Status of This Memo

This is an Internet Standards Track document.¶

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.¶

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc8973.¶

Copyright Notice

Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶

Table of Contents

3. Why Multiple Discovery Mechanisms?

Analysis of the various use cases sketched in [DOTS-USE-CASES] reveals that it is unlikely that one single discovery method can be suitable for all the sample deployments. Concretely:¶

• Many of the use cases discussed in [DOTS-USE-CASES] do involve Customer Premises Equipment (CPE). Multiple CPEs connected to distinct network providers may even be considered. It is intuitive to leverage existing mechanisms, such as discovery using service resolution or DHCP, to provision the CPE acting as a DOTS client with the DOTS server(s).¶
• Resolving a DOTS server domain name offered by an upstream transit provider provisioned to a DOTS client into IP address(es) requires the use of the appropriate DNS resolvers; otherwise, resolving those names will fail. The use of protocols, such as DHCP, does allow associating provisioned DOTS server domain names with a list of DNS servers to be used for name resolution. Furthermore, DHCP allows for directly providing IP addresses, therefore, avoiding the need for extra lookup delays.¶
• Some of the use cases may allow DOTS clients to have direct communications with upstream DOTS servers, that is, no DOTS gateway is involved. Leveraging existing protocol behaviors that do not require specific features on the node embedding the DOTS client may ease DOTS deployment. Typically, the use of Straightforward-Naming Authority Pointer (S-NAPTR) lookups [RFC3958] allows the DOTS server administrators to provision the preferred DOTS transport protocol between the DOTS client and the DOTS server and allows the DOTS client to discover this preference.¶
• The upstream network provider is not the DDoS mitigation provider for some of these use cases. It is safe to assume that, for such deployments, the DOTS server(s) domain name is provided during the service subscription (i.e., manual/local configuration).¶
• Multiple DOTS clients may be enabled within a network (e.g., an enterprise network). Dynamic discovery needs to be deterministic from an operational standpoint.¶
• Some of the use cases may involve a DOTS gateway that is responsible for selecting the appropriate DOTS server(s) to relay requests received from DOTS clients.¶

Consequently, this document describes a unified discovery logic (Section 4) that involves the following mechanisms:¶

• dynamic discovery using DHCP (Section 5)¶
• a resolution mechanism based on S-NAPTR resource records in the DNS (Section 6)¶
• DNS Service Discovery (Section 7)¶

4. DOTS Discovery Procedure

Operators will need a consistent set of ways in which DOTS clients can discover this information and a consistent priority among these options. If some devices prefer manual configuration over dynamic discovery while others prefer dynamic discovery over manual configuration, the result will be a process where the operator must find devices that are using the wrong DOTS server(s), determine how to ensure the devices are configured properly, and then reconfigure the device through the preferred method.¶

All DOTS clients MUST support at least one of the three mechanisms below to determine a DOTS server list. All DOTS clients SHOULD implement all three, or as many as are practical for any specific device, of the following ways to discover DOTS servers in order to facilitate the deployment of DOTS in large-scale environments. For example, a CPE will support the first two mechanisms, a host within a LAN will support the last two mechanisms, or an application server will support a local configuration. More examples are discussed in Section 3. DOTS clients will prefer information received from the discovery methods in the order listed below.¶

1. Explicit Configuration:¶

   Local/Manual Configuration:

   A DOTS client will learn the DOTS server(s) by means of local or manual DOTS configuration (i.e., DOTS servers configured at the system level). Configuration discovered from a DOTS client application is considered a local configuration.¶

   An implementation may give the user an opportunity (e.g., by means of configuration file options or menu items) to specify DOTS server(s) for each address family. These may be specified either as a list of IP addresses or the DNS name of a DOTS server. When only DOTS server IP addresses are configured, a reference identifier must also be configured for authentication purposes.¶

   Automatic Configuration (e.g., DHCP):

   The DOTS client attempts to discover DOTS server(s) names and/or addresses from DHCP, as described in Section 5.¶

