CS 3214 Introduction to Computer Systems Lecture 26

CS 3214 Introduction to Computer Systems Lecture 26 Godmar Back

Announcements • Project 5 due Dec 11 • Exercise 13 (Virtualization) due Dec 11 • Tuesday: teaching evaluation – Must be in class to fill out • Minimum requirement criteria – Projects 1 -2 are graded – You have pre-indication on project 3 – Can verify minimum requirements for projects 4 and 5 yourselves CS 3214 Fall 2009 9/26/2020 2

Some of these slides are substantially derived from slides provided by Jim Kurose & Keith Ross. Copyright on this material is held by Kurose & Ross. Used with permission. The textbook is Computer Networking: A Top Down Approach Featuring the Internet Jim Kurose, Keith Ross, Addison-Wesley, July 2004 Part 3 NETWORKING CS 3214 Fall 2009 9/26/2020 3

NETWORK ADDRESS TRANSLATION CS 3214 Fall 2009 9/26/2020 4

NAT: Network Address Translation rest of Internet local network (e. g. , home network) 192. 168. 5/24 192. 168. 5. 1 /hn 1. rlogin 128. 173. 41. 81 hn 1. cs. vt. edu All datagrams leaving local network have same single source NAT IP address: 128. 173. 41. 81, different source port numbers 192. 168. 5. 62 gogo. rlogin 192. 168. 5. 63 umaro. rlogin 192. 168. 5. 64 kefka. rlogin Datagrams with source or destination in this network have 192. 168. 5. * address for source, destination (as usual) CS 3214 Fall 2009 9/26/2020 5

NAT: Network Address Translation • Motivation: local network uses just one IP address as far as outside word is concerned: – no need to be allocated range of addresses from ISP: - just one IP address is used for all devices – can change addresses of devices in local network without notifying outside world – can change ISP without changing addresses of devices in local network – devices inside local net not explicitly addressable, visible by outside world (a huge security plus). CS 3214 Fall 2009 9/26/2020 6

NAT: Network Address Translation Implementation: NAT router must: – outgoing datagrams: replace (source IP address, port #) of every outgoing datagram to (NAT IP address, new port #). . . remote clients/servers will respond using (NAT IP address, new port #) as destination addr. – remember (in NAT translation table) every (source IP address, port #) to (NAT IP address, new port #) translation pair – incoming datagrams: replace (NAT IP address, new port #) in dest fields of every incoming datagram with corresponding (source IP address, port #) stored in NAT table CS 3214 Fall 2009 9/26/2020 7

NAT: Network Address Translation NAT translation table WAN side addr LAN side addr 1: host 192. 168. 5. 62 2: NAT router sends datagram to changes datagram 128. 173. 41. 81, 5001 192. 168. 5. 62, 3345 128. 119. 40. 186, 80 source addr from …… …… 192. 168. 5. 62, 3345 to 128. 173. 41. 81, 5001, S: 192. 168. 5. 62, 3345 D: 128. 119. 40. 186, 80 updates table 2 S: 128. 173. 41. 81, 5001 D: 128. 119. 40. 186, 80 128. 173. 41. 81 S: 128. 119. 40. 186, 80 D: 128. 173. 41. 81, 5001 3 3: Reply arrives dest. address: 128. 173. 41. 81, 5001 1 192. 168. 5. 62 192. 168. 5. 1 S: 128. 119. 40. 186, 80 D: 192. 168. 5. 62, 3345 4 192. 168. 5. 63 4: NAT router 192. 168. 5. 64 changes datagram dest addr from 128. 173. 41. 81, 5001 to 192. 168. 5. 62, 3345 CS 3214 Fall 2009 9/26/2020 8

Managing NAT table • NAT Gateway (usually) adds entries for datagrams traveling private to public automatically – Allows UDP/TCP clients to transparently sendto/connect to outside servers • Removal of entries – UDP: timeout due to inactivity – TCP: timeout + TCP connection teardown • Other direction requires configuration so NAT Gateway knows where to forward incoming datagram even if no private host previously punched a hole by initiating UDP traffic/TCP connection CS 3214 Fall 2009 9/26/2020 9

NAT Disadvantages • 16 -bit port-number field: – Only 60, 000 simultaneous connections with a single LAN-side address! • NAT is controversial: – routers should only process up to layer 3 – violates end-to-end argument • NAT possibility must be taken into account by app designers, eg, P 2 P applications – address shortage should instead be solved by IPv 6 – really annoying if you time out on rlogin. cs. vt. edu CS 3214 Fall 2009 9/26/2020 10

NAT Challenges • Considering that most Internet hosts are behind NAT these days – how should applications be written to deal with that? • No problem as long as server has public IP and client knows where to connect (HTTP, XMPP, SMTP, POP) – If server has private IP, entries in NAT forwarding table can be manually configured • What about P 2 P applications? – Could relay through server, but that would defeat purpose of P 2 P – Instead, a technique called “hole punching” is widely used (e. g. , in Skype) – Discussed in [Ford/Srisuresh/Kegel 2005] • UDP hole punching is widely used, but TCP hole punching is possible as well CS 3214 Fall 2009 9/26/2020 11

