October 2024 - Bird-users

function return type for enum roa
by James 18 Oct '24

18 Oct '24

Hello, I tried to create a function that returns enum roa. However, I'm encountering difficulties specifying its return type. ``` function check_clearnet_roa() { case net.type { NET_IP4: return roa_check(clearnet_roa_v4, net, bgp_path.last); NET_IP6: return roa_check(clearnet_roa_v6, net, bgp_path.last); else: print "is_roa_invalid: ", "unexpected net.type ", net.type, " ", net; return ROA_UNKNOWN; } } ``` If I use "-> enum roa" as return type, birdcl co ch will return "clearnet.conf:143:34 syntax error, unexpected CF_SYM_UNDEFINED". If I use "-> 'enum roa'" as return type, birdcl co ch will return "clearnet.conf:143:39 Invalid character in apostrophed symbol". If I don't specify its return type, bird issues the warning "clearnet.conf:145:71: Inferring function check_clearnet_roa return type from its return value: enum roa". How should I correctly specify its return type? Regards, James

2 1

Re: Fwd: Address update causing infinite loop
by Maria Matejka 18 Oct '24

18 Oct '24

Hello! On Fri, Oct 18, 2024 at 07:28:02PM +0800, benli ye wrote: > > Subject: Address update causing infinite loop > > > > Hi Maria, > > > > We also encountered an infinite loop issue which is similar to the following link. Could you please share any update about the bug which you mentioned in your mail. > > <https://bird.network.cz/pipermail/bird-users/2022-January/015924.html> There is no update, we couldn't determine anything. > > BIRD version in our environment is 1.6.3-2. BIRD 1 is out of support, please upgrade to BIRD 2. > > ``` > > static void > > static_neigh_notify(struct neighbor *n) > > { > > struct proto *p = n->proto; > > struct static_route *r; > > > > DBG("Static: neighbor notify for %I: iface %p\n", n->addr, n->iface); > > for(r=n->data; r; r=r->chain) ---->>>>>>> by gdb，we check the bird is in this loop. > > { > > static_update_bfd(p, r); > > static_update_rte(p, r); > > } > > } > > ``` With just this information, we can't determine anything, the cause may be anywhere. And AFAIK this is where not only the last report ended as well, but also this is quite a different place and I don't see much more connection than that it has the same symptoms (wasting time in a linked list). Are you able to reproduce this issue with some reasonable probability, so that we could try this in our lab, or is it just a random fail? Could you please at least describe what exactly was happening when this happened? Thanks, Maria -- Maria Matejka (she/her) | https://maria.jmq.cz/

1 0

[PATCH] Fix BGP IPv6 flowspec prefix when offset is not multiple of 8
by Eric Long 16 Oct '24

