shim6 implementation Authors: Jeff Ahrenholz Tom Henderson Installation Guide and User s Manual

Transcription

1 shim6 implementatin Installatin Guide and User s Manual Authrs: Jeff Ahrenhlz Tm Hendersn Cpyright c , The Being Cmpany. This sftware was develped under funding supplied by ONR cntract N C-0319 and The Being Cmpany.

2 i Table f Cntents 1 Intrductin Gals Nn-gals Sftware architecture Implementatin status Future wrk Installatin Prerequisites Operating Systems Installing supprting libraries Overview Supprting libraries ip6tables extensins Installing shim REAP daemn SHIM6 daemn Running shim Overview Testing shim

3 Chapter 1: Intrductin 1 1 Intrductin shim6 (Site Multihming by IPv6 Intermediatin) is a prtcl being develped in the Internet Engineering Task Frce (IETF) t prvide a hst-based slutin t allw IPv6 sites t multi-hme (cnnect t mre than ne Internet prvider) fr lad sharing, redundancy, and fault tlerance. The shim6 prtcl allws such hsts t hld multiple lcatrs (addresses) and t migrate transprt prtcl sessins frm ne lcatr pair t anther withut disruptin. The prtcl includes cmpnents fr securely (cryptgraphically) binding lcatr sets tgether t prevent address hijacking, and a separate reachability prtcl (REAP) that can mnitr the reachability f peer lcatrs in active use. shim6 is architecturally related t the Hst Identity Prtcl (HIP), in that they bth implement an identifier/lcatr split at the bundary between the netwrk and transprt layer. Their cntrl prtcls als share many f the same packet frmats. 1.1 Gals The gals f this shim6 effrt have been t develp an pen-surce Linux implementatin f shim6 that brrws frm (and can later integrate with) ur HIP implementatin. We are interested in the lng-term ptential f the ID/lcatr split architecture and in eventual evlutin twards sme kind f a cmbined shim6/hip implementatin: we envisin that cmpnents f shim6 may be useful t HIP (particularly REAP); shim6 has sme nice features such as deferred cntext establishment and supprt fr referrals withut lkups that make it attractive fr light-weight and near-term deplyment; Nn-gals The fllwing gals are deferred fr a later phase f develpment: cntext frking and balancing acrss multiple paths plicy granularity f when t invke/bypass shim6 prcessing HBA and CGA generatin and verificatin IPV6 DONTSHIM ptin (and ther shim6-api extensins fr applicatins) supprt fr UDP tunneling and ther tunneling supprt RFC3484-bis surce address selectin mdificatins fr shim6 Windws and OS X supprt, r user-mde supprt 1.2 Sftware architecture Our shim6 implementatin is a multithreaded C++ user-space prcesses that interfaces with a standard Linux kernel (extended via a ladable kernel mdule) thrugh standard system interfaces and with a GUI-based status applicatin via sckets IPC. Althugh we d nt require kernel patches, we d require specific kernel versins since we are wrking with kernel mdules that d nt have stable APIs acrss kernel releases. Althugh sme cmpnents f ur architecture are defined fr multi-platfrm supprt, we currently fcus n Linux. Figure 1.1 illustrates the verall sftware architecture. Crsslayer interactin with TCP (e.g., resetting cngestin windw upn lcatr change) is nt shwn and needs further cnsideratin whether it can be dne withut a kernel mdificatin.

