################################################ # Variable header # ################################################ define OWNAS = {{ dn42_local_as }}; define OWNIP = {{ dn42_local_v4 }}; define OWNIPv6 = {{ dn42_local_v6 }}; define OWNNET = {{ dn42_local_subnet_v4 }}; define OWNNETv6 = {{ dn42_local_subnet_v6 }}; define OWNNETSET = [{{ dn42_local_subnet_v4 }}+]; define OWNNETSETv6 = [{{ dn42_local_subnet_v6 }}+]; ################################################ # Header end # ################################################ router id OWNIP; ipv4 table dn42_v4; ipv6 table dn42_v6; protocol device { scan time 10; } /* * Utility functions */ function is_self_net() { return net ~ OWNNETSET; } function is_self_net_v6() { return net ~ OWNNETSETv6; } function is_valid_network() { return net ~ [ 172.20.0.0/14{21,29}, # dn42 172.20.0.0/24{28,32}, # dn42 Anycast 172.21.0.0/24{28,32}, # dn42 Anycast 172.22.0.0/24{28,32}, # dn42 Anycast 172.23.0.0/24{28,32}, # dn42 Anycast 172.31.0.0/16+, # ChaosVPN 10.100.0.0/14+, # ChaosVPN 10.127.0.0/16{16,32}, # neonetwork 10.0.0.0/8{15,24} # Freifunk.net ]; } {% if dn42_enable_roa %} roa4 table dn42_roa; roa6 table dn42_roa_v6; protocol static { roa4 { table dn42_roa; }; include "{{ dn42_roa_v4_location }}"; }; protocol static { roa6 { table dn42_roa_v6; }; include "{{ dn42_roa_v6_location }}"; }; {% endif %} function is_valid_network_v6() { return net ~ [ fd00::/8{44,64} # ULA address space as per RFC 4193 ]; } protocol kernel { scan time 20; ipv6 { table dn42_v6; import none; export filter { if source = RTS_STATIC then reject; krt_prefsrc = OWNIPv6; accept; }; }; {% if dn42_configure_linux_network_table %} kernel table 42; {% endif %} }; protocol kernel { scan time 20; ipv4 { table dn42_v4; import none; export filter { if source = RTS_STATIC then reject; krt_prefsrc = OWNIP; accept; }; }; {% if dn42_configure_linux_network_table %} kernel table 42; {% endif %} } protocol static { route OWNNET reject; ipv4 { table dn42_v4; import all; export none; }; } protocol static { route OWNNETv6 reject; ipv6 { table dn42_v6; import all; export none; }; } template bgp dnpeers { local as OWNAS; path metric 1; ipv4 { table dn42_v4; import filter { if is_valid_network() && !is_self_net() then { {% if dn42_enable_roa %} if (roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID) then { print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last; reject; } else accept; {% else %} accept; {% endif %} } else reject; }; export filter { if is_valid_network() then accept; else reject; }; import limit 1000 action block; }; ipv6 { table dn42_v6; import filter { if is_valid_network_v6() && !is_self_net_v6() then { {% if dn42_enable_roa %} if (roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID) then { print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last; reject; } else accept; {% else %} accept; {% endif %} } else reject; }; export filter { if is_valid_network_v6() then accept; else reject; }; import limit 1000 action block; }; } template bgp dnpeers_v4 { local as OWNAS; path metric 1; ipv4 { import filter { if is_valid_network() && !is_self_net() then { {% if dn42_enable_roa %} if (roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID) then { print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last; reject; } else accept; {% else %} accept; {% endif %} } else reject; }; export filter { if is_valid_network() then accept; else reject; }; import limit 1000 action block; }; } template bgp dnpeers_v6 { local as OWNAS; path metric 1; ipv6 { import filter { if is_valid_network_v6() && !is_self_net_v6() then { {% if dn42_enable_roa %} if (roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID) then { print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last; reject; } else accept; {% else %} accept; {% endif %} } else reject; }; export filter { if is_valid_network_v6() then accept; else reject; }; import limit 1000 action block; }; } include "/etc/bird/peers/*";