La 13 Hlakubele ho sehlopha sa basebetsi ba khahlano le tlhekefetso sa RIPE nka BGP hijacking (hjjack) e le tlōlo ea leano la RIPE. Haeba tlhahiso e amoheloa, mofani oa Inthanete ea hlasetsoeng ke ho thibela sephethephethe o ne a tla ba le monyetla oa ho romela kopo e khethehileng ea ho pepesa mohlaseli. Haeba sehlopha sa tlhahlobo se ne se bokella bopaki bo lekaneng bo tšehetsang, LIR eo e neng e le mohloli oa ho thibela BGP e ne e tla nkoa e le moferefere 'me e ka amohuoa boemo ba eona ba LIR. Ho ne ho boetse ho e-na le likhang liphetoho.
Khatisong ena re batla ho bontša mohlala oa tlhaselo eo ho neng ho se na mohlaseli oa sebele feela, empa hape le lethathamo lohle la li-prefixes tse amehileng. Ho feta moo, tlhaselo e joalo e boetse e hlahisa lipotso mabapi le sepheo sa ho thibela mofuta ona oa sephethephethe nakong e tlang.
Lilemong tse 'maloa tse fetileng, ke likhohlano feela tse kang MOAS (Multiple Origin Autonomous System) tse ileng tsa phatlalatsoa likoranteng e le likhahla tsa BGP. MOAS ke ketsahalo e khethehileng moo litsamaiso tse peli tse fapaneng tsa boipuso li bapatsang lihlomathiso tse hanyetsanang le li-ASN tse tsamaellanang ho AS_PATH (ea pele ea ASN ho AS_PATH, mona e bitsoa tšimoloho ea ASN). Leha ho le joalo, re ka bolela bonyane thibelo ea sephethephethe, ho lumella mohlaseli ho laola sebopeho sa AS_PATH ka merero e fapaneng, ho kenyelletsa le ho iphapanyetsa mekhoa ea sejoale-joale ea ho sefa le ho beha leihlo. Mofuta oa tlhaselo o tsebahalang - mofuta oa ho qetela oa thibelo e joalo, empa ho hang ha e bohlokoa. Ho ka etsahala hore ebe ke mofuta oa tlhaselo eo re e boneng libekeng tse fetileng. Ketsahalo e joalo e na le sebopeho se utloisisoang le litlamorao tse tebileng.
Ba batlang mofuta oa TL; DR ba ka tsamaisetsa ho "Perfect Attack" subtitle.
Sebaka sa marang-rang
(ho u thusa ho utloisisa hamolemo mekhoa e amehang ketsahalong ena)
Haeba u batla ho romela sephutheloana 'me u na le li-prefixes tse ngata tafoleng ea routing e nang le aterese ea IP ea moo u eang teng, u tla sebelisa tsela bakeng sa sehlongwapele se nang le bolelele bo bolelele ka ho fetisisa. Haeba ho na le litsela tse 'maloa tse fapaneng bakeng sa sehlongoapele se tšoanang tafoleng ea ho tsamaisa, u tla khetha e ntle ka ho fetisisa (ho latela mokhoa o motle oa ho khetha tsela).
Mekhoa e teng ea ho sefa le ho beha leihlo e leka ho sekaseka litsela le ho etsa liqeto ka ho sekaseka semelo sa AS_PATH. Router e ka fetola tšobotsi ena ho boleng leha e le bofe nakong ea papatso. Ho kenyelletsa ASN ea mong'a eona qalong ea AS_PATH (joalo ka ASN) ho ka lekana ho feta mekhoa ea hajoale ea ho lekola tšimoloho. Ho feta moo, haeba ho na le tsela e tsoang ho ASN e hlasetsoeng ho ea ho uena, ho ka khoneha ho ntša le ho sebelisa AS_PATH ea tsela ena lipapatsong tsa hau tse ling. Tlhahlobo efe kapa efe ea AS_PATH-feela ea liphatlalatso tsa hau e tla feta.
