BGP Flowspec in IOX Platform

Table of Contents

BGP Flow Specification 功能是一种用于防止 DoS（Denial of Service）/DDoS（Distributed Denial of Service）攻击的方法，可以提高网络安全性和可用性。其实现方式为 BGP FS controller 通过 BGP 下发特定的规则给 BGP FS client, BGP FS client 收到后按照该规则对特定流进行 redirect/remark/drop/rate limit。

BGP FS controller 可为 router 或者 server:

Router/Virtual Router(ASR9000, CRS, NCS 6000, XR 12000, … XRv9000)
Server(ExaBGP, YABGP, Open Day Light, Arbor SP, …)

BGP FS controller
#

Router
#

以 IOS XR 路由器为例，配置示例如下:

//create rules

class-map type traffic match-all match-UDP53
 match destination-port 53
 match protocol udp
 end-class-map
!
class-map type traffic match-all match-src-ipv4-addr
 match destination-address ipv4 25.1.104.0 255.255.255.0
 end-class-map

policy-map type pbr FS
 class type traffic match-src-ipv4-addr
  police rate 100000 bps
  !
 !
 class type traffic match-UDP53
  redirect next 192.42.52.125
  !
 !
 class type traffic class-default
 !
 end-policy-map

flowspec
 address-family ipv4
  service-policy type pbr FS

RP/0/RP0/CPU0:MXC.TAC.L.08-8201-01#show run router bgp
Mon Aug 30 04:44:52.662 UTC
router bgp 100
 bgp router-id 10.1.4.4
 address-family ipv4 flowspec
 !
 neighbor-group ibgp-flowspec
  remote-as 100
  address-family ipv4 flowspec
  !
 !
 neighbor 10.1.34.3
  use neighbor-group ibgp-flowspec
 !

Server
#

以 ExaBGP 为例：

Github上介绍了安装方式，也提供了 flowspec 相关的配置文件以供参考。

ExaBGP Install

[root@localhost ~]# pip install exabgp
Collecting exabgp
  Downloading exabgp-4.2.13.tar.gz (400 kB)
     |████████████████████████████████| 400 kB 14.9 MB/s
Requirement already satisfied: setuptools in ./.pyenv/versions/3.7.8/lib/python3.7/site-packages (from exabgp) (47.1.0)
Using legacy 'setup.py install' for exabgp, since package 'wheel' is not installed.
Installing collected packages: exabgp
    Running setup.py install for exabgp ... done
Successfully installed exabgp-4.2.13
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv
WARNING: You are using pip version 21.1.3; however, version 21.2.4 is available.
You should consider upgrading via the '/root/.pyenv/versions/3.7.8/bin/python3.7 -m pip install --upgrade pip' command.
[root@localhost ~]#
[root@localhost ~]#
[root@localhost ~]# exabgp --version
ExaBGP : 4.2.13
Python : 3.7.8 (default, May  9 2021, 11:28:59)  [GCC 4.8.5 20150623 (Red Hat 4.8.5-44)]
Uname  : Linux localhost.localdomain 3.10.0-862.el7.x86_64 #1 SMP Fri Apr 20 16:44:24 UTC 2018 x86_64
Root   : /root/.pyenv/versions/3.7.8
[root@localhost ~]#

ExaBGP configuration:

[root@localhost exabgp]# pwd
/root/exabgp
[root@localhost exabgp]# ls -al
total 12
drwxr-xr-x.  2 root root   40 Aug 30 00:51 .
dr-xr-x---. 21 root root 4096 Aug 30 00:51 ..
-rw-r--r--.  1 root root  640 Aug 30 00:51 conf.ini
-rw-r--r--.  1 root root  430 Aug 30 00:43 example.py
[root@localhost exabgp]# cat conf.ini
process announce-routes {
    run /root/.pyenv/versions/3.7.8/bin/python /root/exabgp/example.py;
    encoder json;
}

neighbor 10.31.122.26 {                 # Remote neighbor to peer with
    router-id 10.70.79.197;              # Our local router-id
    local-address 10.70.79.197;          # Our local update-source
    local-as 100;                    # Our local AS
    peer-as 100;                     # Peer's AS

   flow {                               #define flowspec rules
      route {
         match {
            destination 7.7.7.7/32;
         }
         then {
            redirect 10.1.13.1;
         }
      }
   }
    api {                               # Option config, define how to use python announce bgp routes
        processes [announce-routes];
    }


