Please read the NIST disclaimer regarding the software of this project, the information it provides and the other resources it uses. In particular note that these software prototypes are expressly provided "as is" and are intended for research and development purposes only.
SRx is an open source reference implementation and research platform for investigating emerging BGP security extensions and supporting protocols such as RPKI Origin Validation and BGPSec Path Validation.
The current release includes:
For those wanting an easy way to experiment with BGP-SRx, we provide the BRITE system (See Test and Debug section below). For more information see out video about Quagga SRx and BRITE.
BGP-SRx has three parts:
BGP-SRx is designed in such to minimize the dependencies on and the impact to specific router implementations. As a result much functionality is provided by the stand alone SRx server module. The prototype is also designed to support experimentation with various deployment architectures. As a result the SRx module can run on the router, the validating cache, or on a complete separate platform.
Test and Debug
You can use BRITE to run BGP-SRx (or any other implementation) through a series of test scripts that exercise numerous interesting scenarios for BGP ROA processing under different policy assumptions.
To facilitate test and evaluation of BGP-SRx (or any other BGP secutiry implementation) we have developed the BRITE (BGPSEC / RPKI Interoperability Test & Evaluation) system. Brite is available at http://brite.antd.nist.gov/
You can use the BRITE on-line test system to put BGP-SRx (or any other implementation) through a series of test scripts that exercise numerous interesting scenarios for BGP ROA processing under different policy assumptions.
QuaggaSRx - BGPSec Path Validation
Within the previous version, all crypto processing was performed by QuaggaSRx using the SRxCryptoAPI
The current implementation still needs work. We updated the code to use the IANA assigned values for capability and BGPsec_PATH attribute. To be backwards compatible with other implementations if is possilbe to pass other values during the configuration stage to QuaggaSRx and BGPSEC-IP. Please see the ChangeLog for more informationon that.
Router diagnostic commands have been extended to display basic BGPSEC information, such as:
bgpd# show ip bgp 10.40.0.0/16 BGP routing table entry for 10.40.0.0/16 Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer 2030 40 SRx Information: Update ID: 0.09A2630D Validation: prefix-origin: valid path: valid bgpsec: valid (combination of prefix-origin and path validation) PathType: BGPSEC-Path ( 1 signature blocks, each with 2 path segments) signature block #1: algorithm suite id 1 path segment 1: as=2030; pcount=1 signature segment : block 1, ski=97E8EEC56E7C8AE22866D218B0E4D40416EC4EFA path segment 2: as=40; pcount=1 signature segment : block 1, ski=A509AE9ED377CC31AED01E820670DF9CC781DA9F 10.0.1.2 from 10.0.1.2 (10.0.1.2) Origin IGP, localpref 100, valid, external, best Last Update: Wed Mar 5 20:42:37 2014
For quesitions or comments regarding this software please contact email@example.com..
The BGP-SRx Software Suite is developed and tested using CentOS 6 and CentOS 7 systems. All binaries provided are compiled on this system as well. This does not mean we endorse CentOS over any other linux distribution, it just means we did not test the BGP-SRx Software Suite on any other system.
Package BGPSRX500: SRx Software Suite Version 5.0.0. This software package is developed and tested on CentOS 6 and CentOS 7. .
Package BUNDLE22040202: A Bundle of all software and documentation for origin validation.The downloads below are a'La Carte.
Package BUNDLE22040103: A Bundle of all software and documentation for origin validation.The downloads below are a'La Carte.
Package BUNDLE22000301: This Bundle contains QuaggaSRx V0.3.1.0 and SRx-server V0.3.0.4 with all software and documentation - newer version available-
Package BUNDLE22000300: This Bundle contains QuaggaSRx V0.3.0.1 and SRx-server V0.3.0.1 with all software and documentation - newer version available-
Package BUNDLE16000300: ABundle of all software and documentation based on Quagga 0.99.16 - deprecated -
This software and test tools were developed by the Advanced Network Technologies Division (ANTD) at the National Institute of Standards and Technology (NIST) as part of the collaborative effort between NIST and The Department of Homeland Security, Science and Technology Directorate's Secure Protocols for the Routing Infrastructure Project.
For inquiries regarding this project, contact