ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE. Application Layer. Jean Yves Le Boudec 2014

Size: px

Start display at page:

Download "ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE. Application Layer. Jean Yves Le Boudec 2014"

Clinton Lionel Hodge
6 years ago
Views:

1 1 ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE Application Layer Jean Yves Le Boudec 2014

2 Contents 1. The Application Layer 2. The Domain Name System 3. Application Layer Gateways 4. IPv4 / IPv6 5. ALG46 Textbook Chapter 2: The Application Layer 2

3 1. The Application Layer The application layer of TCP/IP consists of the distributed applications themselves it is the topic of the courses on information systems and distributed systems You did several application layers in the socket programming lab In this module, we focus on the relationship between the application layer and the lower layers. 3

4 4 Example: World Wide Web (WWW) three components file transfer protocol: HTTP (hyper text transfer protocol); uses TCP format for documents with links ( hyperdocuments ): HTML (hyper text markup language) URLs (universal resource locators) 1. user clicks: 3. user clicks on link in new document 2. transfer of one or several documents 4. transfer of one or several documents Web server S2 Web server S1

5 5 HTTP uses TCP A (client) open TCP connection B (server) GET / HTTP/1.0 HTTP Status 200 Server NCSA/1.4 Date: Tue, 13 May, :55:05 GMT Content type: text/html Content length: 280 last modified: Tue, 6 May, :12:40 GMT <html> <head>... < rest of document> close TCP connection

6 6 URLs identify documents to be transferred and application layer protocol to use protocol to be used target host path for document on target host examples ftp://lrcftp.epfl.ch/meinix.ps.gz news://comp.infosystems.www

7 7 Example: File Transfer Protocol (FTP) active mode : uses two TCP connections; ports 20 and 21 are reserved A: FTP client S: FTP server open TCP connection PORT OK open TCP connection OK <...> passive mode : also uses two TCP connections; only port 20 is reserved A: FTP client S: FTP server open TCP connection PASV 21 OK open TCP connection 1515 <...> OK

8 Which of these port numbers are TCP server ports? and and and all of these three 8. none of these three 9. I don t know 0% 0% 0% 0% 0% 0% 0% 0% 0%

9 Clear Text is often Used use telnet <destmachine> <serverport> to communicate manually with a server example (SMTP) lrcsuns:/export/home1/leboudec$ telnet localhost 25 Trying Connected to localhost. Escape character is '^]'. 220-lrcsuns.epfl.ch Sendmail/LRC ready at Mon, 23 Jun :47: ESMTP spoken here HELO lrcmac45.epfl.ch 250 lrcsuns.epfl.ch Hello localhost [ ], pleased to meet you MAIL FROM: leconcombremasque 250 leconcombremasque... Sender ok RCPT TO: leboudec@di.epfl.ch 250 leboudec@di.epfl.ch... Recipient ok DATA 354 Enter mail, end with "." on a line by itself ceci est un essaiiiii. 250 QAA15185 Message accepted for delivery QUIT 221 lrcsuns.epfl.ch closing connection Connection closed by foreign host. 9

10 2.The Domain Name System (DNS) Why invented? support user friendly naming of resources: computers, printers, mailboxes, hide IP address changes on servers What does it do? map DNS names (ex: ssc.epfl.ch) to IP addresses 10

11 nestlé generic domains DNS Names root top level domains country domains arpa int com edu gov mil net org firm store web arts rec info nom ch us za in-addr IP6 128 ibm 178 zurich 156 www in-addr.arpa 2nd level domains ethz epfl ee lrcsuns ssc tik gwen\.nedeleg jachen\.carigiet lrcsuns.epfl.ch every node on the tree represents one or a set of resources every node on the tree has a label lrcsuns and a domain name lrcsuns.epfl.ch label is made of 1 to 63 characters a-z, 0-9 or Other characters are allowed but real name is translated with punycode Ex: is in fact pfl rna.ch 11

12 How Does DNS Work? When Lisa s machine needs to map name to IP address DNS resolver in Lisa s machine contacts a DNS server IP address of DNS server is known to Lisa s machine at configuration time DNS server may not know answer: in such a case, DNS server needs to do several iterations, as shown on next example. A cache is used at DNS resolver and at DNS server to avoid repeating the same requests frequently. DNS uses UDP for queries and responses (in principle) 12

Lisa clicks: 6 http://www.zurich.ibm.com/rz.html 1 lrcsuns (EPFL DNS server) recursive 2 3 4 root name server iterative 1 query, RD=yes question = www.zurich.ibm.com. A 5 watson ibm.com. 2,4 query, RD=no question = www.

