sonic-buildimage/dockers
abdosi c9111122e4 [chassis/multi-asic] Make sure iBGP session established as directly connected (#16777)
What I did:
Make Sure for internal iBGP we are one-hop away (directly connected) by using Generic TTL security mechanism.

Why I did:
Without this change it's possible on packet chassis i-BGP can be established even if there no direct connection. Below is the example

- Let's say we have 3 LC's LC1/LC2/LC3 each having i-BGP session session with each other over Loopback4096
- Each LC's have static route towards other LC's Loopback4096 to establish i-BGP session
- LC1 learn default route 0.0.0.0/0 from it's e-BGP peers and send it over to LC2 and LC3 over i-BGP
- Now for some reason on LC2 static route towards LC3 is removed/not-present/some-issue we expect i-BGP session should go down between LC2 and LC3
- However i-BGP between LC2 and LC3 does not go down because of feature ip nht-resolve-via-default  where LC2 will use default route to reach Loopback4096 of LC3. As it's using default route BGP packets from LC2 towards LC3 will first route to LC1 and then go to LC3 from there.

Above scenario can result in packet mis-forwarding on data plane

How I fixed it:-

To make sure BGP packets between i-BGP peers are not going with extra routing hop enable using GTSM feature

neighbor PEER ttl-security hops NUMBER

This command enforces Generalized TTL Security Mechanism (GTSM), as specified in RFC 5082. With this command, only neighbors that are the specified number of hops away will be allowed to become neighbors. This command is mutually exclusive with ebgp-multihop.

We set hop count as 1 which makes FRR to reject BGP connection if we receive BGP packets if it's TTL < 255. Also setting this attribute make sure i-BGP frames are originated with IP TTL of 255.

How I verify:

Manual Verification of above scenario. See blow BGP packets receive with IP TTL 254 (additional routing hop) we are seeing FIN TCP flags as BGP is rejecting the connection

Signed-off-by: Abhishek Dosi <abdosi@microsoft.com>
2023-10-25 12:32:27 +08:00
..
docker-base Add a config variable to override default container registry instead of dockerhub. (#10166) 2022-03-14 18:09:20 +08:00
docker-base-bullseye [202205] Remove apt package lists and make macro to clean up apt and python cache (#14377) 2023-03-22 14:51:25 -07:00
docker-base-buster [202205] Remove apt package lists and make macro to clean up apt and python cache (#14377) 2023-03-22 14:51:25 -07:00
docker-base-stretch [Build] Support j2 template for debian sources (#12557) (#13185) 2022-12-30 09:47:33 +08:00
docker-basic_router [supervisord]: use abspath as supervisord entrypoint (#5995) 2020-11-22 21:18:44 -08:00
docker-config-engine Parallel building of sonic dockers using native dockerd(dood). (#10352) 2022-04-28 08:39:37 +08:00
docker-config-engine-bullseye [Build] Fix the PyYang python package installation issue (#15890) (#15907) 2023-07-19 08:08:35 -07:00
docker-config-engine-buster [Build] Fix the PyYang python package installation issue (#15890) (#15907) 2023-07-19 08:08:35 -07:00
docker-config-engine-stretch Parallel building of sonic dockers using native dockerd(dood). (#10352) 2022-04-28 08:39:37 +08:00
docker-database [202205] Remove apt package lists and make macro to clean up apt and python cache (#14377) 2023-03-22 14:51:25 -07:00
docker-dhcp-relay advance dhcprelay to 6a6ce24, add default dhcpv6 dualtor source interface (#15881) 2023-07-19 14:08:48 -07:00
docker-fpm-frr [chassis/multi-asic] Make sure iBGP session established as directly connected (#16777) 2023-10-25 12:32:27 +08:00
docker-fpm-gobgp Parallel building of sonic dockers using native dockerd(dood). (#10352) 2022-04-28 08:39:37 +08:00
docker-iccpd iccpd bullseye migration (#12097) 2022-10-27 22:12:23 +00:00
docker-lldp [chassis][lldp] Fix the lldp error log in host instance which doesn't contain front panel ports (#14814) (#15669) 2023-06-30 13:24:26 -07:00
docker-macsec Update macsec CAK keys in profile for tests to change to type7 encoded format (#16388) (#16499) 2023-09-09 06:23:49 +08:00
docker-mux [mux] Integrate linkmgrd with swss logger (#15392) (#15539) 2023-06-20 09:08:51 +08:00
docker-nat [202205] Remove apt package lists and make macro to clean up apt and python cache (#14377) 2023-03-22 14:51:25 -07:00
docker-orchagent [202205]Change orchagent pop batch size from 8192 to 1024 (#16126) 2023-08-14 17:54:39 -07:00
docker-pde PDE migration to bullseye (#10836) 2022-08-11 23:14:10 +00:00
docker-platform-monitor Chassis: fix pmon docker failure when DEVICE_METADATA is not available (#16527) 2023-09-14 09:29:06 +08:00
docker-ptf [Build] Fix the mirror gpg key expired issue (#14206) 2023-03-16 04:32:36 +08:00
docker-ptf-sai [sai-ptf]Fix sai ptf issue (#12723) 2022-11-16 20:28:30 -08:00
docker-router-advertiser [202205] Remove apt package lists and make macro to clean up apt and python cache (#14377) 2023-03-22 14:51:25 -07:00
docker-sflow [sflow] Exception handling for if_nametoindex (#11437) (#14456) 2023-04-18 11:57:44 -07:00
docker-snmp [202205][SNMP][IPv6]: Revert PRs to support SNMP over IPv6 (#16650) 2023-10-11 12:02:33 -07:00
docker-sonic-mgmt Add scapy support for python3 virtual environment in the sonic-mgmt docker container (#10234) 2022-03-16 12:00:51 +08:00
docker-sonic-mgmt-framework [202205] Remove apt package lists and make macro to clean up apt and python cache (#14377) 2023-03-22 14:51:25 -07:00
docker-sonic-p4rt [202205] Remove apt package lists and make macro to clean up apt and python cache (#14377) 2023-03-22 14:51:25 -07:00
docker-sonic-restapi [202205] Remove apt package lists and make macro to clean up apt and python cache (#14377) 2023-03-22 14:51:25 -07:00
docker-sonic-sdk Parallel building of sonic dockers using native dockerd(dood). (#10352) 2022-04-28 08:39:37 +08:00
docker-sonic-sdk-buildenv Parallel building of sonic dockers using native dockerd(dood). (#10352) 2022-04-28 08:39:37 +08:00
docker-sonic-telemetry Fix telemetry.sh passing in null as log level value (#14303) (#14410) 2023-03-25 05:24:23 +08:00
docker-swss-layer-bullseye [202205] Remove apt package lists and make macro to clean up apt and python cache (#14377) 2023-03-22 14:51:25 -07:00
docker-swss-layer-buster [202205] Remove apt package lists and make macro to clean up apt and python cache (#14377) 2023-03-22 14:51:25 -07:00
docker-teamd [202205] Remove apt package lists and make macro to clean up apt and python cache (#14377) 2023-03-22 14:51:25 -07:00
dockerfile-macros.j2 [202205] Remove apt package lists and make macro to clean up apt and python cache (#14377) 2023-03-22 14:51:25 -07:00