diff options
| author | IWASE Yusuke <iwase.yusuke0@gmail.com> | 2017-06-21 09:07:40 +0900 |
|---|---|---|
| committer | FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> | 2017-06-23 18:13:19 +0900 |
| commit | 4af2f4b7d59ad0173ac7e11ca781981fd3f97546 (patch) | |
| tree | 884128c51ede30d9d595280465bdfbde4f0c409d /server | |
| parent | 613d8a1e9378bf13ffe98b72d6c2b8069c282003 (diff) | |
server: Implement TTL security
This patch enable to configure Generalized TTL Security Mechanism
(GTSM).
Signed-off-by: IWASE Yusuke <iwase.yusuke0@gmail.com>
Diffstat (limited to 'server')
| -rw-r--r-- | server/fsm.go | 28 |
1 files changed, 24 insertions, 4 deletions
diff --git a/server/fsm.go b/server/fsm.go index 2c01c14d..4f19bc39 100644 --- a/server/fsm.go +++ b/server/fsm.go @@ -487,13 +487,33 @@ func (h *FSMHandler) active() (bgp.FSMState, FsmStateReason) { break } fsm.conn = conn - if fsm.pConf.Config.PeerAs != 0 && fsm.pConf.Config.PeerType == config.PEER_TYPE_EXTERNAL { - ttl := 1 + ttl := 0 + ttlMin := 0 + if fsm.pConf.TtlSecurity.Config.Enabled { + ttl = 255 + ttlMin = int(fsm.pConf.TtlSecurity.Config.TtlMin) + } else if fsm.pConf.Config.PeerAs != 0 && fsm.pConf.Config.PeerType == config.PEER_TYPE_EXTERNAL { + ttl = 1 if fsm.pConf.EbgpMultihop.Config.Enabled { ttl = int(fsm.pConf.EbgpMultihop.Config.MultihopTtl) } - if ttl != 0 { - SetTcpTTLSockopts(conn.(*net.TCPConn), ttl) + } + if ttl != 0 { + if err := SetTcpTTLSockopts(conn.(*net.TCPConn), ttl); err != nil { + log.WithFields(log.Fields{ + "Topic": "Peer", + "Key": fsm.pConf.Config.NeighborAddress, + "State": fsm.state.String(), + }).Warnf("cannot set TTL(=%d) for peer: %s", ttl, err) + } + } + if ttlMin != 0 { + if err := SetTcpMinTTLSockopts(conn.(*net.TCPConn), ttlMin); err != nil { + log.WithFields(log.Fields{ + "Topic": "Peer", + "Key": fsm.pConf.Config.NeighborAddress, + "State": fsm.state.String(), + }).Warnf("cannot set minimal TTL(=%d) for peer: %s", ttl, err) } } // we don't implement delayed open timer so move to opensent right |