Source Address Validation in Intra-domain Networks (Intra-domain SAVNET) Gap Analysis, Problem Statement and Requirements

Source Address Validation (SAV) is important for defending against source address spoofing attacks and accurately tracing back to the attackers. To be as effective as possible, SAV should be implemented as close to the source as possible. Given numerous access networks managed by different operators, it is difficult to require all access networks to deploy SAV at the source (e.g., SAVI). When some access networks do not deploy SAV, intra-domain SAV helps filter out spoofed packets as close to the source as possible. Ingress filtering is the current practice of intra-domain SAV. Figure 1 shows the typical adoption scenario of ingress filtering. It is typically deployed at the edge router connected to a subnet to block spoofed traffic from the subnet. A subnet refers to a user network attached to the edge router.

Static Access Control List (ACL) is a typical implementation of ingress filtering. Operators can configure some matching rules to specify which source addresses are acceptable (or unacceptable). The information of ACL should be updated manually so as to keep consistent with the newest filtering criteria, which inevitably limits the flexibility and accuracy of SAV. Strict unicast Reverse Path Forwarding (uRPF) is another suitable solution to achieve ingress filtering in intra-domain networks. Routers deploying strict uRPF accept a data packet only when i) the local forwarding information base (FIB) contains a prefix encompassing the packet's source address and ii) the corresponding forwarding next hop for the prefix matches the packet's incoming direction. Otherwise, the packet will be blocked. However, in the scenario where data packets are under asymmetric routing, strict uRPF often improperly blocks legitimate traffic. Feasible uRPF and loose uRPF are two other alternative implementations of ingress filtering, but their filtering rules are very loose and generally permit all (spoofed) packets with source addresses in the local FIB. Therefore, a new intra-domain SAV mechanism is required to improve accuracy upon current ones. This document provides the gap analysis of existing intra-domain SAV mechanisms, describes their fundamental problems, and defines the requirements for improvements.

SAV: Source Address Validation, i.e. validating the authenticity of a packet's source IP address. SAV rule: The rule generated by intra-domain SAV mechanisms that determines valid incoming interfaces for a specific source prefix. SAV table: The data structure that stores SAV rules on the data plane. The router queries its local SAV table to validate the authenticity of source addresses. Improper block: The packets with legitimate source IP addresses are blocked improperly due to inaccurate SAV rules. Improper permit: The packets with spoofed source IP addresses are permitted improperly due to inaccurate SAV rules.

Existing intra-domain SAV mechanisms can improperly block traffic with legitimate source addresses due to their technical limitations. For example, figure 2 illustrates an intra-domain scenario of multi-homed subnet. In this scenario, Subnet 1 is attached to two edge routers, i.e. Router 1 and Router 2. Although Subnet 1 owns prefix 10.0.0.0/15, Subnet 1 expects traffic destined for 10.1.0.0/16 to come only from Router 1 and traffic destined for 10.0.0.0/16 to come only from Router 2, for traffic engineering or load balance purposes. To this end, Router 1 only learns the route to sub prefix 10.1.0.0/16 from Subnet 1, while Router 2 only learns the route to the other sub prefix 10.0.0.0/16 from Subnet 1. Then, Router 1 and Router 2 advertise the learned sub prefix to other routers in the AS through intra-domain routing protocols such as OSPF or IS-IS. Finally, Router 1 learns the route to 10.0.0.0/16 from Router 5, and Router 2 learns the route to 10.1.0.0/16 from Router 5. Although Subnet 1 only expects incoming traffic destined for 10.0.0.0/16 to come from Router 2, it still sends outgoing traffic with source addresses of prefix 10.0.0.0/16 to Router 1, resulting in routing asymmetry.

