[IM] Extend BGP NEXT_HOP hijacking detection to IPv6 on route servers

inex · Feb 5, 2018 · 2893103 · 2893103
1 parent 9f146d6
commit 2893103
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 6 deletions.
diff --git a/data/travis-ci/known-good/ci-apiv4-rs1-lan1-ipv6.conf b/data/travis-ci/known-good/ci-apiv4-rs1-lan1-ipv6.conf
@@ -98,7 +98,13 @@ function ixp_community_filter(int peerasn)
 template bgp tb_rsclient {
         local as routeserverasn;
         source address routeserveraddress;
-        import all;
+        import filter {
+                ## Prevent BGP NEXT_HOP Hijacking
+                if !( from = bgp_next_hop ) then
+                    reject "BGP neighbor address [", from, "] != next hop address [", bgp_next_hop, "]", ", net:[", net, "], path:[", bgp_path, "]";
+
+                accept;
+        };
 
         export all;
         rs client;

diff --git a/data/travis-ci/known-good/ci-apiv4-rs1-lan2-ipv6.conf b/data/travis-ci/known-good/ci-apiv4-rs1-lan2-ipv6.conf
@@ -98,7 +98,13 @@ function ixp_community_filter(int peerasn)
 template bgp tb_rsclient {
         local as routeserverasn;
         source address routeserveraddress;
-        import all;
+        import filter {
+                ## Prevent BGP NEXT_HOP Hijacking
+                if !( from = bgp_next_hop ) then
+                    reject "BGP neighbor address [", from, "] != next hop address [", bgp_next_hop, "]", ", net:[", net, "], path:[", bgp_path, "]";
+
+                accept;
+        };
 
         export all;
         rs client;

diff --git a/resources/views/api/v4/router/server/bird/neighbor-template.foil.php b/resources/views/api/v4/router/server/bird/neighbor-template.foil.php
@@ -37,17 +37,13 @@
 template bgp tb_rsclient {
         local as routeserverasn;
         source address routeserveraddress;
-<?php if( $t->router->protocol() == 4 ): ?>
         import filter {
                 ## Prevent BGP NEXT_HOP Hijacking
                 if !( from = bgp_next_hop ) then
                     reject "BGP neighbor address [", from, "] != next hop address [", bgp_next_hop, "]", ", net:[", net, "], path:[", bgp_path, "]";
 
                 accept;
         };
-<?php else: ?>
-        import all;
-<?php endif; ?>
 
         export all;
         rs client;