Page MenuHomePhabricator

Prevent advertising invalid prefixes from customers
Closed, ResolvedPublic

Description

Since T265288 is done, WMCS is considered a customer.
But a customer that still have to advertise 172.16.0.0/21 to us.
Unfortunately we re-advertise customer prefixes to the world without any sanitizing, which means we're curently re-advertising 172.16.0.0/21.

Similarly to what we do in the border-out{4,6} firewall filter we need to at least discard prefix-list-filter special-ranges{4,6}.
Even though we could apply a big part of BGP_sanitize_in` I'd prefer to keep BGP_outfilter lightweight. And for example apply BGP_sanitize_in to our customer interfaces when able.

Event Timeline

ayounsi triaged this task as High priority.Nov 11 2020, 9:13 AM
ayounsi created this task.
Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change 640666 had a related patch set uploaded (by Ayounsi; owner: Ayounsi):
[operations/homer/public@master] Drop special-ranges in BGP_outfilter

https://gerrit.wikimedia.org/r/640666

Change 640666 merged by jenkins-bot:
[operations/homer/public@master] Drop special-ranges in BGP_outfilter

https://gerrit.wikimedia.org/r/640666

Pushed to cr3-ulsfo:

before
  Prefix		  Nexthop	       MED     Lclpref    AS path
* 172.16.0.0/21           Self                                    I
* 185.15.56.0/24          Self                                    I
* 198.35.26.0/24          Self                                    I
* 198.35.27.0/24          Self                                    I
* 198.73.209.0/24         Self                                    11820 ?
after
* 185.15.56.0/24          Self                                    I
* 198.35.26.0/24          Self                                    I
* 198.35.27.0/24          Self                                    I
* 198.73.209.0/24         Self                                    11820 ?

Rolling everywhere.