Rayhaan JaufeerallyandClaude Fable 5.1
fd496d26bf
Preparing to run ferrix next to BIRD on the production router. - build: the config proto is now parsed in pure Rust, so building needs no `protoc` binary. It previously worked only where one happened to be installed; the Dockerfile in this repo could not have built. - peers gain `local_address`, the source IP for connections we open (and therefore the next hop we advertise). When both speakers share a host the OS would otherwise pick an arbitrary local address and the peer, which identifies us by address, would refuse the session. Address-family mismatches are rejected at config load; an address the host lacks shows up as the peer's backoff reason. - docs/lab/prod/on-router: static musl cross-build instructions, config, hardened systemd unit (unprivileged, SIGTERM gives BIRD a Cease), loopback addresses for networkd, the BIRD stanza for a same-host multihop session, and reverse-proxy examples with TLS and a password, since the API has no authentication. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
83 lines
2.9 KiB
Protocol Buffer
83 lines
2.9 KiB
Protocol Buffer
syntax = "proto3";
|
|
|
|
package bgp.server;
|
|
|
|
// Top level BGP Server configuration.
|
|
message BgpConfig {
|
|
// The router ID, written as a dotted-quad IPv4 address (e.g. "192.0.2.1").
|
|
// Required even on IPv6-only routers per RFC 4271.
|
|
string router_id = 1;
|
|
|
|
// The local 4-byte AS number (RFC 6793).
|
|
uint32 local_asn = 2;
|
|
|
|
// Endpoints to accept incoming BGP connections on.
|
|
// Defaults to 0.0.0.0:179 and [::]:179 when empty.
|
|
repeated TcpEndpoint listen_endpoints = 3;
|
|
|
|
// Peers configured on this server.
|
|
repeated Peer peers = 4;
|
|
|
|
// Limits on routes originated locally (e.g. via the demo UI).
|
|
LocalRoutePolicy local_route_policy = 5;
|
|
|
|
// Where to serve the HTTP API, status page and metrics. The port is
|
|
// required. Unset disables the HTTP server.
|
|
TcpEndpoint http_endpoint = 6;
|
|
|
|
// Initial delay between attempts to connect to a configured peer, in
|
|
// seconds. Doubles after each failure up to two minutes. Defaults to 5.
|
|
uint32 connect_retry_seconds = 7;
|
|
|
|
// Connection collisions (RFC 4271 §6.8) against a session that is already
|
|
// Established are, by default, resolved by closing the new connection.
|
|
// When true they are resolved like any other collision: the connection
|
|
// initiated by the higher BGP Identifier survives, and a second connection
|
|
// opened by the same side replaces the first. This lets a peer that
|
|
// restarted take over from a session we have not yet noticed is dead,
|
|
// instead of being refused until the hold timer expires.
|
|
bool collision_detect_established_state = 8;
|
|
}
|
|
|
|
// Limits on locally originated routes.
|
|
message LocalRoutePolicy {
|
|
// A locally originated route is accepted only if it is covered by one of
|
|
// these prefixes, written in CIDR notation (e.g. "10.100.0.0/16").
|
|
// Empty means any prefix may be announced.
|
|
repeated string allowed_prefixes = 1;
|
|
|
|
// Maximum number of routes a single owner may announce. 0 means unlimited.
|
|
uint32 max_routes_per_owner = 2;
|
|
}
|
|
|
|
// An IP address and port pair.
|
|
message TcpEndpoint {
|
|
// IP address (V4 or V6).
|
|
string address = 1;
|
|
// TCP port. Defaults to 179 for BGP when unset.
|
|
uint32 port = 2;
|
|
}
|
|
|
|
// Configuration of a BGP peer.
|
|
message Peer {
|
|
// Human-readable name for logging and diagnostics.
|
|
string name = 1;
|
|
|
|
// Address and port to connect to for this peer.
|
|
TcpEndpoint endpoint = 2;
|
|
|
|
// The peer's 4-byte AS number (RFC 6793).
|
|
uint32 remote_asn = 3;
|
|
|
|
// Hold time to advertise in the OPEN message, in seconds (RFC 4271 §4.2).
|
|
// Must be 0 or >= 3. Defaults to 90 when unset.
|
|
uint32 hold_time_seconds = 4;
|
|
|
|
// Source IP address for connections we open to this peer. It is also the
|
|
// next hop of the routes we send it. Required when the peer identifies us
|
|
// by address and the host has several, e.g. when both speakers run on the
|
|
// same machine. Must be the same address family as the endpoint. Unset
|
|
// lets the operating system choose.
|
|
string local_address = 5;
|
|
}
|