Knut Omang Ifi/Oracle 16 Nov, 2015

Transcription

1 RT protocols and Firewall/NAT - SIP FW/NAT support in the Linux kernel Knut Omang Ifi/Oracle 16 Nov, Overview Quick overview of some protocols in use for real-time multimedia SIP/SDP Other protocols that struggles with firewall/nat Details of SIP/SDP Firewall and NAT traversal examples with SIP/SDP IPv6 to the rescue? Firewall and NAT support in the Linux kernel Iptables and ebtables Routing Traffic control using tc qdiscs and filters netem 33

2 Some protocols that struggle with firewall/nat SIP (Session Initiation Protocol) H323 (ITU telecoms standard) Oscar (AIM, ICQ, IChat) Skype MSNP (MSN) XMPP (Jabber, GoogleTalk/libjingle) IPsec (AH/ESP/Tunnel mode) 34 Session Initiation Protocol (SIP) HTTP inspired protocol for session management: Registration/location information Establish (and take down) session Multiple channels (voice,video,ppt,chat, ) Add/remove participants Renegotiate media Forking Bridge to POTS (Plain Old Telephony Systems) Session layer running on top of different protocols (UDP,TCP, ) Increasingly used for IP telephony and video conferencing Lots of equipment available/being developed that uses SIP in some form Also embraced by telecoms by means of IMS 35

3 SIP and firewall/nat STUN, TURN, ICE development driven by SIP community... Still not fully solved with standards Weak ALG implementations complicate Increasing awareness in community With RealTunnel, ICE used with: STUN,TURN tunnelling protocol for cases where STUN/TURN does not provide working candidates 36 H323 and Firewall/NAT Similar problems Somewhat constrained by H323s functionality compared to SIP Deviced solution: H460.x Standards for NAT traversal Supported a.o. with RealTunnel 37

4 Oscar (AIM,ICQ,IChat) and Firewall/NAT Supports most types of firewalls and NATs Similar mechanisms as used for SIP Even tunnelling over https if necessary 38 Skype and firewall/nat Based on software developed for Kazaa Per-to-peer intended for file sharing Gets much for free from P2P.. Proprietary and encrypted Solves NAT traversal with similar strategies as STUN/TURN and tunnelling if necessary Relaying via (and relying on) private users Breakdown in 2007 thought to be due to diminishing number of non-fw/nat ed users 39

5 MSNP (MSN) and firewall/nat RealTunnel used to serve MSN community with free download Had significant user base Microsoft increasingly aware of problem Acquired Skype in 2011 for 8.5$ bn Discontinued old MSN client in 2013 Replaced with Skype.. 40 XMPP and Firewall/NAT Jabber Basis for Googletalk: Implements STUN/TURN/ICE for XMPP(++) 41

6 IPsec AH (Authentication Header protocol) Additional header that authenticates the information in the IP header Ensures that the IP header information is not changed by intermediates.. Does not encrypt payload but checksums it to avoid tampering.. ESP (Encapsulating Security Payload protocol) Encapsulates and encrypts a checksum of the IP payload does not checksum/verify the IP header Tunnel mode: Either or combinations of ESP/AH where the payload is a complete IP packet with its own IP header 42 IPsec and Firewall/NAT AH: Defeats the very purpose of NAT! Any NAT ed packets will be dropped.. ESP: Address modifications may pass Port modifications lead to dropped packets! The port numbers are in the transport headers (UDP/TCP..) which are inside the encrypted payload! 43

7 IPsec and Firewall/NAT (2) NAT-T (RFC 3947,3948) Adds an additional UDP header to ESP packets Defines port 4500 as the ipsec-nat-t port Limited: Requires one side to have destination nat ( static nat) Defines a protocol for exchanging NAT information Problem: DNAT allows a single listener What if multiple VPNs are to communicate across the same NAT devices? Approach requires firewall access not always possible 44 Firewalls and IPv6 Most of the problems remains Open/blocked ports Detecting best path for media UDP/TCP QoS problems 45

8 NAT and IPv6 what will happen? Pros: Avoiding renumbering: when changing Internet provider.. Facilitating multi-homing Use of multiple providers from same domain Topology hiding Preventing host counting by attackers Router scalability IPv6 already old what about host mobility? Cons: End-to-end routability All the complexity of NAT in today s lecture.. Much reconfiguration to do already DHCP, DNS dynamic update Provider independent IP blocks Good for Cisco,Juniper,Nortel (see ao NAT and IPv6 what will happen? 2011: Linux implementation of NAT for IPv6 In mainline kernel from v.3.7 (merged Oct.2012) 47

9 Our simple call example: (now with SIP) Registration : :4560 REGISTER sip:realsip.com REGISTER sip:realsip.com User: per User: ida Our simple call example: (now with SIP) Call: INVITE m=audio RTP/AVP : :5060 INVITE User: per m=audio RTP/AVP User: ida : :

10 A complete SIP dialogue SIP registrar Per Ida INVITE 100 Trying INVITE ACK In call Ida answers ACK BYE BYE 50 A SIP request with SDP INVITE sip:ida@realsip.com SIP/2.0 Via: SIP/2.0/UDP :5061;branch=z9hG4bK From: "per" <sip:per@realsip.com>;tag=1 To: <sip:ida@realsip.com> Call-ID: @ CSeq: 1 INVITE Contact: <sip:per@ :5061> Max-Forwards: 70 Subject: Simple Call Content-Type: application/sdp Content-Length: 186 v=0 o= IN IP s=c=in IP t=0 0 m=audio 6001 RTP/AVP 8 a=rtpmap:8 PCMA/8000 a=rtpmap:101 telephone-event/8000 a=fmtp: ,16 51

