Internet-Praktikum I Lab 3: DNS

Transcription

1 Kommunikationsnetze Internet-Praktikum I Lab 3: DNS Mark Schmidt, Andreas Stockmayer Sommersemester 2015 kn.inf.uni-tuebingen.de

2 Motivation for the DNS Problem IP addresses hard to remember for humans Idea Replace IP address by a hostname But IP address is necessary to contact server Translation required Hostname IP address IP address hostname Requirements Unique hostnames Scalable resolution system In 1980ies hosts file stored on any computer Stores names and IP addresses for all nodes in the Internet Not scalable for millions of nodes Why not centralized name server? Single point of failure Traffic volume Distant centralized database Maintenance Doesn t scale! M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

3 Domain Names Root org edu com net gov mil de fr be ieee kit oracle apple fbi whitehouse uni-tuebingen ccc inria Example: java mail www informatik zdv fsi Hierarchical name space www bib thallo atlas www Entirety of all names can be represented as a tree Divided into several levels of domains and subdomains Domain contains all names in the subtree Uniqueness of names Each domain can delegate subdomains or machine names Names for subdomains or machine names unique M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

4 Structure of the Domain Name System (DNS) Name server resolves domain names into values (e.g. IP numbers) DNS relies on the hierarchy of domain names Zone Domain subtree (connected, but not necessarily complete) which a server keeps own data for Multiple name servers may keep data for the same zone (robustness!) Not equivalent to domain! Name servers know for all subdomains or host names Desired values or Other name server that knows more Root servers Know all name servers for all top-level domains Have well-known IP addresses M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

5 Location of the 13 Root Name Servers Many multiply mirrored and accessible via anycast Actually more than 13 name servers See: M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

6 Control of the Internet Internet Corporation for Assigned Names and Numbers (ICANN) Used to be part of the US Department of Commerce Independent since 2009 Location still in US depends on US law Government of the Internet Manages root name servers Internet Assigned Numbers Authority (IANA) Subdivision of ICANN Controls assignment of Top-level domains IP addresses IP protocol numbers Port numbers M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

7 TLD and Authoritative Servers Root servers Know all name servers for all top-level domains Top-level domain (TLD) servers Responsible for com, org, net, edu, etc, and all top-level country domains uk, fr, ca, jp, de. VeriSign maintains servers for com TLD Educause for edu TLD Authoritative DNS servers Name servers providing authoritative information from their own databases Usually maintained by organization or service provider M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

8 DNS Resolvers and Local Name Servers DNS resolver Software module implementing DNS protocol Resolves DNS names to IP addresses Used by hosts and name servers Endhosts DNS resolver configured with local name server(s) Performs recursive queries Local (caching) name server Name resolution requires IP address list of current root servers Maintenance overhead, should be avoided on endhosts Does not strictly belong to hierarchy Each ISP (residential ISP, company, university) has one Accepts recursive queries and performs iterative queries M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

9 Recursive Queries Puts burden of name resolution on contacted name server Requires state in servers Heavy load? 2 root DNS server TLD DNS server local DNS server dns.poly.edu requesting host cis.poly.edu authoritative DNS server dns.cs.umass.edu gaia.cs.umass.edu M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

10 Iterative Queries Host at cis.poly.edu wants IP address for gaia.cs.umass.edu Contacted server replies with name of server to contact I don t know this name, but ask this server Local DNS server performs iterative query to process recursive query issued by host local DNS server dns.poly.edu requesting host cis.poly.edu root DNS server TLD DNS server 6 authoritative DNS server dns.cs.umass.edu gaia.cs.umass.edu M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

11 Recursive and Iterative Queries Pure recursive queries do not exist in reality In the query chain usually only the first step is a recursive query Name servers accepting recursive queries perform iterative queries Exception: DNS-Proxies like Dnsmasq or builtin DNS servers of consumer DSL routers both accept and perform recursive queries 2 recursive steps in those cases DNS Root-Servers or TLD Servers never accept recursive queries Authoritative name servers usually do not allow recursive queries or only accept them from selected clients Authoritative-Only name servers do not process queries for names outside their own zones M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

12 DNS: Caching and Updating Records Once (any) name server learns mapping, it caches mapping Cache entries timeout (disappear) after some time TLD servers typically cached in local name servers Root name servers not often visited DNS intended for static mappings Dynamic DNS (DynDNS, DDNS) for dynamic mappings Short timeouts ( TTL =60 s) Useful when IP address frequently changes DynDNS client requires to update authoritative name server May be done by DHCP Heart beat mechanism needed to detect when host is down M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

