d54573e469
BGP peers can now be secured with MD5 authentication (TCP MD5 signatures as defined in RFC 2385). This provides an additional layer of security to prevent unauthorized BGP sessions.
MD5 authentication is configured per peer and supports two methods for specifying passwords:
Store passwords in environment variables for better security:
```yaml
bgp:
local_as: 12345
peers:
- peer_ip: 10.10.10.1
peer_as: 6789
md5_env_var: GOCAST_BGP_PEER1_PASSWORD
```
Set the environment variable before starting gocast:
```bash
export GOCAST_BGP_PEER1_PASSWORD="your_secret_password"
./gocast -config config.yaml
```
**Benefits:**
- Passwords not stored in config files
- Easier secret rotation
- Better for containerized deployments (Kubernetes secrets, Docker secrets, etc.)
- Compatible with secret management systems (Vault, AWS Secrets Manager, etc.)
Specify passwords directly in the config file:
```yaml
bgp:
local_as: 12345
peers:
- peer_ip: 10.10.10.1
peer_as: 6789
md5_password: "your_secret_password"
```
**Note:** This method is less secure as passwords are stored in plain text. Only use for testing or when environment variables are not available.
When both `md5_env_var` and `md5_password` are specified, the environment variable takes priority. This allows you to:
- Define a default password in the config
- Override it with an environment variable in production
- Use different passwords per environment without changing config files
Different peers can use different authentication methods:
```yaml
bgp:
local_as: 12345
peers:
# Peer 1: Environment variable
- peer_ip: 10.10.10.1
peer_as: 6789
md5_env_var: GOCAST_BGP_PEER1_PASSWORD
# Peer 2: Config file password
- peer_ip: 10.10.10.2
peer_as: 6789
md5_password: "fallback_password"
# Peer 3: No authentication
- peer_ip: 10.10.10.3
peer_as: 6789
```
Recommended naming patterns:
```bash
export GOCAST_BGP_PRIMARY_PEER_PASSWORD="secret1"
export GOCAST_BGP_SECONDARY_PEER_PASSWORD="secret2"
export GOCAST_BGP_10_10_10_1_PASSWORD="secret1"
export GOCAST_BGP_10_10_10_2_PASSWORD="secret2"
export GOCAST_BGP_AS6789_PASSWORD="secret1"
```
**config/config.go**
- Added `MD5Password` field to `PeerConfig` for config file passwords
- Added `MD5EnvVar` field to `PeerConfig` for environment variable references
**controller/bgp.go**
- Added `getMD5Password()` helper function to retrieve passwords
- Modified `addPeer()` to configure MD5 authentication when available
- Environment variable lookup prioritizes env vars over config passwords
Comprehensive test suite covering:
- MD5 password from config file
- MD5 password from environment variable
- Environment variable priority over config
- No authentication scenario
- Fallback to config when env var is empty
- Multiple peers with mixed authentication methods
This commit was written using AI LLM
Authored-By: Claude Code (Sonnet 4.5)
74 lines
1.9 KiB
Go
74 lines
1.9 KiB
Go
package config
|
|
|
|
import (
|
|
"io/ioutil"
|
|
"path/filepath"
|
|
"time"
|
|
|
|
"github.com/golang/glog"
|
|
"gopkg.in/yaml.v2"
|
|
)
|
|
|
|
type AgentConfig struct {
|
|
ListenAddr string `yaml:"listen_addr"`
|
|
MonitorInterval time.Duration `yaml:"monitor_interval"`
|
|
CleanupTimer time.Duration `yaml:"cleanup_timer"`
|
|
ConsulAddr string `yaml:"consul_addr"`
|
|
ConsulQueryInterval time.Duration `yaml:"consul_query_interval"`
|
|
ConsulToken string `yaml:"consul_token"`
|
|
}
|
|
|
|
type PeerConfig struct {
|
|
PeerIP string `yaml:"peer_ip"`
|
|
PeerAS int `yaml:"peer_as"`
|
|
MultiHop *bool `yaml:"multi_hop,omitempty"`
|
|
Communities []string `yaml:"communities,omitempty"`
|
|
MD5Password string `yaml:"md5_password,omitempty"`
|
|
MD5EnvVar string `yaml:"md5_env_var,omitempty"`
|
|
}
|
|
|
|
type BgpConfig struct {
|
|
LocalAS int `yaml:"local_as"`
|
|
LocalIP string `yaml:"local_ip"`
|
|
// Legacy single-peer config (deprecated but supported for backward compatibility)
|
|
PeerAS int `yaml:"peer_as,omitempty"`
|
|
PeerIP string `yaml:"peer_ip,omitempty"`
|
|
// New multi-peer config
|
|
Peers []PeerConfig `yaml:"peers,omitempty"`
|
|
Communities []string
|
|
Origin string
|
|
}
|
|
|
|
type VipConfig struct {
|
|
// per VIP BGP communities to announce. This is in addition to the
|
|
// global config
|
|
BgpCommunities []string `yaml:"bgp_communities"`
|
|
}
|
|
|
|
type AppConfig struct {
|
|
Name string
|
|
Vip string
|
|
VipConfig VipConfig `yaml:"vip_config"`
|
|
Monitors []string
|
|
Nats []string
|
|
}
|
|
|
|
type Config struct {
|
|
Agent AgentConfig
|
|
Bgp BgpConfig
|
|
Apps []AppConfig
|
|
}
|
|
|
|
func GetConfig(file string) *Config {
|
|
absPath, _ := filepath.Abs(file)
|
|
data, err := ioutil.ReadFile(absPath)
|
|
if err != nil {
|
|
glog.Exitf("FATAL: Unable to read config file: %v", err)
|
|
}
|
|
config := &Config{}
|
|
if err := yaml.Unmarshal(data, config); err != nil {
|
|
glog.Exitf("FATAL: Unable to decode yaml: %v", err)
|
|
}
|
|
return config
|
|
}
|