Merge pull request #195 from ruby-no-kai/inside-outside

plat: respect routes from outside interface

Author: sorah

itamae/roles/plat/templates/etc/bird/bird.conf.d/plat.conf

@@ -14,6 +14,7 @@ protocol direct {
   ipv6 {
     table bgp6;
   };
+  interface "-me0", "<%= node.dig(:plat, :interfaces).fetch(:outside).fetch(:name) %>", "<%= node.dig(:plat, :interfaces).fetch(:inside).fetch(:name) %>", "lo";
 }
 
 protocol kernel kernel_bgp4 {
@@ -142,21 +143,23 @@ protocol bgp bgp_outside {
 
   ipv4 {
     table bgp4;
-    import filter {
-      if net = 0.0.0.0/0 then accept;
-      reject;
-    };
+    import all;
     export filter {
       if dest = RTD_UNREACHABLE then reject; # static recursive route can be RTD_UNREACHABLE when unresolvable
+      if proto = "direct1" then accept;
       if net = <%= node.dig(:plat, :nat64).fetch(:outer_public) %>/32 then accept;
       if net = <%= node.dig(:plat, :nat64).fetch(:outer_private) %>/32 then accept;
       reject;
     };
   };
   ipv6 {
     table bgp6;
-    import none;
-    export none;
+    import all;
+    export filter {
+      if dest = RTD_UNREACHABLE then reject; # static recursive route can be RTD_UNREACHABLE when unresolvable
+      if proto = "direct1" then accept;
+      reject;
+    };
   };
 }
 
@@ -169,23 +172,30 @@ protocol bgp bgp_inside {
   ipv4 {
     table bgp4;
     import filter {
-      if net ~ [10.33.0.0/16+] then accept;
+      if bgp_path ~ [= * <%= inside.fetch(:peer_as) %> =] then accept; # accept only direct path
       reject;
     };
     export filter {
       if dest = RTD_UNREACHABLE then reject; # static recursive route can be RTD_UNREACHABLE when unresolvable
-      if net ~ [10.33.0.0/16+] then accept;
+      if proto = "direct1" then accept;
+      if net !~ [10.33.0.0/16+] then reject;
+      if proto = "static1" then accept;
+      if proto = "static_bgp4" then accept;
       reject;
     };
   };
   ipv6 {
     table bgp6;
     import filter {
-      if net ~ [2001:df0:8500:ca00::/56+] then accept;
+      if bgp_path ~ [= * <%= inside.fetch(:peer_as) %> =] then accept; # accept only direct path
+      reject;
     };
     export filter {
       if dest = RTD_UNREACHABLE then reject; # static recursive route can be RTD_UNREACHABLE when unresolvable
-      if net ~ [2001:df0:8500:ca00::/56{56,64}] then accept;
+      if proto = "direct1" then accept;
+      if net !~ [2001:df0:8500:ca00::/56{56,64}] then reject;
+      if proto = "static1" then accept;
+      if proto = "static_bgp6" then accept;
     };
   };
 }