Julian Padget Tel: x6971, October 12, 2011

Transcription

1 Tel: x6971, Protocols and Applications Acknowledgements: Russell Bradford October 12, 2011 (CS/Bath) October 12, / 30

2 Outline (CS/Bath) October 12, / 30

3 Objectives To introduce some of the core application layer protocols of the internet To illustrate through analysis and example: The use of layers and encapsulation The steady increase in sophistication The composability of protocols thanks to encapsulation The relative simplicity of the key protocols The weaknesses identified in current protocols Hence, create an appreciation of How to design a protocol How to integrate it with the existing internet How to begin a risk assessment of a protocol (CS/Bath) October 12, / 30

4 Remote Access Increasing expectations... telnet simple character-based terminal or process connection ssh secured version of telnet Virtual Private Network (VPN) layer a virtual network over a physical network to provide complete, secured access from remote locations. Deferred until discussion of security (CS/Bath) October 12, / 30

5 Telnet 1/2 Purpose: provide bi-directional, eight-bit byte oriented communications facility. Goal: standard method of interfacing terminal devices and terminal-oriented processes to each other. Vision: terminal-terminal communication ( linking ) and process-process communication (distributed computation) Definition: RFC854, 1983 Usage: telnet [-468ELadr] [-S tos] [-b address] [-e escapechar] [-l user] [-n tracefile] [host [port]] (CS/Bath) October 12, / 30

6 Telnet 2/2 For example: telnet gate.cs.bath.ac.uk, defaults to (TCP) port 23 Or telnet mailhost.zen.co.uk 25, for the SMTP (mail) port Function: relay characters from one end of connection to other (port to port) Insecure: all data (including passwords) readable by machines en-route Now replaced by Secure SHell (CS/Bath) October 12, / 30

7 File Transfer Support for bulk transfer also necessary Original: File Transfer Protocol (FTP) over TCP Secure FTP (SFTP) builds on OpenSSH Operations: get, put, directory manipulation, etc. Replacements/extensions: Remote copy (rcp) builds on OpenSSH, now obsolete Secure copy (scp) builds on OpenSSH Remote sync (rsync) copy/update using file differences Often (some of) these service ports are blocked for security Direct usage now very low: function embedded in HTTP (CS/Bath) October 12, / 30

8 Secure SHell (SSH) Purpose: secure remote login and other secure network services over an insecure network. Definition: RFC4251 (Architecture), notation + terminology + mechanism for local extensions Components: 1 Transport layer (RFC2453): server authentication, confidentiality, and integrity with perfect forward secrecy 2 User Authentication Protocol (RFC4252): authenticates the client to the server 3 Connection Protocol (RFC4254): multiplexes the encrypted tunnel into several logical channels Usage: do man ssh Note: X forwarding Example: ssh gate.cs.bath.ac.uk -l username (CS/Bath) October 12, / 30

9 Components MTA Transport Agent MTC Transport Client Server delivery point for messages Consider three aspects: 1 Sending mail SMTP 2 Spam 3 Fetching mail POP/IMAP (CS/Bath) October 12, / 30

10 Simple Transfer Protocol (SMTP)1/3 Definition: RFC0821, 1982, obsoleted by RFC2821, 2001 Requirements: reliable ordered data stream channel (TCP!) Model: 1 Sender-SMTP establishes a two-way transmission channel to a receiver-smtp. 2 Receiver-SMTP may be destination or intermediate 3 Sender-SMTP sends commands to receiver-smtp 4 Receiver-SMTP replies sender-smtp See [Bradford, 2007] Ch.12 and/or [Stevens, 1993], Ch.28 at com.ezp2.bath.ac.uk/ /ch28 User File System Sender- SMTP SMTP Commands Replies Receiver- SMTP File System (CS/Bath) October 12, / 30

11 SMTP 2/3 SMTP is an old protocol; uses human-readable messages, such as HELO, MAIL FROM, etc. to help in debugging Example session: yourhost.bath.ac.uk ESMTP Postfix 2 HELO myhost yourhost.bath.ac.uk 4 MAIL FROM: me@myhost Ok 6 RCPT TO: you@yourhost Ok 8 DATA End data with <CR><LF>.<CR><LF> 10 Date: Fri, 20 May :37: From: me@myhost 12 To: you@yourhost 13 Subject: sending This is an example Ok: queued as 1BC31201B82 (CS/Bath) October 12, / 30

12 SMTP 3/3 Lines with numbers are from server; function as return codes, indicating success, failure or other states, e.g. 220: service ready 250: success 354: start mail input Other lines are from client; called the envelope HELO: name of client MAIL FROM: send of RCPT TO: intended recipient(s) DATA: start of message End of mail is a lone full-stop (CS/Bath) October 12, / 30

