IPv6 Concepts. Improve router performance Simplify IP header Align to 64 bits Address hierarchy with more levels Simplify routing tables

Transcription

1 IPv6 Concepts Tópicos Avançados de Redes 2016/2017 Why IPv6? 2 Lack of IPv4 addresses Imply NAT, or other solutions; Realm Specific IP (RFC3102) Improve router performance Simplify IP header Align to 64 bits Address hierarchy with more levels Simplify routing tables Improve Mobile IP support from 1998!!!, and obsoleted RFC1883 from 1995 RFC 2460 Internet Protocol, Version 6 (IPv6) Specification See also updates

2 Headers 3 V6 (40 bytes) Ver(4) Class (8) Flow Label (20) Payload Length (16) Next Header (8) Hop Limit (8) Source Address (128) Destination Address (128) V4 (20+ bytes) Ver(4) IHL(4) DSCP (8) Total Length (16) Identification (16) Flags(4) Frag Offset (12) TTL (8) Protocol (8) Header Checksum (16) Source Address (32) Destination Address (32) Options Padding IPv4 Header Format 4 TAR 2016/17 -IPv6 intro - pbrandao

3 Header: fields I 5 Ver protocol version(=6) Class IPv4 s ToS Flow Label flow identification; Unique for each flow for the (src,dst) pair Payload length data size Limited to = bytes, but there there s option for JumboDatagrams <= 2 32 bytes Header: fields II 6 Next Header type of next header Hop-by-Hop Options (the only header that is examined by intermediate nodes) Routing Header Destination Options Header Fragment Header Authentication Header Encrypted Security Payload Header Even transport layer headers Hop Limit IPv4 sttl IPv4 checksum removed, as lower layers are responsible for verification.

4 Header: fields III 7 Header order for defined extensions: IPv6 header Hop-by-Hop Options header Destination Options header (processed by 1 st dst and Routing Header addresses) Routing header Fragment header Authentication header Encapsulating Security Payload header Destination Options header (processed by dst) Upper-layer header Extension Headers 8 IPv6 header next header = Hop-by-Hop options Hop-by-Hop options next header = Destination options Destination options next header = Routing header Routing header next header = Fragment header Fragment header next header = AH AH next header = ESP header ESP header next header = Destination options Destination header next header = upper-layer PDU upper-layer PDU (TCP/UDP/ICMP/..) TAR 2016/17 -IPv6 intro - pbrandao

5 Addresses bits 665,570,793,348,866,943,898,599 addresses Represented in hexadecimal Ex. 1528:8653:294c:0000:0000:90af:0900:7654 Zeros may be aggregated by :: Ex.: 1528:8653:294c::90af:900:7654 Only one :: in an address Masks are the same as for IPv4 CIDR Loopback address ::1 /128 Combining IPv6 and IPv4 addresses ::ffff: (IPv4mapped address) :: (IPv4compatible address) 2002: ::1 (6to4 address) per m 2 on Earth See RFC5952 for text representation Addresses: Unicast 10 Loopback ::1 /128 Link-local: Only used in the local link (not routed by routers) FE80::/64 (last 64 bits are device identifier) Device identifier define in: RFC4291 Appendix A Site-local (deprecated see RFC 3879): Used within the same site, and therefore only valid therein FEC0:0000:0000:<Subnet(16)>:<Interface(64)> Global address Internet routable address. 2000::/3 But there can be routable IPv6 addresses out of this range (see RFC3587)

6 Addresses: Aggregation 11 F P Public Topology Site Topology R TLA ID E NLA ID SLA ID Interface ID S RFC 2374 An IPv6 Aggregatable Global Unicast Address Format FP Format Prefix (001) RES Reserved para future use TLA Top Level Aggregator NLA Next Level Aggregator SLA Site Level Aggregator Interface ID Addresses: Aggregation II 12 Global routing prefix Subnet ID Interface ID n bits 64 n bits 64 bits RFC3587 changed the aggregation Address Policy left for Regional Internet Registries (RIRs) Maintains the normal structure of RFC 4291

7 IPv6 Address Types 13 Address Type Binary Prefix Prefix unspecified (128 bits) ::/128 loopback (128 bits) ::1/128 link-local unicast FE80::/10 multicast FF00::/8 Global unicast all other addresses TAR 2016/17 -IPv6 intro - pbrandao Addresses: multicast 14 Multicast: With different scopes Flags scope Group ID bit multicast scope value used to limit the scope of the multicast group. The values are as follows: 0 reserved 1 Interface-Local scope 2 Link-Local scope 3 Realm-local scope 4 Admin-Local scope 5 Site-Local scope 6 (unassigned) 7 (unassigned) 8 Organization-Local scope 9 (unassigned) A (unassigned) B (unassigned) C (unassigned) D (unassigned) E Global scope F reserved

8 8 bits Multicast Addresses 4 bits 4 bits 8 bits 8 bits 64 bits 32 bits RPT scope reserved plen net prefix group id flags T=0 permanently-assigned ( well-known ) address, T=1 non-permanently-assigned ( transient ) Scope 1 node-local 2 link-local 5 site-local 14 global (Internet) Group ID identififes the mulicast group within the given scope. For example: 1 all nodes (scope = 1,2) 2 all routers (scope = 1,2,5) 101 all NTP servers Examples: FF02::101 all NTP-servers on the same link as a sender FF02::2 all routers on the same link as a sender FF05::101 all NTP-servers on the same site as a sender TAR 2016/17 -IPv6 intro - pbrandao Addresses: multicast examples 16 All Nodes Addresses: ff01:0:0:0:0:0:0:1 ff02:0:0:0:0:0:0:1 The above multicast addresses identify the group of all IPv6 nodes, within scope 1 (interface-local) or 2 (link-local). Interface-local is single itf, used for loopback All Routers Addresses: ff01:0:0:0:0:0:0:2 ff02:0:0:0:0:0:0:2 All NTP servers on the internet ff0e:0:0:0:0:0:0:101

9 Addresses: other 17 Anycast address Defined in more than one interface, but delivered only to one. Same structure of unicast Only uses prefix (n bits) and 128-n bits for anycast address Unspecified address :: Used only during configuration Required addresses (RFC4291#2.8) 18 Node: link-local for each interface loopback all-nodes multicast Solicited-Node multicast address for each of its unicast and anycast addresses Configured unicast, anycast Multicast that the node belongs to Router: All of the node s (above) Subnet-Router Anycast for router interfaces All-Routers multicast

10 19 ICMPv6 Control Protocol(s) 20 IPv4 Control Protocols: ARP (for Ethernet) ICMP DHCP? IGMP IPv6 Control Protocol: ICMPv6 (IPv6 Next Header value = 58) Must be fully implemented & supported! TAR 2016/17 -IPv6 intro - pbrandao

11 ICMPv6 21 Internet control message protocol for IPv6 RFC 4443 Type defines the type J And code can be used to further detail the type Ex.: Type = 1 (Error code for destination unreachable) Code = 0 (no route to destination) Errors have the high-order bit type = 0 (0-126) Informational are Type(8) Code(8) Checksum (16) Message content (length depends on type) ICMPv6 Neighbour Discovery 22 RFC 4861 Incorporates ARP (Address Resolution Protocol, IPv4) functionalities Plus auto-configuration helper functions Extensible: messages may have options for added information IP Hop limit: set to 255, so that routed packets (less than 255) are discarded by nodes on the validation step (see RFC4861#7.1.1)

12 ICMPv6 ND: Router Discovery 23 For discovering routers on the link and possibly address information Router solicitations (sent by Hosts) Sent to the link-local all-routers multicast address Type = 133, code = 0 ICMPv6 ND: Router Discovery 24 Router advertisements Sent by routers in response to solicitations sent to unicast address of requester unsolicited sent to link-local all-nodes multicast address Advertise: net prefix, default router(s), MTU Type=134, code = 0

13 ICMPv6 Neighbour Discovery 25 Neighbour solicitation Sent by hosts or routers Used for: Address resolution, neighbour unreachability detection (NUD) and duplicate address detection (DAD) Type=135, code = 0 Type(8) Code(8) Checksum (16) reserved Target address (128) Option: source link-layer address ICMPv6 Neighbour Discovery 26 Neighbour solicitation (cont.) Target address: IP address of the solicitation target IP destination address: solicited-node multicast address corresponding to the target address, or the target address itself (e.g., for NUD) IP source address: address of the interface where the packet is sent, or unspecified address for DAD The option source link-layer address of sender MUST NOT be present if unspecified address is used

14 ICMPv6 Neighbour Discovery 27 Neighbour advertisement Sent by hosts or routers, in response to solicitations or unsolicited. Type=136, code = 0 Target address: For solicited: same as in solicitation For unsolicited: IP address that changed link-layer address Option: source link-layer address of sender Type(8) Code(8) Checksum (16) R S O Reserved (29) Target address (128) Option: target link-layer address Solicited-Node Address (RFC4291#2.7.1) 28 Multicast address Prefix: ff02:0:0:0:0:1:ff00::/104 Add the low-order 24 bits of an address (unicast or anycast) Example: Unicast address: 4037::01:800:200e:8c6c Solicited Address: ff02:0:0:0:0:1:ff0e:8c6c Advantages of this with regards to ARP?

