TSIN02 - Internetworking

Transcription

1 Lecture 6: Autoconfiguration Literature: Forouzan: ch 15: Application layer and Client-Server Model Forouzan: ch 17: BOOTP, DHCP Forouzan: ch 18: DNS RFC2642: IPv6 Stateless Address Autoconfiguration RFC3927: Dynamic Configuration of IPv4 Link-Local Addresses RFC3315: DHCPv6 (optional extra material) RFC2131: DHCPv4 (optional extra material) RFC2608: Service Location Protocol, Version 2 (optional extra material) 2004 Image Coding Group, Linköpings Universitet

2 Lecture 6: Autoconfigurarion Goals: Know parameters needed to setup a node for IPv4 or IPv6 communication Know some different strategies to do this: Manual configuration Centralized static configuration Centralized dynamic configuration Zero configuration Finding services Know how it can scale to larger networks The Service Location Protocol Framework 2

3 Lecture 6: Autoconfiguration Outline: Application layer basics ARP/ RARP Network parameters & DNS BOOTP DHCP Message types Options Msg exchange example Zeroconf IPv6 Address structure DHCPv6 Stateless address autoconfiguration Service Discovery Abstract vs specific services Service Location Protocol (SLP) 3

4 Application Layer Basics In the TCP/IP stack the application layer covers the top three layers of the OSI-model. 4

5 Clients and Servers A client is a program that requests services from another program. Uses active open when requesting service Active close when finished A server is a program that provides services to another program. Uses passive open to listen for requests. Figure from Forouzan 5

6 Client-server Relationship Figure from Forouzan 6

7 Concurrency Clients can be run on a machine iteratively, ie one at a time, or concurrently, ie more than on in parallel. Connection can be connectionless (UDP) connection oriented (TCP) Servers can (in theory) be connectionless iterative (using UDP) connectionless concurrent connection-oriented iterative connection-oriented concurrent (using TCP) 7

8 Connectionless Iterative Server Figure from Forouzan 8

9 Connection-oriented concurrent server Figure from Forouzan 9

10 review: ARP (over Ethernet) ARP Address resolution protocol. (RFC 826) Dynamically maintain a cache of mappings: IP# Link-local MAC-address (6bytes) An ARP package has the following format: Hardware Type (Ethernet: 0x1) Hardware length (0x6) Protocol length (0x4) ProtocolType (Ipv4 0x8) Request (1) or Response (2) Op Sender hardware address (MAC S ) Sender protocol address (IP S ) Target hardware address (MAC T ) Target protocol address (IP T ) ARP(Op, MAC S, IP S, MAC T, IP T ) 10

11 ARP cont. Resolving an IP# using ARP. Host IP S doesn t know the mapping IP T MAC T. ARP(1, MAC S, IP S, 0, IP T ) broadcast ARP(2, MAC T, IP T, MAC S, IP S ) Receiver of ARP request also updates its own ARPcache with the sender fields of the received package. IP S IP T 11

12 Proxy ARP A kind of routing can be had between two subnets using proxy ARP IP 3 A-net 1. ARP(1, MAC 1, IP 1, 0, IP 2 ) 2. ARP(1, MAC 3B, IP 1, 0, IP 2 ) broadcast B-net broadcast MAC 3A MAC 3B 3. ARP(2, MAC 2, IP 2, MAC 3B, IP 1 ) 4. ARP(2, MAC 3A, IP 2, MAC 1, IP 1 ) IP 1 IP 2 12

13 Gratuitous ARP A host can broadcast ARP requests for itself: ARP(1, MyMAC, MyIP, 0xffffff, MyIP) There are two uses for this: A host can check for misconfigurations. I.e., does any other host use my IP#? In that case host will get an ARP reply and can log an error report. When the network interface card is changed (and the corresponding MAC) a host can broadcast this change on the net forcing updates in all ARP-tables. 13

14 Reverse Address Resolution - RARP When host A don t know its own IP# it can broadcast the RARP request: ARP(3, MAC A, 0, MAC A, 0) The RARP server B answers with unicast: ARP(4, MAC B, IP B, MAC A, IP A ) RARP only really handles local networks since it doesn t convey information about the subnet mask in use and gateway IP. RARP is not used at all in Ipv6. ARP functionality is built in into ICMPv6. 14

15 Parameters for IP configuration The typical parameters needed for an end host to enable IP communications are: The IP-address (A) The netmask (M) Addresses B not matching the mask is sent to the gateway ( (B & M )!= (A & M) ). Otherwise use ARP and find host B on local network. The gateway P Typically ( 0x1 (A & M) ) What an unconfigured host can do is broadcast Can use (broadcast on all attached interfaces) (A & M) ( ^ M) for specific interface 15

