Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix dynamic neighbor connect failed with auth-password(TCP-MD5) and wildcard mask #2861

Closed
wants to merge 1 commit into from

Conversation

ic0xgkk
Copy link
Contributor

@ic0xgkk ic0xgkk commented Dec 12, 2024

I want to use dynamic neighbor to accept all bgp clients, so I using the following config. BUT, all the bgp clients can not connect to gobgp.

I used tcpdump -M to capture the traffic, and I found the MD5 authentication was correct. At the end, I found the problem turned out to be the use of ::/0. In the current code, when the IPv4 or IPv6 mask is 0 (such as wildcard mask), TCP_MD5SIG will be used rather than TCP_MD5SIG_EXT, it cause the issue.

I've fixed it.

global:
  config:
    as: 65504
    router-id: 1.1.1.1
    port: 20179
peer-groups:
  - config:
      peer-group-name: dmwgd
      peer-as: 65504
      auth-password: "password"
    timers:
      config:
        connect-retry: 5
        hold-time: 15
        keepalive-interval: 3
    afi-safis:
      - config:
          afi-safi-name: ipv4-unicast
    transport:
      config:
        passive-mode: true
        ttl: 64
    route-reflector:
      config:
        route-reflector-client: true
        route-reflector-cluster-id: 1.1.1.0

dynamic-neighbors:
  - config:
      prefix: "::/0"
      peer-group: dmwgd

@fujita
Copy link
Member

fujita commented Dec 18, 2024

pushed, thanks!

@fujita fujita closed this Dec 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants