Agent: report the FIB for reachability scoping #3

2026-07-20T22:37:36+10:00

unkinben commented

2026-07-20 22:37:36 +10:00

Why

The control plane scopes which routers enforce a rule based on whether a router can actually route to both endpoints. That needs a reachability signal from each device; this has the agent report its FIB.

Changes

Collect the device's reachable prefixes from the kernel FIB (which includes FRR-installed routes) via ip route show / ip -6 route show.
Report them to the control plane (POST /devices/{name}/routes) alongside the status report each cycle.
Route parsing handles default routes (per-family), ECMP nexthop continuation lines, route-type keywords (blackhole/unreachable/...), host routes, and v4/v6 — unit-tested. Collection degrades to nil on hosts without iproute2, and the control plane then safely over-approximates.

Pairs with

The tomswallapi side (reachable_prefixes column, the /routes endpoint, and compiler scoping) is a separate PR on tomswallapi.

## Why The control plane scopes which routers enforce a rule based on whether a router can actually route to both endpoints. That needs a reachability signal from each device; this has the agent report its FIB. ## Changes - Collect the device's reachable prefixes from the kernel FIB (which includes FRR-installed routes) via `ip route show` / `ip -6 route show`. - Report them to the control plane (POST /devices/{name}/routes) alongside the status report each cycle. - Route parsing handles default routes (per-family), ECMP nexthop continuation lines, route-type keywords (blackhole/unreachable/...), host routes, and v4/v6 — unit-tested. Collection degrades to nil on hosts without iproute2, and the control plane then safely over-approximates. ## Pairs with The tomswallapi side (reachable_prefixes column, the /routes endpoint, and compiler scoping) is a separate PR on tomswallapi.

unkinben added 1 commit 2026-07-20 22:37:37 +10:00

Agent: report the FIB for reachability scoping

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

66265764df

The agent now collects the device's reachable prefixes from the kernel FIB
(including FRR-installed routes) via 'ip route show' / 'ip -6 route show' and
reports them to the control plane (POST /devices/{name}/routes) alongside its
status. tomswallapi uses these to scope which routers enforce a rule. Route
parsing (default routes, ECMP nexthop lines, route-type keywords, host routes,
v4/v6) is unit-tested; collection degrades to nil without iproute2.

benvin merged commit 6f1ac9a1ae into main

2026-07-20 22:40:25 +10:00

benvin deleted branch benvin/agent-fib

2026-07-20 22:40:25 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/tomswall#3