diff --git a/docs/lab/handout/.gitignore b/docs/lab/handout/.gitignore new file mode 100644 index 0000000..d51fa59 --- /dev/null +++ b/docs/lab/handout/.gitignore @@ -0,0 +1,7 @@ +*.aux +*.log +*.out +*.fls +*.fdb_latexmk +*.synctex.gz +build.log diff --git a/docs/lab/handout/handout.pdf b/docs/lab/handout/handout.pdf new file mode 100644 index 0000000..00b2f4b Binary files /dev/null and b/docs/lab/handout/handout.pdf differ diff --git a/docs/lab/handout/handout.tex b/docs/lab/handout/handout.tex new file mode 100644 index 0000000..5a56349 --- /dev/null +++ b/docs/lab/handout/handout.tex @@ -0,0 +1,361 @@ +% Exercise sheet for the "Hands-on BGP" lecture. +% Springer LNCS class (llncs.cls ships with TeX Live). Build: latexmk -pdf handout.tex +\documentclass[runningheads,a4paper]{llncs} + +\usepackage[T1]{fontenc} +\usepackage[utf8]{inputenc} +\usepackage{microtype} +\usepackage{booktabs} +\usepackage{enumitem} +\usepackage{amssymb} +\usepackage{xcolor} +\usepackage{listings} +\usepackage{tikz} +\usetikzlibrary{positioning,arrows.meta,fit} +\PassOptionsToPackage{hyphens}{url} +\usepackage[hidelinks]{hyperref} +\renewcommand\UrlFont{\ttfamily\small} + +% ---- things to change per class ------------------------------------------- +\newcommand{\labhost}{bgplab.rayhaan.net} +\newcommand{\laburl}{https://\labhost/statusz} +\newcommand{\labspace}{2a0d:d741::/40} +\newcommand{\myprefix}{\texttt{2a0d:d741:}\underline{\texttt{\,n\,}}\texttt{::/48}} + +% ---- exercise machinery ------------------------------------------------------ +\lstset{basicstyle=\ttfamily\small,columns=fullflexible,keepspaces=true, + frame=single,framerule=0.3pt,xleftmargin=1.2em,xrightmargin=0.4em, + aboveskip=0.6em,belowskip=0.4em,breaklines=true} + +\newcounter{task}[section] +\renewcommand{\thetask}{\thesection.\arabic{task}} +\newcommand{\task}[1]{\refstepcounter{task}\medskip\noindent + \textbf{Task \thetask}\enspace\textit{#1}\par\nobreak\smallskip\noindent\ignorespaces} + +% Dotted lines to write on: \answer[3] gives three. +\newcommand{\answer}[1][1]{\par\nobreak + \foreach \i in {1,...,#1}{\vspace{1.05em}\noindent\makebox[\linewidth]{\dotfill}\par}\smallskip} +% Fill-in rows: the dots always run to the margin, never past it. +\newcommand{\fillin}[1]{\par\nopagebreak\noindent #1~\dotfill\par\vspace{0.5em}} +\newcommand{\fillintwo}[2]{\par\nopagebreak\noindent + \parbox[t]{0.485\linewidth}{#1~\dotfill}\hfill\parbox[t]{0.485\linewidth}{#2~\dotfill}\par\vspace{0.5em}} +\newcommand{\fillinthree}[3]{\par\nopagebreak\noindent + \parbox[t]{0.42\linewidth}{#1~\dotfill}\hfill\parbox[t]{0.27\linewidth}{#2~\dotfill}\hfill\parbox[t]{0.27\linewidth}{#3~\dotfill}\par\vspace{0.5em}} +\newcommand{\cbox}{$\square$\;} +% The reachability check that recurs through the sheet. +\newcommand{\reach}{\par\nopagebreak\smallskip\noindent + \begin{tabular}{@{}l@{\hspace{2em}}l@{}} + \cbox laptop, university network: reachable & \cbox phone, mobile data: reachable + \end{tabular}\par\smallskip} + +\begin{document} + +\title{Hands-on BGP:\\Announcing and Steering a Prefix on the Internet} +\subtitle{Exercise sheet} +\titlerunning{Hands-on BGP: exercise sheet} + +\author{Rayhaan Jaufeerally} +\authorrunning{Network Security, 2026} +\institute{Network Security, ETH Z\"urich\\ +\email{Lab page: \url{\laburl}}} + +\maketitle + +\begin{abstract} +In this exercise you take an IPv6 