Re: auth_type PASS

Dear quentin,

Thanks a lot for your comments !

I'd like to please describe it with more details:

Working with 2 routers, one virtual router instance.

   - Using auth_type PASS on both machines - it works fine - one is
   becoming Master, the other Backup.
   - Using auth_type AH - same.
   - Using no auth_type - same.

looks fine.

But setting the Backup machine to auth_type PASS and the other machine with
no authentication, I expect Backup machine to drop advertisement packets
and hence to go into Master state. correct?
Actually I see in logs that advertisements packets are really dropped, but
the state is not changed !
Is it OK?

log messages:
===========
bogus VRRP packet received on vrrp.5 !!!
VRRP_Instance(VI_vif10_5) ignoring received advertisment...

Setting the Backup machine to auth_type AH (leaving the master machine
un-changed), authentication fails and state is changed to Master as I
expect.

I mean:
----------
In AH, same packets from master are not dropped (hence authentication fails
and state is changed) .
In PASS, same packets are dropped (hence authentication is not checked,
state is not changed...)

Why the behavior is different than PASS ?

Thanks
Barak


On Thu, Feb 23, 2017 at 3:17 PM, Quentin Armitage <[email protected]>
wrote:

> Please see comments inline
>
> On Thu, 2017-02-23 at 14:50 +0200, barak adam wrote:
>
> Hi,
>
>
>
> Enabling AH, authentication works and drop non-authenticated packets
>
> Enabling PASS - I see no impact. why??
>
>
>
> I know that authentication is discouraged by the latest RFC and I looked
> into vrrp_in_chk() source.
>
> It's not so much that authentication is discouraged, but more that
> authentication doesn't exist in the current RFCs for VRRPv2 and VRRPv3.
>
>
> Using PASS should do nothing in VRRPv3? Do I need to force version to
> VRRPv2 in order to make PASS working ?
>
> If authentication is configured for a version 3 instance, a message should
> be logged reporting "VRRP version 3 does not support authentication.
> Ignoring." If you look at RFC5798 (VRRPv3 RFC) at section 5.1, you will see
> that there is nowhere in the VRRP header for authentication. If you want to
> use authentication then you will need to use VRRPv2, and the authentication
> is retained as a legacy from RFC2338 (RFC3768 which supersedes it removed
> authentication). You will also need to ensure that you don't have strict
> mode enabled.
>
>
> It really is worth looking at the log entries that keepalived writes,
> since they tell you what is happening.
>
> Quentin Armitage
>

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot

_______________________________________________
Keepalived-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/keepalived-devel