Adding support for OSPF authentication modes and encryption types #1127

Shashank-arista · 2024-06-12T07:20:52Z

(M) release/models/ospf/openconfig-ospf-types.yang
(M) release/models/ospf/openconfig-ospfv2-area-interface.yang
(M) release/models/ospf/openconfig-ospfv2.yang

Change Scope

Currently, OSPF authentication is not well-defined with only the authentication-type parameter being available and also with no defined values specified. Added a backward compatible new authentication node under OSPF interface where we can define authentication modes, simple password, and also a message-digest container to configure key, password, encryption type.

  +--rw network-instances
     +--rw network-instance* [name]
        +--rw protocols
           +--rw protocol* [identifier name]
              +--rw ospfv2
                 +--rw areas
                    +--rw area* [identifier]
                       +--rw interfaces
                          +--rw interface* [id]
                             **+--rw authentication
                                +--rw config
                                |  +--rw auth-mode?         identityref
                                |  +--rw simple-password?   string
                                +--ro state
                                |  +--ro auth-mode?         identityref
                                |  +--ro simple-password?   string
                                +--rw message-digests
                                   +--rw message-digest* [md-key-id]
                                      +--rw md-key-id    -> ../config/md-key-id
                                      +--rw config
                                      |  +--rw md-key-id?       uint8
                                      |  +--rw md-encryption?   identityref
                                      |  +--rw md-password?     string
                                      +--ro state
                                         +--ro md-key-id?       uint8
                                         +--ro md-encryption?   identityref
                                         +--ro md-password?     string**

Platform Implementations

Arista : https://www.arista.com/en/um-eos/eos-open-shortest-path-first-version-2#xx1151536

release/models/ospf/openconfig-ospfv2-area-interface.yang

release/models/ospf/openconfig-ospf-types.yang

earies · 2024-06-12T12:59:25Z

release/models/ospf/openconfig-ospfv2-area-interface.yang

+        "Authentication mode to be used for OSPF interface links.";
+    }
+
+    leaf simple-password {


when conditionals could probably be explored to match the branching based on the AUTH_MODE chosen

We would want to be able to configure message digest keys, simple password irrespective of mode selected.

That's fair. Note in JUNOS there is mutual exclusivity between modes in which password/keys are children of the mode vs. independent objects/toggles

earies

Have you considered coverage for keychains which is supported across various implementations?

earies · 2024-06-13T13:17:29Z

release/models/ospf/openconfig-ospfv2-area-interface.yang

+
+    leaf key-id {
+      type uint8 {
+        range "1..255";


This range looks to be EOS specific. The entire 8-bit range is usable including 0 for the Key ID

Thanks, I have removed the restriction.

earies · 2024-06-13T13:23:09Z

release/models/ospf/openconfig-ospfv2-area-interface.yang

+        "Authentication mode to be used for OSPF interface links.";
+    }
+
+    leaf simple-password {


That's fair. Note in JUNOS there is mutual exclusivity between modes in which password/keys are children of the mode vs. independent objects/toggles

earies · 2024-06-13T13:26:42Z

release/models/ospf/openconfig-ospfv2-area-interface.yang

+    }
+
+    leaf auth-key {
+      type string;


For this and simple-password, we'll want to consider what these values mean for storage. Much like in ISIS, we likely at least want to leverage oc-types:routing-password to put some rules around a specific typedef when it comes to reads and writes.

I have changed the simple-password and auth-key type to oc-types:routing-password

gunvinayaka · 2024-06-14T06:26:16Z

isn't a security threat if we share OSPF configured password via streaming ?

DonaMaria2024 · 2024-06-14T08:03:03Z

What is auth-mode? Is it same as 'Autype' define in RFC2328? If so, I think it should be kept under "interface".
What is md-encryption? Is it same as 'Autype' define in RFC2328? If so, above comment applies here too.

Thanks,
Dona

Shashank-arista · 2024-06-14T08:32:49Z

Have you considered coverage for keychains which is supported across various implementations?

Not as of now.

Shashank-arista · 2024-06-14T08:38:48Z

What is auth-mode? Is it same as 'Autype' define in RFC2328? If so, I think it should be kept under "interface".

What is md-encryption? Is it same as 'Autype' define in RFC2328? If so, above comment applies here too.

Thanks, Dona

auth-mode is same as 'Autype' but we have defined it as identity AUTH_MODE. It is added under "authentication" which is under "interface" right? md-encryption is now changed to "auth-algo" which defines the hash algorithm to be used to generate message digest.

