graffen/ix-bird-config
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Got ROA filtering etc. under control

Browse source
This commit is contained in:
graffen 2018-11-11 19:23:42 +00:00
parent d536cb2f79
commit 8c8d48733f
7 changed files with 34 additions and 34 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
bgp4.conf
View file

@ -3,12 +3,13 @@ template bgp dn42peer {
table T_BGP;
path metric 1;
import keep filtered;
import where dn42peer_import_policy();
import filter {
print "WARNING!! no community import filter set, all routes will be rejected";
reject;
};
export filter {
if is_valid_network() then {
accept;
}
reject;
print "WARNING!! no community import filter set, all routes will be rejected";
reject;
};
};

15
bgp6.conf
View file

@ -3,13 +3,14 @@ template bgp dn42peer {
table T_BGP;
path metric 1;
import keep filtered on;
import where dn42peer_import_policy();
export filter {
if is_valid_network() then {
accept;
}
reject;
};
import filter {
print "WARNING!! no community import filter set, all routes will be rejected";
reject;
};
export filter {
print "WARNING!! no community import filter set, all routes will be rejected";
reject;
};
};
template bgp ibgppeer {

5
bird.conf
View file

@ -1,5 +1,10 @@
log "/var/log/bird.log" { debug, trace, info, remote, warning, error, auth, fatal, bug };
timeformat base iso long;
timeformat log iso long;
timeformat protocol iso long;
timeformat route iso long;
table T_BGP;
table T_OSPF;

5
bird6.conf
View file

@ -1,5 +1,10 @@
log "/var/log/bird6.log" { debug, trace, info, remote, warning, error, auth, fatal, bug };
timeformat base iso long;
timeformat log iso long;
timeformat protocol iso long;
timeformat route iso long;
table T_BGP;
table T_OSPF;

5
community_filters.conf
View file

@ -50,6 +50,11 @@ int dn42_crypto;
# which means, these must included before this file
function dn42_import_filter(int link_latency; int link_bandwidth; int link_crypto) {
if (roa_check(dn42_roa, net, bgp_path.last) = ROA_INVALID) then {
print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
reject;
}
if is_valid_network() && !is_self_net() then {
update_flags(link_latency, link_bandwidth, link_crypto);
accept;

20
filter4.conf
View file

@ -18,23 +18,3 @@ function is_valid_network() {
roa table dn42_roa {
include "/var/lib/bird/bird_roa_dn42.conf";
};
function check_roa() {
if (roa_check(dn42_roa, net, bgp_path.last) = ROA_INVALID) then {
print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
return false;
}
return true;
}
function import_filter_networks() {
if is_valid_network() && !is_self_net() then {
return true;
}
return false;
}
function dn42peer_import_policy() {
if(!check_roa()) then return false;
if(!import_filter_networks()) then return false;
}

7
filter6.conf
View file

@ -28,6 +28,9 @@ function import_filter_networks() {
}
function dn42peer_import_policy() {
if(!check_roa()) then return false;
if (roa_check(dn42_roa, net, bgp_path.last) = ROA_INVALID) then {
print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
reject;
}
if(!import_filter_networks()) then return false;
}
}