If Router 1 applies strict uRPF at interface '#', the SAV rule is that Router 1 only accepts packets with source addresses of 10.1.0.0/16 from Subnet 1. Therefore, when Subnet 1 sends packets with source addresses of 10.0.0.0/16 to Router 1, strict uRPF at Router 1 will improperly block these legitimate packets. Similarly, when Router 2 with strict uRPF deployed receives packets with source addresses of prefix 10.1.0.0/16 from Subnet 1, it will also improperly block these legitimate packets. If Router 1 and 2 apply ACL-based ingress filtering at interfaces '#', it requires manual update given prefix or topology update in Subnet 1. Once the network operator does not update the ACL in time, resulting in the ACL status is inconsistent with the routing status, it will cause improper block problems as well. Overall, strict uRPF has serious improper block problem in the case of routing asymmetry, and ACL-based SAV needs high operational overhead in dynamic networks.

As shown in Figure 1, ingress filtering is typically deployed at the edge router connected to a subnet and only works for outbound traffic (traffic originated from the subnet to other networks) but does not work for inbound traffic (traffic originated from other networks to the subnet). It prevents subnets from originating spoofed-source traffic, but does not protect subnets from receiving spoofed-source traffic.

Figure 3 shows a scenario of source address spoofing from outside AS. Although the AS has applied ingress filtering at all edge routers, the spoofed traffic (even with forged intra-domain source addresses) can easily enter from inbound direction due to the lack of inbound SAV.

Router 6 | | | +----------+ +----------+ | | / \ \ | | / \ \/ | | \/ \/ +----------+ | | +----------+ +----------+ | Router 4 | | | | Router 1 | | Router 2 | +--------#-+ | | +------#---+ +--#-------+ / | | | \ / \/ \/ | | \ / +----------+ Subnet3(p3) | | \ / | Router 3 | | | \/ \/ +-----#----+ | | Subnet1(p1) | | | \/ | | Subnet2(p2) | +-------------------------------------------------------------+ Spoofed traffic can easily enter subnets from inbound direction without being detected by ingress filtering Figure 3: Spoofing from outside AS. ]]>

In practice, it is often a challenge to apply intra-domain SAV to all edge routers. For example, the improper block problem described in Section 3.1 prevents ingress filtering from being implemented in some multi-homed scenarios. In addition, there are also some routers that cannot support SAV due to their capabilities, versions, and vendors. However, when ingress filtering is partially deployed, the effectiveness of existing intra-domain SAV will be significantly degraded.

Router 6 | | | +----------+ +----------+ | | / /\ \ | | / \ \/ | | / \ +----------+ | | +----------+ +----------+ | Router 4 | | | | Router 1 | | Router 2 | +--------#-+ | | +----------+ +----------+ / | | | \ /\ / \/ | | \ / forged +----------+ Subnet3(p3) | | \ / request | Router 3 | | | | \ / +-----#----+ + | | Subnet1(p1) | Reflector | | | | | | + Subnet2(p2)-+Victim | | Attacker(spoof p2) | +-------------------------------------------------------------+ Partial deployment scenario: - Router 3 and 4 deploy ingress filtering - Router 1 and 2 do not deploy ingress filtering Figure 4: Reflection attack in a partial deployment scenario. ]]> Figure 4 describes a reflection attack in a partial deployment scenario. Router 1, 2, 3, and 4 are edge routers, each connected to a subnet. Router 5 and 6 are two core routers that are responsible for transmitting traffic. Assume only Router 3 and 4 apply ingress filtering at subnet interfaces, while Router 1 and 2 do not apply ingress filtering. In this case, although Subnet 2 and Subnet 3 cannot originate spoofed-source traffic, they may receive spoofed-source traffic or being the victim of attacks from Subnet 1. In Figure 4, to conduct a reflection attack to the victim in Subnet 2, the attacker in Subnet 1 sends a forged request with victim's source address to the reflector. Since Router 2 does not apply ingress filtering, the forged request will successfully enter the intra-domain network. The forged request cannot be identified and rejected by Router 5, Router 6, and Router 4. In the end, the reflector will receive the forged request and generate a large number of responses to the victim, and the reflection attack succeeds.

This section summarizes the fundamental problems existing in current intra-domain SAV from the above gap analysis. The inaccurate validation, limited protection, and high operational overhead are three main factors that hinder the deployment and compromise the effectiveness of intra-domain SAV.