NAT Relaying • All traffic goes through S • Source: [Ford/Srisuresh/Kegel 2005] CS 3214 Fall 2009 9/26/2020 12

UDP Hole Punching • Rendezvous server only directs punches, traffic goes P 2 P • Details in [Ford/Srisuresh/Kegel 2005] CS 3214 Fall 2009 9/26/2020 13

Application Protocols Part 2: DNS

DNS: Domain Name System People: many identifiers: – SSN, name, passport # Internet hosts, routers: – IP address (32 bit) - used for addressing datagrams – “name”, e. g. , www. yahoo. com - used by humans Q: map between IP addresses and name ? Domain Name System: • distributed database implemented in hierarchy of many name servers • application-layer protocol host, routers, name servers to communicate to resolve names (address/name translation) – not built into the network! CS 3214 Fall 2009 9/26/2020 15

DNS services • Hostname to IP address translation • Host aliasing – Canonical and alias names • Mail server aliasing • Load distribution – Replicated Web servers: set of IP addresses for one canonical name Why not centralize DNS? • single point of failure • traffic volume • distant centralized database • maintenance doesn’t scale! CS 3214 Fall 2009 9/26/2020 16

Distributed, Hierarchical Database Root DNS Servers com DNS servers yahoo. com DNS servers amazon. com DNS servers org DNS servers pbs. org DNS servers edu DNS servers poly. edu umass. edu DNS servers Client wants IP for www. amazon. com; 1 st approx: • Client queries a root server to find. com DNS server • Client queries. com DNS server to get amazon. com DNS server • Client queries amazon. com DNS server to get IP address for www. amazon. com CS 3214 Fall 2009 9/26/2020 17

Resource Types Type AAAA A CNAME NS MX Name Hostname www. l. google. com Value IPv 6 Address 2001: 4860: b 004: : 68 Hostname www. cs. vt. edu IP Address 198. 82. 184. 180 Alias rlogin. cs. vt. edu Domainname vt. edu Mail Domain cs. vt. edu Canonical Hostname hn 1. cs. vt. edu Authoritative Nameserver nomen. cns. vt. edu Mail Server antispam. cs. vt. edu CS 3214 Fall 2009 9/26/2020 18

DNS: Root Name Servers a Verisign, Dulles, VA c Cogent, Herndon, VA (also Los Angeles) d U Maryland College Park, MD k RIPE London (also Amsterdam, Frankfurt) g US Do. D Vienna, VA i Autonomica, Stockholm h ARL Aberdeen, MD j Verisign, ( 11 locations) (plus 3 other locations) 13 root name servers worldwide m WIDE Tokyo e NASA Mt View, CA f Internet Software C. Palo Alto, CA (and 17 other locations) b USC-ISI Marina del Rey, CA l ICANN Los Angeles, CA • List published at – ftp: //ftp. internic. net/domain/named. cache – See http: //www. root-servers. org/ • Replicated using IP anycast CS 3214 Fall 2009 9/26/2020 19

TLD and Authoritative Servers • Top-level domain (TLD) servers: responsible for com, org, net, edu, etc, and all top-level country domains uk, fr, ca, jp, . . – Network solutions maintains servers for com TLD – Educause for edu TLD • Authoritative DNS servers: organization’s DNS servers, providing authoritative hostname to IP mappings for organization’s servers (e. g. , Web and mail). – Can be maintained by organization or service provider CS 3214 Fall 2009 9/26/2020 20

Caching and Local Name Servers • Q: do we want every (of the 280 million) Internet hosts be contacting a dozen or so root servers all the time? • A: No. Caching is needed – Local Name Servers bundle queries by clients they serve and cache their results CS 3214 Fall 2009 9/26/2020 21

Local Name Server • Does not strictly belong to hierarchy • When a host makes a DNS query, query is sent to its local DNS server – Acts as a proxy, forwards query into hierarchy. • Each ISP (residential ISP, company, university) has one (or more. ) – Also called “default name server” or resolver – Contacted by resolver library (libresolv. so, or part of libc – provides such functions as gethostbyname(), getaddrinfo() etc. CS 3214 Fall 2009 9/26/2020 22

Caching Records • Once (any) name server learns mapping, it caches mapping – cache entries time out (disappear) after some time • 86, 400 seconds per day – TLD servers typically cached in local name servers • Thus root name servers not often visited • Aside: Local Name Server crucial resource – Proper cache management required – See Bernstein’s comments on caching in BIND (Berkeley Internet Name Domain) program CS 3214 Fall 2009 9/26/2020 23