15 Auto Configuration 29 Stateless Configuration (RFC4862) 1. Generating link-local address 2. Generating global address(es) 3. Performing duplicate address detection (DAD) Based on Router Advertisements Uses advertised prefix and MAC addr. of interface Valid only for /64 networks What if no router advertisements? Are link-local enough? For what? Auto Configuration Address 30 Source: The IPv6 Protocol, By Mauro Tortonesi

16 DNS? 31 RFC 6106: IPv6 Router Advertisement Options for DNS Configuration Type(8) Length(8) Reserved (16) Lifetime Addresses of IPv6 Recursive DNS Servers Type: 25 Length: indicates the length of the option and thus the number of DNS servers advertised Duplicate Address Detection 32 RFC 4862#5.4 Used after address auto-configuration to confirm uniqueness of address Node sends neighbour solicitation with: Src address: unspecified Dst address: solicited-node multicast address of the tentative address Target address: the address being checked

17 Duplicate Address Detection II 33 Receiving Neighbour Solicitation Target address is the tentative address If src address is unicast (not a DAD): ignore packet If src address is unspecified: other node wants to use same address (is performing DAD) No node will use the address Receiving Neighbour Advertisement Target address is the tentative address Address is not unique 34 Other layers

18 DHCPv6 RFC Stateful configuration Uses UDP (as DHCPv4) DHCP clients use link-local address DHCP servers listen (join) special multicast group ff05::1:3 Relay agents relay between different links ff02::1:2 Also uses DAD for address uniqueness DHCPv6 36 Accommodate messages for partial information Information-Request Ex.: retrieve only DNS and NTP servers (no address configuration) DUID: DHCP Unique Identifier Used by clients and servers to uniquely identify each other Not all messages require the ID Authentication based on authentication for DHCPv4 (RFC3315#21)

19 DHCPv6 Some messages 37 SOLICIT (1): A client sends a Solicit message to locate servers. ADVERTISE (2): a server sends an Advertise message to indicate that it is available for DHCP service, in response to a Solicit message [ ]. REQUEST (3): A client sends a Request message to request configuration parameters, including IP addresses, from a specific server. REPLY (7): A server sends a Reply message containing assigned addresses and configuration parameters in response to a Solicit, Request, Renew, Rebind message received from a client. A server sends a Reply message containing configuration parameters in response to an Informationrequest message. A server sends a Reply message in response to a Confirm message confirming or denying that the addresses assigned to the client are appropriate to the link to which the client is connected. A server sends a Reply message to acknowledge receipt of a Release or Decline message. INFORMATION-REQUEST (11): A client sends an Information-request message to a server to request configuration parameters without the assignment of any IP addresses to the client. DHCPv6 Information 38 Carried in options Example: RFC3646: DNS Configuration options for DHCPv6 Option_DNS_Servers (16) Option-len (16) DNS-recursive-name-server (IPv6 address) Option_DNS_Servers: 23 Option-Len: multiple of 16

20 DNS 39 Options for client configuration (RFC4339) Router Advertisements DHCPv6 Well known anycast address DNS changes for IPv6 (RFC3596) 40 AAAA new record type IPv6 address IPv6 AAAA query Returns all IPv6 addresses associated with domain name IP6.ARPA domain (similar to IPv4's in-addr.arpa) For reverse queries IPv6 è name Existing query types NS, SRV, MX: re-defined to return also AAAA entries

21 DNS in IPv4 and IPv6 41 BCP91/RFC3901 Maintain IPv4 and IPv6 accessible DNS recursive server IPv4 only or dual stack At least one IPv4 reachable server per DNS zone 42 IPv6 in an IPv4 world