16 Domain Name System - DNS The DNS service is a crucial component of the Internet. IP-numbers are sometimes difficult to use. People don't want to remember IP numbers Nodes may change their IP addresses. Subnets may be restructured and netmasks changed. Networks switch to other operators. DNS is a global distributed database letting us have persistent identifications of hosts, services and to some extent also data. 16

17 DNS - name space The name space of the Internet is divided into three different sections Figure from Forouzan 17

18 Domain Names and Labels Figure from Forouzan 18

19 Hierarchy of Name Servers Figure from Forouzan 19

20 DNS messages Query for: address name server host information services etc Responce to queries DNS messages can be sent through UDP (if less than 512 bytes) or TCP (otherwise) 20

21 Query and Response Messages Figure from Forouzan 21

22 Recursive Resolution Figure from Forouzan 22

23 Iterative Resolution Figure from Forouzan 23

24 Manual configuration A host can of course be manually configured with IP, netmask, gateway and DNS. This is not so hard if host needs to be manually configured with further software etc. But the drawbacks are apparent: In large networks a scheme is needed anyway. Why not automate it? Ease network topology changes. We can focus on subnetting and configuring routers. Hosts manage themselves! A host might not even have persistent memory (Diskless clients, printers etc.) making manual configuration impossible! Hosts may be added, removed or moved around on different subnets. 24

25 Bootstrap Protocol - BOOTP Defined in RFC951 (1985). BOOTP allows us to have the autoconfiguration service running over the normal IP stack 1 = BOOTREQUEST, 2 = BOOTREPLY This is encapsulated in UDP to port 68. The request is broadcast (IP target host ) The reply goes to port 68 and may be unicast, but then the bootp server need to update the ARP-table itself. However the reply can be broadcast in which case the TransactionID resolves simultaneous requests. Figure from Forouzan Options might contain subnet mask, time, time servers, DNS servers, print servers, host name etc. Also some vendors have registered fields. 25

26 BOOTP operation Figure from Forouzan 26

27 BOOTP Additional notes To achieve robustness BOOTP... uses UDP checksum option client uses timers and retransmission. Retransmission timer is in the order of seconds more... Timer is randomized to avoid network jam right after e.g., a power failure. A relay agent can be used to BOOTP normally reside in read-only/flash memory in diskless clients BIOS. The TFTP protocol (RFC1350) is usually used to fetch the OS image given in the Boot File Name field. 27

28 BOOTP Implementation Notes A BOOTP server typically has a static table where each host s MAC-address is mapped to IP# (Typically in a file /etc/ethers) The Server IP field tells of the next server to use if on a disk-less client (typically TFTP of kernel image) 28

29 BOOTP Shortcomings BOOTP doesn t solve the problem with hosts moving around! Let s say we have a /24 subnet (255 nodes). Visiting hosts are possibly more numerous. We want to be able to withdraw IP# Hosts actively releasing their IP# Time-out mechanisms for when IP# are automatically withdrawn. Hosts need to be able to renew their IP# lease. Host may need information about lots of servers. This requirements are fulfilled by... 29

30 Dynamic Host Configuration Protocol DHCP for IPv4 See RFC2131 DHCP is backwards compatible with BOOTP: A BOOTP client can request a static configuration from a DHCP server. Same well-known port numbers are used The message format is the same Unused -field is now Flags. Only LSB is used (client enforce broadcast reply) More options than BOOTP 30

31 DHCP Option DHCP message type Mandatory in every DHCP message Client Server DHCPDISCOVER (1) broadcast to locate servers DHCPREQUEST (3) requesting offered parameters etc. DHCPDECLINE (4) indicate address already in use DHCPRELEASE (7) release network address DHCPINFORM (8) ask for parameters but not IP# (1997) Server Client DHCPOFFER (2) server s response to DHCPDISCOVER DHCPACK (5) confirm client s now has lease DHCPNACK (6) tell client its IP# is expired/incorrect 31

32 DHCP Message exchange example server (not selected) client broadcast server (selected) Determines configuration DHCPDISCOVER Collect replies DHCPDISCOVER Determines configuration DHCPOFFER DHCPOFFER Sees that request does not match offer. (May now release internal lock) Select configuration DHCPREQUEST broadcast DHCPREQUEST DHCPACK Commits to previous offer DHCPRELEASE Discard release 32

33 DHCP State Transition Diagram Figure from Forouzan 33

34 DHCP More Options Standard options for BOOTP/DHCP are listed in RFC2132 Routers DNS servers Time servers Printer servers Log servers Swap servers Mail servers (SMPT) POP3 servers NIS servers Font servers (X-Windows) MobileIP Home Agents Broadcast address ARP cache timeout val Ethernet 2 / IEEE802.3 TTL values Forwarding flag Source route policy Plus many more... 34

