From owner-freebsd-net@FreeBSD.ORG Thu Nov 28 18:14:20 2013 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 636ADA75 for ; Thu, 28 Nov 2013 18:14:20 +0000 (UTC) Received: from mail-pd0-x233.google.com (mail-pd0-x233.google.com [IPv6:2607:f8b0:400e:c02::233]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 34D991D19 for ; Thu, 28 Nov 2013 18:14:20 +0000 (UTC) Received: by mail-pd0-f179.google.com with SMTP id r10so12400585pdi.38 for ; Thu, 28 Nov 2013 10:14:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=YiEGus+phsDydT7FKBOWHAoZMyBCDU76c7N8GZ9qHzo=; b=0w7dsmUmK9uCCOK8wHl8iZkTANfFssNmpZPN4JSd32e8qqxCJMOvdv6AUXiStj6cgq ozu6fnGKy9ZxRXAa2bns4InclwLt6UVCbuLIivLdAgU2scQ7V1VNcZVj/qU9Ow1vgvTq Z+QtHIg2DlW6u9EGcqcaKg1O+Vsa3CSVIpP7tr77vUsRPukSFy5rjU3zVYFstO87+XVZ fnkgPT/LJHjYoHe76b/O1Wv09veL7ReqE//WB5f8vnSdlZ5PE83w+J1UIOAG+05/jhdt f1kbxR+OV/yVSGg6EzmYK2jgXehzn+/mqiqh6V7O5IbpBy8EdMBPCa3NpwDwEVpyj/Vj SB8g== MIME-Version: 1.0 X-Received: by 10.66.4.130 with SMTP id k2mr47586500pak.95.1385662458999; Thu, 28 Nov 2013 10:14:18 -0800 (PST) Sender: ermal.luci@gmail.com Received: by 10.70.4.163 with HTTP; Thu, 28 Nov 2013 10:14:18 -0800 (PST) In-Reply-To: <87ob54pndw.fsf@marcos.anarc.at> References: <87zjoqu3wr.fsf@marcos.anarc.at> <874n6xu31q.fsf@marcos.anarc.at> <87ob54pndw.fsf@marcos.anarc.at> Date: Thu, 28 Nov 2013 19:14:18 +0100 X-Google-Sender-Auth: beog3UZ7omkCwEUcsX7jXTHs1Vc Message-ID: Subject: Re: OpenBGPd + TCP-MD5 sig fails after a few weeks From: =?ISO-8859-1?Q?Ermal_Lu=E7i?= To: =?ISO-8859-1?Q?Antoine_Beaupr=E9?= Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.16 Cc: freebsd-net X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Nov 2013 18:14:20 -0000 On Thu, Nov 28, 2013 at 4:16 PM, Antoine Beaupr=E9 wro= te: > On 2013-11-28 10:05:55, Ermal Lu=E7i wrote: > > On Wed, Nov 27, 2013 at 7:12 PM, Antoine Beaupr=E9 >wrote: > > > >> On 2013-11-27 05:58:12, Ermal Lu=E7i wrote: > >> > You can use the port here > >> > https://github.com/pfsense/pfsense-tools/tree/master/pfPorts/openbgp= d > >> > It has integration with pfkey sockets of FreeBSD in the daemon itsel= f > and > >> > you have to specify only th espd policy through setkey. > >> > > >> > It works for pfSense. > >> > >> While it seems to bootstrap properly, it still fails to isntall a > >> security association, in my bgpd.conf: > >> > >> tcp md5sig password "[...]" > >> > > > > Probably because you are putting "(quotes) on the password and that is > > wrong. > > That means password on the connection is wrong since it has " in it. > > Think its an issue of the bgpd parser on this. > > I also tried without the quotes, same effect. > Can you show your related config to this! The only other thing i can think of is that since the daemon is inserting policies you have to define local-address $your-local-ip So the SPD policy is generated correctly. You can verify the generated policy using setkey utility. > > A. > -- > Never underestimate the bandwidth of a station wagon full of tapes > hurtling down the highway. > - Andrew S. Tanenbaum, "Computer Networks" > --=20 Ermal