Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adding support for OSPF authentication modes and encryption types #1127

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Adding support for OSPF authentication modes and encryption types #1127

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
246ccad
OSPF authentication support
Shashank-arista Jun 7, 2024
06e2542
Address review comments
Shashank-arista Jun 13, 2024
589800b
Address review comments.
Shashank-arista Jun 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 73 additions & 1 deletion release/models/ospf/openconfig-ospf-types.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,13 @@ module openconfig-ospf-types {
description
"Type definitions for OSPF";

oc-ext:openconfig-version "0.1.3";
oc-ext:openconfig-version "0.2.0";

revision "2024-06-06" {
description
"Add OSPF authentication modes and encryption types.";
reference "0.2.0";
}

revision "2018-11-21" {
description
Expand Down Expand Up @@ -98,6 +104,72 @@ module openconfig-ospf-types {
}

// identities
identity MESSAGE_DIGEST_ENCRYPTION {
Shashank-arista marked this conversation as resolved.
Show resolved Hide resolved
description
"Base identity to define Message Digest encryption type.";
}

identity ENCRYPTION_NONE {
base MESSAGE_DIGEST_ENCRYPTION;
description
"No encrytion type.";
}

identity ENCRYPTION_MD5 {
base MESSAGE_DIGEST_ENCRYPTION;
description
"MD5 message digest encryption type.";
}

identity ENCRYPTION_SHA1 {
base MESSAGE_DIGEST_ENCRYPTION;
description
"SHA1 message digest encryption type.";
}

identity ENCRYPTION_SHA256 {
base MESSAGE_DIGEST_ENCRYPTION;
description
"SHA256 message digest encryption type.";
}

identity ENCRYPTION_SHA384 {
base MESSAGE_DIGEST_ENCRYPTION;
description
"SHA384 message digest encryption type.";
}

identity ENCRYPTION_SHA512 {
base MESSAGE_DIGEST_ENCRYPTION;
description
"SHA512 message digest encryption type.";
}

identity AUTH_MODE {
description
"Base identity to define OSPF authentication";
}

identity AUTH_NONE {
base AUTH_MODE;
description
"Authentication mode none.";
}

identity AUTH_SIMPLE_PASSWORD {
base AUTH_MODE;
description
"Authentication mode simple password.";
reference "RFC2328";
}

identity AUTH_MESSAGE_DIGEST {
base AUTH_MODE;
description
"Authentication mode message digest.";
reference "RFC5709";
Shashank-arista marked this conversation as resolved.
Show resolved Hide resolved
}

identity OSPF_LSA_TYPE {
description
"Base identity for an OSPF LSA type. This identity is intended
Expand Down
115 changes: 114 additions & 1 deletion release/models/ospf/openconfig-ospfv2-area-interface.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,13 @@ submodule openconfig-ospfv2-area-interface {
"This submodule provides OSPFv2 configuration and operational
state parameters that are specific to the area context";

oc-ext:openconfig-version "0.5.1";
oc-ext:openconfig-version "0.6.0";

revision "2024-06-06" {
description
"Add support for ospfv2 authentication modes and encryption types";
reference "0.6.0";
}

revision "2023-11-01" {
description
Expand Down Expand Up @@ -227,6 +233,55 @@ submodule openconfig-ospfv2-area-interface {
}
}

grouping ospfv2-area-interface-authentication-config {
description
"Configuration parameters relating to OSPF interface
authentication";

leaf auth-mode {
type identityref {
base oc-ospf-types:AUTH_MODE;
}
description
"Authentication mode to be used for OSPF interface links.";
}

leaf simple-password {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

when conditionals could probably be explored to match the branching based on the AUTH_MODE chosen

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We would want to be able to configure message digest keys, simple password irrespective of mode selected.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's fair. Note in JUNOS there is mutual exclusivity between modes in which password/keys are children of the mode vs. independent objects/toggles

type string;
description
"Password for simple authentication mode to be specified for OSPF.";
}
}

grouping ospfv2-area-interface-message-digest-config {
description
"Configuration parameters relating to OSPF message-digest
authentication";

leaf md-key-id {
Shashank-arista marked this conversation as resolved.
Show resolved Hide resolved
type uint8 {
range "1..255";
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This range looks to be EOS specific. The entire 8-bit range is usable including 0 for the Key ID

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I have removed the restriction.

}
description
"Message-digest keyid to be used for OSPF message digest auth.";
}

leaf md-encryption {
type identityref {
base oc-ospf-types:MESSAGE_DIGEST_ENCRYPTION;
}
description
"Encryption type to be used for OSPF message digest auth.";
}

leaf md-password {
type string;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For this and simple-password, we'll want to consider what these values mean for storage. Much like in ISIS, we likely at least want to leverage oc-types:routing-password to put some rules around a specific typedef when it comes to reads and writes.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have changed the simple-password and auth-key type to oc-types:routing-password

description
"Password to be used for message digest authentication mode
for OSPF.";
}
}

grouping ospfv2-area-interface-mpls-config {
description
"Configuration parameters relating to MPLS extensions for OSPF";
Expand Down Expand Up @@ -437,6 +492,64 @@ submodule openconfig-ospfv2-area-interface {
}
}

container authentication {
description
"Configuration and operational state parameters for
OSPFv2 authentication on the interface.";

container config {
description
"Configuration parameters for OSPFv2 authentication on
the interface";
uses ospfv2-area-interface-authentication-config;
}

container state {
config false;
description
"Operational state parameters for OSPFv2 authentication on
the interface";
uses ospfv2-area-interface-authentication-config;
}

container message-digests {
description
"Enclosing container for the list of message-digest keys that
can be configured on the interface";

list message-digest {
key "md-key-id";
max-elements 2;
Shashank-arista marked this conversation as resolved.
Show resolved Hide resolved

description
"A message-digest key to be used for OSPFv2 authentication";

leaf md-key-id {
type leafref {
path "../config/md-key-id";
}
description
"Message-digest authentication key identifier";
}

container config {
description
"Configuration parameters relating to the message-digest
authentication";
uses ospfv2-area-interface-message-digest-config;
}

container state {
config false;
description
"Operational state parameters relating to the message-digest
authentication";
uses ospfv2-area-interface-message-digest-config;
}
}
}
}

container mpls {
description
"Configuration and operational state parameters for
Expand Down
8 changes: 7 additions & 1 deletion release/models/ospf/openconfig-ospfv2.yang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,13 @@ module openconfig-ospfv2 {
"An OpenConfig model for Open Shortest Path First (OSPF)
version 2";

oc-ext:openconfig-version "0.5.1";
oc-ext:openconfig-version "0.6.0";

revision "2024-06-06" {
description
"Add support for ospfv2 authentication modes and encryption types";
reference "0.6.0";
}

revision "2023-11-01" {
description
Expand Down
Loading