prefix that is registered for you, find out +what the Internet's registries say about it, announce it to the real Internet +with BGP, and then use BGP communities to decide which networks may learn it. +By the end your prefix should be reachable from the university network and +from nowhere else. Work through the tasks in order and write your answers on +this sheet; the questions marked \emph{Think} are for discussion. + +\keywords{BGP \and IPv6 \and RIPE database \and route servers \and BGP communities} +\end{abstract} + +\noindent +\begin{tabular}{@{}p{0.47\linewidth}@{\hspace{0.06\linewidth}}p{0.47\linewidth}@{}} +Name: \dotfill & Student number $n$ (decimal): \dotfill \\[0.9em] +$n$ in hexadecimal: \dotfill & Your prefix: \myprefix +\end{tabular} + +\medskip\noindent +Every student has one \texttt{/48} out of the lab's \texttt{\labspace}. The +third group of your prefix is your student number \emph{written in +hexadecimal}: student 10 has \texttt{2a0d:d741:a::/48}, student 16 has +\texttt{2a0d:d741:10::/48}. Fill in the fields above before you continue. + +% ============================================================================== +\section{Who Holds Which Addresses?} + +Address space and AS numbers are handed down from IANA to five regional +registries and on to their members. For Europe the registry is the RIPE NCC, +and its database is public~\cite{ripedb}. + +\task{Look up your own prefix.} +Query the RIPE database, with your prefix in place of the example: +\begin{lstlisting} +whois -h whois.ripe.net 2a0d:d741:1::/48 +\end{lstlisting} +(No \texttt{whois} on your machine? The same query works in a +browser~\cite{ripedb}.) You get an \texttt{inet6num} object describing a block of addresses and a +\texttt{route6} object saying who may announce a prefix. + +\enlargethispage{2\baselineskip} +\fillintwo{\texttt{inet6num} block:}{its \texttt{status}:} +\fillintwo{\texttt{route6} \texttt{origin} AS:}{maintained by (\texttt{mnt-by}):} + +\task{Look up a prefix you use every day.} +Find an address of \texttt{ethz.ch} and look it up the same way: +\begin{lstlisting} +dig +short ethz.ch AAAA +whois -h whois.ripe.net +\end{lstlisting} +\fillinthree{\texttt{inet6num} block:}{\texttt{status}:}{\texttt{origin}:} + +\task{Compare the database with the routing table.} +The database says who \emph{may} announce a prefix. Whether anybody \emph{does} +is a different question. Look up both prefixes on RIPEstat +(\texttt{stat.ripe.net}) or on \texttt{bgp.tools}. + +\fillin{Is ETH's prefix announced, and by which AS?} +\fillintwo{Is yours?}{That AS belongs to:} + +\medskip\noindent\textbf{Think.} +ETH's prefix is originated by an AS that is not called ETH. Whose is it, and +what does that tell you about how the university reaches the Internet? Your +\texttt{route6} object exists although nobody announces the prefix: what is +such an object good for? +\answer[3] + +% ============================================================================== +\section{Announcing Your Prefix} + +\begin{figure}[t] +\centering +\begin{tikzpicture}[font=\footnotesize, node distance=6mm and 8.5mm, + box/.style={draw, rounded corners=1.5pt, minimum height=8mm, inner xsep=3pt, align=center}, + bgp/.style={-{Stealth[length=2mm]}, dashed}, web/.style={-{Stealth[length=2mm]}}] + \node[box] (you) {you\\[-1pt]\scriptsize browser}; + \node[box, right=of you] (ferrix) {lab daemon\\[-1pt]\scriptsize AS4200000001}; + \node[box, right=of ferrix] (pr) {\texttt{pr01.rue}\\[-1pt]\scriptsize AS210036}; + \node[box, right=of pr] (rs) {SwissIX\\[-1pt]\scriptsize route servers\\[-1pt]\scriptsize AS42476}; + \node[box, right=of rs] (sw) {SWITCH\\[-1pt]\scriptsize AS559\\[-1pt]\scriptsize (ETH Z\"urich)}; + \node[box, below=5mm of rs] (other) {other exchanges,\\[-1pt]transit}; + \draw[web] (you) -- node[above, inner sep=1.5pt]{\tiny HTTPS} (ferrix); + \draw[bgp] (ferrix) -- node[above, inner sep=1.5pt]{\tiny BGP} (pr); + \draw[bgp] (pr) -- (rs); + \draw[bgp] (rs) -- (sw); + \draw[bgp] (pr) |- (other); +\end{tikzpicture} +\caption{The lab. Your browser talks to a small BGP daemon, which announces +your prefix to the router \texttt{pr01.rue}. That router peers at several +Internet exchanges and buys transit. Dashed arrows are BGP sessions.} +\label{fig:lab} +\end{figure} + +Open \url{\laburl} and log in with the credentials given in class. The page +belongs to the lab daemon of Fig.~\ref{fig:lab}. It speaks +BGP~\cite{rfc4271} to \texttt{pr01.rue}, and whatever you announce here +reaches the real Internet within a minute or two. Use the \emph{auto-refresh} +link at the top right to keep the tables current. + +\task{Look before you touch.} +\noindent\begin{minipage}{\linewidth} +Read the \emph{Peers} table, then open the \emph{Configuration} line under +the header. +\fillintwo{Neighbour's AS number:}{session state:} +\fillintwo{The daemon's own AS number:}{it only accepts prefixes in:} +\end{minipage} + +\task{Announce.} +Enter your name as \emph{owner} and your prefix, leave everything else +untouched, and press \emph{Announce}. Only the owner can withdraw a route, so +spell your name the same way each time. + +\task{Read the message you just sent.} +Click \emph{bytes} next to your route and hover over the coloured segments. +An UPDATE is a header, two length fields, a list of path attributes, and a +list of IPv4 prefixes. + +\fillintwo{Length of the message, in bytes:}{AS number(s) in \texttt{AS\_PATH}:} +\fillin{Your prefix is carried in the attribute named} +\noindent It is not in the prefix list at the end of the message. Why? +\answer[2] + +\task{See it from the outside.} +Wait two minutes, then look your prefix up again on RIPEstat or +\texttt{bgp.tools}. + +\fillintwo{Origin AS seen by the world:}{an AS path you found:} +\noindent The daemon's AS4200000001 is missing from that path. Where did it go, and why +is that necessary? (Hint: RFC~6996~\cite{rfc6996}.) +\answer[2] + +\task{Reach it.} +The router answers for every address in the lab space, so your prefix is +reachable exactly when your announcement got out. From your laptop, and from +your phone \emph{on mobile data}: +\begin{lstlisting} +ping -6 2a0d:d741:::1 traceroute -6 2a0d:d741:::1 +\end{lstlisting} +\reach + +% ============================================================================== +\section{Steering Your Prefix with Communities} +% Let the opening paragraph finish on this page; the table then opens the next. +\enlargethispage{4\baselineskip} +{\interlinepenalty=10000 + +A community is a tag on a route. It means whatever the network that reads it +has decided it means~\cite{rfc1997,rfc8092}. Table~\ref{tab:communities} +lists the ones you need. Two networks act on them in turn: first our router +\texttt{pr01.rue}, then the SwissIX route servers~\cite{swissix}, which pass +routes between the members of the exchange.