Table of Contents. IP version 6. Arguments for the use of IP version 6. Arguments for the use of IP version 6 (continued)

Transcription

1 IP version 6 The newest IP version Karst Koymans Informatics Institute University of Amsterdam (version 18.5, 2018/11/08 13:39:31) Tuesday, November 6, 2018 Table of Contents Rationale IPv6 addressing IPv6 address space and notation Special-purpose space Unicast space Multicast Addressing hierarchy Neighbor Discovery and Autoconfiguration IPv6 packet formats IPv4 to IPv6 transition General ideas Adresses used in translation NAT64 ISATAP, 6to4 and Teredo DNS issues Application, protocol and programming support Arguments for the use of IP version 6 Arguments for the use of IP version 6 (continued) Many more addresses Only 4 times as many bits (4 32 = 128) Address space grows with a factor /2 32 = 2 (128 32) = 2 96 Autoconfiguration Stateless Stateful (DHCPv6) Security Built-in IPSEC Optimized headers Fixed length (40 bytes) Extension header mechanism Mobility Direct end to end communication No NAT needed End-to-end principle could be reinstated but smart or intelligent middleboxes will interfere Software defined networking (SDN) possibly enemy of end-to-end

2 Weaker arguments for the use of IP version 6 IPv6 Deployment 2018 QoS Flowlabel 1 present in the standard header Hierarchical routing Nothing new with respect to IPv4 Risk of tunnel mess because of IPv6-in-IPv4 transition scenario Tunnels are more and more replaced by native 2 access SixXS ceased their tunnel service in 2017 State of IPv6 Deployment 2018 IPv6 deployment continues to increase around the world. In the six years since World IPv6 Launch 1 levels of IPv6 deployment in networks and service providers all over the globe have increased dramatically. The top 10 countries using the new protocol include Belgium, Greece, Germany, the USA, Uruguay, India, Switzerland, Japan, Malaysia, and Brazil. Belgium was the first country in the world where the majority of connections to IPv6-capable content providers used IPv6. Nearly half a billion people use IPv6 among just the top 15 ISPs combined. Nearly half of all IPv6 users on the planet today are in India. Reliance Jio, a mobile network operator in India, activated over 200 million subscribers with IPv6 connectivity in just 9 months (September June 2017). 80 percent of smartphones in the US on the major cellular network operators (AT&T, Sprint, T-Mobile and Verizon) use IPv6 (up from under 40 percent less than 3 years ago). More than one in four of Alexa s top 1,000 global websites are accessible via IPv6. Over 25% of all Internetconnected networks advertise IPv6 connectivity. In 2012, less than one in a hundred connections to Google services used IPv6. Today that number is nearly one in four. Google reports 49 countries using IPv6 for more than 5% of their interactions with them (up from 37 in 2017). Comcast has an IPv6 deployment in excess of 66% (USA). British Sky Broadcasting has IPv6 deployment in excess of 86% (UK). Deutsche Telekom has 56% (Germany). Internet Society report on IPv6 org/resources/2018/ state-of-ipv6-deployment-2018/ 1 The An IPv4 Flowlabel Option Internet-Draft tries to establish an IPv4 flowlabel option since 2002 (version 28 of September 05, 2018) 2 The IPv6-Internet is a reality for many users since World IPv6 Day on June 8, 2011 and World IPv6 Launch on June 6, % (1519) of the TLDs have IPv6 name server addresses and can be queried using either IPv4 or IPv6. Smartphone-focused T-Mobile (74 million subscribers), is an IPv6-only network. Find more information about the scope and scale of IPv6 deployment in the Internet Society State of IPv6 Deployment 2018 report: XS4ALL has 71% (Netherlands). VOO has 73% and Telenet has 63% (Belgium). IPv6 addresses Remember: IPv4 address notation IP version bit addresses 4 times as many bits as in IPv times as many possible addresses Much more hierarchical addressing This is absolutely necessary because of the huge address space size of IPv6 Still discussions about what is the right sizing (March 2011), see RFC 6177 (BCP 157; IPv6 Address Assignment to End Sites ) IPv4 address notation IP address Subnet mask Wildcard mask Network /26 Broadcast Mixed notation /26 (Host and network in one combined notation)

