Transcription

1

2

3

4

5

6 ISP 1 AS 1 Prefix P peer ISP 2 AS 2 Route leak (P) propagates Prefix P update Route update P Route leak (P) to upstream 2 AS 3 Customer

7 BGP Update messages

8

9 Route update A ISP A Prefix A ISP B B leaks route A ISP C

10 Route update A ISP A Prefix A Customer Peer Peer leaks route to other peer

11 ISP Customer leaks peer prefixes to ISP Customer Peer Peer leaks route to other peer

12 Google-Hathway (Peers) Airtel is transit provider for Hathway Customer networks preferred over peers

13 Prefix A: AS3, AS2 ISP AS 3 ISP AS 1 Prefix A Route update A Leaks route to ISP B Customer AS 2 Prefix A: AS2, AS1

14 ISP A Prefix A ISP B Route update A Leaks internal routes and more specifics to other ISPs Customer Peer Customer leaks route and more specifics to other peers Peer

15 Type of Route leak Type 1: Hairpin Turn with Full Prefix Type 2: Lateral ISP-ISP-ISP Type 3: Leak of Transit-Provider Prefixes to Peer Type 4: Leak of Peer Prefixes to Transit Provider Type 5: Prefix re-origination with Data Path to legitimate Origin Type 6: Accidental leak of Internal Prefixes and more specifics Current State of Detection Coverage Neither OV nor BGPSec Neither OV nor BGPSec Neither OV nor BGPSec Neither OV nor BGPSec OV detects Internal prefixes not meant to be routed: OV can detect (no covering ROA or AS0 ROA) ROA maxlength for more specifics

16

17 Source: Wikipedia For a majority of networks, the chance that your have one of those Tier 1 as transit customer is relatively low =>>> filter them out deny any annoucement with AS_PATH containing big network ASes

18

19

20

21

22 Peer B PEER D Peer A YOU PEER C PEER E

23

24

25

26

27

28

29

30 Resource Certification Amreesh Phokeer

31 Agenda What is the rationale behind RPKI? What is resource certification? How to get your resources certified? How to sign your routing announcements? How to make your router talk RPKI? How to build filters based on validated routes? Demo Current hot topics 2

32 Rationale Routing mostly based on trust BGP offer amazing possibilities but poor security No systematic way to filter peers and customers Unreliable sources of policy information The Internet is full of stories of: Route leaks you said? BGP hijacks Traffic redirection Blackholing 3

33 Mitigation techniques Conservative filtering Use of Routing Registries but: Do not have all routing information Do not necessarily mirror each other Routing policies not kept up-to-date Error-prone 4

34 Youtube and Pakistan Telecom (2008) 5

35 Timeline 6

36 China Telecom - Traffic redirection 7

37 How do we securing Internet Routing? A route consist of: An origin-as and a prefix A path 8

38 How do we securing Internet Routing? A route consist of: An origin-as and a prefix A path 9

39 How do we securing Internet Routing? A route consist of: An origin-as and a prefix A path Prefix origination AS_PATH You need to secure both!!! 10

40 Solution - RPKI SIDR group at the IETF How to securely verify that an AS is authorised to announce a prefix? (Origin Validation) How to make sure that the AS_PATH has not been modified? (BGPSEC) Origin validation RFC 5280: X.509 Public Key Infrastructure RFC 3779: Extensions for IP addresses and ASN BGPSEC (still on-going) 11

41 Role of the RIR Receives global allocations from IANA Distribute and manage resources at a regional level Make sure information are up-to-date and accurate Becomes the de-facto authority as sole registry regionally LACNIC ARIN IANA APNIC LIR RIPE NCC AFRINIC EU 12

42 Role of the RIR Receives global allocations from IANA Distribute and manage resources at a regional level Make sure information are up-to-date and accurate Becomes the de-facto authority as sole registry regionally LACNIC ARIN IANA APNIC LIR RIPE NCC AFRINIC EU 13

43 Resource Certificates RPKI defines two types of certificates: CA - Certificate Authority (to issue CA or EE) EE - End-entity (digital signature, etc) Certify resources - verifiable ownership! AFRINIC has a self-signed root certificate IANA one-day! Opt-in service, one year validity Exclude legacy space/members 14

44 Certificate hierarchy Issuer: AFRINIC Subject: ISP1 Resources: /16 Pub Key Info: <ISP1-key> Signed by: <root-key-priv> Resource Allocation Hierarchy Issuer: ISP1 Subject: ISP2 Resources: /22 Pub Key Info: <isp2-key> Signed by: <afrinic-key-priv> Issuer: ISP2 Subject: ISP2-EE Resources: /24 Pub Key Info: <isp2-ee-key> Signed by: <isp2-key-priv> ROA AS /

45 Repositories LACNIC R R ARIN R R IANA APNIC R LIR Public RIPE NCC R EU Certificates and ROA AFRINIC R CRL and MFT Publish at parent Hosted or delegated HOSTED MODE only 16

46 AFRINIC s Repository AFRINIC Root Certificate AFRINIC member s repository 17

47 Demo 18

48 Validated caches AFRINIC Validator Host: validator.afrinic.net Port:

49 Configure your router router bgp bgp rpki server tcp port refresh 60 bgp rpki server tcp port refresh 60 20

50 Route announcement status Valid A matching/covering prefix was found with a matching AS number Invalid A covering prefix was found, but the AS number did not match, and there was no other matching one NotFound No matching or covering prefix was found, same as today 21

51 You define your own policy Fairly Secure route-map validity-0 match rpki valid set local-preference 100 route-map validity-1 match rpki not-found set local-preference 50! invalid is dropped Paranoid route-map validity-0 match rpki valid set local-preference 110! everything else dropped Security Geek route-map validity-0 match rpki invalid set local-preference 110! everything else dropped 22

52 RPKI tools Validators: RIPE Validator Rcynic - (CA+Validator) RPSTIR Looking glasses: bgp.he.net Bgpmon RIPEStat 23

53 RPKI Hot topics Global trust anchor ICANN/IANA/NRO Support from local RIR community RPKI Adverse actions RPKI Validation considered Transfers of resources ERX spaces 24

54 Questions 25