\par} + +\begin{table}[!htb] +\centering +\caption{Large communities for this exercise, written +\texttt{who:function:target}. Within one network, \emph{never} beats +\emph{announce}, which beats \emph{nowhere}. The page's preset menu has all of +them.} +\label{tab:communities} +\begin{tabular}{@{}l@{\hspace{1.4em}}l@{\hspace{1.4em}}l@{}} +\toprule +Community & Read by & Effect \\ +\midrule +\texttt{210036:0:0} & \texttt{pr01.rue} & announce nowhere \ldots \\ +\texttt{210036:1:42476} & \texttt{pr01.rue} & \ldots except to AS42476 (SwissIX route servers) \\ +\texttt{210036:0:}\textit{as} & \texttt{pr01.rue} & never announce to neighbour \textit{as} \\ +\midrule +\texttt{42476:0:0} & SwissIX & send to no member \ldots \\ +\texttt{42476:1:559} & SwissIX & \ldots except AS559, SWITCH \\ +\texttt{42476:0:}\textit{as} & SwissIX & never send to member \textit{as} \\ +\midrule +\texttt{NO\_EXPORT} & everyone & keep the route, pass it to no other AS \\ +\bottomrule +\end{tabular} +\end{table} + +\task{One exchange only.} +Announce your prefix again, now with the large communities +\texttt{210036:0:0} and \texttt{210036:1:42476}. Announcing a prefix you +already own replaces it. \emph{Before} you look: who do you expect to still +see it? +\answer[1] +\noindent Wait two minutes and check. +\fillin{Origin and path now:} +\reach + +\task{The university only.} +Add \texttt{42476:0:0} and \texttt{42476:1:559} to the two you already have, +and announce again. Our router now tells only the route servers, and the route +servers tell only SWITCH, the network ETH is part of. + +\reach +\noindent Is your prefix still visible on RIPEstat or bgp.tools? Explain what you see. +\answer[2] + +\task{Find the communities in the bytes.} +Open \emph{bytes} again and find \texttt{LARGE\_COMMUNITIES}. Each community +is three 32-bit numbers. $42476$ is \texttt{a5ec} in hexadecimal; write down +the twelve bytes of \texttt{42476:1:559}: +\answer[1] +\noindent Now compare with what the rest of the world received: the +\texttt{210036:\ldots} communities are gone but the \texttt{42476:\ldots} ones +are still there. Who removed them, and why only those? +\answer[2] + +\task{A well-known community.} +Remove all large communities and set the (standard) community +\texttt{NO\_EXPORT} instead. Predict who will learn the route, then check. +\answer[2] + +\task{Clean up.} +Withdraw your prefix. How long does it take to disappear from the looking +glass, and what did the withdrawal look like compared to the announcement? +\answer[2] + +\medskip\noindent\textbf{Think.} +You steered routing in two networks you do not operate, using nothing but +numbers attached to a route. What would happen if you attached a community +that one of \emph{their} upstreams acts on? Look at the \emph{Configuration} +on the lab page and at Table~\ref{tab:communities}: which communities were you +\emph{not} allowed to send, and who decided that? +\answer[3] + +\begin{thebibliography}{8} +\bibitem{rfc4271} Rekhter, Y., Li, T., Hares, S.: A Border Gateway Protocol 4 (BGP-4). RFC 4271 (2006) +\bibitem{rfc1997} Chandra, R., Traina, P., Li, T.: BGP Communities Attribute. RFC 1997 (1996) +\bibitem{rfc8092} Heitz, J., Snijders, J., Patel, K., Bagdonas, I., Hilliard, N.: BGP Large Communities Attribute. RFC 8092 (2017) +\bibitem{rfc6996} Mitchell, J.: Autonomous System (AS) Reservation for Private Use. RFC 6996 (2013) +\bibitem{ripedb} RIPE NCC: RIPE Database Query, \url{https://apps.db.ripe.net/db-web-ui/query} +\bibitem{swissix} SwissIX: Action BGP Communities, \url{https://www.swissix.ch/resources/action-bgp-communities/} +\end{thebibliography} + +\clearpage +\appendix +\section{Reference} +\small + +\noindent\textbf{IPv6 notation.