summaryrefslogtreecommitdiff
path: root/roles/uvok_bird/templates/clearnet.conf.j2
blob: 9f75798b34d62f51848d4544e858dcaff8a7a793 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
# {{ ansible_managed }}

define CLEARNET_PREFIP = {{ uvok_bird_opts.preferred_ip }};

# trs=transit
ipv6 table t_myas_unfiltered;
ipv6 table t_myas_trs;
ipv6 table t_myas_babel;

roa6 table clear_roa_v6;

protocol rpki roa_clearnet1 {
    roa6 { table clear_roa_v6; };
    remote 10.2.0.1;
    port 8282;
    refresh 3600;
    retry 600;
    expire 7200;
}

protocol rpki roa_clearnet2 {
    roa6 { table clear_roa_v6; };
    remote 10.2.0.10;
    port 8282;
    refresh 3600;
    retry 600;
    expire 7200;
}

define BOGON_ASNS = [
  0,                      # RFC 7607
  23456,                  # RFC 4893 AS_TRANS
  64496..64511,           # RFC 5398 and documentation/example ASNs
  64512..65534,           # RFC 6996 Private ASNs
  65535,                  # RFC 7300 Last 16 bit ASN
  65536..65551,           # RFC 5398 and documentation/example ASNs
  65552..131071,          # RFC IANA reserved ASNs
  4200000000..4294967294, # RFC 6996 Private ASNs
  4294967295 ];           # RFC 7300 Last 32 bit ASN

define BOGON_PREFIXES = [ ::/0,                          # Default route
                          ::/8+,                         # RFC 4291 IPv4-compatible, loopback, et al
                          0100::/64+,                    # RFC 6666 Discard-Only
                          2001:2::/48+,                  # RFC 5180 BMWG
                          2001:10::/28+,                 # RFC 4843 ORCHID
                          2001:db8::/32+,                # RFC 3849 documentation
                          2002::/16+,                    # RFC 7526 6to4 anycast relay
                          3ffe::/16+,                    # RFC 3701 old 6bone
                          fc00::/7+,                     # RFC 4193 unique local unicast
                          fe80::/10+,                    # RFC 4291 link local unicast
                          fec0::/10+,                    # RFC 3879 old site local unicast
                          ff00::/8+                      # RFC 4291 multicast
 ];

function reject_bogon_asns()
int set bogon_asns;
{
  bogon_asns = BOGON_ASNS;

  if ( bgp_path ~ bogon_asns ) then {
    print "Reject: bogon AS_PATH: ", net, " ", bgp_path;
    clearnet_add_filter(FILTER_BOGON_ASN);
  }
}

function reject_bogon_prefixes()
prefix set bogon_prefixes;
{
    bogon_prefixes = BOGON_PREFIXES;
    if (net ~ bogon_prefixes) then {
        print "Reject: Bogon prefix: ", net, " ", bgp_path;
        clearnet_add_filter(FILTER_BOGON_PREFIX);
    }
}

define PROBLEM_PREFIXES = [
];

function reject_problem_prefixes()
prefix set problem_prefixes;
{
    problem_prefixes = PROBLEM_PREFIXES;
    if (net ~ problem_prefixes) then {
        print "Reject: Problematic prefix: ", net, " ", bgp_path;
        clearnet_add_filter(FILTER_PROBLEM_PREFIX);
    }
}

function reject_long_aspaths()
{
    if ( bgp_path.len > 50 ) then {
        clearnet_add_filter(FILTER_LONG_ASPATH);
    }
}

function reject_small_prefixes()
{
  if (net.len > 55 && net.type = NET_IP6) then {
    print "Reject: Too small prefix: ", net, " ", bgp_path;
    clearnet_add_filter(FILTER_SMALL_V6_PREFIX);
  }
}

function reject_roa_rpki()
{
    if ( roa_check(clear_roa_v6, net, bgp_path.last_nonaggregated) = ROA_INVALID ) then {
        clearnet_add_filter(FILTER_ROA_RPKI);
    }
}

function clearnet_common_import() {
    reject_bogon_asns();
    reject_bogon_prefixes();
    reject_long_aspaths();
    reject_small_prefixes();
    reject_problem_prefixes();
    reject_roa_rpki();
    honor_graceful_shutdown();
}

filter myas_export
{
    if (proto = "myprefix") then {
        accept;
    }
    reject;
}