3 IPv6 address notation IPv6 address notation IPv6 address 2001:0610:0158:bad0:0000:0000:0000:0001 Short form 2001:610:158:bad0::1 Network 2001:610:158:bad0::/64 Mixed notation 2001:610:158:bad0::1/64 8 blocks of 4 nibbles (hex digits), totaling 128 bits Leading zeroes in blocks may be skipped Blocks of all zeroes may be replaced by :: (once!; why?) No broadcasts (but multicasts), no subnet masks, only prefixes See RFC 4291: IP Version 6 Addressing Architecture Allocated address space Top level allocations ::/8 Special-purpose 100::/8 Special-purpose 2000::/3 Global unicast fc00::/7 Unique local unicast fe80::/10 Link-local (Link-scoped) unicast ff00::/8 Multicast Exercise Write down the unallocated parts with as much aggregation as possible Explain and improve ipv6-address-space/ipv6-address-space.xhtml Special-purpose addresses Special-purpose addresses ::/128 Unspecified address ::1/128 Localhost address ::a.b.c.d/128 (from ::/96) IPv4-compatible addresses ::ffff:a.b.c.d/128 (from ::ffff:0:0/96) IPv4-mapped addresses 64:ff9b::/96 Well-known prefix 100::/64 Discard-only address block a.b.c.d is IPv4 address in decimal IPv4-compatible addresses were used for automatic tunneling (now deprecated) IPv4-mapped addresses may be used by IPv6-only applications to communicate with IPv4-only hosts (never seen on the wire) Algorithmic translation for IPv4/IPv6 now uses the well-known prefix Global unicast space (1) Global unicast addresses (allocated before 2006) 2001::/16 First RIR space 2002::/16 6to4 space 3ffe::/16 6bone space (returned to IANA, see RFC 5156) 5f00::/8 3 6bone space (returned to IANA) The RIR (Regional Internet Registries) are: RIPE NCC, ARIN, APNIC, LACNIC, AfriNIC 6to4 is one of the transition mechanisms 6bone was experimental (now deprecated) 3 This is a subprefix of 4000::/3, which is part of the fully reserved 4000::/2

4 Global unicast space (2) IANA blocks inside 2001::/16 Recent (2006) large chunks 2400::/12 APNIC 2600::/12 ARIN 2800::/12 LACNIC 2a00::/12 RIPE NCC 2c00::/12 AfriNIC https: // IETF Protocol Assignments 2001::/32 TEREDO 2001:2::/48 4 Benchmarking 2001:4:112::/48 AS112-DNAME :20::/28 ORCHIDv2 2001:db8::/32 is used for documentation 4 The RFC mistakenly talks about 2001:200::/48 5 RFC 7535 Anycast addresses Local or private space (fe80::/9, fc00::/7) Allocated from (Global) unicast space One anycast address has been required from the very beginning Subnet-router anycast For each subnet the address with all Interface ID bits set to zero Each IPv6 router should configure this address but it is not always implemented (officially deprecated? 6 ) It is useful to be able to find from the outside 7 the nearest router connected to a subnet fe80::/10 (Link-local addresses) Restricted in scope to a single link (prefix fe80::/64) Address reuse possible on other link fec0::/10 (Site-local addresses; deprecated) Used within a site (what is a site?) Corporate mergers possible with GUSL (Sic!) Globally Unique Site-locals are deprecated fc00::/7 (Unique local unicast; replaces Site-local) Subnets typically look like fdrr:rrrr:rrrr:ssss::/64 (see RFC 4193) Local bit L (eighth bit) is 1; fc00::/8 is reserved rr:rrrr:rrrr is random and ssss is an assigned subnet id 6 See IPv6 Subnet Anycast Deprecated 7 What happens from the inside? Should it also be used on the link local subnet?

5 Multicast space Multicast Scope See RFC 4291 ff00::/8 (NOT ff::/8!) Multicast address bits 8 bits ones ( ) 4 bits flag (0RPT) T (1: transient; 0: permanent) P (1: prefix-owned; 0: not prefix-owned); see RFC 3306 R (1: RP embedded; 0: no RP embedded); see RFC bits scope 112 bits multicast group id 8 Scope Bits Meaning Reserved Interface-local Link-local Admin-local Site-local Organization-local e 1110 Global f 1111 Reserved Others - Unassigned 8 Under further discussion, see RFC 7371, September 2014 Pre-defined multicast addresses 2001::/16 Hierarchy Purpose Address Scope All nodes ff02::1 9 Link-local All routers ff02::2 Link-local All routers ff05::2 Site-local Solicited-Node ff02::1:ffxx:xxxx 1011 Link-local /16 RIR space (from IANA) /23 Basic allocation size /32 ISP allocations (from RIR) /35 Old ISP allocations /48 Customer allocations (from ISP) /56, /60 Consumer allocations /64 IPv6 subnet (inside customer network) In recent years a shift is seen to larger prefixes /12 for the five RIRs 9 Why does ping6 ff02::1 not work? What does work? 10 xx:xxxx are the low order 24 bits of each unicast or anycast address which this host has configured on the interface under consideration. This multicast address is used in Neighbor Solicitation. 11 On an Ethernet link this will show up as a MAC 33:33:ff:xx:xx:xx multicast