ACL-based ingress filtering needs manual configuration and thus faces limitations in flexibility and accuracy in dynamic networks. Strict uRPF-based ingress filtering automatically generates SAV tables, but may improperly block legitimate traffic under asymmetric routing. The root cause is that strict uRPF leverages the local FIB table to determine the incoming interface for source addresses, which may not match the real data-plane forwarding path from the source, due to the existence of asymmetric routes. Hence, it may mistakenly consider a valid incoming interface as invalid, resulting in improper block problems; or consider an invalid incoming interface as valid, resulting in improper permit problems.

Currently, ingress filtering is applied at edge routers and only works for traffic from directly connected subnets, resulting in the inability to block spoofed traffic from inbound direction. Therefore, spoofed traffic with intra-domain source addresses can easily flow to any subnet from outside AS or non-deploying edge routers (when intra-domain SAV is partially deployed).

Since existing intra-domain SAV mechanisms fail to adapt to dynamic or asymmetric routing scenarios, if network operators want to apply intra-domain SAV and avoid improper block , they has to figure out which edge routers have asymmetric routing to the directly connected subnet, and implement ACL-based SAV at those edge routers instead of strict uRPF. In addition, they have to manually update the ACL filtering rules in time when the subnet's prefix or topology changes. Both identifying asymmetric routes and manual update impose significant operational overhead on network operators.

To make improvements to existing intra-domain SAV mechanisms, a new intra-domain SAV mechanism MUST satisfy the following requirements.

The new intra-domain SAV mechanism MUST improve the accuracy upon existing intra-domain SAV mechanisms. To achieve more accurate validation than strict uRPF, it MUST avoid improper block problems under asymmetric routing. Meanwhile, it MUST have as few improper permit problems as possible than loose uRPF. Routers MUST be able to learn the real incoming interfaces for packets originated from the subnet which owns the corresponding source prefix. In other words, accurate SAV MUST match the real data-plane forwarding path from the source. Since this requirement cannot be met by using local FIB information, additional mechanisms are needed to deliver the required information for accurate SAV.

The new intra-domain SAV mechanism MUST work for traffic coming from all directions (i.e. for traffic coming from both subnet and neighboring router). To block spoofed traffic from outside the AS and from non-deploying edge routers as close to the source as possible, it MUST be deployed in more routers than just the edge routers. Especially, when partially deployed, it SHOULD be able to limit the malicious behavior of non-deploying subnets to some extent. At least, to prevent intra-domain reflection attacks, it should prevent non-deploying subnets from forging source addresses of deployed subnets.

The new intra-domain SAV mechanism MUST be able to automatically update and adapt to dynamic or asymmetric routing scenarios, instead of relying entirely on manual update. At least, it MUST induce lower operational overhead than ACL-based SAV. In addition, the new SAV mechanism MUST avoid data-plane packet modification. Existing architectures or protocols or mechanisms can be used in the new SAV mechanism to achieve better SAV function.

The new intra-domain SAV mechanism should work in the same scenarios as existing intra-domain SAV mechanisms. Generally, it includes all IP-encapsulated scenarios: Native IP forwarding: including both global routing table forwarding and CE site forwarding of VPN; IP-encapsulated Tunnel (IPsec, GRE, SRv6, etc.): focusing on the validation of the outer layer IP address; Both IPv4 and IPv6 addresses Scope does not include: Non-IP packets: including MPLS label-based forwarding and other non-IP-based forwarding.

The new intra-domain SAV mechanism MUST not introduce additional security vulnerabilities or confusion to the existing intra-domain architectures or control or management plane protocols. Similar to the security scope of intra-domain routing protocols, intra-domain SAVNET should ensure integrity and authentication of protocol packets that deliver the required SAV information. The new intra-domain SAV mechanism does not provide protection against compromised or misconfigured routers that poison existing control plane protocols. Such routers can not only disrupt the SAV function, but also affect the entire routing domain.

This document does not request any IANA allocations.