Again on communities...

[Alexander Shikoff]

On Wed, Feb 01, 2012 at 06:44:54PM +0100, Simone Morandini wrote:
> Hi guys,
> 
> one question (again) on communities: consider the following filtering 
> function, applied on pipe protocols (no filtering on bgp protocol):
> 
> function bgp_out(int peeras)
> {
>         if !(source = RTS_BGP) then return false;
>         if (0,     peeras) ~ bgp_community  then return false;
>         if (65004, peeras) ~ bgp_community  then return true;
>         if (0,     65004)  ~ bgp_community  then return false;
>         return true;
> }
> 
> If a given peer wants to peer only with two specific ASNs, he will then 
> send these communities: (65004,ASN1) (65004,ASN2) to the route server.
> Is it correct to say that such a filter simply doesn't work for this 
> purpose? That is, routes are however announced to all the participants?

In your case routes are announced to all participants because of
last 'return true'.

If you want to run such function in a right way then introduce some
default community, for example (65004,65004). In bgp_in function 
add it to prefixes that are not marked with any of (0,     peeras) 
or (65004, peeras).
And modify a bit your function:

function bgp_out(int peeras)
{
	if !(source = RTS_BGP) then return false;
	if (0,     peeras) ~ bgp_community  then return false;
	if (0,     65004)  ~ bgp_community  then return false;

	if ( (65004, peeras) ~ bgp_community ||
	     (65004, 65004) ~ bgp_community ) then return true;

	return false;
}

In this function communitites (0, *) have bigger priority, i.e. 
if your RS receive prefix with (0, 65004) and (65004, 100) then 
it will not announce prefix to AS100 despite of (65004, 100).
You may change this behaviour on your requirements.

-- 
MINO-RIPE