Skip to content

Commit

Permalink
v0.1.0a11 [skip ci]
Browse files Browse the repository at this point in the history
  • Loading branch information
pierky committed Feb 14, 2017
1 parent 6df8c7c commit b26d930
Show file tree
Hide file tree
Showing 10 changed files with 100 additions and 100 deletions.
2 changes: 1 addition & 1 deletion CHANGES.rst
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Change log
==========

not released
v0.1.0a11
------------

- The ``filtering.rpsl`` section of general and clients configuration files has been renamed into ``filtering.irrdb``.
Expand Down
10 changes: 5 additions & 5 deletions docs/_static/examples_default.html
Original file line number Diff line number Diff line change
Expand Up @@ -54,11 +54,11 @@ <h3>NEXT_HOP attribute</h3>
<h3>AS_PATH attribute</h3>

<ul>
<li><p>Prefixes whose <strong>AS_PATH is longer than 32</strong> ASNs are rejected.</p></li>
<li><p>Routes whose <strong>AS_PATH is longer than 32</strong> ASNs are rejected.</p></li>

<li><p>The <strong>left-most ASN</strong> in the AS_PATH of any route announced to the route server must be the ASN of the announcing client.</p></li>

<li><p>Prefixes whose AS_PATH contains <a href="http://mailman.nanog.org/pipermail/nanog/2016-June/086078.html"><strong>private or invalid ASNs</strong></a> are rejected.</p></li>
<li><p>Routes whose AS_PATH contains <a href="http://mailman.nanog.org/pipermail/nanog/2016-June/086078.html"><strong>private or invalid ASNs</strong></a> are rejected.</p></li>

</ul>

Expand All @@ -69,11 +69,11 @@ <h3>IRRDBs prefix/origin ASN enforcement</h3>
<ul>
<li><p>
Origin ASN validity is
<strong>enforced</strong>. Prefixes whose origin ASN is not authorized by the client's AS-SET are rejected.
<strong>enforced</strong>. Routes whose origin ASN is not authorized by the client's AS-SET are rejected.
</p></li>

<li><p>Announced prefixes validity is
<strong>enforced</strong>. Prefixes that are not part of the client's AS-SET are rejected.
<strong>enforced</strong>. Routes whose prefix is not part of the client's AS-SET are rejected.
</p></li>

</ul>
Expand All @@ -84,7 +84,7 @@ <h3>RPKI validation</h3>

<ul>

<li><p><a href="https://tools.ietf.org/html/rfc6483">RPKI validation</a> of prefixes received by the route server is <strong>disabled</strong>.</p></li>
<li><p><a href="https://tools.ietf.org/html/rfc6483">RPKI validation</a> of routes received by the route server is <strong>disabled</strong>.</p></li>

</ul>

Expand Down
26 changes: 13 additions & 13 deletions docs/_static/examples_rich.html
Original file line number Diff line number Diff line change
Expand Up @@ -55,14 +55,14 @@ <h3>NEXT_HOP attribute</h3>
<h3>AS_PATH attribute</h3>

<ul>
<li><p>Prefixes whose <strong>AS_PATH is longer than 32</strong> ASNs are rejected.</p></li>
<li><p>Routes whose <strong>AS_PATH is longer than 32</strong> ASNs are rejected.</p></li>

<li><p>The <strong>left-most ASN</strong> in the AS_PATH of any route announced to the route server must be the ASN of the announcing client.</p></li>

<li><p>Prefixes whose AS_PATH contains <a href="http://mailman.nanog.org/pipermail/nanog/2016-June/086078.html"><strong>private or invalid ASNs</strong></a> are rejected.</p></li>
<li><p>Routes whose AS_PATH contains <a href="http://mailman.nanog.org/pipermail/nanog/2016-June/086078.html"><strong>private or invalid ASNs</strong></a> are rejected.</p></li>

<li><p>
Prefixes with an AS_PATH containing one or more of the following <strong>"transit-free" networks</strong>' ASNs
Routes with an AS_PATH containing one or more of the following <strong>"transit-free" networks</strong>' ASNs
are <strong>rejected</strong>.
</p>
<p>
Expand All @@ -78,15 +78,15 @@ <h3>IRRDBs prefix/origin ASN enforcement</h3>
<ul>
<li><p>
Origin ASN validity is
<strong>enforced</strong>. Prefixes whose origin ASN is not authorized by the client's AS-SET are rejected.
<strong>enforced</strong>. Routes whose origin ASN is not authorized by the client's AS-SET are rejected.
</p></li>

<li><p>Announced prefixes validity is
<strong>enforced</strong>. Prefixes that are not part of the client's AS-SET are rejected.
<strong>enforced</strong>. Routes whose prefix is not part of the client's AS-SET are rejected.
</p></li>

<li><p>
Prefix <strong>validity state</strong> is signalled to route server clients using the following <strong>BGP communities</strong>:
Route <strong>validity state</strong> is signalled to route server clients using the following <strong>BGP communities</strong>:
<table class="table">
<thead>
<tr>
Expand Down Expand Up @@ -124,11 +124,11 @@ <h3>RPKI validation</h3>

