diff --git a/docs/lab/handout/handout.pdf b/docs/lab/handout/handout.pdf index 00b2f4b..c5a17a8 100644 Binary files a/docs/lab/handout/handout.pdf and b/docs/lab/handout/handout.pdf differ diff --git a/docs/lab/handout/handout.tex b/docs/lab/handout/handout.tex index 5a56349..706552c 100644 --- a/docs/lab/handout/handout.tex +++ b/docs/lab/handout/handout.tex @@ -1,361 +1,191 @@ -% Exercise sheet for the "Hands-on BGP" lecture. +% Exercise sheet for the "Hands-on BGP" lecture: two A4 pages, one sheet. % Springer LNCS class (llncs.cls ships with TeX Live). Build: latexmk -pdf handout.tex -\documentclass[runningheads,a4paper]{llncs} +\documentclass[a4paper]{llncs} +\usepackage[a4paper,margin=1in]{geometry} \usepackage[T1]{fontenc} \usepackage[utf8]{inputenc} \usepackage{microtype} \usepackage{booktabs} -\usepackage{enumitem} \usepackage{amssymb} -\usepackage{xcolor} \usepackage{listings} \usepackage{tikz} -\usetikzlibrary{positioning,arrows.meta,fit} +\usetikzlibrary{positioning,arrows.meta} \PassOptionsToPackage{hyphens}{url} \usepackage[hidelinks]{hyperref} \renewcommand\UrlFont{\ttfamily\small} +\pagestyle{empty} +% Floats sit in the text here, so they need less air than in a paper. +\setlength{\intextsep}{7pt} +\setlength{\abovecaptionskip}{4pt} +\setlength{\belowcaptionskip}{0pt} % ---- things to change per class ------------------------------------------- -\newcommand{\labhost}{bgplab.rayhaan.net} -\newcommand{\laburl}{https://\labhost/statusz} -\newcommand{\labspace}{2a0d:d741::/40} +\newcommand{\laburl}{https://bgplab.rayhaan.net/statusz} \newcommand{\myprefix}{\texttt{2a0d:d741:}\underline{\texttt{\,n\,}}\texttt{::/48}} % ---- exercise machinery ------------------------------------------------------ \lstset{basicstyle=\ttfamily\small,columns=fullflexible,keepspaces=true, frame=single,framerule=0.3pt,xleftmargin=1.2em,xrightmargin=0.4em, - aboveskip=0.6em,belowskip=0.4em,breaklines=true} - + aboveskip=0.5em,belowskip=0.3em} \newcounter{task}[section] \renewcommand{\thetask}{\thesection.\arabic{task}} -\newcommand{\task}[1]{\refstepcounter{task}\medskip\noindent - \textbf{Task \thetask}\enspace\textit{#1}\par\nobreak\smallskip\noindent\ignorespaces} - -% Dotted lines to write on: \answer[3] gives three. +\newcommand{\task}[1]{\refstepcounter{task}\smallskip\noindent + \textbf{Task \thetask}\enspace\textit{#1}\enspace\ignorespaces} \newcommand{\answer}[1][1]{\par\nobreak - \foreach \i in {1,...,#1}{\vspace{1.05em}\noindent\makebox[\linewidth]{\dotfill}\par}\smallskip} -% Fill-in rows: the dots always run to the margin, never past it. -\newcommand{\fillin}[1]{\par\nopagebreak\noindent #1~\dotfill\par\vspace{0.5em}} -\newcommand{\fillintwo}[2]{\par\nopagebreak\noindent - \parbox[t]{0.485\linewidth}{#1~\dotfill}\hfill\parbox[t]{0.485\linewidth}{#2~\dotfill}\par\vspace{0.5em}} -\newcommand{\fillinthree}[3]{\par\nopagebreak\noindent - \parbox[t]{0.42\linewidth}{#1~\dotfill}\hfill\parbox[t]{0.27\linewidth}{#2~\dotfill}\hfill\parbox[t]{0.27\linewidth}{#3~\dotfill}\par\vspace{0.5em}} + \foreach \i in {1,...,#1}{\vspace{1.0em}\noindent\makebox[\linewidth]{\dotfill}\par}\smallskip} +\newcommand{\fillintwo}[2]{\par\nopagebreak\smallskip\noindent + \parbox[t]{0.485\linewidth}{#1~\dotfill}\hfill\parbox[t]{0.485\linewidth}{#2~\dotfill}\par\vspace{0.4em}} +\newcommand{\fillinthree}[3]{\par\nopagebreak\smallskip\noindent + \parbox[t]{0.32\linewidth}{#1~\dotfill}\hfill\parbox[t]{0.32\linewidth}{#2~\dotfill}\hfill\parbox[t]{0.32\linewidth}{#3~\dotfill}\par\vspace{0.4em}} \newcommand{\cbox}{$\square$\;} -% The reachability check that recurs through the sheet. \newcommand{\reach}{\par\nopagebreak\smallskip\noindent - \begin{tabular}{@{}l@{\hspace{2em}}l@{}} - \cbox laptop, university network: reachable & \cbox phone, mobile data: reachable - \end{tabular}\par\smallskip} + Reachable from:\hspace{1.2em}\cbox laptop on the university network\hspace{2em}\cbox phone on mobile data\par\smallskip} \begin{document} -\title{Hands-on BGP:\\Announcing and Steering a Prefix on the Internet} -\subtitle{Exercise sheet} -\titlerunning{Hands-on BGP: exercise sheet} - +\title{Hands-on BGP: Announcing and Steering a Prefix} \author{Rayhaan Jaufeerally} -\authorrunning{Network Security, 2026} -\institute{Network Security, ETH Z\"urich\\ -\email{Lab page: \url{\laburl}}} - +\institute{Network Security, ETH Z\"urich \qquad Lab page: \url{\laburl}} \maketitle \begin{abstract} -In this exercise you take an IPv6 prefix that is registered for you, find out -what the Internet's registries say about it, announce it to the real Internet -with BGP, and then use BGP communities to decide which networks may learn it. -By the end your prefix should be reachable from the university network and -from nowhere else. Work through the tasks in order and write your answers on -this sheet; the questions marked \emph{Think} are for discussion. - -\keywords{BGP \and IPv6 \and RIPE database \and route servers \and BGP communities} +You look up who announces the address you are using right now, announce an +IPv6 prefix of your own to the real Internet with BGP, and then use BGP +communities to decide which networks may learn it. By the end your prefix +should be reachable from the university network and from nowhere else. \end{abstract} -\noindent -\begin{tabular}{@{}p{0.47\linewidth}@{\hspace{0.06\linewidth}}p{0.47\linewidth}@{}} -Name: \dotfill & Student number $n$ (decimal): \dotfill \\[0.9em] -$n$ in hexadecimal: \dotfill & Your prefix: \myprefix -\end{tabular} - \medskip\noindent -Every student has one \texttt{/48} out of the lab's \texttt{\labspace}. The -third group of your prefix is your student number \emph{written in -hexadecimal}: student 10 has \texttt{2a0d:d741:a::/48}, student 16 has -\texttt{2a0d:d741:10::/48}. Fill in the fields above before you continue. +\parbox[t]{0.44\linewidth}{Name:~\dotfill}\hfill +\parbox[t]{0.24\linewidth}{Student no.\ $n$:~\dotfill}\hfill +\parbox[t]{0.27\linewidth}{Prefix: \myprefix} + +\smallskip\noindent +Your prefix is \myprefix, where \texttt{n} is your student number \emph{in +hexadecimal}: student 10 has \texttt{2a0d:d741:a::/48}, student 26 has +\texttt{2a0d:d741:1a::/48}. % ============================================================================== -\section{Who Holds Which Addresses?} +\section{Who Announces the Address You Are Using?} -Address space and AS numbers are handed down from IANA to five regional -registries and on to their members. For Europe the registry is the RIPE NCC, -and its database is public~\cite{ripedb}. +\task{Find your address.} +Open \texttt{bgp.tools} in a browser: the top of the page shows the address +you are connecting from, the prefix it belongs to, and the network that +announces that prefix. +\fillinthree{Your address:}{its prefix:}{announced by AS:} -\task{Look up your own prefix.} -Query the RIPE database, with your prefix in place of the example: +\task{Ask the registry.