2. Service Resolution: The DOTS client attempts to discover DOTS server name(s) using service resolution, as specified in Section 6.¶
3. DNS-SD: DNS-based Service Discovery. The DOTS client attempts to discover DOTS server name(s) using DNS service discovery, as specified in Section 7.¶

Some of these mechanisms imply the use of DNS to resolve the IP address(es) of the DOTS server, while others imply an IP address of the relevant DOTS server is obtained directly. Implementation options may vary on a per-device basis, as some devices may not have DNS capabilities and/or suitable DNS configuration.¶

On hosts with more than one interface or address family (IPv4/IPv6), the DOTS server discovery procedure has to be performed for each interface-/address-family combination. A DOTS client may choose to perform the discovery procedure only for a desired interface/address combination if the client does not wish to discover a DOTS server for all interface-/address-family combinations.¶

This procedure is also followed by a Call Home DOTS server to discover its Call Home DOTS client in the context of [DOTS-SIG-CALL-HOME].¶

The discovery method is performed upon the bootstrapping of a DOTS agent and is reiterated by the DOTS agent upon the following events:¶

• expiry of a validity timer (e.g., DHCP lease, DHCP information refresh time, or DNS TTL) associated with a discovered DOTS agent¶
• expiry of the certificate of a peer DOTS agent currently in use¶
• attachment to a new network¶

5. DHCP Options for DOTS Agent Discovery

As reported in Section 1.7.2 of [RFC6125]:¶

Some certification authorities issue server certificates based on IP addresses, but preliminary evidence indicates that such certificates are a very small percentage (less than 1%) of issued certificates.¶

In order to allow for PKIX-based authentication between a DOTS client and server while accommodating the current best practices for issuing certificates, this document allows DOTS agents to retrieve the names of their peer DOTS agents. These names can be used for two purposes: (1) to retrieve the list of IP addresses of a peer DOTS agent or (2) to be presented as a reference identifier for authentication purposes.¶

Defining the option to include a list of IP addresses would avoid depending on an underlying name resolution, but that design requires also supplying a name for PKIX-based authentication purposes.¶

Given that DOTS gateways can be involved in a DOTS session, a peer DOTS agent can be reachable using a link-local address. Such addresses can also be discovered using the options defined in Section 5.1.¶

The list of the IP addresses returned by DHCP servers is typically used to feed the DOTS server selection procedure, including when DOTS agents are provided with primary and backup IP addresses of their peer DOTS agents. An example of the DOTS server selection procedure is specified in Section 4.3 of [RFC8782].¶

The design assumes that the same peer DOTS agent is used for establishing both signal and data channels. For more customized configurations (e.g., transport-specific configuration and distinct DOTS servers for the signal and data channels), an operator can supply only a DOTS reference identifier that will be then passed to the procedure described in Section 6.¶

The design allows terminating the base DOTS channels and DOTS Call Home on the same or distinct peer DOTS agents. If distinct peer DOTS agents are deployed, the DHCP option can return, for example, a list of IP addresses to a requesting DOTS agent. This list includes the IP address to be used for the base DOTS channels and the IP address for the DOTS Call Home. The DOTS client (or Call Home DOTS server) will then use the address selection procedure specified in Section 4.3 of [RFC8782] to identify the IP address of the peer DOTS server (or Call Home DOTS client).¶

For example, let's consider that the DOTS server is reachable at 2001:db8:122:300::1, while the Call Home DOTS client is reachable at 2001:db8:122:300::2. The DHCP server will then return one DOTS reference identifier and a list that includes both 2001:db8:122:300::1 and 2001:db8:122:300::2 to a requesting DHCP client. That list is passed to the DOTS client (or Call Home DOTS server), which will try to establish connections to the addresses of that list and destination port number 4646 (or the Call Home port number). As a result, the DOTS client (or Call Home DOTS server) will select 2001:db8:122:300::1 (or 2001:db8:122:300::2) as a DOTS server (or Call Home DOTS client).¶

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     OPTION_V6_DOTS_RI         |         Option-length         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
|                      dots-agent-name (FQDN)                   |
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

