From 204a5bb09bbb5888621edb25de2b1faad34ab781 Mon Sep 17 00:00:00 2001 From: Trygve Laugstøl Date: Wed, 21 Aug 2024 19:46:29 +0200 Subject: coregonus --- tnet/files/coregonus/bird-tnet-pre.conf | 20 +++++++++++++++ tnet/files/coregonus/bird-tnet.conf | 43 +++++++++++++++++++++++++++++++++ tnet/files/knot/bird-tnet.conf | 14 +++++++++++ tnet/host_vars/coregonus/bird.yml | 4 +++ tnet/host_vars/coregonus/wg.yml | 5 ++++ tnet/host_vars/knot/bird.yml | 4 +++ tnet/host_vars/knot/wg.yml | 6 ++++- tnet/host_vars/kv24ix/wg.yml | 1 + tnet/keys/wg-coregonus-knot.pub | 1 + tnet/keys/wg-coregonus-knot.sops.key | 28 +++++++++++++++++++++ tnet/keys/wg-knot-coregonus.pub | 1 + tnet/keys/wg-knot-coregonus.sops.key | 28 +++++++++++++++++++++ 12 files changed, 154 insertions(+), 1 deletion(-) create mode 100644 tnet/files/coregonus/bird-tnet-pre.conf create mode 100644 tnet/files/coregonus/bird-tnet.conf create mode 100644 tnet/host_vars/coregonus/bird.yml create mode 100644 tnet/host_vars/coregonus/wg.yml create mode 100644 tnet/keys/wg-coregonus-knot.pub create mode 100644 tnet/keys/wg-coregonus-knot.sops.key create mode 100644 tnet/keys/wg-knot-coregonus.pub create mode 100644 tnet/keys/wg-knot-coregonus.sops.key (limited to 'tnet') diff --git a/tnet/files/coregonus/bird-tnet-pre.conf b/tnet/files/coregonus/bird-tnet-pre.conf new file mode 100644 index 0000000..d60e8df --- /dev/null +++ b/tnet/files/coregonus/bird-tnet-pre.conf @@ -0,0 +1,20 @@ +define tnet = fdb1:4242:3538:2000::/52; + +function is_tnet() -> bool +{ + return net ~ tnet; +} + +roa6 table dn42_roa; + +protocol static { + roa6 { table dn42_roa; }; + include "/etc/bird/dn42_roa_bird2_6.conf"; +}; + +function dn42_is_valid_network() -> bool +{ + return net ~ [ + fd00::/8{44,64} # ULA address space as per RFC 4193 + ]; +} diff --git a/tnet/files/coregonus/bird-tnet.conf b/tnet/files/coregonus/bird-tnet.conf new file mode 100644 index 0000000..95ede41 --- /dev/null +++ b/tnet/files/coregonus/bird-tnet.conf @@ -0,0 +1,43 @@ +# Set to true if this peer is directly connected to a dn42 peer +define is_dn42_peer = true; +# If we are connected directly to dn42, we don't want the dn42 routes from others +define import_dn42 = !is_dn42_peer; +define export_dn42 = is_dn42_peer; + +template bgp tnet_tpl { + local as 4242423538; + neighbor internal; + + direct; + + password "trygvis"; + + ipv6 { + next hop self; + import filter { + if is_tnet() then { + accept proto, ": (tnet) import accept, net=", net, ", from=", from, ", gw=", gw; + } else