} +The RIPE database~\cite{ripedb} records who holds address space +(\texttt{inet6num}, or \texttt{inetnum} for IPv4) and who may announce it +(\texttt{route6}, \texttt{route}). Look up your address, then your lab prefix: \begin{lstlisting} -whois -h whois.ripe.net 2a0d:d741:1::/48 +whois -h whois.ripe.net whois -h whois.ripe.net 2a0d:d741:::/48 \end{lstlisting} -(No \texttt{whois} on your machine? The same query works in a -browser~\cite{ripedb}.) You get an \texttt{inet6num} object describing a block of addresses and a -\texttt{route6} object saying who may announce a prefix. - -\enlargethispage{2\baselineskip} -\fillintwo{\texttt{inet6num} block:}{its \texttt{status}:} -\fillintwo{\texttt{route6} \texttt{origin} AS:}{maintained by (\texttt{mnt-by}):} - -\task{Look up a prefix you use every day.} -Find an address of \texttt{ethz.ch} and look it up the same way: -\begin{lstlisting} -dig +short ethz.ch AAAA -whois -h whois.ripe.net -\end{lstlisting} -\fillinthree{\texttt{inet6num} block:}{\texttt{status}:}{\texttt{origin}:} - -\task{Compare the database with the routing table.} -The database says who \emph{may} announce a prefix. Whether anybody \emph{does} -is a different question. Look up both prefixes on RIPEstat -(\texttt{stat.ripe.net}) or on \texttt{bgp.tools}. - -\fillin{Is ETH's prefix announced, and by which AS?} -\fillintwo{Is yours?}{That AS belongs to:} - -\medskip\noindent\textbf{Think.} -ETH's prefix is originated by an AS that is not called ETH. Whose is it, and -what does that tell you about how the university reaches the Internet? Your -\texttt{route6} object exists although nobody announces the prefix: what is -such an object good for? -\answer[3] +\fillintwo{Your address: held by (\texttt{netname})}{\texttt{origin} AS:} +\fillintwo{Your lab prefix: \texttt{origin} AS}{is it announced right now?} % ============================================================================== \section{Announcing Your Prefix} -\begin{figure}[t] +\begin{figure}[h] \centering -\begin{tikzpicture}[font=\footnotesize, node distance=6mm and 8.5mm, - box/.style={draw, rounded corners=1.5pt, minimum height=8mm, inner xsep=3pt, align=center}, +\begin{tikzpicture}[font=\footnotesize, node distance=5mm and 11mm, + box/.style={draw, rounded corners=1.5pt, minimum height=7.5mm, inner xsep=4pt, align=center}, bgp/.style={-{Stealth[length=2mm]}, dashed}, web/.style={-{Stealth[length=2mm]}}] \node[box] (you) {you\\[-1pt]\scriptsize browser}; \node[box, right=of you] (ferrix) {lab daemon\\[-1pt]\scriptsize AS4200000001}; \node[box, right=of ferrix] (pr) {\texttt{pr01.rue}\\[-1pt]\scriptsize AS210036}; - \node[box, right=of pr] (rs) {SwissIX\\[-1pt]\scriptsize route servers\\[-1pt]\scriptsize AS42476}; - \node[box, right=of rs] (sw) {SWITCH\\[-1pt]\scriptsize AS559\\[-1pt]\scriptsize (ETH Z\"urich)}; - \node[box, below=5mm of rs] (other) {other exchanges,\\[-1pt]transit}; + \node[box, right=of pr] (rs) {SwissIX route servers\\[-1pt]\scriptsize AS42476}; + \node[box, right=of rs] (sw) {SWITCH (ETH)\\[-1pt]\scriptsize AS559}; + \node[box, below=4mm of rs] (other) {other exchanges, transit}; \draw[web] (you) -- node[above, inner sep=1.5pt]{\tiny HTTPS} (ferrix); \draw[bgp] (ferrix) -- node[above, inner sep=1.5pt]{\tiny BGP} (pr); \draw[bgp] (pr) -- (rs); \draw[bgp] (rs) -- (sw); \draw[bgp] (pr) |- (other); \end{tikzpicture} -\caption{The lab. Your browser talks to a small BGP daemon, which announces -your prefix to the router \texttt{pr01.rue}. That router peers at several -Internet exchanges and buys transit. Dashed arrows are BGP sessions.} +\caption{The lab. Dashed arrows are BGP sessions~\cite{rfc4271}; everything right of +\texttt{pr01.rue} is the real Internet.} \label{fig:lab} \end{figure} -Open \url{\laburl} and log in with the credentials given in class. The page -belongs to the lab daemon of Fig.~\ref{fig:lab}. It speaks -BGP~\cite{rfc4271} to \texttt{pr01.rue}, and whatever you announce here -reaches the real Internet within a minute or two. Use the \emph{auto-refresh} -link at the top right to keep the tables current. - -\task{Look before you touch.