https://jira.opendaylight.org This file is an XML representation of an issue en-us 8.20.10 820010 22-06-2022 https://jira.opendaylight.org/browse/BGPCEP-242 bgpcep <p>It is possible to re-configure TCPMD5 password for a client during ODL runtime using restconf. See the last URL/data in <a href="https://wiki.opendaylight.org/view/BGP_LS_PCEP:TCP_MD5_Guide#PCEP_2" class="external-link" target="_blank" rel="nofollow noopener">https://wiki.opendaylight.org/view/BGP_LS_PCEP:TCP_MD5_Guide#PCEP_2</a></p> <p>Implementation in Lithium works fine with this dynamic password re-configuration only up to the moment session is established. But the behavior when password is re-configured while session is established is not very secure.</p> <p>For example, session is not terminated when passwords no longer match.<br/> Another example: After deleting password element, PCC is still able to reconnect using its password.<br/> Note that these examples are not strictly bugs, as there is no documentation on which behavior should be expected.</p> <p>Thus it would be nice to define the desired behavior for Beryllium.</p> <p>Operating System: All<br/> Platform: All</p> BGPCEP-242

Correct behavior with respect to dynamic password change should be defined

Improvement Resolved Done Claudio David Gasparini Vratko Polak Wed, 17 Jun 2015 11:16:52 +0000 Sun, 3 Mar 2019 11:50:27 +0000 Mon, 23 Nov 2015 08:13:45 +0000 Bugzilla Migration Bugzilla Migration PCEP Thu, 17 Dec 2015 00:00:00 +0000 0 4 <p>RFC2385 does not provide a clean protocol for changing keys while retaining sessions. If the session keys do not match, the session will eventually be torn down via TCP channel communication breaking down.</p> <p>It is perfectly possible for the key change to be synchronized by means of meatware, hence I think the exact policy as to what to do when the key is changed is up to the user of TCP/MD5 (in this case PCEP) to implement a predictable behavior.</p> <p>I think in this case the server socket key should be changed first and then all the sessions should be torn down. That would be predictable, but unfortunately unforgiving in case of mismatched keys. I guess it is trade-off BGPCEP project can make.</p> <p>Links to Robot logs of suites testing one particular scenario for Lithium <span class="error">&#91;0&#93;</span> and Beryllium <span class="error">&#91;1&#93;</span> snapshots. The scenario replaces client configuration with new data without password element (test case Unset_Password) and then it is expected the topology data immediately vanishes (test case Topology_Unauthorized_4).</p> <p><span class="error">&#91;0&#93;</span> <a href="https://jenkins.opendaylight.org/releng/view/bgpcep/job/bgpcep-csit-1node-userfeatures-only-stable-lithium/lastSuccessfulBuild/robot/report/log.html#s1-s3" class="external-link" target="_blank" rel="nofollow noopener">https://jenkins.opendaylight.org/releng/view/bgpcep/job/bgpcep-csit-1node-userfeatures-only-stable-lithium/lastSuccessfulBuild/robot/report/log.html#s1-s3</a></p> <p><span class="error">&#91;1&#93;</span> <a href="https://jenkins.opendaylight.org/releng/view/bgpcep/job/bgpcep-csit-1node-userfeatures-only-beryllium/lastSuccessfulBuild/robot/report/log.html#s1-s3" class="external-link" target="_blank" rel="nofollow noopener">https://jenkins.opendaylight.org/releng/view/bgpcep/job/bgpcep-csit-1node-userfeatures-only-beryllium/lastSuccessfulBuild/robot/report/log.html#s1-s3</a></p> <p>Li: <a href="https://git.opendaylight.org/gerrit/#/c/29314/" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/29314/</a><br/> Li: <a href="https://git.opendaylight.org/gerrit/#/c/29313/" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/29313/</a></p> <p>Working correctly now in Lithium.</p> <p><a href="https://jenkins.opendaylight.org/releng/view/bgpcep/job/bgpcep-csit-1node-userfeatures-only-stable-lithium/lastSuccessfulBuild/robot/report/log.html#s1-s3" class="external-link" target="_blank" rel="nofollow noopener">https://jenkins.opendaylight.org/releng/view/bgpcep/job/bgpcep-csit-1node-userfeatures-only-stable-lithium/lastSuccessfulBuild/robot/report/log.html#s1-s3</a></p> <p>Be: <a href="https://git.opendaylight.org/gerrit/#/c/29539/" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/29539/</a></p> <p>be: <a href="https://jenkins.opendaylight.org/releng/view/bgpcep/job/bgpcep-csit-1node-userfeatures-only-beryllium/lastSuccessfulBuild/robot/report/log.html#s1-s3" class="external-link" target="_blank" rel="nofollow noopener">https://jenkins.opendaylight.org/releng/view/bgpcep/job/bgpcep-csit-1node-userfeatures-only-beryllium/lastSuccessfulBuild/robot/report/log.html#s1-s3</a></p> <p>successfully passed</p> Development External issue ID 3771 External issue URL Issue Type ODL SR Target Milestone Rank 0|i02b2v: