BGP and Internet Routing Lecture Notes

Class Logistics and Communication

• Attendance trends show that Tuesday lectures are significantly more crowded than other days. This likely stems from a "start of the week" mentality similar to New Year's resolutions, where students intend to be diligent at the beginning of the week but lose momentum within a few days.

• A class Discord server has been established following a student request.

  • To maintain a space where students feel comfortable communicating without academic supervision, the instructor will leave the server and transfer ownership to the class representative.

  • At the time of the transfer, the server already contains over $10$ members.

  • The class representative will serve as the administrator and moderator for the server.

Introduction to Border Gateway Protocol (BGP)

• BGP is a critical protocol responsible for routing packets across the Internet from source to destination using IP addresses.

• The Internet is defined as a "network of networks," specifically a collection of interconnected Autonomous Systems (AS).

  • Autonomous Systems are massive networks that connect to one another to share routing information.

  • A map of the Internet is essentially a map of these big Autonomous Systems.

• Each Autonomous System contains at least one BGP router that performs specific functions:

  • It listens for announcements from other routers advertising new routes.

  • It shares known routes with neighboring autonomous systems using the BGP protocol.

  • It can originate routes, claiming authorization to be the entry or exit point for a specific IP prefix.

BGP Advertisements and Route Selection

• Routing information is exchanged via advertisements.

  • An example advertisement format is: Autonomous System number $X$ advertises that a specific IP prefix is reachable via a path consisting of its own number.

  • If an AS shares a route originated elsewhere, the path length increases as more AS numbers are added (e.g., paths of length $2, 3,\text{ or }4$).

• The route selection process follows a specific workflow:

  1. Routers learn routes from advertisements.

  2. The router chooses one preferred route per IP prefix.

  3. The preferred route is added to the routing table, designating the next hop for packets.

  4. The preferred route is shared with neighbors, depending on the business relationship between the systems.

• Primary factors for selecting the "best" route include:

  • Local Policy: This is often dictated by the business relationship between Autonomous Systems.

  • Path Length: Shorter paths are generally preferred over longer paths (e.g., a path with $2$ hops is preferred over one with $6$ hops), though this is only one of many factors.

Autonomous System Business Relationships

• The economic and policy-driven relationships between systems are categorized into three types:

  1. Customers: These entities pay an AS for Internet reachability. The AS has a functional responsibility to provide connectivity to customers.

  2. Providers: These are typically larger Autonomous Systems that a smaller AS pays to gain wider Internet reach.

  3. Peers: Systems at a similar hierarchical level that exchange traffic directly. This allows them to avoid paying a provider to reach each other's customers.

• Economic Logic of Route Sharing:

  • Advertising a route increases the traffic an AS must handle. It is economically disadvantageous to share routes that do not involve a paying customer.

  • Routes learned from a Customer can be advertised to everyone (Providers, Peers, and other Customers).

  • Routes learned from a Provider or a Peer should only be shared with Customers.

  • Violating these rules (e.g., sharing a route from one Provider to another through a customer's network) can cause traffic to flow through systems that cannot handle the volume, leading to massive service outages.

Global IP Prefix Hierarchy

• IP addresses are distributed through a top-down hierarchy:

  1. Internet Assigned Numbers Authority (IANA): This body sits at the top and distributes large blocks of IP addresses.

  2. Regional Internet Registries (RIR): These organizations, such as APNIC (Asia Pacific Network Information Centre) which serves New Zealand, receive chunks from IANA.

  3. Prefix Holders: These are organizations like the University of Auckland or ISPs that receive delegated prefixes from the RIR.

BGP Security Failures and Attacks

• Prefix Hijacking: This occurs when an Autonomous System that is not authorized to originate a prefix claims to be its origin. This can be compared to placing a fake road sign directing traffic to a fake exit.

• Route Leak: This happens when an AS violates business relationship principles by sharing routes with the wrong parties. This is usually a policy error rather than a malicious attack, but it significantly impacts availability.

• Path Manipulation: A malicious actor may shorten a path by removing AS members from the advertised route. This makes the route appear more attractive to BGP routers, drawing traffic toward the malicious entity where it can be monitored or dropped (black holing).

• Longest Matching Prefix Rule: Routing tables always prioritize the most specific rule. For example, if a table has rules for a $/24$ prefix and a $/25$ prefix, any IP matching both will follow the $/25$ rule because it is more specific. This rule is often exploited in prefix hijacking to override legitimate routes.

Resource Public Key Infrastructure (RPKI)

• RPKI is a framework used to validate that an AS is authorized to originate a specific prefix. It utilizes resource certificates, which are a subtype of $x.509$ certificates.

• Chain of Trust:

  • The Regional Internet Registry (RIR) acts as the Trust Anchor.

  • The RIR issues a certificate to the prefix holder (e.g., an ISP).

  • The prefix holder uses its private key to sign a Route Origin Authorization (ROA).

  • The ROA explicitly states which AS number is permitted to originate a specific IP prefix.

• ROA Creation Methods:

  • Direct Signing: The prefix holder creates a short-lived "End Entity" (EE) certificate to sign the ROA and then discards the private key.

  • Hosted RPKI: The prefix holder uses a web interface provided by the RIR, and the RIR creates and publishes the ROA on their behalf. This is the most common method.

• Validation States for BGP Routers:

  1. Valid: The announcement matches an existing ROA.

  2. Invalid: An ROA exists for the prefix, but the announcing AS or prefix length does not match.

  3. Not Found: No ROA exists for the prefix, leaving it vulnerable to hijacking.

Questions & Discussion

• Question on Amazon Route 53 and MyEtherWallet: What happened during the BGP hijacking attack involving Ethereum?

  • Answer: Attackers compromised BGP routing to announce more specific prefixes for Amazon Route 53 DNS servers. This redirected users visits to myetherwallet.com to malicious phishing servers. While the BGP hijacking was successful, browser-based hostname verification (SSL/TLS certificates) provided a final line of defense. The browser issued a "Wrong Host" warning because the attackers did not possess the legitimate certificate for the domain. However, many users ignored the certificate warning and proceeded, resulting in the loss of their cryptocurrency.

• Question on DNSSEC Adoption: Given that recent RFCs from $2023$ suggest fewer than $10\%$ of domain names use DNSSEC and about one-third of queries to recursive resolvers are invalidated, isn't this a failure of the system?

  • Answer: The low adoption rate is often attributed to a cost-benefit analysis by network operators. The administrative and technical cost of implementing DNSSEC is perceived as higher than the actual threat of DNS-related attacks. Additionally, DNSSEC responses are larger due to the inclusion of RSA keys, which can increase traffic and potentially be used in amplification attacks. Many organizations have decided the vulnerabilities are rare enough that the investment in DNSSEC is not currently justified.