16 Oct '24

Hi BIRD maintainers, I was messing with BGP flowspec when I encountered BIRD's inconsistencies with RFC. Details and patch is attached below. Thanks! Cheers, Eric From 3008eeb2d4df45b2a4ac78b038f7c830b7495a88 Mon Sep 17 00:00:00 2001 From: Eric Long Date: Mon, 14 Oct 2024 00:30:13 +0800 Subject: [PATCH] Fix BGP IPv6 flowspec prefix when offset is not multiple of 8 Current implementation handles flowspec prefix length and offset only in bytes, but RFC 8956 (Dissemination of Flow Specification Rules for IPv6) Section 3.1 [1] and example in Section 3.8.2 [2] states the pattern should begin right after offset *bits*. For example, pattern "::1:1234:5678:9800:0/60-104" is currently serialized as "02 68 3c 01 12 34 56 78 98", but it should shift its pattern 4 more bits to the left: "02 68 3c 11 23 45 67 89 80". This patch implements shifting left/right for IPv6 type and use it to correct the behaviour. Test data are replaced with the correct ones. [1]: https://www.rfc-editor.org/rfc/rfc8956.html#section-3.1 [2]: https://www.rfc-editor.org/rfc/rfc8956.html#section-3.8.2 --- lib/flowspec.c | 12 +++++------ lib/flowspec_test.c | 4 ++-- lib/ip.h | 50 +++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 57 insertions(+), 9 deletions(-) diff --git a/lib/flowspec.c b/lib/flowspec.c index df5c8da3..6e693def 100644 --- a/lib/flowspec.c +++ b/lib/flowspec.c @@ -293,13 +293,11 @@ flow_read_ip4_part(const byte *part) static inline ip6_addr flow_read_ip6(const byte *px, uint pxlen, uint pxoffset) { - uint floor_offset = BYTES(pxoffset - (pxoffset % 8)); - uint ceil_len = BYTES(pxlen); ip6_addr ip = IP6_NONE; - memcpy(((byte *) &ip) + floor_offset, px, ceil_len - floor_offset); + memcpy(((byte *) &ip), px, BYTES(pxlen - pxoffset)); - return ip6_ntoh(ip); + return ip6_shift_right(ip6_ntoh(ip), pxoffset); } ip6_addr @@ -476,7 +474,7 @@ flow_validate(const byte *nlri, uint len, int ipv6) uint pxoffset = *pos++; if (pxoffset > IP6_MAX_PREFIX_LENGTH || pxoffset > pxlen) return FLOW_ST_EXCEED_MAX_PREFIX_OFFSET; - bytes -= pxoffset / 8; + bytes = BYTES(pxlen - pxoffset); } pos += bytes; @@ -749,12 +747,12 @@ flow_builder6_add_pfx(struct flow_builder *fb, const net_addr_ip6 *n6, u32 pxoff if (!builder_add_prepare(fb)) return 0; - ip6_addr ip6 = ip6_hton(n6->prefix); + ip6_addr ip6 = ip6_hton(ip6_shift_left(n6->prefix, pxoffset)); BUFFER_PUSH(fb->data) = fb->this_type; BUFFER_PUSH(fb->data) = n6->pxlen; BUFFER_PUSH(fb->data) = pxoffset; - push_pfx_to_buffer(fb, BYTES(n6->pxlen) - (pxoffset / 8), ((byte *) &ip6) + (pxoffset / 8)); + push_pfx_to_buffer(fb, BYTES(n6->pxlen - pxoffset), ((byte *) &ip6)); builder_add_finish(fb); return 1; diff --git a/lib/flowspec_test.c b/lib/flowspec_test.c index 03649b99..ae7444b2 100644 --- a/lib/flowspec_test.c +++ b/lib/flowspec_test.c @@ -533,7 +533,7 @@ t_builder6(void) byte nlri[] = { 27, - FLOW_TYPE_DST_PREFIX, 103, 61, 0x01, 0x12, 0x34, 0x56, 0x78, 0x98, + FLOW_TYPE_DST_PREFIX, 103, 61, 0x22, 0x46, 0x8a, 0xcf, 0x13, 0x00, FLOW_TYPE_SRC_PREFIX, 8, 0, 0xc0, FLOW_TYPE_NEXT_HEADER, 0x80, 0x06, FLOW_TYPE_PORT, 0x03, 0x89, 0x45, 0x8b, 0x91, 0x1f, 0x90, @@ -641,7 +641,7 @@ t_formatting6(void) byte nlri[] = { 0, - FLOW_TYPE_DST_PREFIX, 103, 61, 0x01, 0x12, 0x34, 0x56, 0x78, 0x98, + FLOW_TYPE_DST_PREFIX, 103, 61, 0x22, 0x46, 0x8a, 0xcf, 0x13, 0x00, FLOW_TYPE_SRC_PREFIX, 8, 0, 0xc0, FLOW_TYPE_NEXT_HEADER, 0x81, 0x06, FLOW_TYPE_PORT, 0x03, 20, 0x45, 40, 0x91, 0x01, 0x11, diff --git a/lib/ip.h b/lib/ip.h index f9aa7f66..6282c111 100644 --- a/lib/ip.h +++ b/lib/ip.h @@ -467,6 +467,56 @@ int ip4_pton(const char *a, ip4_addr *o); int ip6_pton(const char *a, ip6_addr *o); +/* + * IPv6 bit shifting + */ + +static inline ip6_addr +ip6_shift_left(ip6_addr a, uint bits) { + int bytes, rem, i; + + if (bits == 0) + return a; + + if (bits > 127) + return IP6_NONE; + + bytes = bits / 32; + rem = bits % 32; + + for (i = 0; i < 3 - bytes; i++) + a.addr[i] = (a.addr[i + bytes] << rem) | + (rem ? (a.addr[i + bytes + 1] >> (32 - rem)) : 0); + + a.addr[3 - bytes] = a.addr[3] << rem; + memset(&a.addr[4 - bytes], 0, bytes * 4); + + return a; +} + +static inline ip6_addr +ip6_shift_right(ip6_addr a, uint bits) { + int bytes, rem, i; + + if (bits == 0) + return a; + + if (bits > 127) + return IP6_NONE; + + bytes = bits / 32; + rem = bits % 32; + for (i = 3; i > bytes; i--) + a.addr[i] = (a.addr[i - bytes] >> rem) | + (rem ? (a.addr[i - bytes - 1] << (32 - rem)) : 0); + + a.addr[bytes] = a.addr[0] >> rem; + memset(&a.addr[0], 0, bytes * 4); + + return a; +} + + /* * Miscellaneous */ -- 2.47.0