+------+------+------+------+------+------+------+------+------+
| 0x04 |   d  |   o  |   t  |  s   | 0x07 |   e  |   x  |   a  |
+------+------+------+------+------+------+------+------+------+
|   m  |   p  |   l  |   e  | 0x03 |   c  |   o  |   m  | 0x00 |
+------+------+------+------+------+------+------+------+------+

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  OPTION_V6_DOTS_ADDRESS       |         Option-length         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
|                    DOTS ipv6-address                          |
|                                                               |
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
|                    DOTS ipv6-address                          |
|                                                               |
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                              ...                              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 Code  Length   Peer DOTS agent name
+-----+-----+-----+-----+-----+-----+-----+--
| 147 |  n  |  s1 |  s2 |  s3 |  s4 | s5  |  ...
+-----+-----+-----+-----+-----+-----+-----+--

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Code=148     |     Length    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                               |
|       DOTS IPv4 Address       |
|                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  ---
|                               |   |
|       DOTS IPv4 Address       |   |
|                               | optional
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
.             ...               .   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  ---

6. Discovery Using Service Resolution

This mechanism is performed in two steps:¶

1. A DNS domain name is retrieved for each combination of interface and address family. A DOTS agent has to determine the domain in which it is located relying on dynamic means, such as DHCP (Section 5). Implementations may allow the user to specify a default name that is used if no specific name has been configured.¶
2. Retrieved DNS domain names are then used for S-NAPTR lookups [RFC3958]. Further DNS lookups may be necessary to determine the peer DOTS agent IP address(es).¶

Once the DOTS agent has retrieved its DNS domain or discovered the peer DOTS agent name that needs to be resolved, an S-NAPTR lookup with the appropriate application service and the desired protocol tag is made to obtain information necessary to connect to the authoritative peer DOTS agent within the given domain.¶

This specification defines "DOTS" and "DOTS-CALL-HOME" as application service tags (Sections 9.4.1 and 9.4.2). It also defines "signal.udp" (Section 9.4.3), "signal.tcp" (Section 9.4.4), and "data.tcp" (Section 9.4.5) as application protocol tags. An example is provided in Figure 8.¶

In the example below, for domain "example.net", the resolution algorithm will result in IP address, port, tag, and protocol tuples listed in Table 1.¶

example.net.
IN NAPTR 100 10 "" DOTS:signal.udp "" signal.example.net.
IN NAPTR 200 10 "" DOTS:signal.tcp "" signal.example.net.
IN NAPTR 300 10 "" DOTS:data.tcp "" data.example.net.

signal.example.net.
IN NAPTR 100 10 "s" DOTS:signal.udp "" _dots-signal._udp.example.net.
IN NAPTR 200 10 "s" DOTS:signal.tcp "" _dots-signal._tcp.example.net.

data.example.net.
IN NAPTR 100 10 "s" DOTS:data.tcp "" _dots-data._tcp.example.net.
IN NAPTR 200 10 "a" DOTS:data.tcp "" b.example.net.

_dots-signal._udp.example.net.
IN SRV   0 0 5000 a.example.net.

_dots-signal._tcp.example.net.
IN SRV   0 0 5001 a.example.net.

_dots-data._tcp.example.net.
IN SRV   0 0 5002 a.example.net.

a.example.net.
IN AAAA  2001:db8::1

b.example.net.
IN AAAA  2001:db8::2

An example is provided in Figure 9 for the Call Home case. In this example, the resolution algorithm will result in IP address, port, and protocol tuples listed in Table 2 for domain "example.net".¶

example.net.
IN NAPTR 100 10 "" DOTS-CALL-HOME:signal.udp "" signal.example.net.
IN NAPTR 200 10 "" DOTS-CALL-HOME:signal.tcp "" signal.example.net.

signal.example.net.
IN NAPTR 100 10 "s" DOTS-CALL-HOME:signal.udp ""
            _dots-call-home._udp.example.net.
IN NAPTR 200 10 "s" DOTS-CALL-HOME:signal.tcp ""
            _dots-call-home._tcp.example.net.

_dots-call-home._udp.example.net.
IN SRV   0 0 6000 b.example.net.