4 Chapter 1: Intrductin 2 GUI tl n desktp UDP sckets IPC shim6 multithreaded prcess UDP sckets IPC REAP (failure detectin and lcatr pair explratin) Ethereal (patched fr shim6) IPv6 Applicatins prtcl state machine (main thread) kernel state maintenance interface state tracker state machine (main thread) cnnectin tracker tcpdump DNS queries user data I1-R2 mangle rules interface up/dwn Prbe Keepalive statistics n active flws user space reslver API sckets API Raw sckets (SOCK_RAW) Netlink sckets (NETLINK_SHIM) Netlink sckets (NETLINK_ROUTE) Raw sckets (SOCK_RAW) nf_cnntrack (/prc/net/ip_cnntrack) kernel space transprt prt ipsec fragmentatin NF_IP6_LOCAL_IN/OUT IPv6 dest. ptins ladable kernel mdule Insert and remve shim6 cntext header Figure 1.1: Overall shim6 implementatin architecture. The verall strategy is t use ladable Netfilter mangle mdules in the IPv6 firewall tables t implement the shimming and deshimming f packets, t use Netfilter queue t receive shim6 cntrl packets, and the Linux Netfilter cnntrack (cnnectin tracking) feature t track active flws. The shim6 daemn itself is a prcess that shares a HIP-abstractin library with ur HIP daemn, and the failure detectin daemn (reapd) is designed t be reused acrss HIP and shim6. Belw is an excerpt frm Sectin 4 f the shim6 prtcl draft. The abve Figure 1.1 can prbably best be understd by walking thrugh what happens in the sftware t cause the fllwing shim6 behavir t ccur. The shim6 prtcl perates in several phases ver time. fllwing sequence illustrates the cncepts: The An applicatin n hst A decides t cntact B using sme upperlayer prtcl. This results in the ULP n A sending packets t B. We call this the initial cntact. Assuming the IP addresses

5 Chapter 1: Intrductin 3 N actin. selected by Default Address Selectin [12] and its extensins [13] wrk, then there is n actin by the shim at this pint in time. Any shim cntext establishment can be deferred until later. Sme heuristic n A r B (r bth) determine that it is apprpriate t pay the shim6 verhead t make this hst-t-hst cmmunicatin rbust against lcatr failures. Fr instance, this heuristic might be that mre than 50 packets have been sent r received, r a timer expiratin while active packet exchange is in place. This makes the shim initiate the 4-way cntext establishment exchange. As a result f this exchange, bth A and B will knw a list f lcatrs fr each ther. If the cntext establishment exchange fails, the initiatr will then knw that the ther end des nt supprt shim6, and will cntinue with standard unicast behavir fr the sessin. Netfilter cnnectin tracking is used t implement the supprted heuristic. A thread in the REAP user-space sftware can mnitr this accrding t plicy and invke a shim6 cntext establishment and lcatr exchange (by telling the shim6 daemn) when necessary. The abve step just builds state (ULID/lcatr cntext) in the shim6 daemn but des nt affect any data plane packets. Hwever, the reachability prtcl (REAP) starts t mnitr the ULIDs fr reachability, and shuld be prvided with a list f alternate lcatrs learned during the shim6 handshake. Cmmunicatin cntinues withut any change fr the ULP packets. In particular, there are n shim extensin headers added t the ULP packets, since the ULID pair is the same as the lcatr pair. In additin, there might be sme messages exchanged between the shim sub-layers fr (un)reachability detectin. At sme pint in time smething fails. Depending n the apprach t reachability detectin, there might be sme advice frm the ULP, r the shim (un)reachability detectin might discver that there is a prblem. At this pint in time ne r bth ends f the cmmunicatin need t prbe the different alternate lcatr pairs until a wrking pair is fund, and switch t using that lcatr pair. REAP prcess r thread separately des this prbing, and ntifies shim6 sftware via sckets IPC when a ULID shuld be replaced with alternate lcatr(s). When ntified, the hst needs t assume that packets may start arriving n that shim cntext r may need t be sent n new shim cntext.

