Download presentation
Presentation is loading. Please wait.
1
「我國IPv6建置發展計畫」 92年度期中成果報告 研究發展分項計畫
子計畫二：6TANET 台灣IPv6網路轉換環境技術研究 子計畫二：6TANET 台灣IPv6網路轉換環境技術研究 「我國IPv6建置發展計畫」 92年度期中成果報告 研究發展分項計畫 子計畫二：6TANET 台灣IPv6網路轉換環境技術研究
2
子計畫二：6TANET 台灣IPv6網路轉換環境技術研究
東華大學 趙涵捷 1 IPv6 第四層以上相關協定分析 交通大學 陳懷恩 2 超高速乙太網路 IPv6/IPv4 轉換器之研製 台灣大學東華大學 郭斯彥 陳俊良 3 可穿越 NAT 的 IPv6 Tunnel 吳坤熹 4 以 IPv6 為基礎的隱匿型網路偵測管理 台灣科技大學 黃忠偉 張瑞雄
3
IPv6 第四層以上相關協定分析 陳懷恩 Research Assistant Professor
Department of CSIE, NCTU TEL:
4
計畫目標 分析常見的第四層以上通訊協定，在由 IPv4 演進到 IPv6 時所需要改變的差異性
提供廠商移植IPv6軟體時之參考，以加速國內IPv6軟硬體研發，實現國內IPv6網際網路環境，促使我國儘速邁入IPv6資訊網路新紀元
5
計畫工作重點 研讀並分析相關通訊協定 製作IPv6通訊協定分析器雛形 設計廠商升級IPv4程式到IPv6程式的機制
網路應用協定、網路路由協定、網路管理協定 SIP-based VoIP相關協定 製作IPv6通訊協定分析器雛形 製作通訊協定分析器雛形 分析第二、三層封包(e.g., Ethernet, IPv4, IPv6) 分析SIP-based VoIP相關協定(e.g., SIP, SDP, RTP, RTCP) 設計廠商升級IPv4程式到IPv6程式的機制 提供廠商修改Socket程式的方法 設計v4/v6轉換之中介軟體
6
計畫成果 提供IPv4程式轉換為IPv6程式之方法 提供IPv6協定分析器 設計主機端轉換之中介軟體(Middleware)
第四層以上之程式多由socket撰寫而成 本計畫提供如何將現有IPv4程式修改成IPv6的方法 提供IPv6協定分析器 提供開發程式、教育訓練時之輔助 設計SIP-based VoIP專屬的分析器 設計主機端轉換之中介軟體(Middleware) 修改現有程式需要時間、人力、金錢 提供廠商在不修改程式的情況下快速轉換程式為IPv6的方法 以Bump-In-the-Stack (BIA)為基礎 設計應用層(Application-Level)轉換機制
7
提供轉換IPv4程式到IPv6之方法 介紹IPv4與IPv6之不同 不用轉換的Socket API 需要轉換的Socket API
需要轉換的資料結構
8
IPv4/IPv6位址長度不同 Numerical addresses IPv4, 32 bit address
32 bits IPv4 IPv6 128 bits
9
不需要轉換的Socket API (依序) Server端的程式碼 Client端的程式碼 socket open a socket
bind bind local address to the socket listen listen on a port accept wait for the connection read/write if TCP recvfrom/sendto if UDP Client端的程式碼 socket open a socket connect connect to a server read/write if TCP recvfrom/sendto if UDP
10
轉換需要改變的部分 有一些與IP位址相關的Socket API與參數需要修改 程式部分有運用到IP位址的部分 位址轉換函式 位址複製函式
位址比較函式 位址相關之記憶體指派與變數宣告
11
API與資料結構的轉換 參數名稱轉換 IPv4 IPv6 inaddr6_any AF_INET AF_INET6 PF_INET
12
API與資料結構的轉換 資料結構轉換 IPv4 IPv6 in_addr in6_addr sockaddr sockaddr_in6
13
API與資料結構的轉換 資料結構參數轉換 IPv4 IPv6 sin_len sin6_len sin_family sin6_family
sin_port sin6_port sin_addr sin6_addr s_addr s6_addr
14
API與資料結構的轉換 函式轉換 IPv4 IPv6 inet_aton() inet_addr() inet_pton()
Name-to_address Functions inet_ntoa() inet_ntop() getipnodebyname() getipnodebyaddr() getnameinfo() getaddrinfo() gethostbyname() gethostbyaddr() Address conversion Functions
15
設計主機端轉換之中介軟體 可是要將應用程式升級成IPv6會有以下問題 例子：SIP-based VoIP User Agent
需要改用新的 API 需要改用新的 Data structure 例子：SIP-based VoIP User Agent 共有約200行Socket API、資料結構需要轉換 約有600行位址相關函式、變數、記憶體指派需要修改 短期內將程式升級IPv6不容易 需要改的函式、變數需要追蹤修訂 程式版本升級時，亦需隨之修訂 提出一個轉換v4/v6的中介軟體，以 BIA為基礎，設計應用層轉換機制
16
轉換中介軟體系統架構
17
轉換中介軟體之設計 依不同程式所需 設計ALG 原BIA之架構
18
提供IPv6相關協定分析器 提供Windows XP/2003上通訊協定分析 可協助本計畫之開發 未來可協助廠商開發相關應用