2 1

[PATCH] Improved readability of the operator documentation
by Johannes Erwerle 15 Oct '24

15 Oct '24

Hi! Every now and then I have to look up what the ~ operator does exactly. Finding the right combination of types in the long running text is always quite hard. I think that formatting that as a list would make this easier. I also put different kinds of operators into different paragraphs, because I think this also makes it easier to find what you are looking for in this section. For reference: This is the block I am talking about: https://bird.network.cz/?get_doc&v=20&f=bird-5.html#ss5.3 Kind Regards Jo From 08c1e50a97b0afd6522d52ba0f9488c8cc3cb9f8 Mon Sep 17 00:00:00 2001 From: Johannes Erwerle <jo(a)swagspace.org> Date: Sat, 12 Oct 2024 09:07:42 +0200 Subject: [PATCH] Improved readability of the operator documentation --- doc/bird.sgml | 40 +++++++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/doc/bird.sgml b/doc/bird.sgml index 6857452d..7ee066bb 100644 --- a/doc/bird.sgml +++ b/doc/bird.sgml @@ -1897,21 +1897,31 @@ in the foot). <label id="operators"> The filter language supports common integer operators <cf>(+,-,*,/)</cf>, -parentheses <cf/(a*(b+c))/, comparison <cf/(a=b, a!=b, a<b, a>=b)/. -Logical operations include unary not (<cf/!/), and (<cf/&&/), and or -(<cf/||/). Special operators include (<cf/&tilde;/, -<cf/!&tilde;/) for "is (not) element of a set" operation - it can be used on -element and set of elements of the same type (returning true if element is -contained in the given set), or on two strings (returning true if first string -matches a shell-like pattern stored in second string) or on IP and prefix -(returning true if IP is within the range defined by that prefix), or on prefix -and prefix (returning true if first prefix is more specific than second one) or -on bgppath and bgpmask (returning true if the path matches the mask) or on -number and bgppath (returning true if the number is in the path) or on bgppath -and int (number) set (returning true if any ASN from the path is in the set) or -on pair/quad and clist (returning true if the pair/quad is element of the -clist) or on clist and pair/quad set (returning true if there is an element of -the clist that is also a member of the pair/quad set). +parentheses <cf/(a*(b+c))/, comparison <cf/(a=b, a!=b, a<b, a>=b)/. + +Logical operations include unary not (<cf/!/), and (<cf/&&/), and or +(<cf/||/). + +Special operators include (<cf/&tilde;/, +<cf/!&tilde;/) for "is (not) element of a set" operation - it can be used on: +<itemize> + <item>element and set of elements of the same type (returning true if + element is contained in the given set) + <item>two strings (returning true if first string matches a shell-like + pattern stored in second string) + <item>IP and prefix (returning true if IP is within the range defined by + that prefix), + <item>prefix and prefix (returning true if first prefix is more specific + than second one) + <item>bgppath and bgpmask (returning true if the path matches the mask) + <item>number and bgppath (returning true if the number is in the path) + <item>bgppath and int (number) set (returning true if any ASN from the + path is in the set) + <item>pair/quad and clist (returning true if the pair/quad is element of + the clist) + <item>clist and pair/quad set (returning true if there is an element of the + clist that is also a member of the pair/quad set). +</itemize> There is one operator related to ROA infrastructure - <cf/roa_check()/. It examines a ROA table and does <rfc id="6483"> route origin validation for a -- 2.46.0

