RFC 7908
Problem Definition and Classification of BGP Route Leaks
Problem Definition and Classification of BGP Route Leaks 🦋
Okay bestie, this is RFC 7908 💖 It's an Informational doc from the IETF, published June 2016. The authors are K. Sriram, D. Montgomery (US NIST), D. McPherson, E. Osterweil (Verisign, Inc.), and B. Dickson. The ISSN is 2070-1721. The header doesn't list any Obsoletes or Updates lines, so it doesn't replace or update anything 🙈
- Series: Internet Engineering Task Force (IETF)
- Number: RFC 7908
- Title: Problem Definition and Classification of BGP Route Leaks
- Authors: K. Sriram, D. Montgomery (US NIST), D. McPherson, E. Osterweil (Verisign, Inc.), B. Dickson
- Category: Informational
- ISSN: 2070-1721
- Date: June 2016
- Obsoletes / Updates: none listed
Abstract ✨
Okay so the Border Gateway Protocol routing system has this known weakness called "route leaks", and it's been getting so much attention lately 👀 A bunch of incidents that cause big disruptions to Internet routing get labeled as route leaks, but nobody had a shared definition for the term until now. This doc gives a working definition that keeps the real incidents that got lots of attention in mind 💅 It also tries to list different types of route leaks based on what's been seen on the Internet. It's not exhaustive, but it's a taxonomy covering several forms that Internet users and network operators are actually worried about 🫶
Status of This Memo 📝
This doc is not an Internet Standards Track spec. It's published just for information 🌸
It's a product of the IETF and reflects the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every doc the IESG approves is a candidate for any level of Internet Standard, so check Section 2 of RFC 7841 for the details 🤓
For the current status, any errata, and how to give feedback, go to http://www.rfc-editor.org/info/rfc7908.
Copyright Notice ⚖️
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, since they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
Table of Contents 🗺️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Working Definition of Route Leaks . . . . . . . . . . . . . . 3
3. Classification of Route Leaks Based on Documented Events . . 4
3.1. Type 1: Hairpin Turn with Full Prefix . . . . . . . . . . 4
3.2. Type 2: Lateral ISP-ISP-ISP Leak . . . . . . . . . . . . 5
3.3. Type 3: Leak of Transit-Provider Prefixes to Peer . . . . 5
3.4. Type 4: Leak of Peer Prefixes to Transit Provider . . . . 5
3.5. Type 5: Prefix Re-origination with Data Path to
Legitimate Origin . . . . . . . . . . . . . . . . . . . . 6
3.6. Type 6: Accidental Leak of Internal Prefixes and More-
Specific Prefixes . . . . . . . . . . . . . . . . . . . . 6
4. Additional Comments about the Classification . . . . . . . . 7
5. Security Considerations . . . . . . . . . . . . . . . . . . . 7
6. Informative References . . . . . . . . . . . . . . . . . . . 7
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 11
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 111. Introduction 💫
Frequent incidents [Huston2012] [Cowie2013] [Toonk2015-A] [Toonk2015-B] [Cowie2010] [Madory] [Zmijewski] [Paseka] [LRL] [Khare] keep causing big disruptions to Internet routing, and people commonly call these "route leaks" 📡 Looking closely at some of them shows they don't all look the same, technically speaking 🤔 So if we want to actually work on solutions to "the route-leak problem", we first need a clear, technical definition and a list of its most common forms 🎯 Section 2 gives the working definition, with lots of the recent incidents that got attention in mind. Section 3 tries to list different types based on what's been observed (not exhaustively). Section 3 also gives a taxonomy covering several forms that Internet users and network operators are concerned about 🫶 This doc builds on and extends earlier IETF work [ROUTE-LEAK-DEF] [ROUTE-LEAK-REQ].
2. Working Definition of Route Leaks 🧠
Here's the proposed working definition of "route leak":
A route leak is the propagation of routing announcement(s) beyond their intended scope. That is, an announcement from an Autonomous System (AS) of a learned BGP route to another AS is in violation of the intended policies of the receiver, the sender, and/or one of the ASes along the preceding AS path.