可分析以下協定： Ethernet, ARP, ICMP/ICMPv6, IPv4/IPv6 DNS, HTTP, FTP SIP, SDP, RTP, RTCP 可協助本計畫之開發 未來可協助廠商開發相關應用 可提供教育訓練(如：通訊改進教育計畫)使用
19
WinPCap Protocol Driver / NPF
IPv6通訊協定分析軟體架構與介面 封包分析軟體 libpcap Interface WinPCap winpcap.dll Packet Interface Device IO Control WinPCap packet.dll WinPCap Protocol Driver / NPF Windows NDIS Physical NICs
20
IPv6通訊協定分析軟體之設計 Packet Module 負責封包收送 Parsing Package負責第二、三層封包解析
IPv6 Module Transport Module SIP RTP RTCP Parsing Package Packet Module
21
IPv6通訊協定分析軟體之雛形系統 選取介面 封包分析
22
計畫結論 目前已有IPv6相關Socket程式，建議廠商開發軟體時，可以考慮撰寫IPv4/IPv6共存之應用程式。
目前設計之應用層轉換以工研院SIP-based UA作為實際v4/v6轉換的例子，若需要進一步資料，歡迎會後與本子計畫聯繫。 本子計畫將繼續v4/v6轉換之研究，以期能幫助國內廠商在節省人力、時間與金錢的情況下，快速升級至IPv6 ready。
23
Teredo - Tunneling IPv6 through NATs
Date: Speaker: Quincy Wu National Chiao Tung University
24
IPv4–to–IPv6 Transition Strategy (RFC 2893)
Dual Stack Reduce the cost invested in transition by running both IPv4/IPv6 protocols on the same machine . Tunneling Reduce the cost in wiring by re-using current IPv4 routing infrastructures as a virtual link. Translation Allow IPv6 realm to access the rich contents already developed on IPv4 applications
25
Tunnels of IPv6 over IPv4 Transport Header IPv6 Header Data IPv6 Host IPv6 Host Dual-Stack Router Dual-Stack Router IPv4 IPv6 Network IPv6 Network Tunnels are often used in networking to overlay a non-compatible functionality over an existing network. When tunneling IPv6 traffic over an IPv4 network, one edge router encapsulates the IPv6 packet inside an IPv4 packet and then the other router decapsulates it, and vice-versa. This enables the connection of IPv6 islands without the need to also convert the backbone to IPv6. There are two issues when tunneling: The MTU is effectively decreased by 20 octets (if the IPv4 header does not contain any optional field). A tunnelled network is often difficult to troubleshoot. Tunneling is a transition technique that should be used where it is appropriate and should not be considered as a final architecture. Native IPv6 architecture should be the target architecture. Tunnel: IPv6 in IPv4 packet Transport Header IPv4 Header IPv6 Header Data Encapsulating the IPv6 packet in an IPv4 packet Tunneling can be used by routers and hosts
26
Manually Configured Tunnel
Dual-Stack Host Dual-Stack Router IPv4 IPv4: IPv6: 2001:288:03a1:210::3/127 IPv4: IPv6: 2001:288:03a1:210::2/127 FreeBSD4.7# gifconfig gif ifconfig gif0 inet6 2001:288:03a1:210::2 2001:288:3a1:210::3 prefixlen 128 FreeBSD is IPv6-ready. You can manually configure an IPv6 tunnel with these commands.