6 Addressing in Internet Exchanges (AMS-IX) Neighbor Discovery Protocol (NDP) Until early 2011 AMS-IX has been using SURFnet address space (2001:610:140::/48) BIT address space (2001:7b8:200::/48) Current (2012) scheme 2001:7f8:1::/48 AMS-IX (peering LAN) from 2001:7f8::/29 is a Block for (direct) RIR assignments to network operators 2001:67c:1a8::/48 AMS-IX (office LAN) from 2001:678::/29 is a Block for (direct) RIR assignments to network operators All assignments are from the 2001:600::/23 RIPE block IPv6 does not use ARP IPv6 does use ICMPv6 to discover or apply Address and status of neighbours Properties of networks, prefixes and routers Duplicate Address Detection (DAD) Neighbour Unreachability Detection (NUD) Extensive use of multicast Specified in RFC 4861 ICMPv6 types for NDP StateLess Address AutoConfiguration (SLAAC) ICMPv6 types for NDP 133 Router Solicitation 134 Router Advertisement 135 Neighbor Solicitation 136 Neighbor Advertisement 137 Redirect Message Specified in RFC 4862 First always acquire a link-local address Then use Router Advertisement Check that the autonomous flag is set for a given prefix Generate an interface identifier to be used with the prefix Apply DAD (Duplicate Address Detection) Addresses used to contain an embedded hardware address RFC 4941 introduced temporary addresses for increased privacy RFC 7217 introduced stable but opaque addresses

7 IPv6 header IPv6 header fields Vers. Traffic Class Flowlabel Payload Length Next Header Hop Limit Source Address (16 bytes) Destination Address (16 bytes) IPv6 header fields Version 6 Traffic Class Type of Service management Flowlabel Identify flows with special requirements Payload Length Including extension headers Next Header Type of following header Hop Limit Forwarding count and loop protection Source Address IPv6 address of sender Destination Address IPv6 address of recipient Next Header Protocol types (1) Next Header Protocol types (2) Header types Number Name Meaning 0 HOPOPT Hop-by-hop Option 6 TCP Upper layer Transmission Control 17 UDP Upper layer User Datagram 41 IPv6 IPv6 (in IPv6) 43 IPv6-Route Routing Header 44 IPv6-Frag Fragment Header Header types (continued) Number Name Meaning 50 ESP Encap Security Payload 51 AH Authentication Header 58 IPv6-ICMP ICMP for IPv6 59 IPv6-NoNxt No Next Header IPv6-Opts Destination Options See 12 This is for instance used by Teredo bubble packets

8 A simple and direct transition scenario Older IETF transition technologies (around 2000) Clients dual stack Servers (services) IPv4 xor IPv6 Killer application IPv6 only Networks completely independent Configured tunnels only if no native connectivity is available Clients and servers dual stack Stateless IP/ICMP Translation (SIIT) RFC 2765 (Feb 2000) Bump in the Stack (BIS) RFC 2767 (Feb 2000) IPv6 Tunnel Broker RFC 3053 (Jan 2001) SOCKS-based IPv6/IPv4 Gateway RFC 3089 (Apr 2001) Transport Relay Translator (TRT) RFC 3142 (Jun 2001) An implementation of NA(P)T-PT (deprecated since RFC 4966) Makes use of DNS_ALG (RFC 2694) Bump in the API (BIA) RFC 3338 (Oct 2002) Current (2018) IETF transition technologies Clients and servers dual stack Dual-Stack Hosts Using Bump-in-the-Host (BIH) RFC 6535 (Feb 2012), replaces BIA and BIS IP/ICMP Translation (derived from SIIT) RFC 7951 (Jun 2016) 6rd RFC 5569 (Jan 2010), 5969 (Aug 2010) IPv6 Rapid Deployment, using 6to4 within ISP network DS-Lite (Dual-Stack Lite) RFC 6333 (Aug 2011), RFC 7335 (Aug 2014) The service provider network is IPv6 only Uses IPv4-in-IPv6 tunnels and Carrier Grade NAT (CGN) for IPv4 NAT64 and DNS64 RFC 6146, 6147 (Apr 2011) 6to4 Do not confuse with 6in4 or 6over4 ISATAP and Teredo IPv6 to IPv4 gateway IPv6-translatable addresses are only used in stateless translation

