Goals of Todayʼs Lecture! IP Addressing! Designing IPʼs Addresses! IP Addressing! Examples! IP Addresses (IPv4)! IP addressing. Address allocation

Transcription

1 Goals of Todayʼs Lecture! IP addressing IP Addressing! Address allocation EE 122 Intro to Communication Networks Fall 2010 (MW in 101 Barker) Scott Shenker TAs Sameer Agarwal, Sara Alspaugh, Igor Ganichev, Prayag Narula http//inst.eecs.berkeley.edu/~ee122/ Materials with thanks to Jennifer Rexford, Ion Stoica, Vern Paxson and other colleagues at Princeton and UC Berkeley 1 Brief security analysis of IP s header design Leftover from last lecture, will cover if have time 2 Designing IPʼs Addresses! IP Addressing! Question #1 what should an address be associated with? E.g., a telephone number is associated not with a person but with a handset Question #2 what structure should addresses have? What are the implications of different types of structure? Question #3 who determines the particular addresses used in the global Internet? What are the implications of how this is done? 3 4 IP Addresses (IPv4)! A unique 32-bit number Identifies an interface (on a host, on a router, ) Represented in dotted-quad notation. E.g, Examples! What address is this? How would you represent

2 What Are Addresses Used For?! Routers! Network uses addresses to figure out where to forward packets Routers are the network devices that forward packets based on IP addresses Router consists of Set of input interfaces where packets arrive Set of output interfaces from which packets depart Some form of interconnect connecting inputs to outputs Router implements Forward packet to corresponding output interface Manage bandwidth and buffer space resources What do switches do? Route on Layer-2 addresses (e.g., MAC addresses) LAN 1! Router router! router! router! LAN 2! 7 8 Forwarding Table! Store mapping between IP addresses and output interfaces Forward incoming packets based on destination address Scalability Challenge! Suppose hosts had arbitrary addresses Then every router would need a lot of information to know how to direct packets toward the host LAN 1! router! router! router! LAN 2! 9 forwarding table! 10 Two Universal Tricks in CS! When you need more flexibility, you add A layer of indirection When you need more scalability, you impose A hierarchical structure Hierarchical Addressing in U.S. Mail! Addressing in the U.S. mail Zip code Street Center Street Building on street 1947 Location in building Suite 600 Name of occupant Scott Shenker Forwarding the U.S. mail Deliver letter to the post office in the zip code Assign letter to mailman covering the street Drop letter into mailbox for the building/room Give letter to the appropriate person??? 11 12

3 Who Knows What?! Does anyone in the US Mail system know where every house is? Separate routing tables at each level of hierarchy Each of manageable scale Hierarchical Structure! The Internet is an inter-network Used to connect networks together, not hosts Natural two-level hierarchy o WAN delivers to right LAN o LAN delivers to right host LAN 1! router! router! router! LAN 2! LAN = Local Area Network! WAN = Wide Area Network! Hierarchical Addressing! Prefix is network address suffix is host address /23 is a 23-bit prefix with 2 9 addresses Terminology Slash IP Address and a 23-bit Subnet Mask! Address! Network (23 bits) Host (9 bits) 15 Mask! Scalability Improved! Number related hosts with same prefix /24 on the left LAN /24 on the right LAN Easy to Add New Hosts! No need to update the routers E.g., adding a new host on the right Doesn t require adding a new forwarding entry LAN 1! /24 router! router! router! LAN 2! LAN 1! /24 router! router! router! LAN 2! / /24 forwarding table! forwarding table! 17 18

4 Original Internet Addresses! First eight bits network address (/8) Last 24 bits host address Assumed 256 networks were more than enough! Next Design Classful Addressing! Class A if first byte in [0..127], assume /8 (top bit = 0) 0******* ******** ******** ******** o Very large blocks (e.g., MIT has /8) Class B first byte in [ ]! assume /16 (top bits = 10) 10****** ******** ******** ******** o Large blocks (e.g,. UCB has* /16) Class C [ ]! assume /24 (top bits = 110) 110***** ******** ******** ******** o Small blocks (e.g., ICIR has /24) o (My house has a /25) Classful Addressing (contʼd)! Class D [ ] (top bits 1110) 1110**** ******** ******** ******** o Multicast groups Class E [ ] (top bits 11110) 11110*** ******** ******** ******** o Reserved for future use What problems can classful addressing lead to? Only comes in 3 sizes Routers can end up knowing about many class C s 21 Todayʼs Addressing CIDR! CIDR = Classless Interdomain Routing Flexible boundary between network and host addresses Must specify both address and mask, to clarify where the network address ends and the host address begins Classful addressing communicate this with first few bits CIDR requires explicit mask 22 CIDR Addressing! Use two 32-bit numbers to represent a network. Network number = IP address + Mask IP Address IP Mask CIDR Hierarchal Address Allocation! Prefixes are key to Internet scalability Addresses allocated in contiguous chunks (prefixes) Routing protocols and packet forwarding based on prefixes Address Mask Network Prefix for hosts Written as /15 or 12.4/ / / / / / / / / / / / / / /17 24

