diff --git a/Makefile.in b/Makefile.in index 63d3351f..a5e80ff4 100644 --- a/Makefile.in +++ b/Makefile.in @@ -10,6 +10,7 @@ CPPFLAGS=-I$(objdir) -I$(srcdir) @CPPFLAGS@ CFLAGS=$(CPPFLAGS) @CFLAGS@ LDFLAGS=@LDFLAGS@ LIBS=@LIBS@ +DAEMON_LIBS=@DAEMON_LIBS@ CLIENT_LIBS=@CLIENT_LIBS@ CC=@CC@ M4=@M4@ @@ -58,6 +59,8 @@ all: daemon cli daemon: $(daemon) cli: $(client) +$(daemon): LIBS += $(DAEMON_LIBS) + # Include directories dirs := client conf doc filter lib nest test $(addprefix proto/,$(protocols)) @sysdep_dirs@ diff --git a/configure.in b/configure.in index 8a825bf2..32344d1f 100644 --- a/configure.in +++ b/configure.in @@ -10,6 +10,7 @@ AC_ARG_ENABLE(debug, [ --enable-debug enable internal debugging routin AC_ARG_ENABLE(memcheck, [ --enable-memcheck check memory allocations when debugging (default: enabled)],,enable_memcheck=yes) AC_ARG_ENABLE(client, [ --enable-client enable building of BIRD client (default: enabled)],,enable_client=yes) AC_ARG_ENABLE(pthreads, [ --enable-pthreads enable POSIX threads support (default: detect)],,enable_pthreads=try) +AC_ARG_ENABLE(libssh, [ --enable-libssh enable LibSSH support together with RPKI protocol (default: detect)],,enable_libssh=try) AC_ARG_WITH(sysconfig, [ --with-sysconfig=FILE use specified BIRD system configuration file]) AC_ARG_WITH(protocols, [ --with-protocols=LIST include specified routing protocols (default: all)],,[with_protocols="all"]) AC_ARG_WITH(sysinclude, [ --with-sysinclude=PATH search for system includes on specified place]) @@ -86,6 +87,21 @@ if test "$enable_pthreads" != no ; then fi fi +if test "$enable_libssh" != no ; then + AC_CHECK_LIB(ssh, ssh_connect) + if test $ac_cv_lib_ssh_ssh_connect = yes ; then + proto_rpki=rpki + enable_libssh=yes + AC_DEFINE(HAVE_LIBSSH) + else + if test "$enable_libssh" = yes ; then + AC_MSG_ERROR([LibSSH not available.]) + else + enable_libssh=no + fi + fi +fi + if test "$bird_cflags_default" = yes ; then BIRD_CHECK_GCC_OPTION(bird_cv_c_option_wno_pointer_sign, -Wno-pointer-sign, -Wall) BIRD_CHECK_GCC_OPTION(bird_cv_c_option_wno_missing_init, -Wno-missing-field-initializers, -Wall -Wextra) @@ -169,8 +185,8 @@ fi AC_SUBST(iproutedir) -# all_protocols="$proto_bfd babel bgp ospf pipe radv rip static" -all_protocols="$proto_bfd bgp ospf pipe radv rip static" +# all_protocols="$proto_bfd babel bgp ospf pipe radv rip $proto_rpki static" +all_protocols="$proto_bfd bgp ospf pipe radv rip $proto_rpki static " all_protocols=`echo $all_protocols | sed 's/ /,/g'` @@ -231,6 +247,9 @@ if test "$enable_debug" = yes ; then fi fi +DAEMON_LIBS= +AC_SUBST(DAEMON_LIBS) + CLIENT=birdcl CLIENT_LIBS= if test "$enable_client" = yes ; then diff --git a/doc/bird.sgml b/doc/bird.sgml index e70232d1..a734b2ff 100644 --- a/doc/bird.sgml +++ b/doc/bird.sgml @@ -3788,8 +3788,8 @@ protocol rip [<name>] {

RIP defines two route attributes: - - RIP metric of the route (ranging from 0 to int + RIP metric of the route (ranging from 0 to +RPKI + +Introduction + +

