Securing Internet Routing with BGP Roles and Only-to-Customer (OTC) Attributes
This article discusses RFC 9234, a critical enhancement to the Border Gateway Protocol (BGP) that aims to prevent route leaks by introducing BGP Roles and the Only-to-Customer (OTC) path attribute. It explains how these features help enforce intended routing policies, shifting the burden from manual operator configuration to automated protocol-level enforcement, thereby improving the stability and security of global internet routing.
Read original on Cloudflare BlogRoute leaks in the Border Gateway Protocol (BGP) are a significant threat to Internet stability, causing traffic misdirection and impacting network performance. Historically, preventing these leaks has relied on complex, error-prone manual routing policies configured by individual Autonomous Systems (ASes). RFC 9234 introduces a protocol-level solution to this challenge, enhancing BGP with mechanisms to express and enforce routing intent more reliably.
Understanding BGP Route Leaks
A BGP route leak occurs when routing announcements propagate beyond their intended scope, typically violating the "valley-free" property of AS relationships. This property dictates that a route learned from a provider or peer should only be announced to customers, not back up to another provider or sideways to another peer. A common example is a customer announcing a route between two of its providers (a "hairpin turn"), which can overload the customer's network and disrupt traffic flow for the entire Internet.
Why Route Leaks are Problematic
Route leaks lead to inefficient traffic paths, increased latency, packet loss, and potential network outages. They can also be exploited for malicious purposes, such as traffic interception or denial-of-service attacks. The distributed nature of BGP makes detection and mitigation challenging without standardized protocol-level enforcement.
RFC 9234: BGP Roles and OTC Attribute
RFC 9234 addresses route leaks through two main mechanisms:
- BGP Roles: This capability requires BGP neighbors to declare their relationship (e.g., Provider, Customer, Peer, RS, RS-Client) during session establishment. This formalizes routing intent and allows routers to reject sessions where there's a disagreement about the relationship, preventing misconfigurations that could lead to leaks.
- Only-to-Customer (OTC) Attribute: An optional transitive path attribute that marks routes that should only propagate to customers. Once set, if a router receives an OTC-carrying route from a provider or peer, or attempts to announce one to a provider or peer, it's identified as a leak and rejected. This provides an automated, in-band validation mechanism.
How OTC Prevents Leaks
The OTC attribute works by marking the "peak" of a route's path, after which it may only travel downwards to customer ASes. If a route with an OTC attribute attempts to travel upwards (to a provider) or sideways (to a peer), a compliant router will detect and reject it. This significantly reduces the reliance on manually configured prefix filters and intricate policies, making route leak prevention more robust and scalable.
Cloudflare's analysis of RFC 9234 adoption highlights the challenges of partial deployment and the issue of some Tier-1 networks stripping the OTC attribute, which undermines the collective effort to secure internet routing. Widespread and correct implementation of RFC 9234 is crucial for improving the overall resilience and security of the global BGP routing system.