<ul>

<li><p><a href="https://tools.ietf.org/html/rfc6483">RPKI validation</a> of prefixes received by the route server is <strong>enabled</strong>.</p></li>
<li><p><a href="https://tools.ietf.org/html/rfc6483">RPKI validation</a> of routes received by the route server is <strong>enabled</strong>.</p></li>

<li><p>When an INVALID prefix is received by the route server, <strong>it is rejected</strong>.</p></li>
<li><p>When an INVALID route is received by the route server, <strong>it is rejected</strong>.</p></li>
<li><p>
Prefix <strong>validity state</strong> is signalled to route server clients using the following <strong>BGP communities</strong>:
Route <strong>validity state</strong> is signalled to route server clients using the following <strong>BGP communities</strong>:
<table class="table">
<thead>
<tr>
Expand Down Expand Up @@ -476,13 +476,13 @@ <h2>Blackhole filtering</h2>
65535:666 (<a href="https://tools.ietf.org/html/rfc7999#section-5">BLACKHOLE</a> well-known community)
</p></li>

<li><p>By default, prefixes are
<li><p>By default, routes are
<strong>propagated</strong> to all the clients unless they have been explicitly configured to not receive them.
</p></li>

<li><p>IPv4 prefixes are propagated to clients after their <strong>NEXT_HOP attribute has been rewritten</strong> to 192.0.2.66.</p></li>
<li><p>IPv6 prefixes are propagated to clients after their <strong>NEXT_HOP attribute has been rewritten</strong> to 2001:db8:1:1::66.</p></li>
<li><p>Before being announced to clients, all the prefixes are tagged with the BLACKHOLE well-known community.</p></li>
<li><p>IPv4 routes are propagated to clients after their <strong>NEXT_HOP attribute has been rewritten</strong> to 192.0.2.66.</p></li>
<li><p>IPv6 routes are propagated to clients after their <strong>NEXT_HOP attribute has been rewritten</strong> to 2001:db8:1:1::66.</p></li>
<li><p>Before being announced to clients, all the routes are tagged with the BLACKHOLE well-known community.</p></li>

<li><p>Blackhole filtering requests bypass any RPKI validation check and min/max length check.</p></li>
</ul>
Expand Down
28 changes: 14 additions & 14 deletions examples/default/bird4.conf
Original file line number Diff line number Diff line change
Expand Up @@ -137,36 +137,36 @@ int set transit_free_asns;

# This function scrubs BGP communities used by the route server
# for signaling purpose toward its clients. (RFC7454, Section 11)
# It must be applied on prefixes entering the route server.
# It must be applied on routes entering the route server.
function scrub_communities_in() {
}

# This function scrubs BGP communities used by clients to instruct
# the route server to perform some actions.
# It must be applied on prefixes leaving the route server.
# It must be applied on routes leaving the route server.
function scrub_communities_out() {
}

# This function verifies if the prefix is tagged with one of
# This function verifies if the route is tagged with one of
# the blackhole filtering communities.
function is_blackhole_filtering_request() {
return false;
}

# This function must be applied to outgoing prefixes.
# It applies the blackhole filtering policy to the current prefix.
# This function must be applied to outgoing routes.
# It applies the blackhole filtering policy to the current route.
function apply_blackhole_filtering_policy() {
reject "blackhole filtering requested but no policy given - REJECTING ", net;
}

# This function verifies if the current prefix can be announced to
# This function verifies if the current route can be announced to
# the given client on the basis of the attached control BGP
# communities.
function prefix_can_be_announced_to(int peer_as) {
function route_can_be_announced_to(int peer_as) {
return true;
}

# This function verifies if the current prefix matches one of the
# This function verifies if the current route matches one of the
# control communities in charge of prepending client's ASN.
function apply_prepend(int peer_as) {

Expand Down Expand Up @@ -216,7 +216,7 @@ function prefix_is_in_AS3333_1_as_set() {

function next_hop_is_valid_for_AS3333_1()
{
# Checks if NEXT_HOP is one of those allowed for prefixes announced by AS3333_1
# Checks if NEXT_HOP is one of those allowed for routes announced by AS3333_1
if bgp_next_hop = 192.0.2.11 then return true;
return false;
}
Expand Down Expand Up @@ -285,8 +285,8 @@ filter announce_to_AS3333_1 {
}

# BGP control communities
if !prefix_can_be_announced_to(3333) then
reject "prefix didn't pass control communities checks - NOT ANNOUNCING ", net, " TO AS3333_1";
if !route_can_be_announced_to(3333) then
reject "route didn't pass control communities checks - NOT ANNOUNCING ", net, " TO AS3333_1";

apply_prepend(3333);

Expand Down Expand Up @@ -330,7 +330,7 @@ function prefix_is_in_AS10745_1_as_set() {

function next_hop_is_valid_for_AS10745_1()
{
# Checks if NEXT_HOP is one of those allowed for prefixes announced by AS10745_1
# Checks if NEXT_HOP is one of those allowed for routes announced by AS10745_1
if bgp_next_hop = 192.0.2.22 then return true;
return false;
}
Expand Down Expand Up @@ -399,8 +399,8 @@ filter announce_to_AS10745_1 {
}

