<div dir="ltr"><div>There is a bug in Arista EOS <=4.9.1 which causes it to flip it's lid when it receives TAC_PLUS_AUTHOR_STATUS_PASS_REPL in an Authorization response. The bug manifests itself as tac_plus and do_auth.py both agreeing that the request was authorized but, the EOS device displaying "Authorization denied:" and dropping the login.</div><div><br></div><div>After some troubleshooting to determine what was actually tickling this bug, I found that when using an after authorization script with tac_plus, it will return TAC_PLUS_AUTHOR_STATUS_PASS_REPL wherein when you don't use an after authorization script, tac_plus will return TAC_PLUS_AUTHOR_STATUS_PASS_ADD.</div><div><br></div><div>I write a quick and dirty patch that seems to work just fine in my environment and I thought I would pass it along to the community in case you have any vintage EOS devices in your stable and want to use after authorization. (If you're not using do_auth.py, you don't know what you're missing!)</div><div><br></div><div>This patch is against stock Shrubbery.net F4.0.4.28:</div><div><br></div><div><div>$ cat arista-bug-fix.diff</div><div><font face="monospace, monospace">*** do_author.c.orig 2015-07-23 11:51:33.641510860 -0700</font></div><div><font face="monospace, monospace">--- do_author.c 2015-07-23 12:13:11.667818482 -0700</font></div><div><font face="monospace, monospace">***************</font></div><div><font face="monospace, monospace">*** 325,359 ****</font></div><div><font face="monospace, monospace">--- 325,388 ----</font></div><div><font face="monospace, monospace"> case 2:</font></div><div><font face="monospace, monospace"> /* Use replacement AV pairs from program */</font></div><div><font face="monospace, monospace"> if (debug & DEBUG_AUTHOR_FLAG)</font></div><div><font face="monospace, monospace"> report(LOG_DEBUG, "cmd %s returns 2 (replace & continue)",</font></div><div><font face="monospace, monospace"> after);</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"> /* Free any existing AV output pairs */</font></div><div><font face="monospace, monospace"> if (data->num_out_args) {</font></div><div><font face="monospace, monospace"> for (i = 0; i < data->num_out_args; i++) {</font></div><div><font face="monospace, monospace"> free(data->output_args[i]);</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"> free(data->output_args);</font></div><div><font face="monospace, monospace"> data->output_args = NULL;</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">+ /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * *</font></div><div><font face="monospace, monospace">+ * Arista EOS versions 4.9.1 and below do not support the *</font></div><div><font face="monospace, monospace">+ * TAC_AUTHOR_STATUS_PASS_REPL status. When they receive *</font></div><div><font face="monospace, monospace">+ * this status in an authorization reply, they flip their *</font></div><div><font face="monospace, monospace">+ * lidz and return "Authorization denied:" to the user *</font></div><div><font face="monospace, monospace">+ * and dump them out of the session. This presents a *</font></div><div><font face="monospace, monospace">+ * problem for organizations who desire to use after *</font></div><div><font face="monospace, monospace">+ * authorization scripts to change AV PAIRS, etc if they *</font></div><div><font face="monospace, monospace">+ * have equipment running older EOS code. *</font></div><div><font face="monospace, monospace">+ * *</font></div><div><font face="monospace, monospace">+ * After finally tracking down the root cause of this *</font></div><div><font face="monospace, monospace">+ * undesired behavior, the "fix" is very simple: "Lie to *</font></div><div><font face="monospace, monospace">+ * everybody and send TAC_AUTHOR_STATUS_PASS_ADD any time *</font></div><div><font face="monospace, monospace">+ * we would normally send TAC_AUTHOR_STATUS_PASS_REPL." *</font></div><div><font face="monospace, monospace">+ * *</font></div><div><font face="monospace, monospace">+ * This nasty hack was conceived and written by: *</font></div><div><font face="monospace, monospace">+ * John Fraizer <<a href="mailto:jfraizer@ebay.com">jfraizer@ebay.com</a>> *</font></div><div><font face="monospace, monospace">+ * 23 July 2015 *</font></div><div><font face="monospace, monospace">+ * *</font></div><div><font face="monospace, monospace">+ * No Warranty is Expressed or Implied! *</font></div><div><font face="monospace, monospace">+ * Individual mileage may vary with driving conditions and *</font></div><div><font face="monospace, monospace">+ * driving style. Always use the manufacturers *</font></div><div><font face="monospace, monospace">+ * recommended tire inflation! *</font></div><div><font face="monospace, monospace">+ * *</font></div><div><font face="monospace, monospace">+ * Semper Fi! *</font></div><div><font face="monospace, monospace">+ * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *</font></div><div><font face="monospace, monospace">+</font></div><div><font face="monospace, monospace">+</font></div><div><font face="monospace, monospace"> if (debug & DEBUG_AUTHOR_FLAG) {</font></div><div><font face="monospace, monospace"> report(LOG_DEBUG, "status is now AUTHOR_STATUS_PASS_REPL");</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"> data->status = AUTHOR_STATUS_PASS_REPL;</font></div><div><font face="monospace, monospace">+ */</font></div><div><font face="monospace, monospace"> data->output_args = out_args;</font></div><div><font face="monospace, monospace"> data->num_out_args = out_cnt;</font></div><div><font face="monospace, monospace"> return;</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"> /* Return a pointer to the value part of an attr=value string */</font></div><div><font face="monospace, monospace"> static char *</font></div><div><font face="monospace, monospace"> value(char *s)</font></div><div><font face="monospace, monospace"> {</font></div><div><font face="monospace, monospace"> while (*s != '\0' && *s != '=' && *s != '*')</font></div><div><font face="monospace, monospace"> s++;</font></div><div><font face="monospace, monospace"> if (*s != '\0')</font></div><div><font face="monospace, monospace"> return(++s);</font></div><div><font face="monospace, monospace"> return(NULL);</font></div></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div>--</div>John Fraizer<div>LinkedIn profile: <a href="http://www.linkedin.com/in/johnfraizer/" target="_blank">http://www.linkedin.com/in/johnfraizer/</a></div><div><br><div><span style="color:rgb(53,53,53);font-family:Arial,sans-serif;font-size:12px;line-height:12px;background-color:rgb(244,244,244)"><br></span></div></div></div></div></div>
</div>