27
Linux Tunnel /etc/sysconfig/network-scripts/ifcfg-sit1 ifup sit1
DEVICE=sit1 BOOTPROTO=none ONBOOT=yes IPV6INIT=yes #Remote end-ISP IPv4 addr IPV6TUNNELIPV4= #Yourself IPv6 tunnel addr from ISP IPV6ADDR=2001:288:3A1:210::2/127 ifup sit1
28
6to4 Tunnel (RFC 3056) 6to4 Tunnel: 6to4 Router1 6to4 Router2 IPv4
IPv6 Network IPv6 Network E0 E0 Network prefix: 2002:83F3:812C::/48 Network prefix: 2002:8C6E:C7FA::/48 = = The example shows one of the many possible 6to4 tunnel scenarios. It shows Cisco routers connecting IPv6 domains using the 6to4 mechanism. Router1 has the IPv4 address From this IPv4 address, the site 6to4 prefix used for the internal IPv6 network is 2002:c0a8:6301::/48, which can be used subnetted in a site with many subnetworks. The router interface is configured on subnet 1 (SLA = 0x0001) so the interface is assigned the IPv6 address 2002:c0a8:6301:1::/64 with the EUI-64 interface ID. The router 6to4 tunnel interface tunnel0 has no IPv4 or IPv6 address specifically configured for it. It uses the Loopback0 IPv4 address, as the source address for the tunnel. The destination address is unspecified since it is constructed automatically. As packets are forwarded from its internal network to the 6to4 cloud, the router generates a new tunnel with the IPv4 destination used from the IPv4 address embedded inside the IPv6 address of the IPv6 packet being forwarded. The command tunnel mode ipv6ip 6to4 identifies a 6to4 tunnel. Depending on the routing domain and topology, route entries should be added. Except in special cases, the routing entry shown is generally needed to forward all 2002: packets through tunnel0. Router2 has a similar configuration for its end. router2# interface Ethernet0 ip address ipv6 address 2002:8C6E:C7FA:1::/64 eui-64 interface Tunnel0 no ip address ipv6 unnumbered Ethernet0 tunnel source Ethernet0 tunnel mode ipv6ip 6to4 ipv6 route 2002::/16 Tunnel0 6to4 Tunnel: Is an automatic tunnel method Gives a prefix to the attached IPv6 network 2002::/16 assigned to 6to4 Requires one global IPv4 address on each site
29
6to4 Tunnel 2002:8C6E:C7FA:2::5 2002:83F3:812C:1::3 6to4 Router1
IPv4 IPv6 Network IPv6 Network E0 E0 Network prefix: 2002:83F3:812C::/48 Network prefix: 2002:8C6E:C7FA::/48 IPv4 SRC The example shows one of the many possible 6to4 tunnel scenarios. It shows Cisco routers connecting IPv6 domains using the 6to4 mechanism. Router1 has the IPv4 address From this IPv4 address, the site 6to4 prefix used for the internal IPv6 network is 2002:c0a8:6301::/48, which can be used subnetted in a site with many subnetworks. The router interface is configured on subnet 1 (SLA = 0x0001) so the interface is assigned the IPv6 address 2002:c0a8:6301:1::/64 with the EUI-64 interface ID. The router 6to4 tunnel interface tunnel0 has no IPv4 or IPv6 address specifically configured for it. It uses the Loopback0 IPv4 address, as the source address for the tunnel. The destination address is unspecified since it is constructed automatically. As packets are forwarded from its internal network to the 6to4 cloud, the router generates a new tunnel with the IPv4 destination used from the IPv4 address embedded inside the IPv6 address of the IPv6 packet being forwarded. The command tunnel mode ipv6ip 6to4 identifies a 6to4 tunnel. Depending on the routing domain and topology, route entries should be added. Except in special cases, the routing entry shown is generally needed to forward all 2002: packets through tunnel0. Router2 has a similar configuration for its end. IPv4 DEST IPv6 SRC 2002:83F3:812C:1::3 IPv6 SRC 2002:83F3:812C:1::3 IPv6 SRC 2002:83F3:812C:1::3 IPv6 DEST 2002:8C6E:C7FA:2::5 IPv6 DEST 2002:8C6E:C7FA:2::5 IPv6 DEST 2002:8C6E:C7FA:2::5 Data Data Data