2 1

[BIRD] Upgrade Debian
by Jakub Osuch 13 Oct '24

13 Oct '24

Dear BIRD community I would like to upgrade Debian with BIRD. 10 to 11 and finally to 12. I have several VM Debian machines without BIRD and this tutorial works for me. https://www.cyberciti.biz/faq/update-upgrade-debian-11-to-debian-12-bookwor… Can I upgrade my servers Debian 10 with BIRD 1.6.6 to new Debian and BIRD 1.6.8 without problems ? -- Jakub Osuch mobile +48501203739 www.techgroup.pl

2 1

case & string
by Mikhail Mayorov 11 Oct '24

11 Oct '24

Hi! I try use CASE and string variable and a have error.... I checked User's guide 2.0 <https://bird.network.cz/?get_doc&f=bird.html&v=20>.... CASE use operator ~. This operator applies to string variables. What am I doing wrong? [root@wine etc]# cat 123.conf && bird -c ./123.conf -p function teststring(string myvar) -> bool { case myvar { "text A" : print "A"; return true; "text B" : print "B"; return true; "text C" : print "C"; return true; else : print "unknown"; return false; } } bird: ./123.conf:4:12 syntax error, unexpected TEXT -- Regards, Mikhail Mayorov

4 6

Re: BIRD is not prepending ASN on EBGP export.
by Ochalski, Radoslaw 10 Oct '24

10 Oct '24

Thanks Ondrej, So for the routes originating in AS20940, downstream will not be aware of AS20940 in the as-path it will only know private AS4290006033. Kind Regards, Radek On 10/8/24, 5:18 PM, "Ondrej Zajicek" <santiago(a)crfreenet.org <mailto:santiago@crfreenet.org>> wrote: !-------------------------------------------------------------------| This Message Is From an External Sender This message came from outside your organization. |-------------------------------------------------------------------! On Tue, Oct 08, 2024 at 04:46:07PM +0200, Alexander Zubkov via Bird-users wrote: > Hi Radoslaw, > > Do I get it right, that you have 2 bgp peerings here. First your route > passes this peering: > AS8075 <-> AS20940 > then it passes other peering: > AS4290006033 <-> AS4290006002 > > Then it is an expected behaviour. Because the ASN is prepended when > route is exported over eBGP session. And the local ASN is prepended. > So you see that when you receive the route over the first peering, it > is prepended with AS8075. Then it goes over the second peering, where > it is prepended with AS4290006033. Yes, that is true. I would add that one is not supposed to have different local ASNs for different BGP instances that form coherent BGP router, unless it is configured as BGP confederation or manually patched by filters. -- Elen sila lumenn' omentielvo Ondrej 'Santiago' Zajicek (email: santiago(a)crfreenet.org <mailto:santiago@crfreenet.org>) "To err is human -- to blame it on a computer is even more so."

3 5

FW: BIRD is not prepending ASN on EBGP export.
by Ochalski, Radoslaw 08 Oct '24

08 Oct '24

Hi, We have observed strange behavior where BIRD is not adding ASN on EBGP export. Route is received on IBGP session within AS20940: r04.border01.lon03.fab > bird show config template bgp 4INTERECOR_ROUTERS template bgp '4INTERECOR_ROUTERS' { local as 20940; neighbor as 20940; r04.border01.lon03.fab> show route protocol 23.210.49.60__r24.lon02.ien for 20.135.0.0/16 all Executing "/usr/sbin/birdc show route protocol '23.210.49.60__r24.lon02.ien' for 20.135.0.0/16 all" Table master4: 20.135.0.0/16 unicast [23.210.49.60__r24.lon02.ien 2024-10-07] (100) [AS8075i] via 23.210.49.60 on ae1 Type: BGP univ BGP.origin: IGP BGP.as_path: 8075 BGP.next_hop: 23.210.49.60 BGP.med: 4294967294 BGP.local_pref: 350 Route ASPATH: 8075 which is expected. We are exporting this route on EBGP session from private ASN 4290006033 <-> to private ASN: 4290006002: r04.border01.lon03.fab> show route export 2a02:26f0:1880:3702::1__r01.stem01 for 20.135.0.0/16 all Executing "/usr/sbin/birdc show route export '2a02:26f0:1880:3702::1__r01.stem01' for 20.135.0.0/16 all" Table master4: 20.135.0.0/16 unicast [2.22.144.250__r01.sdn 2024-10-07 from 2.22.144.250] * (100) [AS8075i] via 23.210.49.60 on ae1 Type: BGP univ BGP.origin: IGP BGP.as_path: 8075 BGP.next_hop: 23.210.49.60 BGP.med: 4294967294 BGP.local_pref: 777 Route is received on 4290006002: r01.stem01.lon03.fab> show route protocol 2a02:26f0:1880:3702::__r04.border01 for 20.135.0.0/16 all Executing "/usr/sbin/birdc show route protocol '2a02:26f0:1880:3702::__r04.border01' for 20.135.0.0/16 all" Table master4: 20.135.0.0/16 unicast [2a02:26f0:1880:3702::__r04.border01 2024-10-07] * (100) [AS8075i] via 2a02:26f0:1880:3702:: on ae4 Type: BGP univ BGP.origin: IGP BGP.as_path: 4290006033 8075 BGP.next_hop: 2a02:26f0:1880:3702:: fe80::b6db:91ff:fe8b:1eb4 BGP.local_pref: 100 ASPATH: 4290006033 8075 We are missing AS 20940 on which essentially this prefix is received in our network!? Is this behavior expected? Kind Regards, Radek Ochalski