13 Lisa clicks: lrcsuns (EPFL DNS server) recursive root name server iterative 1 query, RD=yes question = A 5 watson ibm.com. 2,4 query, RD=no question = A 3 answer question = A answer = autority= ibm.com. NS watson.ibm.com. NS ns.austin.ibm.com. NS ns.almaden.ibm.com. additional= watson.ibm.com. A ns.austin.ibm.com. A ns.almaden.ibm.com A ,6 answer question = A answer = A

14 The previous slide shows an example of name resolution. 1. an application on lrcsuns requests a name resolution (find the IP address of a request is sent to the name server configured at lrcsuns 2. the epfl name server does not know the answer, but, as any name server, knows the IP address of root name servers. 3. a root name server knows the IP addresses of all level 2 domains. Thus, it informs lrcsuns of the IP address of the name servers responsible for the ibm.com domain 4. the epfl name server sends the same request now to the ibm name server 5 the ibm name server gives the IP address of back to the epfl name server. The epfl name server keeps the address in its cache, this will be used if the same request comes again 6 the epfl name server gives the IP address of back to lrcsuns. End of the resolution! The request sent by lrcsuns is recursive (RD=yes): lrcsuns will receive only the final answer. In contrast, the request sent by the epfl name server is iterative (RD=no): it receives only partial answers that help towards the solution. 14

15 A (=IPv4) and AAAA (= IPv6) records C:\Users\leboudec> dig a lca.epfl.ch <<>> DiG <<>> a lca.epfl.ch ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 652 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;lca.epfl.ch. IN A ;; ANSWER SECTION: lca.epfl.ch IN CNAME lca1srv2.epfl.ch. lca1srv2.epfl.ch IN A C:\Users\leboudec> dig aaaa lca.epfl.ch ; <<>> DiG <<>> aaaa lca.epfl.ch ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 415 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;lca.epfl.ch. IN AAAA ;; ANSWER SECTION: lca.epfl.ch IN CNAME lca1srv2.epfl.ch. lca1srv2.epfl.ch IN AAAA 2001:620:618:19c:1:80b2:9c18:1 15

When TTL = 0, cache entry is discarded by lrcsuns During next 2 hours, further requests are answered directly

16 Caching and Time to Live when receiving message 5, stisun1.epf.ch keeps answer from watson.ibm.com in a cache and does TTL = 7200 s for this cache entry. TTL decreases by 1 every second. When TTL = 0, cache entry is discarded by lrcsuns During next 2 hours, further requests are answered directly by lrcsuns watson.ibm.com is the authoritative DNS server for this record (i.e. the origin) decides value of TTL to be used by caching servers 16

17 17 1 Lisa clicks: 6 lrcsuns (EPFL DNS server) recursive 2 4 root name server iterative 7 8 watson ibm.com. 1mn later, Bart clicks: query, RD=yes question = A answer question = A answer = A

18 18 Reverse DNS Lookup Reverse Query = find IP address, given some name; used e.g. by traceroute Lab 1a

DNS client asks DNS server: what is the name corresponding to this IP address?

19 How does traceroute do DNS lookup? 1. DNS client tries all possible DNS names and verifies each of them with DNS server 2. DNS client asks DNS server: what is the name corresponding to this IP address? and DNS server searches its database to find an answer 3. Traceroute asks intermediate routers: what is you DNS name? 4. None of the above 5. I don t know 19

20 Z:\>dig in addr.arpa PTR ; <<>> DiG <<>> in addr.arpa PTR ;; global options: printcmd ;; Got answer: ;; >>HEADER<< opcode: QUERY, status: NOERROR, id: 368 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ; in addr.arpa. IN PTR ;; ANSWER SECTION: in addr.arpa IN PTR c6 slb 1 v15 ro.epfl.ch. ;; Query time: 0 msec ;; SERVER: #53( ) ;; WHEN: Thu Aug 28 12:10: ;; MSG SIZE rcvd: 80 Z:\>dig c6 slb 1 v15 ro.epfl.ch we are looking for the name corresponding to the IPv4 address the name is found from a PTR record in DNS we verify that the IPv4 address for this name is as expected ; <<>> DiG <<>> c6 slb 1 v15 ro.epfl.ch ;; ANSWER SECTION: c6 slb 1 v15 ro.epfl.ch IN A it is as expected, i.e. reverse record (PTR) and direct record (A) are consistant 21

21 Z:\>dig in addr.arpa PTR ; <<>> DiG <<>> in addr.arpa PTR ;; global options: printcmd ;; Got answer: ;; >>HEADER<< opcode: QUERY, status: NOERROR, id: 1223 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ; in addr.arpa. IN PTR ;; ANSWER SECTION: in addr.arpa. 257 IN PTR freedom.to.the.galaxy. ;; Query time: 2 msec ;; SERVER: #53( ) ;; WHEN: Thu Aug 28 11:43: ;; MSG SIZE rcvd: 80 Z:\>ping freedom.to.the.galaxy. Ping request could not find host freedom.to.the.galaxy.. Please check the name and try again. we are looking for the name corresponding to the IPv4 address the name is found from a PTR record in DNS we verify that the IPv4 address for this name is as expected this DNS name is bogus, there is no A (nor AAAA) record for it. The PTR record is bogus. 22