# route collector
filter myas_f_rc
{
# export IXP routes after all
#    if ( clearnet_is_ixp() ) then reject;
    if (source = RTS_BGP) then accept;
    if (proto = "myprefix") then accept;
    reject;
};

protocol static myprefix {
{% for prefix in uvok_bird_opts.prefixes %}
    route {{ prefix }} reject;
{% endfor %};

    ipv6 {
        # needs to be in unfiltered - because that's where I'm exporting from
        table t_myas_unfiltered;
        import all;
        export none;
    };
}

protocol direct {
    ipv6 { table t_myas_babel; };
    interface "myas_int";
};

template bgp pt_clearnet {
    local as CLEARNET_ASN;

    graceful restart on;
    long lived graceful restart on;

    prefer older on;

    # Neighbor as must be first route as
    enforce first as on;
    # faster updates
    enable extended messages on;

    # defaults anyway
    enable route refresh on;
    interpret communities on;
    direct;

    # higher better
    default bgp_local_pref 100;

    # my value - lower better
    default bgp_med 100;

    ipv6 {
        # start by importing into the unfiltered table
        table t_myas_unfiltered;

        # for inspection who's evil
        import keep filtered;
        # for RPKI / ROA
        import table on;

        import filter {
            clearnet_import_transit();
            clearnet_common_import();
            accept;
        };

        export filter myas_export;
    };
}

# route collector
template bgp pt_rc from pt_clearnet {
    multihop;

    # yes, use unfiltered table for export
    # I wanna shame garbish announcers publically! ;)
    ipv6 {
        add paths tx;
        import none;
        export filter myas_f_rc;
    };
}

{% if uvok_bird_opts.babel_if_name %}
protocol babel p_myas_babel {
  ipv6 {
    table t_myas_babel;
    import where source ~ [RTS_DEVICE, RTS_BABEL];
    export where source ~ [RTS_DEVICE, RTS_BABEL];
  };

  interface "{{ uvok_bird_opts.babel_if_name }}" {
  };
}
{% endif %}

# pipe babel table => bgp table for next-hop resolution?
protocol pipe {
    table t_myas_babel;
    peer table t_myas_trs;
    import none;
    export where source ~ [RTS_BABEL];
}

# EXPORT FROM unfilteed TO filtered trs table
protocol pipe {
    table t_myas_unfiltered;
    peer table t_myas_trs;
    import none;
    export filter {
        if ( bgp_large_community ~ [(CLEARNET_ASN, LC_FILTERED, *)] ) then {
            reject;
        }
        accept;
    };
}

protocol kernel p_myas_i {
#    scan time 20;
    kernel table 150;

    ipv6 {
        table t_myas_babel;
        import none;
        export filter {
            if (source != RTS_BABEL) then {
                print "SHOULD NOT HAPPEN: export babel to kernel: ", net, " from", source;
                reject;
            }
            krt_prefsrc = CLEARNET_PREFIP;
            accept;
        };
    };
};

protocol kernel pk_myas_out {
    kernel table 100;

    ipv6 {
        table t_myas_trs;
        import none;
        export filter {
            krt_prefsrc = CLEARNET_PREFIP;
            if (source = RTS_BGP) then {
                accept;
            }
{% if uvok_bird_opts.use_fallback %}
            if (proto = "myas_def_fallb") then {
                accept;
            }
{% endif %}
            reject;
        };
    };
};

include "/etc/bird/clear_peers/*.conf";
{% if uvok_bird_opts.use_fallback %}
include "clear_fallback.conf";
{% endif %}