Roles service-bird + service-bird-icvpn:

Restructure bird configuration to exchange loopback addresses and announce the whole freifunk subnets instead the configured ones.
This commit is contained in:
Tobias Hachmer 2018-10-31 20:58:56 +01:00
parent d66f880539
commit a8693377a4
No known key found for this signature in database
GPG key ID: E112788464CA5C60
6 changed files with 189 additions and 30 deletions

View file

@ -7,6 +7,18 @@ internet_exit_tcp_mss_ipv6: 1220
icvpn_ipv4_transfer_net: 10.207.0.0/16 icvpn_ipv4_transfer_net: 10.207.0.0/16
icvpn_ipv6_transfer_net: fec0::a:cf:0:0/96 icvpn_ipv6_transfer_net: fec0::a:cf:0:0/96
ffmwu_loopback_net_ipv4: 10.37.255.0/24
ffmwu_loopback_net_ipv6: fd37:b4dc:4b1e:ffff::/64
ffmwu_anycast_ipv4: 10.37.255.255/32
ffmwu_anycast_ipv6: fd37:b4dc:4b1e:ffff:ffff:ffff:ffff:ffff/128
ffmwu_internal_prefixes:
- ipv4: 10.37.0.0/16
ipv6: fd37:b4dc:4b1e::/48
- ipv4: 10.56.0.0/16
ipv6: fd56:b4dc:4b1e::/48
bgp_loopback_net: 10.37.0.0/18 bgp_loopback_net: 10.37.0.0/18
bgp_ipv4_transfer_net: 10.37.0.0/18 bgp_ipv4_transfer_net: 10.37.0.0/18
bgp_ipv6_transfer_net: fd37:b4dc:4b1e::/64 bgp_ipv6_transfer_net: fd37:b4dc:4b1e::/64

View file

@ -10,9 +10,12 @@ roa table roa_icvpn {
include "icvpn_ipv4_roa.con?"; include "icvpn_ipv4_roa.con?";
} }
# Routing Tables
table icvpn;
# Filters # Filters
filter icvpn_import_filter { filter icvpn_import_filter {
if is_mwu_self_nets() then reject; if is_mwu_self_nets_loose() then reject;
if is_chaosvpn() then accept; if is_chaosvpn() then accept;
if roa_check(roa_icvpn) = ROA_VALID then { if roa_check(roa_icvpn) = ROA_VALID then {
if is_freifunk() then accept; if is_freifunk() then accept;
@ -40,12 +43,25 @@ filter icvpn_import_filter {
} }
# Protocols # Protocols
protocol kernel kernel_mwu { protocol pipe {
peer table icvpn;
import none;
export filter {
if is_mwu_self_nets_loose() then reject;
if is_freifunk() then accept;
if is_chaosvpn() then accept;
if is_dn42() then accept;
reject;
};
};
# Protocols
protocol kernel kernel_icvpn {
table icvpn;
scan time 30; scan time 30;
import none; import none;
export filter { export filter {
if is_mwu_self_nets() then if is_mwu_self_nets_loose() then reject;
reject;
krt_prefsrc = icvpn_address; krt_prefsrc = icvpn_address;
accept; accept;
}; };
@ -58,9 +74,7 @@ template bgp ebgp_icvpn {
import keep filtered on; import keep filtered on;
import filter icvpn_import_filter; import filter icvpn_import_filter;
export filter { export filter {
if is_mwu_self_nets() then { if is_mwu_self_nets_strict() then accept;
accept;
}
if source = RTS_BGP then { if source = RTS_BGP then {
if is_freifunk() || is_dn42() then { if is_freifunk() || is_dn42() then {
accept; accept;

