|
 |
4d1074 |
diff --git a/ospfd/ospf_vty.c b/ospfd/ospf_vty.c
|
|
|
4d1074 |
index 631465f..e084ff3 100644
|
|
|
4d1074 |
--- a/ospfd/ospf_vty.c
|
|
|
4d1074 |
+++ b/ospfd/ospf_vty.c
|
|
|
4d1074 |
@@ -1136,6 +1136,11 @@ DEFUN (ospf_area_vlink,
|
|
|
4d1074 |
|
|
|
4d1074 |
if (argv_find(argv, argc, "message-digest", &idx)) {
|
|
|
4d1074 |
/* authentication message-digest */
|
|
|
4d1074 |
+ if(FIPS_mode())
|
|
|
4d1074 |
+ {
|
|
|
4d1074 |
+ vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
|
|
|
4d1074 |
+ return CMD_WARNING_CONFIG_FAILED;
|
|
|
4d1074 |
+ }
|
|
|
4d1074 |
vl_config.auth_type = OSPF_AUTH_CRYPTOGRAPHIC;
|
|
|
4d1074 |
} else if (argv_find(argv, argc, "null", &idx)) {
|
|
|
4d1074 |
/* "authentication null" */
|
|
|
4d1074 |
@@ -1993,6 +1998,15 @@ DEFUN (ospf_area_authentication_message_digest,
|
|
|
4d1074 |
? OSPF_AUTH_NULL
|
|
|
4d1074 |
: OSPF_AUTH_CRYPTOGRAPHIC;
|
|
|
4d1074 |
|
|
|
4d1074 |
+ if(area->auth_type == OSPF_AUTH_CRYPTOGRAPHIC)
|
|
|
4d1074 |
+ {
|
|
|
4d1074 |
+ if(FIPS_mode())
|
|
|
4d1074 |
+ {
|
|
|
4d1074 |
+ vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
|
|
|
4d1074 |
+ return CMD_WARNING_CONFIG_FAILED;
|
|
|
4d1074 |
+ }
|
|
|
4d1074 |
+ }
|
|
|
4d1074 |
+
|
|
|
4d1074 |
return CMD_SUCCESS;
|
|
|
4d1074 |
}
|
|
|
4d1074 |
|
|
|
4d1074 |
@@ -6665,6 +6679,11 @@ DEFUN (ip_ospf_authentication_args,
|
|
|
4d1074 |
|
|
|
4d1074 |
/* Handle message-digest authentication */
|
|
|
4d1074 |
if (argv[idx_encryption]->arg[0] == 'm') {
|
|
|
4d1074 |
+ if(FIPS_mode())
|
|
|
4d1074 |
+ {
|
|
|
4d1074 |
+ vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
|
|
|
4d1074 |
+ return CMD_WARNING_CONFIG_FAILED;
|
|
|
4d1074 |
+ }
|
|
|
4d1074 |
SET_IF_PARAM(params, auth_type);
|
|
|
4d1074 |
params->auth_type = OSPF_AUTH_CRYPTOGRAPHIC;
|
|
|
4d1074 |
return CMD_SUCCESS;
|
|
|
4d1074 |
@@ -6971,6 +6990,11 @@ DEFUN (ip_ospf_message_digest_key,
|
|
|
4d1074 |
"The OSPF password (key)\n"
|
|
|
4d1074 |
"Address of interface\n")
|
|
|
4d1074 |
{
|
|
|
4d1074 |
+ if(FIPS_mode())
|
|
|
4d1074 |
+ {
|
|
|
4d1074 |
+ vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
|
|
|
4d1074 |
+ return CMD_WARNING_CONFIG_FAILED;
|
|
|
4d1074 |
+ }
|
|
|
4d1074 |
VTY_DECLVAR_CONTEXT(interface, ifp);
|
|
|
4d1074 |
struct crypt_key *ck;
|
|
|
4d1074 |
uint8_t key_id;
|
|
|
4d1074 |