Ho ntse ho e-na le mefokolo e seng mekae e lokelang ho boleloa. Taba ea pele, haeba prefix e sefa ke mofani oa thepa ea holimo, tsela ea hau e ntse e ka sefuoa (le ka AS_PATH e nepahetseng) haeba sehlomapele e se sa khoune ea moreki ea hau e hlophisitsoeng holimo. Taba ea bobeli, AS_PATH e nepahetseng e ka fetoha e sa sebetseng haeba tsela e entsoeng e bapatsoa ka litsela tse fosahetseng, 'me ka hona, e tlola leano la ho tsamaisa litsela. Qetellong, tsela efe kapa efe e nang le sehlongwapele se tlolang bolelele ba ROA e ka nkuwa e sa sebetse.
Ketsahalo
Libekeng tse 'maloa tse fetileng re ile ra fumana tletlebo ho tsoa ho e mong oa basebelisi ba rona. Re bone litsela ka tšimoloho ea hae ea ASN le /25 prefixes, ha mosebelisi a re ha a li bapatsa.
TABLE_DUMP2|1554076803|B|xxx|265466|78.163.7.0/25|265466 262761 263444 22356 3491 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.163.7.128/25|265466 262761 263444 22356 3491 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.163.18.0/25|265466 262761 263444 6762 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.163.18.128/25|265466 262761 263444 6762 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.163.226.0/25|265466 262761 263444 22356 3491 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.163.226.128/25|265466 262761 263444 22356 3491 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.164.7.0/25|265466 262761 263444 6762 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.164.7.128/25|265466 262761 263444 6762 2914 9121|INCOMPLETE|xxx|0|0||NAG||
Mehlala ea liphatlalatso tsa maqalong a Mmesa 2019
NTT tseleng ea /25 prefix e etsa hore e belaelle haholo. LG NTT e ne e sa tsebe ka tsela ena nakong ea ketsahalo. Ho joalo, opareitara e 'ngoe e etsa AS_PATH eohle bakeng sa lihlomathiso tsena! Ho sheba li-routers tse ling ho senola ASN e le 'ngoe: AS263444. Kamora ho sheba litsela tse ling tse nang le sistimi ena e ikemetseng, re ile ra kopana le maemo a latelang:
TABLE_DUMP2|1554076800|B|xxx|265466|1.6.36.0/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.6.38.0/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.23.143.0/25|265466 262761 263444 22356 6762 9498 9730 45528|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.23.143.128/25|265466 262761 263444 22356 6762 9498 9730 45528|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.24.0.0/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.24.128.0/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.26.0.0/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.26.128.0/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.64.96.0/20|265466 262761 263444 6762 3491 4760|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.64.112.0/20|265466 262761 263444 6762 3491 4760|IGP|xxx|0|0||NAG||
Leka ho hakanya hore na phoso ke efe mona
Ho bonahala eka motho e mong o ile a nka sehlongwapele tseleng, a se arola ka dikarolo tse pedi, mme a bapatsa tsela ka AS_PATH bakeng sa dihlongwapele tseo tse pedi.
TABLE_DUMP2|1554076800|B|xxx|263444|1.6.36.0/23|263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||
TABLE_DUMP2|1554076800|B|xxx|263444|1.6.38.0/23|263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||
TABLE_DUMP2|1554076800|B|xxx|61775|1.6.36.0/23|61775 262761 263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||
TABLE_DUMP2|1554076800|B|xxx|61775|1.6.38.0/23|61775 262761 263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.6.36.0/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.6.38.0/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|28172|1.6.36.0/23|28172 52531 263444 52320 9583|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|28172|1.6.38.0/23|28172 52531 263444 52320 9583|IGP|xxx|0|0||NAG||
Mohlala oa litsela bakeng sa e 'ngoe ea li-prefix tse peli tse arohaneng
Ho hlaha lipotso tse ’maloa ka nako e le ’ngoe. A na ho na le motho ea kileng a leka mofuta ona oa ho khelosa ka mokhoa? Ho na le motho ea nkileng litsela tsee? Ke lihlomapele life tse ileng tsa ameha?
