BGP MD5 support regression

Bug #176015 reported by Jeremy Jackson
6
Affects Status Importance Assigned to Milestone
quagga (Ubuntu)
Fix Released
Undecided
Unassigned
Hardy
Fix Released
Undecided
Unassigned
Intrepid
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: quagga

Gutsy's quagga pkg uses a rather dated version of the TCP-MD5 patch. It's not working (possibly due to ipv6 being enabled, that's a known issue on mailing list) symptoms are, the listen socket doesn't have the md5 option set, so 2 quaggas can't establish a session. They both have kernel messages "MD5 NOT expected, but received"

If quagga <--> Cisco, the quagga connects *to* the cisco with md5 ok.

An updated patch is http://marc.info/?l=quagga-dev&m=119093788810289&w=2

It needs HAVE_TCP_MD5SIG defined in config.h; A later patch makes autoconf do that:

http://marc.info/?l=quagga-dev&m=119356096204723&w=2

However that one is in an obscure format (CVS diff) and I didn't test it.

Revision history for this message
Jeremy Jackson (jerj) wrote :

Looks like this didn't quite work out; 0.99.9-2ubuntu1 won't build from source on Gutsy, using the CVS diff mis-patches bgpd.h struct bgp_master, giving build error:

gcc -DHAVE_CONFIG_H -DSYSCONFDIR=\"/etc/quagga/\" -I. -I.. -I.. -I.. -I../lib -Os -fno-omit-frame-pointer -g -std=gnu99 -Wall -Wsign-compare -Wpointer-arith -
Wbad-function-cast -Wwrite-strings -Wmissing-prototypes -Wmissing-declarations -Wchar-subscripts -Wcast-qual -MT bgpd.o -MD -MP -MF .deps/bgpd.Tpo -c -o bgpd.o bg
pd.c
bgpd.c: In function ‘peer_delete’:
bgpd.c:1216: error: ‘struct bgp_master’ has no member named ‘sock’

and many more simliar. Sargun from freenode#quagga informs me the latest patch here:

http://www.wittsend.com/mhw/md5sig/quagga_md5_bsd_linux_v9.diff

Revision history for this message
Mathias Gug (mathiaz) wrote :

This should be fixed in intrepid once quagga is synced from debian - bug 228489.

Changed in quagga:
status: New → Fix Committed
Revision history for this message
Mathias Gug (mathiaz) wrote :

Opening a task for hardy - may be worth an SRU.

Revision history for this message
Mathias Gug (mathiaz) wrote :

Should be fixed in Intrepid.

Changed in quagga:
status: Fix Committed → Fix Released
Chuck Short (zulcss)
Changed in quagga:
status: New → Confirmed
Revision history for this message
Chuck Short (zulcss) wrote :

I have updated the patch from the mailing list. Without this patch quagga will not work correctly.

TEST CASE:

1. Install quagga.
2. Start quagga to see if the listen socket has the md5 option set.

NOTE: This should be done who has experience with quagga to make sure that it is working properly. I have added the updated patch.

Thanks
chuck

Revision history for this message
Chuck Short (zulcss) wrote :

Please ignore the last attachment and look at this one instead.

Thanks
chuck

Revision history for this message
Martin Pitt (pitti) wrote :

Accepted into -proposed, please test and give feedback here

Changed in quagga:
status: Confirmed → Fix Committed
Revision history for this message
Martin Pitt (pitti) wrote :

Ugh, that's a mega-patch. Please make sure to get it tested properly, also from people who use it in production.

Revision history for this message
Jeremy Jackson (jerj) wrote : Re: [Bug 176015] Re: BGP MD5 support regression

I'm ready, willing and able to test this with 2 live BGP full tables +
MD5. I have limited time so if you can point me at a .deb or specific
instructions how to patch the src pkg, i'll give it a go straight away.

I have rebuilt the quagga src pkg already, I just need to know what to
change to use this patch.

Cheers,

Jeremy

On Sat, 2008-05-17 at 15:16 +0000, Martin Pitt wrote:
> Ugh, that's a mega-patch. Please make sure to get it tested properly,
> also from people who use it in production.
>
--
Jeremy Jackson
Coplanar Networks
(519)489-4903
http://www.coplanar.net
<email address hidden>

Revision history for this message
Martin Pitt (pitti) wrote :

Jeremy, that would be great! To test the package, just enable hardy-proposed in /etc/apt/sources.list, apt-get update, and apt-get install quagga (or just dist-upgrade, to test all the other pending updates as well). If you are testing this with GNOME, you can also activate it in System -> Administration -> Software Sources -> Updates.

Revision history for this message
Martin Pitt (pitti) wrote :

Jeremy, what are your experiences with the new version so far? Thanks!

Revision history for this message
Jeremy Jackson (jerj) wrote :

I've finally found time to test it, looks good so far. I'll be testing on 5 machines in lab environment for a bit longer, then updating the live machines.

Revision history for this message
Martin Pitt (pitti) wrote :

Thanks for testing! Copied to hardy-updates.

Changed in quagga:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.