more invalid or unknown a 'sid' Uri-Path, or contains one or more invalid or unknown
parameters, 4.00 (Bad Request) MUST be returned in the response. parameters, 4.00 (Bad Request) MUST be returned in the response.
o If the DOTS server does not find the 'sid' parameter value * If the DOTS server does not find the 'sid' parameter value
conveyed in the PUT request in its configuration data and if the conveyed in the PUT request in its configuration data and if the
DOTS server has accepted the configuration parameters, then a DOTS server has accepted the configuration parameters, then a
Response Code 2.01 (Created) MUST be returned in the response. Response Code 2.01 (Created) MUST be returned in the response.
o If the DOTS server finds the 'sid' parameter value conveyed in the * If the DOTS server finds the 'sid' parameter value conveyed in the
PUT request in its configuration data and if the DOTS server has PUT request in its configuration data and if the DOTS server has
accepted the updated configuration parameters, 2.04 (Changed) MUST accepted the updated configuration parameters, 2.04 (Changed) MUST
be returned in the response. be returned in the response.
o If any of the 'heartbeat-interval', 'missing-hb-allowed', * If any of the 'heartbeat-interval', 'missing-hb-allowed',
'probing-rate', 'max-retransmit', 'target-protocol', 'ack- 'probing-rate', 'max-retransmit', 'target-protocol', 'ack-
timeout', and 'ack-random-factor' attribute values are not timeout', and 'ack-random-factor' attribute values are not
acceptable to the DOTS server, 4.22 (Unprocessable Entity) MUST be acceptable to the DOTS server, 4.22 (Unprocessable Entity) MUST be
returned in the response. Upon receipt of this error code, the returned in the response. Upon receipt of this error code, the
DOTS client SHOULD retrieve the maximum and minimum attribute DOTS client SHOULD retrieve the maximum and minimum attribute
values acceptable to the DOTS server (Section 4.5.1). values acceptable to the DOTS server (Section 4.5.1).
The DOTS client may retry and send the PUT request with updated The DOTS client may retry and send the PUT request with updated
attribute values acceptable to the DOTS server. attribute values acceptable to the DOTS server.
skipping to change at page 55, line 45 skipping to change at line 2466
Header: DELETE (Code=0.04) Header: DELETE (Code=0.04)
Uri-Path: ".well-known" Uri-Path: ".well-known"
Uri-Path: "dots" Uri-Path: "dots"
Uri-Path: "config" Uri-Path: "config"
Uri-Path: "sid=123" Uri-Path: "sid=123"
Figure 24: Delete Configuration Figure 24: Delete Configuration
The DOTS server resets the DOTS signal channel session configuration The DOTS server resets the DOTS signal channel session configuration
back to the default values and acknowledges a DOTS client's request back to the default values and acknowledges a DOTS client's request
to remove the DOTS signal channel session configuration using 2.02 to remove the DOTS signal channel session configuration using a 2.02
(Deleted) Response Code. (Deleted) Response Code.
Upon bootstrapping or reboot, a DOTS client MAY send a DELETE request Upon bootstrapping or reboot, a DOTS client MAY send a DELETE request
to set the configuration parameters to default values. Such a to set the configuration parameters to default values. Such a
request does not include any 'sid'. request does not include any 'sid'.
4.6. Redirected Signaling 4.6. Redirected Signaling
Redirected DOTS signaling is discussed in detail in Section 3.2.2 of Redirected DOTS signaling is discussed in detail in Section 3.2.2 of
[RFC8811]. [RFC8811].
skipping to change at page 57, line 36 skipping to change at line 2553
] ]
} }
} }
Figure 26: Example of Redirected Server Error Response Body Figure 26: Example of Redirected Server Error Response Body
When the DOTS client receives a 5.03 response with an alternate When the DOTS client receives a 5.03 response with an alternate
server included, it considers the current request to have failed, but server included, it considers the current request to have failed, but
it SHOULD try resending the request to the alternate DOTS server. it SHOULD try resending the request to the alternate DOTS server.
During a DDoS attack, the DNS server may be the target of another During a DDoS attack, the DNS server may be the target of another
DDoS attack, the alternate DOTS server's IP addresses conveyed in the DDoS attack; the alternate DOTS server's IP addresses conveyed in the
5.03 response help the DOTS client skip the DNS lookup of the 5.03 response help the DOTS client skip the DNS lookup of the
alternate DOTS server, at the cost of trusting the first DOTS server alternate DOTS server, at the cost of trusting the first DOTS server
to provide accurate information. The DOTS client can then try to to provide accurate information. The DOTS client can then try to
establish a UDP or a TCP session with the alternate DOTS server establish a UDP or a TCP session with the alternate DOTS server
(Section 4.3). Note that state synchronization (e.g., signal session (Section 4.3). Note that state synchronization (e.g., signal session
configuration, aliases) is assumed to be in place between the configuration, aliases) is assumed to be in place between the
original and alternate DOTS servers; such synchronization means are original and alternate DOTS servers; such synchronization means are
out of scope. If session configuration refresh is needed while out of scope. If session configuration refresh is needed while
redirection is in place, the DOTS client follows the procedure redirection is in place, the DOTS client follows the procedure
defined in Section 4.5.3. In 'idle' time and under some conditions defined in Section 4.5.3. In 'idle' time and under some conditions
skipping to change at page 58, line 11 skipping to change at line 2576
procedure defined in Section 4.5.2 to negotiate the DOTS signal procedure defined in Section 4.5.2 to negotiate the DOTS signal
channel session configuration with the alternate server. The DOTS channel session configuration with the alternate server. The DOTS
client MAY implement a method to construct IPv4-embedded IPv6 client MAY implement a method to construct IPv4-embedded IPv6
addresses [RFC6052]; this is required to handle the scenario where an addresses [RFC6052]; this is required to handle the scenario where an
IPv6-only DOTS client communicates with an IPv4-only alternate DOTS IPv6-only DOTS client communicates with an IPv4-only alternate DOTS
server. server.
If the DOTS client has been redirected to a DOTS server with which it If the DOTS client has been redirected to a DOTS server with which it
has already communicated within the last five (5) minutes, it MUST has already communicated within the last five (5) minutes, it MUST
ignore the redirection and try to contact other DOTS servers listed ignore the redirection and try to contact other DOTS servers listed
in the local configuration or discovered using dynamic means such as in the local configuration or discovered using dynamic means, such as
DHCP or SRV procedures [RFC8973]. It is RECOMMENDED that DOTS DHCP or SRV procedures [RFC8973]. It is RECOMMENDED that DOTS
clients support the means to alert administrators about redirect clients support the means to alert administrators about redirect
loops. loops.
4.7. Heartbeat Mechanism 4.7. Heartbeat Mechanism
To provide an indication of signal health and to distinguish an To provide an indication of signal health and to distinguish an
'idle' signal channel from a 'disconnected' or 'defunct' session, the 'idle' signal channel from a 'disconnected' or 'defunct' session, the
DOTS agent sends a heartbeat over the signal channel to maintain its DOTS agent sends a heartbeat over the signal channel to maintain its
half of the channel (also, aligned with the "consents" recommendation half of the channel (also, aligned with the "consents" recommendation
skipping to change at page 59, line 34 skipping to change at line 2639
example, if a DOTS client receives a 2.04 response for its heartbeat example, if a DOTS client receives a 2.04 response for its heartbeat
messages but no server-initiated heartbeat messages, the DOTS client messages but no server-initiated heartbeat messages, the DOTS client
sets 'peer-hb-status' to 'false' in its next heartbeat message. Upon sets 'peer-hb-status' to 'false' in its next heartbeat message. Upon
receipt of this message, the DOTS server then will need to try receipt of this message, the DOTS server then will need to try
another strategy for sending the heartbeats (e.g., adjust the another strategy for sending the heartbeats (e.g., adjust the
heartbeat interval or send a server-initiated heartbeat immediately heartbeat interval or send a server-initiated heartbeat immediately
after receiving a client-initiated heartbeat message). after receiving a client-initiated heartbeat message).
Header: (Code=2.04) Header: (Code=2.04)
Figure 28: Response to a DOTS Heartbeat Request (with an Empty Body) Figure 28: Response to a DOTS Heartbeat Request (with an Empty Body)
DOTS servers MAY trigger their heartbeat requests immediately after DOTS servers MAY trigger their heartbeat requests immediately after
receiving heartbeat probes from peer DOTS clients. It is the receiving heartbeat probes from peer DOTS clients. It is the
responsibility of DOTS clients to ensure that on-path translators/ responsibility of DOTS clients to ensure that on-path translators/
firewalls are maintaining a binding so that the same external IP firewalls are maintaining a binding so that the same external IP
address and/or port number is retained for the DOTS signal channel address and/or port number is retained for the DOTS signal channel
session. session.
Under normal traffic conditions (i.e., no attack is ongoing), if a Under normal traffic conditions (i.e., no attack is ongoing), if a
DOTS agent does not receive any response from the peer DOTS agent for DOTS agent does not receive any response from the peer DOTS agent for
skipping to change at page 60, line 21 skipping to change at line 2671
| failure to establish a (D)TLS session. | failure to establish a (D)TLS session.
In case of a massive DDoS attack that saturates the incoming link(s) In case of a massive DDoS attack that saturates the incoming link(s)
to the DOTS client, all traffic from the DOTS server to the DOTS to the DOTS client, all traffic from the DOTS server to the DOTS
client will likely be dropped, although the DOTS server receives client will likely be dropped, although the DOTS server receives
heartbeat requests in addition to DOTS messages sent by the DOTS heartbeat requests in addition to DOTS messages sent by the DOTS
client. In this scenario, DOTS clients MUST behave differently to client. In this scenario, DOTS clients MUST behave differently to
handle message transmission and DOTS signal channel session handle message transmission and DOTS signal channel session
liveliness during link saturation: liveliness during link saturation:
The DOTS client MUST NOT consider the DOTS signal channel session The DOTS client MUST NOT consider the DOTS signal channel
terminated even after a maximum 'missing-hb-allowed' threshold is session terminated even after a maximum 'missing-hb-allowed'
reached. The DOTS client SHOULD keep on using the current DOTS threshold is reached. The DOTS client SHOULD keep on using the
signal channel session to send heartbeat requests over it, so that current DOTS signal channel session to send heartbeat requests
the DOTS server knows the DOTS client has not disconnected the over it so that the DOTS server knows the DOTS client has not
DOTS signal channel session. disconnected the DOTS signal channel session.
After the maximum 'missing-hb-allowed' threshold is reached, the After the maximum 'missing-hb-allowed' threshold is reached, the
DOTS client SHOULD try to establish a new DOTS signal channel DOTS client SHOULD try to establish a new DOTS signal channel
session. The DOTS client SHOULD send mitigation requests over the session. The DOTS client SHOULD send mitigation requests over
current DOTS signal channel session and, in parallel, send the the current DOTS signal channel session and, in parallel, send
mitigation requests over the new DOTS signal channel session. the mitigation requests over the new DOTS signal channel
This may be handled, for example, by resumption of the (D)TLS session. This may be handled, for example, by resumption of the
session or using 0-RTT mode in DTLS 1.3 to piggyback the (D)TLS session or using 0-RTT mode in DTLS 1.3 to piggyback the
mitigation request in the ClientHello message. mitigation request in the ClientHello message.
As soon as the link is no longer saturated, if traffic from the As soon as the link is no longer saturated, if traffic from the
DOTS server reaches the DOTS client over the current DOTS signal DOTS server reaches the DOTS client over the current DOTS signal
channel session, the DOTS client can stop the new DOTS signal channel session, the DOTS client can stop the new DOTS signal
channel session attempt or if a new DOTS signal channel session is channel session attempt or if a new DOTS signal channel session
successful then disconnect the current DOTS signal channel is successful then disconnect the current DOTS signal channel
session. session.
If the DOTS server receives traffic from the peer DOTS client (e.g., If the DOTS server receives traffic from the peer DOTS client (e.g.,
peer DOTS client-initiated heartbeats) but the maximum 'missing-hb- peer DOTS client-initiated heartbeats) but the maximum 'missing-hb-
allowed' threshold is reached, the DOTS server MUST NOT consider the allowed' threshold is reached, the DOTS server MUST NOT consider the
DOTS signal channel session disconnected. The DOTS server MUST keep DOTS signal channel session disconnected. The DOTS server MUST keep
on using the current DOTS signal channel session so that the DOTS on using the current DOTS signal channel session so that the DOTS
client can send mitigation requests over the current DOTS signal client can send mitigation requests over the current DOTS signal
channel session. In this case, the DOTS server can identify that the channel session. In this case, the DOTS server can identify that the
DOTS client is under attack and that the inbound link to the DOTS DOTS client is under attack and that the inbound link to the DOTS
client (domain) is saturated. Furthermore, if the DOTS server does client (domain) is saturated. Furthermore, if the DOTS server does
skipping to change at page 61, line 47 skipping to change at line 2744
5.1. Tree Structure 5.1. Tree Structure
This document defines the YANG module "ietf-dots-signal-channel", This document defines the YANG module "ietf-dots-signal-channel",
which has the following tree structure. A DOTS signal message can be which has the following tree structure. A DOTS signal message can be
a mitigation, a configuration, a redirect, or a heartbeat message. a mitigation, a configuration, a redirect, or a heartbeat message.
This tree structure obsoletes the one described in Section 5.1 of This tree structure obsoletes the one described in Section 5.1 of
[RFC8782]. [RFC8782].
module: ietf-dots-signal-channel module: ietf-dots-signal-channel
structure dots-signal: structure dots-signal:
+-- (message-type)? +-- (message-type)?
+--:(mitigation-scope) +--:(mitigation-scope)
| +-- scope* [] | +-- scope* []
| +-- target-prefix* inet:ip-prefix | +-- target-prefix* inet:ip-prefix
| +-- target-port-range* [lower-port] | +-- target-port-range* [lower-port]
| | +-- lower-port inet:port-number | | +-- lower-port inet:port-number
| | +-- upper-port? inet:port-number | | +-- upper-port? inet:port-number
| +-- target-protocol* uint8 | +-- target-protocol* uint8
| +-- target-fqdn* inet:domain-name | +-- target-fqdn* inet:domain-name
| +-- target-uri* inet:uri | +-- target-uri* inet:uri
| +-- alias-name* string | +-- alias-name* string
| +-- lifetime? union | +-- lifetime? union
| +-- trigger-mitigation? boolean | +-- trigger-mitigation? boolean
| +-- (direction)? | +-- (direction)?
| +--:(server-to-client-only) | +--:(server-to-client-only)
| | +-- mid? uint32 | | +-- mid? uint32
| | +-- mitigation-start? uint64 | | +-- mitigation-start? uint64
| | +-- status? | | +-- status?
| | | iana-dots-signal:status | | | iana-dots-signal:status
| | +-- conflict-information | | +-- conflict-information
| | | +-- conflict-status? | | | +-- conflict-status?
| | | | iana-dots-signal:conflict-status | | | | iana-dots-signal:conflict-status
| | | +-- conflict-cause? | | | +-- conflict-cause?
| | | | iana-dots-signal:conflict-cause | | | | iana-dots-signal:conflict-cause
| | | +-- retry-timer? uint32 | | | +-- retry-timer? uint32
| | | +-- conflict-scope | | | +-- conflict-scope
| | | +-- target-prefix* inet:ip-prefix | | | +-- target-prefix* inet:ip-prefix
| | | +-- target-port-range* [lower-port] | | | +-- target-port-range* [lower-port]
| | | | +-- lower-port inet:port-number | | | | +-- lower-port inet:port-number
| | | | +-- upper-port? inet:port-number | | | | +-- upper-port? inet:port-number
| | | +-- target-protocol* uint8 | | | +-- target-protocol* uint8
| | | +-- target-fqdn* inet:domain-name | | | +-- target-fqdn* inet:domain-name
| | | +-- target-uri* inet:uri | | | +-- target-uri* inet:uri
| | | +-- alias-name* string | | | +-- alias-name* string
| | | +-- acl-list* [acl-name] | | | +-- acl-list* [acl-name]
| | | | +-- acl-name leafref | | | | +-- acl-name leafref
| | | | +-- acl-type? leafref | | | | +-- acl-type? leafref
| | | +-- mid? uint32 | | | +-- mid? uint32
| | +-- bytes-dropped? | | +-- bytes-dropped?
| | | yang:zero-based-counter64 | | | yang:zero-based-counter64
| | +-- bps-dropped? yang:gauge64 | | +-- bps-dropped? yang:gauge64
| | +-- pkts-dropped? | | +-- pkts-dropped?
| | | yang:zero-based-counter64 | | | yang:zero-based-counter64
| | +-- pps-dropped? yang:gauge64 | | +-- pps-dropped? yang:gauge64
| +--:(client-to-server-only) | +--:(client-to-server-only)
| +-- attack-status? | +-- attack-status?
| iana-dots-signal:attack-status | iana-dots-signal:attack-status
+--:(signal-config) +--:(signal-config)
| +-- mitigating-config | +-- mitigating-config
| | +-- heartbeat-interval | | +-- heartbeat-interval
| | | +-- (direction)? | | | +-- (direction)?
| | | | +--:(server-to-client-only) | | | | +--:(server-to-client-only)
| | | | +-- max-value? uint16 | | | | +-- max-value? uint16
| | | | +-- min-value? uint16 | | | | +-- min-value? uint16
| | | +-- current-value? uint16 | | | +-- current-value? uint16
| | +-- missing-hb-allowed | | +-- missing-hb-allowed
| | | +-- (direction)? | | | +-- (direction)?
| | | | +--:(server-to-client-only) | | | | +--:(server-to-client-only)
| | | | +-- max-value? uint16 | | | | +-- max-value? uint16
| | | | +-- min-value? uint16 | | | | +-- min-value? uint16
| | | +-- current-value? uint16 | | | +-- current-value? uint16
| | +-- probing-rate | | +-- probing-rate
| | | +-- (direction)? | | | +-- (direction)?
| | | | +--:(server-to-client-only) | | | | +--:(server-to-client-only)
| | | | +-- max-value? uint16 | | | | +-- max-value? uint16
| | | | +-- min-value? uint16 | | | | +-- min-value? uint16
| | | +-- current-value? uint16 | | | +-- current-value? uint16
| | +-- max-retransmit | | +-- max-retransmit
| | | +-- (direction)? | | | +-- (direction)?
| | | | +--:(server-to-client-only) | | | | +--:(server-to-client-only)
| | | | +-- max-value? uint16 | | | | +-- max-value? uint16
| | | | +-- min-value? uint16 | | | | +-- min-value? uint16
| | | +-- current-value? uint16 | | | +-- current-value? uint16
| | +-- ack-timeout | | +-- ack-timeout
| | | +-- (direction)? | | | +-- (direction)?
| | | | +--:(server-to-client-only) | | | | +--:(server-to-client-only)
| | | | +-- max-value-decimal? decimal64 | | | | +-- max-value-decimal? decimal64
| | | | +-- min-value-decimal? decimal64 | | | | +-- min-value-decimal? decimal64
| | | +-- current-value-decimal? decimal64 | | | +-- current-value-decimal? decimal64
| | +-- ack-random-factor | | +-- ack-random-factor
| | +-- (direction)? | | +-- (direction)?
| | | +--:(server-to-client-only) | | | +--:(server-to-client-only)
| | | +-- max-value-decimal? decimal64 | | | +-- max-value-decimal? decimal64
| | | +-- min-value-decimal? decimal64 | | | +-- min-value-decimal? decimal64
| | +-- current-value-decimal? decimal64 | | +-- current-value-decimal? decimal64
| +-- idle-config | +-- idle-config
| +-- heartbeat-interval | +-- heartbeat-interval
| | +-- (direction)? | | +-- (direction)?
| | | +--:(server-to-client-only) | | | +--:(server-to-client-only)
| | | +-- max-value? uint16 | | | +-- max-value? uint16
| | | +-- min-value? uint16 | | | +-- min-value? uint16
| | +-- current-value? uint16 | | +-- current-value? uint16
| +-- missing-hb-allowed | +-- missing-hb-allowed
| | +-- (direction)? | | +-- (direction)?
| | | +--:(server-to-client-only) | | | +--:(server-to-client-only)
| | | +-- max-value? uint16 | | | +-- max-value? uint16
| | | +-- min-value? uint16 | | | +-- min-value? uint16
| | +-- current-value? uint16 | | +-- current-value? uint16
| +-- probing-rate | +-- probing-rate
| | +-- (direction)? | | +-- (direction)?
| | | +--:(server-to-client-only) | | | +--:(server-to-client-only)
| | | +-- max-value? uint16 | | | +-- max-value? uint16
| | | +-- min-value? uint16 | | | +-- min-value? uint16
| | +-- current-value? uint16 | | +-- current-value? uint16
| +-- max-retransmit | +-- max-retransmit
| | +-- (direction)? | | +-- (direction)?
| | | +--:(server-to-client-only) | | | +--:(server-to-client-only)
| | | +-- max-value? uint16 | | | +-- max-value? uint16
| | | +-- min-value? uint16 | | | +-- min-value? uint16
| | +-- current-value? uint16 | | +-- current-value? uint16
| +-- ack-timeout | +-- ack-timeout
| | +-- (direction)? | | +-- (direction)?
| | | +--:(server-to-client-only) | | | +--:(server-to-client-only)
| | | +-- max-value-decimal? decimal64 | | | +-- max-value-decimal? decimal64
| | | +-- min-value-decimal? decimal64 | | | +-- min-value-decimal? decimal64
| | +-- current-value-decimal? decimal64 | | +-- current-value-decimal? decimal64
| +-- ack-random-factor | +-- ack-random-factor
| +-- (direction)? | +-- (direction)?
| | +--:(server-to-client-only) | | +--:(server-to-client-only)
| | +-- max-value-decimal? decimal64 | | +-- max-value-decimal? decimal64
| | +-- min-value-decimal? decimal64 | | +-- min-value-decimal? decimal64
| +-- current-value-decimal? decimal64 | +-- current-value-decimal? decimal64
+--:(redirected-signal) +--:(redirected-signal)
| +-- (direction)? | +-- (direction)?
| +--:(server-to-client-only) | +--:(server-to-client-only)
| +-- alt-server inet:domain-name | +-- alt-server inet:domain-name
| +-- alt-server-record* inet:ip-address | +-- alt-server-record* inet:ip-address
+--:(heartbeat) +--:(heartbeat)
+-- peer-hb-status boolean +-- peer-hb-status boolean
5.2. IANA DOTS Signal Channel YANG Module 5.2. IANA DOTS Signal Channel YANG Module
This version obsoletes the version described in Section 5.2 of This version obsoletes the version described in Section 5.2 of
[RFC8782]. [RFC8782].
<CODE BEGINS> file "iana-dots-signal-channel@2020-09-24.yang" <CODE BEGINS> file "iana-dots-signal-channel@2021-08-16.yang"
module iana-dots-signal-channel { module iana-dots-signal-channel {
yang-version 1.1; yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:iana-dots-signal-channel"; namespace "urn:ietf:params:xml:ns:yang:iana-dots-signal-channel";
prefix iana-dots-signal; prefix iana-dots-signal;
organization organization
"IANA"; "IANA";
contact contact
"Internet Assigned Numbers Authority "Internet Assigned Numbers Authority
Postal: ICANN Postal: ICANN
12025 Waterfront Drive, Suite 300 12025 Waterfront Drive, Suite 300
Los Angeles, CA 90094-2536 Los Angeles, CA 90094-2536
United States of America United States of America
Tel: +1 310 301 5800 Tel: +1 310 301 5800
<mailto:iana@iana.org>"; <mailto:iana@iana.org>";
description description
"This module contains a collection of YANG data types defined "This module contains a collection of YANG data types defined
by IANA and used for DOTS signal channel protocol. by IANA and used for DOTS signal channel protocol.
skipping to change at page 65, line 24 skipping to change at line 2913
Copyright (c) 2021 IETF Trust and the persons identified as Copyright (c) 2021 IETF Trust and the persons identified as
authors of the code. All rights reserved. authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD License to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents Relating to IETF Documents
(http://trustee.ietf.org/license-info). (http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC 8782; see This version of this YANG module is part of RFC 9132; see
the RFC itself for full legal notices."; the RFC itself for full legal notices.";
revision 2020-09-24 { revision 2021-08-16 {
description description
"Updated the prefix used for the module."; "Updated the prefix used for the module.";
reference reference
"RFC XXXX: Distributed Denial-of-Service Open Threat "RFC 9132: Distributed Denial-of-Service Open Threat
Signaling (DOTS) Signal Channel Specification"; Signaling (DOTS) Signal Channel Specification";
} }
revision 2020-05-28 { revision 2020-05-28 {
description description
"Initial revision."; "Initial revision.";
reference reference
"RFC 8782: Distributed Denial-of-Service Open Threat "RFC 8782: Distributed Denial-of-Service Open Threat
Signaling (DOTS) Signal Channel Specification"; Signaling (DOTS) Signal Channel Specification";
} }
skipping to change at page 66, line 9 skipping to change at line 2946
description description
"Attack mitigation setup is in progress (e.g., changing "Attack mitigation setup is in progress (e.g., changing
the network path to reroute the inbound traffic the network path to reroute the inbound traffic
to DOTS mitigator)."; to DOTS mitigator).";
} }
enum attack-successfully-mitigated { enum attack-successfully-mitigated {
value 2; value 2;
description description
"Attack is being successfully mitigated (e.g., traffic "Attack is being successfully mitigated (e.g., traffic
is redirected to a DDoS mitigator and attack is redirected to a DDoS mitigator and attack
traffic is dropped or blackholed)."; traffic is dropped).";
} }
enum attack-stopped { enum attack-stopped {
value 3; value 3;
description description
"Attack has stopped and the DOTS client can "Attack has stopped and the DOTS client can
withdraw the mitigation request."; withdraw the mitigation request.";
} }
enum attack-exceeded-capability { enum attack-exceeded-capability {
value 4; value 4;
description description
skipping to change at page 67, line 4 skipping to change at line 2988
value 8; value 8;
description description
"Attack mitigation will be triggered "Attack mitigation will be triggered
for the mitigation request only when for the mitigation request only when
the DOTS signal channel session is lost."; the DOTS signal channel session is lost.";
} }
} }
description description
"Enumeration for status reported by the DOTS server."; "Enumeration for status reported by the DOTS server.";
} }
typedef conflict-status { typedef conflict-status {
type enumeration { type enumeration {
enum request-inactive-other-active { enum request-inactive-other-active {
value 1; value 1;
description description
"DOTS Server has detected conflicting mitigation "DOTS server has detected conflicting mitigation
requests from different DOTS clients. requests from different DOTS clients.
This mitigation request is currently inactive This mitigation request is currently inactive
until the conflicts are resolved. Another until the conflicts are resolved. Another
mitigation request is active."; mitigation request is active.";
} }
enum request-active { enum request-active {
value 2; value 2;
description description
"DOTS Server has detected conflicting mitigation "DOTS server has detected conflicting mitigation
requests from different DOTS clients. requests from different DOTS clients.
This mitigation request is currently active."; This mitigation request is currently active.";
} }
enum all-requests-inactive { enum all-requests-inactive {
value 3; value 3;
description description
"DOTS Server has detected conflicting mitigation "DOTS server has detected conflicting mitigation
requests from different DOTS clients. All requests from different DOTS clients. All
conflicting mitigation requests are inactive."; conflicting mitigation requests are inactive.";
} }
} }
description description
"Enumeration for conflict status."; "Enumeration for conflict status.";
} }
typedef conflict-cause { typedef conflict-cause {
type enumeration { type enumeration {
skipping to change at page 68, line 44 skipping to change at line 3077
<CODE ENDS> <CODE ENDS>
5.3. IETF DOTS Signal Channel YANG Module 5.3. IETF DOTS Signal Channel YANG Module
This module uses the common YANG types defined in [RFC6991] and types This module uses the common YANG types defined in [RFC6991] and types
defined in [RFC8783]. defined in [RFC8783].
This version obsoletes the version described in Section 5.3 of This version obsoletes the version described in Section 5.3 of
[RFC8782]. [RFC8782].
<CODE BEGINS> file "ietf-dots-signal-channel@2021-03-02.yang" <CODE BEGINS> file "ietf-dots-signal-channel@2021-08-16.yang"
module ietf-dots-signal-channel { module ietf-dots-signal-channel {
yang-version 1.1; yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-dots-signal-channel"; namespace "urn:ietf:params:xml:ns:yang:ietf-dots-signal-channel";
prefix dots-signal; prefix dots-signal;
import ietf-inet-types { import ietf-inet-types {
prefix inet; prefix inet;
reference reference
"Section 4 of RFC 6991"; "Section 4 of RFC 6991";
} }
import ietf-yang-types { import ietf-yang-types {
prefix yang; prefix yang;
reference reference
"Section 3 of RFC 6991"; "Section 3 of RFC 6991";
} }
import ietf-dots-data-channel { import ietf-dots-data-channel {
prefix data-channel; prefix data-channel;
reference reference
"RFC 8783: Distributed Denial-of-Service Open Threat Signaling "RFC 8783: Distributed Denial-of-Service Open Threat Signaling
(DOTS) Data Channel Specification"; (DOTS) Data Channel Specification";
} }
import iana-dots-signal-channel { import iana-dots-signal-channel {
prefix iana-dots-signal; prefix iana-dots-signal;
reference reference
"RFC XXXX: Distributed Denial-of-Service Open Threat Signaling "RFC 9132: Distributed Denial-of-Service Open Threat Signaling
(DOTS) Signal Channel Specification"; (DOTS) Signal Channel Specification";
} }
import ietf-yang-structure-ext { import ietf-yang-structure-ext {
prefix sx; prefix sx;
reference reference
"RFC 8791: YANG Data Structure Extensions"; "RFC 8791: YANG Data Structure Extensions";
} }
organization organization
"IETF DDoS Open Threat Signaling (DOTS) Working Group"; "IETF DDoS Open Threat Signaling (DOTS) Working Group";
contact contact
"WG Web: <https://datatracker.ietf.org/wg/dots/> "WG Web: <https://datatracker.ietf.org/wg/dots/>
WG List: <mailto:dots@ietf.org> WG List: <mailto:dots@ietf.org>
Editor: Mohamed Boucadair Editor: Mohamed Boucadair
<mailto:mohamed.boucadair@orange.com> <mailto:mohamed.boucadair@orange.com>
Editor: Jon Shallow Editor: Jon Shallow
<mailto:supjps-ietf@jpshallow.com> <mailto:supjps-ietf@jpshallow.com>
Author: Konda, Tirumaleswar Reddy.K Author: Konda, Tirumaleswar Reddy.K
<mailto:TirumaleswarReddy_Konda@McAfee.com> <mailto:mailto:kondtir@gmail.com>
Author: Prashanth Patil Author: Prashanth Patil
<mailto:praspati@cisco.com> <mailto:praspati@cisco.com>
Author: Andrew Mortensen Author: Andrew Mortensen
<mailto:amortensen@arbor.net> <mailto:amortensen@arbor.net>
Author: Nik Teague Author: Nik Teague
<mailto:nteague@ironmountain.co.uk>"; <mailto:nteague@ironmountain.co.uk>";
description description
"This module contains YANG definition for the signaling "This module contains YANG definition for the signaling
messages exchanged between a DOTS client and a DOTS server. messages exchanged between a DOTS client and a DOTS server.
Copyright (c) 2021 IETF Trust and the persons identified as Copyright (c) 2021 IETF Trust and the persons identified as
authors of the code. All rights reserved. authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD License to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents Relating to IETF Documents
(http://trustee.ietf.org/license-info). (http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see This version of this YANG module is part of RFC 9132; see
the RFC itself for full legal notices."; the RFC itself for full legal notices.";
revision 2021-03-02 { revision 2021-08-16 {
description description
"Updated revision to comply with RFC8791. "Updated revision to comply with RFC 8791.
This version is not backward compatible with the version This version is not backward compatible with the version
published in RFC 8782."; published in RFC 8782.";
reference reference
"RFC XXXX: Distributed Denial-of-Service Open Threat "RFC 9132: Distributed Denial-of-Service Open Threat
Signaling (DOTS) Signal Channel Specification"; Signaling (DOTS) Signal Channel Specification";
} }
revision 2020-05-28 { revision 2020-05-28 {
description description
"Initial revision."; "Initial revision.";
reference reference
"RFC 8782: Distributed Denial-of-Service Open Threat "RFC 8782: Distributed Denial-of-Service Open Threat
Signaling (DOTS) Signal Channel Specification"; Signaling (DOTS) Signal Channel Specification";
} }
/* /*
* Groupings * Groupings
*/ */
grouping mitigation-scope { grouping mitigation-scope {
description
"Specifies the scope of the mitigation request.";
list scope {
description description
"The scope of the request."; "Specifies the scope of the mitigation request.";
uses data-channel:target; list scope {
leaf-list alias-name {
type string;
description description
"An alias name that points to a resource."; "The scope of the request.";
} uses data-channel:target;
leaf lifetime { leaf-list alias-name {
type union { type string;
type uint32; description
type int32 { "An alias name that points to a resource.";
range "-1";
}
} }
units "seconds"; leaf lifetime {
default "3600"; type union {
description type uint32;
"Indicates the lifetime of the mitigation request. type int32 {
range "-1";
}
}
units "seconds";
default "3600";
description
"Indicates the lifetime of the mitigation request.
A lifetime of '0' in a mitigation request is an A lifetime of '0' in a mitigation request is an
invalid value. invalid value.
A lifetime of negative one (-1) indicates indefinite A lifetime of negative one (-1) indicates indefinite
lifetime for the mitigation request. lifetime for the mitigation request.
Lifetime is mandatory in a mitigation request. Lifetime is mandatory in a mitigation request.
The DOTS server must always indicate the actual lifetime The DOTS server must always indicate the actual lifetime
in the response to an accepted mitigation request and the in the response to an accepted mitigation request and the
remaining lifetime in status messages sent to the remaining lifetime in status messages sent to the
DOTS client."; DOTS client.";
} }
leaf trigger-mitigation { leaf trigger-mitigation {
type boolean; type boolean;
default "true"; default "true";
description
"If set to 'false', DDoS mitigation will not be
triggered unless the DOTS signal channel
session is lost.";
}
choice direction {
description
"Indicates the communication direction in which the
data nodes can be included.";
case server-to-client-only {
description description
"These data nodes appear only in a mitigation message "If set to 'false', DDoS mitigation will not be
sent from the server to the client."; triggered unless the DOTS signal channel
leaf mid { session is lost.";
type uint32; }
description choice direction {
"Mitigation request identifier. description
"Indicates the communication direction in which the
This identifier must be unique for each mitigation data nodes can be included.";
request bound to the DOTS client."; case server-to-client-only {
}
leaf mitigation-start {
type uint64;
description
"Mitigation start time is represented in seconds
relative to 1970-01-01T00:00:00Z in UTC time.
This is a mandatory attribute when an attack mitigation
is active. It must not be returned for a
mitigation with 'status' code set to 8.";
}
leaf status {
type iana-dots-signal:status;
description
"Indicates the status of a mitigation request.
It must be included in responses only.
This is a mandatory attribute if a mitigation
request is accepted and processed by the server.";
}
container conflict-information {
description description
"Indicates that a conflict is detected."; "These data nodes appear only in a mitigation message
leaf conflict-status { sent from the server to the client.";
type iana-dots-signal:conflict-status; leaf mid {
type uint32;
description description
"Indicates the conflict status."; "Mitigation request identifier.
This identifier must be unique for each mitigation
request bound to the DOTS client.";
} }
leaf conflict-cause { leaf mitigation-start {
type iana-dots-signal:conflict-cause; type uint64;
description description
"Indicates the cause of the conflict."; "Mitigation start time is represented in seconds
relative to 1970-01-01T00:00:00Z in UTC time.
This is a mandatory attribute when an attack
mitigation is active. It must not be returned for
a mitigation with 'status' code set to 8.";
} }
leaf retry-timer { leaf status {
type uint32; type iana-dots-signal:status;
units "seconds";
description description
"The DOTS client must not resend the "Indicates the status of a mitigation request.
same request that has a conflict before the expiry of It must be included in responses only.
this timer.";
This is a mandatory attribute if a mitigation
request is accepted and processed by the server.";
} }
container conflict-scope { container conflict-information {
description description
"Provides more information about the conflict scope."; "Indicates that a conflict is detected.";
leaf conflict-status {
uses data-channel:target { type iana-dots-signal:conflict-status;
when "/dots-signal/scope/conflict-information/" description
+ "conflict-cause = 'overlapping-targets'"; "Indicates the conflict status.";
} }
leaf-list alias-name { leaf conflict-cause {
when "../../conflict-cause = 'overlapping-targets'"; type iana-dots-signal:conflict-cause;
type string;
description description
"Conflicting alias-name."; "Indicates the cause of the conflict.";
} }
list acl-list { leaf retry-timer {
when "../../conflict-cause =" type uint32;
+ " 'conflict-with-acceptlist'"; units "seconds";
key "acl-name";
description description
"List of conflicting ACLs as defined in the DOTS data "The DOTS client must not resend the
channel. These ACLs are uniquely defined by same request that has a conflict before the expiry
cuid and acl-name."; of this timer.";
leaf acl-name { }
type leafref { container conflict-scope {
path "/data-channel:dots-data" description
+ "/data-channel:dots-client/data-channel:acls" "Provides more information about the conflict
+ "/data-channel:acl/data-channel:name"; scope.";
} uses data-channel:target {
when "/dots-signal/scope/conflict-information/"
+ "conflict-cause = 'overlapping-targets'";
}
leaf-list alias-name {
when "../../conflict-cause = 'overlapping-targets'";
type string;
description description
"Reference to the conflicting ACL name bound to "Conflicting alias-name.";
a DOTS client.";
} }
leaf acl-type { list acl-list {
type leafref { when "../../conflict-cause ="
path "/data-channel:dots-data" + " 'conflict-with-acceptlist'";
+ "/data-channel:dots-client/data-channel:acls" key "acl-name";
+ "/data-channel:acl/data-channel:type"; description
"List of conflicting ACLs, as defined in the DOTS
data channel. These ACLs are uniquely defined by
cuid and acl-name.";
leaf acl-name {
type leafref {
path "/data-channel:dots-data"
+ "/data-channel:dots-client"
+ "/data-channel:acls"
+ "/data-channel:acl/data-channel:name";
}
description
"Reference to the conflicting ACL name bound to
a DOTS client.";
} }
leaf acl-type {
type leafref {
path "/data-channel:dots-data"
+ "/data-channel:dots-client"
+ "/data-channel:acls"
+ "/data-channel:acl/data-channel:type";
}
description
"Reference to the conflicting ACL type bound to
a DOTS client.";
}
}
leaf mid {
when "../../conflict-cause = 'overlapping-targets'";
type uint32;
description description
"Reference to the conflicting ACL type bound to "Reference to the conflicting 'mid' bound to
a DOTS client."; the same DOTS client.";
} }
} }
leaf mid { }
when "../../conflict-cause = 'overlapping-targets'"; leaf bytes-dropped {
type uint32; type yang:zero-based-counter64;
description units "bytes";
"Reference to the conflicting 'mid' bound to description
the same DOTS client."; "The total dropped byte count for the mitigation
} request since the attack mitigation was triggered.
The count wraps around when it reaches the maximum
value of counter64 for dropped bytes.";
}
leaf bps-dropped {
type yang:gauge64;
units "bytes per second";
description
"The average number of dropped bytes per second for
the mitigation request since the attack
mitigation was triggered. This should be over
five-minute intervals (that is, measuring bytes
into five-minute buckets and then averaging these
buckets over the time since the mitigation was
triggered).";
}
leaf pkts-dropped {
type yang:zero-based-counter64;
description
"The total number of dropped packet count for the
mitigation request since the attack mitigation was
triggered. The count wraps around when it reaches
the maximum value of counter64 for dropped packets.";
}
leaf pps-dropped {
type yang:gauge64;
units "packets per second";
description
"The average number of dropped packets per second
for the mitigation request since the attack
mitigation was triggered. This should be over
five-minute intervals (that is, measuring packets
into five-minute buckets and then averaging these
buckets over the time since the mitigation was
triggered).";
} }
} }
leaf bytes-dropped { case client-to-server-only {
type yang:zero-based-counter64;
units "bytes";
description
"The total dropped byte count for the mitigation
request since the attack mitigation was triggered.
The count wraps around when it reaches the maximum value
of counter64 for dropped bytes.";
}
leaf bps-dropped {
type yang:gauge64;
units "bytes per second";
description
"The average number of dropped bytes per second for
the mitigation request since the attack
mitigation was triggered. This should be over
five-minute intervals (that is, measuring bytes
into five-minute buckets and then averaging these
buckets over the time since the mitigation was
triggered).";
}
leaf pkts-dropped {
type yang:zero-based-counter64;
description
"The total number of dropped packet count for the
mitigation request since the attack mitigation was
triggered. The count wraps around when it reaches
the maximum value of counter64 for dropped packets.";
}
leaf pps-dropped {
type yang:gauge64;
units "packets per second";
description
"The average number of dropped packets per second
for the mitigation request since the attack
mitigation was triggered. This should be over
five-minute intervals (that is, measuring packets
into five-minute buckets and then averaging these
buckets over the time since the mitigation was
triggered).";
}
}
case client-to-server-only {
description
"These data nodes appear only in a mitigation message
sent from the client to the server.";
leaf attack-status {
type iana-dots-signal:attack-status;
description description
"Indicates the status of an attack as seen by the "These data nodes appear only in a mitigation message
DOTS client. sent from the client to the server.";
leaf attack-status {
type iana-dots-signal:attack-status;
description
"Indicates the status of an attack as seen by the
DOTS client.
This is a mandatory attribute when a client This is a mandatory attribute when a client
performs an efficacy update."; performs an efficacy update.";
}
} }
} }
} }
} }
}
grouping config-parameters { grouping config-parameters {
description
"Subset of DOTS signal channel session configuration.";
container heartbeat-interval {
description description
"DOTS agents regularly send heartbeats to each other "Subset of DOTS signal channel session configuration.";
after mutual authentication is successfully container heartbeat-interval {
completed in order to keep the DOTS signal channel
open.";
choice direction {
description description
"Indicates the communication direction in which the "DOTS agents regularly send heartbeats to each other
data nodes can be included."; after mutual authentication is successfully
case server-to-client-only { completed in order to keep the DOTS signal channel
open.";
choice direction {
description description
"These data nodes appear only in a mitigation message "Indicates the communication direction in which the
sent from the server to the client."; data nodes can be included.";
leaf max-value { case server-to-client-only {
type uint16;
units "seconds";
description
"Maximum acceptable heartbeat-interval value.";
}
leaf min-value {
type uint16;
units "seconds";
description description
"Minimum acceptable heartbeat-interval value."; "These data nodes appear only in a mitigation message
sent from the server to the client.";
leaf max-value {
type uint16;
units "seconds";
description
"Maximum acceptable heartbeat-interval value.";
}
leaf min-value {
type uint16;
units "seconds";
description
"Minimum acceptable heartbeat-interval value.";
}
} }
} }
} leaf current-value {
leaf current-value { type uint16;
type uint16; units "seconds";
units "seconds"; default "30";
default "30"; description
description "Current heartbeat-interval value.
"Current heartbeat-interval value.
'0' means that heartbeat mechanism is deactivated."; '0' means that heartbeat mechanism is deactivated.";
}
} }
} container missing-hb-allowed {
container missing-hb-allowed {
description
"Maximum number of missing heartbeats allowed.";
choice direction {
description description
"Indicates the communication direction in which the "Maximum number of missing heartbeats allowed.";
data nodes can be included."; choice direction {
case server-to-client-only {
description description
"These data nodes appear only in a mitigation message "Indicates the communication direction in which the
sent from the server to the client."; data nodes can be included.";
leaf max-value { case server-to-client-only {
type uint16;
description
"Maximum acceptable missing-hb-allowed value.";
}
leaf min-value {
type uint16;
description description
"Minimum acceptable missing-hb-allowed value."; "These data nodes appear only in a mitigation message
sent from the server to the client.";
leaf max-value {
type uint16;
description
"Maximum acceptable missing-hb-allowed value.";
}
leaf min-value {
type uint16;
description
"Minimum acceptable missing-hb-allowed value.";
}
} }
} }
leaf current-value {
type uint16;
default "15";
description
"Current missing-hb-allowed value.";
}
} }
leaf current-value { container probing-rate {
type uint16;
default "15";
description
"Current missing-hb-allowed value.";
}
}
container probing-rate {
description
"The limit for sending Non-confirmable messages with
no response.";
choice direction {
description description
"Indicates the communication direction in which the "The limit for sending Non-confirmable messages with
data nodes can be included."; no response.";
case server-to-client-only { choice direction {
description description
"These data nodes appear only in a mitigation message "Indicates the communication direction in which the
sent from the server to the client."; data nodes can be included.";
leaf max-value { case server-to-client-only {
type uint16;
units "byte/second";
description
"Maximum acceptable probing-rate value.";
}
leaf min-value {
type uint16;
units "byte/second";
description description
"Minimum acceptable probing-rate value."; "These data nodes appear only in a mitigation message
sent from the server to the client.";
leaf max-value {
type uint16;
units "byte/second";
description
"Maximum acceptable probing-rate value.";
}
leaf min-value {
type uint16;
units "byte/second";
description
"Minimum acceptable probing-rate value.";
}
} }
} }
leaf current-value {
type uint16;
units "byte/second";
default "5";
description
"Current probing-rate value.";
}
} }
leaf current-value { container max-retransmit {
type uint16;
units "byte/second";
default "5";
description description
"Current probing-rate value."; "Maximum number of retransmissions of a Confirmable
message.";
choice direction {
description
"Indicates the communication direction in which the
data nodes can be included.";
case server-to-client-only {
description
"These data nodes appear only in a mitigation message
sent from the server to the client.";
leaf max-value {
type uint16;
description
"Maximum acceptable max-retransmit value.";
}
leaf min-value {
type uint16;
description
"Minimum acceptable max-retransmit value.";
}
}
}
leaf current-value {
type uint16;
default "3";
description
"Current max-retransmit value.";
}
} }
} container ack-timeout {
container max-retransmit {
description
"Maximum number of retransmissions of a Confirmable
message.";
choice direction {
description description
"Indicates the communication direction in which the "Initial retransmission timeout value.";
data nodes can be included."; choice direction {
case server-to-client-only {
description description
"These data nodes appear only in a mitigation message "Indicates the communication direction in which the
sent from the server to the client."; data nodes can be included.";
leaf max-value { case server-to-client-only {
type uint16;
description description
"Maximum acceptable max-retransmit value."; "These data nodes appear only in a mitigation message
sent from the server to the client.";
leaf max-value-decimal {
type decimal64 {
fraction-digits 2;
}
units "seconds";
description
"Maximum ack-timeout value.";
}
leaf min-value-decimal {
type decimal64 {
fraction-digits 2;
}
units "seconds";
description
"Minimum ack-timeout value.";
}
} }
leaf min-value { }
type uint16; leaf current-value-decimal {
description type decimal64 {
"Minimum acceptable max-retransmit value."; fraction-digits 2;
} }
units "seconds";
default "2";
description
"Current ack-timeout value.";
} }
} }
leaf current-value { container ack-random-factor {
type uint16;
default "3";
description
"Current max-retransmit value.";
}
}
container ack-timeout {
description
"Initial retransmission timeout value.";
choice direction {
description description
"Indicates the communication direction in which the "Random factor used to influence the timing of
data nodes can be included."; retransmissions.";
case server-to-client-only { choice direction {
description description
"These data nodes appear only in a mitigation message "Indicates the communication direction in which the
sent from the server to the client."; data nodes can be included.";
leaf max-value-decimal { case server-to-client-only {
type decimal64 {
fraction-digits 2;
}
units "seconds";
description description
"Maximum ack-timeout value."; "These data nodes appear only in a mitigation message
} sent from the server to the client.";
leaf min-value-decimal { leaf max-value-decimal {
type decimal64 { type decimal64 {
fraction-digits 2; fraction-digits 2;
}
description
"Maximum acceptable ack-random-factor value.";
}
leaf min-value-decimal {
type decimal64 {
fraction-digits 2;
}
description
"Minimum acceptable ack-random-factor value.";
} }
units "seconds";
description
"Minimum ack-timeout value.";
} }
} }
} leaf current-value-decimal {
leaf current-value-decimal { type decimal64 {
type decimal64 { fraction-digits 2;
fraction-digits 2; }
default "1.5";
description
"Current ack-random-factor value.";
} }
units "seconds"; }
default "2"; }
grouping signal-config {
description
"DOTS signal channel session configuration.";
container mitigating-config {
description description
"Current ack-timeout value."; "Configuration parameters to use when a mitigation
is active.";
uses config-parameters;
}
container idle-config {
description
"Configuration parameters to use when no mitigation
is active.";
uses config-parameters;
} }
} }
container ack-random-factor {
grouping redirected-signal {
description description
"Random factor used to influence the timing of "Grouping for the redirected signaling.";
retransmissions.";
choice direction { choice direction {
description description
"Indicates the communication direction in which the "Indicates the communication direction in which the
data nodes can be included."; data nodes can be included.";
case server-to-client-only { case server-to-client-only {
description description
"These data nodes appear only in a mitigation message "These data nodes appear only in a mitigation message
sent from the server to the client."; sent from the server to the client.";
leaf max-value-decimal { leaf alt-server {
type decimal64 { type inet:domain-name;
fraction-digits 2; mandatory true;
}
description description
"Maximum acceptable ack-random-factor value."; "FQDN of an alternate server.";
} }
leaf min-value-decimal { leaf-list alt-server-record {
type decimal64 { type inet:ip-address;
fraction-digits 2;
}
description description
"Minimum acceptable ack-random-factor value."; "List of records for the alternate server.";
} }
} }
} }
leaf current-value-decimal {
type decimal64 {
fraction-digits 2;
}
default "1.5";
description
"Current ack-random-factor value.";
}
}
}
grouping signal-config {
description
"DOTS signal channel session configuration.";
container mitigating-config {
description
"Configuration parameters to use when a mitigation
is active.";
uses config-parameters;
} }
container idle-config {
description
"Configuration parameters to use when no mitigation
is active.";
uses config-parameters;
} /*
} * DOTS Signal Channel Structure
*/
grouping redirected-signal { sx:structure dots-signal {
description
"Grouping for the redirected signaling.";
choice direction {
description description
"Indicates the communication direction in which the "Main structure for DOTS signal message.
data nodes can be included.";
case server-to-client-only { A DOTS signal message can be a mitigation, a configuration,
a redirected, or a heartbeat signal message.";
choice message-type {
description description
"These data nodes appear only in a mitigation message "Can be a mitigation, a configuration, a redirect, or
sent from the server to the client."; a heartbeat message.";
leaf alt-server { case mitigation-scope {
type inet:domain-name;
mandatory true;
description description
"FQDN of an alternate server."; "Mitigation scope of a mitigation message.";
uses mitigation-scope;
} }
leaf-list alt-server-record { case signal-config {
type inet:ip-address;
description description
"List of records for the alternate server."; "Configuration message.";
uses signal-config;
} }
} case redirected-signal {
}
}
/*
* DOTS Signal Channel Structure
*/
sx:structure dots-signal {
description
"Main structure for DOTS signal message.
A DOTS signal message can be a mitigation, a configuration,
a redirected, or a heartbeat signal message.";
choice message-type {
description
"Can be a mitigation, a configuration, a redirect, or
a heartbeat message.";
case mitigation-scope {
description
"Mitigation scope of a mitigation message.";
uses mitigation-scope;
}
case signal-config {
description
"Configuration message.";
uses signal-config;
}
case redirected-signal {
description
"Redirected signaling.";
uses redirected-signal;
}
case heartbeat {
description
"DOTS heartbeats.";
leaf peer-hb-status {
type boolean;
mandatory true;
description description
"Indicates whether a DOTS agent receives heartbeats "Redirected signaling.";
from its peer. The value is set to 'true' if the uses redirected-signal;
DOTS agent is receiving heartbeat messages }
from its peer."; case heartbeat {
description
"DOTS heartbeats.";
leaf peer-hb-status {
type boolean;
mandatory true;
description
"Indicates whether a DOTS agent receives heartbeats
from its peer. The value is set to 'true' if the
DOTS agent is receiving heartbeat messages
from its peer.";
}
} }
} }
} }
} }
} <CODE ENDS>
<CODE ENDS>
6. YANG/JSON Mapping Parameters to CBOR 6. YANG/JSON Mapping Parameters to CBOR
All parameters in the payload of the DOTS signal channel MUST be All parameters in the payload of the DOTS signal channel MUST be
mapped to CBOR types as shown in Table 5 and are assigned an integer mapped to CBOR types, as shown in Table 5, and are assigned an
key to save space. integer key to save space.
Note: Implementers must check that the mapping output provided by Note: Implementers must check that the mapping output provided by
their YANG-to-CBOR encoding schemes is aligned with the content of their YANG-to-CBOR encoding schemes is aligned with the content of
Table 5. For example, some CBOR and JSON types for enumerations Table 5. For example, some CBOR and JSON types for enumerations
and the 64-bit quantities can differ depending on the encoder and the 64-bit quantities can differ depending on the encoder
used. used.
The CBOR key values are divided into two types: comprehension- The CBOR key values are divided into two types: comprehension-
required and comprehension-optional. DOTS agents can safely ignore required and comprehension-optional. DOTS agents can safely ignore
comprehension-optional values they don't understand, but they cannot comprehension-optional values they don't understand, but they cannot
successfully process a request if it contains comprehension-required successfully process a request if it contains comprehension-required
values that are not understood. The 4.00 response SHOULD include a values that are not understood. The 4.00 response SHOULD include a
diagnostic payload describing the unknown comprehension-required CBOR diagnostic payload describing the unknown comprehension-required CBOR
key values. The initial set of CBOR key values defined in this key values. The initial set of CBOR key values defined in this
specification are of type comprehension-required. specification are of type comprehension-required.
+---------------------+--------------+------+-------------+--------+ +=====================+==============+======+=============+========+
| Parameter Name | YANG Type | CBOR | CBOR Major | JSON | | Parameter Name | YANG Type | CBOR | CBOR Major | JSON |
| | | Key | Type & | Type | | | | Key | Type & | Type |
| | | | Information | | | | | | Information | |
+=====================+==============+======+=============+========+ +=====================+==============+======+=============+========+
| ietf-dots-signal- | container | 1 | 5 map | Object | | ietf-dots-signal- | container | 1 | 5 map | Object |
| channel:mitigation- | | | | | | channel:mitigation- | | | | |
| scope | | | | | | scope | | | | |
+---------------------+--------------+------+-------------+--------+ +---------------------+--------------+------+-------------+--------+
| scope | list | 2 | 4 array | Array | | scope | list | 2 | 4 array | Array |
+---------------------+--------------+------+-------------+--------+ +---------------------+--------------+------+-------------+--------+
skipping to change at page 85, line 16 skipping to change at line 3869
| ietf-dots-signal- | container | 49 | 5 map | Object | | ietf-dots-signal- | container | 49 | 5 map | Object |
| channel:heartbeat | | | | | | channel:heartbeat | | | | |
+---------------------+--------------+------+-------------+--------+ +---------------------+--------------+------+-------------+--------+
| probing-rate | container | 50 | 5 map | Object | | probing-rate | container | 50 | 5 map | Object |
+---------------------+--------------+------+-------------+--------+ +---------------------+--------------+------+-------------+--------+
| peer-hb-status | boolean | 51 | 7 bits 20 | False | | peer-hb-status | boolean | 51 | 7 bits 20 | False |
| | | +-------------+--------+ | | | +-------------+--------+
| | | | 7 bits 21 | True | | | | | 7 bits 21 | True |
+---------------------+--------------+------+-------------+--------+ +---------------------+--------------+------+-------------+--------+
Table 5: CBOR Key Values Used in DOTS Signal Channel Messages & Table 5: CBOR Key Values Used in DOTS Signal Channel Messages &
Their Mappings to JSON and YANG Their Mappings to JSON and YANG
7. (D)TLS Protocol Profile and Performance Considerations 7. (D)TLS Protocol Profile and Performance Considerations
7.1. (D)TLS Protocol Profile 7.1. (D)TLS Protocol Profile
This section defines the (D)TLS protocol profile of DOTS signal This section defines the (D)TLS protocol profile of DOTS signal
channel over (D)TLS and DOTS data channel over TLS. channel over (D)TLS and DOTS data channel over TLS.
There are known attacks on (D)TLS, such as man-in-the-middle and There are known attacks on (D)TLS, such as man-in-the-middle and
protocol downgrade attacks. These are general attacks on (D)TLS and, protocol downgrade attacks. These are general attacks on (D)TLS and,
skipping to change at page 85, line 44 skipping to change at line 3897
(D)TLS 1.2 or later. (D)TLS 1.2 or later.
When a DOTS client is configured with a domain name of the DOTS When a DOTS client is configured with a domain name of the DOTS
server, and it connects to its configured DOTS server, the server may server, and it connects to its configured DOTS server, the server may
present it with a PKIX certificate. In order to ensure proper present it with a PKIX certificate. In order to ensure proper
authentication, a DOTS client MUST verify the entire certification authentication, a DOTS client MUST verify the entire certification
path per [RFC5280]. Additionally, the DOTS client MUST use [RFC6125] path per [RFC5280]. Additionally, the DOTS client MUST use [RFC6125]
validation techniques to compare the domain name with the certificate validation techniques to compare the domain name with the certificate
provided. Certification authorities that issue DOTS server provided. Certification authorities that issue DOTS server
certificates SHOULD support the DNS-ID and SRV-ID identifier types. certificates SHOULD support the DNS-ID and SRV-ID identifier types.
DOTS servers SHOULD prefer the use of DNS-ID and SRV-ID over CN-ID DOTS servers SHOULD prefer the use of DNS-ID and SRV-ID over Common
identifier types in certificate requests (as described in Section 2.3 Name ID (CN-ID) identifier types in certificate requests (as
of [RFC6125]), and the wildcard character '*' SHOULD NOT be included described in Section 2.3 of [RFC6125]), and the wildcard character
in the presented identifier. DOTS doesn't use URI-IDs for server '*' SHOULD NOT be included in the presented identifier. DOTS doesn't
identity verification. use URI-IDs for server identity verification.
A key challenge to deploying DOTS is the provisioning of DOTS A key challenge to deploying DOTS is the provisioning of DOTS
clients, including the distribution of keying material to DOTS clients, including the distribution of keying material to DOTS
clients to enable the required mutual authentication of DOTS agents. clients to enable the required mutual authentication of DOTS agents.
Enrollment over Secure Transport (EST) [RFC7030] defines a method of Enrollment over Secure Transport (EST) [RFC7030] defines a method of
certificate enrollment by which domains operating DOTS servers may certificate enrollment by which domains operating DOTS servers may
provide DOTS clients with all the necessary cryptographic keying provide DOTS clients with all the necessary cryptographic keying
material, including a private key and a certificate, to authenticate material, including a private key and a certificate, to authenticate
themselves. One deployment option is to have DOTS clients behave as themselves. One deployment option is to have DOTS clients behave as
EST clients for certificate enrollment from an EST server provisioned EST clients for certificate enrollment from an EST server provisioned
by the mitigation provider. This document does not specify which EST by the mitigation provider. This document does not specify which EST
or other mechanism the DOTS client uses to achieve initial or other mechanism the DOTS client uses to achieve initial
enrollment. enrollment.
The Server Name Indication (SNI) extension [RFC6066] defines a The Server Name Indication (SNI) extension [RFC6066] defines a
mechanism for a client to tell a (D)TLS server the name of the server mechanism for a client to tell a (D)TLS server the name of the server
it wants to contact. This is a useful extension for hosting it wants to contact. This is a useful extension for hosting
environments where multiple virtual servers are reachable over a environments where multiple virtual servers are reachable over a
single IP address. The DOTS client may or may not know if it is single IP address. The DOTS client may or may not know if it is
interacting with a DOTS server in a virtual server hosting interacting with a DOTS server in a virtual server-hosting
environment, so the DOTS client SHOULD include the DOTS server FQDN environment, so the DOTS client SHOULD include the DOTS server FQDN
in the SNI extension. in the SNI extension.
Implementations compliant with this profile MUST implement all of the Implementations compliant with this profile MUST implement all of the
following items: following items:
o DTLS record replay detection (Section 3.3 of [RFC6347]) or an * DTLS record replay detection (Section 3.3 of [RFC6347]) or an
equivalent mechanism to protect against replay attacks. equivalent mechanism to protect against replay attacks.
o DTLS session resumption without server-side state to resume * DTLS session resumption without server-side state to resume
session and convey the DOTS signal. session and convey the DOTS signal.
o At least one of raw public keys [RFC7250] or PSK handshake * At least one of raw public keys [RFC7250] or PSK handshake
[RFC4279] with (EC)DHE key exchange. This reduces the size of the [RFC4279] with (EC)DHE key exchange. This reduces the size of the
ServerHello. Also, this can be used by DOTS agents that cannot ServerHello. Also, this can be used by DOTS agents that cannot
obtain certificates. obtain certificates.
Implementations compliant with this profile SHOULD implement all of Implementations compliant with this profile SHOULD implement all of
the following items to reduce the delay required to deliver a DOTS the following items to reduce the delay required to deliver a DOTS
signal channel message: signal channel message:
o TLS False Start [RFC7918], which reduces round-trips by allowing * TLS False Start [RFC7918], which reduces round trips by allowing
the TLS client's second flight of messages (ChangeCipherSpec) to the TLS client's second flight of messages (ChangeCipherSpec) to
also contain the DOTS signal. TLS False Start is formally defined also contain the DOTS signal. TLS False Start is formally defined
for use with TLS, but the same technique is applicable to DTLS as for use with TLS, but the same technique is applicable to DTLS as
well. well.
o Cached Information Extension [RFC7924] which avoids transmitting * Cached Information Extension [RFC7924], which avoids transmitting
the server's certificate and certificate chain if the client has the server's certificate and certificate chain if the client has
cached that information from a previous TLS handshake. cached that information from a previous TLS handshake.
Compared to UDP, DOTS signal channel over TCP requires an additional Compared to UDP, DOTS signal channel over TCP requires an additional
round-trip time (RTT) of latency to establish a TCP connection. DOTS round-trip time (RTT) of latency to establish a TCP connection. DOTS
implementations are encouraged to implement TCP Fast Open [RFC7413] implementations are encouraged to implement TCP Fast Open [RFC7413]
to eliminate that RTT. to eliminate that RTT.
7.2. (D)TLS 1.3 Considerations 7.2. (D)TLS 1.3 Considerations
TLS 1.3 provides useful latency improvements for connection TLS 1.3 provides useful latency improvements for connection
establishment over TLS 1.2. The DTLS 1.3 protocol establishment over TLS 1.2. The DTLS 1.3 protocol [TLS-DTLS13] is
[I-D.ietf-tls-dtls13] is based upon the TLS 1.3 protocol and provides based upon the TLS 1.3 protocol and provides equivalent security
equivalent security guarantees. (D)TLS 1.3 provides two basic guarantees. (D)TLS 1.3 provides two basic handshake modes the DOTS
handshake modes the DOTS signal channel can take advantage of: signal channel can take advantage of:
o A full handshake mode in which a DOTS client can send a DOTS * A full handshake mode in which a DOTS client can send a DOTS
mitigation request message after one round trip and the DOTS mitigation request message after one round trip and the DOTS
server immediately responds with a DOTS mitigation response. This server immediately responds with a DOTS mitigation response. This
assumes no packet loss is experienced. assumes no packet loss is experienced.
o 0-RTT mode in which the DOTS client can authenticate itself and * 0-RTT mode in which the DOTS client can authenticate itself and
send DOTS mitigation request messages in the first message, thus send DOTS mitigation request messages in the first message, thus
reducing handshake latency. 0-RTT only works if the DOTS client reducing handshake latency. 0-RTT only works if the DOTS client
has previously communicated with that DOTS server, which is very has previously communicated with that DOTS server, which is very
likely with the DOTS signal channel. likely with the DOTS signal channel.
The DOTS client has to establish a (D)TLS session with the DOTS The DOTS client has to establish a (D)TLS session with the DOTS
server during 'idle' time and share a PSK. server during 'idle' time and share a PSK.
During a DDoS attack, the DOTS client can use the (D)TLS session to During a DDoS attack, the DOTS client can use the (D)TLS session to
convey the DOTS mitigation request message and, if there is no convey the DOTS mitigation request message and, if there is no
skipping to change at page 88, line 23 skipping to change at line 4020
overlapping scopes with mitigation requests having higher numeric overlapping scopes with mitigation requests having higher numeric
'mid' values will be rejected systematically by the DOTS server. 'mid' values will be rejected systematically by the DOTS server.
Likewise, the 'sid' value is monotonically increased by the DOTS Likewise, the 'sid' value is monotonically increased by the DOTS
client for each configuration request (Section 4.5.2); attackers client for each configuration request (Section 4.5.2); attackers
replaying configuration requests with lower numeric 'sid' values will replaying configuration requests with lower numeric 'sid' values will
be rejected by the DOTS server if it maintains a higher numeric 'sid' be rejected by the DOTS server if it maintains a higher numeric 'sid'
value for this DOTS client. value for this DOTS client.
Owing to the aforementioned protections, all DOTS signal channel Owing to the aforementioned protections, all DOTS signal channel
requests are safe to transmit in TLS 1.3 as early data. Refer to requests are safe to transmit in TLS 1.3 as early data. Refer to
[I-D.boucadair-dots-earlydata] for more details. [DOTS-EARLYDATA] for more details.
A simplified TLS 1.3 handshake with 0-RTT DOTS mitigation request A simplified TLS 1.3 handshake with 0-RTT DOTS mitigation request
message exchange is shown in Figure 29. message exchange is shown in Figure 29.
DOTS Client DOTS Server DOTS Client DOTS Server
ClientHello ClientHello
(0-RTT DOTS signal message) (0-RTT DOTS signal message)
--------> -------->
ServerHello ServerHello
skipping to change at page 88, line 46 skipping to change at line 4043
<-------- [DOTS signal message] <-------- [DOTS signal message]
(end_of_early_data) (end_of_early_data)
{Finished} --------> {Finished} -------->
[DOTS signal message] <-------> [DOTS signal message] [DOTS signal message] <-------> [DOTS signal message]
Note that: Note that:
() Indicates messages protected 0-RTT keys () Indicates messages protected 0-RTT keys
{} Indicates messages protected using handshake keys {} Indicates messages protected using handshake keys
[] Indicates messages protected using 1-RTT keys [] Indicates messages protected using 1-RTT keys
Figure 29: A Simplified TLS 1.3 Handshake with 0-RTT Figure 29: A Simplified TLS 1.3 Handshake with 0-RTT
7.3. DTLS MTU and Fragmentation 7.3. DTLS MTU and Fragmentation
To avoid DOTS signal message fragmentation and the subsequent To avoid DOTS signal message fragmentation and the subsequent
decreased probability of message delivery, the DLTS records need to decreased probability of message delivery, the DLTS records need to
fit within a single datagram [RFC6347]. DTLS handles fragmentation fit within a single datagram [RFC6347]. DTLS handles fragmentation
and reassembly only for handshake messages and not for the and reassembly only for handshake messages and not for the
application data (Section 4.1.1 of [RFC6347]). If the path MTU application data (Section 4.1.1 of [RFC6347]). If the Path MTU
(PMTU) cannot be discovered, DOTS agents MUST assume a PMTU of 1280 (PMTU) cannot be discovered, DOTS agents MUST assume a PMTU of 1280
bytes, as IPv6 requires that every link in the Internet have an MTU bytes, as IPv6 requires that every link in the Internet have an MTU
of 1280 octets or greater as specified in [RFC8200]. If IPv4 support of 1280 octets or greater, as specified in [RFC8200]. If IPv4
on legacy or otherwise unusual networks is a consideration and the support on legacy or otherwise unusual networks is a consideration
PMTU is unknown, DOTS implementations MAY assume a PMTU of 576 bytes and the PMTU is unknown, DOTS implementations MAY assume a PMTU of
for IPv4 datagrams (see Section 3.3.3 of [RFC1122]). 576 bytes for IPv4 datagrams (see Section 3.3.3 of [RFC1122]).
The DOTS client must consider the amount of record expansion expected The DOTS client must consider the amount of record expansion expected
by the DTLS processing when calculating the size of the CoAP message by the DTLS processing when calculating the size of the CoAP message
that fits within the PMTU. PMTU MUST be greater than or equal to that fits within the PMTU. The PMTU MUST be greater than or equal to
[CoAP message size + DTLS 1.2 overhead of 13 octets + authentication [CoAP message size + DTLS 1.2 overhead of 13 octets + authentication
overhead of the negotiated DTLS cipher suite + block padding] overhead of the negotiated DTLS cipher suite + block padding]
(Section 4.1.1.1 of [RFC6347]). If the total request size exceeds (Section 4.1.1.1 of [RFC6347]). If the total request size exceeds
the PMTU, then the DOTS client MUST split the DOTS signal into the PMTU, then the DOTS client MUST split the DOTS signal into
separate messages; for example, the list of addresses in the 'target- separate messages; for example, the list of addresses in the 'target-
prefix' parameter could be split into multiple lists and each list prefix' parameter could be split into multiple lists and each list
conveyed in a new PUT request. conveyed in a new PUT request.
| Implementation Note: DOTS choice of message size parameters | Implementation Note: DOTS choice of message size parameters
| works well with IPv6 and with most of today's IPv4 paths. | works well with IPv6 and with most of today's IPv4 paths.
| However, with IPv4, it is harder to safely make sure that there | However, with IPv4, it is harder to safely make sure that there
| is no IP fragmentation. If the IPv4 PMTU is unknown, | is no IP fragmentation. If the IPv4 PMTU is unknown,
| implementations may want to limit themselves to more | implementations may want to limit themselves to more
| conservative IPv4 datagram sizes such as 576 bytes, per | conservative IPv4 datagram sizes, such as 576 bytes, per
| [RFC0791]. | [RFC0791].
8. Mutual Authentication of DOTS Agents & Authorization of DOTS Clients 8. Mutual Authentication of DOTS Agents & Authorization of DOTS Clients
(D)TLS based upon client certificates can be used for mutual (D)TLS based upon client certificates can be used for mutual
authentication between DOTS agents. If, for example, a DOTS gateway authentication between DOTS agents. If, for example, a DOTS gateway
is involved, DOTS clients and DOTS gateways must perform mutual is involved, DOTS clients and DOTS gateways must perform mutual
authentication; only authorized DOTS clients are allowed to send DOTS authentication; only authorized DOTS clients are allowed to send DOTS
signals to a DOTS gateway. The DOTS gateway and the DOTS server must signals to a DOTS gateway. The DOTS gateway and the DOTS server must
perform mutual authentication; a DOTS server only allows DOTS signal perform mutual authentication; a DOTS server only allows DOTS signal
skipping to change at page 90, line 38 skipping to change at line 4127
| | DDoS detector | | | | | DDoS detector | | |
| | (DOTS client) +<-------------+ | | | (DOTS client) +<-------------+ |
| +----------------+ | | +----------------+ |
+---------------------------------------------+ +---------------------------------------------+
Figure 30: Example of Authentication and Authorization of DOTS Agents Figure 30: Example of Authentication and Authorization of DOTS Agents
In the example depicted in Figure 30, the DOTS gateway and DOTS In the example depicted in Figure 30, the DOTS gateway and DOTS
clients within the 'example.com' domain proceed with mutual clients within the 'example.com' domain proceed with mutual
authentication. After the DOTS gateway validates the identity of a authentication. After the DOTS gateway validates the identity of a
DOTS client, it communicates with the AAA server in the 'example.com' DOTS client, it communicates with the Authentication, Authorization,
domain to determine if the DOTS client is authorized to request DDoS and Accounting (AAA) server in the 'example.com' domain to determine
mitigation. If the DOTS client is not authorized, a 4.01 if the DOTS client is authorized to request DDoS mitigation. If the
(Unauthorized) is returned in the response to the DOTS client. In DOTS client is not authorized, a 4.01 (Unauthorized) is returned in
this example, the DOTS gateway only allows the application server and the response to the DOTS client. In this example, the DOTS gateway
DDoS attack detector to request DDoS mitigation, but does not permit only allows the application server and DDoS attack detector to
the user of type 'guest' to request DDoS mitigation. request DDoS mitigation, but does not permit the user of type 'guest'
to request DDoS mitigation.
Also, DOTS gateways and servers located in different domains must Also, DOTS gateways and servers located in different domains must
perform mutual authentication (e.g., using certificates). A DOTS perform mutual authentication (e.g., using certificates). A DOTS
server will only allow a DOTS gateway with a certificate for a server will only allow a DOTS gateway with a certificate for a
particular domain to request mitigation for that domain. In particular domain to request mitigation for that domain. In
reference to Figure 30, the DOTS server only allows the DOTS gateway reference to Figure 30, the DOTS server only allows the DOTS gateway
to request mitigation for the 'example.com' domain and not for other to request mitigation for the 'example.com' domain and not for other
domains. domains.
9. Error Handling 9. Error Handling
This section is a summary of the Error Code responses that can be This section is a summary of the Error Code responses that can be
returned by a DOTS server. These error responses must contain a CoAP returned by a DOTS server. These error responses must contain a CoAP
4.xx or 5.xx Response Code. 4.xx or 5.xx Response Code.
In general, there may be an additional plain text diagnostic payload In general, there may be an additional plain text diagnostic payload
(Section 5.5.2 of [RFC7252]) to help troubleshooting in the body of (Section 5.5.2 of [RFC7252]) to help troubleshooting in the body of
the response unless detailed otherwise. the response unless detailed otherwise.
Errors returned by a DOTS server can be broken into two categories, Errors returned by a DOTS server can be broken into two categories:
those associated with CoAP itself and those generated during the those associated with CoAP itself and those generated during the
validation of the provided data by the DOTS server. validation of the provided data by the DOTS server.
The following list of common CoAP errors that are implemented by DOTS The following is a list of common CoAP errors that are implemented by
servers. This list is not exhaustive; other errors defined by CoAP DOTS servers. This list is not exhaustive; other errors defined by
and associated RFCs may be applicable. CoAP and associated RFCs may be applicable.
4.00 (Bad Request) is returned by the DOTS server when the DOTS 4.00 (Bad Request) is returned by the DOTS server when the DOTS
client has sent a request that violates the DOTS protocol client has sent a request that violates the DOTS protocol
(Section 4). (Section 4).
4.01 (Unauthorized) is returned by the DOTS server when the DOTS 4.01 (Unauthorized) is returned by the DOTS server when the DOTS
client is not authorized to access the DOTS server (Section 4). client is not authorized to access the DOTS server (Section 4).
4.02 (Bad Option) is returned by the DOTS server when one or more 4.02 (Bad Option) is returned by the DOTS server when one or more
CoAP options are unknown or malformed by the CoAP layer [RFC7252]. CoAP options are unknown or malformed by the CoAP layer [RFC7252].
4.04 (Not Found) is returned by the DOTS server when the DOTS client 4.04 (Not Found) is returned by the DOTS server when the DOTS client
is requesting a 'mid' or 'sid' that is not valid (Section 4). is requesting a 'mid' or 'sid' that is not valid (Section 4).
4.05 (Method Not Allowed) is returned by the DOTS server when the 4.05 (Method Not Allowed) is returned by the DOTS server when the
DOTS client is requesting a resource by a method (e.g., GET) that DOTS client is requesting a resource by a method (e.g., GET) that
is not supported by the DOTS server [RFC7252]. is not supported by the DOTS server [RFC7252].
4.08 (Request Entity Incomplete) is returned by the DOTS server if 4.08 (Request Entity Incomplete) is returned by the DOTS server if
one or multiple blocks of a block transfer request is missing one or multiple blocks of a block transfer request is missing
[RFC7959]. [RFC7959].
4.09 (Conflict) is returned by the DOTS server if the DOTS server 4.09 (Conflict) is returned by the DOTS server if the DOTS server
detects that a request conflicts with a previous request. The detects that a request conflicts with a previous request. The
response body is formatted using "application/dots+cbor", and response body is formatted using "application/dots+cbor" and
contains the "conflict-clause" (Section 4.4). contains the "conflict-clause" (Section 4.4.1.3).
4.13 (Request Entity Too Large) may be returned by the DOTS server 4.13 (Request Entity Too Large) may be returned by the DOTS server
during a block transfer request [RFC7959]. during a block transfer request [RFC7959].
4.15 (Unsupported Content-Format) is returned by the DOTS server 4.15 (Unsupported Content-Format) is returned by the DOTS server
when the Content-Format is used but the request is not formatted when the Content-Format is used but the request is not formatted
as "application/dots+cbor" (Section 4). as "application/dots+cbor" (Section 4).
4.22 (Unprocessable Entity) is returned by the DOTS server when one 4.22 (Unprocessable Entity) is returned by the DOTS server when one
or more session configuration parameters are not valid or more session configuration parameters are not valid
(Section 4.5). (Section 4.5).
5.03 (Service Unavailable) is returned by the DOTS server if the 5.03 (Service Unavailable) is returned by the DOTS server if the
DOTS server is unable to handle the request (Section 4). An DOTS server is unable to handle the request (Section 4). An
example is the DOTS server needs to redirect the DOTS client to example is the DOTS server needs to redirect the DOTS client to
use an alternate DOTS server (Section 4.6). The response body is use an alternate DOTS server (Section 4.6). The response body is
formatted using "application/dots+cbor", and contains how to formatted using "application/dots+cbor" and contains how to handle
handle the 5.03 Response Code. the 5.03 Response Code.
5.08 (Hop Limit Reached) is returned by the DOTS server if there is 5.08 (Hop Limit Reached) is returned by the DOTS server if there is
a data path loop through upstream DOTS gateways. The response a data path loop through upstream DOTS gateways. The response
body is formatted using plain text and contains a list of servers body is formatted using plain text and contains a list of servers
that are in the data path loop [RFC8768]. that are in the data path loop [RFC8768].
10. IANA Considerations 10. IANA Considerations
10.1. DOTS Signal Channel UDP and TCP Port Number 10.1. DOTS Signal Channel UDP and TCP Port Number
IANA has assigned the port number 4646 (the ASCII decimal value for IANA has assigned the port number 4646 (the ASCII decimal value for
".." (DOTS)) to the DOTS signal channel protocol for both UDP and TCP ".." (DOTS)) to the DOTS signal channel protocol for both UDP and TCP
from the "Service Name and Transport Protocol Port Number Registry" from the "Service Name and Transport Protocol Port Number Registry"
available at <https://www.iana.org/assignments/service-names-port- available at <https://www.iana.org/assignments/service-names-port-
numbers/>. numbers/>.
IANA is requested to update these entries with the RFC number to be IANA has updated these entries to refer to this document and updated
assigned to this document: the Description as described below:
Service Name: dots-signal Service Name: dots-signal
Port Number: 4646 Port Number: 4646
Transport Protocol: TCP Transport Protocol: TCP
Description: Distributed Denial-of-Service Open Threat Signaling Description: Distributed Denial-of-Service Open Threat Signaling
(DOTS) Signal Channel (DOTS) Signal Channel Protocol. The service name is used to
Assignee: IESG construct the SRV service names "_dots-signal._udp" and "_dots-
Contact: IETF Chair signal._tcp" for discovering DOTS servers used to establish DOTS
Registration Date: 2020-01-16 signal channel.
Reference: [RFCXXXX] Assignee: IESG
Contact: IETF Chair
Registration Date: 2020-01-16
Reference: [RFC8973][RFC9132]
Service Name: dots-signal Service Name: dots-signal
Port Number: 4646 Port Number: 4646
Transport Protocol: UDP Transport Protocol: UDP
Description: Distributed Denial-of-Service Open Threat Signaling Description: Distributed Denial-of-Service Open Threat Signaling
(DOTS) Signal Channel (DOTS) Signal Channel Protocol. The service name is used to
Assignee: IESG construct the SRV service names "_dots-signal._udp" and "_dots-
Contact: IETF Chair signal._tcp" for discovering DOTS servers used to establish DOTS
Registration Date: 2020-01-16 signal channel.
Reference: [RFCXXXX] Assignee: IESG
Contact: IETF Chair
Registration Date: 2020-01-16
Reference: [RFC8973][RFC9132]
10.2. Well-Known 'dots' URI 10.2. Well-Known 'dots' URI
IANA is requested to update the 'dots' well-known URI (Table 6) entry IANA has updated the 'dots' well-known URI (Table 6) entry in the
in the Well- Known URIs registry [URI] as follows: "Well-Known URIs" registry [URI] as follows:
+------------+------------+-----------+-----------+-------------+ +============+============+===========+===========+=============+
| URI Suffix | Change | Reference | Status | Related | | URI Suffix | Change | Reference | Status | Related |
| | Controller | | | information | | | Controller | | | information |
+============+============+===========+===========+=============+ +============+============+===========+===========+=============+
| dots | IETF | [RFCXXXX] | permanent | None | | dots | IETF | [RFC9132] | permanent | None |
+------------+------------+-----------+-----------+-------------+ +------------+------------+-----------+-----------+-------------+
Table 6: 'dots' Well-Known URI Table 6: 'dots' Well-Known URI
10.3. Media Type Registration 10.3. Media Type Registration
IANA is requested to update the "application/dots+cbor" media type in IANA has updated the "application/dots+cbor" media type in the "Media
the "Media Types" registry [IANA-MediaTypes] in the manner described Types" registry [IANA-MediaTypes] in the manner described in
in [RFC6838], which can be used to indicate that the content is a [RFC6838], which can be used to indicate that the content is a DOTS
DOTS signal channel object: signal channel object:
Type name: application
Subtype name: dots+cbor Type name: application
Required parameters: N/A Subtype name: dots+cbor
Optional parameters: N/A Required parameters: N/A
Encoding considerations: binary Optional parameters: N/A
Security considerations: See the Security Considerations section of Encoding considerations: binary
[RFCXXXX].
Interoperability considerations: N/A Security considerations: See the Security Considerations section of
RFC 9132.
Published specification: [RFCXXXX] Interoperability considerations: N/A
Applications that use this media type: DOTS agents sending DOTS Published specification: RFC 9132
messages over CoAP over (D)TLS.
Fragment identifier considerations: N/A Applications that use this media type: DOTS agents sending DOTS
messages over CoAP over (D)TLS.
Additional information: Fragment identifier considerations: N/A
Deprecated alias names for this type: N/A Additional information:
Magic number(s): N/A Deprecated alias names for this type: N/A
File extension(s): N/A Magic number(s): N/A
Macintosh file type code(s): N/A File extension(s): N/A
Macintosh file type code(s): N/A
Person & email address to contact for further information: IESG, Person & email address to contact for further information:
iesg@ietf.org IESG, iesg@ietf.org
Intended usage: COMMON Intended usage: COMMON
Restrictions on usage: none Restrictions on usage: none
Author: See Authors' Addresses section. Author: See Authors' Addresses section.
Change controller: IESG Change controller: IESG
Provisional registration? No Provisional registration? No
10.4. CoAP Content-Formats Registration 10.4. CoAP Content-Formats Registration
IANA is requested to update the CoAP Content-Format ID for the IANA has updated the "application/dots+cbor" media type in the "CoAP
"application/ dots+cbor" media type in the "CoAP Content-Formats" Content-Formats" registry [IANA-CoAP-Content-Formats] as follows:
registry [IANA-CoAP-Content-Formats]:
o Media Type: application/dots+cbor Media Type: application/dots+cbor
o Encoding: - Encoding: -
o Id: 271 ID: 271
o Reference: [RFCXXXX] Reference: [RFC9132]
10.5. CBOR Tag Registration 10.5. CBOR Tag Registration
This section defines the DOTS CBOR tag as another means for This section defines the DOTS CBOR tag as another means for
applications to declare that a CBOR data structure is a DOTS signal applications to declare that a CBOR data structure is a DOTS signal
channel object. Its use is optional and is intended for use in cases channel object. Its use is optional and is intended for use in cases
in which this information would not otherwise be known. The DOTS in which this information would not otherwise be known. The DOTS
CBOR tag is not required for DOTS signal channel protocol version CBOR tag is not required for the DOTS signal channel protocol version
specified in this document. If present, the DOTS tag MUST prefix a specified in this document. If present, the DOTS tag MUST prefix a
DOTS signal channel object. DOTS signal channel object.
IANA is requested to update the DOTS signal channel CBOR tag in the IANA has updated the DOTS signal channel CBOR tag in the "CBOR Tags"
"CBOR Tags" registry [IANA-CBOR-Tags]: registry [IANA-CBOR-Tags] as follows:
* Tag: 271 Tag: 271
* Data Item: DDoS Open Threat Signaling (DOTS) signal channel object Data Item: DDoS Open Threat Signaling (DOTS) signal channel object
* Semantics: DDoS Open Threat Signaling (DOTS) signal channel Semantics: DDoS Open Threat Signaling (DOTS) signal channel object,
object, as defined in [RFCXXXX] as defined in [RFC9132]
* Reference: [RFCXXXX] Reference: [RFC9132]
10.6. DOTS Signal Channel Protocol Registry 10.6. DOTS Signal Channel Protocol Registry
The following sections update the "Distributed Denial-of- Service The following sections update the "Distributed Denial-of-Service Open
Open Threat Signaling (DOTS) Signal Channel" subregistries Threat Signaling (DOTS) Signal Channel" subregistries [REG-DOTS].
[REG-DOTS].
10.6.1. DOTS Signal Channel CBOR Key Values Subregistry 10.6.1. DOTS Signal Channel CBOR Key Values Subregistry
The structure of this subregistry is provided in Section 10.6.1.1. The structure of this subregistry is provided in Section 10.6.1.1.
10.6.1.1. Registration Template 10.6.1.1. Registration Template
This specification requests IANA to update the allocation policy of IANA has updated the allocation policy of "DOTS Signal Channel CBOR
"DOTS Signal Channel CBOR Key Values" registry as follows: Key Values" registry as follows:
Parameter name: Parameter name:
Parameter name as used in the DOTS signal channel. Parameter name, as used in the DOTS signal channel.
CBOR Key Value: CBOR Key Value:
Key value for the parameter. The key value MUST be an integer in Key value for the parameter. The key value MUST be an integer in
the 1-65535 range. the 1-65535 range.
OLD: OLD:
+-------------+-------------------------+------------------------+
| Range | Registration Procedures | Note |
+=============+=========================+========================+
| 1-16383 | IETF Review | comprehension-required |
| 16384-32767 | Specification Required | comprehension-optional |
| 32768-49151 | IETF Review | comprehension-optional |
| 49152-65535 | Private Use | comprehension-optional |
+-------------+-------------------------+------------------------+
NEW: +=============+=========================+========================+
+-------------+-------------------------+------------------------+ | Range | Registration | Note |
| Range | Registration Procedures | Note | | | Procedures | |
+=============+=========================+========================+ +=============+=========================+========================+
| 1-127 | IETF Review | comprehension-required | | 1-16383 | IETF Review | comprehension-required |
| 128-255 | IETF Review | comprehension-optional | +-------------+-------------------------+------------------------+
| 256-16383 | IETF Review | comprehension-required | | 16384-32767 | Specification | comprehension-optional |
| 16384-32767 | Specification Required | comprehension-optional | | | Required | |
| 32768-49151 | IETF Review | comprehension-optional | +-------------+-------------------------+------------------------+
| 49152-65535 | Private Use | comprehension-optional | | 32768-49151 | IETF Review | comprehension-optional |
+-------------+-------------------------+------------------------+ +-------------+-------------------------+------------------------+
| 49152-65535 | Private Use | comprehension-optional |
+-------------+-------------------------+------------------------+
Table 7
NEW:
+=============+=========================+========================+
| Range | Registration | Note |
| | Procedures | |
+=============+=========================+========================+
| 1-127 | IETF Review | comprehension-required |
+-------------+-------------------------+------------------------+
| 128-255 | IETF Review | comprehension-optional |
+-------------+-------------------------+------------------------+
| 256-16383 | IETF Review | comprehension-required |
+-------------+-------------------------+------------------------+
| 16384-32767 | Specification | comprehension-optional |
| | Required | |
+-------------+-------------------------+------------------------+
| 32768-49151 | IETF Review | comprehension-optional |
+-------------+-------------------------+------------------------+
| 49152-65535 | Private Use | comprehension-optional |
+-------------+-------------------------+------------------------+
Table 8
Registration requests for the 16384-32767 range are evaluated Registration requests for the 16384-32767 range are evaluated
after a three-week review period on the dots-signal-reg- after a three-week review period on the dots-signal-reg-
review@ietf.org mailing list, on the advice of one or more review@ietf.org mailing list, on the advice of one or more
Designated Experts. However, to allow for the allocation of designated experts. However, to allow for the allocation of
values prior to publication, the Designated Experts may approve values prior to publication, the designated experts may approve
registration once they are satisfied that such a specification registration once they are satisfied that such a specification
will be published. New registration requests should be sent in will be published. New registration requests should be sent in
the form of an email to the review mailing list; the request the form of an email to the review mailing list; the request
should use an appropriate subject (e.g., "Request to register CBOR should use an appropriate subject (e.g., "Request to register CBOR
Key Value for DOTS: example"). IANA will only accept new Key Value for DOTS: example"). IANA will only accept new
registrations from the Designated Experts, and it will check that registrations from the designated experts, and it will check that
review was requested on the mailing list in accordance with these review was requested on the mailing list in accordance with these
procedures. procedures.
Within the review period, the Designated Experts will either Within the review period, the designated experts will either
approve or deny the registration request, communicating this approve or deny the registration request, communicating this
decision to the review list and IANA. Denials should include an decision to the review list and IANA. Denials should include an
explanation and, if applicable, suggestions as to how to make the explanation and, if applicable, suggestions as to how to make the
request successful. Registration requests that are undetermined request successful. Registration requests that are undetermined
for a period longer than 21 days can be brought to the IESG's for a period longer than 21 days can be brought to the IESG's
attention (using the iesg@ietf.org mailing list) for resolution. attention (using the iesg@ietf.org mailing list) for resolution.
Criteria that should be applied by the Designated Experts include Criteria that should be applied by the designated experts include
determining whether the proposed registration duplicates existing determining whether the proposed registration duplicates existing
functionality, whether it is likely to be of general applicability functionality, whether it is likely to be of general applicability
or whether it is useful only for a single use case, and whether or whether it is useful only for a single use case, and whether
the registration description is clear. IANA must only accept the registration description is clear. IANA must only accept
registry updates to the 16384-32767 range from the Designated registry updates to the 16384-32767 range from the designated
Experts and should direct all requests for registration to the experts and should direct all requests for registration to the
review mailing list. It is suggested that multiple Designated review mailing list. It is suggested that multiple designated
Experts be appointed. In cases where a registration decision experts be appointed. In cases where a registration decision
could be perceived as creating a conflict of interest for a could be perceived as creating a conflict of interest for a
particular Expert, that Expert should defer to the judgment of the particular expert, that expert should defer to the judgment of the
other Experts. other experts.
CBOR Major Type: CBOR Major Type:
CBOR Major type and optional tag for the parameter. CBOR Major type and optional tag for the parameter.
Change Controller: Change Controller:
For Standards Track RFCs, list the "IESG". For others, give the For Standards Track RFCs, list the "IESG". For others, give the
name of the responsible party. Other details (e.g., email name of the responsible party. Other details (e.g., email
address) may also be included. address) may also be included.
Specification Document(s): Specification Document(s):
Reference to the document or documents that specify the parameter, Reference to the document or documents that specify the parameter,
preferably including URIs that can be used to retrieve copies of preferably including URIs that can be used to retrieve copies of
the documents. An indication of the relevant sections may also be the documents. An indication of the relevant sections may also be
included but is not required. included but is not required.
10.6.1.2. Update Subregistry Content 10.6.1.2. Update Subregistry Content
IANA is requested to update entries in the "0-51" and "49152-65535" IANA has updated entries in the "0-51" and "49152-65535" ranges from
ranges from the "DOTS Signal Channel CBOR Key Values" registry with the "DOTS Signal Channel CBOR Key Values" registry to refer this RFC.
the RFC number to be assigned to this document.
10.6.2. Status Codes Subregistry 10.6.2. Status Codes Subregistry
IANA is requested to update these entries from the "DOTS Signal IANA has updated the following entries from the "DOTS Signal Channel
Channel Status Codes" registry with the RFC number to be assigned to Status Codes" registry to refer to this RFC:
this document:
+--------------+---------------+----------------------+-----------+ +==============+===============+======================+===========+
| Code | Label | Description | Reference | | Code | Label | Description | Reference |
+==============+===============+======================+===========+ +==============+===============+======================+===========+
| 0 | Reserved | | [RFCXXXX] | | 0 | Reserved | | [RFC9132] |
+--------------+---------------+----------------------+-----------+ +--------------+---------------+----------------------+-----------+
| 1 | attack- | Attack mitigation | [RFCXXXX] | | 1 | attack- | Attack mitigation | [RFC9132] |
| | mitigation- | setup is in progress | | | | mitigation- | setup is in progress | |
| | in-progress | (e.g., changing the | | | | in-progress | (e.g., changing the | |
| | | network path to | | | | | network path to | |
| | | redirect the inbound | | | | | redirect the inbound | |
| | | traffic to a DOTS | | | | | traffic to a DOTS | |
| | | mitigator). | | | | | mitigator). | |
+--------------+---------------+----------------------+-----------+ +--------------+---------------+----------------------+-----------+
| 2 | attack- | Attack is being | [RFCXXXX] | | 2 | attack- | Attack is being | [RFC9132] |
| | successfully- | successfully | | | | successfully- | successfully | |
| | mitigated | mitigated (e.g., | | | | mitigated | mitigated (e.g., | |
| | | traffic is | | | | | traffic is | |
| | | redirected to a DDoS | | | | | redirected to a DDoS | |
| | | mitigator and attack | | | | | mitigator and attack | |
| | | traffic is dropped). | | | | | traffic is dropped). | |
+--------------+---------------+----------------------+-----------+ +--------------+---------------+----------------------+-----------+
| 3 | attack- | Attack has stopped | [RFCXXXX] | | 3 | attack- | Attack has stopped | [RFC9132] |
| | stopped | and the DOTS client | | | | stopped | and the DOTS client | |
| | | can withdraw the | | | | | can withdraw the | |
| | | mitigation request. | | | | | mitigation request. | |
+--------------+---------------+----------------------+-----------+ +--------------+---------------+----------------------+-----------+
| 4 | attack- | Attack has exceeded | [RFCXXXX] | | 4 | attack- | Attack has exceeded | [RFC9132] |
| | exceeded- | the mitigation | | | | exceeded- | the mitigation | |
| | capability | provider capability. | | | | capability | provider capability. | |
+--------------+---------------+----------------------+-----------+ +--------------+---------------+----------------------+-----------+
| 5 | dots-client- | DOTS client has | [RFCXXXX] | | 5 | dots-client- | DOTS client has | [RFC9132] |
| | withdrawn- | withdrawn the | | | | withdrawn- | withdrawn the | |
| | mitigation | mitigation request | | | | mitigation | mitigation request | |
| | | and the mitigation | | | | | and the mitigation | |
| | | is active but | | | | | is active but | |
| | | terminating. | | | | | terminating. | |
+--------------+---------------+----------------------+-----------+ +--------------+---------------+----------------------+-----------+
| 6 | attack- | Attack mitigation is | [RFCXXXX] | | 6 | attack- | Attack mitigation is | [RFC9132] |
| | mitigation- | now terminated. | | | | mitigation- | now terminated. | |
| | terminated | | | | | terminated | | |
+--------------+---------------+----------------------+-----------+ +--------------+---------------+----------------------+-----------+
| 7 | attack- | Attack mitigation is | [RFCXXXX] | | 7 | attack- | Attack mitigation is | [RFC9132] |
| | mitigation- | withdrawn. | | | | mitigation- | withdrawn. | |
| | withdrawn | | | | | withdrawn | | |
+--------------+---------------+----------------------+-----------+ +--------------+---------------+----------------------+-----------+
| 8 | attack- | Attack mitigation | [RFCXXXX] | | 8 | attack- | Attack mitigation | [RFC9132] |
| | mitigation- | will be triggered | | | | mitigation- | will be triggered | |
| | signal-loss | for the mitigation | | | | signal-loss | for the mitigation | |
| | | request only when | | | | | request only when | |
| | | the DOTS signal | | | | | the DOTS signal | |
| | | channel session is | | | | | channel session is | |
| | | lost. | | | | | lost. | |
+--------------+---------------+----------------------+-----------+ +--------------+---------------+----------------------+-----------+
| 9-2147483647 | Unassigned | | | | 9-2147483647 | Unassigned | | |
+--------------+---------------+----------------------+-----------+ +--------------+---------------+----------------------+-----------+
Table 7: Initial DOTS Signal Channel Status Codes Table 9: Initial DOTS Signal Channel Status Codes
New codes can be assigned via Standards Action [RFC8126]. New codes can be assigned via Standards Action [RFC8126].
10.6.3. Conflict Status Codes Subregistry 10.6.3. Conflict Status Codes Subregistry
IANA is requested to update these entries from the "DOTS Signal IANA has updated the following entries from the "DOTS Signal Channel
Channel Conflict Status Codes" registry with the RFC number to be Conflict Status Codes" registry to refer to this RFC.
assigned to this document:
+--------------+-------------------+--------------------+-----------+ +=============+===============================+===========+=========+
| Code | Label | Description | Reference | |Code | Label |Description|Reference|
+==============+===================+====================+===========+ +=============+===============================+===========+=========+
| 0 | Reserved | | [RFCXXXX] | |0 | Reserved | |[RFC9132]|
+--------------+-------------------+--------------------+-----------+ +-------------+-------------------------------+-----------+---------+
| 1 | request-inactive- | DOTS server | [RFCXXXX] | |1 | request-inactive-other-active |DOTS server|[RFC9132]|
| | other-active | has detected | | | | |has | |
| | | conflicting | | | | |detected | |
| | | mitigation | | | | |conflicting| |
| | | requests from | | | | |mitigation | |
| | | different DOTS | | | | |requests | |
| | | clients. This | | | | |from | |
| | | mitigation | | | | |different | |
| | | request is | | | | |DOTS | |
| | | currently | | | | |clients. | |
| | | inactive until | | | | |This | |
| | | the conflicts | | | | |mitigation | |
| | | are resolved. | | | | |request is | |
| | | Another | | | | |currently | |
| | | mitigation | | | | |inactive | |
| | | request is | | | | |until the | |
| | | active. | | | | |conflicts | |
+--------------+-------------------+--------------------+-----------+ | | |are | |
| 2 | request-active | DOTS server | [RFCXXXX] | | | |resolved. | |
| | | has detected | | | | |Another | |
| | | conflicting | | | | |mitigation | |
| | | mitigation | | | | |request is | |
| | | requests from | | | | |active. | |
| | | different DOTS | | +-------------+-------------------------------+-----------+---------+
| | | clients. This | | |2 | request-active |DOTS server|[RFC9132]|
| | | mitigation | | | | |has | |
| | | request is | | | | |detected | |
| | | currently | | | | |conflicting| |
| | | active. | | | | |mitigation | |
+--------------+-------------------+--------------------+-----------+ | | |requests | |
| 3 | all-requests- | DOTS server | [RFCXXXX] | | | |from | |
| | inactive | has detected | | | | |different | |
| | | conflicting | | | | |DOTS | |
| | | mitigation | | | | |clients. | |
| | | requests from | | | | |This | |
| | | different DOTS | | | | |mitigation | |
| | | clients. All | | | | |request is | |
| | | conflicting | | | | |currently | |
| | | mitigation | | | | |active. | |
| | | requests are | | +-------------+-------------------------------+-----------+---------+
| | | inactive. | | |3 | all-requests-inactive |DOTS server|[RFC9132]|
+--------------+-------------------+--------------------+-----------+ | | |has | |
| 4-2147483647 | Unassigned | | | | | |detected | |
+--------------+-------------------+--------------------+-----------+ | | |conflicting| |
| | |mitigation | |
| | |requests | |
| | |from | |
| | |different | |
| | |DOTS | |
| | |clients. | |
| | |All | |
| | |conflicting| |
| | |mitigation | |
| | |requests | |
| | |are | |
| | |inactive. | |
+-------------+-------------------------------+-----------+---------+
|4-2147483647 | Unassigned | | |
+-------------+-------------------------------+-----------+---------+
Table 8: Initial DOTS Signal Channel Conflict Status Codes Table 10: Initial DOTS Signal Channel Conflict Status Codes
New codes can be assigned via Standards Action [RFC8126]. New codes can be assigned via Standards Action [RFC8126].
10.6.4. Conflict Cause Codes Subregistry 10.6.4. Conflict Cause Codes Subregistry
IANA is requested to update these entries from the "DOTS Signal IANA has updated the following entries from the "DOTS Signal Channel
Channel Conflict Cause Codes" registry with the RFC number to be Conflict Cause Codes" registry to refer to this document:
assigned to this document:
+--------------+---------------------+----------------+-----------+ +==============+==========================+===============+=========+
| Code | Label | Description | Reference | | Code | Label |Description |Reference|
+==============+=====================+================+===========+ +==============+==========================+===============+=========+
| 0 | Reserved | | [RFCXXXX] | | 0 | Reserved | |[RFC9132]|
+--------------+---------------------+----------------+-----------+ +--------------+--------------------------+---------------+---------+
| 1 | overlapping-targets | Overlapping | [RFCXXXX] | | 1 | overlapping-targets |Overlapping |[RFC9132]|
| | | targets. | | | | |targets. | |
+--------------+---------------------+----------------+-----------+ +--------------+--------------------------+---------------+---------+
| 2 | conflict-with- | Conflicts with | [RFCXXXX] | | 2 | conflict-with-acceptlist |Conflicts with |[RFC9132]|
| | acceptlist | an existing | | | | |an existing | |
| | | accept-list. | | | | |accept-list. | |
| | | This code is | | | | |This code is | |
| | | returned when | | | | |returned when | |
| | | the DDoS | | | | |the DDoS | |
| | | mitigation | | | | |mitigation | |
| | | detects source | | | | |detects source | |
| | | addresses/ | | | | |addresses/ | |
| | | prefixes in | | | | |prefixes in the| |
| | | the accept- | | | | |accept-listed | |
| | | listed ACLs | | | | |ACLs are | |
| | | are attacking | | | | |attacking the | |
| | | the target. | | | | |target. | |
+--------------+---------------------+----------------+-----------+ +--------------+--------------------------+---------------+---------+
| 3 | cuid-collision | CUID | [RFCXXXX] | | 3 | cuid-collision |CUID Collision.|[RFC9132]|
| | | Collision. | | | | |This code is | |
| | | This code is | | | | |returned when a| |
| | | returned when | | | | |DOTS client | |
| | | a DOTS client | | | | |uses a 'cuid' | |
| | | uses a 'cuid' | | | | |that is already| |
| | | that is | | | | |used by another| |
| | | already used | | | | |DOTS client. | |
| | | by another | | +--------------+--------------------------+---------------+---------+
| | | DOTS client. | | | 4-2147483647 | Unassigned | | |
+--------------+---------------------+----------------+-----------+ +--------------+--------------------------+---------------+---------+
| 4-2147483647 | Unassigned | | |
+--------------+---------------------+----------------+-----------+
Table 9: Initial DOTS Signal Channel Conflict Cause Codes Table 11: Initial DOTS Signal Channel Conflict Cause Codes
New codes can be assigned via Standards Action [RFC8126]. New codes can be assigned via Standards Action [RFC8126].
10.6.5. Attack Status Codes Subregistry 10.6.5. Attack Status Codes Subregistry
IANA is requested to update these entries from the "DOTS Signal IANA has updated the following entries from the "DOTS Signal Channel
Channel Attack Status Codes" registry with the RFC number to be Attack Status Codes" registry to refer to this RFC:
assigned to this document:
+--------------+----------------------+-----------------+-----------+ +============+===============================+============+=========+
| Code | Label | Description | Reference | |Code | Label |Description |Reference|
+==============+======================+=================+===========+ +============+===============================+============+=========+
| 0 | Reserved | | [RFCXXXX] | |0 | Reserved | |[RFC9132]|
+--------------+----------------------+-----------------+-----------+ +------------+-------------------------------+------------+---------+
| 1 | under-attack | The DOTS | [RFCXXXX] | |1 | under-attack |The DOTS |[RFC9132]|
| | | client | | | | |client | |
| | | determines | | | | |determines | |
| | | that it is | | | | |that it is | |
| | | still under | | | | |still under | |
| | | attack. | | | | |attack. | |
+--------------+----------------------+-----------------+-----------+ +------------+-------------------------------+------------+---------+
| 2 | attack-successfully- | The DOTS | [RFCXXXX] | |2 | attack-successfully-mitigated |The DOTS |[RFC9132]|
| | mitigated | client | | | | |client | |
| | | determines | | | | |determines | |
| | | that the | | | | |that the | |
| | | attack is | | | | |attack is | |
| | | successfully | | | | |successfully| |
| | | mitigated. | | | | |mitigated. | |
+--------------+----------------------+-----------------+-----------+ +------------+-------------------------------+------------+---------+
| 3-2147483647 | Unassigned | | | |3-2147483647| Unassigned | | |
+--------------+----------------------+-----------------+-----------+ +------------+-------------------------------+------------+---------+
Table 10: Initial DOTS Signal Channel Attack Status Codes Table 12: Initial DOTS Signal Channel Attack Status Codes
New codes can be assigned via Standards Action [RFC8126]. New codes can be assigned via Standards Action [RFC8126].
10.7. DOTS Signal Channel YANG Modules 10.7. DOTS Signal Channel YANG Modules
IANA already registered the following URIs in the "ns" subregistry IANA has registered the following URIs in the "ns" subregistry within
within the "IETF XML Registry" [RFC3688]: the "IETF XML Registry" [RFC3688]:
URI: urn:ietf:params:xml:ns:yang:ietf-dots-signal-channel URI: urn:ietf:params:xml:ns:yang:ietf-dots-signal-channel
Registrant Contact: The IESG. Registrant Contact: The IESG.
XML: N/A; the requested URI is an XML namespace. XML: N/A; the requested URI is an XML namespace.
URI: urn:ietf:params:xml:ns:yang:iana-dots-signal-channel URI: urn:ietf:params:xml:ns:yang:iana-dots-signal-channel
Registrant Contact: IANA. Registrant Contact: IANA.
XML: N/A; the requested URI is an XML namespace. XML: N/A; the requested URI is an XML namespace.
This document requests IANA to update the following YANG modules in IANA has updated the following YANG module in the "YANG Module Names"
the "YANG Module Names" subregistry [RFC6020] within the "YANG subregistry [RFC6020] within the "YANG Parameters" registry.
Parameters" registry.
Name: ietf-dots-signal-channel Name: iana-dots-signal-channel
Maintained by IANA: N Maintained by IANA: Y
Namespace: urn:ietf:params:xml:ns:yang:ietf-dots-signal-channel Namespace: urn:ietf:params:xml:ns:yang:iana-dots-signal-channel
Prefix: dots-signal Prefix: iana-dots-signal
Reference: RFCXXXX Reference: [RFC9132]
Name: iana-dots-signal-channel IANA has registered the additional following YANG module in the "YANG
Maintained by IANA: Y Module Names" subregistry [RFC6020] within the "YANG Parameters"
Namespace: urn:ietf:params:xml:ns:yang:iana-dots-signal-channel registry. This obsoletes the registration in [RFC8782].
Prefix: iana-dots-signal
Reference: RFCXXXX
This document defines the initial version of the IANA-maintained Name: ietf-dots-signal-channel
iana-dots-signal-channel YANG module. IANA is requested to maintain Maintained by IANA: N
this note: Namespace: urn:ietf:params:xml:ns:yang:ietf-dots-signal-channel
Prefix: dots-signal
Reference: [RFC9132]
Status, conflict status, conflict cause, and attack status values This document obsoletes the initial version of the IANA-maintained
must not be directly added to the iana-dots-signal-channel YANG iana-dots-signal-channel YANG module (Section 5.2 of [RFC8782]).
module. They must instead be respectively added to the "DOTS IANA is requested to maintain this note:
Status Codes", "DOTS Conflict Status Codes", "DOTS Conflict Cause
Codes", and "DOTS Attack Status Codes" registries. Status, conflict status, conflict cause, and attack status
values must not be directly added to the iana-dots-signal-
channel YANG module. They must instead be respectively added to
the "DOTS Status Codes", "DOTS Conflict Status Codes", "DOTS
Conflict Cause Codes", and "DOTS Attack Status Codes"
registries.
When a 'status', 'conflict-status', 'conflict-cause', or 'attack- When a 'status', 'conflict-status', 'conflict-cause', or 'attack-
status' value is respectively added to the "DOTS Status Codes", "DOTS status' value is respectively added to the "DOTS Status Codes", "DOTS
Conflict Status Codes", "DOTS Conflict Cause Codes", or "DOTS Attack Conflict Status Codes", "DOTS Conflict Cause Codes", or "DOTS Attack
Status Codes" registry, a new "enum" statement must be added to the Status Codes" registry, a new "enum" statement must be added to the
iana-dots-signal-channel YANG module. The following "enum" iana-dots-signal-channel YANG module. The following "enum"
statement, and substatements thereof, should be defined: statement, and substatements thereof, should be defined:
"enum": Replicates the label from the registry. "enum": Replicates the label from the registry.
"value": Contains the IANA-assigned value corresponding to the "value": Contains the IANA-assigned value corresponding to the
'status', 'conflict-status', 'conflict-cause', or 'status', 'conflict-status', 'conflict-cause', or
'attack-status'. 'attack-status'.
"description": Replicates the description from the registry. "description": Replicates the description from the registry.
"reference": Replicates the reference from the registry and adds "reference": Replicates the reference from the registry and adds
the title of the document. the title of the document.
When the iana-dots-signal-channel YANG module is updated, a new When the iana-dots-signal-channel YANG module is updated, a new
"revision" statement must be added in front of the existing revision "revision" statement must be added in front of the existing revision
statements. statements.
IANA is requested to update this note of "DOTS Status Codes", "DOTS IANA has updated this note in "DOTS Status Codes", "DOTS Conflict
Conflict Status Codes", "DOTS Conflict Cause Codes", and "DOTS Attack Status Codes", "DOTS Conflict Cause Codes", and "DOTS Attack Status
Status Codes" registries: Codes" registries:
When this registry is modified, the YANG module iana-dots-signal- When this registry is modified, the YANG module iana-dots-
channel must be updated as defined in [RFCXXXX]. signal-channel must be updated as defined in [RFC9132].
11. Security Considerations 11. Security Considerations
High-level DOTS security considerations are documented in [RFC8612] High-level DOTS security considerations are documented in [RFC8612]
and [RFC8811]. and [RFC8811].
Authenticated encryption MUST be used for data confidentiality and Authenticated encryption MUST be used for data confidentiality and
message integrity. The interaction between the DOTS agents requires message integrity. The interaction between the DOTS agents requires
Datagram Transport Layer Security (DTLS) or Transport Layer Security Datagram Transport Layer Security (DTLS) or Transport Layer Security
(TLS) with a cipher suite offering confidentiality protection, and (TLS) with a cipher suite offering confidentiality protection, and
skipping to change at page 104, line 40 skipping to change at line 4775
If the 'cuid' is guessable, a misbehaving DOTS client from within the If the 'cuid' is guessable, a misbehaving DOTS client from within the
client's domain can use the 'cuid' of another DOTS client of the client's domain can use the 'cuid' of another DOTS client of the
domain to delete or alter active mitigations. For this attack to domain to delete or alter active mitigations. For this attack to
succeed, the misbehaving client's messages need to pass the security succeed, the misbehaving client's messages need to pass the security
validation checks by the DOTS server and, if the communication validation checks by the DOTS server and, if the communication
involves a client-domain DOTS gateway, the security checks of that involves a client-domain DOTS gateway, the security checks of that
gateway. gateway.
A similar attack can be achieved by a compromised DOTS client that A similar attack can be achieved by a compromised DOTS client that
can sniff the TLS 1.2 handshake, use the client certificate to can sniff the TLS 1.2 handshake: use the client certificate to
identify the 'cuid' used by another DOTS client. This attack is not identify the 'cuid' used by another DOTS client. This attack is not
possible if algorithms such as version 4 Universally Unique possible if algorithms such as version 4 Universally Unique
IDentifiers (UUIDs) in Section 4.4 of [RFC4122] are used to generate IDentifiers (UUIDs) in Section 4.4 of [RFC4122] are used to generate
the 'cuid' because such UUIDs are not a deterministic function of the the 'cuid' because such UUIDs are not a deterministic function of the
client certificate. Likewise, this attack is not possible with TLS client certificate. Likewise, this attack is not possible with TLS
1.3 because most of the TLS handshake is encrypted and the client 1.3 because most of the TLS handshake is encrypted and the client
certificate is not visible to eavesdroppers. certificate is not visible to eavesdroppers.
A compromised DOTS client can collude with a DDoS attacker to send a A compromised DOTS client can collude with a DDoS attacker to send a
mitigation request for a target resource, get the mitigation efficacy mitigation request for a target resource, get the mitigation efficacy
from the DOTS server, and convey the mitigation efficacy to the DDoS from the DOTS server, and convey the mitigation efficacy to the DDoS
attacker to possibly change the DDoS attack strategy. Obviously, attacker to possibly change the DDoS attack strategy. Obviously,
signaling an attack by the compromised DOTS client to the DOTS server signaling an attack by the compromised DOTS client to the DOTS server
will trigger attack mitigation. This attack can be prevented by will trigger attack mitigation. This attack can be prevented by
monitoring and auditing DOTS clients to detect misbehavior and to monitoring and auditing DOTS clients to detect misbehavior and to
deter misuse, and by only authorizing the DOTS client to request deter misuse and by only authorizing the DOTS client to request
mitigation for specific target resources (e.g., an application server mitigation for specific target resources (e.g., an application server
is authorized to request mitigation for its IP addresses, but a DDoS is authorized to request mitigation for its IP addresses, but a DDoS
mitigator can request mitigation for any target resource in the mitigator can request mitigation for any target resource in the
network). Furthermore, DOTS clients are typically co-located on network). Furthermore, DOTS clients are typically co-located on
network security services (e.g., firewall), and a compromised network security services (e.g., firewall), and a compromised
security service potentially can do a lot more damage to the network. security service potentially can do a lot more damage to the network.
Rate-limiting DOTS requests, including those with new 'cuid' values, Rate-limiting DOTS requests, including those with new 'cuid' values,
from the same DOTS client defend against DoS attacks that would from the same DOTS client defend against DoS attacks that would
result in varying the 'cuid' to exhaust DOTS server resources. Rate- result in varying the 'cuid' to exhaust DOTS server resources. Rate-
skipping to change at page 109, line 29 skipping to change at line 5004
[RFC8768] Boucadair, M., Reddy.K, T., and J. Shallow, "Constrained [RFC8768] Boucadair, M., Reddy.K, T., and J. Shallow, "Constrained
Application Protocol (CoAP) Hop-Limit Option", RFC 8768, Application Protocol (CoAP) Hop-Limit Option", RFC 8768,
DOI 10.17487/RFC8768, March 2020, DOI 10.17487/RFC8768, March 2020,
<https://www.rfc-editor.org/info/rfc8768>. <https://www.rfc-editor.org/info/rfc8768>.
[RFC8783] Boucadair, M., Ed. and T. Reddy.K, Ed., "Distributed [RFC8783] Boucadair, M., Ed. and T. Reddy.K, Ed., "Distributed
Denial-of-Service Open Threat Signaling (DOTS) Data Denial-of-Service Open Threat Signaling (DOTS) Data
Channel Specification", RFC 8783, DOI 10.17487/RFC8783, Channel Specification", RFC 8783, DOI 10.17487/RFC8783,
May 2020, <https://www.rfc-editor.org/info/rfc8783>. May 2020, <https://www.rfc-editor.org/info/rfc8783>.
[RFC8791] Bierman, A., Bjoerklund, M., and K. Watsen, "YANG Data [RFC8791] Bierman, A., Björklund, M., and K. Watsen, "YANG Data
Structure Extensions", RFC 8791, DOI 10.17487/RFC8791, Structure Extensions", RFC 8791, DOI 10.17487/RFC8791,
June 2020, <https://www.rfc-editor.org/info/rfc8791>. June 2020, <https://www.rfc-editor.org/info/rfc8791>.
[RFC8949] Bormann, C. and P. Hoffman, "Concise Binary Object [RFC8949] Bormann, C. and P. Hoffman, "Concise Binary Object
Representation (CBOR)", STD 94, RFC 8949, Representation (CBOR)", STD 94, RFC 8949,
DOI 10.17487/RFC8949, December 2020, DOI 10.17487/RFC8949, December 2020,
<https://www.rfc-editor.org/info/rfc8949>. <https://www.rfc-editor.org/info/rfc8949>.
12.2. Informative References 12.2. Informative References
[I-D.boucadair-dots-earlydata] [CORE-COMI]
Boucadair, M. and T. Reddy, "Using Early Data in DOTS",
draft-boucadair-dots-earlydata-00 (work in progress),
January 2019.
[I-D.ietf-core-comi]
Veillette, M., Stok, P. V. D., Pelov, A., Bierman, A., and Veillette, M., Stok, P. V. D., Pelov, A., Bierman, A., and
I. Petrov, "CoAP Management Interface (CORECONF)", draft- I. Petrov, "CoAP Management Interface (CORECONF)", Work in
ietf-core-comi-11 (work in progress), January 2021. Progress, Internet-Draft, draft-ietf-core-comi-11, 17
January 2021, <https://datatracker.ietf.org/doc/html/
draft-ietf-core-comi-11>.
[I-D.ietf-core-yang-cbor] [CORE-YANG-CBOR]
Veillette, M., Petrov, I., and A. Pelov, "CBOR Encoding of Veillette, M., Petrov, I., Pelov, A., and C. Bormann,
Data Modeled with YANG", draft-ietf-core-yang-cbor-15 "CBOR Encoding of Data Modeled with YANG", Work in
(work in progress), January 2021. Progress, Internet-Draft, draft-ietf-core-yang-cbor-16, 24
June 2021, <https://datatracker.ietf.org/doc/html/draft-
ietf-core-yang-cbor-16>.
[I-D.ietf-dots-multihoming] [DOTS-EARLYDATA]
Boucadair, M. and T. Reddy, "Using Early Data in DOTS",
Work in Progress, Internet-Draft, draft-boucadair-dots-
earlydata-00, 29 January 2019,
<https://datatracker.ietf.org/doc/html/draft-boucadair-
dots-earlydata-00>.
