Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Naming (2) DISTRIBUTED SYSTEMS (dDist) 2014

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Plan Terminology Types of naming –Flat naming –Structured naming –Attribute-based naming

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Structured Naming Flat naming convenient is for machines, not for humans We would like to support names composed from simple, human- readable names –/users/jbn/public_html_cs/index.html –

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Name Space Can be represented as a directed graph –Leaf node represents named entity –Directory nodes store pointers to other nodes

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Path Name Entities are uniquely named by giving a start node and names of edges to follow, called path names –n0:  home, steen, keys  –root:  dk, au, cs, www 

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Name Resolution Given path name, locate the entity being named –n0:  home, steen, keys   an inode For a Unix file system –root:  dk, au, cs, www   A For the DNS system

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Name Space Implementation (1/2) Need distributed solution for large-scale networks Convenient that one directory node is fully handled by one organization/machine –Processes that need information on the node know who to contact Each machine can of course handle many nodes Zone: A sub-graph handled by a single machine

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Name Space Implementation (2/2) Logical layers –Global layer Handles the root node and nodes logically close to it Handles nodes with highly stable assignment –Administrational layer Handles nodes which have a fairly stable assignment Typically by a single enterprise –Managerial layer Maintained also by users Unstable assignment

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Name Space Distribution Figure An example partitioning of the DNS name space, including Internet-accessible files, into three layers.

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Domain Name System (DNS) How to map structured names to IP addresses in the Internet? –“Back in the days”: HOSTS.TXT file FTP’ed among hosts Now a distributed name service –Hierarchical name space –Each level separated by ‘.’ Analogous to ‘/’ separator in file systems –One global root Replicated across 13 root servers There have been Denial of Service (DoS) attacks on these root servers, none successful Because of caching, queries to root servers relatively rare DNS is the only really global directory/name service –The true backbone of the Internet –The Internet = DNS + TCP/IP,UDP/IP

DNS is simple but powerful Three major components –Domain Name Space and Resource Records Specification for a tree-structured name space and small databases associated with nodes (both internal nodes and leaf nodes) –Name Servers Servers which hold the databases associated with some nodes and references to other name servers –Resolvers Client programs that extract information from name servers Name servers can be resolvers –Will be so in so-called recursive lookup Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved

Resource Records (1/3) Each name server holds a set of resource records which for each path specifies, e.g., what is the name server for the path and what is the address of the machine at the path path type data cs.au.dk.MX mx.nfit.au.dk means that mx.nfit.au.dk is mail server for the domain cs.au.dk

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Resource Records (2/3) path type data Some types of records –NS:Name server for the path –A:IP address for the path, if any Not all partial paths, like dk, correspond to machines –MX:Name of the mail server for path, if any (Mail eXchange) –AAAA:IPv6 address

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Resource Records (3/3) Examples of resource records: pathtype data dk.NSa.nic.dk. a.nic.dk.A au.dk. NS ns.au.dk ns.au.dkA cs.au.dkA cs.au.dkA cs.au.dkMXmx.nfit.au.dk. mx.nfit.au.dkA

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Glue If a name server holds a record like pathtype data au.dk. NS ns.au.dk then it also holds a record like pathtype data ns.au.dkA And, it sends it along with the NS record

Path name resolved:  dk, au  Name server: ns.au.dk Knows: “cs.au.dk.” A  Knows: “cs.au.dk.” NS  au Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Looking up cs.au.dk Path name resolved:   Name server: a.root-servers.net Knows: “dk.” NS  Path name resolved:  dk  Name server: a.nic.dk Knows: “au.dk.” NS  dk com org aau Path name resolved:  dk, au, cs  DNS name: cs.au.dk. IP: cs science

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved DiG Let us ask the NS for “dk.” what the NS for “au.dk.” is?

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Replication “au.dk.” had three name servers: ns.au.dk. ( ) ns2.au.dk( ) ns-soa.darenet.dk( ) They are kept identical and during lookup clients are requested to contact a random one Load balancing No single point of error

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Implementation of Name Resolution Figure The principle of iterative name resolution.

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Implementation of Name Resolution Figure The principle of recursive name resolution.

Caching DNS resolvers are allowed to cache entries –This speeds up lookup immensely The root servers are not receiving a lot of traffic when they are not under attack Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved

The Internet, Example The access a resource you need to: Name the resource (URL) – Resolve the name (DNS) –IP Address, then file server, file on disk Access the resource (TCP/IP): –And the rest of ISO OSI Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved

DNS is Insecure DNS is implemented over UDP/IP (switching to TCP/IP for large packets) UDP and TCP are insecure in that you have no guarantee who sent a given package –Anyone can therefore play DNS server to you!! When a resolver asks for the IP address of your.bank.dk, it might be a Russian hacker sending back the reply –And the provided IP address is then probably going to be for his machine

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Cache Poisoning (1/2) Caching makes the problem even worse A hacker finds a resolver used by many clients, like the resolver of your service provider She asks it to resolve “au.dk.” The resolver asks “dk.” for NS of “au.dk.” The hacker returns his own IP address Now the hacker is the name server for “au.dk.” for all clients using that resolver, as long as the address sits in the cache –Can then, e.g, direct messages for mx.nfit.au.dk to his own IP to read your from inside the service provider (and forward to mx.nfit.au.dk to not be detected)

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Cache Poisoning (2/2) You can read more about Cache poisoning in a note found on the homepage This note is also a nice walk through of the DNS system

Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved Summary Naming is fundamental to distributed systems Different types of names may be used –Flat naming E.g., DHT –Structured naming E.g, DNS –Attribute-based naming E.g., LDAP