BGP 路由安全#

# 安装 RPKI 验证软件（使用 rpki-client）
pkg install rpki-client

# 或者使用 Routinator（更易用）
docker run -d --name routinator \
  -p 8080:8080 \
  -v routinator-data:/data \
  nlnetlabs/routinator \
  routinator daemon \
  --http 0.0.0.0:8080 \
  --export-sqlite /data/routinator.sqlite

# 通过 RIR/NIR 的管理门户创建 ROA
# 以下是通过 Bird 进行 RPKI 配置的示例

# /etc/bird/rpki.conf
rpki {
    # RPKI 验证服务器
    roa4 {
        table "rpki";
        remote "192.0.2.1" port 323;
    };
    roa6 {
        table "rpki";
        remote "2001:db8::1" port 323;
    };
}

# 启用 RPKI 验证
protocol rpki "rpki" {
    remote "rpki-validator.example.com" port 323;
    
    # 连接配置
    retry_interval 600;
    refresh_interval 3600;
    expire_interval 7200;
}

# Bird 路由策略配置
# /etc/bird/bird.conf

filter rpki_filter {
    # 获取 ROA 验证结果
    if rpki_invalid() then {
        # 拒绝 RPKI 无效的路由
        # 或者降级处理
        # reject;
        
        # 降级：降低优先级但不拒绝
        bgp_path.prepend(65500);
    }
}

# 应用到 BGP 对等连接
protocol bgp Peering {
    neighbor as 64499;
    table master;
    
    import filter {
        # 应用 RPKI 过滤
        if ! rpki_valid() then {
            # 不接受 RPKI 验证失败的路由
            reject;
        }
        accept;
    };
    
    export where proto = "kernel";
}

# 使用 bgpstream 或 peval 工具验证路由来源
peval --irr-check --asn 64499 192.0.2.0/24

# 输出示例
# ASN in Route:      64499
# ASN in IRR:        64499
# Prefix in IRR:     192.0.2.0/24
# Source:            RIPE
# Route Origin:      VALID

# 使用 MANRS 提供的工具检查 AS 的合规性
curl -s "https://api.manifold0.com/manrs/v1/asn/AS64499" | jq .

# 输出示例
{
  "asn": "64499",
  "name": "Example Network",
  "type": "ISP",
  "compliance": {
    "action_1": {
      "name": "Preventing route leaks",
      "status": "IMPLEMENTED",
      "details": "RPKI ROA published for 90% of prefixes"
    },
    "action_2": {
      "name": "Preventing path deception",
      "status": "PARTIAL",
      "details": "IRR filters configured"
    },
    "action_3": {
      "name": "Promoting coordination",
      "status": "IMPLEMENTED",
      "details": "Contact info in PeeringDB"
    },
    "action_4": {
      "name": "Promoting filtering",
      "status": "NOT_IMPLEMENTED",
      "details": "Customer route filters not configured"
    }
  },
  "overall_score": 75
}

# 企业需要向 RIR/NIR 申请并发布 ROA
# 1. 确定需要宣告的前缀
# 2. 确定宣告的 AS 号
# 3. 创建 ROA 记录

# ROA 示例：企业 AS64499 宣告 198.51.100.0/24
roa create --asn 64499 --prefix 198.51.100.0/24 --max-length 24

#!/bin/bash
# bgp_monitor.sh

# 使用 BGPStream 监控特定前缀
bgpstream read \
    --filter "prefix more 192.0.2.0/24" \
    --collector route-views.linx \
    --collector route-views.eqix \
    --collector route-views.isc | \
while read line; do
    # 解析 BGP 消息
    TIMESTAMP=$(echo $line | jq -r '.timestamp')
    PREFIX=$(echo $line | jq -r '.prefix')
    AS_PATH=$(echo $line | jq -r '.as_path')
    
    # 检测异常
    if echo "$AS_PATH" | grep -q "64499"; then
        # 记录 ROA 验证失败的宣告
        echo "[$(date)] ALERT: Unexpected AS 64499 in path to $PREFIX"
        echo "AS_PATH: $AS_PATH"
        
        # 发送告警
        curl -X POST "https://alerting.example.com/webhook" \
            -d "message=BGP anomaly detected: $PREFIX via $AS_PATH"
    fi
done