bird: Add common configuration to container

3 files changed, 111 insertions, 3 deletions

diff --git a/bird/Dockerfile b/bird/Dockerfile
index 93d6352..c8dfd65 100644
--- a/bird/Dockerfile
+++ b/bird/Dockerfile
@@ -1,8 +1,11 @@
 FROM alpine:edge
 LABEL maintainer="Mike Crute <mike@crute.us>"
 
-RUN \
+RUN set -euxo pipefail; \
     echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories; \
-    apk add --no-cache bird
+    apk add --no-cache bird;
 
-CMD [ "/usr/sbin/bird", "-f", "-c", "/srv/bird/bird.conf" ]
+ADD entrypoint.sh /
+ADD bird_common.conf /etc
+
+ENTRYPOINT [ "/entrypoint.sh" ]
diff --git a/bird/bird_common.conf b/bird/bird_common.conf
new file mode 100644
index 0000000..2f7f9ac
--- /dev/null
+++ b/bird/bird_common.conf
@@ -0,0 +1,90 @@
+protocol device {
+};
+
+function is_self_net() {
+  return net ~ OWNNETS;
+};
+
+function is_valid_network() {
+  return net ~ [
+    172.16.0.0/12+,
+    192.168.0.0/16+,
+    10.0.0.0/8+,
+    100.64.0.0/10+,
+    2000::/3+,
+    fd00::/8+
+  ];
+};
+
+protocol kernel {
+  ipv4 {
+    import none;
+    export filter {
+      if source = RTS_STATIC && proto != "vpnras_v4" && proto != "hack_v4" then reject;
+      krt_prefsrc = OWNIP4;
+      accept;
+    };
+  };
+};
+
+protocol kernel {
+  ipv6 {
+    import none;
+    export filter {
+      if source = RTS_STATIC && proto != "vpnras_v6" && proto != "hack_v6" then reject;
+      krt_prefsrc = OWNIP6;
+      accept;
+    };
+  };
+};
+
+template bgp v4peers {
+  local as OWNAS;
+
+  ipv4 {
+    # this lines allows debugging filter rules
+    # filtered routes can be looked up in birdc using the "show route filtered" command
+    import keep filtered;
+    import filter {
+      # accept every subnet, except our own advertised subnet
+      # filtering is important, because some guys try to advertise routes like 0.0.0.0
+      if is_valid_network() && !is_self_net() then {
+        accept;
+      }
+      reject;
+    };
+    export filter {
+      if is_valid_network() then {
+        accept;
+      }
+      reject;
+    };
+    import limit 1000 action block;
+  };
+};
+
+template bgp v6peers {
+  local as OWNAS;
+
+  ipv6 {
+    # this lines allows debugging filter rules
+    # filtered routes can be looked up in birdc using the "show route filtered" command
+    import keep filtered;
+    import filter {
+      # accept every subnet, except our own advertised subnet
+      # filtering is important, because some guys try to advertise routes like 0.0.0.0
+      if is_valid_network() && !is_self_net() then {
+        accept;
+      }
+      reject;
+    };
+    export filter {
+      if is_valid_network() then {
+        accept;
+      }
+      reject;
+    };
+    import limit 1000 action block;
+  };
+};
+
diff --git a/bird/entrypoint.sh b/bird/entrypoint.sh
new file mode 100755
index 0000000..54aab0d
--- /dev/null
+++ b/bird/entrypoint.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+PROFILE="$1"
+
+if [ -z "$PROFILE" ]; then
+    echo "Profile must be specified on the command line"
+    exit 1
+fi
+
+if [ ! -e "/srv/bird/${PROFILE}.conf" ]; then
+    echo "Profile '$PROFILE' does not exist"
+    exit 1
+fi
+
+exec /usr/sbin/bird -d -f -c /srv/bird/${PROFILE}.conf