5 Scalability Address Aggregation! Aggregation Not Always Possible! Provider is given /21 Provider ( x x) /21 Provider 1 Provider / / / / / / / /23 Routers in the rest of the Internet just need to know how to reach /21. The provider can direct the Multi-homed customer with /23 has two providers. Other parts of the Internet need to know how to reach these destinations through both providers.! IP packets to the appropriate customer.!! /23 route must be globally visible! Growth in Routed Prefixes ( )! Initial growth super-linear; no aggregation Dot-com implosion; Internet bubble bursts Advent of CIDR allows aggregation linear growth Internet boom multihoming drives superlinear growth Back in business 27 Special-Purpose Address Blocks! Private addresses By agreement, not routed in the public Internet For networks not meant for general Internet connectivity Blocks /8, /12, /16 Link-local By agreement, not forwarded by any router Used for single-link communication only Intent autoconfiguration (especially when DHCP fails) Block /16 Loopback Address blocks that refer to the local machine Block /8 Usually only /32 is used Limited broadcast Sent to every host attached to the local network Block /32 28 Summary of IP Addressing! Scalability Through Non-Uniform Hierarchy Hierarchical addressing Critical for scalable system Don t require everyone to know everyone else Reduces amount of updating when something changes Non-uniform hierarchy Useful for heterogeneous networks of different sizes Class-based addressing was far too coarse Classless InterDomain Routing (CIDR) more flexible 29 Editorial! Internet started with simple addressing design Two-layer hierarchy network and host Addresses in each hierarchy not tied to network topology Address exhaustion led to a less clean design CIDR is based on flexible aggregation Aggregation relies on topological numbering In our design, names were Semantic-free Verifiable Internet addresses violate both of these conditions Spoofing, problems with mobility, etc. 30

6 5 Minute Break! Address Allocation! Questions Before We Proceed? Obtaining a Block of Addresses! Allocation is also hierarchical Prefix assigned to an institution Addresses assigned by the institution to their nodes Who assigns prefixes? Internet Corporation for Assigned Names and Numbers o Allocates large address blocks to Regional Internet Registries o ICANN is politically charged Regional Internet Registries (RIRs) o E.g., ARIN (American Registry for Internet Numbers) o Allocates address blocks within their regions o Allocated to Internet Service Providers and large institutions ($$) Internet Service Providers (ISPs) o Allocate address blocks to their customers (could be recursive) Often w/o charge" 33 Figuring Out Who Owns an Address! Address registries Public record of address allocations Internet Service Providers (ISPs) should update when giving addresses to customers However, records are notoriously out-of-date Ways to query UNIX whois h whois.arin.net http// http// 34 Are 32-bit Addresses Enough?! Not all that many unique addresses 2 32 = 4,294,967,296 (just over four billion) Plus, some (many) reserved for special purposes And, addresses are allocated in larger blocks And, many devices need IP addresses Computers, PDAs, routers, tanks, toasters, Long-term solution (perhaps) larger address space IPv6 has 128-bit addresses (2 128 = 3.403! ) Short-term solutions limping along with IPv4 Private addresses Dynamically-assigned addresses (DHCP) Network address translation (NAT) 35 Network Address Translation (NAT)! Before NAT Every machine connected to Internet had unique IP address Server Internet dest addr src addr src port dst port LAN Clients 36

7 NAT (contʼd)! NAT (contʼd)! Independently assign addresses to machines behind same NAT Usually in address block /16 Use bogus port numbers to multiplex/demultiplex internal addresses Server NAT Internet Clients 37 Independently assign addresses to machines behind same NAT Usually in address block /16 Use bogus port numbers to multiplex demultiplex internal addresses Server NAT Internet Clients 38 Hard Policy Questions! How much address space per geographic region? Equal amount per country? Proportional to the population? What about addresses already allocated? Address space portability? Keep your address block when you change providers? Pro avoid having to renumber your equipment Con reduces the effectiveness of address aggregation Keeping the address registries up to date? What about mergers and acquisitions? Delegation of address blocks to customers? Summary of IP Addressing! 32-bit numbers identify interfaces Allocated in prefixes Non-uniform hierarchy for scalability and flexibility Routing is based on CIDR A number of special-purpose blocks reserved Address allocation ICANN! RIR! ISP! customer network! host Issues to be covered later How hosts get their addresses (DHCP) How to map from an IP address to a link address (ARP) As a result, the registries are often out of date Focus on Sender Attacks! Quick Security Analysis! Ignore (for now) attacks by others Traffic analysis Snooping payload Denial of service Here we look at vulnerabilities sender can exploit 41 42