# BGP control communities
if !prefix_can_be_announced_to(10745) then
reject "prefix didn't pass control communities checks - NOT ANNOUNCING ", net, " TO AS10745_1";
if !route_can_be_announced_to(10745) then
reject "route didn't pass control communities checks - NOT ANNOUNCING ", net, " TO AS10745_1";

apply_prepend(10745);

Expand Down
22 changes: 11 additions & 11 deletions examples/default/bird6.conf
Original file line number Diff line number Diff line change
Expand Up @@ -179,36 +179,36 @@ int set transit_free_asns;

# This function scrubs BGP communities used by the route server
# for signaling purpose toward its clients. (RFC7454, Section 11)
# It must be applied on prefixes entering the route server.
# It must be applied on routes entering the route server.
function scrub_communities_in() {
}

# This function scrubs BGP communities used by clients to instruct
# the route server to perform some actions.
# It must be applied on prefixes leaving the route server.
# It must be applied on routes leaving the route server.
function scrub_communities_out() {
}

# This function verifies if the prefix is tagged with one of
# This function verifies if the route is tagged with one of
# the blackhole filtering communities.
function is_blackhole_filtering_request() {
return false;
}

# This function must be applied to outgoing prefixes.
# It applies the blackhole filtering policy to the current prefix.
# This function must be applied to outgoing routes.
# It applies the blackhole filtering policy to the current route.
function apply_blackhole_filtering_policy() {
reject "blackhole filtering requested but no policy given - REJECTING ", net;
}

# This function verifies if the current prefix can be announced to
# This function verifies if the current route can be announced to
# the given client on the basis of the attached control BGP
# communities.
function prefix_can_be_announced_to(int peer_as) {
function route_can_be_announced_to(int peer_as) {
return true;
}

# This function verifies if the current prefix matches one of the
# This function verifies if the current route matches one of the
# control communities in charge of prepending client's ASN.
function apply_prepend(int peer_as) {

Expand Down Expand Up @@ -257,7 +257,7 @@ function prefix_is_in_AS10745_2_as_set() {

function next_hop_is_valid_for_AS10745_2()
{
# Checks if NEXT_HOP is one of those allowed for prefixes announced by AS10745_2
# Checks if NEXT_HOP is one of those allowed for routes announced by AS10745_2
if bgp_next_hop = 2001:db:1:1::22 then return true;
return false;
}
Expand Down Expand Up @@ -329,8 +329,8 @@ filter announce_to_AS10745_2 {
}

# BGP control communities
if !prefix_can_be_announced_to(10745) then
reject "prefix didn't pass control communities checks - NOT ANNOUNCING ", net, " TO AS10745_2";
if !route_can_be_announced_to(10745) then
reject "route didn't pass control communities checks - NOT ANNOUNCING ", net, " TO AS10745_2";

apply_prepend(10745);

Expand Down
10 changes: 5 additions & 5 deletions examples/default/description.html
Original file line number Diff line number Diff line change
Expand Up @@ -54,11 +54,11 @@ <h3>NEXT_HOP attribute</h3>
<h3>AS_PATH attribute</h3>

<ul>
<li><p>Prefixes whose <strong>AS_PATH is longer than 32</strong> ASNs are rejected.</p></li>
<li><p>Routes whose <strong>AS_PATH is longer than 32</strong> ASNs are rejected.</p></li>

<li><p>The <strong>left-most ASN</strong> in the AS_PATH of any route announced to the route server must be the ASN of the announcing client.</p></li>

<li><p>Prefixes whose AS_PATH contains <a href="http://mailman.nanog.org/pipermail/nanog/2016-June/086078.html"><strong>private or invalid ASNs</strong></a> are rejected.</p></li>
<li><p>Routes whose AS_PATH contains <a href="http://mailman.nanog.org/pipermail/nanog/2016-June/086078.html"><strong>private or invalid ASNs</strong></a> are rejected.</p></li>

</ul>

Expand All @@ -69,11 +69,11 @@ <h3>IRRDBs prefix/origin ASN enforcement</h3>
<ul>
<li><p>
Origin ASN validity is
<strong>enforced</strong>. Prefixes whose origin ASN is not authorized by the client's AS-SET are rejected.
<strong>enforced</strong>. Routes whose origin ASN is not authorized by the client's AS-SET are rejected.
</p></li>

<li><p>Announced prefixes validity is
<strong>enforced</strong>. Prefixes that are not part of the client's AS-SET are rejected.
<strong>enforced</strong>. Routes whose prefix is not part of the client's AS-SET are rejected.
</p></li>

</ul>
Expand All @@ -84,7 +84,7 @@ <h3>RPKI validation</h3>

<ul>

<li><p><a href="https://tools.ietf.org/html/rfc6483">RPKI validation</a> of prefixes received by the route server is <strong>disabled</strong>.</p></li>
<li><p><a href="https://tools.ietf.org/html/rfc6483">RPKI validation</a> of routes received by the route server is <strong>disabled</strong>.</p></li>

</ul>

Expand Down
Loading

0 comments on commit b26d930

Please sign in to comment.