Internet Protocol Version 6: advanced features. The innovative aspects of IPv6

Transcription

1 Internet Protocol Version 6: advanced features The innovative aspects of IPv6 1

2 Autoconfiguration Addresses are composed by Information held by routers (network address) Information locally available (interface identifier) Addressing space: usually received from the provider Switching provider implies changes in addressing space A protocol is needed to address assignment and propagation of configuration information, and it should be designed for: making esier to re-number the machines avoiding manual configuration (Plug and Play) avoiding the use of servers, for small sites managing: Link Local Address Site Local Address Global Address What we need to configure Host, Routers, DNS, applications (e.g. web server, IP-based licenses, access lists,...) 2

3 Stateless autoconfiguration for hosts (1) Basic configuration Generate a local address Probing to verify its uniqueness The host can communicate with all the machines within its own LAN, without router intervention If a router exists It si possible to listen to Router Advertisement messages (or) to send a Router Solicitation message Configuration and probing the uniqueness of the address Router advertisement with 2 network prefixes 3

4 Stateless autoconfiguration for hosts(2) The host is always listening to router messages A host can be re-configured at run time Renumbering is easier For example, it is possible to switch from a link local to a global address State of addresses Preferred Deprecated (invalid) 4

5 Duplicate Address Detection Needed to test the uniqueness of an IPv6 address For example, it used to verify the uniqueness of a configures address Procedure MAC+IPv6 related to the IPv6 address to verify are merged This phase does not requires any packet A IPv6 multicast packet is sent with the information of the address to be verified Waitfora responseforat least1 sec If no answer is received, the address is considere valid Start the phase of router discovery 5

6 Host autoconfiguration: stateful DHCPv6: client/server model Compatible with stateless autoconfiguration Possible messages: Solicit Advertise Request Reply Release Reconfigure 6

7 Autoconfiguration for routers Router Renumbering (RFC 2894) Router Renumbering packets they include PCOs (Prefix Control Operations) Match-Prefix: specifies the operation Use-Prefix They are transported in ICMPv6 packets Two types of Router Renumbering messages Commands: sent to the routers Results: sent by routers as responses to commands 7

8 Autoconfiguration and privacy The least significant 64 bits in an IPv6 address never change, when obtained with stateless configuration Privacy problems (es. traceability) RFC 4941, Privacy Extensions for Stateless Address Autoconfiguration in IPv6 Algorithm Stateless address (64 bit) + 64 bit random number (or previous privacy address) MD5 is computed over the previous result The most significant 64 bits are selected, and the bit 6 (universal/local) is set to 0 ( local ) The result is used as interface identifier This value is stored o be used in the next address configuration Each host may have several different address ( default and privacy ), used to accept/generate connections The address selection may available to the user, through some suitable API 8

9 DNS DNS: Domain Name System Distributed data base It associates IP addresses and names The atomic element in DNS is the resource record (RR) Record: type A (canonical): used for 32 bit addresses type AAAA: ised for 128 bit (RFC1886) addresses IP6.INT domain It is possible to specifiy the type ANY in a query, in order to receive both type A and type AAAA records (if they exist) It is up to the application to select which one to use (modified application) 9

10 Neighbor discovery ARP no longer present in IPv6, its functions included in ICMP: Router Discovery Prefix Discovery Parameter Discovery: used to determine parameters such as MTU of the link or default hop limit Address Autoconfiguration Neighbor Discovery Neighbor Unreachability Detection Duplicate Address Detection Next-Hop Determination Redirect 10

11 Mapping IPv6 addresses over Ethernet Two different solutions for unicast and multicast Given an IPv6 Unicast address, compute the MAC address of the station Problem similar to the ARP in IPv6 Given ad IPv6 multicast address, compute the MAC multicast address of the destination IPv6 multicast address FF... Last 32 bits of the IPv6 address MAC multicast address 3333 Last 32 bit of the IPv6 address 11

12 Esemples of mapping Description IPv6 address MAC address All Nodes Address FF02:0:0:0:0:0:0: All Routers Address FF02:0:0:0:0:0:0: IPv6 multicast address (IPv6 multicast solicited node) FF02::1:FFA8: FF-A

13 Solicited node IPv6 multicast address It is a specific multicast address, which (likely) only one node can respond to Used to limit the scope of the multicast packet It is likely that the packet will be examined only by a limited number of stations (possibly only one) IPv6 multicast is in turn mapped onto Ethernet multicast The addresses are formed as follows: Solicited node IPv6 multicast address 127 FF02::1 32 FF 24 Last 24 address bits of the target IPv6 address 0 Solicited node MAC multicast address FF + Last 24 address bits of the target IPv6 address 0 13

14 Search of the destination MAC address Algorithm An ARP-like request is sent to the solicited node IPv6 multicast address of the target station In IPv4 broadcast is used, IPv6 tends to limit the number of stations addressed, as much as possible The target host send a response using a unicast message Example: search of the MAC address for the host 2001::1 Neighbor Solicitation message addressed to FF02::1:FF00:1 Neighbor Advertisement response message 14