} -\noindent\begin{minipage}{\linewidth} -Read the \emph{Peers} table, then open the \emph{Configuration} line under -the header. -\fillintwo{Neighbour's AS number:}{session state:} -\fillintwo{The daemon's own AS number:}{it only accepts prefixes in:} -\end{minipage} - \task{Announce.} -Enter your name as \emph{owner} and your prefix, leave everything else -untouched, and press \emph{Announce}. Only the owner can withdraw a route, so -spell your name the same way each time. +Open \url{\laburl} (credentials are given in class). Enter your name as +\emph{owner} and your prefix, leave everything else untouched, and press +\emph{Announce}. Only the owner can withdraw a route, so spell your name the +same way each time. -\task{Read the message you just sent.} +\task{Read what you sent.} Click \emph{bytes} next to your route and hover over the coloured segments. -An UPDATE is a header, two length fields, a list of path attributes, and a -list of IPv4 prefixes. +\fillintwo{AS number(s) in \texttt{AS\_PATH}:}{attribute carrying your prefix:} -\fillintwo{Length of the message, in bytes:}{AS number(s) in \texttt{AS\_PATH}:} -\fillin{Your prefix is carried in the attribute named} -\noindent It is not in the prefix list at the end of the message. Why? -\answer[2] - -\task{See it from the outside.} -Wait two minutes, then look your prefix up again on RIPEstat or -\texttt{bgp.tools}. - -\fillintwo{Origin AS seen by the world:}{an AS path you found:} -\noindent The daemon's AS4200000001 is missing from that path. Where did it go, and why -is that necessary? (Hint: RFC~6996~\cite{rfc6996}.) -\answer[2] +\task{See it from outside.} +Wait two minutes, then look your prefix up on \texttt{bgp.tools}. +\fillintwo{Origin AS the world sees:}{an AS path you found:} +\noindent The lab daemon's AS4200000001 is missing from that path. Where did it go, and why? +\answer[1] \task{Reach it.} The router answers for every address in the lab space, so your prefix is -reachable exactly when your announcement got out. From your laptop, and from -your phone \emph{on mobile data}: -\begin{lstlisting} -ping -6 2a0d:d741:::1 traceroute -6 2a0d:d741:::1 -\end{lstlisting} +reachable exactly when your announcement got out:\quad +\texttt{ping -6 2a0d:d741:::1} \reach % ============================================================================== \section{Steering Your Prefix with Communities} -% Let the opening paragraph finish on this page; the table then opens the next. -\enlargethispage{4\baselineskip} -{\interlinepenalty=10000 -A community is a tag on a route. It means whatever the network that reads it -has decided it means~\cite{rfc1997,rfc8092}. Table~\ref{tab:communities} -lists the ones you need. Two networks act on them in turn: first our router -\texttt{pr01.rue}, then the SwissIX route servers~\cite{swissix}, which pass -routes between the members of the exchange.\par} +A community is a tag on a route; it means whatever the network reading it has +decided it means~\cite{rfc8092}. Two networks act on yours in turn: first our +router \texttt{pr01.rue}, then the SwissIX route servers~\cite{swissix}, which +pass routes between the members of the exchange. The page's preset menu has +all of the communities below. -\begin{table}[!htb] +\begin{table}[h] \centering -\caption{Large communities for this exercise, written -\texttt{who:function:target}. Within one network, \emph{never} beats -\emph{announce}, which beats \emph{nowhere}. The page's preset menu has all of -them.