22 DNSSEC The current DNS is unsecure anyone can send (incorrect) answers to DNS queries DNSSEC solves this problem Records are signed, using public key cryptography Chain of trust is initialized with root servers Some domains (such as.se) implement it systematically 23

23 24 Bonjour = Server less DNS Why invented? For names of local importance only : e.g. your printer at home hp laser2719.local top level domain local is reserved for names visible in subnet Uses multicast address , UDP port 5353 Works in the domain where multicast is supported In practice in one LAN

24 We change the IPv4 address of lca.epfl.ch. How long does it take for the whole world to be informed of the change? 1. less than a minute 2. Up to 6 hours 3. Up to 1 day 4. Up to 2 days 5. None of these 6. I don t know EPFL names have TTL= secs, i.e. 1 day 0% 0% 0% 0% 0% 0%

25 27 A 3. Application Layer Gateways (ALGs) HTTP client 1 GET xxx.. 2 GET xxx.. 4 data HTTP server gateway logic HTTP client 3 data B HTTP server TCP/IP intranet TCP/IP HTTP Gateway = Web Proxy Internet TCP/IP Definition: an application layer gateway is an application layer intermediate system. It terminates the TCP connections (if the application layer uses TCP) and does store and forward for the application layer data Example: HTTP gateway, also called web proxy A sends HTTP request to gateway, gateway sends another HTTP request to server, server sends objects to gateway, gateway sends objects to A Gateway terminates the TCP connections and does store and forward

26 Web Proxy is often deployed to reduce traffic HTTP Intermediate Systems can keep frequently asked documents close to user requested files are kept in a cache similar systems deployed in content distribution networks lrcpc89 epfl cache GET hoa.gif 1 GET hoa.gif 2 OK sskczzjj,k@ph,d KD"XÇáH\ ÅÊä9ã GET hoa.gif OK sskczzjj,k@ph,d KD"XÇáH\ ÅÊä9ã OK Expires... sskczzjj,k@ph,d KD"XÇáH\ ÅÊä9ã hoa.gif expires 2 May :32 last modified 2 May :32 3 GET hoa.gif OK sskczzjj,k@ph,d KD"XÇáH\ ÅÊä9ã GET hoa.gif IF-MODIFIED-SINCE 2 May :32 HEAD 28

27 The End to end Principle The end to end principle of the Internet says that any layer above the network layer should avoid intermediate systems Thus: Application Layer Gateways should be avoided Why? Simplify the network. The network is independent of applications and can be run more safely. Allow easy deployment of applications. Ex: the web was deployed in 1994 in a few months. Before that, TCP/IP existed, but not HTTP. Performance is better no store and forward 29

28 30 The End to end Principle is not always Applicable Application layer gateways are still desirable in some cases. Q. Can you mention three good reasons for desiring an application layer gateway?

29 32 The End to end Principle for A joe.max@epfl.ch SMTP X SMTP Y SMTP B sales@mycorp.ch sicmail.epfl.ch mail.mycorp.ch Q. what would a strict application of the end to end principle on the figure give?

30 34 Firewalls use ALGs Firewall = a system that separates Internet from intranet: all traffic must go through firewall; only authorized traffic may go through; firewall itself cannot be penetrated (as one thinks) intranet Internet Firewall = one dual homed application layer gateway HTTP Proxy Cloud Service Proxy intranet R1 R2 Internet Firewall = several gateways + sacrificial subnet separated by filtering routers

31 35 Filtering Routers sees all packets and may decide to keep / discard packets Based on filtering rules using port numbers, protocol type, control bits in TCP header (SYN packets) Example: rule 1 allows http traffic connections from the outside to the machine rule 2 allows to be sent to machine rule 3 allows news to be sent to machine , but only from machine rule 4 forbids all other packets. intranet filtering router Internet prot srce addr dest addr srce port dest port action 1 tcp * > permit 2 tcp * > permit 3 tcp > permit 4 * * * * * deny

32 How many TCP connections are there on the figure? smartgrid.epfl.ch I don t know 0% 0% 0% 0% 0% 0% 0%

only IPv4; newer ones can use IPv4 and IPv6 sockets Note that application

33 4. The Application Layer has to select IPv4 or IPv6 sockets Application layer programs must be explicitly choose IPv4 or IPv6 sockets Old programs can use only IPv4; newer ones can use IPv4 and IPv6 sockets Note that application layer protocols (such as HTTP) are independent of the version of IP (IPv4/IPv6) 37