6 Chapter 1: Intrductin 4 If the lcal hst has new dest lcatrs, a tw step prcess is needed fr each active lcatr that is!= dst ULID: 1. add a rule t divert packets t a SHIM6 mdule ip6tables -A INPUT <matching rule> -j SHIM6 2. add cntext state t the SHIM6 mdule If the lcal hst has new src lcatrs, a tw step prcess will be needed fr each active lcatr that is!= src ULID: 1. add a rule t divert packets t a SHIM6 mdule ip6tables -A OUTPUT <matching rule> -j SHIM6 2. add cntext state t the SHIM6 mdule Once a wrking alternative lcatr pair has been fund, the shim will rewrite the packets n transmit, and tag the packets with shim6 Paylad extensin header, which cntains the receiver s cntext tag. The receiver will use the cntext tag t find the cntext state which will indicate which addresses t place in the IPv6 header befre passing the packet up t the ULP. The result is that frm the perspective f the ULP the packet passes unmdified end-t-end, even thugh the IP ruting infrastructure sends the packet t a different lcatr. Nthing needed, until cnnectin being shimmed ges away r the lcatr pair changes again. There needs t be sme garbage cllectin f shim state nt being used fr a lng time. Again, Netfilter cnnectin tracking culd be used fr this. The shim (un)reachability detectin will mnitr the new lcatr pair as it mnitred the riginal lcatr pair, s that subsequent failures can be detected. The abve is a functin f the REAP prtcl. In additin t failures detected based n end-t-end bservatins, ne endpint might knw fr certain that ne r mre f its lcatrs is nt wrking. Fr instance, the netwrk interface might have failed r gne dwn (at layer 2), r an IPv6 address might have becme deprecated r invalid. In such cases the hst can signal its peer that this address is n lnger recmmended t try. Thus this triggers smething similar t a failure handling in that a new, wrking lcatr pair must be fund. The abve is a functin f the REAP prtcl. The prtcl als has the ability t express ther frms f lcatr preferences. A change in any preferences can be signaled t the peer, which will made the peer recrd the new preferences. A change in the preferences might ptinally make the peer want t use a different lcatr pair. If it makes this decisin, it fllws the same lcatr switching prcedure as after a failure

7 Chapter 1: Intrductin 5 (by verifying that its peer is indeed present at the alternate lcatr, etc). This exchange will take part in the shim6 daemn, and updates are pushed t the REAP prtcl. Change in lcal lcatr status may be mnitred by the Netlink ROUTING scket. When the shim thinks that the cntext state is n lnger used, it can garbage cllect the state; there is n crdinatin necessary with the peer hst befre the state is remved. There is a recvery message defined t be able t signal when there is n cntext state, which can be used t detect and recver frm bth premature garbage cllectin, as well as cmplete state lss (crash and rebt) f a peer. SHIM6 kernel mdule needs t be able t send this NO CONTEXT message t shim6 daemn. The exact mechanism t determine when the cntext state is n lnger used is implementatin dependent. An implementatin might use the existence f ULP state (where knwn t the implementatin) as an indicatin that the state is still used, cmbined with a timer (t handle ULP state that might nt be knwn t the shim sub-layer) t determine when the state is likely t n lnger be used. NOTE: The ULP packets in shim6 can be carried cmpletely unmdified as lng as the ULID pair is used as the lcatr pair. After a switch t a different lcatr pair the packets are "tagged" with a shim6 extensin header, s that the receiver can always determine the cntext t which they belng. This is accmplished by including an 8-ctet shim6 Paylad Extensin header befre the (extensin) headers that are prcessed by the IP endpint sublayer and ULPs. If subsequently the riginal ULIDs are selected as the active lcatr pair then the tagging f packets with the shim6 extensin header can als be stpped. 1.3 Implementatin status Currently, this implementatin supprts the fllwing: Fur-packet I1, R1, I2, R2 shim6 cntext establishment Sends peridic keep-alive packets Prbes lcatr pairs using the Prbe packet, using the Prbes Sent and Prbes Received fields Shims and deshims data packets based n cntext establishment and reachability state Cmmunicates lcal address list in the I2 and R2 messages Handling f the ULID Pair ptin Cntext tag and nnce management

8 Chapter 1: Intrductin Future wrk These items are left fr future revisins: Garbage cllectin and cleanup f cntext Packet retransmissin with binary expnential backff Cntext recvery, cntext cnfusin, and the R1bis and I2bis packets R1 validatr and Lcatr List ptins Handling fragmentatin f packets that exceed the MTU size after the IPv6 extensin header has been added (nte: we have a wrkarund in place in ur shimming mdule) shim6 Errr, Update Request, and Update Acknwledgment messages Keepalive Timeut ptin Handling ICMP errr messages and psitive r negative feedback frm upper layer prtcls Cmmunicatin frm the kernel mdule t the shim6 daemn abut packets received with a cntext tag that des nt match Cntext frking and balancing acrss multiple paths; Frked Instance Identifier ptin Generate and validate cryptgraphically bund addresses such as CGA r HBA; CGA Parameter Data Structure and CGA Signature ptins Native shim6 API fr applicatins, such as the IPV6 DONTSHIM ptin Supprt fr UDP tunneling and ther tunneling supprt RFC5014 surce address selectin rules.