} -\label{tab:communities} -\begin{tabular}{@{}l@{\hspace{1.4em}}l@{\hspace{1.4em}}l@{}} +\begin{tabular}{@{}l@{\hspace{1.6em}}l@{\hspace{1.6em}}l@{}} \toprule -Community & Read by & Effect \\ +Large community & Read by & Effect \\ \midrule \texttt{210036:0:0} & \texttt{pr01.rue} & announce nowhere \ldots \\ -\texttt{210036:1:42476} & \texttt{pr01.rue} & \ldots except to AS42476 (SwissIX route servers) \\ -\texttt{210036:0:}\textit{as} & \texttt{pr01.rue} & never announce to neighbour \textit{as} \\ +\texttt{210036:1:42476} & \texttt{pr01.rue} & \ldots except to AS42476, the SwissIX route servers \\ \midrule \texttt{42476:0:0} & SwissIX & send to no member \ldots \\ -\texttt{42476:1:559} & SwissIX & \ldots except AS559, SWITCH \\ -\texttt{42476:0:}\textit{as} & SwissIX & never send to member \textit{as} \\ -\midrule -\texttt{NO\_EXPORT} & everyone & keep the route, pass it to no other AS \\ +\texttt{42476:1:559} & SwissIX & \ldots except AS559, SWITCH, the network ETH is part of \\ \bottomrule \end{tabular} \end{table} \task{One exchange only.} -Announce your prefix again, now with the large communities -\texttt{210036:0:0} and \texttt{210036:1:42476}. Announcing a prefix you -already own replaces it. \emph{Before} you look: who do you expect to still -see it? +Announce your prefix again with \texttt{210036:0:0} and +\texttt{210036:1:42476}; announcing a prefix you own replaces it. Before you +look: who do you expect to still see it? \answer[1] -\noindent Wait two minutes and check. -\fillin{Origin and path now:} +\noindent Wait two minutes, then check on \texttt{bgp.tools} and with \texttt{ping}. \reach \task{The university only.} -Add \texttt{42476:0:0} and \texttt{42476:1:559} to the two you already have, -and announce again. Our router now tells only the route servers, and the route -servers tell only SWITCH, the network ETH is part of. - +Add \texttt{42476:0:0} and \texttt{42476:1:559} to the two you already have and +announce again. Our router now tells only the route servers, and they tell +only SWITCH. \reach -\noindent Is your prefix still visible on RIPEstat or bgp.tools? Explain what you see. +\noindent Is your prefix still visible on \texttt{bgp.tools}? Explain what you see. \answer[2] -\task{Find the communities in the bytes.} -Open \emph{bytes} again and find \texttt{LARGE\_COMMUNITIES}. Each community -is three 32-bit numbers. $42476$ is \texttt{a5ec} in hexadecimal; write down -the twelve bytes of \texttt{42476:1:559}: -\answer[1] -\noindent Now compare with what the rest of the world received: the -\texttt{210036:\ldots} communities are gone but the \texttt{42476:\ldots} ones -are still there. Who removed them, and why only those? -\answer[2] - -\task{A well-known community.} -Remove all large communities and set the (standard) community -\texttt{NO\_EXPORT} instead. Predict who will learn the route, then check. -\answer[2] - -\task{Clean up.} -Withdraw your prefix. How long does it take to disappear from the looking -glass, and what did the withdrawal look like compared to the announcement? -\answer[2] - -\medskip\noindent\textbf{Think.} +\task{Think.} You steered routing in two networks you do not operate, using nothing but -numbers attached to a route. What would happen if you attached a community -that one of \emph{their} upstreams acts on? Look at the \emph{Configuration} -on the lab page and at Table~\ref{tab:communities}: which communities were you -\emph{not} allowed to send, and who decided that? -\answer[3] +numbers attached to a route. What stops you from attaching a community that +one of \emph{their} upstreams acts on? +\answer[2] -\begin{thebibliography}{8} +\task{Clean up.