30
IPv6 tunneling problem It does not work when the IPv4 address is not globally routable B4 is a private address! IPv6 IPv6 site D E A B IPv4 C IPv4 D4 B4 6to4 Relay router E6 A6 IPv6 host 6to4 router IPv4 router IPv6 host NAT Address translation Src: B4 Dest: D4 Src: N4 Dest: D4 Src: N4 Dest: D4 Src: A6 Dest: E6 data Src: A6 Dest: E6 data D to E: IPv6 A to B: IPv6 Src: A6 Dest: E6 data Src: A6 Dest: E6 data Src: A6 Dest: E6 data B to C: IPv4 (encapsulating IPv6) C to D: IPv4 (encapsulating IPv6) A v6 IP: 2002:a02:3fe::2/48 (A6) B v6 IP: 2002:a02:3fe::1/48 (B6) B v4 IP: (B4) E v6 IP: 2001:238:f88:4::2/64 (E6) D v6 IP: 2001:238:f88:4::1/64 (D6) D v4 IP: (D4) NAT address: (N4)
31
Teredo service To allow hosts behind NAT to access IPv6, without modifying NAT. Teredo is not a long term solution If NAT also supports IPv6 routing, the problem of NAT traversal will disappear.
32
Teredo definitions Teredo client Teredo server Teredo relay
A node wants to gain access to the IPv6 Internet. Teredo server helper to provide IPv6 connectivity to Teredo clients. Teredo relay An IPv6 router that can receive traffic destined to Teredo clients and forward it to Teredo client. Teredo bubble minimal IPv6 packet, made of an IPv6 header and null payload, no Next Header. Teredo service The transmission of IPv6 packets over UDP. 1. payload type is set to 59
33
Operation model A client has pre-configured server location.
A client gets IPv6 prefix from the Teredo server. IPv6 Teredo server Teredo relay Teredo server is stateless. Traffic goes directly between the relay router and the client. Teredo Relay announces reachability of Teredo prefix on IPv6 realm. Relay and Client maintain peer list to avoid sending Teredo message too often. IPv4 Tunnel Teredo IPv6 prefix? 1. Bubbles and list of peers ensures that data packets will always be transmitted on a direct path to another Teredo client, or on a direct path to the Teredo relay nearest from an IPv6 peer. NAT Teredo IPv6 prefix, your mapped address IPv4 Teredo client
34
Teredo address encoding
Prefix Server IPv4 Flags Port Client IPv4 Prefix: the 32 bit Teredo service prefix. 3FFE:831F::/32 Server IPv4: the IPv4 address of a Teredo server. Flags: a set of 16 bits that document type of address and NAT. 16 bits flag: “C00000UG ” C=1 if NAT is cone. UG should set to “00”. Port: the obfuscated "mapped UDP port" of the client Client IPv4: the obfuscated "mapped IPv4 address" of a client Obfuscated: XOR every bits in the field with 1, prevent over-genius NAT’s translation.
35
Obtaining an address(1/2)
Teredo client sends a UDPv4 tunneled IPv6 Router Solicitation to the Teredo server. Teredo server replies UDPv4 tunneled IPv6 Router Advertisement with origin indication. IPv6 Teredo server Teredo relay IPv4 :4096 NAT IPv4 UDP IPv6 RS IPv4 IPv4 UDP Origin indication IPv6 RA Teredo client 0x00 mapped port # mapped IPv4 address :1234 Origin indication format
36
Obtaining an address(2/2)
Client get Teredo service prefix 3FFE:831F::/32 (PREF= 3FFE:831F) Client get mapped address/port from origin indication Mapped address: :4096 Generated Teredo IPv6 address 3FFE:831F:102:304::EFFF:F6FF:FFFE Already known server IP: Address and port are obfuscated. Must keep alive address mapping on NAT Default refresh interval: 30 seconds.