8 IP Packet Structure! Version Header Length 8-bit Type of Service (TOS) 16-bit Identification 16-bit Total Length (Bytes) 3-bit Flags 13-bit Fragment Offset IP Address Integrity! Source address should be the sending host But, who s checking, anyway? You could send packets with any source you want Why is checking hard? 8-bit Time to Live (TTL) 8-bit Protocol 16-bit Header Checksum 32-bit Source IP Address 32-bit Destination IP Address Options (if any) Payload 44 IP Address Integrity, conʼt! Why would someone use a bogus source address? Launch a denial-of-service attack Send excessive packets to the destination to overload the node, or the links leading to the node But victim can identify/filter you by the source address Evade detection by spoofing Put someone else s source address in the packets o Or use a lot of different ones so can t be filtered Or as a way to bother the spoofed host Spoofed host is wrongly blamed Spoofed host may receive return traffic from the receiver 45 Security Implications of IPʼs Design! Version Header Length 8-bit Type of Service (TOS) 16-bit Identification 8-bit Time to Live (TTL) 8-bit Protocol 16-bit Total Length (Bytes) 3-bit Flags 32-bit Source IP Address 13-bit Fragment Offset 16-bit Header Checksum 32-bit Destination IP Address Options (if any) Payload Security Implications, conʼt! Version field (4 bits).? Issue fledgling IPv6 deployment means sometimes connectivity exceeds security enforcement o E.g., firewall rules only set up for IPv4 Header length (4 bits).? Controls presence of IP options o E.g., Source Route lets sender control path taken through network - say, sidestep security monitoring Non-obvious difficulty IP options often processed in router s slow path o Allows attacker to stress router for denial-of-service Often, today s firewalls configured to drop packets with options. 47 IP Packet Structure! Version Header Length 8-bit Type of Service (TOS) 16-bit Identification 8-bit Time to Live (TTL) 8-bit Protocol 16-bit Total Length (Bytes) 3-bit Flags 32-bit Source IP Address 13-bit Fragment Offset 16-bit Header Checksum 32-bit Destination IP Address Options (if any) Payload

9 Security Implications of TOS? (8 bits)! What if attacker sets TOS for their flooding traffic for prioritized delivery? If regular traffic does not set TOS, then network prefers the attack traffic, greatly compounding damage IP Packet Structure! Version Header Length 8-bit Type of Service (TOS) 16-bit Identification 16-bit Total Length (Bytes) 3-bit Flags 13-bit Fragment Offset What if network charges for TOS traffic and attacker spoofs the victim s source address? (denial-of-money) In general, in today s network TOS does not work Due to very hard problems with billing TOS has now been redefined for Differential Service o Discussed later in course 49 8-bit Time to Live (TTL) 8-bit Protocol 16-bit Header Checksum 32-bit Source IP Address 32-bit Destination IP Address Options (if any) Payload Security Implications of Fragmentation?! Allows evasion of network monitoring/enforcement E.g., split an attack across multiple fragments Packet inspection won t match a signature Offset=0 Nasty-at Offset=8 tack-bytes E.g., split TCP header across multiple fragments Firewall can t tell anything about connection associated with traffic Both of these can be addressed by monitor remembering previous fragments But that costs state 51 Fragmentation Attacks, conʼt! What if 2 overlapping fragments are inconsistent? Offset=0 USERNAME Offset=8 NICE EVIL Offset=8 How does network monitor know whether receiver sees USERNAME NICE or USERNAME EVIL? 52 Fragmentation Attacks, conʼt! Fragmentation Attacks, conʼt! What if fragments exceed IP datagram limit? Offset=65528 NineBytes Maximum size of 13-bit field 0x1FFF = 8191 Byte offset into final datagram = 8191*8 = Length of final datagram = = Result kernel crash Denial-of-service using just a few packets Fixed in modern OS s What happens if attacker doesn t send all of the fragments in a datagram? Receiver (or firewall) winds up holding the ones they receive for a long time State-holding attack 53 54

10 IP Packet Structure! Version Header Length 8-bit Type of Service (TOS) 16-bit Identification 8-bit Time to Live (TTL) 8-bit Protocol 16-bit Total Length (Bytes) 3-bit Flags 32-bit Source IP Address 13-bit Fragment Offset 16-bit Header Checksum 32-bit Destination IP Address Options (if any) Payload Security Implications of TTL? (8 bits)! Allows discovery of topology (a la traceroute) Can provide a hint that a packet is spoofed It arrives at a router w/ a TTL different than packets from that address usually have o Because path from attacker to router has different # hops Though this is brittle in the presence of routing changes Initial value that s picked is somewhat distinctive to sender s operating system. This plus other such initializations allow OS fingerprinting Which in turn can allow attacker to infer its likely vulnerabilities 56 Security Implications of Remainder?! Next Lecture! No apparent problems with protocol field (8 bits) It s just a demux ing handle If value set incorrectly, next higher layer will find packet ill-formed IP Forwarding; Transport protocols Read K&R Similarly, bad IP checksum field (16 bits) will very quickly cause packet to be discarded by the network 57 58