Okay so the intended scope is usually set by a bunch of local redistribution and filtering policies spread across the ASes involved 🗂️ Those intended policies are often described using the pair-wise peering business relationship between ASes (customer, transit provider, peer, etc.) 💼 If you want reading on AS relationships and routing policies, check [Gao], [Luckie], and [Gill]. For measurements of valley-free violations in Internet routing, see [Anwar], [Giotsas], and [Wijchers] 📚
The result of a route leak can be traffic getting redirected down an unintended path, which might allow eavesdropping or traffic analysis. It may or may not end in an overload or a black hole 😬 Route leaks can be accidental or malicious, but most of the time they come from accidental misconfigurations 🙈
This definition isn't meant to be all encompassing, obviously 💅 The goal is a working definition that fits enough observed incidents so the IETF community has a basis for building route-leak detection and mitigation solutions 🛠️
3. Classification of Route Leaks Based on Documented Events 🧩
Here's the most common shape of a route leak 👇 A multihomed customer AS (like AS3 in Figure 1) learns a prefix update from one transit provider (ISP1). It then leaks that update to another transit provider (ISP2), even though that breaks its intended routing policies. And then the second transit provider doesn't notice the leak and passes the leaked update along to its customers, peers, and transit ISPs. Main character energy for all the wrong reasons 😭
/\ /\
\ route leak(P)/
\ propagated /
\ /
+------------+ peer +------------+
______| ISP1 (AS1) |----------->| ISP2 (AS2)|---------->
/ ------------+ prefix(P) +------------+ route leak(P)
| prefix | \ update /\ \ propagated
\ (P) / \ / \
------- prefix(P) \ / \
update \ / \
\ /route leak(P) \/
\/ /
+---------------+
| customer(AS3) |
+---------------+
Figure 1: Basic Notion of a Route LeakThis doc proposes the taxonomy below to cover several types of observed route leaks. It's clear the list isn't meant to be exhaustive 🌈 From here on, the AS that announces a route that breaks the intended policies is called the "offending AS" 🫣
3.1. Type 1: Hairpin Turn with Full Prefix 🪞
Description: A multihomed AS learns a route from one upstream ISP and just passes it on to another upstream ISP. The turn basically looks like a hairpin 🧷 The prefix and the AS path in the update both stay unchanged. This is similar to a straightforward path-poisoning attack [Kapela-Pilosov], except with the full prefix 👀 Leaks of this type are often accidental (so not malicious), btw 🙏 The update makes a hairpin turn at the offending AS's multihomed AS. The leak often succeeds (the leaked update gets accepted and propagated) because the second ISP prefers a customer announcement over a peer announcement of the same prefix 😤 Data packets would still reach the legitimate destination, just through the offending AS. Unless the offending AS can't handle the huge volumes of traffic and drops them 💀
- Example incidents: Type 1 route-leak examples include (1) the Dodo-Telstra incident in March 2012 [Huston2012], (2) the VolumeDrive-Atrato incident in September 2014 [Madory], and (3) the massive Telekom Malaysia route leak of about 179,000 prefixes, which Level3 accepted and propagated [Toonk2015-B] 🫠
3.2. Type 2: Lateral ISP-ISP-ISP Leak 🤝
Description: "Lateral" here means the same thing as "non-transit" or "peer-to-peer" 🧃 This type usually shows up when three sequential ISP peers (say ISP-A, ISP-B, and ISP-C) are involved, and ISP-B takes a route from ISP-A and leaks it to ISP-C. The usual routing policy between laterally (non-transit) peering ISPs is that they should only propagate their respective customer prefixes to each other 📦
- Example incidents: In [Mauch-nanog] and [Mauch], route leaks of this type were reported by monitoring updates in the global BGP system and finding three or more very large ISPs' Autonomous System Numbers (ASNs) in a sequence in a BGP update's AS path 🔍 [Mauch] notes its detection algorithm flags these anomalies, and potentially route leaks, because very large ISPs don't generally buy transit from each other. It also points out there are exceptions, though, when one very large ISP does buy transit from another. So its detection algorithm has exceptions for those known cases 🧐
3.3. Type 3: Leak of Transit-Provider Prefixes to Peer 🚪
Description: This type of route leak happens when an offending AS leaks routes it learned from its transit provider to a lateral (non-transit) peer 🙅♀️
- Example incidents: The incidents reported in [Mauch] include Type 3 leaks 📌
Part 1 of 3 is done, and more is coming soon 💖🎀
