diff options
| author | Ermal Luçi <eri@pfsense.org> | 2009-10-04 18:20:51 +0000 |
|---|---|---|
| committer | Ermal Luçi <eri@pfsense.org> | 2009-10-04 18:21:49 +0000 |
| commit | 127bc77d2393908b2fb746802c75ea1ac6ef0693 (patch) | |
| tree | aab6ad3990009fc643b75a69725d3657f70fccff /config/openbgpd/openbgpd.inc | |
| parent | 3c90519e3bcf30fe514754a8702de5aadc5df94d (diff) | |
| download | pfsense-packages-127bc77d2393908b2fb746802c75ea1ac6ef0693.tar.gz pfsense-packages-127bc77d2393908b2fb746802c75ea1ac6ef0693.tar.bz2 pfsense-packages-127bc77d2393908b2fb746802c75ea1ac6ef0693.zip | |
Enable TCP-MD5 support on this pacakge.
Diffstat (limited to 'config/openbgpd/openbgpd.inc')
| -rw-r--r-- | config/openbgpd/openbgpd.inc | 35 |
1 files changed, 30 insertions, 5 deletions
diff --git a/config/openbgpd/openbgpd.inc b/config/openbgpd/openbgpd.inc index 3c67262b..d105a80e 100644 --- a/config/openbgpd/openbgpd.inc +++ b/config/openbgpd/openbgpd.inc @@ -50,6 +50,7 @@ function openbgpd_install_conf() { $openbgpd_neighbors = &$config['installedpackages']['openbgpdneighbors']['config']; $conffile = "# This file was created by the pfSense package manager. Do not edit!\n\n"; + $setkeycf = ""; // Setup AS # if($openbgpd_conf['asnum']) @@ -83,10 +84,16 @@ function openbgpd_install_conf() { if($neighbor['groupname'] == $group['name']) { $conffile .= " neighbor {$neighbor['neighbor']} {\n"; $conffile .= " descr \"{$neighbor['descr']}\"\n"; - if($neighbor['md5sigpass']) + if($neighbor['md5sigpass']) { + $setkeycf .= "delete {$openbgpd_conf['listenip']} {$neighbor['neighbor']} tcp 0x1000;\n"; + $setkeycf .= "add {$openbgpd_conf['listenip']} {$neighbor['neighbor']} tcp 0x1000 -A tcp-md5 \"{$neighbor['md5sigpass']}\";\n"; $conffile .= " tcp md5sig password {$neighbor['md5sigpass']}\n"; - if($neighbor['md5sigkey']) - $conffile .= " tcp md5sig key {$neighbor['md5sigkey']}\n"; + } + if($neighbor['md5sigkey']) { + $setkeycf .= "delete {$openbgpd_conf['listenip']} {$neighbor['neighbor']} tcp 0x1000;\n"; + $setkeycf .= "add {$openbgpd_conf['listenip']} {$neighbor['neighbor']} tcp 0x1000 -A tcp-md5 0x{$neighbor['md5sigkey']};\n"; + $conffile .= " tcp md5sig key {$neighbor['md5sigkey']}\n"; + } foreach($neighbor['row'] as $row) { $conffile .= " {$row['paramaters']} {$row['parmvalue']} \n"; } @@ -103,11 +110,21 @@ function openbgpd_install_conf() { foreach($openbgpd_neighbors as $neighbor) { $used_this_item = false; if($neighbor['groupname'] == "") { - $conffile .= " neighbor {$neighbor['neighbor']} {\n"; + $conffile .= "neighbor {$neighbor['neighbor']} {\n"; $conffile .= " descr \"{$neighbor['descr']}\"\n"; + if ($neighbor['md5sigpass']) { + $setkeycf .= "delete {$openbgpd_conf['listenip']} {$neighbor['neighbor']} tcp 0x1000;\n"; + $setkeycf .= "add {$openbgpd_conf['listenip']} {$neighbor['neighbor']} tcp 0x1000 -A tcp-md5 \"{$neighbor['md5sigpass']}\";\n"; + $conffile .= " tcp md5sig password {$neighbor['md5sigpass']}\n"; + } + if ($neighbor['md5sigkey']) { + $setkeycf .= "delete {$openbgpd_conf['listenip']} {$neighbor['neighbor']} tcp 0x1000;\n"; + $setkeycf .= "add {$openbgpd_conf['listenip']} {$neighbor['neighbor']} tcp 0x1000 -A tcp-md5 0x{$neighbor['md5sigkey']};\n"; + $conffile .= " tcp md5sig key {$neighbor['md5sigkey']}\n"; + } $used_this_item = true; foreach($neighbor['row'] as $row) { - $conffile .= " {$row['paramaters']} {$row['parmvalue']} \n"; + $conffile .= " {$row['paramaters']} {$row['parmvalue']} \n"; } } } @@ -144,6 +161,14 @@ function openbgpd_install_conf() { exec("chmod a-rw /usr/local/etc/bgpd.conf"); exec("chmod u+rw /usr/local/etc/bgpd.conf"); + // TCP-MD5 support on freebsd. See tcp(5) for more + if ($neighbor['md5sigpass'] <> "" || $neighbor['md5sigkey'] <> "") { + $fd = fopen("{$g['tmp_path']}/bgpdsetkey.conf", "w"); + fwrite($fd, $setkeycf ); + fclose($fd); + exec("setkey -f {$g['tmp_path']}/bgpdsetkey.conf"); + } + // bgpd process running? if so reload, elsewise start. if(is_openbgpd_running() == true) { exec("bgpctl reload"); |