}

[root@localhost exabgp]#

Define python Script to add/remove Routes (option)

Exabgp 除了可以生成 bgp flowspec 路由，也可以用来生成普通的 BGP 路由，这篇文章介绍了如何使用 python script 生成 BGP 路由。

[root@localhost exabgp]# cat example.py
#!/usr/bin/env python3

from __future__ import print_function

from sys import stdout
from time import sleep

messages = [
    'announce route 100.10.0.0/24 next-hop self',
    'announce route 200.20.0.0/24 next-hop self',
]

sleep(5)

#Iterate through messages
for message in messages:
    stdout.write(message + '\n')
    stdout.flush()
    sleep(1)

#Loop endlessly to allow ExaBGP to continue running
while True:
    sleep(1)
[root@localhost exabgp]#

Start ExaBGP

[root@localhost exabgp]# exabgp ./conf.ini
00:51:45 | 61810  | welcome       | Thank you for using ExaBGP
00:51:45 | 61810  | version       | 4.2.13
00:51:45 | 61810  | interpreter   | 3.7.8 (default, May  9 2021, 11:28:59)  [GCC 4.8.5 20150623 (Red Hat 4.8.5-44)]
00:51:45 | 61810  | os            | Linux localhost.localdomain 3.10.0-862.el7.x86_64 #1 SMP Fri Apr 20 16:44:24 UTC 2018 x86_64
00:51:45 | 61810  | installation  | /root/.pyenv/versions/3.7.8
00:51:45 | 61810  | advice        | environment file missing
00:51:45 | 61810  | advice        | generate it using "exabgp --fi > /root/.pyenv/versions/3.7.8/etc/exabgp/exabgp.env"
00:51:45 | 61810  | cli           | could not find the named pipes (exabgp.in and exabgp.out) required for the cli
00:51:45 | 61810  | cli           | we scanned the following folders (the number is your PID):
00:51:45 | 61810  | cli control   |  - /run/exabgp/
00:51:45 | 61810  | cli control   |  - /run/0/
00:51:45 | 61810  | cli control   |  - /run/
00:51:45 | 61810  | cli control   |  - /var/run/exabgp/
00:51:45 | 61810  | cli control   |  - /var/run/0/
00:51:45 | 61810  | cli control   |  - /var/run/
00:51:45 | 61810  | cli control   |  - /root/.pyenv/versions/3.7.8/run/exabgp/
00:51:45 | 61810  | cli control   |  - /root/.pyenv/versions/3.7.8/run/0/
00:51:45 | 61810  | cli control   |  - /root/.pyenv/versions/3.7.8/run/
00:51:45 | 61810  | cli control   |  - /root/.pyenv/versions/3.7.8/var/run/exabgp/
00:51:45 | 61810  | cli control   |  - /root/.pyenv/versions/3.7.8/var/run/0/
00:51:45 | 61810  | cli control   |  - /root/.pyenv/versions/3.7.8/var/run/
00:51:45 | 61810  | cli control   | please make them in one of the folder with the following commands:
00:51:45 | 61810  | cli control   | > mkfifo /root/exabgp/run/exabgp.{in,out}
00:51:45 | 61810  | cli control   | > chmod 600 /root/exabgp/run/exabgp.{in,out}
00:51:45 | 61810  | configuration | performing reload of exabgp 4.2.13
00:51:45 | 61810  | reactor       | loaded new configuration successfully
00:51:47 | 61810  | reactor       | connected to peer-1 with outgoing-3 10.70.79.197-10.31.122.26
00:51:50 | 61810  | api           | route added to neighbor 10.31.122.26 local-ip 10.70.79.197 local-as 100 peer-as 100 router-id 10.70.79.197 family-allowed in-open : 100.10.0.0/24 next-hop self
00:51:51 | 61810  | api           | route added to neighbor 10.31.122.26 local-ip 10.70.79.197 local-as 100 peer-as 100 router-id 10.70.79.197 family-allowed in-open : 200.20.0.0/24 next-hop self
  00:53:47 | 61810  | reactor       | connected to peer-1 with outgoing-4 10.70.79.197-10.31.122.26

路由器上输出如下:

RP/0/RP0/CPU0:MXC.TAC.L.08-8201-01#show bgp ipv4 unicast summary
Neighbor        Spk    AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down  St/PfxRcd
10.1.2.2          0   100     181     180        3    0    0 02:50:22          0
10.70.79.197      0   100      67      62        3    0    0 00:36:55          2

RP/0/RP0/CPU0:MXC.TAC.L.08-8201-01#show bgp ipv4 unicast
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
* i100.10.0.0/24      10.70.79.197                  100      0 i
* i200.20.0.0/24      10.70.79.197                  100      0 i

Processed 2 prefixes, 2 paths
RP/0/RP0/CPU0:MXC.TAC.L.08-8201-01#show bgp ipv4 flowspec
   Network            Next Hop            Metric LocPrf Weight Path
*>iDest:7.7.7.7/32/48 10.1.13.1                     100      0 i
*> Dest:8.8.8.8/32/48 10.1.13.1                              0 i

Processed 2 prefixes, 2 paths
RP/0/RP0/CPU0:MXC.TAC.L.08-8201-01#show bgp ipv4 flowspec  Dest:7.7.7.7/32/48 $
Mon Aug 30 05:00:44.529 UTC
BGP routing table entry for Dest:7.7.7.7/32/48
NLRI in Hex: 012007070707/48
Versions:
  Process           bRIB/RIB  SendTblVer
  Speaker                 16          16
    Flags: 0x00001001+0x00000000;
Last Modified: Aug 30 04:23:30.743 for 00:37:13
Paths: (1 available, best #1)
  Advertised to peers (in unique update groups):
    10.1.34.3
  Path #1: Received by speaker 0
  Flags: 0x2000000001060205, import: 0x20
  Advertised to peers (in unique update groups):
    10.1.34.3
  Local, (Received from a RR-client)
    10.1.13.1 from 10.70.79.197 (10.70.79.197), if-handle 0x00000000
      Origin IGP, localpref 100, valid, internal, best, group-best
      Received Path ID 0, Local Path ID 1, version 16
      Extended community: FLOWSPEC Redirect-IP:0
RP/0/RP0/CPU0:MXC.TAC.L.08-8201-01#show bgp ipv4 flowspec summary
<Snip>
Neighbor        Spk    AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down  St/PfxRcd
10.1.34.3         0   100    1388    1407       16    0    0 02:59:21          0
10.70.79.197      0   100      68      63       16    0    0 00:37:29          1

BGP FS Client.
#

配置示例:

//Install all rules on all interface
RP/0/RSP0/CPU0:MXC.TAC.L.08-ASR9901-01#show run flowspec
Mon Aug 30 05:09:28.007 UTC
flowspec
 local-install interface-all
 address-family ipv4
  local-install interface-all
 !
!

RP/0/RSP0/CPU0:MXC.TAC.L.08-ASR9901-01#show run router bgp
Mon Aug 30 05:09:32.514 UTC
router bgp 100
 bgp router-id 10.1.3.3
 address-family ipv4 flowspec
 !
 neighbor-group ibgp-flowspec
  remote-as 100
  address-family ipv4 flowspec
  !
 !
 neighbor 10.1.34.4
  use neighbor-group ibgp-flowspec
 !
!

RP/0/RSP0/CPU0:MXC.TAC.L.08-ASR9901-01#

Some command:
#

RP/0/RSP0/CPU0:MXC.TAC.L.08-ASR9901-01#show policy-map transient targets type pbr
Mon Aug 30 05:50:22.536 UTC
1) Policymap: __bgpfs_default_IPv4    Type: pbr
     Targets (applied as main policy):
       TenGigE0/0/0/14.2500 input
       TenGigE0/0/0/14 input
       HundredGigE0/0/0/20 input
       TenGigE0/0/0/14.101 input
       TenGigE0/0/0/8 input
     Total targets: 5