Mona ke moo letoto la mefokolo ea rona e qalang le ho soetseha ho hong ka boemo ba hajoale ba bophelo bo botle ba Marang-rang.
Tsela ya ho hloleha
Lintho tsa pele pele. Re ka tseba joang hore na ke li-routers life tse amohetseng litsela tse joalo tse thibetsoeng le hore na sephethephethe sa mang se ka khutlisetsoa tseleng kajeno? Re ne re nahana hore re tla qala ka li-prefixes /25 hobane "ha li khone ho ba le kabo ea lefats'e." Joalokaha u ka nahana, re ne re fositse haholo. Metric ena e ile ea bonahala e le lerata haholo 'me litsela tse nang le li-prefixes tse joalo li ka hlaha le ho tsoa ho basebelisi ba Tier-1. Mohlala, NTT e na le lihlongoana tse joalo tse ka bang 50, tseo e li abang ho bareki ba eona. Ka lehlakoreng le leng, metric ena e fosahetse hobane li-prefixes tse joalo li ka sefuoa ha opareitara e sebelisa , ka nqa tsohle. Ka hona, mokhoa ona ha o loketse ho fumana basebetsi bohle bao sephethephethe sa bona se ileng sa fetisoa ka lebaka la ketsahalo e joalo.
Khopolo e ’ngoe e ntle eo re neng re nahana hore ke ho e sheba . Haholo-holo bakeng sa litsela tse tlolang molao oa maxLength oa ROA e tsamaisanang. Ka tsela ena re ka fumana palo ea li-ASN tse fapaneng tse nang le maemo a sa nepahaleng tse neng li bonahala ho AS e fanoeng. Leha ho le joalo, ho na le bothata bo "bonyane". Karolelano (bohare le mokhoa) oa palo ena (palo ea li-ASN tsa tšimoloho e fapaneng) e ka ba 150 mme, leha re sefa li-prefixes tse nyane, e lula e le kaholimo ho 70. Boemo bona ba litaba bo na le tlhaloso e bonolo haholo: ho na le feela basebetsi ba seng bakae ba seng ba ntse ba sebelisa li-filters tsa ROA ka leano la "reset Invalid routes" libakeng tsa ho kena, e le hore kae kapa kae moo tsela e nang le tlōlo ea ROA e hlahang lefatšeng la sebele, e ka hasana hohle.
Mekhoa e 'meli ea ho qetela e re lumella ho fumana basebetsi ba boneng ketsahalo ea rona (kaha e ne e le khōlō haholo), empa ka kakaretso ha e sebetse. Ho lokile, empa na re ka fumana mohatelli? Likarolo tse akaretsang tsa maqheka ana a AS_PATH ke afe? Ho na le maikutlo a 'maloa a mantlha:
- Sehlongoapele se ne se e-so bonoe kae kapa kae pele;
- Origin ASN (sehopotso: ASN ea pele ho AS_PATH) e sebetsa;
- ASN ea ho qetela ho AS_PATH ke ASN ea mohlaseli (ha moahelani oa hae a hlahloba ASN ea moahisani litseleng tsohle tse kenang);
- Tlhaselo e tsoa ho mofani a le mong.
Haeba mehopolo eohle e nepahetse, joale litsela tsohle tse fosahetseng li tla hlahisa ASN ea mohlaseli (ntle le tšimoloho ea ASN) 'me, ka hona, ena ke ntlha "ea bohlokoa". Har'a basholu ba 'nete e ne e le AS263444, leha ho ne ho e-na le ba bang. Le ha re lahla litsela tsa liketsahalo ho tloha ho nahanoa. Hobaneng? Ntlha ea bohlokoa e ka 'na ea lula e le ea bohlokoa esita le bakeng sa litsela tse nepahetseng. E ka ba ka lebaka la khokahanyo e fokolang sebakeng kapa mefokolo ea ponahalo ea rona.
