Hi,
Does anyone know if MD5 authentication in ospfd is known to be broken? In
our test environment things work fine without authentication or simple
authentication turned on, but as soon as we turn on MD5 authentication
things break.
We're using the snapshot of October 13th and a Cisco 3640 router (IOS
12.1(5)). If this is an unknown problem I will submit a bug report.
Without authentication:
=======================
Cisco:
------
Router#sh run
-snip
!
interface Loopback0
ip address 192.168.255.1 255.255.255.255
!
interface FastEthernet0/0
ip address 192.168.0.1 255.255.255.0
duplex auto
speed auto
!
-snip
!
router ospf 1
log-adjacency-changes
network 192.168.0.0 0.0.255.255 area 0
!
-snip
end
Router#sh ip ospf nei
Neighbor ID Pri State Dead Time Address Interface
192.168.0.2 1 FULL/BDR 00:00:32 192.168.0.2
FastEthernet0/0
OpenBSD:
--------
# cat /etc/ospfd.conf
router-id 192.168.0.2
area 0 {
interface xl0 {
router-priority 1
}
}
# ospfctl sh nei
ID Pri State DeadTime Address Interface
192.168.255.1 1 FULL/DR 00:00:37 192.168.0.1 xl0
With MD5 authentication enabled:
================================
Cisco:
------
Router#sh run
-snip
!
interface Loopback0
ip address 192.168.255.1 255.255.255.255
!
interface FastEthernet0/0
ip address 192.168.0.1 255.255.255.0
ip ospf message-digest-key 1 md5 openbsd
duplex auto
speed auto
!
-snip
!
router ospf 1
log-adjacency-changes
area 0 authentication message-digest
network 192.168.0.0 0.0.255.255 area 0
!
-snip
end
Router#sh ip ospf nei
Router#
Router#debug ip ospf adj
OSPF adjacency events debugging is on
Router#
01:34:47: OSPF: Rcv pkt from 192.168.0.2, FastEthernet0/0 : Mismatch
Authentication Key - Message Digest Key 1
01:34:57: OSPF: Rcv pkt from 192.168.0.2, FastEthernet0/0 : Mismatch
Authentication Key - Message Digest Key 1
01:34:57: OSPF: Send with youngest Key 1
01:35:07: OSPF: Rcv pkt from 192.168.0.2, FastEthernet0/0 : Mismatch
Authentication Key - Message Digest Key 1
01:35:07: OSPF: Send with youngest Key 1
01:35:17: OSPF: Rcv pkt from 192.168.0.2, FastEthernet0/0 : Mismatch
Authentication Key - Message Digest Key 1
01:35:17: OSPF: Send with youngest Key 1
01:35:27: OSPF: Rcv pkt from 192.168.0.2, FastEthernet0/0 : Mismatch
Authentication Key - Message Digest Key 1
01:35:27: OSPF: Send with youngest Key 1
01:35:37: OSPF: Rcv pkt from 192.168.0.2, FastEthernet0/0 : Mismatch
Authentication Key - Message Digest Key 1
01:35:37: OSPF: end of Wait on interface FastEthernet0/0
01:35:37: OSPF: DR/BDR election on FastEthernet0/0
01:35:37: OSPF: Elect BDR 192.168.255.1
01:35:37: OSPF: Elect DR 192.168.255.1
01:35:37: OSPF: Elect BDR 0.0.0.0
01:35:37: OSPF: Elect DR 192.168.255.1
01:35:37: DR: 192.168.255.1 (Id) BDR: none
01:35:37: OSPF: Send with youngest Key 1
01:35:37: OSPF: No full nbrs to build Net Lsa for interface FastEthernet0/0
OpenBSD:
--------
# cat /etc/ospfd.conf
router-id 192.168.0.2
area 0 {
interface xl0 {
router-priority 1
auth-type crypt
auth-md 1 openbsd
}
}
# ospfd -d -v
startup
rde: new announced net 0.0.0.0/0
rde: new announced net 192.168.0.0/24
orig_rtr_lsa: area 0.0.0.0
orig_rtr_lsa: stub net, interface xl0
if_fsm: event UP resulted in action START and changing state for interface xl0
from DOWN to WAITING
start_spf_timer: IDLE -> DELAY
spf_calc: calculation started, area ID 0.0.0.0
spf_calc: calculation ended, area ID 0.0.0.0
spf_start_holdtimer: DELAY -> HOLD
auth_validate: invalid MD5 digest, interface xl0
recv_packet: authentication error, interface xl0
spf_timer: state HOLD -> IDLE
auth_validate: invalid MD5 digest, interface xl0
recv_packet: authentication error, interface xl0
auth_validate: invalid MD5 digest, interface xl0
recv_packet: authentication error, interface xl0
auth_validate: invalid MD5 digest, interface xl0
recv_packet: authentication error, interface xl0
if_act_elect: interface xl0 old dr none new dr 192.168.0.2, old bdr none new
bdr none
orig_rtr_lsa: area 0.0.0.0
orig_rtr_lsa: stub net, interface xl0
orig_rtr_lsa: area 0.0.0.0
orig_rtr_lsa: stub net, interface xl0
if_fsm: event WAITTIMER resulted in action ELECT and changing state for
interface xl0 from WAITING to DR
auth_validate: invalid MD5 digest, interface xl0
recv_packet: authentication error, interface xl0
^Ckernel routing table decoupled
route decision engine exiting
orig_rtr_lsa: area 0.0.0.0
orig_rtr_lsa: stub net, interface xl0
if_fsm: event DOWN resulted in action RESET and changing state for interface
xl0 from DR to DOWN
if_del: interface xl0
terminating
#
--
Egbert Krook
System/Network Engineer
Amarin Printing and Publishing Public Co., Ltd.
