Subject: Re: [RPSEC] Back to the Basics: The AS Path

From: Sandy Murphy <[email-masked]>
Date: Mon, 24 Jan 2005 13:23:44 -0500 (EST)

>Russ, I believe, was speaking of the Cisco "as path prepend" operation
>in their CLI.  This option is what is used to insert an arbitrary
>number of ASes beyond that of the local AS number.

Ouch.  People actually operationally add arbitrary AS's to the AS_PATH?

I'm stuck right now on the idea of how I might protect the AS_PATH if
this were a desired feature.  I don't know how either a "check the
pairwise adjacencies" check or a "check for transit through the
mentioned AS's" check could deal with this.

Any chance this could be considered a current operational behavior
that would be deprecated as faciilitating abusive practices?

It can be difficult to allow only benign manipulations if those
same manipulations can be malicious as well.  Unless you can find
a way for the code to tell the benign cases from the malicious ones.

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: [email-masked]
Date: Mon, 24 Jan 2005 19:40:25 +0100

> Ouch.  People actually operationally add arbitrary AS's to the AS_PATH?

The common usage is to prepend an arbitrary number of your *own* AS to
the path. I wouldn't be surprised if some people depend on being able
to prepend an arbitrary AS other than their own.

> that would be deprecated as faciilitating abusive practices?

Being able to prepend your own AS is vital.

Steinar Haug, Nethelp consulting, [email-masked]

---

From: Blaine Christian <[email-masked]>
Date: Mon, 24 Jan 2005 13:40:31 -0500

> Ouch.  People actually operationally add arbitrary AS's to the AS_PATH?

Normally, AS's are prepended by the AS sending the update (in other words
they prepend their OWN AS not someone elses).

> mentioned AS's" check could deal with this.

Lump multiple, identical, AS numbers together and you should be able to
still check pairwise.

> that would be deprecated as faciilitating abusive practices?

Not much of a chance.  Very widely used.

---

From: [email-masked]
Date: Mon, 24 Jan 2005 18:46:05 +0000

> Ouch.  People actually operationally add arbitrary AS's to the AS_PATH?

	every single day.  AS padding is common practice

> that would be deprecated as faciilitating abusive practices?

	perhaps not. why would you consider this an abusive practice?

> a way for the code to tell the benign cases from the malicious ones.

	i am reminded that even normally benign actions, when taken
	to excess or w/o consideration of the environment where there
	operatate, may be malignant.  biological analogs of recent
	memory include death by excessive salt and water intake.

---

From: Jeffrey Haas <[email-masked]>
Date: Mon, 24 Jan 2005 13:49:26 -0500

Blaine,

> they prepend their OWN AS not someone elses).

Given this assumption (you only append your own ASes), a security 
mechanism can be devised to deal with this.  (After all, in this case,
the set of ASes is considered an equivalence class as far as the
security goes.)

More problematic is when this is done by adding in an AS_SET.  AS_SETs
are problematic for AS_PATH security in general.

However, we're aware of people who do this to deny routes to other ASes.
This means they put someone else's AS in there.

-- 
Jeff Haas 
NextHop Technologies

---

From: Stephen Kent <[email-masked]>
Date: Mon, 24 Jan 2005 13:52:36 -0500

>they prepend their OWN AS not someone elses).

OK, but that's what I cited as a specifically allowed behavior in the 
current BGP spec. So, is that what you assumed Russ meant, or is it 
"let's add arbitrary ASes?"

>Lump multiple, identical, AS numbers together and you should be able to

the fact that it is just a repeated instance of the same AS makes this easy.

>Not much of a chance.  Very widely used.

I think Sandy was talking about the "arbitrary AS" case, not the case 
where an AS adds itself multiple times.

Steve

---

From: [email-masked]
Date: Mon, 24 Jan 2005 18:58:51 +0000

> to prepend an arbitrary AS other than their own.

	and there are some folks who have several AS'es and 
	they use these as well as private AS'es..

> Being able to prepend your own AS is vital.

	yes.

---

From: Blaine Christian <[email-masked]>
Date: Mon, 24 Jan 2005 13:59:51 -0500

> the fact that it is just a repeated instance of the same AS makes this easy.

I have heard exactly one "request" for random AS insertion from an operator.
The request was based on a desire to ensure that "certain" AS's would reject
an announcement (taking advantage of loop free BGP behavior).

This will be a question I will posit for the operators.

---

From: Stefan Mink <[email-masked]>
Date: Mon, 24 Jan 2005 20:45:00 +0100

>that would be deprecated as faciilitating abusive practices?

in the past I once used the "as path prepend" feature to prepend certain 
routes
from transit providers with their own AS to make them less likely to be 
elected
as best route. I'm not sure this is really "abusive" practice although I 
did more
than prepend my own AS number. I'm fully d'accord that this is not a 
brilliant
practise but using a higher localPref ist sometimes not the right path 
and prepending
your own AS just doesn't work here.

The application here would not really break a security architecture since no
arbitrary AS was inserted but only ASes involved in the sessions. But 
I'm not
sure what other "creative" usages are still possible...

   tschuess
             Stefan Mink
-- 
Stefan Mink, Schlund+Partner AG (AS 8560)
Primary key fingerprint: 389E 5DC9 751F A6EB B974  DC3F 7A1B CF62 F0D4 D2BA