RPKI Introduction. APNIC Technical Workshop July 5-6, 2018 in Beijing, China. Hosted By:

Size: px

Start display at page:

Download "RPKI Introduction. APNIC Technical Workshop July 5-6, 2018 in Beijing, China. Hosted By:"

Randall Wilkins
5 years ago
Views:

1 RPKI Introduction APNIC Technical Workshop July 5-6, 2018 in Beijing, China. Hosted By: 1

2 Content Why do we need RPKI What is RPKI How to deploy RPKI Configuration case

services downed Occurred 5 Nov 2012 (for 30 minutes) Moratel Indonesia

3 Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours) Pakistan Telecom announced YT block Google (AS15169) services downed Occurred 5 Nov 2012 (for 30 minutes) Moratel Indonesia (AS23947) 3

4 Indonesia Hijacks On 3rd April 2014, Indosat (AS4761) leaked over 320,000* routes within a 2-hour period Disrupted Akamai Self-inflicted DDoS attack 4

5 Telekom Malaysia On June 12, 2015, Telekom Malaysia (AS4788) tweets this then breaks the Internet It announced 179,000 prefixes to Level 3 (AS3549) 5

6 Cyber Criminals exploiting the vulnerability BGP Hijacking for Cryptocurrency Profit (2014) Spamhaus DDoS Attack (2013) Detecting BGP Attacks in

7 How we address this A network should only originate his own prefix How do we verify & avoid false advertisement? A provider should filter prefixes they propagate from customers Transitive trust; BGP is a trust-based system Check the legitimacy of address (LoA) Passive Countermeasure Strict filter on Interconnection BGP router can filter in UPDATE Messages Useful filtering can be done by upstream provider Automate Filter Maintenance Use the Route Object 7

8 What is RPKI? RPKI Resource Pubic Key Infrastructure 8

9 What does it solve? Prevents route hijacking A prefix originated by an AS without authorization due to malicious intent Prevents mis-origination A prefix that is mistakenly originated by an AS which does not own it Also route leakage due to configuration mistake or fat finger 9

10 How does it work? Is this AS number (ASN) authorized to announce this IP address range? 10

11 RPKI Origin Validation Network Next Hop AS_PATH Age Attrs V*> 2001:db8::/ :df2:ee00:: :30:49 [{Origin: i}] I > 2001:db8::/ :df2:ee11:: :30:49 [{Origin: i}] :db8::/ :db8:ab:: :db8::/32 11

12 RPKI Implementation Two RPKI implementation type Delegated: Each participating node becomes a CA and runs their own RPKI repository, delegated by the parent CA. Hosted: The RIR runs the CA functionality for interested participants.

13 Two Components Certificate Authority (CA) Internet Registries (RIR, NIR, Large LIR) Issue certificates for customers Allow customers to use the CA s GUI to issue ROAs for their prefixes Relying Party (RP) Software which gathers data from CAs

14 Issuing Party Internet Registries (RIR, NIR, Large LIRs) Acts as a Certificate Authority and issues certificates for customers Provides a web interface to issue ROAs for customer prefixes Publishes the ROA records APNIC RPKI Engine publication rpki.apnic.net Repository MyAPNIC GUI

15 Relying Party (RP) IANA Repo APNIC Repo rpki.apnic.net LIR Repo LIR Repo RIPE Repo rpki.ripe.net RP Cache (gather) Validated Cache RPKI-Rtr Protocol Software which gathers data from CAs Also called RP cache or validator

16 RPKI Building Blocks 1. Trust Anchors (RIR s) 2. Route Origination Authorizations (ROA) 3. Validators

17 1. PKI & Trust Anchors

18 Public Key Concept Private key: This key must be known only by its owner. Public key: This key is known to everyone (it is public) Relation between both keys: What one key encrypts, the other one decrypts, and vice versa. That means that if you encrypt something with my public key (which you would know, because it's public :-), I would need my private key to decrypt the message. Same alike http with SSL aka https

