brnet/bird_config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

change 4.0

Browse Source
This commit is contained in:
gaoyuheng
2026-04-14 12:16:31 +08:00
parent 0b3d5d7d00
commit 6f634771cb
13 changed files with 234 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
bird/filter/inet_downstream.conf
View File

@@ -1,15 +1,18 @@
# 下游-收表控制器
function function_inet6_downstream_import() {
if is_bogon_prefix() || (bgp_path.len > 100) then return false;
bgp_large_community.add((LOCAL_ASN,200,0));
return true;
}
# 下游过滤器
# 政策：发全表，只收下游和关联下游的
# 下游-发表控制器
function function_inet6_downstream_export() {
# 过滤掉begon和过长的段子（太长了下游受不了）
if is_bogon_prefix() || (bgp_path.len > 100) then reject;
# BGP发出底线防控
if bgp_large_community !~ [(LOCAL_ASN, 200,0)] then return false;
if is_bogon_prefix() || (bgp_path.len > 20) then reject;
# 硬性限制，没有1000,0的，不放
if bgp_large_community !~ [(LOCAL_ASN, 1000,0)] then return false;
return true;
}
# 下游-收表控制器
# 注意，配置下游时候，一定要注意手打一个 300 0 ，不然发不出去
function function_inet6_downstream_import() {
if is_bogon_prefix() || (bgp_path.len > 20) then return false;
return true;
}

29
bird/filter/inet_filter.conf
View File

@@ -1,29 +0,0 @@
function function_inet4_bgp_import() {
if is_self_net() then return false;
if is_bogon_prefix() || (bgp_path.len > 100) then return false;
bgp_large_community.add((LOCAL_ASN,200,0));
return true;
}
function function_inet4_bgp_export() {
if !is_self_net() then return false;
if is_bogon_prefix() || (bgp_path.len > 100) then reject;
if source != RTS_STATIC then reject;
if bgp_large_community !~ [(LOCAL_ASN, 200,0)] then return false;
return true;
}
function function_inet6_bgp_import() {
if is_self_net() then return false;
if is_bogon_prefix() || (bgp_path.len > 100) then return false;
bgp_large_community.add((LOCAL_ASN,200,0));
return true;
}
function function_inet6_bgp_export() {
if !is_self_net() then return false;
if is_bogon_prefix() || (bgp_path.len > 100) then reject;
if source != RTS_STATIC then reject;
if bgp_large_community !~ [(LOCAL_ASN, 200,0)] then return false;
return true;
}

10
bird/filter/inet_import.conf Normal file
View File

@@ -0,0 +1,10 @@
# 对上游接收过滤器
# 政策：全网照单接受
function function_inet_bgp_import_from_upstream() {
if is_self_net() then return false;
if is_bogon_prefix() || (bgp_path.len > 20) then return false;
# 允许转发给下游
bgp_large_community.add((LOCAL_ASN,1000,0));
return true;
}

34
bird/filter/inet_upstream0.conf Normal file
View File

@@ -0,0 +1,34 @@
# 普通上游（发布控制器）
# 政策：只发自己的
function function_inet_bgp_export_to_upstream0() {
if !is_self_net() then return false;
if is_bogon_prefix() then return false;
if source != RTS_STATIC then return false;
# 100禁止性过滤
if bgp_large_community ~ [(LOCAL_ASN, 100, 100)] then return false;
if bgp_large_community ~ [(LOCAL_ASN, 100, 200)] then return false;
if bgp_large_community ~ [(LOCAL_ASN, 200, 201)] then return false;
# 前置过滤：允许自己的段子-所有上游和普通上游
if bgp_large_community ~ [(LOCAL_ASN, 200, 0)] then return true;
if bgp_large_community ~ [(LOCAL_ASN, 200, 1)] then return true;
if bgp_large_community ~ [(LOCAL_ASN, 200, 2)] then return false;
return false;
}
function function_inet_control_bgp_upstream0(int peer_asn){
# 1.禁止带有 201 0 (禁止一切外发)的发出去
if bgp_large_community ~ [(LOCAL_ASN, 201, 0)] then return false;
# 2.禁止带有 201 peer asn (禁止向某一外发)的发出去
if bgp_large_community ~ [(LOCAL_ASN, 201, peer_asn)] then return false;
# 3.不带202,0(允许全体外发)，但是带有202,peer asn（允许单一外发）的，放
if (bgp_large_community !~ [(LOCAL_ASN, 202, 0)]) then {
if bgp_large_community ~ [(LOCAL_ASN, 202, peer_asn)] then return true;
}
# 4.带有202,0（允许一切外发）的，放
if bgp_large_community ~ [(LOCAL_ASN, 202, 0)] then return true;
return false;
}

48
bird/filter/inet_upstream1.conf Normal file
View File

@@ -0,0 +1,48 @@
# 能带下游的上游（发布控制器）
# 政策：发自己的+下游的
function function_inet_bgp_export_to_upstream1() {
if source !~ [RTS_STATIC, RTS_BGP] then return false;
if is_bogon_prefix() then return false;
if bgp_large_community !~ [(LOCAL_ASN, 200, 0)] then return false;
# 100禁止性过滤
if bgp_large_community ~ [(LOCAL_ASN, 100, 100)] then return false;
if bgp_large_community ~ [(LOCAL_ASN, 100, 200)] then return false;
if bgp_large_community ~ [(LOCAL_ASN, 200, 202)] then return false;
if source == RTS_STATIC then {
# 静态路由，允许 200，[0 2]
if bgp_large_community ~ [(LOCAL_ASN, 200, 0)] then return true;
if bgp_large_community ~ [(LOCAL_ASN, 200, 2)] then return true;
if bgp_large_community ~ [(LOCAL_ASN, 200, 1)] then return false;
};
if source == RTS_BGP then {
# BGP路由，允许 300，0
if bgp_large_community ~ [(LOCAL_ASN, 300, 0)] then return true;
}
return false;
}
function function_inet_control_bgp_upstream1(int peer_asn){
# 1.禁止带有 201 0 (禁止一切外发) 301 0（禁止下游段子转发）的发出去
if bgp_large_community ~ [(LOCAL_ASN, 201, 0)] then return false;
if bgp_large_community ~ [(LOCAL_ASN, 301, 0)] then return false;
# 2.禁止带有 201 peer asn (禁止向某一外发) 301 peer asn（禁止向某一外发下游）的发出去
if bgp_large_community ~ [(LOCAL_ASN, 201, peer_asn)] then return false;
if bgp_large_community ~ [(LOCAL_ASN, 301, peer_asn)] then return false;
# 3.不带202,0(允许全体外发)，但是带有202,peer asn 放
if (bgp_large_community !~ [(LOCAL_ASN, 202, 0)]) then {
if bgp_large_community ~ [(LOCAL_ASN, 202, peer_asn)] then return true;
}
# 不带302 0，但是有302 peer asn的，放
if (bgp_large_community !~ [(LOCAL_ASN, 302, 0)]) then {
if bgp_large_community ~ [(LOCAL_ASN, 302, peer_asn)] then return true;
}
# 4.带有202,0（允许一切外发）和302 0的，放
if bgp_large_community ~ [(LOCAL_ASN, 202, 0)] then return true;
if bgp_large_community ~ [(LOCAL_ASN, 302, 0)] then return true;
return false;
}