RP/0/RSP0/CPU0:MXC.TAC.L.08-ASR9901-01#
RP/0/RSP0/CPU0:MXC.TAC.L.08-ASR9901-01#show policy-map transient type pbr pmap-name
% Incomplete command.
RP/0/RSP0/CPU0:MXC.TAC.L.08-ASR9901-01#show policy-map transient type pbr pmap-name __bgpfs_default_IPv4
Mon Aug 30 05:50:53.493 UTC
policy-map type pbr __bgpfs_default_IPv4
 handle:0x36000002
 table description: L3 IPv4 and IPv6
 class handle:0x76000004  sequence 512
   match destination-address ipv4 7.7.7.7 255.255.255.255
  redirect ipv4 nexthop 10.1.13.1
 !
 class handle:0x76000003  sequence 1024
   match destination-address ipv4 8.8.8.8 255.255.255.255
  redirect ipv4 nexthop 10.1.13.1
 !
 class handle:0x76000005  sequence 2048
   match destination-address ipv4 25.1.102.1 255.255.255.255
   match protocol udp
   match packet length 500-1550
  police rate 1000000000 bps
   conform-action transmit
   exceed-action drop
  !
 !
 class handle:0xf6000002  sequence 4294967295 (class-default)
 !
 end-policy-map
!
RP/0/RSP0/CPU0:MXC.TAC.L.08-ASR9901-01#show bgp ipv4 flowspec
Mon Aug 30 05:53:20.122 UTC
BGP router identifier 10.1.3.3, local AS number 100
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0x0   RD version: 9
BGP main routing table version 9
BGP NSR Initial initsync version 1 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*>iDest:7.7.7.7/32/48 10.1.13.1                     100      0 i
*>iDest:8.8.8.8/32/48 10.1.13.1                     100      0 i
*>iDest:25.1.102.1/32,Proto:=17,Length:>=500&<=1550/128
                      0.0.0.0                       100      0 i

Processed 3 prefixes, 3 paths
RP/0/RSP0/CPU0:MXC.TAC.L.08-ASR9901-01#show bgp ipv4 flowspec  Dest:25.1.102.1/32,Proto:=17,Length:>=500&<=1550/128 detail
Mon Aug 30 05:53:26.663 UTC
BGP routing table entry for Dest:25.1.102.1/32,Proto:=17,Length:>=500&<=1550/128
NLRI in Hex: 0120190166010381110a1301f4d5060e/128
Versions:
  Process           bRIB/RIB  SendTblVer
  Speaker                  9           9
    Flags: 0x00001001+0x00000000;
Last Modified: Aug 30 05:14:11.832 for 00:39:15
Paths: (1 available, best #1)
  Not advertised to any peer
  Path #1: Received by speaker 0
  Flags: 0x4000000001060005, import: 0x20
  Not advertised to any peer
  Local
    0.0.0.0 from 10.1.34.4 (10.1.4.4), if-handle 0x00000000
      Origin IGP, localpref 100, valid, internal, best, group-best
      Received Path ID 0, Local Path ID 1, version 9
      Extended community: FLOWSPEC Traffic-rate:100,125000000
RP/0/RSP0/CPU0:MXC.TAC.L.08-ASR9901-01#
RP/0/RSP0/CPU0:MXC.TAC.L.08-ASR9901-01#show flowspec afi-all detail
Mon Aug 30 05:53:43.848 UTC

AFI: IPv4
  Flow           :Dest:7.7.7.7/32
    Actions      :Nexthop: 10.1.13.1  (bgp.1)
    Statistics                        (packets/bytes)
      Matched             :                   0/0
      Dropped             :                   0/0
  Flow           :Dest:8.8.8.8/32
    Actions      :Nexthop: 10.1.13.1  (bgp.1)
    Statistics                        (packets/bytes)
      Matched             :                2000/236000
      Dropped             :                   0/0
  Flow           :Dest:25.1.102.1/32,Proto:=17,Length:>=500&<=1550
    Actions      :Traffic-rate: 1000000000 bps  (bgp.1)
    Statistics                        (packets/bytes)
      Matched             :                   0/0
      Dropped             :                   0/0
RP/0/RSP0/CPU0:MXC.TAC.L.08-ASR9901-01#

#show flowspec vrf all ipv4 detail
#show flowspec vrf all afi-all summary internal
#show flowspec vrf all afi-all  internal
#show bgp ipv4 flowspec
#show bgp ipv4 flowspec neighbors x.x.x.x received routes

- debug flowspec all
- show flowspec trace manager event error
- show flowspec trace client event error
- show flowspec client internal
- show logging | inc FLOW
- show flowspec vrf all afi-all summary internal
- show flowspec vrf all afi-all internal
- show tech flowspec

参考:

BRKSPG-3012

BGP FS controller #

Router #

Server #

BGP FS Client. #

Some command: #

BGP FS controller
#

Router
#

Server
#

BGP FS Client.
#

Some command:
#