4 ms·

How would that kind of disruption happen? Someone else also anycasting the CF IP addresses?

arghwhat 7y ago
BGP route/prefix leaks. BGP is the protocol that deals with routing across the various internet backbones (known in the protocol as "autonomous systems", identified by an AS number). On that protocol, the various systems broadcast what prefixes they can route, which then affects the rest of the networks' routing decisions. By error or malice, a system can report a prefix they cannot or should not route, causing other systems to start routing traffic across it. This will either just cause weird routes (such as ones going through certain suspicious countries), cause poor performance for those routed, or no connection at all for those routed.
- nikisweeting 7y ago
  At 3-4 major leaks per year it seems like we should probably fix BGP one of these days...
  - purerandomness 7y ago
    The way I understand it it's not BGP, it's mostly human error, or malicious intent. The protocol is fine.
    - arghwhat 7y ago
      Malicious intent could likely be mitigated with cryptography. E.g., publishing a prefix requiring a signature from its owner. Such system would also contain human error to a smaller set of possible faults.
    - nikisweeting 7y ago
      An unauthenticated protocol that allows unsigned routes to be blindly accepted is not a good protocol, that's why Cloudflare has been pushing RPKI for a while https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki-details/ https://blog.cloudflare.com/rpki-details/
      - Hikikomori 7y ago
        It has authentication and requires explicit configuration to form a neighbor relationship. BGP was designed for operators to implement a routing policy. In most implementations it allows everything by default with no modifications to route metadata, so if you do not set up your policy correctly you'll have issues like this.
        nikisweeting 7y ago
        It has authentication for only one hop, if routes propagated all the way up the chain with signatures, it would be much easier to block/limit bad AS behavior.
        Hikikomori 7y ago
        Your peering relationship is only for one hop. What it lacks is prefix/path validation, not authentication.
        nikisweeting 7y ago
        But authentication of every advertised range all the way up the chain would allow upstream providers to easily differentiate valid large prefix announcements that were done intentionally (e.g. big ISP announcing some routes) from crazy nonsense done by an unknown party that isn't a big ISP. We definitely need prefix filtering, but there needs to be some easily verifiable source of identity tied to each announcement to be able to automate the process of accepting and rejecting large prefix announcements.
    - JshWright 7y ago
      No system failure is ever "human error". It's faulty system design.
    - joepie91_ 7y ago
      A protocol that allows "human error" or "malicious intent" to take down entire swathes of the internet due to being entirely unauthenticated, is not "fine". What you are describing is a protocol problem.
  - faded242 7y ago
    We'll get right on that after everyone has IPv6 deployed.
    - nikisweeting 7y ago
      I think the pressure to implement better ROA checking and something like RPKI will be much stronger than the push to IPv6 was if we keep having major route leaks multiple times a year. Eventually some governments will have to get involved...
deleted 7y ago
[deleted]

BGP route/prefix leaks. BGP is the protocol that deals with routing across the various internet backbones (known in the protocol as "autonomous systems", identified by an AS number). On that protocol, the various systems broadcast what prefixes they can route, which then affects the rest of the networks' routing decisions. By error or malice, a system can report a prefix they cannot or should not route, causing other systems to start routing traffic across it. This will either just cause weird routes (such as ones going through certain suspicious countries), cause poor performance for those routed, or no connection at all for those routed.

nikisweeting 7y ago
At 3-4 major leaks per year it seems like we should probably fix BGP one of these days...
- purerandomness 7y ago
  The way I understand it it's not BGP, it's mostly human error, or malicious intent. The protocol is fine.
  - arghwhat 7y ago
    Malicious intent could likely be mitigated with cryptography. E.g., publishing a prefix requiring a signature from its owner. Such system would also contain human error to a smaller set of possible faults.
  - nikisweeting 7y ago
    An unauthenticated protocol that allows unsigned routes to be blindly accepted is not a good protocol, that's why Cloudflare has been pushing RPKI for a while https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki-details/ https://blog.cloudflare.com/rpki-details/
    - Hikikomori 7y ago
      It has authentication and requires explicit configuration to form a neighbor relationship. BGP was designed for operators to implement a routing policy. In most implementations it allows everything by default with no modifications to route metadata, so if you do not set up your policy correctly you'll have issues like this.
      - nikisweeting 7y ago
        It has authentication for only one hop, if routes propagated all the way up the chain with signatures, it would be much easier to block/limit bad AS behavior.
        Hikikomori 7y ago
        Your peering relationship is only for one hop. What it lacks is prefix/path validation, not authentication.
        nikisweeting 7y ago
        But authentication of every advertised range all the way up the chain would allow upstream providers to easily differentiate valid large prefix announcements that were done intentionally (e.g. big ISP announcing some routes) from crazy nonsense done by an unknown party that isn't a big ISP. We definitely need prefix filtering, but there needs to be some easily verifiable source of identity tied to each announcement to be able to automate the process of accepting and rejecting large prefix announcements.
  - JshWright 7y ago
    No system failure is ever "human error". It's faulty system design.
  - joepie91_ 7y ago
    A protocol that allows "human error" or "malicious intent" to take down entire swathes of the internet due to being entirely unauthenticated, is not "fine". What you are describing is a protocol problem.
- faded242 7y ago
  We'll get right on that after everyone has IPv6 deployed.
  - nikisweeting 7y ago
    I think the pressure to implement better ROA checking and something like RPKI will be much stronger than the push to IPv6 was if we keep having major route leaks multiple times a year. Eventually some governments will have to get involved...

deleted 7y ago

[deleted]