Make authentication of SNPs work correctly - ie. conditionally like it is in
IOS.
diff --git a/isisd/isis_pdu.c b/isisd/isis_pdu.c
index bac903a..0e0a832 100644
--- a/isisd/isis_pdu.c
+++ b/isisd/isis_pdu.c
@@ -1270,10 +1270,7 @@
struct listnode *node, *node2;
struct tlvs tlvs;
struct list *lsp_list = NULL;
- /* TODO: Implement SNP authentication. */
-#if 0
struct isis_passwd *passwd;
-#endif
if (snp_type == ISIS_SNP_CSNP_FLAG)
{
@@ -1398,27 +1395,25 @@
return retval;
}
- /* FIXME: Authentication in LSPs does not mean authentication in SNPs...
- * In fact by default IOS only deals with LSPs authentication!!
- * To force authentication in SNPs, one must specify the 'authenticate
- * snp' command after 'area-password WORD' or 'domain-password WORD'.
- * This command is not supported for the moment.
- */
-#if 0
- (level == 1) ? (passwd = &circuit->area->area_passwd) :
- (passwd = &circuit->area->domain_passwd);
- if (passwd->type)
+ if (level == 1)
+ passwd = &circuit->area->area_passwd;
+ else
+ passwd = &circuit->area->domain_passwd;
+
+ if (CHECK_FLAG(passwd->snp_auth, SNP_AUTH_RECV))
{
- if (!(found & TLVFLAG_AUTH_INFO) ||
- authentication_check (passwd, &tlvs.auth_info))
+ if (passwd->type)
{
- isis_event_auth_failure (circuit->area->area_tag,
- "SNP authentication" " failure",
- phdr ? phdr->source_id : chdr->source_id);
- return ISIS_OK;
+ if (!(found & TLVFLAG_AUTH_INFO) ||
+ authentication_check (passwd, &tlvs.auth_info))
+ {
+ isis_event_auth_failure (circuit->area->area_tag,
+ "SNP authentication" " failure",
+ phdr ? phdr->source_id : chdr->source_id);
+ return ISIS_OK;
+ }
}
}
-#endif /* 0 */
/* debug isis snp-packets */
if (isis->debugs & DEBUG_SNP_PACKETS)
@@ -2155,9 +2150,10 @@
else
passwd = &circuit->area->domain_passwd;
- if (passwd->type)
- retval = tlv_add_authinfo (passwd->type, passwd->len,
- passwd->passwd, circuit->snd_stream);
+ if (CHECK_FLAG(passwd->snp_auth, SNP_AUTH_SEND))
+ if (passwd->type)
+ retval = tlv_add_authinfo (passwd->type, passwd->len,
+ passwd->passwd, circuit->snd_stream);
if (!retval && lsps)
{
@@ -2305,9 +2301,10 @@
else
passwd = &circuit->area->domain_passwd;
- if (passwd->type)
- retval = tlv_add_authinfo (passwd->type, passwd->len,
- passwd->passwd, circuit->snd_stream);
+ if (CHECK_FLAG(passwd->snp_auth, SNP_AUTH_SEND))
+ if (passwd->type)
+ retval = tlv_add_authinfo (passwd->type, passwd->len,
+ passwd->passwd, circuit->snd_stream);
if (!retval && lsps)
{