1. BGP Prefix Origin Validation
Keyur Patel
May, 2011

2. Security issues with sourcing of BGP Routes
Any AS can source/announce incorrect prefixes within BGP
Either by mistake (most cases)
Or with a malicious intent
In either case, AS can hijack prefixes owned by other AS
Has an impact on end-to-end data forwarding
BGP prefixes can be hijacked by
Sourcing a prefix (with better BGP metrics) that is owned by some other AS
Sourcing a more specific for a prefix that is owned by some other AS
The main motivation behind using BGP Prefix Origin Validation is …..

3. Prefix hijacking using same prefix with a shorter AS_PATH
Source: nanog 46 preso

4. Prefix hijacking using a more specific prefix length
Source: nanog 46 preso

5. BGP Prefix Origin Validation
Mechanism within BGP to identify incorrectly sourced prefixes and prevent them from being selected as BGP Bestpaths
Provides Origin AS Validation for BGP prefixes
Solution for
You Tube accident
7007 accident (MAI) that affected SPRINT, UUNET and others
Any kind of accidental announcements due to incorrect sourcing of BGP prefixes (99% of mis-announcements fall under this category)
Does NOT solve BGP path hijacking related issues
Origin validation does not provide assurance of BGP aspath received in an update message
The main motivation behind using BGP Prefix Origin Validation is …..

6. Router Modifications for BGP Prefix Origin Validation
Router Modifications involves implementation of 3 SIDR drafts
Draft1: RPKI Router protocol defined in the ietf draft-sidr-rpki-rtr-protocol12.txt
Means of communication between a trusted Cache and BGP routers
Helps create and maintain within BGP a new address-family specific digested RPKI database in form of {IP prefixes, Origin AS} tuples
Edge routers *do NOT* deal with RPKI complexity. It instead uses digested RPKI information to do Origin validation
Draft2: Origin Validation related BGP protocol modifications defined in the IETF draft-ietf-sidr-pfx-validate-01.txt
Perform Origin AS validation on ASPATHS of received EBGP prefixes
Invalidate prefixes with incorrect origin AS
Router Modifications for BGP Prefix Origin Validation Involves *Implementing* RPKI Router Protocol as defined…..
First draft involves implementing RPKI Router protocol defined in ….
This protocol helps create and maintain within BGP …..

7. Router Modifications (Cont’d)
Draft3: BGP RPKI origin validation state announcement defined in the ietf draft-ietf-sidr-origin-validation-signaling-00.txt
Announce path validation state within an IBGP network
Using new extended community defined in draft-ietf-sidr-origin-validation-signaling-00.txt
Alternate approach to using path validation state community
Implementations could translate path validation state into appropriate IBGP parameters that influence BGP Bestpath processing using route policies
The 3rd draft provides a means to communicate path validation state information with an IBGP network

8. RPKI Origin Validation ArchitectureIR
Back End
[Hardware]
Signing Module
Priv Keys
RPKI
Private
Keys
ROAs
Issued
Options
Config
My Misc
Public
ID=Me
Engine
Resource PKI
Route Origin Attestations
IP Resource Certs
ASN Resource Certs
CA Data
Internal
XML Object
Transport
& Handler
Business
Key/Cert
Management
Private IR
Anchor
Biz Trust
Public Keys
Up/Down EE
IR BackEnd
Talking to
Keys for
DownStreams
Issued to
Certs
My Resources
My RightsToRoute
Repo Mgt
Up / Down
Protocol
Publication
Key(s)
Signing
Biz EE 8
RCynic
Gatherer
to Rtr
Near/In PoP
Cache /
Server
Provisioning
GUI
BGP Speaker

9. Large ISP deployment for Trusted Caches
Global
RPKI
Asia
Cache
NoAm
Euro
in-PoP
Cust
Facing

10. BGP RPKI Router Protocol
Client-Server protocol used between trusted RPKI Caches and BGP Routers having EBGP internet peering
Has TCP or SSHv2 as its transport
Announces digested RPKI Prefix Origin information in form of protocol IPvx PDUs
Has an ability:
to request/announce entire record table at any time during the lifetime of the session
Can do Incremental re-sync or Full announcement of prefix records on session re-establishment
Initial Cisco IOS release plans to:
Run TCP as a transport on its BGP Routers
Implement Client side functionality of RPKI router protocol

11. RPKI Router Protocol PDUs
Serial Notify
Local Cache informs router about new data
Serial Query
Router requests Cache for updates
Reset Query
Router requests Cache to send its entire database
Cache Response
Cache replies to Reset Query by announcing its entire database
End of Data PDU
Cache signals end of database announcements

12. RPKI Router Protocol PDU (cont’d)
Cache Reset
Local Cache informs router about its inability to provide an incremental update for a particular Serial Query
Error Report
Use to signal errors detected while parsing PDUs
Internal Errors: memory exhaustion, code assertion failures, etc
No Data Available: Cache cannot provide an incremental update to a particular Serial Query
IPV4 Prefix
Use to announce IPV4 Prefix
IPV6 Prefix
Use to announce IPV6 Prefix

13. RPKI Router Protocol Typical Exchange
Validator Cache Router
~ ~
| <----- Reset Query | R requests data
| |
| Cache Response -----> | C confirms request
| IPvX Prefix > | C sends zero or more
| IPvX Prefix > | IPv4 and IPv6 Prefix
| IPvX Prefix > | Payload PDUs
| End of Data > | C sends End of Data
| | and sends new serial 13