15 IPv6 packet forwarding Similar to IPv4 Longest prefix match: If the destination is local: find the MAC address with a Neighbor Solicitation If the destination is remote: select a router among those learned through Router Advertisement A cache is used to store the most recent MAC addresses (similar to ARP) 15

16 The host cache C.IP H.IP L.IP D.IP Destination Cache Neighbor Cache R1.IP R1.Eth R2.IP R2.Eth Default Router List C.IP C.Eth Prefix List FE80:0:0:0:0::/80 FEC0:0:0:0:3::/ :600:0:C00:3::/80 16

17 Scoped addresses 17

18 Why a scope is required? application socket TCP/UDP IPv6 DL DL PHY PHY FE80::0237:00FF:FE02:a7FD FE80::0237:00FF:FE02:a7FD 18

19 Sintax A scoped address is composed by an IPv6 address followed by a % by a number identifying the the interface Example: FE80::0237:00FF:FE02:a7FD%19 The value of the scope is selected according some internal criterion 19

20 Neighbor Reachability Detection New entry Incomplete The neighbor discovery has detected a link layer address The node has received a neighbor advertisement message with flag S=1 Reachable Reachability confirmed for 30 sec Reachability not confirmed. The entry is removed Probe An upper layer protocol has confirmed the reachability of this destination Stale The entry has been for 5 sec in the Delay state Delay A packet needs to be sent to this destination 20

21 Communication algorithm Longest prefix match If the destination is reachable directly I already know its prefix (it is the same as mine) I need to find the MAC address I need to send the packet to a router Neighbor cache Used when it is necessary to detrmine the next hop in the path If not present, a neighbour discovery procedure is triggered 21

22 Security Standard in IPv6 Key distribution Photuris (zero-knowledge key exchange) Based on Diffie-Hellman protocol Authentication Keyed MD5 Encryption DES-CBC See from RFC 2401 to RFC

23 Security and IPv6 addresses Network scanning DDoS More difficult, from a theoretical point of view. because the larger number of combinations available (64 bits per LAN) In reality, it is possible to used tricks to shrink the address space to be scanned Addresses are assigned sequentially ( from ::1 on) Stateless address qutoconfiguration (48 bits to be scanned) Hosts with sequential MAC addresses (once one is found, all the others have similar MACs) Start scanning with known OUI (NIC manufacturers 24 bit) IPv6 addresses derived from IPv4 ones Often, an IPv6 host uses dual stack, hence it is possible to scan the IPv4 space Address harvesting, used to find addresses to be used as "seeds" Host published in DNS Analysis of log files of an host (e.g tracker P2P, web server) An attacker may use several different addresses from the same machine (potentially, a whole /64) 23

24 Nomadicity and Mobility Nomadicity Need to be always connected, anywhere, using different technologies and administrative domains Solved with stateless and stateful mechanisms of IPv6 Mobility Possibility to keep your identity (traceability and reachability) in autonatica way (transparent to the user) and with continuous service Thos requires to keep the same address, regardless of the physical position Addressed by Mobile IPv6 24

25 Mobility and layer 2 networks A layer 2 network (e.g. Switched Ethernet) provides some support for mobility The backward learning mechanism in the switches is able to precisely locate each host at MAC layer Layer 3 protocols use multicast messages (ICMPv6 Neighbor Solicitation) to locate hosts within the LAN If the mobility is restricted to a layer 2 network, it is not necessary a more sophisticated architecture, such as Mobile IPv6 Example: company with internal telephony based on VoIP 25

26 Routing mechanism in IPv6 Destination network based If we move the machine (without adjusting its address), it becomes unreachable The forward path is still valid Net B Net A To: B:1 address B:1 To: B:1 Address A:1 To: A:1 To: A:1 Net C Address B:1 26

27 Mobile IP vs. Mobile IPv6 (1) There is no need to deploy special routers as "foreign agents", as Mobile IPv4. Mobile IPv6 operates in any location without any support required from the local router. Support for route optimization is a fundamental part of the protocol, rather than a nonstandard set of extensions. Mobile IPv6 route optimization can operate securely even without pre-arranged security associations. It is expected that route optimization can be deployed on a global scale between all mobile nodes and correspondent nodes. Support is also integrated into Mobile IPv6 for allowing route optimization to coexist efficiently with routers that perform "ingress filtering" [26]. The IPv6 Neighbor Unreachability Detection assures symmetric reachability between the mobile node and its default router in the current location. 27

28 Mobile IP vs. Mobile IPv6 (2) Most packets sent to a mobile node while away from home in Mobile IPv6 are sent using an IPv6 routing header rather than IP encapsulation, reducing the amount of resulting overhead compared to Mobile IPv4. Mobile IPv6 is decoupled from any particular link layer, as it uses IPv6 Neighbor Discovery [12] instead of ARP. This also improves the robustness of the protocol. The use of IPv6 encapsulation (and the routing header) removes the need in Mobile IPv6 to manage "tunnel soft state". The dynamic home agent address discovery mechanism in Mobile IPv6 returns a single reply to the mobile node. The directed broadcast approach used in IPv4 returns separate replies from each home agent. 28

29 Routing protocols Inside the same autonomous system RIPng OSPFv3 29

30 6bone network 30