35 Zero Configuration Simple ad-hoc network scenario. Hosts are connected to a local network. No special RARP/DHCP server exist. How to configure hosts with unique IP#? Answer: RFC3927 Formally what Windows and Mac already do Picks random addresses from subnet /16 Randomization should give same sequence between boots (e.g., use MAC-address for seed) Use ARP-probes to check for collisions ARP(1, MyMAC, 0, 0xffffff, MyRandomIP) Defend once if active TCP connections etc. 35

36 IPv6 Addressing The address is 128 bits long (16 bytes) Example notation: FE80:BA98:0074:3210:000F:BBFF:0000:FFFF may be abbrevated: FE80:BA98:74:3210:F:BBFF:0:FFFF Globally routable unicast addresses have the Provider Identifier Subscriber Identifier Subnet Identifier Node Identifier 010 Registry INTERNIC RIPNIC APNIC Pick MAC-address here! 36

37 IPv6 Address Autoconfiguration Two methods Stateful DHCPv6 requests Stateless Address Autoconfiguration In IPv6 routers periodically send Router Advertisements (ICMPv6) Stateful autoconfiguration available or not Other stateful parameter configuration available Various timing values. >>> Prefix Information <<< 37

38 DHCPv6 (RFC3315) Uses multicast (FF02::1:2, FF05::1:3) Simpler message structure: 8 24 msgtype transactions-id options (variable) Requires globally unique identifiers of clients and hosts (DUID DHCP Unique Identifier). These can be constructed from MAC-addresses. Client uniquely identifies network interfaces. 38

39 DHCPv6 Message Types Client Server SOLICIT (1) locate servers REQUEST (3) request parameters from a specific server CONFIRM (4) confirm that address is still appropriate RENEW (5) try extend lifetime of assigned addresses REBIND (6) follows an unresponsive RENEW. Get other parameters RELEASE (8) tell server we don t use one or more addresses DECLINE (9) tell server one or more addresses already seem in use INFORMATION REQUEST (11) Request configuration params without IP# Server Client ADVERTISE (2) server s ready to serve. Response to SOLICIT REPLY (7) general reply message. May contain configuration parameters RECONFIGURE (10) tell client it needs to RENEW 39

40 DHCPv6 Additional Notes Not so many options yet. Client DUID, Server DUID, Client interface ID IPv6 address + lease time (obviously such an option!) Rapid transaction option (two messages) Security! DHCPv6 may use IPSec Authentication option (works both ways) DNS configuration option: RFC3646 (servers and domain lists) Some more options on draft stage in the dhc working group. Time, NIS, timezones, tunnels, boot images etc. 40

41 IPv6 Stateless Address Autoconfiguration RFC2462 Similar to zeroconf we form an link-local address and run the Duplicate Address Detection scheme. IPv6 link-local prefix: FE80::0. Put the hardware interface s address (length N) in the rightmost N bits. Maximum allowed hardware address length 118bits. (Note: there exist a 64-bit standard hardware addressing system) Listen for router advertisements and the Prefix Information field. Use these prefixes to form (possibly many) routable addresses! (global and site) 41

42 IPv6 Prefix Delegation Taking it one step further... Work is underway to enable autoconfiguration of IPv6 addresses for whole network topologies. See draft, Requirements for IPv6 prefix delegation on the ipv6 working group page. An expired draft (2000) can be found at 6ants.net Routers search for delegating routers via a multicast query. It picks one delegating router and sends an initial request requiring a prefix of needed length Delegating answers responds with a prefix which querying router may use till it expires 42

43 Service Discovery Problem statement: How to automatically find a host responsible for running a particular service? Many protocols uses broadcast or registered multicast addresses for sending requests to a server with unknown unicast address, IGMP, RARP, BOOTP, DHCP, MADCAP, SIP Services may broadcast their existence. Typically used in file/printer sharing networks broadcast storms in large networks Directory services which summarizes available services (NIS, Novell Directory Service, Microsoft Active Directory, Apple Open Directory). Not only shares and printers but also hosts in general and user authentication information. 43

44 Service Discovery cont. Two generic mechanisms for discovering services can be found in IETF s working groups A new DNS resource record type SRV has been defined in RFC2782. I.e., the DNS server can be queried for needed services. The Service Location Protocol defined by the svrloc (now concluded) working group. This mechanism allows for queries of abstract services (explained later) as well as LDAP (Light Weight Directory Access Protocol) filtering based on predefined attributes for services Of these two methods the DNS SRV seems to survive. For instance Windows 2000 uses the scheme when looking for active directories. 44