14. RPKI Router Protocol Incremental Exchange (cont’d)
Validator Cache Router
~ ~
| Notify > | (optional)
| |
| <----- Serial Query | R requests data
| Cache Response -----> | C confirms request
| IPvX Prefix > | C sends zero or more
| IPvX Prefix > | IPv4 and IPv6 Prefix
| IPvX Prefix > | Payload PDUs
| End of Data > | C sends End of Data
| | and sends new serial 14

15. RPKI Router Protocol and BGP Interactionee
Receives prefixes from ibgp & ebgp peers
Does Inline prefix validation
Does Event-based validation on cache updates
BGP Border Router
iBGP peering
AF specific Prefix
Validation database
AF Specific BGP tables
iBGP Neighbor Router
(ex. Route Reflector)
eBGP peering
RPKI Router Protocol
(TCP based) Client
RPKI Router protocol
RPKI Validator
Cache
eBGP Neighbor Router

16. BGP Modifications - High Level Code Flow
Process received EBGP update messages
Set Validation State for BGP NLRIs and origin AS received in an update message
Apply any inbound policies if configured
may use path validation state computed by Prefix origin validation to set different policies
Store the path in Adj-Rib-In
Run Modified BGP Bestpath
Evaluate the prefix for update generation to ibgp peers
outbound policies may use path validation state to manipulate different BGP attributes
Use a well-known extended community to announce path validation state 16

17. Prefix Validation Logic
1. query key = <BGP prefix, masklen>, data = origin AS
2. result = BGP_PFXV_STATE_NOT_FOUND
3. walk prefix validation table to look for the query key
4. for each matched “entry” node in prefix validation table,
prefix_exists = TRUE
walk all records with different maxLength values
for each “record” within range (query masklen <= maxLength)
if query origin AS == record origin AS
result = BGP_PFXV_STATE_VALID
return (result)
endif
endfor
13. endfor
14. if prefix_exists == TRUE,
result = BGP_PFXV_STATE_INVALID
16. endif
17. return (result)

18. BGP Bestpath Selection Modifications
Path Validation States (in order of preference)
BGP_FXV_STATE_VALID (Lookup Successful)
BGP_PFX_STATE_NOT_FOUND (Not in the table)
BGP_PFX_STATE_INVALID (Lookup invalid - different origin AS or masklen not in the range)
BGP Bestpath Modifications
Input: Received Path, Current Bestpath
If Received Path is an ibgp learnt path without path validation state, then skip the Prefix Origination check
If Received Path’s Prefix Origination Check state is BGP_PFX_STATE_INVALID then prefer the Current Bestpath
else If Received Path’s Prefix Origination Check state > Current Bestpath Prefix Origination Check state, then prefer the Current Bestpath
else (they are equal) proceed to next Bestpath check step
Rest of the BGP Bestpath Steps
Normal Bestpath computation to follow if the path validation state is converted into BGP parameters as part of policy change

19. Policy and Path Validation State
Route-maps extended to modify policies based on path validation state
Effective way of tweaking bestpath selection for ibgp paths based on its path validation state
Route-map example:
route-map rpki permit 10
match rpki invalid
set local-preference 50
route-map rpki permit 20
match rpki incomplete
set local-preference 100
route-map rpki permit 30
match rpki valid
set local-preference 200 19

20. BGP CLI Modifications Global CLI to [de-]configure the cache server
AF specific BGP Bestpath CLI Changes
Disable Prefix Validation Globally
Allow paths with an invalid rpki state for Bestpath computation
iBGP Neighbor CLI Changes
Announcement of Prefix Validation State using a well-known extended community
Route-map policy knob to filter on path validation state

21. IOS Show commands uut1# show ip bgp rpki-table
12 BGP sovc network entries using 1056 bytes of memory
13 BGP sovc record entries using 208 bytes of memory
Network
Maxlen
Origin -AS
Color
Source
/16 24 1
/24 2
/24 3 /8 8
/24 4 /4 6
200 /8
36394
/16
34000 /6
100
/16 /8 16
13979
7018
/21 21
4237

22. IOS Show Commands - Valid IPv4 Prefix
uut1# show ip bgp /16
BGP routing table entry for /16, version 19
Paths: (1 available, best #1, table default)
Advertised to update-groups: 1
from ( )
Origin IGP, localpref 100, valid, external, best
RPKI State valid 22

23. IOS Show Commands - Invalid IPv4 Prefix
uut1#show ip bgp /6
BGP routing table entry for /6, version 25
Paths: (1 available, no best path)
Not advertised to any peer
100
from ( )
Origin IGP, localpref 100, valid, external
RPKI State invalid 23

24. IOS Show Commands - Not Found IPv4 Prefix
uut1#show ip bgp
BGP routing table entry for /8, version 10
Paths: (1 available, best #1, table default)
Advertised to update-groups:
65000
from ( )
Origin IGP, localpref 100, valid, external, best
RPKI State not found 24

25. Code Status Remember: Please generate your Certificates and ROAs!
Prototype code for BGP Origin Validation available for IOS (7200s) and IOS-XR
IOS Marketing Roadmap has it for RLS12 in Similar Roadmap for IOS-XR.
Contact Ed Kern or Bertrand Duvivier if interested
Remember: Please generate your Certificates and ROAs! 25