MaxLength Considered Harmful to the RPKI Yossi Gilad, Omar Sagga , - PowerPoint PPT Presentation

MaxLength Considered Harmful to the RPKI Yossi Gilad, Omar Sagga , Sharon Goldberg Boston University

Outline Background ❖ How does BGP work? ➢ How does RPKI work? ➢ What is the “maxLength”? ➢ How maxLength causes problems ❖ How to fix the problems caused by maxLength ❖

Border Gateway Protocol (BGP) Path: AS 111 168.122.0.0/16 AS 111 AS 222 168.122.0.0/16

Problem: Subprefix Hijack Path: AS 111 168.122.0.0/16 AS 111 AS 222 AS 666 168.122.0.0/16

Problem: Subprefix Hijack Path: AS 666 168.122.0.0/24 Path: AS 111 168.122.0.0/16 AS 111 AS 222 AS 666 168.122.0.0/16

Problem: Subprefix Hijack BGP routers perform a longest-prefix match Path: AS 666 168.122.0.0/24 Path: AS 111 168.122.0.0/16 /24 destinations AS 111 AS 222 AS 666 168.122.0.0/16

Solution: RPKI ROA: AS 111 RPKI 168.122.0.0/16 AS 111 AS 222 168.122.0.0/16

Solution: RPKI ROA: AS 111 RPKI RPKI 168.122.0.0/16 ✓ Path: AS 111 168.122.0.0/16 RPKI VALID AS 111 AS 222 168.122.0.0/16

Solution: RPKI ROA: AS 111 RPKI 168.122.0.0/16 Path: AS 666 ✓ Path: AS 111 168.122.0.0/24 168.122.0.0/16 RPKI VALID AS 111 AS 222 AS 666 168.122.0.0/16

Solution: RPKI ROA: AS 111 RPKI AS 666 fails to attract traffic! 168.122.0.0/16 ✘ Path: AS 666 ✓ Path: AS 111 168.122.0.0/24 RPKI INVALID 168.122.0.0/16 RPKI VALID AS 111 AS 222 AS 666 168.122.0.0/16

MaxLength in RPKI Path: AS 111 168.122.0.0/17 Path: AS 111 168.122.128.0/17 . . . . AS 111 Path: AS 111 168.122.0.0/16 168.122.255.0/24

MaxLength in RPKI ROA: AS 111 Path: AS 111 168.122.0.0/17 168.122.0.0/17 ROA: AS 111 Path: AS 111 168.122.128.0/17 168.122.128.0/17 . . . . . . . . AS 111 ROA: AS 111 Path: AS 111 168.122.255.0/24 168.122.0.0/16 168.122.255.0/24

MaxLength in RPKI ROA: AS 111 Path: AS 111 168.122.0.0/17 168.122.0.0/17 ROA: AS 111 Path: AS 111 168.122.128.0/17 168.122.128.0/17 ROA: AS 111 168.122.0.0/16 . . . . . . . . to maxLength 24 AS 111 AS 111 ROA: AS 111 Path: AS 111 168.122.255.0/24 168.122.0.0/16 168.122.255.0/24

Outline Background ❖ How does BGP work? ➢ How does RPKI work? ➢ What is the “maxLength”? ➢ How maxLength causes problems ❖ Forged-Origin Subprefix Hijack ➢ How to fix the problems caused by maxLength ❖

Forged-Origin Subprefix Hijack ROA: AS 111 RPKI 168.122.0.0/16 to maxLength 24 ✓ Path: AS 111 168.122.0.0/16 RPKI VALID AS 111 AS 222 168.122.0.0/16

Forged-Origin Subprefix Hijack ROA: AS 111 RPKI 168.122.0.0/16 to maxLength 24 Path: AS 666, AS111 ✓ Path: AS 111 168.122.0.0/24 168.122.0.0/16 RPKI VALID AS 111 AS 222 AS 666 168.122.0.0/16

Forged-Origin Subprefix Hijack ROA: AS 111 RPKI 168.122.0.0/16 to maxLength 24 ✓ Path: AS 666, AS111 ✓ Path: AS 111 168.122.0.0/24 RPKI VALID 168.122.0.0/16 RPKI VALID AS 111 AS 222 AS 666 168.122.0.0/16

Forged-Origin Subprefix Hijack ROA: AS 111 RPKI 168.122.0.0/16 AS 666 is the ONLY path to the subprefix! to maxLength 24 ✓ Path: AS 666, AS111 ✓ Path: AS 111 168.122.0.0/24 RPKI VALID 168.122.0.0/16 RPKI VALID AS 111 AS 222 AS 666 168.122.0.0/16

Maxlength almost always creates vulnerabilities! ➢ In June 2017: ▪ 12% of the prefixes in ROAs have a maxLength > prefix length. ▪ 84% of these are vulnerable to forged-origin subprefix hijacks!

