Subject: Re: BGP Black hole Community

From: [email-masked]
Date: Wed, 09 Apr 2003 16:41:03 -0400

On Wed, 09 Apr 2003 14:19:51 MDT, "Rasheeduddin, Tariq" said:
> > If this was to be generic, well-known behaviour you would want 
> > additional semantics for enabling/accepting it, in order to malicious 
> > or accidental) injection of DISCARD-equipped routes from peers. 
> 
> As the threat exists regardless to this functionality, this discussion
> should be out-of-scope.

Correct. Those who didn't learn from AS7007 (yes, AS7007 screwed up - but how
many *other* AS believed it as gospel truth?) will shoot themselves in the foot
eventually, with or without this function.

---

From: John Stracke <[email-masked]>
Date: Wed, 09 Apr 2003 16:51:20 -0400

>eventually, with or without this function.
Well, yes; but just because it's possible to shoot yourself in the foot 
doesn't mean you want to make it easy for other people to shoot you in 
the foot--which would be the effect of enabling this blackhole feature 
by default.

-- 
/============================================================\
|John Stracke      [email-masked]                     |
|Principal Engineer|http://www.centive.com                   |
|Centive           |My opinions are my own.                  |
|============================================================|
|"God does not play games with His loyal servants." "Whoo-ee,|
|where have you *been*?" --_Good Omens_                      |
\============================================================/

---

From: "Rasheeduddin, Tariq" <[email-masked]>
Date: Wed, 9 Apr 2003 14:19:51 -0600

Tariq

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Wed, 09 Apr 2003 17:16:59 -0400

>the foot--which would be the effect of enabling this blackhole feature 

Agreed.  The function itself is reasonable, but it should only be used 
in private by consenting adult ISPs.

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com (2nd edition of "Firewalls" book)

---

From: "Peering" <[email-masked]>
Date: Thu, 10 Apr 2003 16:22:20 -0400

> in private by consenting adult ISPs.

If a Network operator is not acknowledging the DISCARD community (due to any
reason) and accepting the advertisment, then simply he will forward the
traffic to the sender BGP neighbor (won't hurt anything) and the sender will
forward the traffic eventually to the discard bin. The receiving BGP
neighbor may or may not change the DISCARD community when forward the prefix
to other peers. Again, it won't be any issue.

Am I missing anything here or any threat/issue?

Obviously wherever possible, a network operator does prefix filtering
otherwise just leave open to accept everything (e.g., from Transit/ISP
link.... 125,000 routes today). As Tariq mentioned the threat exists
regardless to this functionality. For example, a peer can advertise a specif
prefix for someone else aggregate prefix without DISCARD community as
follows:

1. Prefix 2.10.0.0/16 belongs to AS#abc
2. Prefix 2.10.0.0/17 and 2.10.128.0/17 advertise from another AS#xyz (just
an attack). Is there any way to NOT accept this prefix if coming from
Transit link (without prefix filtering)? Due to longest match rule all the
traffic will forward to AS#xyz (assume 2.10.0.0/16 is the only aggregate
prefix advertisng from AS#abc).

So IMO, this new community will not create any loophole or potential threat.

If globally disabled, then what should be the default behaviour (a) Do not
accept prefix if DISCARD community is attached or (b) Do not take any action
by default (setting next hop for those prefix to discard bin)?

We could define a set of rules to use this community properly (like today's
Inetnet network, an external peer normally accept /24 or smaller prefix).