graffen
/
ix-bird-config
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Got ROA filtering etc. under control

This commit is contained in:
graffen 2018-11-11 19:23:42 +00:00
parent d536cb2f79
commit 8c8d48733f
7 changed files with 34 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
bgp4.conf
View File

@ -3,12 +3,13 @@ template bgp dn42peer {
table T_BGP; table T_BGP;
path metric 1; path metric 1;
import keep filtered; import keep filtered;
import where dn42peer_import_policy(); import filter {
print "WARNING!! no community import filter set, all routes will be rejected";
reject;
};
export filter { export filter {
if is_valid_network() then { print "WARNING!! no community import filter set, all routes will be rejected";
accept; reject;
}
reject;
}; };
}; };

15
bgp6.conf
View File

@ -3,13 +3,14 @@ template bgp dn42peer {
table T_BGP; table T_BGP;
path metric 1; path metric 1;
import keep filtered on; import keep filtered on;
import where dn42peer_import_policy(); import filter {
export filter { print "WARNING!! no community import filter set, all routes will be rejected";
if is_valid_network() then { reject;
accept; };
} export filter {
reject; print "WARNING!! no community import filter set, all routes will be rejected";
}; reject;
};
}; };
template bgp ibgppeer { template bgp ibgppeer {

5
bird.conf
View File

@ -1,5 +1,10 @@
log "/var/log/bird.log" { debug, trace, info, remote, warning, error, auth, fatal, bug }; log "/var/log/bird.log" { debug, trace, info, remote, warning, error, auth, fatal, bug };
timeformat base iso long;
timeformat log iso long;
timeformat protocol iso long;
timeformat route iso long;
table T_BGP; table T_BGP;
table T_OSPF; table T_OSPF;

5
bird6.conf
View File

@ -1,5 +1,10 @@
log "/var/log/bird6.log" { debug, trace, info, remote, warning, error, auth, fatal, bug }; log "/var/log/bird6.log" { debug, trace, info, remote, warning, error, auth, fatal, bug };
timeformat base iso long;
timeformat log iso long;
timeformat protocol iso long;
timeformat route iso long;
table T_BGP; table T_BGP;
table T_OSPF; table T_OSPF;

5
community_filters.conf
View File

@ -50,6 +50,11 @@ int dn42_crypto;
# which means, these must included before this file # which means, these must included before this file
function dn42_import_filter(int link_latency; int link_bandwidth; int link_crypto) { function dn42_import_filter(int link_latency; int link_bandwidth; int link_crypto) {
if (roa_check(dn42_roa, net, bgp_path.last) = ROA_INVALID) then {
print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
reject;
}
if is_valid_network() && !is_self_net() then { if is_valid_network() && !is_self_net() then {
update_flags(link_latency, link_bandwidth, link_crypto); update_flags(link_latency, link_bandwidth, link_crypto);
accept; accept;

20
filter4.conf
View File

@ -18,23 +18,3 @@ function is_valid_network() {
roa table dn42_roa { roa table dn42_roa {
include "/var/lib/bird/bird_roa_dn42.conf"; include "/var/lib/bird/bird_roa_dn42.conf";
}; };
function check_roa() {
if (roa_check(dn42_roa, net, bgp_path.last) = ROA_INVALID) then {
print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
return false;
}
return true;
}
function import_filter_networks() {
if is_valid_network() && !is_self_net() then {
return true;
}
return false;
}
function dn42peer_import_policy() {
if(!check_roa()) then return false;
if(!import_filter_networks()) then return false;
}

7
filter6.conf
View File

@ -28,6 +28,9 @@ function import_filter_networks() {
} }
function dn42peer_import_policy() { function dn42peer_import_policy() {
if(!check_roa()) then return false; if (roa_check(dn42_roa, net, bgp_path.last) = ROA_INVALID) then {
print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
reject;
}
if(!import_filter_networks()) then return false; if(!import_filter_networks()) then return false;
} }