if import_dn42 && dn42_is_valid_network() then { + accept proto, ": (dn42) import accept, net=", net, ", from=", from, ", gw=", gw; + } else { + reject proto, ": import reject, reason=not tnet"; + } + }; + # newer bird's only + # import keep filtered; + export filter { + if is_tnet() then { + accept proto, ": (tnet) export accept, net=", net, ", from=", from, ", gw=", gw; + } else if export_dn42 && dn42_is_valid_network() then { + accept proto, ": (dn42) import accept, net=", net, ", from=", from, ", gw=", gw; + } else { + reject proto, ": export reject, reason=not tnet"; + } + }; + }; +} + +protocol bgp tnet_knot from tnet_tpl { + neighbor fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d2; + interface "tnet-knot"; +} diff --git a/tnet/files/knot/bird-tnet.conf b/tnet/files/knot/bird-tnet.conf index fd5332a..e774e31 100644 --- a/tnet/files/knot/bird-tnet.conf +++ b/tnet/files/knot/bird-tnet.conf @@ -44,6 +44,13 @@ protocol bgp tnet_conflatorio from tnet_tpl { rr client; } +protocol bgp tnet_coregonus from tnet_tpl { + neighbor fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d3; + interface "tnet-coregonus"; + + rr client; +} + protocol bgp tnet_hash from tnet_tpl { neighbor fe80:3b20:4cb0:5315:22a:c7de:a45b:8a7d; interface "tnet-hash"; @@ -51,6 +58,13 @@ protocol bgp tnet_hash from tnet_tpl { rr client; } +protocol bgp tnet_kv24ix from tnet_tpl { + neighbor fe80:fef1:078a:5b64:efd3:ae7b:d286:d7cf; + interface "tnet-kv24ix"; + + rr client; +} + protocol bgp tnet_lhn2pi from tnet_tpl { neighbor fdb1:4242:3538:ffff:374e:2c7d:319e:e527; interface "tnet-lhn2pi"; diff --git a/tnet/host_vars/coregonus/bird.yml b/tnet/host_vars/coregonus/bird.yml new file mode 100644 index 0000000..816b95a --- /dev/null +++ b/tnet/host_vars/coregonus/bird.yml @@ -0,0 +1,4 @@ +tnet_bird_peers: + knot: + +birdv: 2015 diff --git a/tnet/host_vars/coregonus/wg.yml b/tnet/host_vars/coregonus/wg.yml new file mode 100644 index 0000000..0d80a18 --- /dev/null +++ b/tnet/host_vars/coregonus/wg.yml @@ -0,0 +1,5 @@ +tnet_wg: + knot: + endpoint: knot.inamo.no:51011 + address: fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d3 + diff --git a/tnet/host_vars/knot/bird.yml b/tnet/host_vars/knot/bird.yml index a9175e8..94c610a 100644 --- a/tnet/host_vars/knot/bird.yml +++ b/tnet/host_vars/knot/bird.yml @@ -2,8 +2,12 @@ tnet_bird_peers: conflatorio: rr_client: true interface: tnet-confltrio + coregonus: + rr_client: true hash: rr_client: true + kv24ix: + rr_client: true node1: rr_client: true node2: diff --git a/tnet/host_vars/knot/wg.yml b/tnet/host_vars/knot/wg.yml index b382831..243c9f2 100644 --- a/tnet/host_vars/knot/wg.yml +++ b/tnet/host_vars/knot/wg.yml @@ -9,7 +9,7 @@ tnet_wg: address: fdb1:4242:3538:ffff:18b7:d3ec:5608:db9a kv24ix: port: 51003 - address: fdb1:4242:3538:ffff:ea4:11cb:863:5252 + address: fe80:fef1:078a:5b64:efd3:ae7b:d286:d7ce akili: port: 51004 address: fdb1:4242:3538:ffff:59d7:cf77:8b5d:761a @@ -34,3 +34,7 @@ tnet_wg: if_name: confltrio port: 51010 address: fe80:47fc:0660:b91f:1063:a6ae:46bb:7589 + coregonus: + if_name: coregonus + port: 51011 + address: fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d2 diff --git a/tnet/host_vars/kv24ix/wg.yml b/tnet/host_vars/kv24ix/wg.yml index 9cfdc5d..99c54b6 100644 --- a/tnet/host_vars/kv24ix/wg.yml +++ b/tnet/host_vars/kv24ix/wg.yml @@ -1,2 +1,3 @@ tnet_wg: knot: + address: fe80:fef1:078a:5b64:efd3:ae7b:d286:d7cf diff --git a/tnet/keys/wg-coregonus-knot.pub b/tnet/keys/wg-coregonus-knot.pub new file mode 100644 index 0000000..181fd56 --- /dev/null +++ b/tnet/keys/wg-coregonus-knot.pub @@ -0,0 +1 @@ +uOqXlYKRgwBXVKPAaPn2fx4YtMHCH5M2qQ3hs/tZwms= diff --git a/tnet/keys/wg-coregonus-knot.sops.key b/tnet/keys/wg-coregonus-knot.sops.key new file mode 100644 index 0000000..b3c6239 --- /dev/null +++ b/tnet/keys/wg-coregonus-knot.sops.key @@ -0,0 +1,28 @@ +{ + "data": "ENC[AES256_GCM,data:aPPYaRDzczKgMZxWKJXE5X7JC0pQxs9W0d3UZjY8QYLhxmxk8L+RpX6zWscR,iv:CE+JgwUMdkbFDrkk53ow77ehm3GEmeJFnVM5jbWXZIY=,tag:mlnV5SNhIOnU/+TnOWiU0g==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMWml3V0dCRStJY0RsUEN5\nSVhya1dXYW5GQ0R1a1h3NVJMV09LbVV1eXhNCmFMS2JYVzVPbS95TmwxWG04emtO\nd3B5QUtxWGVaWTlpUDN4ZVErZ1BqcEEKLS0tIE9iTjJaN0RaZjJQeG5Zd1Z5Ylp1\nYkwxS0JqVzNLNHBkSjM0b2owcURZN1UKj5i3uMAwhcqM/vB6faF2vq3ndEYGEOAn\nH1m4LdRj0b03BOtz5vz5oeF+nW3e8rGwhq84N7UFdI4W+9w3ZCI2AQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMVGdPaERQRWNodnpmOUFM\nWG1QSGhJUmoyamplMFFsK3krNzd4ZHVvdlY0Cit3UHNzNUVIVWlZakNsTUFNVlA1\neE9rNTliWmZ0a295UVJZUXo3dk9WTkkKLS0tIDE2SjE1bXFVdno5NkwwQk15UGZY\nczBPTTUwdTBJT0laWWJsWmJmNDFuUG8KRlCmMio144qdPuPXuxc2AEHhdUxbJT8W\nDp7Atk0G57V57tX/zk1RaXjp+ORStvwpgDAdCwmikt1PW78Y6x77tQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpYWlHRUVTV1RreFExcDBj\nYmI3OTBpRnEwd0FBTDdPTHI1OVhRYmlZMGdFCjlHTWJPY0lSRVhPSTQyNEgxYkMy\nY3ljMnhKeURSL2JwcDd3dmlubW15bFEKLS0tIEZHUG9NUmNnUlh2NjlTd1RsYytR\nVDI0OVhZeGhyWFVFcU9URE1NRXpnR00KUO2W8ab2RehPhEAjFlOXWrr2rn55gBR5\neSvOtAPEEV1lWO+O0r3jOFpnUI/ahgPeBhMoLFOdionm3GPrYzf8