3 2

Link-local address change in Blackhole routing
by ushiroz＠ate-mahoroba.jp 05 Oct '24

05 Oct '24

Hi I am aware that IPv4 next-hop / IPv6 next-hop global can be achieved by changing bgp_next_hop when Blackhole Community is applied. I believe that if we notify the next-hop of only global, the link-local in the FIB will remain the same as the peer's address even though the RIB has changed, resulting in unintended behavior, and I believe that the link-local address needs to be changed. Is it possible to change the link-local address in Bird?

2 2

[patch] Add TCP-MD5 authentication option for RPKI protocol
by Job Snijders 03 Oct '24

03 Oct '24

Dear BIRD community, I think many of us use good ole' TCP-MD5 to authenticate IBGP sessions, even if TCP-MD5 is imperfect from key rolling perspective. TCP-MD5 is easy to configure, and supported on a broad range of platforms, and beats doing nothing. RPKI-To-Router (RTR) sessions seem to be similar security-sensitivity as IBGP sessions, but at the moment of writing BIRD offers a choice of either "plain TCP" (meh) or "SSH" (secure, albeit a bit more hassle to set up than TCP-MD5). I'd like to add TCP-MD5 as another option. TCP-MD5 for RTR is specified through RFC 6810 section 7.3 and RFC 8210 section 9.3. Minimal bird.conf: router id 10.0.0.1; roa4 table r4; roa6 table r6; protocol rpki rpki1 { roa4 { table r4; }; roa6 { table r6; }; remote 165.254.255.17 port 8282; transport tcp password "test"; /* password keyword is new here! */ debug all; } This config was tested on Linux against a WIP based on StayRTR, tcpdump suggests this works as expected. job@josephine:~/bird$ ./birdc -s /tmp/bird show protocols all BIRD v2.15.1-29-g35f74c4b-x ready. Name Proto Table State Since Info rpki1 RPKI --- up 15:16:41.677 Established Cache server: 165.254.255.17 Cache port: 8282 Status: Established Transport: TCP-MD5 I can leave the server at 165.254.255.17 port 8282 with TCP-MD5 authentication password "test" running for a bit so others can more easily test the below patch without having to compile/run StayRTR. Below is a changeset for your consideration! Feedback is welcome. Kind regards, Job ps. It seems TCP-MD5 for BGP doesn't work out-of-the-box on OpenBSD, downstream porters apply a few minimal patches: https://github.com/openbsd/ports/tree/master/net/bird/2/patches perhaps these can be upstreamed so that we can work towards TCP-MD5 RTR support in BIRD on OpenBSD as well? :-) Author: Job Snijders <job(a)fastly.com> Date: Wed Sep 18 10:46:06 2024 +0000 Add RTR TCP-MD5 authentication support diff --git a/doc/bird.sgml b/doc/bird.sgml index e2050c13..07bedef9 100644 --- a/doc/bird.sgml +++ b/doc/bird.sgml @@ -5735,7 +5735,7 @@ protocol rpki [<name>] { refresh [keep] <num>; retry [keep] <num>; expire [keep] <num>; - transport tcp; + transport tcp [password <m/string/]; transport ssh { bird private key "</path/to/id_rsa>"; remote public key "</path/to/known_host>"; @@ -5791,9 +5791,10 @@ specify both channels. instead. This may be useful for implementing loose RPKI check for