anti spoofing. reboot. · strict mode provider a provider b customerx rule: incoming interface =...
TRANSCRIPT
![Page 1: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/1.jpg)
Anti Spoofing. Reboot.Alexander Azimov <[email protected]>
![Page 2: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/2.jpg)
IP Spoofing
• Attacks on TCP stack;• TCP floods (SYN, ACK,…);• Reflection Attacks;• Amplification Attacks.
![Page 3: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/3.jpg)
DDoS Amplifiers
Source: Qrator Labs annual report 2017
![Page 4: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/4.jpg)
BCP84: uRPF
https://tools.ietf.org/html/bcp84• Strict mode;• Feasible mode;• Loose mode.
![Page 5: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/5.jpg)
Strict Mode
Provider A Provider B
CustomerX
Rule: incoming interface = interface for the best route for SRC_IP
Provider C
x.x.x.0/24
Ingress Traffic
Egress Traffic
Provider AS_PATHA XB XC A X
x.x.x.0/24
![Page 6: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/6.jpg)
Loose Mode
Rule: there is a route for SRC_IP
Provider A Provider B
CustomerX
Provider C
x.x.x.0/24
Ingress Traffic
Egress Traffic
Provider AS_PATHA XB XC A X
x.x.x.0/24
![Page 7: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/7.jpg)
Feasible Mode
Rule: incoming interface = interface for the best route for SRC_IP
Provider A Provider B
CustomerX
Provider C
x.x.x.0/24
Ingress Traffic
Egress Traffic
Provider AS_PATHA XB XC A X
x.x.x.0/24
![Page 8: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/8.jpg)
Feasible Mode
Rule: incoming interface = interface for the best route for SRC_IP
Provider A Provider B
Provider C
Ingress Traffic
Egress Traffic
Provider AS_PATHA XB C A XC A X
x.x.x.0/24
CustomerX
![Page 9: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/9.jpg)
BCP84: uRPF
https://tools.ietf.org/html/bcp84• Strict mode – not working;• Loose mode – does nothing.• Feasible mode – not working;
![Page 10: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/10.jpg)
Problem Statement
A distance-vector protocol isn't the best way to propagate availability information.
![Page 11: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/11.jpg)
Option №1: New SAFI
![Page 12: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/12.jpg)
Hacking
![Page 13: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/13.jpg)
Option №2: AS-SETs
Rule: Check that SRC_IP belongs to customer’s AS_SET
Provider A Provider B
CustomerX
Provider C
x.x.x.0/24
Ingress Traffic
Egress Traffic
Provider AS_PATH
A X
B X
C A X
x.x.x.0/24
![Page 14: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/14.jpg)
Option №2: AS-SETs
Transformation of ingress filters into ACLs.
Positive:• We do not need to change specification;• We do not need to ship new software;• Can be used by any ISP, isn't it?
Negative:• AS-SETs are outdated, unauthorized;• Scalability problems.
![Page 15: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/15.jpg)
Option 3: GRSH + Feasible Mode
A new transit well-known community that sets LOCAL_PREF to 0.
Provider A Provider B
CustomerX
Provider C
x.x.x.0/24GRSH
Ingress Traffic
Egress Traffic
Provider AS_PATH
A X
B C A X
C A X
x.x.x.0/24
![Page 16: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/16.jpg)
Option 3: GRSH + Feasible Mode
Provider B sees x.x.x.0/24 route, but doesn’t use it.x.x.x.0/24 route marked with GRSH – informational message
Provider A Provider B
CustomerX
Provider C
x.x.x.0/24GRSH
Ingress Traffic
Egress Traffic
Provider AS_PATH
A X
B C A X
C A X
x.x.x.0/24
![Page 17: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/17.jpg)
Option 3: GRSH + Feasible Mode
Works only for multihomed ISPs…
But it more then 85% of all ISPs in the world!
Provider A Provider B
Provider C
Ingress Traffic
Egress Traffic
Provider AS_PATH
A X
B C A X
C A X
x.x.x.0/24
CustomerX
x.x.x.0/24
GRSH
![Page 18: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/18.jpg)
Option 3: GRSH + Feasible Mode
GRACEFUL_SHTUTDOWN community creates informational message for directly connected peers.
Positive:• We do not need to change specification;• We do not need to ship new software;• We solve problem for multihomed of ISPs.
Negative:• A lot of work with customers is required;• Doesn’t work between transit ISPs.
![Page 19: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/19.jpg)
Option 4: Do Nothing.
But are you prepared?
![Page 21: Anti Spoofing. Reboot. · Strict Mode Provider A Provider B CustomerX Rule: incoming interface = interface for the best route for SRC_IP Provider C x.x.x.0/24 Ingress Traffic](https://reader035.vdocuments.net/reader035/viewer/2022071219/6053ed2f3c405f60ff14afe9/html5/thumbnails/21.jpg)