19 RPKI Profile X.509 Certificates 3779 EXT Certificates are X.509 certificates that conform to the PKIX profile [PKIX]. They also contain an extension field that lists a collection of IP resources (IPv4 addresses, IPv6 addresses and AS Numbers) [RFC3779] Signed by Parent s Private Key X.509 Cert RFC 3779 Extension Describes IP Resources (Addr & ASN) SIA URI for where this Publishes Owner s Public Key CA

20 Trust Anchor Resource Allocation Hierarchy IANA Trust Anchor Certificate AFRINIC RIPE NCC ARIN APNIC LACNIC Issued Certificates match allocation actions NIR NIR ISP ISP ISP ISP ISP Source :

21 RPKI Chain of Trust The RIRs hold a self-signed root certificate for all the resources that they have in the registry They are the trust anchor for the system That root certificate is used to sign a certificate that lists your resources You can issue child certificates for those resources to your customers When making assignments or sub allocations

22 2. ROA

23 Route Origination Authorizations (ROA) A ROA is a digitally signed object that provides a means of verifying that an IP address block holder has authorized an Autonomous System (AS) to originate routes to one or more prefixes within the address block. With a ROA, the resource holder is attesting that the origin AS number is authorized to announce the prefix(es). The attestation can be verified cryptographically using RPKI.

24 Route Origination Authorizations (ROA) Next to the prefix and the ASN which is allowed to announce it, the ROA contains: A minimum prefix length A maximum prefix length An expiry date Origin ASN Multiple ROAs can exist for the same prefix ROAs can overlap

25 Create ROA 25

26 3. Validators

27 Origin Validation Router gets ROA information from the RPKI Cache RPKI verification is done by the RPKI Cache The BGP process will check each announcement with the ROA information and label the prefix Validated RPKI Cache RPKI to RTR protocol

28 Result of Check Valid Indicates that the prefix and AS pair are found in the database. Invalid Indicates that the prefix is found, but either the corresponding AS received from the EBGP peer is not the AS that appears in the database, or the prefix length in the BGP update message is longer than the maximum length permitted in the database. Not Found / Unknown Indicates that the prefix is not among the prefixes or prefix ranges in the database. Valid > Unknown > Invalid

29 ROA Example IPv4 Prefix: /16 ASN: ROA /16 /18 Origin AS Prefix Max Length VALID AS /16 VALID AS /17 INVALID AS /16 INVALID AS /24 UNKNOWN AS /8

30 Local Policy You can define your policy based on the outcomes Do nothing Just logging Label BGP communities Modify preference values Rejecting the announcement

31 ROV Deployment - CRIX First stage -> Only tagging valid, invalid and not found prefixes with BGP communities Currently (since 2015): Discarding invalids at route server. IX members only get valid and not found prefixes. Not found prefixes are marked with a BGP community. Periodic manual checks of invalid prefixes, letting members know when they are announcing an invalid route so that they fix it. Quarantine for new members (before traffic is enabled in the production environment) involves announced prefixes revision to make sure the corresponding ROAs have been created. 31

32 RPKI Caveats When RTR session goes down, the RPKI status will be not found for all the bgp route after a while Invalid => not found we need several RTR sessions or care your filtering policy In case of the router reload, which one is faster, receiving ROAs or receiving BGP routes? If receiving BGP is much faster than ROA, the router propagate the invalid route to others We need to put our Cache validator within our IGP scope

33 In summary As an announcer/lir You choose if you want certification You choose if you want to create ROAs You choose AS, max length As a Relying Party You can choose if you use the validator You can override the lists of valid ROAs in the cache, adding or removing valid ROAs locally You can choose to make any routing decisions based on the results of the BGP Verification (valid/invalid/unknown)

34 ROV Deployment NAP.Ec (the Ecuatorian IXP) Doing ROV and discarding invalid routes (Since 2 or 3 years ago) CRIX (The Costarican IXP) Doing ROV since 2015 RENATA (Colombian Academic Network) They have recently set up ROV Just tagging traffic and not making any routing decision yet as they are seeing too many invalid routes 34

35 RPKI Further Reading RFC 5280: X.509 PKI Certificates RFC 3779: Extensions for IP Addresses and ASNs RFC : Resource Public Key Infrastructure