9 Chapter 2: Installatin 7 2 Installatin 2.1 Prerequisites Backgrund infrmatin n shim6 is available at these links: Operating Systems This sftware has nly been tested n Linux i386 systems. There are several Linux kernel dependencies that are knwn t be unstable acrss recent kernel versins. We have tested using kernels n Ubuntu and Fedra Linux. 2.2 Installing supprting libraries Overview The fllwing pen surce packages and prgrams are needed fr shim6: scklibpp: prvides (mre) prtable libraries fr scket prgramming cnntrack: user-space utility fr tracking the number f packets in a flw libnetfilter cnntrack: netfilter library t access cnntrack libnetfilter queue: netfilter library fr receiving SHIM6 cntrl packets in a user-space queue frm the match rule libnfnetlink: lw-level netfilter library required by the thers These dependencies are part f this sftware distributin: hal (HIP Abstractin Library): platfrm independent abstractin library fr HIP and shim6, mainly prviding sckets IPC ip6t shim6: ip6tables match rule t catch SHIM6 packets, and send them t the cntrl netfilter queue r t ip6t shim6 data ip6t shim6 data: ip6tables target t shim and deshim data packets Supprting libraries The fllwing libraries are necessary. We recmmend that yu install these frm a surce package because sme f the RPM and DEB packages fr Linux distributins are incmplete (even develpment packages). patch scklibpp with ur IPv6 patch check ut the library frm surefrge s annymus CVS patch, cmpile and install it install cnntrack-tls. This has been tested with versin Hwever, if yur Linux distributin already supprts cnntrack, installatin f cnntrack-tls is nt necessary. install libnfnetlink (versin r later)./cnfigure && make && sud make install

10 Chapter 2: Installatin 8 need a symlink frm /usr/lib/libnfnetlink.s.0 -> /usr/lcal/lib/libnfnetlink.s.0 if yu leave the default prefix. install libnetfilter queue (versin r later) this library requires libnfnetlink (abve)./cnfigure && make && sud make install need a symlink frm /usr/lib/libnetfilter_queue.s.1 -> /usr/lcal/lib/libnetfilter_queue.s.1 if yu leave the default prefix On Fedra Linux, yu need t build with: PKG_CONFIG_PATH=../libnfnetlink /cnfigure... install libnetfilter cnntrack (versin r later)./cnfigure && make && sud make install need a symlink frm /usr/lib/libnetfilter_cnntrack.s.1 -> /usr/lcal/lib/libnetfilter_cnntrack.s.1 if yu leave the default prefix install hal (HIP Abstractin Layer) library prvided in this distributin./btstrap.sh &&./cnfigure && make && sud make install need a symlink frm /usr/lib/libhal-0.1.s -> /usr/lcal/lib/libhal- 0.1.s ip6tables extensins The kernel-level firewall tl fr IPv6, ip6tables, has been extended in tw ways t supprt SHIM6. There is a shim6 match mdule fr receiving SHIM6 cntrl and data packets, and a shim6 data target fr inserting and remving the shim layer frm data packets. 1. build and install bth shim6 ip6tables kernel mdules untar the hip-mdules tarball: cd hip-mdules/ip6t_shim6 make sud ip6tables -L sud insmd -f./ip6t_shim6.k sud insmd -f./ip6t_shim6_data.k 2. build and install the iptables libraries fr extending the ip6tables cmmand this adds a dynamically-laded extensin t yur ip6tables cmmand t supprt the shim6 match and shim6 data target this is really nly needed if yu wish t prperly display the SHIM6 rules r manually mdify them first edit the Makefile s that IP6T_VER matches ip6tables -V; als n Fedra, change LD=ld (fr Ubuntu yu need t use LD=cc) cd hip-mdules/iptables make sud make install ntes: the shared libraries are installed in /lib/iptables/