Ka lebaka leo, ho na le mokhoa oa ho lemoha mohlaseli, empa feela haeba maemo ohle a ka holimo a finyelloa 'me feela ha thibelo e le khōlō ho lekana ho feta menyako ea ho shebella. Haeba tse ling tsa lintlha tsee li sa finyelloe, na re ka tseba lihlomathiso tse bileng teng ka lebaka la ho kheloha ho joalo? Bakeng sa basebelisi ba itseng - e.
Ha mohlaseli a theha tsela e ikhethileng, sehlomathiso se joalo ha se phatlalatsoe ke mong'a 'nete. Haeba u na le lethathamo le matla la li-prefixes tsohle tsa eona ho tsoa ho eona, joale hoa khoneha ho etsa papiso le ho fumana litsela tse sothehileng haholoanyane. Re bokella lethathamo lena la li-prefixes ka ho sebelisa linako tsa rona tsa BGP, hobane ha re fuoe feela lethathamo le feletseng la litsela tse bonahalang ho opereishene hona joale, empa hape le lethathamo la li-prefixes tsohle tseo a batlang ho li phatlalatsa lefatšeng. Ka bomalimabe, hona joale ho na le basebelisi ba Radar ba 'maloa ba sa phetheng karolo ea ho qetela ka nepo. Re tla ba tsebisa haufinyane mme re leke ho rarolla bothata bona. Batho ba bang kaofela ba ka kenela sistimi ea rona ea ho beha leihlo hona joale.
Haeba re khutlela ketsahalong ea pele, mohlaseli le sebaka sa kabo li ile tsa bonoa ke rona ka ho batla lintlha tse mahlonoko. Ho makatsang ke hore AS263444 ha ea ka ea romela litsela tse iqapetsoeng ho bareki bohle ba eona. Leha ho na le motsotso o sa mo tsebeng.
BGP4MP|1554905421|A|xxx|263444|178.248.236.0/24|263444 6762 197068|IGP|xxx|0|0|13106:12832 22356:6453 65444:20000|NAG||
BGP4MP|1554905421|A|xxx|263444|178.248.237.0/24|263444 6762 197068|IGP|xxx|0|0|13106:12832 22356:6453 65444:20000|NAG||
Mohlala oa morao tjena oa teko ea ho sitisa sebaka sa rona sa aterese
Ha ho ne ho etsoa tse tobileng haholoanyane bakeng sa lihloho tsa rona, ho ile ha sebelisoa AS_PATH e entsoeng ka ho khetheha. Leha ho le joalo, AS_PATH e ka be e sa nkuoa ho tse ling tsa rona tse fetileng. Ha re na puisano le AS6762. Ha re sheba litsela tse ling ketsahalong ena, tse ling tsa tsona li ne li e-na le AS_PATH ea sebele e neng e sebelisoa pele, ha ba bang ba sa e tsebe, le haeba e shebahala joaloka ea sebele. Ho fetola AS_PATH hape ha ho na kelello e sebetsang, kaha sephethephethe se tla fetisetsoa ho mohlaseli leha ho le joalo, empa litsela tse nang le "mpe" AS_PATH li ka hloekisoa ke ASPA kapa mochine ofe kapa ofe oa ho hlahloba. Mona re nahana ka tšusumetso ea mosholu. Hajoale ha re na leseli le lekaneng ho netefatsa hore ketsahalo ena e ne e le tlhaselo e reriloeng. Leha ho le joalo, hoa khoneha. Ha re leke ho nahana, leha e ntse e le taba e inahaneloang, empa e kanna ea ba ea nnete, boemo.
Tlhaselo e Phethahetseng
Re na le eng? Ha re re u mofani oa lipalangoang ho hasa litsela bakeng sa bareki ba hau. Haeba bareki ba hau ba na le boteng bo bongata (multihome), joale u tla fumana karolo feela ea sephethephethe sa bona. Empa ha sephethephethe se ntse se eketseha, chelete ea hau e eketseha. Kahoo ha u qala ho bapatsa lihlomathiso tsa li-subnet tsa litsela tse tšoanang ka AS_PATH, u tla fumana sephethephethe sa tsona kaofela. Ka lebaka leo, chelete e setseng.