3.4. Type 4: Leak of Peer Prefixes to Transit Provider 🦋
okay so Type 4 is giving "my peer's customers' stuff ended up at my transit provider" 💅 an offending AS leaks routes it learned from a lateral (non-transit) peer up to its own transit provider. these leaked routes usually come from the customer cone of that lateral peer, so it's basically the peer's whole crew getting exposed. 🫶
- Example incidents: the Axcelx-Hibernia leak of Amazon Web Services (AWS) prefixes that messed up AWS and a bunch of services running on it [Kephart] 😭, the Hathway-Airtel leak of 336 Google prefixes that caused widespread Google outages in Europe and Asia [Toonk2015-A] 💀, the Moratel-PCCW leak of Google prefixes that knocked Google's services offline [Paseka] 🙈, and (4) some of the examples cited for Type 1 are also Type 4, no cap ✨. like in the Dodo-Telstra incident [Huston2012] 🌸, the routes Dodo leaked to Telstra included stuff Dodo learned from its transit providers and its lateral peers. iconic chaos 👑
3.5. Type 5: Prefix Re-origination with Data Path to Legitimate Origin 🎀
so Type 5 is a whole plot twist 🔥 a multihomed AS learns a route from one upstream ISP and then announces that prefix to another upstream ISP like it originated it. it strips the received AS path and re-originates the prefix. this can be called re-origination or mis-origination 🧚 but lowkey there can still be a reverse path back to the legitimate origin AS, so data packets actually reach the real destination, just via the offending AS 🦋. (Note: the presence of a reverse path here is not attributable to the offending AS using a path-poisoning trick 👀.) sometimes though, there's no reverse path at all, and data packets for the leaked prefix just get discarded at the offending AS 💀
- Example incidents: (1) the China Telecom incident in April 2010 [Hiran] [Cowie2010] [Labovitz] 🌈, (2) the Belarusian GlobalOneBel route-leak incidents in February-March 2013 and May 2013 [Cowie2013] 💜, (3) the Icelandic Opin Kerfi-Simmin route-leak incidents in July-August 2013 [Cowie2013] 🍓, and (4) the Indosat route-leak incident in April 2014 [Zmijewski] 🫶. the reverse paths (data paths from the offending AS to the legitimate destinations) were present in incidents #1, #2, and #3, but NOT in incident #4. in #4, the misrouted data packets were dropped at Indosat's AS 😭
3.6. Type 6: Accidental Leak of Internal Prefixes and More-Specific Prefixes 🧁
Type 6 is the "oops, that was supposed to stay internal" era 🙈 an offending AS simply leaks its internal prefixes to one or more of its transit-provider ASes and/or ISP peers. the leaked internal prefixes are often more-specific prefixes subsumed by an already announced, less-specific prefix. those more-specific prefixes were never meant to be routed in External BGP (eBGP) 🚫 and the AS receiving them fails to filter them, which is the real tea ☕
usually these leaks come from some transient failures inside the AS. they're short-lived and typically withdrawn quickly after the announcements 💨 but even so, these more-specific prefixes can momentarily get preferred over other aggregate (less specific) route announcements, which redirects traffic away from its normal best path 🌀
- Example incidents: internal-route leaks happen frequently (like multiple times in a week) 📅, and the number of leaked prefixes ranges from hundreds to thousands per incident 💅. one highly conspicuous and widely disruptive leak happened in August 2014, when AS701 and AS705 leaked about 22,000 more-specific prefixes of already-announced aggregates [Huston2014] [Toonk2014] 😱
- Additional Comments about the Classification ✨
it's worth noting that Types 1 through 4 are similar in that a route is leaked in violation of policy in each case 📜 what changes is the context of the leaked-route source AS and destination AS roles 🎭
a Type 5 route leak (prefix mis-origination with data path to legitimate origin) can also happen alongside the AS relationship contexts in Types 2, 3, and 4 🧩. while these possibilities are acknowledged, simply enumerating more types to cover all these special cases doesn't add value for solution development, so the special cases mentioned here aren't included in the list of route-leak types 🫶
- Security Considerations 🔐
No security considerations apply since this is a problem definition document. 💖
- Informative References 📚
[Anwar] Anwar, R., Niaz, H., Choffnes, D., Cunha, I., Gill, P., and N. Katz-Bassett, "Investigating Interdomain Routing Policies in the Wild", In Proceedings of the 2015 ACM Internet Measurement Conference (IMC), DOI 10.1145/2815675.2815712, October 2015, <http://www.cs.usc.edu/assets/007/94928.pdf>.