The Resource Public Key Infrastructure (RPKI) is mechanism for origin +validation of BGP routes (RFC 6480). BIRD supports only so-called RPKI-based +origin validation. There is implemented RPKI to Router (RPKI-RTR) protocol (RFC +6810). It uses some of the RPKI data to allow a router to verify that the +autonomous system announcing an IP address prefix is in fact authorized to do +so. This is not crypto checked so can be violated. But it should prevent the +vast majority of accidental hijackings on the Internet today, e.g. the famous +Pakastani accidental announcement of YouTube's address space. + +

The RPKI-RTR protocol receives and maintains a set of ROAs from a cache +server (also called validator). You can validate routes (RFC 6483) using +function reload in for manual call of revalidation of all +routes. + +Supported transports + + Unprotected transport over TCP uses a port 323. The cache server + and BIRD router should be on the same trusted and controlled network + for security reasons. + SSHv2 encrypted transport connection uses the normal SSH port + 22. + + +Configuration + +

We currently support just one cache server per protocol. However you can +define more RPKI protocols generally. + + +protocol rpki [<name>] { + roa4 { table <tab>; }; + roa6 { table <tab>; }; + remote <ip> | "<domain>" [port <num>]; + port <num>; + refresh [keep] <num>; + retry [keep] <num>; + expire [keep] <num>; + transport tcp; + transport ssh { + bird private key "</path/to/id_rsa>"; + remote public key "</path/to/known_host>"; + user "<name>"; + }; +} + + +

Alse note that you have to specify ROA table into which will be imported +routes from a cache server. If you want to import only IPv4 prefixes you have +to specify only roa4 table. Similarly with IPv6 prefixes only. If you want to +fetch both IPv4 and even IPv6 ROAs you have to specify both types of ROA +tables. + +RPKI protocol options + + + remote Specifies + a destination address of the cache server. Can be specified by an IP + address or by full domain name string. Only one cache can be specified + per protocol. This option is required. + + port Specifies the port number. The default port + number is 323 for transport without any encryption and 22 for transport + with SSH encryption. + + refresh [keep] Time period in seconds. Tells how + long to wait before next attempting to poll the cache using a Serial + Query or a Reset Query packet. Must be lower than 86400 seconds (one + day). Too low value can caused a false positive detection of + network connection problems. A keyword retry [keep] Time period in seconds between a failed + Serial/Reset Query and a next attempt. Maximum allowed value is 7200 + seconds (two hours). Too low value can caused a false positive + detection of network connection problems. A keyword expire [keep] Time period in seconds. Received + records are deleted if the client was unable to successfully refresh + data for this time period. Must be in range from 600 seconds (ten + minutes) to 172800 seconds (two days). A keyword transport tcp Unprotected transport over TCP. It's a default + transport. Should be used only on secure private networks. + Default: tcp + + transport ssh { It enables a + SSHv2 transport encryption. Cannot be combined with a TCP transport. + Default: off + + +SSH transport options + + bird private key "/path/to/id_rsa" + A path to the BIRD's private SSH key for authentication. + It can be a id_rsa file. + + remote public key "/path/to/known_host" + A path to the cache's public SSH key for verification identity + of the cache server. It could be a path to known_host file. + + user " + A SSH user name for authentication. This option is a required. + + +Examples +BGP origin validation +

Policy: Don't import +roa4 table r4; +roa6 table r6; + +protocol rpki { + debug all; + + roa4 { table r4; }; + roa6 { table r6; }; + + # Please, do not use rpki-validator.realmv6.org in production + remote "rpki-validator.realmv6.org" port 8282; + + retry keep 5; + refresh keep 30; + expire 600; +} + +filter peer_in { + if (roa_check(r4, net, bgp_path.last) = ROA_INVALID || + roa_check(r6, net, bgp_path.last) = ROA_INVALID) then + { + print "Ignore invalid ROA ", net, " for ASN ", bgp_path.last; + reject; + } + accept; +} + +protocol bgp { + debug all; + local as 65000; + neighbor 192.168.2.1 as 65001; + import filter peer_in; +} + + +SSHv2 transport encryption + +roa4 table r4; +roa6 table r6; + +protocol rpki { + debug all; + + roa4 { table r4; }; + roa6 { table r6; }; + + remote 127.0.0.1 port 2345; + transport ssh { + bird private key "/home/birdgeek/.ssh/id_rsa"; + remote public key "/home/birdgeek/.ssh/known_hosts"; + user "birdgeek"; + }; + + # Default interval values +} + + + Static