22 IPv6 in an IPv4 world 43 Problem is incompatibility For hosts and routers: header of IPv6 vs. IPv4 For applications: Socket API of IPv6 is different ( RFC 3493) Compatibility maintained for IPv4 addresses Use of the IPv4 mapped address: ::ffff:<ipv4-address> Also for applications RFC6535 Bump-In-the-Host BIH hides IPv6 and makes the IPv4-only applications think they are talking with IPv4 peers by local synthesis of IPv4 addresses IPv6 in an IPv4 world: solutions 44 Dual stack nodes (RFC 4213) Support both IPv4 and IPv6 Routers must maintain both routing tables, protocols, etc. Configured Tunneling (RFC 4213) The tunnel endpoints encapsulate the original IPv6 in an IPv4 packet Using their addresses as source/destination Tunnel endpoints (routes) are manually configured Referred as 6in4

23 IPv6 in an IPv4 world: tunnelling 45 Image from [CiscoIPv6ABC] IPv6 in an IPv4 world: solutions 46 6to4 Tunnel (without explicit setup) (RFC 3056) Use of 2002:V4ADDR::/48 networks V4ADDR is the IPv4 address of the entry router Routers advertise these prefixes on local IPv6 networks Sites may have connection to IPv6 only networks Or use 6to4 relay routers for this connectivity These relay routers can have an IPv4 anycast address of (RFC3068)

24 6to4 components 47 Router B host B IPv6 backbone 4fe1:300:/32 6to4 relay router IPv4 backbone Site B Connection to IPv6 backbone 6to4 relay Router A 6to4 Router C 2002:09fe:fdfd::/48 4fe1:1345:/ :c001:0203::/48 host A Site A Based on [MHS] Site c host C 6to4 Components: II 48 Router B Connects to IPv6 backbone Has a native IPv6 address (not 2002::/16) Does not handle IPv4 6to4 Router C Connects to IPv4 backbone Has a 6to4 IPv6 address Has a native IPv4 address Does not relay packets to the IPv6 backbone 6to4 relay Router A Connects to IPv4 backbone Connects to IPv6 backbone Has a 6to4 IPv6 address Has a native IPv6 address (not 2002::/16) Has a native IPv4 address

25 IPv6 in an IPv4 world: ISATAP 49 Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) (RFC 5214) Connects dual-stack nodes over IPv4 networks Uses entire IPv4 network as a link layer (NBMA) Defines locators (mappings) on interfaces that are used to route packets Potential router lists obtained through DNS doing a lookup for isatap.<domain> (or some other means) For sending Router Solicitations and communication with the public IPv6 Internet IPv6 address: <net id>:0000:5efe:<ipv4 address> IPv6 in an IPv4 world: Teredo (RFC 4380) 50 Teredo allows automatic IPv6 tunneling between hosts that are located across one or more IPv4 NATs Encapsulates IPv4 packets in UDP using port 3544 More overhead (use only if previous techniques are infeasible) Use of 2001:0000::/32 for Teredo clients 2001:0000:<teredo server IP address>:<flags (16)>: <mapped UDP port>:<client IPv4 address> Discovers and maintains NAT mappings to the client Components: Client: has IPv4 connectivity, wants IPv6 Server: to discover external address and type of NAT Relay: forwards traffic using the Teredo encapsulation on IPv4 and to the IPv6

26 IPv6 in an IPv4 world: Teredo 51 Image from Microsoft Technet article IPv6 in an IPv4 world: solutions 52 Stateless IP/ICMP Translation (SIIT) (RFC 6145) Translates IPv4óIPv6, including ICMP Addresses translations are defined as per RFC 6052) NAT64 (RFC 6146) Uses DNS64 and a NAT gateway to proxy connections Image from Wikipedia NAT64

27 IPv6 in an IPv4 world: solutions 53 And several others See Wikipedia IPv6 transition mechanisms There s also the other way around 4in6 - RFC2473: Generic Packet Tunneling in IPv6 IPv6 IPv4 54 The end

28 Acronyms IPv6 55 CIDR Classless Inter-Domain Routing FP Format Prefix NAT Network Address Translation NLA Next Level Aggregator SLA Site Level Aggregator ToS Type of Service TLA Top Level Aggregator TTL Time To Live Sources 56 The IPv6 Protocol, por Mauro Tortonesi IPv6 Fundamentals, por John Barlow [MHS] Hesham Soliman, Mobile IPv6: Mobility in a Wireless Internet, 2004 Pearson Education [CiscoIPv6ABCs] The ABCs of IP Version 6, Cisco IOS LEARNING SERVICES, 2002