Na ROA e tla thusa moo? Mohlomong e, haeba u etsa qeto ea ho khaotsa ho e sebelisa ka ho feletseng . Ntle le moo, ha ho lakatsehe haholo ho ba le lirekoto tsa ROA tse nang le li-prefixes tse kopaneng. Bakeng sa basebelisi ba bang, lithibelo tse joalo ha li amohelehe.
Ha ho nahanoa ka mekhoa e meng ea ts'ireletso ea litsamaiso, ASPA e ke ke ea thusa le ntlheng ena (hobane e sebelisa AS_PATH ho tsoa tseleng e nepahetseng). BGPSec e ntse e se khetho e nepahetseng ka lebaka la litefiso tse tlase tsa ho amohela bana le monyetla o setseng oa litlhaselo tse tlase.
Kahoo re na le phaello e hlakileng bakeng sa mohlaseli le ho hloka tšireletso. Motsoako o moholo!
Ke hloka ho etsa eng?
Mohato o totobetseng le o matla ka ho fetisisa ke ho hlahloba leano la hau la hona joale la litsela. Arola sebaka sa hau sa aterese ka likaroloana tse nyane haholo (ha li fetellane) tseo u batlang ho li bapatsa. Saena ROA bakeng sa bona feela, ntle le ho sebelisa paramente ea maxLength. Tabeng ena, POV ea hau ea hajoale e ka u pholosa tlhaselong e joalo. Leha ho le joalo, hape, ho basebelisi ba bang mokhoa ona ha o utloahale ka lebaka la tšebeliso e khethehileng ea litsela tse khethehileng. Mathata ohle a boemo ba hona joale ba ROA le lintho tsa litsela a tla hlalosoa ho e 'ngoe ea lisebelisoa tsa rona tsa nakong e tlang.
Ho phaella moo, o ka leka ho shebella interceptions joalo. Ho etsa sena, re hloka lintlha tse tšepahalang mabapi le li-prefixes tsa hau. Kahoo, haeba u theha seboka sa BGP le 'mokelli oa rona' me u re fa leseli mabapi le ponahalo ea hau ea Marang-rang, re ka fumana sebaka sa liketsahalo tse ling. Bakeng sa ba e-so hokahane le sistimi ea rona ea ho beha leihlo, ho qala, lethathamo la litsela feela le li-prefixes tsa hau le tla lekana. Haeba u na le kopano le rona, ka kopo netefatsa hore litsela tsohle tsa hau li rometsoe. Ka bomalimabe, sena se bohlokoa ho hopoloa hobane basebelisi ba bang ba lebala sehlongoapele kapa tse peli, kahoo ba kena-kenana le mekhoa ea rona ea ho batla. Haeba e entsoe ka nepo, re tla ba le lintlha tse tšepahalang mabapi le li-prefixes tsa hau, tseo nakong e tlang li tla re thusa ho tseba le ho lemoha mefuta ena (le e meng) ea ho thibela sephethephethe bakeng sa sebaka sa hau sa aterese.
Haeba u ka elelloa ketso e joalo ea sephethephethe sa hau ka nako ea nnete, u ka leka ho e loantša ka bouena. Mokhoa oa pele ke ho bapatsa litsela ka li-prefixes tsena ka bouena. Haeba ho ka ba le tlhaselo e ncha ho li-prefixes tsena, pheta.
Mokhoa oa bobeli ke ho otla mohlaseli le bao e leng ntlha ea bohlokoa ho bona (bakeng sa litsela tse ntle) ka ho khaola ho fihlella ha litsela tsa hau ho mohlaseli. Sena se ka etsoa ka ho kenyelletsa ASN ea mohlaseli ho AS_PATH ea litsela tsa hau tsa khale 'me kahoo u ba qobelle ho qoba AS ba sebelisa mochine oa ho lemoha loop o hahiloeng ho BGP. .
Source: www.habr.com