_dots-call-home._tcp.example.net.
IN SRV   0 0 6001 b.example.net.

b.example.net.
IN AAAA  2001:db8::2

Note that customized port numbers are used for the DOTS signal channel, DOTS data channel, and DOTS signal channel Call Home in the examples shown in Figures 8 and 9 for illustration purposes. If default port numbers are used in a deployment, the discovery procedure will return 4646 (DOTS signal channel) and 443 (DOTS data channel) as DOTS service port numbers.¶

If no DOTS-specific S-NAPTR records can be retrieved, the discovery procedure fails for this domain name (and the corresponding interface and IP protocol version). If more domain names are known, the discovery procedure MAY perform the corresponding S-NAPTR lookups immediately. However, before retrying a lookup that has failed, a DOTS client MUST wait a time period that is appropriate for the encountered error (e.g., NXDOMAIN, timeout, etc.).¶

7. DNS Service Discovery

DNS-based Service Discovery (DNS-SD) [RFC6763] provides generic solutions for discovering services. DNS-SD defines a set of naming rules for certain DNS record types that they use for advertising and discovering services.¶

Section 4.1 of [RFC6763] specifies that a service instance name in DNS-SD has the following structure:¶

<Instance> . <Service> . <Domain>

The <Domain> portion specifies the DNS subdomain where the service instance is registered. It is a conventional domain name, such as "example.com".¶

The <Service> portion of the DOTS service instance name MUST be "_dots-signal._udp", "_dots-signal._tcp", "_dots-data._tcp", "_dots-call-home._udp", or "_dots-call-home._tcp".¶

This document does not define any keys; the TXT record of a DNS-SD service is thus empty (Section 6 of [RFC6763]).¶

Figure 10 depicts an excerpt of the DNS zone configuration file listing record examples to discover two DOTS signal channel servers. In this example, only UDP is supported as transport for the establishment of the DOTS signal channel.¶

_dots-signal._udp.example.net. PTR  a._dots-signal._udp.example.net.
_dots-signal._udp.example.net. PTR  b._dots-signal._udp.example.net.
a._dots-signal._udp.example.net. SRV 0 0 4646 a.example.net.
b._dots-signal._udp.example.net. SRV 0 0 4646 b.example.net.
a._dots-signal._udp.example.net. TXT ""
b._dots-signal._udp.example.net. TXT ""

8. Security Considerations

DOTS-related security considerations are discussed in Section 5 of [RFC8811]. As a reminder, DOTS agents must authenticate each other using (D)TLS before a DOTS session is considered valid according to the [RFC8782].¶

An attacker may block some protocol messages (e.g., DHCP) to force the client to use a discovery mechanism with a lower priority. The security implications of such attack are those inherent to the fallback discovery mechanism discussed in the following subsections.¶

The results of the discovery procedure are a function of the interface/address family. Contacting a discovered DOTS server via an interface to which it is not bound may exacerbate the delay required to establish a DOTS channel. Moreover, such behavior may reveal that a DOTS service is enabled by a DOTS client domain and exposes the identity of the DOTS service provider (which can be inferred from the name and the destination IP address) to external networks.¶

Security considerations related to how security credentials to authenticate DOTS server(s) are provisioned to a DOTS client are those inherent to the mechanism used for that purpose (for example, see [RFC8572]).¶

9. IANA Considerations

Acknowledgements

Thanks to Brian Carpenter for the review of the Bootstrapping Remote Secure Key Infrastructure (BRSKI) text used in previous draft versions of the specification.¶

Many thanks to Russ White for the review, comments, and text contribution.¶

Thanks to Dan Wing, Pei Wei, Valery Smyslov, and Jon Shallow for the review and comments.¶

Thanks to Bernie Volz for the review of the DHCP section.¶

Many thanks to Benjamin Kaduk for the detailed AD review.¶

Thanks to Zhen Cao, Kyle Rose, Nagendra Nainar, and Peter Yee for the directorate reviews.¶

Thanks to Barry Leiba, Martin Duke, Roman Danyliw, Éric Vyncke, and Magnus Westerlund for the IESG review.¶

Authors' Addresses