11 Chapter 2: Installatin 9 The fllwing is perfrmed autmatically by the shim6 daemn, but included here fr reference. setting up a match rule t send SHIM6 cntrl messages t the user-space shim6d daemn: sud ip6tables -A INPUT -m shim6 --cntrl -j NFQUEUE --queue-num 1 setting up an inbund match + target rule t deshim SHIM6 data packets: sud ip6tables -t mangle -A INPUT -m shim6 --data \\ --mcid 0x j shim6_data --cid 0x \\ --src_lc src_ulid --dst_lc dst_ulid setting up an utbund target rule t shim certain flws: sud ip6tables -t mangle -A INPUT --src src_ulid --dst dst_ulid \\ -j shim6_data --cid 0xa1a2a3a4a5a6 --src_lc src_lcatr \\ --dst_lc dst_lcatr 2.3 Installing shim REAP daemn This implements the REAchability Prcess that mnitrs lcal address infrmatin, remte peer status, and takes care f verifying reachability. cmpile the reap daemn cde./btstrap.sh &&./cnfigure && make befre starting reapd, it may be useful t initialize the kernel s iptables and cnnectin tracking: sud ip6tables -F sud mdprbe ng_cnntrack_ipv6 sud cnntrack -F nw yu can run reapd with: sud src/reapd/reapd SHIM6 daemn The SHIM6 daemn implements the SHIM6 prtcl, exchanging SHIM6 cntrl messages and inserting cntext state int the kernel, using bth the REAP daemn and the HAL library. The REAP daemn shuld be running first. cmpile the shim6 daemn cde./btstrap.sh &&./cnfigure && make sud src/shim6d/shim6d the SHIM6 daemn manages the ip6tables rules, s yu d nt need t manually manipulate them; upn nrmal exit, shim6 ip6tables rules are remved

12 Chapter 3: Running shim Running shim6 3.1 Overview shim6 requires tw prcesses and a number f mdules t be running: ip6t_shim6.k (kernel mdule), ip6t_shim6_data.k (kernel mdule), nf_cnntrack_ipv6, (kernel mdule) reapd (user-space prgram), and shim6d If yu perfrmed a make install in the previus installatin step, these executables are likely in yur /usr/lcal/sbin path: Here is a sample list f cmmands that culd be executed: cd /usr/lcal/sbin sud ip6tables -F sud mdprbe nf_cnntrack_ipv6 sud insmd -f./ip6t_shim6.k sud insmd -f./ip6t_shim6_data.k sud reapd sud shim6d Of curse, all f the abve culd be smewhat autmated in an init script. 3.2 Testing shim6 S nw what? shim6 and reap are running, but are they ding anything? Belw are sme initial steps that can be taken t exercise yur implementatin. Nrmal triggering using cnntrack if yu ve installed the cnntrack libraries, shim6d will autmatically receive ntificatins f new IPv6 cnnectins frm the kernel; after 45 packets it will attempt a SHIM6 cntext exchange yu may want t add multiple IPv6 lcatrs t yur netwrk interface befre starting cnntrack tips: sud cnntrack -F (flush the cnntrack table), sud cnntrack -f ipv6 -L (view IPv6 entries) yu culd establish a SHIM6 cntext using ssh, fr example ssh <dst-ulid> after 45 packets, a SHIM6 cntext exchange shuld ccur, and the inbund deshimming rules are installed; the packets flw as usual withut any shim since there is n failure if yu use unidirectinal UDP traffic (fr example a VLC UDP vide stream), yu shuld see SHIM6 keepalives transmitted peridically in the ppsite directin f the flw f traffic

13 Chapter 3: Running shim6 11 nw yu can try blcking ne directin f cmmunicatin t prduce a failure ip6tables -I OUTPUT --dst <dst-ulid> -j DROP after detecting a path failure, reapd will begin its prbing prcess, and chse anther wrking pair if available the previus cnnectin using the ULIDs shuld still be functinal, and nw cntain the shim6 IPv6 extensin header and use a new wrking lcatr pair Debugging prt n UDP Once shim6d is running n bth hsts yu can manually trigger a SHIM6 cntext establishment handshake using a lcal debugging prt (uses the netcat utility): nc -u lcalhst the debugging prt supprts the fllwing cmmands: # dump shim6 cntexts dump # trigger cntext exchange cntext <ipv6-src-ulid> <ipv6-dst-ulid> # manually delete cntext fr the prvided ulids delete <ipv6-src-ulid> <ipv6-dst-ulid> # update cntext (send update and pssibly cause shimming) update <cntext_id> # manually insert mangle rule fr adding an utbund shim shim <cntext_id> <ipv6-src-lc> <ipv6-dst-lc> # manually insert mangle rule fr remving inbund shims deshim <cntext_id>