DNS Protocol: Query Types • Possible constellations: – Client’s resolver library talks to local name server – Local name server talks to other name servers: root server, TLD servers, … • Beauty of DNS Protocol: same protocol can be used for either constellation – Uses two query types • Recursive: “please resolve this name for me and send me the result” – Good for client, harder for server • Iterated: “please tell me what you know about the name – partial resolution is okay, I’ll ask the next server in hierarchy” – Easy for server, harder for client CS 3214 Fall 2009 9/26/2020 24

root DNS server a. root-servers. net Recursive vs. Iterative Queries 2 Host at gback. cs. vt. edu wants IP address for godmar. stanford. edu • Sends recursive query to voodoo • Voodoo performs iterative queries • (Animation assumes voodoo has nothing cached yet) 3 4 TLD DNS server a 3. nstld. com 5 local DNS server voodoo. slo. cs. vt. edu 1 8 requesting host 7 6 authoritative DNS server argus. stanford. edu gback. cs. vt. edu godmar. stanford. edu CS 3214 Fall 2009 9/26/2020 25

SERVER MODELS CS 3214 Fall 2009 9/26/2020 26

Server Models • Should more than one more client at a time be supported? – No: use iterative approach: one at a time • If Yes: How do we manage n clients (and be able to accept more at the same time)? – Option 1: use multiple execution contexts (aka “thread-based”, concurrent model) – Option 2: multiplex multiple connections in single execution context (aka “event-based”, achieves “apparent concurrency”) CS 3214 Fall 2009 9/26/2020 27

High-Concurrency Servers Ideal – Maintain throughput: measure of useful work seen by clients Performance Key goal: Peak: some resource at max Overload: some resource thrashing Load (concurrent tasks) Source: von Behren, SOSP 2003 • CPU and resource management is critical – Must weigh which connections to accept vs. to drop – Ensure that requests in pipeline are completed CS 3214 Fall 2009 9/26/2020 28

Multiple Contexts • Option A: fork a new process for every connection on-demand • Option B: fork a new thread for every connection to handle it • Option C/D: pre-fork a certain number of processes (or threads) and hand connections to them CS 3214 Fall 2009 9/26/2020 29

Handling multiple clients using multiple execution contexts A/B: # grows & shrinks A B C/D: fixed # C D Q. : When would you use which? CS 3214 Fall 2009 9/26/2020 30

Multiplexing Multiple Connections • Problem: need to avoid blocking • Different solutions: – Always test before you read/write (would I block? ) • NB: does not require use of nonblocking mode – Use socket in nonblocking mode: try to read, let it fail if it would block • Then try again later (when? ), or: • use in combination with notification: send a signal or event if the socket becomes readable. • Many combinations possible CS 3214 Fall 2009 9/26/2020 31

Multiplexing multiple connections in a single execution context • Use an event-based programming style • Problem: need to avoid blocking • Split code in before and after part, assign an event to ‘after’ part, record all information needed to continue – “stack ripping” • Can make event-based code hard to write – See TAME [Krohn 2007] CS 3214 Fall 2009 9/26/2020 32

OS interfaces to avoid blocking • Different solutions: – Always test before you read/write (would I block? ) • NB: does not require use of nonblocking mode – Use socket in nonblocking mode: try to read, let it fail if it would block • Then try again later (when? ), or: • use in combination with notification: send a signal or event if the socket becomes readable. • Many combinations possible CS 3214 Fall 2009 9/26/2020 33

select(2) int select(int maxn, fd_set *readfds, fd_set *writefds, fd_set *exceptfds, struct timeval *timeout); FD_CLR(int fd, fd_set *set); FD_ISSET(int fd, fd_set *set); FD_ZERO(fd_set *set); • fd_set’s are bit vectors that implement a set of integers – maxn is max{fds in set} + 1 • If fd is in return set, read/write will not block • Java implementation is in java. nio. * CS 3214 Fall 2009 9/26/2020 34

Problems with select() • select(2) is portable, but not scalable: – Time to scan fd_sets depends on maximum fd value – O(n) – OS must scan entire fd_set every time (+copyin from user space, +copy-out to user space) • [Banga Mogul 1998] – Found some systems spend >53% of time in select() – Led to development of new mechanisms CS 3214 Fall 2009 9/26/2020 35

Alternative 1: poll() • poll(2) – Specify array with fds of interest – OS returns (shorter) array with ready fds • Win if ready set is sparse • Otherwise same problems as select Before call 0 RWE ? ? ? 1 RWE ? ? ? After call 1 RWE R-- 9 RWE --E CS 3214 Fall 2009 5 RWE ? ? ? 9/26/2020 36

Alternative 2: epoll() • Linux: epoll(4) – Specify interest set to OS only once – Then refer to it by descriptor • Add new fds to set, remove fds from set – Edge-triggered vs. Level-triggered versions • ET: Notify on change • Adopted from Solaris’s: /dev/poll – Further improve performance by mmap’ing /dev/poll CS 3214 Fall 2009 9/26/2020 37

Alternative 3: RT signals • Key idea: RT Signals carry fd information with them in their siginfo struct (unlike SIGIO) – Avoid delivery overhead by polling for them with sigwaitinfo – Problem: Finite signal queue requires overflow mechanism • Discussed in [Chandra Mosberger 2001] – “multi-accept” select – reduce frequency of select by accepting multiple connections CS 3214 Fall 2009 9/26/2020 38