[Cowie2010] Cowie, J., "China's 18 Minute Mystery", Dyn Research: The New Home of Renesys Blog, November 2010, <http://research.dyn.com/2010/11/ chinas-18-minute-mystery/>.
[Cowie2013] Cowie, J., "The New Threat: Targeted Internet Traffic Misdirection", Dyn Research: The New Home of Renesys Blog, November 2013, <http://research.dyn.com/2013/11/ mitm-internet-hijacking/>.
[Gao] Gao, L. and J. Rexford, "Stable Internet Routing Without Global Coordination", IEEE/ACM Transactions on Networking (TON), Volume 9, Issue 6, pp 689-692, DOI 10.1109/90.974523, December 2001, <http://www.cs.princeton.edu/~jrex/papers/ sigmetrics00.long.pdf>.
[Gill] Gill, P., Schapira, M., and S. Goldberg, "A Survey of Interdomain Routing Policies", ACM SIGCOMM Computer Communication Review, Volume 44, Issue 1, pp 28-34, DOI 10.1145/2567561.2567566, January 2014, <http://www.cs.bu.edu/~goldbe/papers/survey.pdf>.
[Giotsas] Giotsas, V. and S. Zhou, "Valley-free violation in Internet routing - Analysis based on BGP Community data", 2012 IEEE International Conference on Communications (ICC), DOI 10.1109/ICC.2012.6363987, June 2012.
[Hiran] Hiran, R., Carlsson, N., and P. Gill, "Characterizing Large-Scale Routing Anomalies: A Case Study of the China Telecom Incident", In Proceedings of the 14th International Conference on Passive and Active Measurement (PAM) 2013, DOI 10.1007/978-3-642-36516-4_23, March 2013, <http://www3.cs.stonybrook.edu/~phillipa/papers/ CTelecom.html>.
[Huston2012] Huston, G., "Leaking Routes", Asia Pacific Network Information Centre (APNIC) Blog, March 2012, <http://labs.apnic.net/blabs/?p=139/>.
[Huston2014] Huston, G., "What's so special about 512?", Asia Pacific Network Information Centre (APNIC) Blog, September 2014, <http://labs.apnic.net/blabs/?p=520/>.
[Kapela-Pilosov] Pilosov, A. and T. Kapela, "Stealing the Internet: An Internet-Scale Man in the Middle Attack", 16th Defcon Conference, August 2008, <https://www.defcon.org/images/defcon-16/ dc16-presentations/defcon-16-pilosov-kapela.pdf>.
[Kephart] Kephart, N., "Route Leak Causes Amazon and AWS Outage", ThousandEyes Blog, June 2015, <https://blog.thousandeyes.com/ route-leak-causes-amazon-and-aws-outage>.
[Khare] Khare, V., Ju, Q., and B. Zhang, "Concurrent Prefix Hijacks: Occurrence and Impacts", In Proceedings of the 2013 ACM Internet Measurement Conference (IMC), DOI 10.1145/2398776.2398780, November 2012, <http://www.cs.arizona.edu/~bzhang/ paper/12-imc-hijack.pdf>.
[Labovitz] Labovitz, C., "Additional Discussion of the April China BGP Hijack Incident", Arbor Networks IT Security Blog, November 2010, <http://www.arbornetworks.com/asert/2010/11/additional- discussion-of-the-april-china-bgp-hijack-incident/>.