} Withdraw your prefix and watch it disappear. + +\begin{thebibliography}{4} +\small \bibitem{rfc4271} Rekhter, Y., Li, T., Hares, S.: A Border Gateway Protocol 4 (BGP-4). RFC 4271 (2006) -\bibitem{rfc1997} Chandra, R., Traina, P., Li, T.: BGP Communities Attribute. RFC 1997 (1996) \bibitem{rfc8092} Heitz, J., Snijders, J., Patel, K., Bagdonas, I., Hilliard, N.: BGP Large Communities Attribute. RFC 8092 (2017) -\bibitem{rfc6996} Mitchell, J.: Autonomous System (AS) Reservation for Private Use. RFC 6996 (2013) \bibitem{ripedb} RIPE NCC: RIPE Database Query, \url{https://apps.db.ripe.net/db-web-ui/query} \bibitem{swissix} SwissIX: Action BGP Communities, \url{https://www.swissix.ch/resources/action-bgp-communities/} \end{thebibliography} -\clearpage -\appendix -\section{Reference} -\small - -\noindent\textbf{IPv6 notation.} An address is 128 bits, written as eight -groups of four hexadecimal digits. Leading zeros in a group may be dropped, -and one run of all-zero groups may be written \texttt{::}. A prefix -\texttt{2a0d:d741:1::/48} fixes the first 48 bits and leaves the rest free. -Hexadecimal digits: \texttt{a}\,=\,10, \texttt{b}\,=\,11, \texttt{c}\,=\,12, -\texttt{d}\,=\,13, \texttt{e}\,=\,14, \texttt{f}\,=\,15; for a two-digit value, -$n = 16 \cdot \mathit{first} + \mathit{second}$, so $26 = \texttt{1a}$. - -\begin{table}[!htb] -\centering -\caption{Anatomy of a BGP UPDATE message~\cite{rfc4271}.} -\begin{tabular}{@{}l@{\hspace{1.4em}}l@{\hspace{1.4em}}l@{}} -\toprule -Bytes & Field & Contents \\ -\midrule -16 & marker & all ones; marks a message boundary \\ -2 & length & of the whole message, 19 to 4096 bytes \\ -1 & type & 1 OPEN, 2 UPDATE, \\ - & & 3 NOTIFICATION, 4 KEEPALIVE \\ -\midrule -2 + $w$ & withdrawn routes & IPv4 prefixes no longer reachable \\ -2 + $a$ & path attributes & everything about the route \\ -rest & NLRI & IPv4 prefixes being announced \\ -\bottomrule -\end{tabular} -\end{table} - -\begin{table}[!htb] -\centering -\caption{Path attributes you will meet. Each is sent as flags, type, length, -value. Flag bits: \texttt{0x80} optional, \texttt{0x40} transitive (passed on -even by routers that do not understand it), \texttt{0x10} two-byte length.} -\begin{tabular}{@{}r@{\hspace{1.2em}}l@{\hspace{1.4em}}l@{}} -\toprule -Type & Name & Meaning \\ -\midrule -1 & \texttt{ORIGIN} & how the route entered BGP \\ -2 & \texttt{AS\_PATH} & networks crossed: nearest first, origin last \\ -3 & \texttt{NEXT\_HOP} & where to send the packets (IPv4) \\ -4 & \texttt{MULTI\_EXIT\_DISC} & hint to the neighbour; lower is preferred \\ -8 & \texttt{COMMUNITIES} & 32-bit tags, written \texttt{a:b}~\cite{rfc1997} \\ -14 & \texttt{MP\_REACH\_NLRI} & IPv6 (and other) prefixes, with their next hop \\ -32 & \texttt{LARGE\_COMMUNITIES} & three 32-bit numbers, written \texttt{a:b:c}~\cite{rfc8092} \\ -\bottomrule -\end{tabular} -\end{table} - -\noindent\textbf{Glossary.} -\begin{description}[leftmargin=2.4cm,style=sameline,itemsep=0pt,topsep=2pt,parsep=0pt] -\item[AS] Autonomous system: a network under one administration, identified - by a number. Numbers from 4200000000 upwards are for private use~\cite{rfc6996}. -\item[Prefix] Addresses sharing their leading bits. The longest matching prefix wins. -\item[Transit] Paying a provider to carry your traffic to and from the whole Internet. -\item[Peering] Two networks exchanging their own and their customers' routes, usually for free. -\item[Exchange] An IX: a shared Ethernet network where many networks meet to peer. -\item[Route server] Passes routes between members of an exchange; carries no traffic. -\item[\texttt{route6}] A database object stating that an AS may originate an IPv6 prefix. -\end{description} - - - \end{document}