Skip to content

Latest commit

 

History

History
256 lines (163 loc) · 11.2 KB

README.rst

File metadata and controls

256 lines (163 loc) · 11.2 KB
Raw

ARouteServer

Documentation Build Status Unique test cases PYPI Version Python Versions

A Python tool to automatically build (and test) feature-rich configurations for BGP route servers.

How it works

  1. Two YAML files provide general policies and clients configurations options:

    cfg:
  rs_as: 64496
  router_id: "192.0.2.2"
  filtering:
    irrdb:
      enforce_origin_in_as_set: True
      enforce_prefix_in_as_set: True
    rpki_bgp_origin_validation:
      enabled: True
      reject_invalid: True
      ...
    clients:
  - asn: 64511
    ip:
    - "192.0.2.11"
    - "2001:db8:1:1::11"
    irrdb:
      as_sets:
        - "RIPE::AS-FOO"
  ...

  2. ARouteServer acquires external information to enrich them: i.e. bgpq4/bgpq3 for IRR data, PeeringDB for max-prefix limit and AS-SETs, RPKI ROAs, ...

  3. Jinja2 built-in templates are used to render the final route server's configuration file.

    Currently, BIRD (>= 1.6.3 up to 1.6.8), BIRD v2 (starting from 2.0.7), BIRD v3 (only for testing, still in pre-release/alpha) and OpenBGPD (OpenBSD >= 7.0 also OpenBGPD Portable >= 7.0) are supported, with almost feature parity between them.

Validation and testing of the configurations generated with this tool are performed using the built-in live tests framework: Docker instances are used to simulate several scenarios and to validate the behaviour of the route server after configuring it with ARouteServer. More details on the Live tests section.

A Docker-based playground is available to experiment with the tool in a virtual IXP environment.

Also, a Docker image is provided to start building rich and secure configurations in a couple of minutes.

Features

  • Path hiding mitigation techniques (RFC7947 section 2.3.1).
  • Basic filters (mostly enabled by default):
  • Prefixes and origin ASNs validation (also in tag-only mode):
    • IRR-based filters (RFC7948 section 4.6.2);
    • AS-SETs configured manually or fetched from PeeringDB;
    • support for IRR sources (RIPE::AS-FOO, RADB::AS-BAR);
    • white lists support;
    • extended dataset for filters generation:
    • RPKI-based filtering (BGP Prefix Origin Validation);
      • ROAs can be retrieved from publicly available JSON files or from a local validating cache;
    • Route Leak Prevention and Detection Using BGP Roles (RFC9234).
  • Blackhole filtering support:
    • optional NEXT_HOP rewriting;
    • signalling via BGP Communities (BLACKHOLE and custom communities);
    • client-by-client control over propagation.
  • Graceful shutdown support:
    • honor the GRACEFUL_SHUTDOWN BGP community received from clients (draft-ietf-grow-bgp-gshut-11);
    • allow to perform a graceful shutdown of the route server itself.
  • Control and informative BGP communities:
    • prefix/origin ASN present/not present in IRRDBs data;
    • do (not) announce to any / peer / on RTT basis;
    • prepend to any / peer / on RTT basis;
    • add NO_EXPORT / NO_ADVERTISE to any / peer;
    • 32bit ASNs mapping to 16bit ASNs for announcement control BGP communities;
    • Euro-IX large BGP communities to track reject reasons;
    • custom informational BGP communities.
  • Optional session features on a client-by-client basis:
  • Automatic building of clients list:
  • IX-F Member Export JSON files creation.
  • Related tools:

A comprehensive list of features can be found within the comments of the distributed configuration file on GitHub or on the documentation web page.

More feature are already planned: see the Future work section for more details.

Full documentation

Full documentation can be found on ReadTheDocs: https://arouteserver.readthedocs.org/

Presentations

  • Euro-IX "Learn with us: ARouteServer tutorial", 28 July 2021: video (33:13)
  • RIPE74, 10 May 2017, Connect Working Group: video (9:53), slides (PDF)
  • Salottino MIX, 30 May 2017: slides

Mentions / endorsements:

Who is using ARouteServer?

Are you using it? Do you want to be listed here? Drop me a message!

1: GoBGP configurations are generated using a fork of the project which is still WIP and that hopefully will be merged upstream in the future.

Bug? Issues? Support requests?

But also suggestions? New ideas?

Please create an issue on GitHub or drop me a message.

A Slack channel is also available on the network.toCode() community: arouteserver.

Author

Pier Carlo Chiodi - https://pierky.com

Blog: https://blog.pierky.com Twitter: @pierky