13 Spam Ca perhaps 80% of the world s is bulk unsolicited commercial , also known as spam SMTP was designed/developed in an academic environment: no consideration of authentication The FROM field is useless as it can be anything the sender wants Secure SMTP known as both SMPTS and SSMTP, uses SSL. Secures content in transit no help Spam filtering: Where does mail come from? What does it contain? Keyword matching? Probabilistic matching? (Spam Assassin) application of machine learning (CS/Bath) October 12, / 30

14 Combatting Spam Blacklist: refuse to accept mail from certain addresses. Improve effectiveness by using DNS and Realtime Blackhole Lists (RBLs) to lookup up IP addresses Whitelist: always accept mail from certain addresses. Good for individuals, but not for companies. Greylist: use a whitelist; reply to unknown addresses with a (temporary) delivery failure message, then add address to whitelist with an expiry time. Normal senders wait a bit and re-try, spammers do not bother. Sender Policy Framework (SPF, aka Sender Permitted From): can help against forging the From field. Uses DNS to look up to see if the From address is permitted to send from the actual IP address the came from Domain Keys: use DNS to store public encryption keys that can be used to check signatures on s (CS/Bath) October 12, / 30

15 servers MTC uses SMTP to send mail and POP or IMAP to fetch mail Originally users had one mailbox and used one machine Now situation is very different: want access to multiple mailboxes from anywhere POP = Post Office Protocol IMAP = Internet Message Access Protocol Secure variants exist: SPOP, SIMAP (aka IMAPS) both of which run over SSL/TLS (CS/Bath) October 12, / 30

16 Post Office Protocol (POP) 1/2 RFC1939, Post Office Protocol - Version 3, J.Myers, M.Rose, 1996 There are 24 RFCs in relation to POP (at the time of writing) POP3 works over a TCP/IP connection using TCP on network port 110 POP3 requirements derived from view that a workstation cannot support SMTP and mail delivery continuously and is not permanently connected POP3 supports a maildrop model: download and delete (from server) moving through three states: 1 Authorization: client identification USER, PASS 2 Transaction: client requests server actions (STAT, LIST, RETR, DELE, NOOP, RSET), ending with QUIT 3 Update: release resources and terminate protocol Several optional commands: TOP, UIDL, APOP (CS/Bath) October 12, / 30

17 POP 2/2 Sample transaction: 1 jap@jap-lap2:~> telnet mailhost.zen.co.uk Trying Connected to mailhost.zen.co.uk. 4 Escape character is ^]. 5 +OK smarthost03.mail, Zen Internet POP3 Server Ready 6 USER julian.padget 7 +OK Please enter your pass, with the PASS command. 8 PASS not-a-password 9 -ERR Authentication Failed. 10 Connection closed by foreign host. POP4 adds selected features from IMAP, but appears to be moribund since 2003 (CS/Bath) October 12, / 30

18 Internet Message Access Protocol RFC3501 Internet Message Access Protocol - Version 4rev1, M.Crispin, 2003 There are 56 RFCs in relation to IMAP (at the time of writing) IMAP provides a mailstore facility that assumes extended connectivity Offers greater functionality than POP3: Connected and disconnected modes of operation Multiple clients simultaneously connected to the same mailbox (transactional) Access to MIME message parts and partial fetch Message state information Multiple mailboxes on the server Server-side searches Built-in extension mechanism (CS/Bath) October 12, / 30

19 Over Internet Protocol (VOIP) Origins in Network Protocol (NVP) specification (RFC 741), 1973 US telcos requested the US Congress to ban internet telephony in 1996 Builds on several protocols for different purposes: Session Initiation Protocol (SIP), RFC3261. Used for most standards based in-house and internet telephony (e.g. resnet in bath) H.323 teleconferencing Real Time Protocol (RTP) A combination of UDP and TCP, generally UDP for voice data and TCP for control of the connection is easily digitised and sent on the Internet The marginal cost of internet use is very small compared to that of long-distance calls (CS/Bath) October 12, / 30

20 Addressing in VOIP ITU Electronic Numbering (ENUM) standard unifies telephone numbers and IP domains: A number such as Translates to the E.164 address e164.arpa This resolves to the relevant IP end-point Week tbd: VOIP seminar (CS/Bath) October 12, / 30

21 HTTP HyperText Transfer Protocol (HTTP) is the protocol over which the web works Simple requst-response protocol (originally) Definition: HTTP 1.0 in RFC1945, 1996 Revised and extended: HTTP 1.1 in RFC2616, 1999 Like SMTP, designed for human readability for ease of debugging An example web page request (using HTTP1.0): GET /home.html HTTP/1.0 Host:xanadu:80 Note blank line (instead of lone full stop) at end 80 is the conventional port for the web server (CS/Bath) October 12, / 30