[LRL] Khare, V., Ju, Q., and B. Zhang, "Large Route Leaks", University of Arizona (UA) Network Research Lab: Projects Webpage, 2012, <http://nrl.cs.arizona.edu/projects/ lsrl-events-from-2003-to-2009/>.
[Luckie] Luckie, M., Huffaker, B., Dhamdhere, A., Giotsas, V., and kc. claffy, "AS Relationships, Customer Cones, and Validation", In Proceedings of the 2013 ACM Internet Measurement Conference (IMC), DOI 10.1145/2504730.2504735, October 2013, <http://www.caida.org/~amogh/papers/asrank-IMC13.pdf>.
[Madory] Madory, D., "Why Far-Flung Parts of the Internet Broke Today", Dyn Research: The New Home of Renesys Blog, September 2014, <http://research.dyn.com/2014/09/ why-the-internet-broke-today/>.
[Mauch] Mauch, J., "BGP Routing Leak Detection System", Project web page, 2014, <http://puck.nether.net/bgp/leakinfo.cgi/>.
[Mauch-nanog] Mauch, J., "Detecting Routing Leaks by Counting", 41st NANOG Conference, October 2007, <https://www.nanog.org/meetings/nanog41/presentations/ mauch-lightning.pdf>.
[Paseka] Paseka, T., "Why Google Went Offline Today and a Bit about How the Internet Works", CloudFlare Blog, November 2012, <http://blog.cloudflare.com/ why-google-went-offline-today-and-a-bit-about/>.
[ROUTE-LEAK-DEF] Dickson, B., "Route Leaks -- Definitions", Work in Progress, draft-dickson-sidr-route-leak-def-03, October 2012.
[ROUTE-LEAK-REQ] Dickson, B., "Route Leaks -- Requirements for Detection and Prevention thereof", Work in Progress, draft-dickson- sidr-route-leak-reqts-02, March 2012.
[Toonk2014] Toonk, A., "What caused today's Internet hiccup", BGPMON Blog, August 2014, <http://www.bgpmon.net/ what-caused-todays-internet-hiccup/>.
[Toonk2015-A] Toonk, A., "What caused the Google service interruption", BGPMON Blog, March 2015, <http://www.bgpmon.net/ what-caused-the-google-service-interruption/>.
[Toonk2015-B] Toonk, A., "Massive route leak causes Internet slowdown", BGPMON Blog, June 2015, <http://www.bgpmon.net/ massive-route-leak-cause-internet-slowdown/>.
[Wijchers] Wijchers, B. and B. Overeinder, "Quantitative Analysis of BGP Route Leaks", Reseaux IP Europeens (RIPE) 69th Meeting, November 2014, <http://ripe69.ripe.net/ presentations/157-RIPE-69-Routing-WG.pdf>.
[Zmijewski] Zmijewski, E., "Indonesia Hijacks the World", Dyn Research: The New Home of Renesys Blog, April 2014, <http://research.dyn.com/2014/04/ indonesia-hijacks-world/>.
Acknowledgements 🫶
okay so bestie, the authors wanna give a huge shoutout to Jared Mauch, Jeff Haas, Warren Kumari, Amogh Dhamdhere, Jakob Heitz, Geoff Huston, Randy Bush, Job Snijders, Ruediger Volk, Andrei Robachevsky, Charles van Niman, Chris Morrow, and Sandy Murphy 👑 for their comments, suggestions, and critique. these people literally helped make this doc way better 💅
they also said thank u to Padma Krishnaswamy, Oliver Borchert, and Okhee Kim for their comments and review 🎀 the way everyone showed up for this one is so iconic 😭🌈
Authors' Addresses 💌
Kotikalapudi Sriram ✨ US NIST
Email: ksriram@nist.gov
Doug Montgomery 🦋 US NIST
Email: dougm@nist.gov
Danny McPherson 🌸 Verisign, Inc.
Email: dmcpherson@verisign.com
Eric Osterweil 🧚 Verisign, Inc.
Email: eosterweil@verisign.com
Brian Dickson 💜
Email: brian.peter.dickson@gmail.com
📦 where this page comes from
- ietf: rfc7908 2016-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms