enable TCP_MD5SIG in the kernel config

[anubisg1]

I'm running Quagga on my raspberry pi. While testing the different features i noted that BGP md5 authentication failed.

2013/05/23 21:49:12 BGP: sockopt_tcp_signature: setsockopt(6): Protocol not available
2013/05/23 21:49:12 BGP: can't set TCP_MD5SIG option on socket 6: Protocol not available

after some investigation i found out that the kernel doesn't support this feature and should be enabled:

from config file i get:
CONFIG_TCP_MD5SIG is not set

please enable TCP MD5. Debian had this enabled long time ago: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=443742

kernel i'm running is 3.6.11+

root@ROUTER-RASP-BB2 /home/pi # cat /etc/debian_version
7.0
root@ROUTER-RASP-BB2 /home/pi # uname -a
Linux ROUTER-RASP-BB2 3.6.11+ #456 PREEMPT Mon May 20 17:42:15 BST 2013 armv6l GNU/Linux

i reported also to the raspbian project: https://bugs.launchpad.net/raspbian/+bug/1183546 , the raspbian official kernel is compiled with this option set and things works as they should.

[Ruffio]

@anubisg1 has this issue been resolved? If yes, then please close this issue.

[Ruffio]

@popcornmix this issue should be closed as there have been no activity since 2013, it looks like to have some PR merged in 2014 and no response to my ping a month ago, has been responded

[JamesH65]

Closing due to lack of activity. Reopen if you feel this issue is still relevant.

[arbitrix]

I'd like to see this re-opened if possible. The the time being BGP supports either insecure sessions or less insecure MG5 sessions. The latter require the CONFIG_TCP_MD5SIG to be set.

It would be nice to be able to do a BGP lab without having to recompile the kernel and then reconcile it with Raspbian updates across many machines.

[JamesH65]

As with any kernel change requests, we are mostly interesting in ensuring that there are no major memory or performance changes. Any idea on the impact of this change on either of those?

[arbitrix]

I have since learned that a VPN tunnel of sorts is a better approach to secure BGP sessions in my case. MD5 is terribly outdated and I can use WireGuard/IPSEC/OpenVPN instead.