45 The DNS SRV Resource Record [_Service._Proto.Name TTL Class SRV Priority Weight Port Target] _Service _Proto Name TTL Class A service name as defined by IANA, See A protocol from the same namespace as above. Typically _TCP or _UDP DNS-domain name (32 bits) For how long the record can be cached (in seconds) Network class (1 = Internet) SRV The Resource Record string identifier (type# = 33) Priority Weight Port Target (16 bits) Client must try to pick serving host with lowest value (16 bits) When client finds several services of the same priority it picks one with a probability proportional to the weight value. Port number the service is running on DNS domain name of serving host 45

46 DNS SRV Example Example of a DNS table entry for fictional service foobar (from the RFC.) $ORIGIN SOA server.example.com. root.example.com. ( ) NS server.example.com. NS ns1.ip-provider.net. NS ns2.ip-provider.net. ; foobar - use old-slow-box or new-fast-box if either is ; available, make three quarters of the logins go to ; new-fast-box. _foobar._tcp SRV old-slow-box.example.com. SRV new-fast-box.example.com. ; if neither old-slow-box or new-fast-box is up, switch to ; using the sysdmin's box and the server SRV sysadmins-box.example.com. SRV server.example.com. server A old-slow-box A sysadmins-box A new-fast-box A ; NO other services are supported *._tcp SRV *._udp SRV

47 Service Location Protocol Framework Services may be abstract or specific. abstract Printing services File sharing services Naming & directory services specific lpr: SMB printers IPP NFS SMB shares CIFS Andrew FS The Service Location Protocol ver. 2 (RFC2608) approaches the matter of finding services in a general manner. (proposed standard...) Can search for abstract as well as specific services Can have parametrical restrictions on services we want to know about. I.e. All printers with printer-color-supported to true Open Directory JAVA JNDI NIS Active Directory 47

48 svrloc Service Request (SrvRqst) SLP common header Length of <PRList> Length of <service-type> Length of <scope-list> Length of <predicate> Length SPI <PRList> <service-type> (string) <scope-list> <predicate> BSD=0x0002 <PRList> <service-type> <scope-list> <predicate> <SPI> Previously responding servers. An URI-style service (E.g., http ftp telnet ) or a service: specifier. The new service: specifier let us have abstract services: Example: service:printer:, service:naming-directory A list of groups we accept services from. Example: DEFAULT, SALES_DEPT An LDAPv3 search filter expression. (RFC2254) Denote authentication style needed. Currently BSD=0x0002 corresponding to DSA/SHA1 signatures is used. 48

49 svrloc Service Reply (SrvRply) SLP common header Error Code URL Entry count <URL entry 1>... <URL Entry N> SA ( Service Agent) answers (unicast) with a list of URL:s matching the Service Request. A client might get a Directory Agent Advertisement (DAAdvert) as an answer. This tells the client of a service:directory-agent://<addr> which could be a super-agent for other services. We can unicast new queries directly to DA:s. 49

50 svrloc Message Exchange Example 2. Answer with SrvRply Services might earlier have registered with DA via SvrReg messages 4. Answer with SrvRply 1. Multicasts a SrvReq request 3. Not satisfied. Multicast a new SrvReq with previously answering servers in <PRList> 5. This machine was a little slow but keeps track of many services. We send a DAAdvert message SvrReg 50

51 IETF Working Groups dhc Dynamic Host Configuration DHCPv4 DHCPv6 DHCP Options and BOOTP Vendor Extensions ipv6 IP version 6 Addressing Architecture Stateless Address Autoconfiguration dnsext DNS Extensions DNS SRV Resource Records svrloc Service Location Protocol (Note: concluded) SLPv1, SLPv2 IANA schemes for service: URI:s 51

52 The future - UPnP? Universal plug and play - each entity can automatically find IP address, learn about services in the network and announce its own services. The Universal Plug and Play Forum - a group of more than 700 vendors that define specifications for UPnP devices Current architecture - a set of application level protocols running on top of TCP/IP. 52

53 Summary RARP and BOOTP have shortcomings. Dynamic Host Configuration Protocol (DHCP) is most versatile for IPv4 autoconfiguration. Many options for locating various servers etc. Zero-configuration scheme exists as draft for IPv4. Zero-configuration of link-local IPv6 addresses on Standards Track. In IPv6 use Router Advertisements to get prefixes to link-local address making it site-local / global. Use DHCPv6 for total administrative control. Automatic service location via DNS SRV Resource Records or Service Location Protocol. UPnP - the future? 53