Outline Background ❖ How does BGP work? ➢ How does RPKI work? ➢ What is the “maxLength”? ➢ How maxLength causes problems ❖ How to fix the problems caused by maxLength ❖

Minimal ROAs stop forged origin subprefix hijacks A ROA is minimal when it includes only those prefixes that the AS announces in BGP, and no other prefixes. Minimal ROA Path: AS 111 168.122.0.0/16 ROA: AS 111 Path: AS 111 168.122.0.0/16 168.122.0.0/17 168.122.0.0/17 168.122.128.0/17 Path: AS 111 168.122.0.0/18 168.122.128.0/17 Path: AS 111 168.122.0.0/18 AS 111

Minimal ROAs stop forged origin subprefix hijacks ROA: AS 111 RPKI 168.122.0.0/16 168.122.0.0/17 168.122.128.0/17 168.122.0.0/18 Path: AS 111 168.122.0.0/16 Path: AS 111 168.122.0.0/17 Path: AS 111 168.122.128.0/17 Path: AS 111 168.122.0.0/18 AS 222 AS 111

Minimal ROAs stop forged origin subprefix hijacks ROA: AS 111 RPKI 168.122.0.0/16 168.122.0.0/17 168.122.128.0/17 168.122.0.0/18 Path: AS 666, AS111 Path: AS 111 168.122.0.0/16 168.122.0.0/24 Path: AS 111 168.122.0.0/17 Path: AS 111 168.122.128.0/17 Path: AS 111 168.122.0.0/18 AS 222 AS 666 AS 111

Minimal ROAs stop forged origin subprefix hijacks ROA: AS 111 RPKI 168.122.0.0/16 168.122.0.0/17 168.122.128.0/17 168.122.0.0/18 ✘ Path: AS 666, AS111 Path: AS 111 168.122.0.0/16 168.122.0.0/24 RPKI INVALID Path: AS 111 168.122.0.0/17 Path: AS 111 168.122.128.0/17 Path: AS 111 168.122.0.0/18 AS 222 AS 666 AS 111

How minimal ROAs affect filtering rules Non-minimal ROA ROA: AS 111 168.122.0.0/16 to maxLength 24 Path: AS 111 168.122.0.0/16 Path: AS 111 insecure ✘ 168.122.0.0/17 Path: AS 111 168.122.128.0/17 Path: AS 111 168.122.0.0/18 AS 111

How minimal ROAs affect filtering rules Non-minimal ROA ROA: AS 111 168.122.0.0/16 to maxLength 24 Path: AS 111 168.122.0.0/16 Path: AS 111 insecure ✘ 168.122.0.0/17 Path: AS 111 1 filtering rule 168.122.128.0/17 Path: AS 111 168.122.0.0/18 (AS 111, 168.122.0.0, len: 16, maxlen: 24) AS 111

How minimal ROAs affect filtering rules Non-minimal Minimal ROA ROA (no maxlen!) ROA: AS 111 ROA: AS 111 168.122.0.0/16 168.122.0.0/16 168.122.0.0/17 to maxLength 24 168.122.128.0/17 Path: AS 111 168.122.0.0/18 168.122.0.0/16 Path: AS 111 insecure ✘ 168.122.0.0/17 secure! Path: AS 111 1 filtering rule 4 filtering rules 168.122.128.0/17 Path: AS 111 168.122.0.0/18 AS 111

How minimal ROAs affect filtering rules Non-minimal Minimal ROA Minimal ROA ROA (no maxlen!) (compressed!) ROA: AS 111 ROA: AS 111 ROA: AS 111 168.122.0.0/16 168.122.0.0/16 168.122.0.0/16 168.122.0.0/17 to maxLength 17 to maxLength 24 168.122.128.0/17 Path: AS 111 168.122.0.0/18 168.122.0.0/18 168.122.0.0/16 Path: AS 111 insecure ✘ secure! 168.122.0.0/17 secure! Path: AS 111 2 filtering rules 1 filtering rule 4 filtering rules 168.122.128.0/17 Path: AS 111 168.122.0.0/18 Our compress_roas software converts a minimal ROA (no maxlen) to a compressed minimal ROA! AS 111

How minimal ROAs affect RPKI-validating routers more prefixes in ROAs More filtering rules

How minimal ROAs affect RPKI-validating routers more prefixes in ROAs More filtering rules

How minimal ROAs affect RPKI-validating routers more prefixes in ROAs Insecure case! Every IPv4 prefix has More maxLength = 32 & filtering is vulnerable to forged rules origin sub-prefix hijack!

How minimal ROAs affect RPKI-validating routers more prefixes in ROAs secure! More uses our filtering compress_roas rules software!

Summary ➢ Operators (and RPKI configuration interfaces) should ○ be cautious when using maxLength attribute ○ use minimal ROAs whenever possible ○ follow our recommendations in IETF draft-yossigi-rpkimaxlen ➢ In an RPKI full deployment scenario: ○ maxLength does reduce overhead at routers ○ but our compression tool gives comparable results

Summary ➢ Operators (and RPKI configuration interfaces) should ○ be cautious when using maxLength attribute ○ use minimal ROAs whenever possible ○ follow our recommendations in IETF draft-yossigi-rpkimaxlen ➢ In an RPKI full deployment scenario: ○ maxLength does reduce overhead at routers ○ but our compression tool gives comparable results Thanks!