...

"org.onosproject.artemis" : {
	"artemis" : {
    	"prefixes" : [ 
        	{
            	"prefix" : "40.0.0.0/8",
                "paths" : [ 
                	{
                    	"origin" : 65004,
                        "neighbor" : [
                        	{
                            	"asn" : 65002,
                                "neighbor": [ 65001 ]
                            }
                        ]
                    }
                ],
                "moas" : [ ]
            }
        ],
        "frequency" : 3000,
        "monitors" : {
        	"ripe" : [ ],
        	"exabgp": [ "192.168.1.2:5000" ]
        }
    }
}

...

• AS65001
  Intermediate AS that consists of a BGP Speaker (R1), a L2 switch, a host (H1) and an ExaBGP Route Collector.

• R1: Announces 10.0.0.0/8 and is neighbor with AS65003 and AS65002. Also, has the exaBGP RC as an iBGP neighbor to propagate the BGP Update messages to it.

• ExaBGP RC: Connected to R1 but also to the ONOS Controller on the protected AS (in real world this connection is done through the underlaying network).

• H1 / 10.0.0.100: Host which is going to be communicating with the host inside the protected AS. It is going to provide us a visualization of the data-plane behavior when the BGP Hijack occurs.

• AS65002
  IntermediateIntermediate AS that consists of a BGP Speaker that announces 20.0.0.0/8 and its purpose is to add an additional hop to the AS-path so the protected AS is hijackable.
  
  

• AS65003
  Hijackers AS that consists of a BGP Speaker (R3).

• R3:Announcing from this BGP Speaker the prefix of the protected AS (40.0.0.0/8) will cause a BGP hijack and all trafic generated from AS65001 will be redirected to the network of AS65003.
  
  

• AS65004
  Protected AS that is running ONOS. It consists of a BGP Speaker, an OVS switch, a Host and the ONOS instance.

• R4: Bgp Speaker announcing 40.0.0.0/8. It is connected with his neighbor through the OVS switch which is configured by the sdn-ip application to talk with the BGP speaker of AS65002.

• OVS: Talks with ONOS on a management interface in 192.168.0.0/24 subnet.

• ONOS: ONOS is connected with the BGP speaker to retrieve the BGP routing table. Also, it receives the BGP Update messages from the ExaBGP router and has a link with the OVS to send the flow rules and receive the packet ins.

• H4 / 40.0.0.100: Host that receives traffic with the help of the reactive-routing application from the host in AS65001.

Running the Demo

...

Install ExaBGP by doing these steps: 

 

 

...

Code Block
theme Midnight language bash
$ cd ~ $ git clone https://github.com/Exa-Networks/exabgp $ cd exabgp; git checkout 3.4 $ echo 'export PATH=$PATH:~/exabgp/sbin' >> ~/.bashrc $ source ~/.bashrc

 

Install Quagga suite through apt-get:

...

Download and install mininet: 

Code Block
theme Midnight language bash
$ cd ~ $ git clone https://github.com/mininet/mininet $ cd mininet; git checkout 2.2.2 $ ./util/install.sh -fnv

Install java 8 (needed by ONOS next): 

Code Block
theme Midnight language bash
$ sudo apt-get install software-properties-common -y $ sudo add-apt-repository ppa:webupd8team/java -y $ sudo apt-get update $ echo "oracle-java8-installer shared/accepted-oracle-license-v1-1 $ select true" | sudo debconf-set-selections && \ $ sudo apt-get install oracle-java8-installer oracle-java8-set-default -y

...

Install pip3, python packages and fix the configuration used by ExaBGP: 

Code Block
theme Midnight language bash
$ sudo apt-get install python3-pip -y $ sudo pip3 install -r ~/onos/tools/tutorials/artemis/requirements.txt $ nano ~/onos/tools/tutorials/artemis/configs/exabgp.conf (you must put the absolute path at run command, e.g., /home/onos/onos/tools/tutorials/artemis/server.py)

Run ONOS (first time will take some time):

 

Code Block
theme Midnight language bash
$ buck run onos-local -- clean

When ONOS is loaded run the mininet topology:

 

Code Block
theme Midnight language bash
$ cd /onos/tools/tutorials/artemis $ sudo ./topo.py

## NOTENote: You should disable networking in order to avoid interfaces swapping IP addresses!
Pass the network configuration with onos-netcfg and login to the onos CLI 

Code Block
theme Midnight language bash
$ onos-netcfg localhost ~/onos/tools/tutorials/artemis/configs/network-cfg.json $ onos localhost

Run artemis inside CLI:

 

Code Block
theme Midnight language bash
onos> app activate org.onosproject.reactive-routing onos> app activate org.onosproject.artemis

Check if bgp-routes are completed (should include 10.0.0.0/8, 20.0.0.0/8, 30.0.0.0/8 and 40.0.0.0/8; if not you should restart the topology. It takes some time (~1-2min)): 

Code Block
theme Midnight language bash
ONOS> bgp-routes

Now that the topology is running; through the mininet CLI you can connect to the hosts to check connectivity and also to the BGP speakers. To hijack the prefix of our protected AS:

...

1. Connect to BGP speaker named R3:

...

 

Code Block
theme Midnight language bash
mininet> xterm R3 (opens a new window on R3 node) R3> telnet localhost bgpd

2. And announce Announce the prefix: 

Code Block
theme Midnight language bash
$R3> sudo apt-get install quagga -y

...

sdnip (this is the password)

...

 

R3> enable

...

 

R3# configuration terminal

...

 

R3(conf)# router bgp 65003

...

 

R3(conf-bgp)# network 40.0.0.0/8

Now the hijacker with attract all the traffic from AS65001 but in parallel the ExaBGP speaker will send the BGP update of the hijack to the ONOS instance which is going to detect the hijack. Inside the logs you will see that the attack is detected and the deaggregation mechanism has successfully defended the attack. After the BGP converges the traffic of AS65001 returns to our protected AS. 

Demo video

...