View file

@ -10,9 +10,12 @@ roa table roa_icvpn {
include "icvpn_ipv6_roa.con?"; include "icvpn_ipv6_roa.con?";
} }
# Routing Tables
table icvpn;
# Filters # Filters
filter icvpn_import_filter { filter icvpn_import_filter {
if is_mwu_self_nets() then reject; if is_mwu_self_nets_loose() then reject;
if roa_check(roa_icvpn) = ROA_VALID then { if roa_check(roa_icvpn) = ROA_VALID then {
if is_ula() then accept; if is_ula() then accept;
} else { } else {
@ -34,12 +37,22 @@ filter icvpn_import_filter {
} }
# Protocols # Protocols
protocol kernel kernel_mwu { protocol pipe {
peer table icvpn;
export filter {
if is_mwu_self_nets_loose() then reject;
if is_ula() then accept;
reject;
};
import none;
};
protocol kernel kernel_icvpn {
table icvpn;
scan time 30; scan time 30;
import none; import none;
export filter { export filter {
if is_mwu_self_nets() then if is_mwu_self_nets_loose() then reject;
reject;
krt_prefsrc = icvpn_address; krt_prefsrc = icvpn_address;
accept; accept;
}; };
@ -52,12 +65,8 @@ template bgp ebgp_icvpn {
import keep filtered on; import keep filtered on;
import filter icvpn_import_filter; import filter icvpn_import_filter;
export filter { export filter {
if is_mwu_self_nets() then { if is_mwu_self_nets_strict() then accept;
accept; if source = RTS_BGP then accept;
}
if source = RTS_BGP then {
accept;
}
reject; reject;
}; };
direct; direct;