11 A SIP request with SDP (received) INVITE SIP/2.0 Via: SIP/2.0/UDP :5060;branch=z9hG4bK-ffdef4f8xc0a80054 Via: SIP/2.0/UDP :5061;branch=z9hG4bK From: "per" To: Call-ID: CSeq: 2 INVITE Contact: <sip:per@ :5061> Max-Forwards: 69 Subject: Simple Call Content-Type: application/sdp Record-Route: <sip: :5060;lr> Content-Length: 186 v=0 o= IN IP s=c=in IP t=0 0 m=audio 6001 RTP/AVP 8 a=rtpmap:8 PCMA/8000 a=rtpmap:101 telephone-event/8000 a=fmtp: ,16 52 A SIP response with SDP SIP/2.0 Via: SIP/2.0/UDP :5061;branch=z9hG4bK Record-Route: <sip: :5060;lr> From: "per" <sip:per@realsip.com>;tag=1 To: <sip:ida@realsip.com>;tag=1 Call-ID: @ CSeq: 2 INVITE Contact: <sip:ida@ :5062;transport=udp> Content-Type: application/sdp Content-Length: 131 v=0 o= IN IP s=c=in IP t=0 0 m=audio 6000 RTP/AVP 0 a=rtpmap:0 PCMU/

12 A SIP response with SDP (received) SIP/2.0 Via: SIP/2.0/UDP :5060;branch=z9hG4bK-ffdef4f8xc0a80054 Via: SIP/2.0/UDP :5061;branch=z9hG4bK Record-Route: <sip: :5060;lr> From: "per" To: Call-ID: CSeq: 2 INVITE Contact: <sip:ida@ :5062;transport=udp> Content-Type: application/sdp Content-Length: 131 v=0 o= IN IP s=c=in IP t=0 0 m=audio 6000 RTP/AVP 0 a=rtpmap:0 PCMU/ A more complex example: Registration RealTunnel servers pear.com: via :23456 gigasoft.com: via :45608 (establish RealTunnel connection) REGISTER sip:pear.com RealTunnel Enterprise proxy (establish RealTunnel connection) User: per@pear.com RealTunnel Enterprise proxy User: ida@gigasoft.com Sip registrar for gigasoft.com Sip registrar for pear.com per@pear.com: via :

13 A more complex example: Registration pear.com: via :23456 gigasoft.com: via :45608 RealTunnel servers RealTunnel Enterprise proxy RealTunnel Enterprise proxy User: REGISTER sip:gigasoft.com User: Sip registrar for gigasoft.com Sip registrar for pear.com via : via : A more complex example: call per@pear.com visiting gigasoft.com Enterprise proxy for gigasoft.com Sip registrar for gigasoft.com 100 Trying Enterprise proxy for pear.com Sip registrar for pear.com Realtunnel servers Ida answers ida@gigasoft.com visiting pear.com ACK sip:ida_url_code@realtunnel.com In call (puh)... 57

14 Skype vs SIP based VOIP? Skype: Proprietary protocol Large user base Easy to use Pushed by Microsoft SIP: Open standard (but loose ) Vendor specific implementations Both proprietary and open clients Lots of hardware and infrastructure: Telecommunication infrastructure, both fixed and mobile Dominant in backbones.. 58 Summary RT multimedia protocols demands good RT QoS - peer to peer! Particularly susceptible to firewalls and NAT Can generate very complex initiation scenarios Linux and firewall/nat Firewalls and NAT Firewalls and NAT can to some extent be characterized potential for issues and problems limited observability in the general case! Lots of protocols exhibit similar problems SIP, H323, Oscar, Skype, XMPP, IPsec No rescue in IPv6. 59

15 Linux packet handling toolbox Packet filtering (iptables,ebtables) Connection tracking (conntrack) Packet classification and traffic shaping/control (tc) Routing/forwarding (ip route) Test tools (netem, tcpdump, wireshark, log targets,...) 60 netfilter packet flow.. 61

16 iptables able to filter where packets are passed at IP protocol level 5 tables: filter, nat, mangle, raw, security filter for typical filtering of packets nat for network address translation FORWARD, INPUT and OUTPUT PREROUTING (incoming) POSTROUTING (forwarded outgoing) OUTPUT (packets coming from the host itself) mangle: modify the packets 62 ebtables similar to iptables but at link layer filter, forward, nat on ethernet addresses send upwards in stack can be used to implement special handling in virtual bridges often IP layer does not see packet at all useful in virtualization: host want's to interfere with bridged traffic from guests 63

17 Linux routing/forwarding ~]# ip route show default via dev eth0 proto static metric /24 dev eth0 proto kernel scope link src metric 100 ~]# ip route show table local broadcast dev lo proto kernel scope link src local /8 dev lo proto kernel scope host src local dev lo proto kernel scope host src broadcast dev lo proto kernel scope link src broadcast dev eth0 proto kernel scope link src local dev eth0 proto kernel scope host src broadcast dev eth0 proto kernel scope link src ip route Table space defined by /etc/iproute2/rt_tables: May add own table names or just use number: ~]# ip route add /24 dev eth0 table 23 ~]# ip route show table /24 dev eth0 scope link # # reserved values # 255 local 254 main 253 default 0 unspec # # local # #1 mytable 65

18 Connection tracking: conntrack Built into all kernels optional user level tool to display: conntrack All connections tracked by the kernel Usable by firewall and NAT functionality Allows optimization to only inspect packets that does not belong to a connection 66 Traffic shaping and control: tc Ability to discriminate traffic Traffic classes Examples: High bandwidth, low latency Allow setup to get resources distributed among usages Prioritize traffic as needed Easy to combine with packet filtering (iptables) 67