dn42-bird-config/bird.conf

# Refer: https://dn42.dev/howto/Bird2
# Refer: https://lantian.pub/article/modify-website/bird-confederation.lantian

include "/etc/bird/net-info.conf";
include "/etc/bird/conf/net-info.conf";

router id OWNIP;

protocol device {
    scan time 10;
}

/*
 *  Utility functions
 */

function is_self_net() {
    return net ~ OWNNETSET;
}

function is_self_net_v6() {
    return net ~ OWNNETSETv6;
}

function is_valid_network() {
    return net ~ [
        172.20.0.0/14{21,29}, # dn42
        172.20.0.0/24{28,32}, # dn42 Anycast
        172.21.0.0/24{28,32}, # dn42 Anycast
        172.22.0.0/24{28,32}, # dn42 Anycast
        172.23.0.0/24{28,32}, # dn42 Anycast
        172.31.0.0/16+,       # ChaosVPN
        10.100.0.0/14+,       # ChaosVPN
        10.127.0.0/16{16,32}, # neonetwork
        10.0.0.0/8{15,24}     # Freifunk.net
    ];
}

roa4 table dn42_roa;
roa6 table dn42_roa_v6;

protocol static {
    roa4 { table dn42_roa; };
    include "/etc/bird/roa_dn42.conf";
};

protocol static {
    roa6 { table dn42_roa_v6; };
    include "/etc/bird/roa_dn42_v6.conf";
};

function is_valid_network_v6() {
    return net ~ [
        fd00::/8{44,64} # ULA address space as per RFC 4193
    ];
}

function is_kas_network() {
    if net ~ KASNET_SET then accept;
    if is_valid_network() && source ~ [RTS_STATIC, RTS_BGP] then {
        accept;
    } else reject;
}

function is_kas_network_v6() {
    if net ~ KASNET_SETv6 then accept;
    if is_valid_network_v6() && source ~ [RTS_STATIC, RTS_BGP] then {
        accept;
    } else reject;
}

protocol kernel {
    scan time 20;
    
    ipv6 {
        import none;
        export filter {
            if source = RTS_STATIC then reject;
            krt_prefsrc = OWNIPv6;
            accept;
        };
    };
};

protocol kernel {
    scan time 20;

    ipv4 {
        import none;
        export filter {
            if source = RTS_STATIC then reject;
            krt_prefsrc = OWNIP;
            accept;
        };
    };
}

protocol static {
    route OWNNET reject;

    ipv4 {
        import all;
        export none;
    };
}

protocol static {
    route OWNNETv6 reject;

    ipv6 {
        import all;
        export none;
    };
}

template bgp dn42_external_peer {
    local as OWNAS;
    path metric 1;
    
    ipv4 {
        import filter {
            if is_valid_network() && !is_self_net() then {
                if (roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID) then {
                    print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
                    reject;
                } else accept;
            } else reject;
        };

        export filter {
            bgp_path.delete(KASNET_ASSET);
            if is_valid_network() && source ~ [RTS_STATIC, RTS_BGP] then accept; else reject;
        };
        import limit 1000 action block;
    };

    ipv6 {
        import filter {
            if is_valid_network_v6() && !is_self_net_v6() then {
                if (roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID) then {
                    print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
                    reject;
                } else accept;
            } else reject;
        };
        export filter {
          bgp_path.delete(KASNET_ASSET);
          if is_valid_network_v6() && source ~ [RTS_STATIC, RTS_BGP] then accept; else reject;
        };
        import limit 1000 action block; 
    };
}

template bgp kas_edge_peer {
    local as KASNET_AS;
    confederation OWNAS;
    confederation member yes;
    path metric 1;
    direct;
    enable extended messages on;
    ipv4 {
        next hop self yes;
        import filter { is_kas_network(); };
        export filter { is_kas_network(); };
    };
    ipv6 {
        next hop self yes;
        import filter { is_kas_network_v6(); };
        export filter { is_kas_network_v6(); };
    };
};

template bgp kas_internal_peer {
    local as KASNET_AS;
    path metric 1;
    direct;
    enable extended messages on;
    ipv4 {
        next hop self yes;
        import filter { is_kas_network(); };
        export filter { is_kas_network(); };
    };
    ipv6 {
        next hop self yes;
        import filter { is_kas_network_v6(); };
        export filter { is_kas_network_v6(); };
    };
};

# Config for peering eBGPs
include "/etc/bird/conf/peers/*.conf";

# Config for peering edges (those nodes peering with eBGP)
include "/etc/bird/conf/edges/*.conf";

# Config for peering internals
include "/etc/bird/conf/internals/*.conf";