ospf: T7679: add "null" authentication option

3 files changed, 21 insertions, 2 deletions

diff --git a/data/templates/frr/ospfd.frr.j2 b/data/templates/frr/ospfd.frr.j2
index 7027f1aca..a3a8c5bcb 100644
--- a/data/templates/frr/ospfd.frr.j2
+++ b/data/templates/frr/ospfd.frr.j2
@@ -12,6 +12,8 @@ interface {{ iface }}
  ip ospf message-digest-key {{ key }} md5 {{ key_config.md5_key }}
 {%                 endfor %}
 {%             endif %}
+{%         elif iface_config.authentication.null is vyos_defined %}
+ ip ospf authentication null
 {%         endif %}
 {%         if iface_config.area is vyos_defined %}
  ip ospf area {{ iface_config.area }}
@@ -128,6 +130,8 @@ router ospf {{ 'vrf ' ~ vrf if vrf is vyos_defined }}
 {%                     for key, key_config in link_config.authentication.md5.key_id.items() %}
  area {{ area_id }} virtual-link {{ link }} message-digest-key {{ key }} md5 {{ key_config.md5_key }}
 {%                     endfor %}
+{%                 elif link_config.authentication.null is vyos_defined %}
+ area {{ area_id }} virtual-link {{ link }} authentication null
 {%                 endif %}
 {#         The following values are default values #}
  area {{ area_id }} virtual-link {{ link }} hello-interval {{ link_config.hello_interval }} retransmit-interval {{ link_config.retransmit_interval }} retransmit-window {{ link_config.retransmit_window }} transmit-delay {{ link_config.transmit_delay }} dead-interval {{ link_config.dead_interval }}
diff --git a/interface-definitions/include/ospf/authentication.xml.i b/interface-definitions/include/ospf/authentication.xml.i
index 8e8cad067..f38a37269 100644
--- a/interface-definitions/include/ospf/authentication.xml.i
+++ b/interface-definitions/include/ospf/authentication.xml.i
@@ -38,6 +38,12 @@
         </tagNode>
       </children>
     </node>
+    <leafNode name="null">
+      <properties>
+        <help>Use null authentication</help>
+        <valueless/>
+      </properties>
+    </leafNode>
     <leafNode name="plaintext-password">
       <properties>
         <help>Plain text password</help>
diff --git a/src/conf_mode/protocols_ospf.py b/src/conf_mode/protocols_ospf.py
index 3f312d2cd..46023e486 100755
--- a/src/conf_mode/protocols_ospf.py
+++ b/src/conf_mode/protocols_ospf.py
@@ -102,8 +102,17 @@ def verify(config_dict):
             if 'area' in ospf and 'area' in interface_config:
                 for area, area_config in ospf['area'].items():
                     if 'network' in area_config:
-                        raise ConfigError('Can not use OSPF interface area and area ' \
-                                          'network configuration at the same time!')
+                        raise ConfigError('Can not use OSPF "interface area" and ' \
+                                          '"area network" configuration at the same time!')
+
+            # FRR only allows a single authentication mode (MD5, NULL or plaintext)
+            # at a time. Prevent users from defining more than one authentication mode.
+            if 'authentication' in interface_config:
+                auth_keys = set(interface_config['authentication'])
+                exclusive_auth_keys = {'md5', 'null', 'plaintext_password'}
+                if len(auth_keys & exclusive_auth_keys) >= 2:
+                    raise ConfigError('Can not use multiple authentication modes '
+                                      f'simultaneously for interface "{interface}"!')
 
             # If interface specific options are set, we must ensure that the
             # interface is bound to our requesting VRF. Due to the VyOS