36 RPKI Configuration

37 RPKI Configuration Resources: AS : [APNICTRAINING-DC] IPv4 : /24 IPv6: 2001:df2:ee00::/48 Process Create ROA Setup cache validation server Validate the ROA

Implementation Scenario upstream DNS Trust Anchors DNS Trust Anchors DNS Trust Anchors {bgp4} Routers validate updates from other BGP peers ASBR {bgp4} {rsync} repository {rtr}

38 Implementation Scenario upstream DNS Trust Anchors DNS Trust Anchors DNS Trust Anchors {bgp4} Routers validate updates from other BGP peers ASBR {bgp4} {rsync} repository {rtr} Caches feeds routers using RTR protocol with ROA information {rtr} {rsync} Caches retrieves and cryptographically DNS RPKI Cache Validator validates certificates & ROAs from repositories

39 Phase I: Create ROA APNIC member Create ROA in MyAPNIC CNNIC member Create ROA in your member portal 39

40 Phase I - Check your ROA # whois -h whois.bgpmon.net 2001:df2:ee00::/48 Prefix: 2001:df2:ee00::/48 Prefix description: APNICTRAINING-DC Country code: AU Origin AS: Origin AS Name: ASN for APNICTRAINING LAB DC RPKI status: ROA validation successful First seen: Last seen: Seen by #peers: 160

41 Phase I - Check your ROA # whois -h whois.bgpmon.net " --roa :df2:ee00::/48" 0 Valid ROA Details Origin ASN: AS Not valid Before: :10:04 Not valid After: :00:00 Expires in 3y208d1h39m s Trust Anchor: rpki.apnic.net Prefixes: 2001:df2:ee00::/48 (max length /48) /24 (max length /24)

42 Phase I Global ROA Stats

43 Phase II - RPKI Validator Two options: A. RIPE NCC RPKI Validator B. Dragon Research Labs RPKI Toolkit

44 Phase II - RPKI Validator A. RIPE NCC RPKI Validator Download RPKI Validator Installation # tar -zxvf rpki-validator-app-2.24-dist.tar.gz # cd rpki-validator-app-2.24 #./rpki-validator.sh start

45 Phase II - RPKI Validator A. RIPE NCC RPKI Validator

46 Phase II - RPKI Validator B. Dragon Research Labs RPKI Toolkit Installation process in Ubuntu Xenial /xenial-rp.md Installation # wget -q -O /etc/apt/sources.list.d/rpki.list # wget -q -O /etc/apt/trusted.gpg.d/rpki.asc # apt update # apt install rpki-rp

47 Phase II - RPKI Validator B. Dragon Research Labs RPKI Toolkit

48 Phase III - Router Configuration (JunOS)

49 Phase III - Router Configuration (IOS)

50 Phase III - Router Configuration (GoBGP)

51 Check your prefix Junos rpki-junos>show route protocol bgp / /24 *[BGP/170] 3w5d 16:57:33, MED 0, localpref 110 AS path: I, validation-state: verified > to via xe-1/3/0.0

52 Check your prefix IOS rpki-ios>show ip bgp /24 BGP routing table entry for /24, version Paths: (2 available, best #2, table default) Not advertised to any peer Refresh Epoch from ( ) Origin IGP, localpref 110, valid, external Community: path B8 RPKI State valid

53 Check your prefix GoBGP gobgp global rib /24 Network Next Hop AS_PATH Age Attrs V*> / :13:29 [{Origin: i} {Med: 0} {LocalPref: 110} {Communities: 4608:11101}]

54 Commands Check session status of cache validator server JunOS IOS GoBGP show validation session detail show bgp ipv4 unicast rpki servers gobgp rpki server Full validation database JunOS show validation database IOS GoBGP show bgp ipv4 unicast rpki table gobgp rpki table

55 Acknowledgements Fakrul Alam Tom Harrison (APNIC) Sofia Silva Berenguer (APNIC) 55

56 Thank you! 56

RPKI. Resource Pubic Key Infrastructure

RPKI. Resource Pubic Key Infrastructure RPKI Resource Pubic Key Infrastructure Purpose of RPKI RPKI replaces IRR or lives side by side? Side by side: different advantages Security, almost real time, simple interface: RPKI Purpose of RPKI Is