BGP Prefix Origin Validation Keyur Patel (keyupate@cisco.com) May, 2011

Security issues with sourcing of BGP Routes Any AS can source/announce incorrect prefixes within BGP Either by mistake (most cases) Or with a malicious intent In either case, AS can hijack prefixes owned by other AS Has an impact on end-to-end data forwarding BGP prefixes can be hijacked by Sourcing a prefix (with better BGP metrics) that is owned by some other AS Sourcing a more specific for a prefix that is owned by some other AS The main motivation behind using BGP Prefix Origin Validation is …..

Prefix hijacking using same prefix with a shorter AS_PATH Source: nanog 46 preso

Prefix hijacking using a more specific prefix length Source: nanog 46 preso

BGP Prefix Origin Validation Mechanism within BGP to identify incorrectly sourced prefixes and prevent them from being selected as BGP Bestpaths Provides Origin AS Validation for BGP prefixes Solution for You Tube accident 7007 accident (MAI) that affected SPRINT, UUNET and others Any kind of accidental announcements due to incorrect sourcing of BGP prefixes (99% of mis-announcements fall under this category) Does NOT solve BGP path hijacking related issues Origin validation does not provide assurance of BGP aspath received in an update message The main motivation behind using BGP Prefix Origin Validation is …..

Router Modifications for BGP Prefix Origin Validation Router Modifications involves implementation of 3 SIDR drafts Draft1: RPKI Router protocol defined in the ietf draft-sidr-rpki-rtr-protocol12.txt Means of communication between a trusted Cache and BGP routers Helps create and maintain within BGP a new address-family specific digested RPKI database in form of {IP prefixes, Origin AS} tuples Edge routers *do NOT* deal with RPKI complexity. It instead uses digested RPKI information to do Origin validation Draft2: Origin Validation related BGP protocol modifications defined in the IETF draft-ietf-sidr-pfx-validate-01.txt Perform Origin AS validation on ASPATHS of received EBGP prefixes Invalidate prefixes with incorrect origin AS Router Modifications for BGP Prefix Origin Validation Involves *Implementing* RPKI Router Protocol as defined….. First draft involves implementing RPKI Router protocol defined in …. This protocol helps create and maintain within BGP …..

Router Modifications (Cont’d) Draft3: BGP RPKI origin validation state announcement defined in the ietf draft-ietf-sidr-origin-validation-signaling-00.txt Announce path validation state within an IBGP network Using new extended community defined in draft-ietf-sidr-origin-validation-signaling-00.txt Alternate approach to using path validation state community Implementations could translate path validation state into appropriate IBGP parameters that influence BGP Bestpath processing using route policies The 3rd draft provides a means to communicate path validation state information with an IBGP network

RPKI Origin Validation Architecture IR Back End [Hardware] Signing Module Priv Keys RPKI Private Keys ROAs Issued Options Config My Misc Public ID=Me Engine Resource PKI Route Origin Attestations IP Resource Certs ASN Resource Certs CA Data Internal XML Object Transport & Handler Business Key/Cert Management Private IR Anchor Biz Trust Public Keys Up/Down EE IR BackEnd Talking to Keys for DownStreams Issued to Certs My Resources My RightsToRoute Repo Mgt Up / Down Protocol Publication Key(s) Signing Biz EE 8 RCynic Gatherer to Rtr Near/In PoP Cache / Server Provisioning GUI BGP Speaker

Large ISP deployment for Trusted Caches Global RPKI Asia Cache NoAm Euro in-PoP Cust Facing

BGP RPKI Router Protocol Client-Server protocol used between trusted RPKI Caches and BGP Routers having EBGP internet peering Has TCP or SSHv2 as its transport Announces digested RPKI Prefix Origin information in form of protocol IPvx PDUs Has an ability: to request/announce entire record table at any time during the lifetime of the session Can do Incremental re-sync or Full announcement of prefix records on session re-establishment Initial Cisco IOS release plans to: Run TCP as a transport on its BGP Routers Implement Client side functionality of RPKI router protocol

RPKI Router Protocol PDUs Serial Notify Local Cache informs router about new data Serial Query Router requests Cache for updates Reset Query Router requests Cache to send its entire database Cache Response Cache replies to Reset Query by announcing its entire database End of Data PDU Cache signals end of database announcements

RPKI Router Protocol PDU (cont’d) Cache Reset Local Cache informs router about its inability to provide an incremental update for a particular Serial Query Error Report Use to signal errors detected while parsing PDUs Internal Errors: memory exhaustion, code assertion failures, etc No Data Available: Cache cannot provide an incremental update to a particular Serial Query IPV4 Prefix Use to announce IPV4 Prefix IPV6 Prefix Use to announce IPV6 Prefix

RPKI Router Protocol Typical Exchange Validator Cache Router ~ ~ | <----- Reset Query -------- | R requests data | | | ----- Cache Response -----> | C confirms request | ------- IPvX Prefix ------> | C sends zero or more | ------- IPvX Prefix ------> | IPv4 and IPv6 Prefix | ------- IPvX Prefix ------> | Payload PDUs | ------ End of Data ------> | C sends End of Data | | and sends new serial 13

