Has BGP routing security failed (yet)?

▼ In the thorough style we've come to expect from him, Geoff Huston tries to answer the question Is Secured Routing a Market Failure? Please read about the market aspect (and the limitations imposed on the IETF by big router vendors) in that article. His final conclusion is broader, through:

But mostly it's a failure because it does not deliver. Security solutions that offer only a thin veneer of the appearance of improvement while offering little in the way of improved defence against determined attack are perhaps worse than a placebo.

20 years ago I went to my first IETF meeting and there I learned about S-BGP and soBGP. It would take another almost ten years for RPKI to be standardized and fifteen years for the BGPSEC specification (which is largely S-BGP with the RPKI functionality removed) to be published. RPKI is gaining some traction but hasn't been able to stop at least some determined attackers. There are no production level implementations of BGPSEC after five years.

So why is that? True, if people would be prepared to pay extra for secure routing, we'd have it by now.

But I think the bigger issue is failure to understand the problem.

Looking at the valley-free model, we can observe that the right hand part of the network hierarchy is trusted by the sender of the routing updates / receiver of the packets, while the left hand side is trusted by the receiver of the routing updates / sender of the packets.

This hierarchy is pretty flat, so there's usually only a handful of networks on each side. So telling the world that those are networks you trust should be something we can do reasonably efficiently. Then, the only thing is to make sure that there are no network hops in the path that aren't trusted by either side.

Earlier this year, RFC 9234 "Route Leak Prevention and Detection Using Roles in UPDATE and OPEN Messages" was published. This adds some information to BGP that lets it detect paths that aren't valley-free. The nice thing about this mechanism is that it protects two networks that implement the mechanism against mistakes made by networks that don't implement the mechanism.

We still need better mechanisms to thwart determined, purposeful attackers, but the good news is that we've made life a lot harder for those already. So even though we're not there yet when it comes to secured routing, it's not so much that we've failed, but that we are taking too much time to succeed.

Permalink - posted 2022-12-13

Free Range Routing vs Quagga/Cisco

▼ Back in the 1990s, I used Cisco routers. Mostly rather underpowered ones such as the Cisco 2500 series. I later started using the Zebra and then Quagga routing software for the lab part of my training courses.

However, like Zebra before it, Quagga also ran out of steam but was forked by people (and companies) who saw value in the software. The Quagga fork is Free Range Routing a.k.a. FRRouting a.k.a. FRR.

As I was writing my new BGP book, I made configuration examples using Quagga. But about two thirds in, I decided to switch to FRRouting. This had the huge advantage that I could include RPKI examples. But on the other hand, I now had to revisit all my earlier configuration examples to see if they still worked under FRR. And too often, the answer was "no".

So let me list some differences between Quagga or even old school Cisco routers and FRRouting.

A really annoying change is that in FRR, it's no longer "ip as-path ..." but "bgp as-path ..." to define AS path access lists. Yes, it makes more sense. But this change immediately makes it impossible to have a configuration file that works on both Cisco/Quagga and FRR. Same thing for "ip community ..." vs "bgp community ...".

I think the solution here would have been to accept the "ip ..." syntax and translate that into "bgp ..." syntax. That way, an FRR BGP daemon could still read Quagga BGP daemon configurations and work as expected.

Another change is that with FRR, there's no way to get around "address-family ipv4".

Way, way, way back in the day, we didn't have IPv6. Actually, it took quite a while for 1990s routers like the 2500 series to gain IPv6 capability. So there was no reason to differentiate between BGP configuration commands that both apply to IPv4 and IPv6 and configuration commands that only apply to either IPv4 or IPv6.

With Cisco routers, you could always just pretend like IPv6 didn't exist and enter configurations like:

!
router bgp 65086
 no synchronization
 network 10.86.0.0 mask 255.255.0.0
 neighbor 203.0.113.83 remote-as 65083
 no auto-summary
!

On FRR, you can still paste that configuration snippet. But if you then issue "show running-config", this is what you get back:

!
router bgp 65086
 neighbor 203.0.113.83 remote-as 65083
 !
 address-family ipv4 unicast
  network 10.86.0.0/16
 exit-address-family
exit
!

Yes, it boils down to the same thing, but it looks rather different. Especially as the configuration gets longer and the non address family part and the IPv4 address family part don't fit on the screen at the same time.

Bottom line: FRR is moving away from the traditional Cisco configuration language relatively quickly, white Quagga, for BGP at least, stayed pretty close to that. So moving from Quagga to FRR is a bigger step than you might think.

Also, as much as we may be unhappy with Cisco for some of their high profile software bugs, more minor software bugs happen much more frequently in these software implementations such as Quagga and FRR. For instance, I find myself not being able to use ^(64496_)+$ to match one or more instances of AS 64496 in an AS path but nothing else. However, ^(_64496)+$ does work as expected.

Permalink - posted 2022-11-02