DonaMaria2024 · 2024-06-14T08:53:46Z

What is auth-mode? Is it same as 'Autype' define in RFC2328? If so, I think it should be kept under "interface".

What is md-encryption? Is it same as 'Autype' define in RFC2328? If so, above comment applies here too.

Thanks, Dona

What is auth-mode? Is it same as 'Autype' define in RFC2328? If so, I think it should be kept under "interface".

What is md-encryption? Is it same as 'Autype' define in RFC2328? If so, above comment applies here too.

Thanks, Dona

auth-mode is same as 'Autype' but we have defined it as identity AUTH_MODE. It is added under "authentication" which is under "interface" right? md-encryption is now changed to "auth-algo" which defines the hash algorithm to be used to generate message digest.

"We would want to be able to configure message digest keys, simple password irrespective of mode selected." ==> Saw this comment from you. If this is the case, mode configuration should be outside of key values right? Means, Autype should reflect what is the actual Autype on the configured on the interface; not the Autype associated with the key.

Shashank-arista · 2024-06-14T08:57:59Z

What is auth-mode? Is it same as 'Autype' define in RFC2328? If so, I think it should be kept under "interface".

What is md-encryption? Is it same as 'Autype' define in RFC2328? If so, above comment applies here too.

Thanks, Dona

What is auth-mode? Is it same as 'Autype' define in RFC2328? If so, I think it should be kept under "interface".

What is md-encryption? Is it same as 'Autype' define in RFC2328? If so, above comment applies here too.

Thanks, Dona

auth-mode is same as 'Autype' but we have defined it as identity AUTH_MODE. It is added under "authentication" which is under "interface" right? md-encryption is now changed to "auth-algo" which defines the hash algorithm to be used to generate message digest.

"We would want to be able to configure message digest keys, simple password irrespective of mode selected." ==> Saw this comment from you. If this is the case, mode configuration should be outside of key values right?

   +--rw network-instance* [name]
      +--rw protocols
         +--rw protocol* [identifier name]
            +--rw ospfv2
               +--rw areas
                  +--rw area* [identifier]
                     +--rw interfaces
                        +--rw interface* [id]
                           +--rw authentication
                              +--rw config
                              |  +--rw auth-mode?         identityref
                              |  +--rw simple-password?   oc-types:routing-password
                              +--ro state
                              |  +--ro auth-mode?         identityref
                              |  +--ro simple-password?   oc-types:routing-password
                              +--rw message-digests
                                 +--rw message-digest* [key-id]
                                    +--rw key-id    -> ../config/key-id
                                    +--rw config
                                    |  +--rw key-id?      uint8
                                    |  +--rw auth-algo?   identityref
                                    |  +--rw auth-key?    oc-types:routing-password
                                    +--ro state
                                       +--ro key-id?      uint8
                                       +--ro auth-algo?   identityref
                                       +--ro auth-key?    oc-types:routing-password

So, we can configure mode here without configuring keys right and vice-versa, all existing under "authentication" container.

DonaMaria2024 · 2024-06-14T09:03:02Z

What is auth-mode? Is it same as 'Autype' define in RFC2328? If so, I think it should be kept under "interface".

What is md-encryption? Is it same as 'Autype' define in RFC2328? If so, above comment applies here too.

Thanks, Dona

What is auth-mode? Is it same as 'Autype' define in RFC2328? If so, I think it should be kept under "interface".

What is md-encryption? Is it same as 'Autype' define in RFC2328? If so, above comment applies here too.

Thanks, Dona

auth-mode is same as 'Autype' but we have defined it as identity AUTH_MODE. It is added under "authentication" which is under "interface" right? md-encryption is now changed to "auth-algo" which defines the hash algorithm to be used to generate message digest.