RPKI Router Protocol Incremental Exchange (cont’d) Validator Cache Router ~ ~ | -------- Notify ----------> | (optional) | | | <----- Serial Query ------- | R requests data | ----- Cache Response -----> | C confirms request | ------- IPvX Prefix ------> | C sends zero or more | ------- IPvX Prefix ------> | IPv4 and IPv6 Prefix | ------- IPvX Prefix ------> | Payload PDUs | ------ End of Data ------> | C sends End of Data | | and sends new serial 14

RPKI Router Protocol and BGP Interaction ee Receives prefixes from ibgp & ebgp peers Does Inline prefix validation Does Event-based validation on cache updates BGP Border Router iBGP peering AF specific Prefix Validation database AF Specific BGP tables iBGP Neighbor Router (ex. Route Reflector) eBGP peering RPKI Router Protocol (TCP based) Client RPKI Router protocol RPKI Validator Cache eBGP Neighbor Router

BGP Modifications - High Level Code Flow Process received EBGP update messages Set Validation State for BGP NLRIs and origin AS received in an update message Apply any inbound policies if configured may use path validation state computed by Prefix origin validation to set different policies Store the path in Adj-Rib-In Run Modified BGP Bestpath Evaluate the prefix for update generation to ibgp peers outbound policies may use path validation state to manipulate different BGP attributes Use a well-known extended community to announce path validation state 16

Prefix Validation Logic 1. query key = <BGP prefix, masklen>, data = origin AS 2. result = BGP_PFXV_STATE_NOT_FOUND 3. walk prefix validation table to look for the query key 4. for each matched “entry” node in prefix validation table, 5. prefix_exists = TRUE 6. walk all records with different maxLength values 7. for each “record” within range (query masklen <= maxLength) 8. if query origin AS == record origin AS 9. result = BGP_PFXV_STATE_VALID 10. return (result) 11. endif 12. endfor 13. endfor 14. if prefix_exists == TRUE, 15. result = BGP_PFXV_STATE_INVALID 16. endif 17. return (result)

BGP Bestpath Selection Modifications Path Validation States (in order of preference) BGP_FXV_STATE_VALID (Lookup Successful) BGP_PFX_STATE_NOT_FOUND (Not in the table) BGP_PFX_STATE_INVALID (Lookup invalid - different origin AS or masklen not in the range) BGP Bestpath Modifications Input: Received Path, Current Bestpath If Received Path is an ibgp learnt path without path validation state, then skip the Prefix Origination check If Received Path’s Prefix Origination Check state is BGP_PFX_STATE_INVALID then prefer the Current Bestpath else If Received Path’s Prefix Origination Check state > Current Bestpath Prefix Origination Check state, then prefer the Current Bestpath else (they are equal) proceed to next Bestpath check step Rest of the BGP Bestpath Steps Normal Bestpath computation to follow if the path validation state is converted into BGP parameters as part of policy change

Policy and Path Validation State Route-maps extended to modify policies based on path validation state Effective way of tweaking bestpath selection for ibgp paths based on its path validation state Route-map example: route-map rpki permit 10 match rpki invalid set local-preference 50 route-map rpki permit 20 match rpki incomplete set local-preference 100 route-map rpki permit 30 match rpki valid set local-preference 200 19

BGP CLI Modifications Global CLI to [de-]configure the cache server AF specific BGP Bestpath CLI Changes Disable Prefix Validation Globally Allow paths with an invalid rpki state for Bestpath computation iBGP Neighbor CLI Changes Announcement of Prefix Validation State using a well-known extended community Route-map policy knob to filter on path validation state

IOS Show commands uut1# show ip bgp rpki-table 12 BGP sovc network entries using 1056 bytes of memory 13 BGP sovc record entries using 208 bytes of memory Network Maxlen Origin -AS Color Source 1.1.0.0/16 24 1 3.0.0.0/24 2 4.0.0.0/24 3 4.0.0.0/8 8 5.0.0.0/24 4 8.0.0.0/4 6 200 8.2.0.0/8 36394 9.2.0.0/16 34000 10.0.0.0/6 100 11.0.0.0/16 12.0.0.0/8 16 13979 7018 20.137.0.0/21 21 4237

IOS Show Commands - Valid IPv4 Prefix uut1# show ip bgp 1.1.0.0/16 BGP routing table entry for 1.1.0.0/16, version 19 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 2 1 20.0.101.1 from 20.0.101.1 (20.0.101.1) Origin IGP, localpref 100, valid, external, best RPKI State valid 22

IOS Show Commands - Invalid IPv4 Prefix uut1#show ip bgp 8.0.0.0/6 BGP routing table entry for 8.0.0.0/6, version 25 Paths: (1 available, no best path) Not advertised to any peer 100 20.0.101.4 from 20.0.101.4 (20.0.101.4) Origin IGP, localpref 100, valid, external RPKI State invalid 23

IOS Show Commands - Not Found IPv4 Prefix uut1#show ip bgp 8.0.0.0 BGP routing table entry for 8.0.0.0/8, version 10 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 2 65000 20.0.101.10 from 20.0.101.10 (20.0.101.10) Origin IGP, localpref 100, valid, external, best RPKI State not found 24

Code Status Remember: Please generate your Certificates and ROAs! Prototype code for BGP Origin Validation available for IOS (7200s) and IOS-XR IOS Marketing Roadmap has it for RLS12 in 2011. Similar Roadmap for IOS-XR. Contact Ed Kern (ejk@cisco.com) or Bertrand Duvivier (bduvivie@cisco.com) if interested Remember: Please generate your Certificates and ROAs! 25