View file

@ -12,10 +12,15 @@ Im iBGP peeren wir mangels separatem Transfernetz (im Moment) im Mainzer Mesh Ne
## Benötigte Variablen ## Benötigte Variablen
- Variable `bgp_loopback_net` # IPv4-Range des Mainzer Meshes, hieraus werden die Loopback Adressen gewählt. - Variable `bgp_loopback_net` # IPv4-Range des Mainzer Meshes, hieraus werden die Loopback Adressen gewählt.
- Variable `ffmwu_loopback_net_ipv4` # IPv4-Subnetz für Loopback-Adressen
- Variable `ffmwu_loopback_net_ipv6` # IPv6-Subnetz für Loopback-Adressen
- Variable `ffmwu_anycast_ipv4` # Anycast IPv4-Adresse
- Variable `ffmwu_anycast_ipv6` # Anycast IPv6-Adresse
- Variable `bgp_ipv4_transfer_net` # IPv4-Range des Mainzer Meshes, das aktuell als Transfernetz benutzt wird. - Variable `bgp_ipv4_transfer_net` # IPv4-Range des Mainzer Meshes, das aktuell als Transfernetz benutzt wird.
- Variable `bgp_ipv6_transfer_net` # IPv6-Range des Mainzer Meshes, das aktuell als Transfernetz benutzt wird. - Variable `bgp_ipv6_transfer_net` # IPv6-Range des Mainzer Meshes, das aktuell als Transfernetz benutzt wird.
- Variable `bgp_as_private_mwu` # Private ASN von Freifunk MWU - Variable `bgp_as_private_mwu` # Private ASN von Freifunk MWU
- Liste `bgp_groups` # List von Hostgruppen zu denen eine Verbindung aufgebaut werden soll - Liste `bgp_groups` # List von Hostgruppen zu denen eine Verbindung aufgebaut werden soll
- Liste `ffmwu_internal_prefixes`
- Dictionary `bgp_mwu_servers` - Dictionary `bgp_mwu_servers`
``` ```

View file

@ -36,14 +36,34 @@ function is_chaosvpn() {
]; ];
} }
function is_mwu_self_nets() { function is_mwu_self_nets_loose() {
return net ~ [ return net ~ [
{% for mesh in meshes %} {% for prefix in ffmwu_internal_prefixes %}
{{ mesh.ipv4_network | ipaddr('net') }}+{{ "," if not loop.last else "" }} {{ prefix.ipv4 | ipaddr('net') }}+{{ "," if not loop.last else "" }}
{% endfor %} {% endfor %}
]; ];
} }
function is_mwu_self_nets_strict() {
return net ~ [
{% for prefix in ffmwu_internal_prefixes %}
{{ prefix.ipv4 | ipaddr('net') }}{{ "," if not loop.last else "" }}
{% endfor %}
];
}
function is_mwu_loopback() {
return net ~ [
{{ ffmwu_loopback_net_ipv4 }}+
];
}
function is_mwu_anycast() {
return net ~ [
{{ ffmwu_anycast_ipv4 }}
];
}
# Protocols # Protocols
protocol device { protocol device {
scan time 30; scan time 30;
@ -53,15 +73,56 @@ protocol direct mwu_subnets {
{% for mesh in meshes %} {% for mesh in meshes %}
interface "{{ mesh.id }}br"; interface "{{ mesh.id }}br";
{% endfor %} {% endfor %}
import where is_mwu_self_nets(); import where is_mwu_self_nets_loose();
};
protocol direct mwu_loopback {
interface "loopback";
import where is_mwu_loopback();
};
{% if ffmwu_server_type == "gateway" %}
protocol direct mwu_anycast {
interface "anycast";
import where is_mwu_anycast();
};
{% endif %}
protocol static {
{% for prefix in ffmwu_internal_prefixes %}
route {{ prefix.ipv4 }} reject;
{% endfor %}
};
protocol kernel kernel_mwu {
scan time 30;
import none;
export filter {
if is_mwu_anycast() then reject;
if is_mwu_loopback() then accept;
reject;
};
kernel table ipt_mwu;
}; };
# Templates # Templates
template bgp ibgp_mwu { template bgp ibgp_mwu {
local mwu_address as mwu_as; local mwu_address as mwu_as;
import keep filtered on; import keep filtered on;
import all; import filter {
export where source = RTS_BGP; if is_mwu_anycast() then reject;
if is_mwu_self_nets_loose() then accept;
if is_freifunk() then accept;
if is_chaosvpn() then accept;
if is_dn42() then accept;
reject;
};
export filter {
if is_mwu_anycast() then reject;
if is_mwu_self_nets_loose() then accept;
if source = RTS_BGP then accept;
reject;
};
direct; direct;
gateway direct; gateway direct;
}; };

View file

@ -24,15 +24,34 @@ function is_ula() {
]; ];
} }
function is_mwu_self_nets() { function is_mwu_self_nets_loose() {
return net ~ [ return net ~ [
{% for mesh in meshes %} {% for prefix in ffmwu_internal_prefixes %}
{% for ula in mesh.ipv6_ula %} {{ prefix.ipv6 | ipaddr('net') }}+{{ "," if not loop.last else "" }}
{{ ula | ipaddr('net') }}+{{ "," if not loop.last else "" }}{% endfor %}{{ "," if not loop.last else "" }}
{% endfor %} {% endfor %}
]; ];
} }
function is_mwu_self_nets_strict() {
return net ~ [
{% for prefix in ffmwu_internal_prefixes %}
{{ prefix.ipv6 | ipaddr('net') }}{{ "," if not loop.last else "" }}
{% endfor %}
];
}
function is_mwu_loopback() {
return net ~ [
{{ ffmwu_loopback_net_ipv6 }}+
];
};
function is_mwu_anycast() {
return net ~ [
{{ ffmwu_anycast_ipv6 }}+
];
};
# Protocols # Protocols
protocol device { protocol device {
scan time 30; scan time 30;
@ -42,15 +61,54 @@ protocol direct mwu_subnets {
{% for mesh in meshes %} {% for mesh in meshes %}
interface "{{ mesh.id }}br"; interface "{{ mesh.id }}br";
{% endfor %} {% endfor %}
import where is_mwu_self_nets(); import where is_mwu_self_nets_loose();
};
protocol direct mwu_loopback {
interface "loopback";
import where is_mwu_loopback();
};
{% if ffmwu_server_type == "gateway" %}
protocol direct mwu_anycast {
interface "anycast";
import where is_mwu_anycast();
};
{% endif %}
protocol static {
{% for prefix in ffmwu_internal_prefixes %}
route {{ prefix.ipv6 }} reject;
{% endfor %}
};
protocol kernel kernel_mwu {
scan time 30;
import none;
export filter {
if is_mwu_anycast() then reject;
if is_mwu_loopback() then accept;
reject;
};
kernel table ipt_mwu;
}; };
# Templates # Templates
template bgp ibgp_mwu { template bgp ibgp_mwu {
local mwu_address as mwu_as; local mwu_address as mwu_as;
import keep filtered on; import keep filtered on;
import all; import filter {
export where source = RTS_BGP; if is_mwu_anycast() then reject;
if is_mwu_self_nets_loose() then accept;
if is_ula() then accept;
reject;
};
export filter {
if is_mwu_anycast() then reject;
if is_mwu_self_nets_loose() then accept;
if source = RTS_BGP then accept;
reject;
};
direct; direct;
gateway direct; gateway direct;
}; };