} An address is 128 bits, written as eight +groups of four hexadecimal digits. Leading zeros in a group may be dropped, +and one run of all-zero groups may be written \texttt{::}. A prefix +\texttt{2a0d:d741:1::/48} fixes the first 48 bits and leaves the rest free. +Hexadecimal digits: \texttt{a}\,=\,10, \texttt{b}\,=\,11, \texttt{c}\,=\,12, +\texttt{d}\,=\,13, \texttt{e}\,=\,14, \texttt{f}\,=\,15; for a two-digit value, +$n = 16 \cdot \mathit{first} + \mathit{second}$, so $26 = \texttt{1a}$. + +\begin{table}[!htb] +\centering +\caption{Anatomy of a BGP UPDATE message~\cite{rfc4271}.} +\begin{tabular}{@{}l@{\hspace{1.4em}}l@{\hspace{1.4em}}l@{}} +\toprule +Bytes & Field & Contents \\ +\midrule +16 & marker & all ones; marks a message boundary \\ +2 & length & of the whole message, 19 to 4096 bytes \\ +1 & type & 1 OPEN, 2 UPDATE, \\ + & & 3 NOTIFICATION, 4 KEEPALIVE \\ +\midrule +2 + $w$ & withdrawn routes & IPv4 prefixes no longer reachable \\ +2 + $a$ & path attributes & everything about the route \\ +rest & NLRI & IPv4 prefixes being announced \\ +\bottomrule +\end{tabular} +\end{table} + +\begin{table}[!htb] +\centering +\caption{Path attributes you will meet. Each is sent as flags, type, length, +value. Flag bits: \texttt{0x80} optional, \texttt{0x40} transitive (passed on +even by routers that do not understand it), \texttt{0x10} two-byte length.} +\begin{tabular}{@{}r@{\hspace{1.2em}}l@{\hspace{1.4em}}l@{}} +\toprule +Type & Name & Meaning \\ +\midrule +1 & \texttt{ORIGIN} & how the route entered BGP \\ +2 & \texttt{AS\_PATH} & networks crossed: nearest first, origin last \\ +3 & \texttt{NEXT\_HOP} & where to send the packets (IPv4) \\ +4 & \texttt{MULTI\_EXIT\_DISC} & hint to the neighbour; lower is preferred \\ +8 & \texttt{COMMUNITIES} & 32-bit tags, written \texttt{a:b}~\cite{rfc1997} \\ +14 & \texttt{MP\_REACH\_NLRI} & IPv6 (and other) prefixes, with their next hop \\ +32 & \texttt{LARGE\_COMMUNITIES} & three 32-bit numbers, written \texttt{a:b:c}~\cite{rfc8092} \\ +\bottomrule +\end{tabular} +\end{table} + +\noindent\textbf{Glossary.} +\begin{description}[leftmargin=2.4cm,style=sameline,itemsep=0pt,topsep=2pt,parsep=0pt] +\item[AS] Autonomous system: a network under one administration, identified + by a number. Numbers from 4200000000 upwards are for private use~\cite{rfc6996}. +\item[Prefix] Addresses sharing their leading bits. The longest matching prefix wins. +\item[Transit] Paying a provider to carry your traffic to and from the whole Internet. +\item[Peering] Two networks exchanging their own and their customers' routes, usually for free. +\item[Exchange] An IX: a shared Ethernet network where many networks meet to peer. +\item[Route server] Passes routes between members of an exchange; carries no traffic. +\item[\texttt{route6}] A database object stating that an AS may originate an IPv6 prefix. +\end{description} + + + +\end{document}