37
Packet from Teredo node to IPv6 node (1/3)
2000::B A does not know which relay will be chosen by B. A sends ICMPv6 “echo request" toward B. S forwards “echo request” to IPv6 realm. IPv6 B Teredo Server S Teredo Relay R :3544 :3544 IPv4 :4096 NAT IPv6 Src. IPv6 dest. Src. Dest. IPv4 :1234 :3544 PREF:102:304::EFFF:F6FF:FFFE 2000::B PREF:102:304::EFFF:F6FF:FFFE 2000::B Teredo Client A :1234 PREF:102:304::EFFF:F6FF:FFFE
38
Packet from Teredo node to IPv6 node (2/3)
2000::B B sends the “echo reply” back to Teredo Client. The IPv6 packet will be queued by Teredo Relay. If Teredo Client is behind a restricted NAT, a bubble must be sent to Teredo Server. IPv6 B S R IPv4 :3544 :3544 :4096 NAT IPv6 Src. IPv6 dest. IPv4 2000::B PREF:102:304::EFFF:F6FF:FFFE A :1234 PREF:102:304::EFFF:F6FF:FFFE
39
Packet from Teredo node to IPv6 node (3/3)
2000::B R sends the queued “echo reply” to A. A knows B can be reached through address :3544. A will send all further packets directly through R. IPv6 B S R IPv4 :3544 :3544 :4096 1. B simply follows IPv6 routing rules NAT IPv4 Teredo Client A :1234 PREF:102:304::EFFF:F6FF:FFFE
40
Conclusion Many users get private IPv4 address from their service providers, such as WLAN and GPRS. These users are unable to create IPv6 tunnels. Before all NAT devices can be upgraded to support IPv6, Teredo service is useful for users behind NAT to obtain IPv6 access.
41
6TANET IPv6 TrAnsition Network Environment of Taiwan
IPv6 / IPv4 轉換器介紹 東華大學 資訊工程學系 張耀中
42
Agenda IPv6 Current State Introduction Objective Schedule Conclusion
43
IPv6 TF Around The World
48
Transition Mechanisms
52
IPv4 to IPv6 Data Flow
53
IPv4 to IPv6 Data Flow
54
Header Translation -IPv4 to IPv6
55
Header Translation -IPv6 to IPv4
56
Checksum Modification
Internet checksum use 16-bits 1’s complement checksum We adopt a 32-bits 1’s complement checksum algorithm Take advantage of the 32-bits registers in IXDP1200 Much faster and efficient 2 policies CASE Policy ARP ND (ICMP checksum) Re-Compute Algorithm IPv6 Header IPv4 Header ICMPv4 ICMPv6 Adjustment Algorithm TCP UDP
57
IQ2000
58
Project Objective IPv4/IPv6網路通訊協定轉換機制之技術與應用 超高速乙太網路IPv6/IPv4轉換器雛型系統
適合我國GbE網路環境之轉換機制 超高速乙太網路IPv6/IPv4轉換器雛型系統 雛型系統之系統需求規格與功能訂定 雛型系統之設計與實作 雛型系統之測試
60
Project Schedule IPv4/IPv6轉換機制運作原理研究 IPv4/IPv6轉換機制應用現況研究
※ GbE 網路環境轉移機制評估與設計 NP-based GbE IPv6/v4 轉換器雛形系統規格與功能訂定 雛型系統之軟體設計 雛型系統之實作與測試
61
Rejuvenating the Decaying Internet
IPv6 is a young lady? IPv6 NAT IPv4 Global Summit IPv6 North America IPv6 State of the World - Latif Ladid
62
IPv6 Is Not Only Unlimited Address Space
QoS Flow Bits? Reliability Simplicity ... ... Dynamic Routing Flexible Renumbering STRING Multicast v6 Transition Tool Box of Technology PERLS e2e Security Mobile IPv6 Autoconfiguration Plug & Ping End-2-end Transparency Global Summit IPv6 North America IPv6 State of the World - Latif Ladid
63
以 IPv6 為基礎的隱匿型 網路偵測管理
64
IPv6 環境下偵測管理的問題 區段內 IPv6 網址範圍巨大，逐一掃瞄 IPv6 網址以偵測上網之電腦或設備，需耗費時大量時間而變不可行
由於switch大量使用，broadcast 訊息不容易取得，增加偵測時的困難度
65
IPv4 - IPv6 headers 20 bytes IPv4 IPv6 40 bytes Vers = 4 Total length
Type of service Identification Fragment Offset Flags IHL TTL Header Checksum Protocol Source Address Destination Address Options... Vers = 6 flow Label Traffic Class Payload Length Next Header Hop Limit IPv4 IPv6 20 bytes 40 bytes
66
IPv6 網址 網址類型： 單一介面可以被設定多種 IPv6 網址 以 Multicast 取代 broadcast
Unicast : 一對一 Global Site local Link local Multicast Anycast 單一介面可以被設定多種 IPv6 網址 以 Multicast 取代 broadcast
67
Address resolution Neighbor Solicitation : @ IP2 ?