"We would want to be able to configure message digest keys, simple password irrespective of mode selected." ==> Saw this comment from you. If this is the case, mode configuration should be outside of key values right?
   +--rw network-instance* [name]
      +--rw protocols
         +--rw protocol* [identifier name]
            +--rw ospfv2
               +--rw areas
                  +--rw area* [identifier]
                     +--rw interfaces
                        +--rw interface* [id]
                           +--rw authentication
                              +--rw config
                              |  +--rw auth-mode?         identityref
                              |  +--rw simple-password?   oc-types:routing-password
                              +--ro state
                              |  +--ro auth-mode?         identityref
                              |  +--ro simple-password?   oc-types:routing-password
                              +--rw message-digests
                                 +--rw message-digest* [key-id]
                                    +--rw key-id    -> ../config/key-id
                                    +--rw config
                                    |  +--rw key-id?      uint8
                                    |  +--rw auth-algo?   identityref
                                    |  +--rw auth-key?    oc-types:routing-password
                                    +--ro state
                                       +--ro key-id?      uint8
                                       +--ro auth-algo?   identityref
                                       +--ro auth-key?    oc-types:routing-password
So, we can configure mode here without configuring keys right and vice-versa, all existing under "authentication" container.

Why is Autype is associated with "simple-password"? MD5 also should have an Autype of 2.
As per RFC 2328:
AuType Description
___________________________________________
0 Null authentication
1 Simple password
2 Cryptographic authentication

DonaMaria2024 · 2024-06-14T10:07:51Z

If possible, please make the design common to all Cryptographic Authentications. Keyed-MD5 is just one among them.

wenovus · 2024-06-25T21:30:04Z

/gcbrun

OpenConfigBot · 2024-06-25T21:31:26Z

No major YANG version changes in commit 589800b

Shashank-arista requested a review from a team as a code owner June 12, 2024 07:20

OSPF authentication support

246ccad

Shashank-arista force-pushed the ospfOc branch from a10cab8 to 246ccad Compare June 12, 2024 07:37

Shashank-arista mentioned this pull request Jun 12, 2024

authentication-type parameter for ospf protocol seems incomplete #922

Open

earies reviewed Jun 12, 2024

View reviewed changes

Shashank-arista force-pushed the ospfOc branch from 9708483 to c6be8a0 Compare June 13, 2024 09:43

Address review comments

06e2542

Shashank-arista force-pushed the ospfOc branch from c6be8a0 to 06e2542 Compare June 13, 2024 09:48

earies reviewed Jun 13, 2024

View reviewed changes

Address review comments.

589800b

OpenConfigBot added the non-breaking label Jun 25, 2024

dplore mentioned this pull request Aug 14, 2024

Updates to network instance models for VLAN-VNI and VRF-VNI mappings #1125

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding support for OSPF authentication modes and encryption types #1127

Adding support for OSPF authentication modes and encryption types #1127

Shashank-arista commented Jun 12, 2024 •

edited

Loading

earies Jun 12, 2024

Shashank-arista Jun 13, 2024

earies Jun 13, 2024

earies left a comment

earies Jun 13, 2024

Shashank-arista Jun 14, 2024

earies Jun 13, 2024

earies Jun 13, 2024

Shashank-arista Jun 14, 2024

gunvinayaka commented Jun 14, 2024

DonaMaria2024 commented Jun 14, 2024

Shashank-arista commented Jun 14, 2024

Shashank-arista commented Jun 14, 2024

DonaMaria2024 commented Jun 14, 2024 •

edited

Loading

Shashank-arista commented Jun 14, 2024 •

edited

Loading

DonaMaria2024 commented Jun 14, 2024 •

edited

Loading

DonaMaria2024 commented Jun 14, 2024

wenovus commented Jun 25, 2024

OpenConfigBot commented Jun 25, 2024

Adding support for OSPF authentication modes and encryption types #1127

Are you sure you want to change the base?

Adding support for OSPF authentication modes and encryption types #1127

Conversation

Shashank-arista commented Jun 12, 2024 • edited Loading

Change Scope

Platform Implementations

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

earies left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gunvinayaka commented Jun 14, 2024

DonaMaria2024 commented Jun 14, 2024

Shashank-arista commented Jun 14, 2024

Shashank-arista commented Jun 14, 2024

DonaMaria2024 commented Jun 14, 2024 • edited Loading

Shashank-arista commented Jun 14, 2024 • edited Loading

DonaMaria2024 commented Jun 14, 2024 • edited Loading

DonaMaria2024 commented Jun 14, 2024

wenovus commented Jun 25, 2024

OpenConfigBot commented Jun 25, 2024

Shashank-arista commented Jun 12, 2024 •

edited

Loading

DonaMaria2024 commented Jun 14, 2024 •

edited

Loading

Shashank-arista commented Jun 14, 2024 •

edited

Loading

DonaMaria2024 commented Jun 14, 2024 •

edited

Loading