Rayhaan JaufeerallyandClaude Fable 5.1
160e28690a
Preparing to peer with a production BIRD router turned up two problems. - packet: most Capability::from_wire arms returned the per-capability buffer (always empty by then) instead of the bytes following the capability. The list parser then saw an empty remainder and silently dropped every later capability. Any OPEN listing extended message, role, graceful restart, add-path, enhanced route refresh, LLGR, extended next hop or an unknown capability before the 4-octet ASN capability lost the ASN, so the peer appeared as AS_TRANS (23456) and a configured remote_asn was refused with Bad Peer AS. BIRD and FRR both do this. Single-capability round-trip tests could not catch it; new tests parse every capability with another following it, and a full BIRD capability list. - server: advertise MultiProtocol IPv6 unicast alongside IPv4. Without it a peer will not accept the IPv6 routes we originate via MP_REACH_NLRI. - Interop test: byte-for-byte BIRD 2 OPEN is accepted with the right ASN, and an IPv6 End-of-RIB neither drops the session nor creates a route. - docs/lab/prod: BIRD config for an announce-only ferrix neighbour (strict /48 import filter, community scrubbing, unreachable next hop, import limit, export none, passive) and the matching ferrix config. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
26 lines
945 B
Protocol Buffer Text Format
26 lines
945 B
Protocol Buffer Text Format
# ferrix_bgp on a laptop, peering with the production router over WireGuard.
|
|
# Counterpart of bird-ferrix.conf. Run: cargo run --release -- docs/lab/prod/ferrix.textpb --level info
|
|
router_id: "10.255.0.2" # must differ from the production router's
|
|
local_asn: 4200000001 # private; stripped by the production router
|
|
|
|
# IPv6 prefixes are only announced over an IPv6 session, and the next hop is
|
|
# our end of it, so listen and dial on the tunnel's IPv6 address.
|
|
listen_endpoints { address: "fd00:179::2" port: 179 }
|
|
|
|
peers {
|
|
name: "prod"
|
|
endpoint { address: "fd00:179::1" port: 179 }
|
|
remote_asn: 210036
|
|
hold_time_seconds: 90
|
|
}
|
|
connect_retry_seconds: 5
|
|
collision_detect_established_state: true
|
|
|
|
local_route_policy {
|
|
allowed_prefixes: "2a0d:d741::/40"
|
|
max_routes_per_owner: 1
|
|
}
|
|
|
|
# No authentication on this API: keep it on loopback or the classroom LAN.
|
|
http_endpoint { address: "127.0.0.1" port: 8080 }
|