From: Ondrej Zajicek <santiago@crfreenet.org>
Date: Mon, 31 Mar 2025 14:21:47 +0000 (+0200)
Subject: BGP: Forbid TCP-AO on dynamic BGP sessions
X-Git-Tag: v3.1.0~8^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e69d80c90795f0dad727c97410944039fcd41a19;p=thirdparty%2Fbird.git

BGP: Forbid TCP-AO on dynamic BGP sessions

Reconfiguration does not work properly for this case, disable it for now.
---

diff --git a/doc/bird.sgml b/doc/bird.sgml
index 3d968e38a..6585672f7 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -3143,7 +3143,8 @@ protocol bgp [<name>] {
 	the (single) password. Finally, <cf/ao/ means to use TCP Authentication
 	Option (TCP-AO, <rfc id="5925">), allowing multiple keys and different
 	cryptographic algorithms. These are specified using the option
-	<ref id="bgp-keys" name="keys">. Default: none.
+	<ref id="bgp-keys" name="keys">. Note that TCP-AO authentication is not
+	supported on dynamic BGP sessions. Default: none.
 
 	<tag><label id="bgp-password">password "<m/text/"</tag>
 	Use this password for MD5 authentication of BGP sessions (<rfc id="2385">). When
diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c
index f1f8140d0..f5008f6cf 100644
--- a/proto/bgp/bgp.c
+++ b/proto/bgp/bgp.c
@@ -2617,6 +2617,9 @@ bgp_postconfig(struct proto_config *CF)
   if ((cf->auth_type == BGP_AUTH_AO) != !!cf->ao_keys)
     cf_error("AO authentication and keys option should be used together");
 
+  if ((cf->auth_type == BGP_AUTH_AO) && cf->remote_range)
+    cf_error("AO authentication not supported on dynamic BGP sessions");
+
   struct bgp_channel_config *cc;
   BGP_CF_WALK_CHANNELS(cf, cc)
   {