blackholes. Default: disabled. - <tag>transport tcp</tag> Unprotected transport over TCP. It's a default - transport. Should be used only on secure private networks. - Default: tcp + <tag>transport tcp [password <m/string/]</tag> transport over TCP. It's + the default transport. Should be used only on secure private networks. + If a password is specified, the session is authenticated using TCP-MD5 + (<rfc id="2385">). Default: tcp, no authentication. <tag>transport ssh { <m/SSH transport options.../ }</tag> It enables a SSHv2 transport encryption. Cannot be combined with a TCP transport. diff --git a/proto/rpki/config.Y b/proto/rpki/config.Y index 769ebb2c..a0b678be 100644 --- a/proto/rpki/config.Y +++ b/proto/rpki/config.Y @@ -32,7 +32,8 @@ rpki_check_unused_transport(void) CF_DECLS CF_KEYWORDS(RPKI, REMOTE, BIRD, PRIVATE, PUBLIC, KEY, TCP, SSH, TRANSPORT, USER, - RETRY, REFRESH, EXPIRE, KEEP, IGNORE, MAX, LENGTH, LOCAL, ADDRESS) + RETRY, REFRESH, EXPIRE, KEEP, IGNORE, MAX, LENGTH, LOCAL, ADDRESS, + PASSWORD) %type rpki_keep_interval @@ -109,6 +110,7 @@ rpki_cache_addr: text_or_ipa rpki_transport: TCP rpki_transport_tcp_init + | TCP PASSWORD text rpki_transport_tcp_init { RPKI_CFG->password = $3; } | SSH rpki_transport_ssh_init '{' rpki_transport_ssh_opts '}' rpki_transport_ssh_check ; diff --git a/proto/rpki/rpki.c b/proto/rpki/rpki.c index 4ec48e3b..d793ee56 100644 --- a/proto/rpki/rpki.c +++ b/proto/rpki/rpki.c @@ -673,6 +673,12 @@ rpki_reconfigure_cache(struct rpki_proto *p UNUSED, struct rpki_cache *cache, st return NEED_RESTART; } + if (old->password != new->password) + { + CACHE_TRACE(D_EVENTS, cache, "MD5 authentication changed"); + return NEED_RESTART; + } + if (old->tr_config.type != new->tr_config.type) { CACHE_TRACE(D_EVENTS, cache, "Transport type changed"); @@ -843,7 +849,10 @@ rpki_show_proto_info(struct proto *P) break; #endif case RPKI_TR_TCP: - transport_name = "Unprotected over TCP"; + if (cf->password == NULL) + transport_name = "Unprotected over TCP"; + else + transport_name = "TCP-MD5"; default_port = RPKI_TCP_PORT; break; }; diff --git a/proto/rpki/rpki.h b/proto/rpki/rpki.h index e67eb0e3..d8fd72ce 100644 --- a/proto/rpki/rpki.h +++ b/proto/rpki/rpki.h @@ -127,6 +127,7 @@ struct rpki_config { u8 keep_retry_interval:1; /* Do not overwrite retry interval by cache server update */ u8 keep_expire_interval:1; /* Do not overwrite expire interval by cache server update */ u8 ignore_max_length:1; /* Ignore received max length and use MAX_PREFIX_LENGTH instead */ + const char *password; /* Password used for MD5 authentication */ }; void rpki_check_config(struct rpki_config *cf); diff --git a/proto/rpki/transport.c b/proto/rpki/transport.c index 26571977..46b00822 100644 --- a/proto/rpki/transport.c +++ b/proto/rpki/transport.c @@ -88,6 +88,9 @@ rpki_tr_open(struct rpki_tr_sock *tr) sk->tos = IP_PREC_INTERNET_CONTROL; sk->vrf = cache->p->p.vrf; + if (cf->tr_config.type == RPKI_TR_TCP && cf->password != NULL) + sk->password = cf->password; + if (ipa_zero(sk->daddr) && sk->host) { const char *err_msg;

2 5