[DOTS-MULTIHOMING]
Boucadair, M., Reddy, T., and W. Pan, "Multi-homing Boucadair, M., Reddy, T., and W. Pan, "Multi-homing
Deployment Considerations for Distributed-Denial-of- Deployment Considerations for Distributed-Denial-of-
Service Open Threat Signaling (DOTS)", draft-ietf-dots- Service Open Threat Signaling (DOTS)", Work in Progress,
multihoming-05 (work in progress), November 2020. Internet-Draft, draft-ietf-dots-multihoming-07, 6 July
2021, <https://datatracker.ietf.org/doc/html/draft-ietf-
dots-multihoming-07>.
[I-D.ietf-dots-telemetry] [DOTS-TELEMETRY]
Boucadair, M., Reddy, T., Doron, E., Chen, M., and J. Boucadair, M., Reddy, T., Doron, E., Chen, M., and J.
Shallow, "Distributed Denial-of-Service Open Threat Shallow, "Distributed Denial-of-Service Open Threat
Signaling (DOTS) Telemetry", draft-ietf-dots-telemetry-15 Signaling (DOTS) Telemetry", Work in Progress, Internet-
(work in progress), December 2020. Draft, draft-ietf-dots-telemetry-16, 25 May 2021,
<https://datatracker.ietf.org/doc/html/draft-ietf-dots-
[I-D.ietf-tls-dtls13] telemetry-16>.
Rescorla, E., Tschofenig, H., and N. Modadugu, "The
Datagram Transport Layer Security (DTLS) Protocol Version
1.3", draft-ietf-tls-dtls13-43 (work in progress), April
2021.
[IANA-CBOR-Tags] [IANA-CBOR-Tags]
IANA, "Concise Binary Object Representation (CBOR) Tags", IANA, "Concise Binary Object Representation (CBOR) Tags",
<https://www.iana.org/assignments/cbor-tags/cbor- <https://www.iana.org/assignments/cbor-tags>.
tags.xhtml>.
[IANA-CoAP-Content-Formats] [IANA-CoAP-Content-Formats]
IANA, "CoAP Content-Formats", IANA, "CoAP Content-Formats",
<https://www.iana.org/assignments/core-parameters/core- <https://www.iana.org/assignments/core-parameters>.
parameters.xhtml#content-formats>.
[IANA-MediaTypes] [IANA-MediaTypes]
IANA, "Media Types", IANA, "Media Types",
<https://www.iana.org/assignments/media-types>. <https://www.iana.org/assignments/media-types>.
[IANA-Proto] [IANA-Proto]
IANA, "Protocol Numbers", 2011, IANA, "Protocol Numbers",
<https://www.iana.org/assignments/protocol-numbers>. <https://www.iana.org/assignments/protocol-numbers>.
[REG-DOTS] [REG-DOTS] IANA, "Distributed Denial-of-Service Open Threat Signaling
IANA, "Distributed Denial-of-Service Open Threat Signaling
(DOTS) Signal Channel", (DOTS) Signal Channel",
<https://www.iana.org/assignments/dots/dots.xhtml>. <https://www.iana.org/assignments/dots>.
[RFC3022] Srisuresh, P. and K. Egevang, "Traditional IP Network [RFC3022] Srisuresh, P. and K. Egevang, "Traditional IP Network
Address Translator (Traditional NAT)", RFC 3022, Address Translator (Traditional NAT)", RFC 3022,
DOI 10.17487/RFC3022, January 2001, DOI 10.17487/RFC3022, January 2001,
<https://www.rfc-editor.org/info/rfc3022>. <https://www.rfc-editor.org/info/rfc3022>.
[RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S. [RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S.
Rose, "Resource Records for the DNS Security Extensions", Rose, "Resource Records for the DNS Security Extensions",
RFC 4034, DOI 10.17487/RFC4034, March 2005, RFC 4034, DOI 10.17487/RFC4034, March 2005,
<https://www.rfc-editor.org/info/rfc4034>. <https://www.rfc-editor.org/info/rfc4034>.
skipping to change at page 114, line 14 skipping to change at line 5224
[RFC8903] Dobbins, R., Migault, D., Moskowitz, R., Teague, N., Xia, [RFC8903] Dobbins, R., Migault, D., Moskowitz, R., Teague, N., Xia,
L., and K. Nishizuka, "Use Cases for DDoS Open Threat L., and K. Nishizuka, "Use Cases for DDoS Open Threat
Signaling", RFC 8903, DOI 10.17487/RFC8903, May 2021, Signaling", RFC 8903, DOI 10.17487/RFC8903, May 2021,
<https://www.rfc-editor.org/info/rfc8903>. <https://www.rfc-editor.org/info/rfc8903>.
[RFC8973] Boucadair, M. and T. Reddy.K, "DDoS Open Threat Signaling [RFC8973] Boucadair, M. and T. Reddy.K, "DDoS Open Threat Signaling
(DOTS) Agent Discovery", RFC 8973, DOI 10.17487/RFC8973, (DOTS) Agent Discovery", RFC 8973, DOI 10.17487/RFC8973,
January 2021, <https://www.rfc-editor.org/info/rfc8973>. January 2021, <https://www.rfc-editor.org/info/rfc8973>.
[TLS-DTLS13]
Rescorla, E., Tschofenig, H., and N. Modadugu, "The
Datagram Transport Layer Security (DTLS) Protocol Version
1.3", Work in Progress, Internet-Draft, draft-ietf-tls-
dtls13-43, 30 April 2021,
<https://datatracker.ietf.org/doc/html/draft-ietf-tls-
dtls13-43>.
[URI] IANA, "Well-Known URIs", [URI] IANA, "Well-Known URIs",
<https://www.iana.org/assignments/well-known-uris/well- <https://www.iana.org/assignments/well-known-uris>.
known-uris.xhtml>.
Appendix A. Summary of Changes From RFC8782 Appendix A. Summary of Changes From RFC 8782
The main changes compared to [RFC8782] are as follows: The main changes compared to [RFC8782] are as follows:
o Update the "ietf-dots-signal-channel" YANG module (Section 5.3) * Update the "ietf-dots-signal-channel" YANG module (Section 5.3)
and the tree structure (Section 5.1) to follow the new YANG data and the tree structure (Section 5.1) to follow the new YANG data
structure specified in [RFC8791]. In particular: structure specified in [RFC8791]. In particular:
* Add in 'choice' to indicate the communication direction in - Add in 'choice' to indicate the communication direction in
which a data node applies. If no 'choice' is indicated, a data which a data node applies. If no 'choice' is indicated, a data
node can appear in both directions (i.e., from DOTS clients to node can appear in both directions (i.e., from DOTS clients to
DOTS servers and vice versa). DOTS servers and vice versa).
* Remove 'config' clauses. Note that 'config' statements will be - Remove 'config' clauses. Note that 'config' statements will be
ignored (if present) anyway according to Section 4 of ignored (if present) anyway, according to Section 4 of
[RFC8791]. This supersedes the references to the use of 'ro' [RFC8791]. This supersedes the references to the use of 'ro'
and 'rw' which are now covered by 'choice' above. and 'rw', which are now covered by 'choice' above.
* Remove 'cuid', 'cdid', and 'sid' data nodes from the structure - Remove 'cuid', 'cdid', and 'sid' data nodes from the structure
because these data nodes are included as Uri-Path options, not because these data nodes are included as Uri-Path options, not
within the message body. within the message body.
* Remove the list keys for the mitigation scope message type - Remove the list keys for the mitigation scope message type
(i.e., 'cuid' and 'mid'). 'mid' is not indicated as a key (i.e., 'cuid' and 'mid'). 'mid' is not indicated as a key
because it is included as Uri-Path option for requests and in because it is included as a Uri-Path option for requests and in
the message body for responses. Note that Section 4 of the message body for responses. Note that Section 4 of
[RFC8791] specifies that a list does not require to have a key [RFC8791] specifies that a list does not require to have a key
statement defined. statement defined.
o Add a new section with a summary of the error code responses that * Add a new section with a summary of the error code responses that
can be returned by a DOTS server (Section 9). can be returned by a DOTS server (Section 9).
o Update the IANA section to allocate a new range for comprehension- * Update the IANA section to allocate a new range for comprehension-
optional attributes (Section 10.6.1.1). This modification is optional attributes (Section 10.6.1.1). This modification is
motivated by the need to allow for compact DOTS signal messages motivated by the need to allow for compact DOTS signal messages
that include a long list of comprehension-optional attributes, that include a long list of comprehension-optional attributes,
e.g., DOTS telemetry messages [I-D.ietf-dots-telemetry]. e.g., DOTS telemetry messages [DOTS-TELEMETRY].
o Add Appendix C to list recommended/default values of key DOTS * Add Appendix C to list recommended/default values of key DOTS
signal channel parameters. signal channel parameters.
o Add subsections to Section 4.4.1 for better readability. * Add subsections to Section 4.4.1 for better readability.
Appendix B. CUID Generation Appendix B. CUID Generation
The document recommends the use of SPKI to generate the 'cuid'. This The document recommends the use of SPKI to generate the 'cuid'. This
design choice is motivated by the following reasons: design choice is motivated by the following reasons:
o SPKI is globally unique. * SPKI is globally unique.
o It is deterministic. * It is deterministic.
o It allows the avoidance of extra cycles that may be induced by * It allows the avoidance of extra cycles that may be induced by
'cuid' collision. 'cuid' collision.
o DOTS clients do not need to store the 'cuid' in a persistent * DOTS clients do not need to store the 'cuid' in a persistent
storage. storage.
o It allows the detection of compromised DOTS clients that do not * It allows the detection of compromised DOTS clients that do not
adhere to the 'cuid' generation algorithm. adhere to the 'cuid' generation algorithm.
Appendix C. Summary of Protocol Recommended/Default Values Appendix C. Summary of Protocol Recommended/Default Values
+--------------------------------+---------------------------+ +================================+===========================+
| Parameter | Recommended/Default Value | | Parameter | Recommended/Default Value |
+--------------------------------+---------------------------+ +================================+===========================+
| Port number | 4646 (tcp/udp) | | Port number | 4646 (tcp/udp) |
+--------------------------------+---------------------------+
| lifetime | 3600 seconds | | lifetime | 3600 seconds |
+--------------------------------+---------------------------+
| active-but-terminating | 120 seconds | | active-but-terminating | 120 seconds |
+--------------------------------+---------------------------+
| maximum active-but-terminating | 300 seconds | | maximum active-but-terminating | 300 seconds |
+--------------------------------+---------------------------+
| heartbeat-interval | 30 seconds | | heartbeat-interval | 30 seconds |
+--------------------------------+---------------------------+
| minimum 'heartbeat-interval' | 15 seconds | | minimum 'heartbeat-interval' | 15 seconds |
+--------------------------------+---------------------------+
| maximum 'heartbeat-interval' | 240 seconds | | maximum 'heartbeat-interval' | 240 seconds |
+--------------------------------+---------------------------+
| missing-hb-allowed | 15 | | missing-hb-allowed | 15 |
+--------------------------------+---------------------------+
| max-retransmit | 3 | | max-retransmit | 3 |
+--------------------------------+---------------------------+
| ack-timeout | 2 seconds | | ack-timeout | 2 seconds |
+--------------------------------+---------------------------+
| ack-random-factor | 1.5 | | ack-random-factor | 1.5 |
+--------------------------------+---------------------------+
| probing-rate | 5 bytes/second | | probing-rate | 5 bytes/second |
+--------------------------------+---------------------------+
| trigger-mitigation | true | | trigger-mitigation | true |
+--------------------------------+---------------------------+ +--------------------------------+---------------------------+
Appendix D. Acknowledgements Table 13
Many thanks to Martin Bjoerklund for the suggestion to use RFC8791. Acknowledgements
Many thanks to Martin Björklund for the suggestion to use [RFC8791].
Thanks to Valery Smyslov for the comments, guidance, and support. Thanks to Valery Smyslov for the comments, guidance, and support.
Thanks to Ebben Aries for the yangdoctors review, Dan Romascanu for Thanks to Ebben Aries for the yangdoctors review, Dan Romascanu for
the opsdir review, Michael Tuexen for the tsv-art review, Dale Worley the opsdir review, Michael Tuexen for the tsv-art review, Dale Worley
for the genart review, and Donald Eastlake for the secdir review. for the genart review, and Donald Eastlake 3rd for the secdir review.
Thanks to Benjamin Kaduk for the AD review. Thanks to Benjamin Kaduk for the AD review.
Thanks to Martin Duke, Lars Eggert, Erik Kline, Murray Kucherawy, Thanks to Martin Duke, Lars Eggert, Erik Kline, Murray Kucherawy,
Eric Vyncke, and Robert Wilton for the IESG review. Éric Vyncke, and Robert Wilton for the IESG review.
D.1. Acknowledgements from RFC8782 Acknowledgements from RFC 8782
Thanks to Christian Jacquenet, Roland Dobbins, Roman Danyliw, Michael Thanks to Christian Jacquenet, Roland Dobbins, Roman Danyliw, Michael
Richardson, Ehud Doron, Kaname Nishizuka, Dave Dolson, Liang Xia, Richardson, Ehud Doron, Kaname Nishizuka, Dave Dolson, Liang Xia,
Gilbert Clark, Xialiang Frank, Jim Schaad, Klaus Hartke, Nesredien Gilbert Clark, Xialiang Frank, Jim Schaad, Klaus Hartke, Nesredien
Suleiman, Stephen Farrell, and Yoshifumi Nishida for the discussion Suleiman, Stephen Farrell, and Yoshifumi Nishida for the discussion
and comments. and comments.
The authors would like to give special thanks to Kaname Nishizuka and The authors would like to give special thanks to Kaname Nishizuka and
Jon Shallow for their efforts in implementing the protocol and Jon Shallow for their efforts in implementing the protocol and
performing interop testing at IETF Hackathons. performing interop testing at IETF Hackathons.
skipping to change at page 116, line 43 skipping to change at line 5368
redirect signaling. redirect signaling.
Special thanks to Benjamin Kaduk for the detailed AD review. Special thanks to Benjamin Kaduk for the detailed AD review.
Thanks to Alexey Melnikov, Adam Roach, Suresh Krishnan, Mirja Thanks to Alexey Melnikov, Adam Roach, Suresh Krishnan, Mirja
Kuehlewind, and Alissa Cooper for the review. Kuehlewind, and Alissa Cooper for the review.
Thanks to Carsten Bormann for his review of the DOTS heartbeat Thanks to Carsten Bormann for his review of the DOTS heartbeat
mechanism. mechanism.
Appendix E. Contributors Contributors
E.1. Authors of RFC8782
The authors of RFC8782 are listed below:
Tirumaleswar Reddy.K (editor) The authors of RFC 8782 are listed below:
McAfee, Inc.
Embassy Golf Link Business Park
Bangalore 560071
Karnataka
India
Email: kondtir@gmail.com Tirumaleswar Reddy.K (editor)
McAfee, Inc.
Embassy Golf Link Business Park
Bangalore 560071
Karnataka
India
Mohamed Boucadair (editor) Email: kondtir@gmail.com
Orange
35000 Rennes
France
Email: mohamed.boucadair@orange.com Mohamed Boucadair (editor)
Orange
35000 Rennes
France
Prashanth Patil Email: mohamed.boucadair@orange.com
Cisco Systems, Inc.
Email: praspati@cisco.com Prashanth Patil
Cisco Systems, Inc.
Andrew Mortensen Email: praspati@cisco.com
Arbor Networks, Inc.
2727 S. State Street
Ann Arbor, MI 48104
United States of America
Email: andrew@moretension.com Andrew Mortensen
Arbor Networks, Inc.
2727 S. State Street
Ann Arbor, MI 48104
United States of America
Nik Teague Email: andrew@moretension.com
Iron Mountain Data Centers
United Kingdom
Email: nteague@ironmountain.co.uk Nik Teague
Iron Mountain Data Centers
United Kingdom
E.2. Contributors to RFC8782 Email: nteague@ironmountain.co.uk
The following individuals have contributed to RFC8782: The following individuals have contributed to RFC 8782:
Jon Shallow Jon Shallow
NCC Group NCC Group
Email: jon.shallow@nccgroup.trust Email: jon.shallow@nccgroup.trust
Mike Geller Mike Geller
Cisco Systems, Inc. Cisco Systems, Inc.
FL 33309 FL 33309
United States of America United States of America
Email: mgeller@cisco.com Email: mgeller@cisco.com
Robert Moskowitz Robert Moskowitz
HTT Consulting HTT Consulting
Oak Park, MI 42837 Oak Park, MI 42837
United States of America United States of America
Email: rgm@htt-consult.com Email: rgm@htt-consult.com
Authors' Addresses Authors' Addresses
Mohamed Boucadair (editor) Mohamed Boucadair (editor)
Orange Orange
Rennes 35000 35000 Rennes
France France
Email: mohamed.boucadair@orange.com Email: mohamed.boucadair@orange.com
Jon Shallow Jon Shallow
United Kingdom United Kingdom
Email: supjps-ietf@jpshallow.com Email: supjps-ietf@jpshallow.com
Tirumaleswar Reddy.K Tirumaleswar Reddy.K
McAfee, Inc. Akamai
Embassy Golf Link Business Park Embassy Golf Link Business Park
Bangalore, Karnataka 560071 Bangalore 560071
Karnataka
India India
Email: kondtir@gmail.com Email: kondtir@gmail.com
 End of changes. 411 change blocks. 
1497 lines changed or deleted 1548 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/