Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bird46: add ROA via icvpn-scripts/mkroa script #110

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

bird46: add ROA via icvpn-scripts/mkroa script #110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions files/usr/local/bin/update-meta
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ reload() {
echo
echo bird6: regenerating icvpn peers
/opt/icvpn-scripts/mkbgp -6 -s /var/lib/icvpn-meta -d icvpn $excluded_peers > /etc/bird/bird6.conf.d/icvpn-peers.conf
/opt/icvpn-scripts/mkroa -6 -s /var/lib/icvpn-meta -m 64 $excluded_peers > /etc/bird/bird6.conf.d/icvpn-roa-table.conf
echo bird6: reload
# We only want errors
/usr/sbin/birdc6 configure 1>/dev/null
Expand All @@ -34,6 +35,7 @@ reload() {
echo
echo bird: regenerating icvpn peers
/opt/icvpn-scripts/mkbgp -4 -s /var/lib/icvpn-meta -d icvpn $excluded_peers > /etc/bird/bird.conf.d/icvpn-peers.conf
/opt/icvpn-scripts/mkroa -4 -s /var/lib/icvpn-meta -m 24 $excluded_peers > /etc/bird/bird.conf.d/icvpn-roa-table.conf
echo bird: reload
# We only want errors
/usr/sbin/birdc configure 1>/dev/null
Expand Down
47 changes: 33 additions & 14 deletions manifests/bird4.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,13 @@

$icvpn_name = $name

file_line {
"icvpn-include-roa":
path => '/etc/bird/bird.conf',
line => 'include "/etc/bird/bird.conf.d/icvpn-roa.conf";',
require => File['/etc/bird/bird.conf'],
notify => Service['bird'];
}->
file_line {
"icvpn-template":
path => '/etc/bird/bird.conf',
Expand All @@ -124,18 +131,30 @@
}

# Process meta data from tinc directory
file { "/etc/bird/bird.conf.d/icvpn-template.conf":
mode => "0644",
content => template("ffnord/etc/bird/bird.icvpn-template.conf.erb"),
require => [
File['/etc/bird/bird.conf.d/'],
Package['bird'],
Class['ffnord::tinc'],
],
notify => [
Service['bird'],
File_line['icvpn-include'],
File_line['icvpn-template']
];
}
file {
"/etc/bird/bird.conf.d/icvpn-template.conf":
mode => "0644",
content => template("ffnord/etc/bird/bird.icvpn-template.conf.erb"),
require => [
File['/etc/bird/bird.conf.d/'],
Package['bird'],
Class['ffnord::tinc'],
],
notify => [
Service['bird'],
File_line['icvpn-include'],
File_line['icvpn-template']
];
}

file_line {
"icvpn-roa":
path => '/etc/bird/bird.conf.d/icvpn-roa.conf',
line => 'roa table icvpn_roa { include "icvpn-roa-table.con?" }',
require => [
File['/etc/bird/bird.conf.d/'],
File_line['icvpn-include-roa']
],
notify => Service['bird'];
}
}
20 changes: 19 additions & 1 deletion manifests/bird6.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,13 @@

include ffnord::icvpn

file_line {
"icvpn-include-roa6":
path => '/etc/bird/bird6.conf',
line => 'include "/etc/bird/bird6.conf.d/icvpn-roa.conf";',
require => File['/etc/bird/bird6.conf'],
notify => Service['bird6'];
}->
file_line {
"icvpn-template6":
path => '/etc/bird/bird6.conf',
Expand Down Expand Up @@ -137,5 +144,16 @@
File_line['icvpn-include6'],
File_line['icvpn-template6']
];
}
}

file_line {
"icvpn-roa6":
path => '/etc/bird/bird6.conf.d/icvpn-roa.conf',
line => 'roa table icvpn_roa { include "icvpn-roa-table.con?" }',
require => [
File['/etc/bird/bird6.conf.d/'],
File_line['icvpn-include-roa6']
],
notify => Service['bird'];
}
}
14 changes: 12 additions & 2 deletions templates/etc/bird/bird.icvpn-template.conf.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,15 @@
# this is file is generated by puppet

filter icvpn_import_filter {
if is_dn42() then accept;
if roa_check(icvpn_roa) = ROA_VALID then {
accept;
} else {
print "ROA check failed for ", net, " ASN ", bgp_path.last;
}
reject;
}

# template for icvpn route exchange via bgp
# we exchange freifunk and dn42 routes with peers
# chaosvpn should not be exchanged because chaosvpn misses a route to not
Expand All @@ -8,6 +18,6 @@ template bgp icvpn {
table mesh;
local as <%= @icvpn_as %>;
source address <%= @icvpn_ipv4_address %>;
import where is_freifunk() || is_dn42();
export where ((source = RTS_BGP) || (source = RTS_STATIC)) && (is_freifunk() || is_dn42());
import filter icvpn_import_filter;
export where ((source = RTS_BGP) || (source = RTS_STATIC)) && (is_freifunk() || is_dn42()) && !is_default() && !is_chaos();
};
12 changes: 11 additions & 1 deletion templates/etc/bird/bird6.icvpn-template.conf.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,20 @@
# this is file is generated by puppet

filter icvpn_import_filter {
if is_ula() then accept;
if roa_check(icvpn_roa) = ROA_VALID then {
accept;
} else {
print "ROA check failed for ", net, " ASN ", bgp_path.last;
}
reject;
}

# template for icvpn route exchange via bgp
template bgp icvpn {
table mesh;
local as <%= @icvpn_as %>;
source address <%= @icvpn_ipv6_address %>;
import where (is_ula() || is_freifunk());
import filter icvpn_import_filter;
export where ((source = RTS_BGP) || (source = RTS_STATIC_DEVICE)) && (is_ula() || is_freifunk());
};