@MAC1 @IP2 @MAC2 Neighbor Solicitation : @ IP2 ? Neighbor advertisement : @ IP2 @ MAC2 IPv6 Packet
68
Configure hosts addresses
IPv6 router Prefix : pf1/64 @ IPv6 : pf1::X and fe80::X IPv6 host A Pf1::Y Fe80::Y IPv6 Host B fe80::Z Router advert. Fe80::X Prefix : pf1 Router solicitation
69
本子計劃進行的目的 於各個 IPv6 網路區段中載入不具 IP Address 之隱匿偵測點
藉由隱匿偵測點於各網路區段中進行偵測，並建構出區段內已存在之電腦名單 主控端針對各個區段的隱匿偵測點進行蒐集，並根據蒐集結果產生整體網路拓樸架構圖，以提供管理者對整體網路規劃及評估
70
相關軟體設計開發 目前僅有 ActiveX 能以網路物件形式存在且具有網路封包攔截或傳遞功能
開發ActiveX隱匿偵測點物件，透過 Web 介面下載至各區段偵測點；啟動偵蒐功能以建構出區段內上網電腦清單 開發主從架構之主控管理程式，動態即時蒐集各網路區段資料後進行彙整，進而建構出網路拓樸圖
71
網路物件程式範例
72
隱匿偵測點物件動作流程 啟動 Router solicitation 開始 取得 Global Address 的Prefix
啟動 ping multicast IP 加入區段內已存在電腦名單 Y 根據區段中某電腦 Acknowledge 封包資料 是否有 acknowledge 封包回傳 建構該電腦 IPv6 Address N 結束
73
ping Multicast IP 根據 RFC 2461和RFC 2463，可藉由ff02::1(link-local scope all-nodes multicast address)令上網電腦回應其 link-local IPv6 網址 利用ping6 指令及 ff02::1，令上網電腦回應 link-local 網址清單 本計畫需實現 RFC 2461及RFC 2463之規範，以偵蒐區域網路內之上網電腦或設備
74
利用 ping6 取得 link-local 網址清單 實驗結果之部分清單
[root]# ping6 -I eth0 ff02::1 PING ff02::1(ff02::1) from fe80::280:c8ff:fe6f:abeb eth0: 56 data bytes 64 bytes from ::1: icmp_seq=1 ttl=64 time=0.108 ms 64 bytes from fe80::202:b3ff:fe8e:6af7: icmp_seq=1 ttl=64 time=0.265 ms (DUP!) 64 bytes from fe80::2d0:b7ff:fe2d:ead5: icmp_seq=1 ttl=64 time=0.304 ms (DUP!) 64 bytes from fe80::2c0:4fff:fe15:4c4a: icmp_seq=1 ttl=64 time=0.308 ms (DUP!) 64 bytes from fe80::280:c8ff:fe58:4038: icmp_seq=1 ttl=64 time=0.347 ms (DUP!) 64 bytes from fe80::200:e8ff:fe63:aa7d: icmp_seq=1 ttl=64 time=0.350 ms (DUP!) 64 bytes from fe80::2e0:29ff:fe34:be97: icmp_seq=1 ttl=64 time=0.447 ms (DUP!) 64 bytes from fe80::a00:20ff:fe93:22ca: icmp_seq=1 ttl=255 time=0.326 ms (DUP!) 64 bytes from fe80::206:29ff:fe13:3de4: icmp_seq=1 ttl=64 time=0.374 ms (DUP!) 64 bytes from fe80::202:b3ff:fe16:5c44: icmp_seq=1 ttl=64 time=0.514 ms (DUP!) .
75
主控程式動作流程
76
繪製網路拓樸圖形介面
77
本計畫可應用於產業界之相關研究 網管系統 網路安全
Similar presentations