22 HTTP response Header and data Data encapsulated in a MIME block Server communicates information using codes: Successful 2xx: e.g. 200 OK Redirection 3xx: e.g. 301 Moved Permanently Client error 4xx: e.g. 404 Not Found Server error 5xx: e.g. 500 Internal Server Error HTTP/ OK Server: Wombat Server 1.0 MIME-version: 1.0 Content-type: text/html Content-length: 81 Expires: Tue Feb 14 22:57: <html> <head> <title>example</title> </head> <body> Hello world. </body> </html> (CS/Bath) October 12, / 30

23 HTTP mechanics HTTP1.0 opens a new TCP connection for each request One web page may results in many requests (one for each image, for example) High overhead in TCP handshake + teardown Solutions: A persistent connection Share connections between users by a proxy Proxy enables: 1 Security: one point of organization entry/exit 2 Monitoring: collect request data 3 Control: prevent access to specified sites (CS/Bath) October 12, / 30

24 HTTP verbs GET uri: retrieve content identified by uri POST uri content: requests server to accept content as subordinate of uri (subject to local processing) PUT uri content: requests server to store content under uri DELETE uri: requests server to delete content under uri HEAD uri: like GET, but only returns meta-information TRACE: request recipient returns message received body of a 200 (OK) response CONNECT: reserved for use with a proxy that can dynamically switch to being a tunnel, such as SSL HTTP 1.1: supports Chunked Transfer Coding modifies the body of a message to transfer it as a series of chunks, each with its own size indicator. See RFC2616 HTTP/1.1 (CS/Bath) October 12, / 30

25 HTTP Headers Format = <name>: <value> ; four categories: general-header (RFC2616, 4.5) request-header (RFC2616, 5.3) response-header (RFC2616, 6.2) entity-header (RFC2616, 7.1) Session management (response header): Cookie: <attribute> Set-Cookie: <attribute> = <value> Also specify some of: domain, max-age, path, secure, version (required) For example: Content-type: text/html Set-Cookie: foo=bar; path=/; expires Mon, 09-Dec :46:00 GMT Header key for proxy: contains information to enable proxy to forward request (CS/Bath) October 12, / 30

26 HTTPS/SSL HTTP telnet: data can be read by any machine en-route HTTPS ssh: HTTP over an encrypting layer SSL/TLS (detailed discussion under Security) SHTTP is an extension to the HTTP protocol to include security and authentication usage uncommon HTTPS is widely used the padlock sign on the browser for pages requesting confidential data (CS/Bath) October 12, / 30

27 Summary Protocols over protocols all of the above Encapsulation: higher level protocols package up their data to pass it over lower levels (e.g. TCP) Protocols are not adaptable (probably for the better!) and have to be revised, extended, replaced to cope with changed environment Most protocols layer on TCP Most protocols use human-readable commands to help debugging Omissions: File sharing: deferred to discussion of programming frameworks due to use of Remote Procedure Call (RPC) Security: deferred to SSL/TLS, VPNs to Security in order to treat whole topic MIME encapsulation: deferred to discussion of data representation (CS/Bath) October 12, / 30

28 Resources I Never believe one source web standards development, publication of recommendations. Russell Bradford s website: http: //people.bath.ac.uk/masrjb/aocn/links.html RFC0821 Simple Transfer Protocol, J.Postel, 1982 RFC854 Telnet Protocol Specification, J.Postel and J.Reynolds, 1983 RFC1939, Post Office Protocol - Version 3, J.Myers, M.Rose, 1996 (CS/Bath) October 12, / 30

29 Resources II RFC1945 Transfer Protocol HTTP/1.0, T. Berners-Lee, R. Fielding, H. Frystyk, 1996 RFC2616 Transfer Protocol HTTP/1.1, R. Fielding, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, T. Berners-Lee, 1999 RFC2821 Simple Transfer Protocol, J.Klensin (ed), 2001, obsoletes RFC0821 RFC3261 SIP: Session Initiation Protocol, J.Rosenberg, H.Schulzrinne, G.Camarillo, A.Johnston, J.Peterson, R.Sparks, M.Handley, E.Schooler, 2002 RFC3501 Internet Message Access Protocol - Version 4rev1, M.Crispin, 2003 (CS/Bath) October 12, / 30

30 Bradford, R. (2007). The Art of Computer Networking. Prentice Hall. ISBN-13: , on-line resources can be retrieved from Stevens, W. R. (1993). TCP/IP Illustrated, Volume 1: The Protocols. Addison Wesley. Retrieved via Safari at Bath : (CS/Bath) October 12, / 30