9 Addresses used in IPv4/IPv6 Translation Format of IPv4-embedded Addresses Framework for IPv4/IPv6 Translation (RFC 6144, April 2011) IPv4-embedded addresses IPv6 addresses containing IPv4 addresses IPv4-converted IPv6 addresses Used to represent IPv4-only hosts inside an IPv6-only network Assigned to the IPv6-side of an IPv4/IPv6 translator/gateway IPv4-translatable IPv6 addresses Used to represent IPv6-only hosts inside an IPv4-only network Assigned to an IPv6-only host Only works with a stateless IPv4/IPv6 translator/gateway Embedded IPv4 address is assigned to the IPv4-side of an IPv4/IPv6 translator/gateway IPv6 Addressing of IPv4/IPv6 Translators RFC 6052, October 2010 Prefix IPv4 address Suffix Prefix length can be 32, 40, 48, 56, 64 or 96 The Well-known prefix (WKP 13 ) 64:ff9b::/96 is one option Other options are network specific prefixes (NSPs) Bits should all be set to 0 for compatibility with the EUI universal bit The IPv4 address wraps around bits 64-71, if necessary The suffix completes the IPv6 address and is reserved (all 0 s) 13 Only in a stateful scenario without IPv4-translatable addresses 14 This will be explained in the Layer2 lecture How do IPv6 (only) clients reach IPv4 (only) servers? Windows XP SP1 choice It is one big NAT scheme RFC 6145 (April 2011), RFC 6791 (November 2012) IP/ICMP Translation Algorithm Header translation IPv4 IPv6 RFC 6146 (April 2011) Stateful NAT64: Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers Uses algorithmic (4 6) and table based (6 4) translation RFC 6147 (April 2011) DNS64: DNS Extensions for Network Address Translation from IPv6 Clients to IPv4 Servers Synthesizes AAAA records from A records ISATAP (RFC 5214) For intra domain connectivity Was once automatically enabled (in XP) when IPv6 was enabled 6to4 (RFC 3056) For inter domain connectivity Was once automatically enabled (in XP) when IPv6 was enabled ISATAP + 6to4 == a possible security nightmare

10 ISATAP Intra-Site Automatic Tunnel Addressing Protocol PREFIX:0:5efe:a.b.c.d PREFIX (64 bits) can be (link) local or global 0:5efe (32 bits) is an ISATAP constant Related to the IANA OUI 00:00:5e (RFC 7042) a.b.c.d (32 bits) is a public or private IPv4 address Uses IPv4 encapsulation inside the domain as data link layer Default gateway should be a full blown IPv6 router 6to4 Everybody with a public IPv4 address a.b.c.d owns an IPv6 site 2002:a.b.c.d::/48 This notation is illegal, but practical Uses normal IPv6 routing inside its prefix A full mesh of IPv4 encapsulated point to point links connect all 6to4 routers The 6to4 router acts as a default gateway within 2002:a.b.c.d::/48 A 6to4 relay is a 6to4 router that connects 6to4 space to native IPv6 space A 6to4 relay advertises 2002::/16 towards native IPv6 space A 6to4 relay uses a well-known IPv4 anycast address ( ) from /24 to reach nearest relay as 2002:c058:6301:: 6to4 in a picture ISATAP+6to4 Source: Microsoft Technet Source:

11 Teredo RFC 4380, 5991, 6081 DNS Teredo Navalis is a shipworm 6to4 equivalent for end user nodes Works through NAT and uses UDP over IPv4 for transport Uses a Teredo Server to determine NAT-type Uses the 2001::/32 prefix 2001:0000:ssss:ssss:ffff:pppp:cccc:cccc is the IPv6 address used s: Teredo Server; c: obfuscated Teredo Client public NAT address f: Teredo Flags; p: obfuscated public NAT UDP tunnel port Uses a Teredo Relay as a gateway to reach IPv6-hosts AAAA record Just like A record Alternative approach A6 record (piecewise; historic) PTR record Inside ip6.arpa. (ip6.int. has been deprecated) Based on nibbles as labels Labels are strings of length 1 from {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f} Alternative approach (piecewise; historic) DNAME (Delegation name; Domain CNAME ) Bitstring labels (deprecated) DNS over IPv6 IPv6 applications and protocols Implemented since BIND version 9 Root servers partly IPv6 enabled since February 2008 Not IPv6 enabled (tested ): e, g NASA, DISA They are now ( ) Many DNS servers use and serve IPv6 (tested ) ns1.os3.nl 2001:610:158:960::66 ns.ripe.net 2001:67c:e0::6 ns3.surfnet.nl 2001:610:0:800c:195:169:124:71 Many protocols can be used, often unaltered, with IPv6 ftp, ssh, telnet, smtp, whois, domain, tftp, finger, http, pop3, nntp, ntp, netbios-*, imap, irc, ldap, login, lpr, rsync, Many OSs IPv6 ready Windows XP/Vista/7/8/10, MacOS X, Linux, *BSD Many routers are IPv6 ready Home routers are the main exception, but this is improving The IPv4 address pool is depleted everywhere, except AfriNIC AfriNIC expected to run out of IPv4 addresses on 27-Jun According to (visited on )

12 IPv6 programming Changes in library calls Replace inet_addr(), inet_aton() and inet_ntoa() by inet_pton() and inet_ntop() Replace gethostbyname(), gethostbyaddr(), by getaddrinfo() and its inverse getnameinfo() Library calls and underlying structures are not backwards compatible but not too hard to change in a well written program The basics of sockets programming doesn t change