34 38 A Dual Stack Host with up to date application code can use both IPv4 and IPv6 Lisa s PC lca.epfl.ch v4 v6 v4 v6 infoscience.epfl.ch newstuff.epfl.cn v6 Will Lisa use IPv4 or IPv6 to connect to lca.epfl.ch? v4

35 How does Lisa know whether other end is v4 or v6? Lisa s PC newstuff.epfl.cn v4 v6 v6 1. Lisa s PC sends a ping to newstuff.epfl.cn 2. Lisa s PC tries http over both IPv4 and IPv6 in parallel and sees what works 3. None of the above 4. I don t know 0% 0% 0% 0%

36 DNS can be accessed via IPv4 or IPv6 Lisa s PC v6 newstuff.epfl.cn v4 QUESTION lca.epfl.ch. type = AAAA type = A v6 DNS server v4 ANSWER v6 lca.epfl.ch. AAAA 2001:620:618:19c:1:80b2:9c18:1 Lisa s PC is configured to talk to a DNS server using IPv4 Can ask A as well as AAAA questions Lisa s PC could be configured to use v6 for speaking to DNS server, if a v6 DNS servers is accessible to Lisa s PC 42

37 43 5. ALG46 IPv4 and IPv6 Interworking IPv4 and IPv6 are incompatible with Application Layer Gateways v4 only host cannot handle IPv6 packets v6 only host cannot handle IPv4 packets What needs to be solved: Interworking (h4 to h6): allow IPv6 only hosts and IPv4 only hosts to communicate example: IPv6 host connects to an IPv4 web server like to like access 6 to 6 over IPv4 infrastructure; ex: IPv6 host at home connects to IPv6 server at EPFL 4 to 4 over IPv6; in a distant future In this module we study interworking; In a later module we will study like to like

38 Dual Stack Application Layer Gateways (ALG46s) can be used to solve h4 to h6 Interworking Homer s PC Web proxy Web server Application TCP IPv6 ALG46 TCP TCP IPv6 IPv4 Application TCP/ IP IPv4 IPv6 IPv4 Application layer gateway (e.g. web proxy) relays HTTP questions / answers. ALG must be dual stack 44

39 45 How does Homer s PC know it should go to the ALG instead of the final web server? Homer s PC Application TCP IPv6 www6.epfl.ch 2001:620:618:1a6:1:80b2:a60a:2 TCP IPv6 ALG46 TCP IPv Application TCP/ IP IPv4

47 Bart s PC will not use the ALG Bart s PC Application TCP IPv4 QUESTION www.epfl.

40 47 Bart s PC will not use the ALG Bart s PC Application TCP IPv4 QUESTION type = A DNS server www6.epfl.ch 2001:620:618:1a6:1:80b2:a60a:2 TCP IPv6 ANSWER A ALG46 TCP IPv Application TCP/ IP IPv4

41 Will Lisa s PC use the ALG? Lisa s PC Application TCP IPv4 IPv6 www6.epfl.ch 2001:620:618:1a6:1:80b2:a60a:2 TCP IPv6 ALG46 TCP IPv Application TCP/ IP IPv4 1. Yes 2. No 3. I don t know 0% 0% 0%

42 Pros and Cons of ALG46 50

43 Will Joe s PC use IPv4 or IPv6 to connect to lca.epfl.ch? 1. IPv4 2. IPv6 3. It depends on the configuration of Joe s PC 4. I don t know QUESTION lca.epfl.ch. type = AAAA type = A DNS server 0% 0% 0% 0%

44 Does Joe s PC use IPv4 or IPv6 to contact the DNS server? 1. Always IPv4 2. Always IPv6 3. It depends on the configuration of Joe s PC 4. I don t know QUESTION lca.epfl.ch. type = AAAA type = A DNS server 0% 0% 0% 0%

45 Facts to Remember Application layer runs on hosts, not routers Application layer programs often use clear text commands Application layer gateways (ALGs)should be avoided whenever possible ( end to end principle ) Application chooses UDP or TCP and must be able to use both IPv4 and IPv6; old apps use IPv4 only DNS is a world wide distributed data base used for mapping names to IP addresses (and vice versa) DSN is used by apps on dual stack machines to know whether to use v4 or v6 ALG46s can be used to solve the h4 to h6 interworking problem 55

ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE. Application Layer. Jean Yves Le Boudec 2015

1 ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE Application Layer Jean Yves Le Boudec 2015 Contents 1. The Application Layer 2. The Domain Name System 3. Application Layer Gateways 4. IPv4 / IPv6 5. ALG46 Textbook