aQ==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2024-08-20T22:51:59Z", + "mac": "ENC[AES256_GCM,data:4haVcOm18uCW8LK06wURyf32qr9ZXnjc6feJHf4T85C0COrmZ7AmxUZKt5Mi9YoPO7dTMpjcvnxhEVEP4x6/wBc3SB5RpRSWU25GZ4/ofnqR/xBH0R1edirQtuhsDJeR3rYnTYeMjRltf9zpZknED907GRmmddaO15xsWtU8/t8=,iv:wXMIQRj4mV7SNnUqC3XVM/8mEhbPMwL1Z4/LrIBqpcs=,tag:i6CSlmj2449GgMqosa8e0A==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.7.3" + } +} \ No newline at end of file diff --git a/tnet/keys/wg-knot-coregonus.pub b/tnet/keys/wg-knot-coregonus.pub new file mode 100644 index 0000000..7fc1905 --- /dev/null +++ b/tnet/keys/wg-knot-coregonus.pub @@ -0,0 +1 @@ +lTuzdN+En+Jc8v9+cTx2U455mw6v+fl/QsWWxO7ZYgI= diff --git a/tnet/keys/wg-knot-coregonus.sops.key b/tnet/keys/wg-knot-coregonus.sops.key new file mode 100644 index 0000000..6acb9ef --- /dev/null +++ b/tnet/keys/wg-knot-coregonus.sops.key @@ -0,0 +1,28 @@ +{ + "data": "ENC[AES256_GCM,data:NhASCvnUd1DDdo8qQ8MNY+KXMa9fACx7DNEwNwwLgjuwSu+bV42z/OYTY6Ck,iv:z0mGt+HuBwuS+WnbuomGwqReCXqEfIC+qPOuz+JciSw=,tag:sCUW0nXWJWgxYEAbkp+7JQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTWY3a0xxbzJnVm1GRHdU\nZU1IcnhKQkdEVjBtNFRIb0swWHlqdldFSUR3Ckg4dGlERkV4Ly93YVRwSjBJdzB0\nS1hmSkNQY2ROdDBZVTVmODRUR2Z4bmMKLS0tIFh0ZDJ1d2ViMFVwNlRkY3d6eU5E\nbHVhSXVCRWI2b2NKVVI1cGVjL3RGaVEKgFzmd42NmzH4GH4Vuklcd1jkCJnngloO\nN4Q5/NdHij8fXWnhkuV/8xX7KnBXEGX5uHo9pYd1aYzyZTUD40rDyw==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TmJ4UjZBN2pFU2dBZXdG\naDNtQUhGdkFnYkh5OXVlYTZ6c1N0YWpaTnpNCnZMWFgrWFpNd0tqVGpyN2NIZnlo\ncTRlQ1Q4UGJySm16TThwS0V1dW1nTlUKLS0tIGgzWjQvZ0hETW15TTV4S0Q1K1V5\naDFMODFVcVB4cmxnYXR5RTRnanQ0bVkKPZ/caVVhPQ/0I5X3A70czYnMNgw/l39W\nrf75d5RK5x5FcgZenz23l00g+AUt8uNfct+3YHc15OjL+vOrtm1NCQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjalBWcXg5NVlFS3Bjb0Vt\nUXlhNVNxMmtIMVhEdC8rb2h5UEJxUVpUckI0Ci9BaUM3YWJSczI1RVNQWGtIZllI\nQmhuK2dyMUwvRlpORUZDK2thWldUdFkKLS0tIDA2UVBzbTQ3aDEwcXNHcjRoMkNW\nRXhmZ3hmUlhVR0xzaWU1MDZBUW1zcTAKkkyLoqodk7FWwZV07wlkttEs115/v9ZI\nOVfi+VzkI++jLW2KzL1S1i1N+/BHnfXDnzNDaIqUTRrFi5jhd1kk0A==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2024-08-20T23:20:12Z", + "mac": "ENC[AES256_GCM,data:l4s7OdTHRqBXVGHpCQMo/k6nwwPEcWK8J47n1b8pQSDuO4DFcB/ApI8rNKgFAujXLUwB10YeRwp0bcLdlGREt7PhcHhddNB5yRYx/8djqYpm0w3rSAN9p4IW5CNB5LmfdxQk2dI0Ow8wxw8UzTVO08T7cDNeYRZdQTJLd+VUhCo=,iv:Ffv/pz30FwLaho3Y2HlMO11jKIl71GUpKMe1cSMNOwo=,tag:Qo3ZSTnJa26jYdwJtGvmyQ==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.7.3" + } +} \ No newline at end of file -- cgit v1.2.3