73 lines
3.6 KiB
Plaintext
73 lines
3.6 KiB
Plaintext
# rust-bfd configuration. Install as /etc/rust-bfd/config.yaml (or pass --config / set BFD_CONFIG).
|
|
#
|
|
# Precedence, lowest to highest: built-in defaults < this file < BFD_* environment < command line.
|
|
# Values shown below are the built-in defaults unless noted. Unknown keys are an error.
|
|
|
|
# Local address(es) to bind and use as the source of BFD control packets. Required (here, in BFD_BIND, or via --bind).
|
|
# Accepts a single address, a list, or a comma-separated string. The daemon currently supports exactly one address;
|
|
# the list form is accepted so configs do not need to change once multiple binds are implemented.
|
|
# Env: BFD_BIND="192.0.2.1" (or "192.0.2.1,2001:db8::1")
|
|
# CLI: --bind 192.0.2.1 [--bind ...] (replaces the addresses configured here)
|
|
bind: 192.0.2.1
|
|
# bind: [192.0.2.1, "2001:db8::1"]
|
|
|
|
# Directory of executable scripts run, in lexical order, on every session state change.
|
|
# Env: BFD_HOOKS_DIR
|
|
hooks_dir: /etc/rust-bfd/hooks.d
|
|
|
|
# Settings inherited by every peer that does not override them. Durations are humantime strings (300ms, 1s, 2m).
|
|
# A peer is never allowed a zero interval or a detect_mult of 0.
|
|
defaults:
|
|
# Minimum interval between transmitted control packets that we would like to use once the session is Up. Sessions
|
|
# that are not Up transmit no faster than once per second regardless (RFC 5880 section 6.8.3).
|
|
# Env: BFD_DEFAULTS_DESIRED_MIN_TX
|
|
desired_min_tx: 300ms
|
|
# Minimum interval between received control packets we can support.
|
|
# Env: BFD_DEFAULTS_REQUIRED_MIN_RX
|
|
required_min_rx: 300ms
|
|
# Detection time multiplier: we declare the session down after this many missed packets.
|
|
# Env: BFD_DEFAULTS_DETECT_MULT
|
|
detect_mult: 3
|
|
|
|
# Peers to establish sessions with. Peers can only be configured here and with --peer (repeatable, addresses only,
|
|
# default settings); they cannot be set from the environment. Each peer's address must match the family of at least
|
|
# one bind address.
|
|
peers:
|
|
- address: 192.0.2.2
|
|
# Per-peer overrides of any `defaults` key:
|
|
# - address: 192.0.2.3
|
|
# desired_min_tx: 1s
|
|
# required_min_rx: 1s
|
|
# detect_mult: 5
|
|
#
|
|
# Authentication (RFC 5880 section 6.7), per peer and off by default. Both ends must be configured identically; a
|
|
# peer that does not authenticate as configured is discarded. `key_id` is a number (0-255) that must match the remote's.
|
|
# Keys are used verbatim (not hashed or derived), so they must be exactly the length shown. Give them as a string;
|
|
# use YAML double-quoted escapes (\x00, \x1b, ...) for bytes that are not printable. Strings are UTF-8, so only bytes
|
|
# 0x00-0x7f can be written this way. To use bytes 0x80-0xff, give the key as a list of integers instead, one per
|
|
# byte (hex is fine), with the same length requirement:
|
|
# key: [0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x80, 0xff]
|
|
#
|
|
# Keyed MD5: `key` is exactly 16 bytes. `meticulous` (default true) selects Meticulous Keyed MD5, in which every
|
|
# packet must carry a newer sequence number; the remote must be set to the same mode.
|
|
# - address: 192.0.2.4
|
|
# auth:
|
|
# type: md5
|
|
# key_id: 1
|
|
# key: "0123456789abcdef"
|
|
# meticulous: true
|
|
#
|
|
# Keyed SHA1: `key` is exactly 20 bytes. `meticulous` as above.
|
|
# - address: 192.0.2.5
|
|
# auth:
|
|
# type: sha1
|
|
# key_id: 1
|
|
# key: "0123456789abcdef\x00\x01\x7f\x1b"
|
|
#
|
|
# Simple password: 1 to 16 bytes, sent in the clear. Provides no protection against an attacker on the path.
|
|
# - address: 192.0.2.6
|
|
# auth:
|
|
# type: password
|
|
# key_id: 1
|
|
# password: "secret"
|