Distributed Denial-of-Service Open Threat Signaling (DOTS) Signal Channel Call Home
Extracted elements (26)
A dedicated port number is used to disambiguate the base DOTS signal channel from the DOTS Call Home channel, rather than using role-signaling via the DOTS data channel. The data channel may not function during an attack, role-signaling adds protocol complexity, and the port-based approach requires only two (D)TLS sessions which is simpler and more efficient.
The Call Home approach uses role reversal at the (D)TLS layer rather than extending the base DOTS signal channel with a new attribute because initiating a signal channel from an upstream network into a source network is complicated by NATs and firewalls. Additionally, sharing one channel for both inbound and outbound attacks would complicate heartbeat and redirection mechanisms, and would expose the DOTS server to fingerprinting and DoS attacks.
The Call Home DOTS server adjusts the 'heartbeat-interval' to accommodate binding timers of on-path NATs and firewalls, ensuring the same external IP address and port are retained for the DOTS signal channel session. This adaptation is needed because the server initiates the (D)TLS connection from behind the NAT.
The base DOTS signal channel (RFC 9132) and the DOTS signal channel Call Home can coexist on the same device; the same node may embed both a DOTS server and a Call Home DOTS client (at the network provider side) or both a DOTS client and a Call Home DOTS server (at the source network side). The DMS provider must be on the default forwarding path of outbound traffic for Call Home to function.
A Call Home DOTS server MUST NOT support the redirected signaling mechanism from RFC 9132 Section 4.6 (the 5.03 response conveying an alternate DOTS server FQDN or IP addresses). A Call Home DOTS client MUST silently discard such a message because only a Call Home DOTS server can initiate a new (D)TLS connection.
Call Home DOTS clients that are aware of on-path CGNs MUST NOT include the external IP address and/or port number identifying the suspect attack source, but MUST include the internal IP address and/or port number to enable the Call Home DOTS server to identify the compromised device.
DOTS agents MUST authenticate each other using (D)TLS before a DOTS signal channel session is considered valid. Security considerations from RFC 9132 Section 11 and those related to (D)TLS early data from RFC 9132 Section 7 MUST also be considered.
If a MAP Border Relay or lwAFTR is enabled in the provider's domain, identification of an attack source bound to an IPv4 address/prefix MUST also rely on source port numbers because the same IPv4 address is shared across multiple customers.
If the Call Home DOTS server does not receive any traffic from the peer Call Home DOTS client long enough to exhaust the maximum 'missing-hb-allowed' threshold, it concludes the session is disconnected and MUST try to establish a new DOTS signal channel session, preferably by resuming the (D)TLS session.
If the Call Home DOTS server receives traffic from the Call Home DOTS client, it MUST continue to use the DOTS signal channel even if the threshold of allowed missing heartbeats ('missing-hb-allowed') is reached.
Only immediate mitigation requests ('trigger-mitigation' set to 'true') are allowed in the Call Home scenario. Call Home DOTS clients MUST NOT send requests with 'trigger-mitigation' set to 'false'. Such requests MUST be discarded by the Call Home DOTS server with a 4.00 (Bad Request).
The Call Home DOTS server MUST check that the 'source-prefix' in a mitigation request is within the scope of the Call Home DOTS server domain. By default, the Call Home DOTS server considers any routable IP prefix in 'target-prefix' to be within the scope of the Call Home DOTS client.
The 'source-prefix' parameter is mandatory when a Call Home DOTS client signals attack traffic information. The 'target-prefix' attribute MUST be included in the mitigation request. The Call Home DOTS client MUST validate that attacker prefixes are within the scope of the Call Home DOTS server domain. The prefix list MUST NOT include broadcast, loopback, or multicast addresses.
When an outgoing attack that saturates the outgoing link from the Call Home DOTS server is detected and reported by a Call Home DOTS client, the Call Home DOTS client MUST continue to use the DOTS signal channel even if no traffic is received from the Call Home DOTS server.
DDoS detection systems used to trigger Call Home mitigation requests (e.g., flow exports) may be misused to track users and infer their activities. Such misuse is not required for the defined functionality, but is an implementation concern outside the scope of this specification.
The DOTS Call Home protocol does not leak new information that can be used to ease surveillance. Attack identification information is encrypted and shared only with an authorized entity in the domain to which the IP address/prefix is assigned. The Call Home DOTS server is not required to share internal network identifiers with the Call Home DOTS client.
If a Call Home DOTS client wants to redirect a Call Home DOTS server to another Call Home DOTS client, it sends a Non-confirmable PUT request to the predefined resource '.well-known/dots/redirect' with three attributes: 'alt-ch-client' (mandatory FQDN of alternate client), 'alt-ch-client-record' (optional list of IP addresses), and 'ttl' (optional time-to-live in seconds). These attributes MUST NOT be used for base DOTS signal channel operations.
In DOTS Call Home, the Call Home DOTS server acts as the (D)TLS client and initiates the (D)TLS connection to the Call Home DOTS client, which acts as the (D)TLS server. All DOTS application-layer roles (client/server) remain unchanged; only the (D)TLS transport roles are reversed. The Call Home DOTS client then issues mitigation requests over this established connection.
This document extends the DOTS mitigation request (RFC 9132 Section 4.4.1) with three new optional parameters: 'source-prefix' (list of attacker IP prefixes in CIDR notation), 'source-port-range' (list of port ranges defined by lower-port and upper-port), and 'source-icmp-type-range' (list of ICMP/ICMPv6 type ranges defined by lower-type and upper-type). These convey attack source information to the Call Home DOTS server.
This document registers conflict cause code 4 ('request-rejected-legitimate-traffic') in the IANA 'DOTS Signal Channel Conflict Cause Codes' registry. This code is returned by the DOTS server to indicate that attack traffic has been classified as legitimate traffic.
This document registers eight new comprehension-optional parameters in the IANA 'DOTS Signal Channel CBOR Key Values' registry with CBOR key values 32768–32775, covering source-prefix, source-port-range, source-icmp-type-range, lower-type, upper-type, alt-ch-client, alt-ch-client-record, and ttl. Change controller is IESG.
This document registers the YANG module 'ietf-dots-call-home' (namespace urn:ietf:params:xml:ns:yang:ietf-dots-call-home, prefix dots-call-home) in the IANA 'YANG Module Names' subregistry and registers the corresponding URI in the IETF XML Registry.
A misbehaving Call Home DOTS client may arbitrarily signal legitimate traffic as attack traffic or falsify mitigation signals to disconnect sources or rate-limit traffic. Call Home DOTS servers should not blindly trust mitigation requests; they should validate source prefixes, inspect relevant traffic for attack signatures, or seek administrator consent before acting.
An attacker may launch a DoS attack against the Call Home DOTS client by causing it to perform computationally expensive (D)TLS operations before the attacker is detected as unauthorized. Common precautions such as temporarily adding a source address to a drop-list after a set number of unsuccessful authentication attempts are recommended.
Call Home DOTS agents may interact with on-path address sharing functions (NAT, CGN) to retrieve internal/external IP address mappings identifying an attack source. Blocking access to or manipulating mapping information will complicate DDoS mitigation close to the attack source.
New CBOR parameters for the DOTS Call Home extension use CBOR key values 32768–32775: source-prefix (32768, major type 4 array of text strings), source-port-range (32769, array), source-icmp-type-range (32770, array), lower-type (32771, unsigned), upper-type (32772, unsigned), alt-ch-client (32773, text string), alt-ch-client-record (32774, array of text strings), ttl (32775, unsigned).