Internet Lab (iLab1) Domain Name Sytem Dominik Scholz - PowerPoint PPT Presentation

Chair of Network Architectures and Services Department of Informatics Technical University of Munich Internet Lab (iLab1) Domain Name Sytem Dominik Scholz ilab1@net.in.tum.de Chair of Network Architectures and Services Department of Informatics Technical University of Munich Lab 5 – WiSe 2018

Outline Meta Domain Name System Authoritative name server Resolver Security 1/32

Outline Meta Domain Name System Authoritative name server Resolver Security 2/32

Oral attestations Scope of the oral attestations: • expert knowledge of the lecture content • show us your individual understanding of the labs • labs and lectures 1–5 (including crypto) • you may choose the lab to start with • prepare for oral attestation: you have to explain things • duration 10 minutes • 20% of grade • room 03.05.051 (or 03.05.033) 3/32

Oral Attestations • Make sure you can access lecture recordings NOW • Make sure you confirmed your time slot! • We assume you show up for your designated slot • Attestation is required for passing the course 4/32

Outline Meta Domain Name System Authoritative name server Resolver Security 5/32

The quest for memorable names • IP addresses hard to remember for humans • symbolic names mapped to addresses address resolution 1. host files file with mappings • copy between all machines • • /etc/hosts 2. protocol: Domain Name System by Paul Mockapetris in 1983 • wide deployment in 1988 • 6/32

Domain Name System • application layer protocol on UDP , TCP glibc call getaddrinfo(3) • • distributed name database deployed globally • hierarchical structure • • extensible e.g. DNSSEC: security extensions inside the protocol itself • 7/32

Distributed hierarchical name space . net edu org lwn tum gnu debian cs ma ei mail Fully qualified domain name (FQDN) by label concatenation: mail.cs.tum.edu. 8/32

Distributed hierarchical name space root zone (empty label) . top level domain net edu org second level domain lwn tum gnu debian cs ma ei mail Fully qualified domain name (FQDN) by label concatenation: mail.cs.tum.edu. 8/32

Name server Name servers can fulfill different functions: 1. authoritative name servers operated by a site on the Internet • 2. resolver asked to resolve names • contacts authoritative name servers • Example Knot and unbound 9/32

Outline Meta Domain Name System Authoritative name server Resolver Security 10/32

Zone • subtree of the global name space • delegated by parent • managed by one organization • hosted on an authoritative name server Example tum.edu. delegated by edu., containing www.tum.edu. and mail.in.tum.edu. 11/32

Authoritative name server • only knows about its own part of the name space • responsible, “authoritative”, for its zone • may serve multiple zones • usually primary and secondary servers exist for a zone synchronized with zone transfer • avoid disappearance of the zone in case of outage • load balancing • 12/32

Zones: example . net edu org lwn tum gnu debian cs ma ei mail 13/32

Resource record • zone contains resource records (RR) example.net. 3600 IN A 198.51.100.5 owner TTL class type RDATA domain name where RR is found 14/32

Resource record • zone contains resource records (RR) example.net. 3600 IN A 198.51.100.5 owner TTL class type RDATA validity period in seconds when cached 14/32

Resource record • zone contains resource records (RR) example.net. 3600 IN A 198.51.100.5 owner TTL class type RDATA only Internet is relevant for us 14/32

Resource record • zone contains resource records (RR) example.net. 3600 IN A 198.51.100.5 owner TTL class type RDATA record type, e.g. IPv4 address 14/32

Resource record • zone contains resource records (RR) example.net. 3600 IN A 198.51.100.5 owner TTL class type RDATA resource data: e.g. 32 bit IPv4 address 14/32

Resource records owner TTL class type RDATA i.example.net. 3600 IN AAAA 2001:db8::1 like.example.net. 3600 IN AAAA 2001:db8:af23::eb2 dns.example.net. 3600 IN A 192.0.2.25 i.example.net. 3600 IN A 192.0.2.205 15/32

Resource records owner type RDATA i.example.net. AAAA 2001:db8::1 like.example.net. AAAA 2001:db8:af23::eb2 dns.example.net. A 192.0.2.25 i.example.net. A 192.0.2.205 i.example.net. AAAA 2001:db8::2 • RRset for i.example.net. type AAAA with more than one record! • note: TTL and class usually omitted 15/32

Zone file and record types $ORIGIN example.net. ; everything will be relative to this $TTL 1h ; default TTL could be overwritten later 16/32