diff --git a/isisd/isis_circuit.c b/isisd/isis_circuit.c
|
|
|
4d1074 |
index 81b4b39..cce33d9 100644
|
|
|
4d1074 |
--- a/isisd/isis_circuit.c
|
|
|
4d1074 |
+++ b/isisd/isis_circuit.c
|
|
|
4d1074 |
@@ -1318,6 +1318,10 @@ static int isis_circuit_passwd_set(struct isis_circuit *circuit,
|
|
|
4d1074 |
return ferr_code_bug(
|
|
|
4d1074 |
"circuit password too long (max 254 chars)");
|
|
|
4d1074 |
|
|
|
4d1074 |
+ //When in FIPS mode, the password never gets set in MD5
|
|
|
4d1074 |
+ if((passwd_type == ISIS_PASSWD_TYPE_HMAC_MD5) && FIPS_mode())
|
|
|
4d1074 |
+ return ferr_cfg_invalid("FIPS mode is enabled, md5 authentication is disabled");
|
|
|
4d1074 |
+
|
|
|
4d1074 |
circuit->passwd.len = len;
|
|
|
4d1074 |
strncpy((char *)circuit->passwd.passwd, passwd, 255);
|
|
|
4d1074 |
circuit->passwd.type = passwd_type;
|
|
|
4d1074 |
diff --git a/isisd/isisd.c b/isisd/isisd.c
|
|
|
4d1074 |
index 419127c..a6c36af 100644
|
|
|
4d1074 |
--- a/isisd/isisd.c
|
|
|
4d1074 |
+++ b/isisd/isisd.c
|
|
|
4d1074 |
@@ -1638,6 +1638,10 @@ static int isis_area_passwd_set(struct isis_area *area, int level,
|
|
|
4d1074 |
if (len > 254)
|
|
|
4d1074 |
return -1;
|
|
|
4d1074 |
|
|
|
4d1074 |
+ //When in FIPS mode, the password never get set in MD5
|
|
|
4d1074 |
+ if ((passwd_type == ISIS_PASSWD_TYPE_HMAC_MD5) && (FIPS_mode()))
|
|
|
4d1074 |
+ return ferr_cfg_invalid("FIPS mode is enabled, md5 authentication is disabled");
|
|
|
4d1074 |
+
|
|
|
4d1074 |
modified.len = len;
|
|
|
4d1074 |
strncpy((char *)modified.passwd, passwd, 255);
|
|
|
4d1074 |
modified.type = passwd_type;
|
|
|
4d1074 |
diff --git a/ripd/rip_cli.c b/ripd/rip_cli.c
|
|
|
4d1074 |
index 5bb81ef..02a09ef 100644
|
|
|
4d1074 |
--- a/ripd/rip_cli.c
|
|
|
4d1074 |
+++ b/ripd/rip_cli.c
|
|
|
4d1074 |
@@ -796,6 +796,12 @@ DEFPY (ip_rip_authentication_mode,
|
|
|
4d1074 |
value = "20";
|
|
|
4d1074 |
}
|
|
|
4d1074 |
|
|
|
4d1074 |
+ if(strmatch(mode, "md5") && FIPS_mode())
|
|
|
4d1074 |
+ {
|
|
|
4d1074 |
+ vty_out(vty, "FIPS mode is enabled, md5 authentication id disabled\n");
|
|
|
4d1074 |
+ return CMD_WARNING_CONFIG_FAILED;
|
|
|
4d1074 |
+ }
|
|
|
4d1074 |
+
|
|
|
4d1074 |
nb_cli_enqueue_change(vty, "./authentication-scheme/mode", NB_OP_MODIFY,
|
|
|
4d1074 |
strmatch(mode, "md5") ? "md5" : "plain-text");
|
|
|
4d1074 |
nb_cli_enqueue_change(vty, "./authentication-scheme/md5-auth-length",
|