Move the Tor exit nodes to their own VLAN, and their own address space. Background for move ------------------- For the first Tor exit node, we where able to create inet6num object 2a01:4262:1ab:20::71/128. So we could assign a specific Tor abuse contact. When we added the second node it was no longer possible to create /128 inet6num objects, but only up to /64. We therefore need to move our Tor exit nodes to a dedicated address space. Connection tracking ------------------- Connection tracking is quite expensive, so it's better to only do it for Tor traffic, when we actually need it, which is only when internal clients need to access the servers. In the future conntrack could also be disabled for labicolo in general. Current stats ~~~~~~~~~~~~~ [root@space ~]# grep -v '185\.38\.175\.7[12] ' /proc/net/nf_conntrack | grep -v '2a01:4262:01ab:0020:0000:0000:0000:007[12]' | wc -l 4071 [root@space ~]# wc -l /proc/net/nf_conntrack 39138 /proc/net/nf_conntrack Currently 4071 out of 39138 connections are not Tor related. Also reading /proc/net/nf_conntrack is quite slow atm.: [root@space ~]# time cat /proc/net/nf_conntrack > /dev/null real 0m35.097s user 0m0.010s sys 0m28.114s Signed-off-by: Asbjørn Sloth Tønnesen <asbjorn@labitat.dk>
Until now BGP connections have only been established when the space server has initiated the connection to the peer. It's best practice for both BGP speakers to be able to connect to one another, lowering recovery time.
This patch changes the reverse path filtering of the labicolo VLAN to take place in the prerouting hook, using the kernel routing table, and removes the need to maintain a static prefix list. Labicolo routes are exported to the kernel routing table by BIRD, hence it should be sufficient to only have prefix lists there. This change has been tested, and it's only possible to spoof fellow labicolo members address space (same as before). Esmil: prerouting before input/forward makes more sense to me
Now that we use communities, we don't need this prefix filter anymore, only the per-customer prefix filters.
We only announce a prefix, if we have recieved it from a customer connection or if we originate it our self. This way we avoid announcing prefixes matching the earlier used, prefix list if we haven't recieved it via the customer connection. This is important for multi-homed labicolo customers. Esmil: consistent brace placement
Assign large communities on prefix import. Later we can then use the community, to decide if we should announce it to our peers.
This patch prepares us for adopting Large BGP Communities (RFC 8092). Basic format of Large BGP Communities: <uint32_t asn>:<uint32_t function>:<uint32_t value> We use function 1 for storing prefix type (or relation). We then assign a value to transit, peering, customer and originated prefixes. Large BGP Communities http://largebgpcommunities.net/ https://tools.ietf.org/html/rfc8092 https://tools.ietf.org/html/rfc8195 Esmil: consistent brace placement
This protects us amount otherthings against 3rd parties resetting the TCP connection underneat our BGP sessions. This has been enabled in both ends, and this _MUST_ remain enabled, otherwise these sessions will go down. If this needs to be disabled for some reason then it must be coordinated with Fiberby. RFC 5082 - The Generalized TTL Security Mechanism https://datatracker.ietf.org/doc/html/rfc5082
The prefix was only routeable on the intern network, not the whole internet, as it was not added in local_prefix_v6. The 2a0e:8f02:f034::/48 is attached to my ASN, AS211153 Commit message fixed up by Esmil