Ferrix BGP

An implementation of the Border Gateway Protocol, which is used to exchange routing and control plane information between Autonomous Systems.

The aim of this project is to provide a modern, high performance, secure, programmatic and customizable software package that can be useful to network operators, researchers, and people interested in Internet.

Current status

The daemon holds sessions with configured peers, takes their routes through an import policy, validates them against the RPKI (route origin validation and ASPA), picks the best route for each prefix and, on Linux, installs it in the kernel. It announces the routes it originates and, to the peers configured for it, the best of what it learned from the others, as far as RFC 9234's roles and the routes' communities allow.

• bin/bgp/README.md: what the daemon does, how to configure and run it, and how it is tested against FRR, BIRD and Routinator.
• docs/RFCs.md: which parts of which RFCs are implemented.
• crates/server/proto/config.proto: the configuration, field by field.

It has not yet run in a production network.

Not there yet

• Route reflection, per-client selection for a route server, ADD-PATH for learned routes
• TCP-AO / TCP MD5 and GTSM
• Graceful restart, BFD, changing the configuration without a restart
• Next hops that are not directly connected

Layout

Crate	What is in it
crates/primitives	Prefixes, address families, parsing helpers
crates/packet	The wire format: messages, attributes, capabilities
crates/rib	The routing table, best route selection, the journal of changes
crates/rpki	The RTR client; origin validation and ASPA path verification
crates/fib	The best routes in the Linux kernel, over netlink
crates/server	Sessions, the state machine, policy, configuration
crates/web	The status page, HTTP API and metrics
bin/bgp	The daemon

Development

CI runs these on every push, and fails on any warning:

cargo fmt --all -- --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --document-private-items

It also runs the tests that need a real Linux kernel (scripts/kernel-tests.sh) and the lab with FRR, BIRD and Routinator (scripts/interop/lab.sh); scripts/linux-vm.sh runs either from macOS.

Lints are configured once, under [workspace.lints] in the root Cargo.toml. unsafe code is forbidden throughout.

cargo test includes property tests: generated messages must survive being written and read back, and no input, however damaged, may make a parser panic. They take about a second; for a longer hunt:

PROPTEST_CASES=1000000 cargo test --release -p bgp-packet --test properties

Coverage-guided fuzz targets for the same parsers are in fuzz/; see fuzz/README.md. CI runs each of them for a minute.

License

Apache License 2.0; see LICENSE.