ffho-salt-public/bird/ff-policy.conf

#
# FFHO Routing Policy
#
{%- set node_roles = salt['pillar.get']('nodes:' ~ grains['id'] ~ ':roles', []) %}
{%- set node_sites = salt['pillar.get']('nodes:' ~ grains['id'] ~ ':sites', []) %}
{%- set sites = salt['pillar.get']('sites', {}) %}
{%- set te = salt['pillar.get']('te', {}) %}


################################################################################
#                              Static Filters                                  #
################################################################################

filter external_IPs_to_learn {
	if net ~ [
{%- if proto == 'v4' %}
		80.70.181.59/32,	# mail.ffho.net
		80.70.181.61/32		# fe01.ffho.net
{%- else %}
		2a02:450:1:0::/64	# Vega VM Subnet
{%- endif %}
	] then accept;

	reject;
};

filter own_prefixes {
	if net ~ [
{%- if proto == 'v4' %}
		10.132.0.0/16,
		172.30.0.0/16{24,24}
{%- else %}
		fdca:ffee:ff12::/48,
		2a03:2260:2342::/48
{%- endif %}
	] then accept;

	reject;
};


################################################################################
#               iBGP routing policy (Communities + Filter) + TE                #
################################################################################

{%- for site in node_sites %}
  {%- set site_config = sites.get (site) %}
  {%- set community = 'SITE_' ~ site|upper|replace('-', '') ~ '_ROUTE' %}
  {%- set community_id = site_config.get ('site_no')|int + 100 %}
define {{ community }} = (65132,{{ community_id }});
{%- endfor %}

# Prefixes longer that site prefix leaving a gateway as TE prefixes.
# They are for TE core -> gateway only and must not be imported on other gateways.
define GATEWAY_TE_ROUTE = (65132,300);

# All our prefixes learned in the external VRF and redistributed into the
# internal network
define EXTERNAL_ROUTE = (65132,1023);

# TE routes only to be exported by specific border routers
define EXPORT_RESTRICT       = (65132, 100);
define EXPORT_ONLY_AT_CR01   = (65132, 101);
define EXPORT_ONLY_AT_CR02   = (65132, 102);
define EXPORT_ONLY_AT_CR03   = (65132, 103);
define EXPORT_ONLY_AT_BBR_KT = (65132, 197);

# Anycasted prefix
define ANYCAST_PREFIX = (65132,999);

# To be placed in /etc/bird/ff_killswitch.conf
define SITE_LEGACY_ONLINE = 1;
define SITE_PADCTY_ONLINE = 1;
define SITE_PADUML_ONLINE = 1;
define DRAINED = 0;


{%- if 'batman_gw' in node_roles %}
function tag_site_routes ()
{
  {%- for site in node_sites %}
    {%- set site_config = sites.get (site) %}
    {%- set prefix = site_config.get ('prefix_' ~ proto) %}
    {%- set prefix_mask_te = prefix.split ('/')[1]|int + 1 %}
    {%- set community = 'SITE_' ~ site|upper|replace('-', '') ~ '_ROUTE' %}
	# {{ site_config.get ('name', site) }}
	if net ~ [ {{ prefix }}+ ] then {
		bgp_community.add ({{ community }});
	}

  {#-
   # Tag all routes for prefixes longer that site prefix leaving a gateway
   # as TE prefixes. They are for TE core -> gateway only and must not be
   # imported on other gateways.
   #}
    {%- if proto == 'v4' %}
	if net ~ [ {{ prefix ~ '{' ~ prefix_mask_te ~ ',32}' }} ] then {
		bgp_community.add (GATEWAY_TE_ROUTE);
	}
    {%- endif %}
  {% endfor %}
}
{%- endif %}


filter ibgp_in {
{#- Don't import other gateways TE prefixes here #}
{%- if 'batman_gw' in node_roles %}
        if (GATEWAY_TE_ROUTE ~ bgp_community) then {
                reject;
        }
{%- endif %}

        accept;
}


filter ibgp_out {
	# Don't redistribute OSPF into iBGP
	if "IGP" = proto then
		reject;

	if "bogon_unreach" = proto then
		reject;

	if "ffrl_te" = proto then
		reject;

	if 1 = DRAINED then
		reject;

{%- if 'batman_gw' in node_roles %}
	tag_site_routes ();
{%- endif %}

	accept;
}


# Traffic engineering routes
protocol static ffho_te {
	preference 23;

{% set prefixes = salt['ffho_net.get_te_prefixes'](te, grains['id'], proto) %}
{% for prefix in prefixes|sort %}
  {%- set config = prefixes.get (prefix) %}
  {%- if 'desc' in config %}
	# {{ config.get ('desc') }}
  {%- endif %}
	route {{ prefix }} unreachable {
  {%- for community in config.get ('communities', []) %}
		bgp_community.add ({{ community }});
  {%- endfor %}
	};
{%- endfor %}

}