Zone file and record types $ORIGIN example.net. ; everything will be relative to this $TTL 1h ; default TTL could be overwritten later example.net. IN SOA ns1 hostmaster [. . . ] 16/32

Zone file and record types $ORIGIN example.net. ; everything will be relative to this $TTL 1h ; default TTL could be overwritten later example.net. IN SOA ns1 hostmaster [. . . ] ; RRset with two records: NS example.net. NS ns1 ; primary authoritative NS example.net. NS ns2.registrar.example. ; secondary 16/32

Zone file and record types $ORIGIN example.net. ; everything will be relative to this $TTL 1h ; default TTL could be overwritten later example.net. IN SOA ns1 hostmaster [. . . ] ; RRset with two records: NS example.net. NS ns1 ; primary authoritative NS example.net. NS ns2.registrar.example. ; secondary ns1 A 198.51.100.1 16/32

Zone file and record types $ORIGIN example.net. ; everything will be relative to this $TTL 1h ; default TTL could be overwritten later example.net. IN SOA ns1 hostmaster [. . . ] ; RRset with two records: NS example.net. NS ns1 ; primary authoritative NS example.net. NS ns2.registrar.example. ; secondary ns1 A 198.51.100.1 example.net. MX 10 mail ; priority to order multiple MX RRs 16/32

Zone file and record types $ORIGIN example.net. ; everything will be relative to this $TTL 1h ; default TTL could be overwritten later example.net. IN SOA ns1 hostmaster [. . . ] ; RRset with two records: NS example.net. NS ns1 ; primary authoritative NS example.net. NS ns2.registrar.example. ; secondary ns1 A 198.51.100.1 example.net. MX 10 mail ; priority to order multiple MX RRs mail AAAA 2001:db8::1 A 198.51.100.2 16/32

Zone file and record types $ORIGIN example.net. ; everything will be relative to this $TTL 1h ; default TTL could be overwritten later example.net. IN SOA ns1 hostmaster [. . . ] ; RRset with two records: NS example.net. NS ns1 ; primary authoritative NS example.net. NS ns2.registrar.example. ; secondary ns1 A 198.51.100.1 example.net. MX 10 mail ; priority to order multiple MX RRs mail AAAA 2001:db8::1 A 198.51.100.2 webmail CNAME mail ; alias for a canonical name 16/32

Delegation sub.example.net. NS ns.sub.example.net. ns.sub.example.net. A 198.51.100.3 • make ns.sub.example.net. responsible for the sub.example.net. zone • glue record to make the new name server findable • possible misconfigurations 1. missing glue records 2. delegation loops 17/32

Outline Meta Domain Name System Authoritative name server Resolver Security 18/32

Resolving name server tasks • query: owner, class, type • resolve a query from the root downwards • cache responses based on TTL • changes might only be visible after days Allow access only from your network, never open for everybody 19/32

DNS packet layout IP UDP DNS header query answer authoritative additional ID, flags, number of RRs records header c,s QR query or response s AA authoritative answer s TC truncation (TCP as fallback) c RD recursion desired s RA recursion available s 4 bit response code: no error, name error, server failure, refused • number of resource records in each section 20/32

DNS packet layout IP UDP DNS header query answer authoritative additional ID, flags, number of RRs records record sections • query: only one record with owner, type, class • answer: answer RRs • authoritative section: name server delegation • additional section: glue records, EDNS pseudo record packet size limited to 512 octets 20/32

Lookup stub forwarder recursor IP? in.tum.de. • recursive queries 21/32

Lookup k.root-servers.net. 2001:7fd::1 in.tum.de. A de. NS a.nic.de. a.nic.de. A 194.0.0.53 stub forwarder recursor in.tum.de. • recursive queries • iterative queries • glue 21/32

Lookup k.root-servers.net. a.nic.de. in.tum.de. A tum.de. NS dns1.lrz.de. stub forwarder recursor dns1.lrz.de A 129.187.19.183 in.tum.de. • recursive queries • iterative queries • glue 21/32

Lookup k.root-servers.net. a.nic.de. in.tum.de. A stub forwarder recursor dns1.lrz.de. in.tum.de. A 131.159.0.35 in.tum.de. • recursive queries • iterative queries • glue 21/32

Lookup k.root-servers.net. a.nic.de. stub forwarder recursor dns1.lrz.de. in.tum.de. • recursive queries • iterative queries • glue 21/32

Lookup k.root-servers.net. a.nic.de. stub forwarder recursor dns1.lrz.de. 131.159.0.35 in.tum.de. • recursive queries • iterative queries • glue 21/32