13 Paketformat DNS is mostly UDP based (Port 53) More efficient, no handshake/teardown required DNS-Header: Query ID, number of entries in the following fields, additional control information (recursion, authority, truncated payload, error codes, etc.) Queries: Consists of DNS-names (e.g. and record type of the query (e.g. A, MX, PTR) Answer- / Authority- / Additional-Resource Records (RRs) One or more RRs containing the requested DNS information Names of the authoritative (responsible) name servers Additional RRs not explicitly requested (e.g. matching A- or AAAA-RRs for queried NS- or MX-RRs) M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

14 Resource Records (RR) Format: Resource Record A (Address) AAAA NS MX (Mail Exchanger) CNAME (Canonical Name) PTR (Pointer) TXT (Text) SRV (Service) Description IPv4 address for a name IPv6 address for a name Responsible name server (Incoming) -server for a domain Alias name Name for an IP address Text (used for SPF) Name and port number of server responsible for a service M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

15 DNS Example: A and MX Records http IP address for (local name server) 5. A dns1.uni-tuebingen.de (authoritative name server) Root name server 3. de NS a.nic.de a.nic.de A uni-tuebingen.de NS dns1.uni-tuebingen.de dns1.uni-tuebingen.de A de TLD name server 1. mail to: menth@uni-tuebingen.de 2. MX for uni-tuebingen.de? dns1.uni-tuebingen.de (authoritative name server) 4. smtp uni-tuebingen.de MX 500 mx03.uni-tuebingen.de mx03.uni-tuebingen.de A M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

16 DNS: Reverse Lookup Objective: get name for IP address Operation Special subtree in DNS in-addr.arpa Used for mapping IP-address-to-name Every IP address corresponds to entry below in-addr.arpa Hierarchical structure Every part of IP address corresponds to a node in the tree DNS query Uses PTR record Contains reversed IP address arpa in-addr M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

17 DNS: Example IPv4 address DNS name in query in-addr.arpa Result (Answer RR) IPv6 address 2a02:2e0:3fe:100::6 DNS name in query e.f e a.2.ip6.arpa Result (Answer RR) Useful Tool: M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

18 Examples dig +norecurse ; <<>> DiG <<>> +norecurse ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3 ;; QUESTION SECTION: ; IN A ;; ANSWER SECTION: IN CNAME text.wikimedia.org. ;; AUTHORITY SECTION: wikimedia.org IN NS ns0.wikimedia.org. wikimedia.org IN NS ns1.wikimedia.org. wikimedia.org IN NS ns2.wikimedia.org. ;; ADDITIONAL SECTION: ns1.wikimedia.org IN A ns2.wikimedia.org IN A ns0.wikimedia.org IN A ;; Query time: 2 msec ;; SERVER: #53( ) ;; WHEN: Thu Nov 18 18:48: ;; MSG SIZE rcvd: 166 M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

19 Examples dig wikipedia.org mx ; <<>> DiG <<>> wikipedia.org mx ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 3 ;; QUESTION SECTION: ;wikipedia.org. IN MX ;; ANSWER SECTION: wikipedia.org IN MX 50 lists.wikimedia.org. wikipedia.org IN MX 10 mchenry.wikimedia.org. ;; AUTHORITY SECTION: wikipedia.org IN NS ns1.wikimedia.org. wikipedia.org IN NS ns2.wikimedia.org. wikipedia.org IN NS ns0.wikimedia.org. ;; ADDITIONAL SECTION: ns0.wikimedia.org IN A ns2.wikimedia.org IN A ns1.wikimedia.org IN A ;; Query time: 3 msec ;; SERVER: #53( ) ;; WHEN: Thu Nov 18 18:47: ;; MSG SIZE rcvd: 189 M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

20 Security DNS was originally designed at a time, when security considerations were of low priority due to the small number of users DNS messages are do not contain digital signatures Recipients can not verify authenticity The hierarchical structure of DNS leads to a massive impact when a name server in one of the top levels is compromised Political problem: Who controls the root servers/zone M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

21 Security: Examples DNS spoofing Rogue name server sends forged reply (faster than the real name server) DNS cache poisoning Exploiting vulnerabilities in DNS software, to inject manipulated non-authoritative data in caching name servers Google: Dan Kaminsky + DNS + Exploit/Bug M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS

22 DNSSEC DNSSEC: Security-Extensions (RFC 4033) Introduces cryptographic mechanisms in DNS Public-Key hierarchy alongside the DNS hierarchy Root-Zone signed since 2010 New RRs for DNSSEC: Name DS Content Hash of the key for a zone DNSKEY Public key of a zone RRSIG NSEC NSEC3 Digital signature of another RR Pointer to the next signed RR (to proof non-existence of RRs in between) Replacement for NSEC, using a hashes instead of names, to prevent zone walking M. Schmidt, A. Stockmayer: Internet-Praktikum I, SS