[rancid] mtrancid patch

[Steven Saner]

I had an issue with rancid 3.1 (and earlier versions too) tracking
several Mikrotik routers. I'm not sure if this issue affects all

system resource print

uptime: 8w2d22h47m48s
version: 5.21
free-memory: 992624KiB
total-memory: 1555212KiB
cpu: e500v2
cpu-count: 2
cpu-frequency: 1066MHz
cpu-load: 16%
free-hdd-space: 68928KiB
total-hdd-space: 110092KiB
architecture-name: powerpc
board-name: RB1100AHx2
platform: MikroTik


In the config export there is the following:

/interface ovpn-server server
set auth=sha1,md5 certificate=none cipher=blowfish128,aes128
default-profile=\
default enabled=no keepalive-timeout=60 mac-address=FE:EB:E4:50:DC:E8 \
max-mtu=1500 mode=ip netmask=24 port=1194 require-client-certificate=no


This is an interface associated with the OpenVPN server, which I am not
using. The thing is, the mac-address attribute seems to be a generated
value and it changes (how often or why, I'm not sure). As a result every
time rancid would run, it would log a config change because this value
was different.

I implemented a quick and dirty patch to mtrancid to simply ignore the
set auth= line inside of the ovpn-server interface so that the config
would not change each run.

Has someone else run in to this? Did they solve the problem in a
different way? It might be better to make this ignore just the
mac-address attribute, rather than the entire config line, but it didn't
matter to me as I'm not using that interface.

Here is my patch:

--- a/bin/mtrancid.in
+++ b/bin/mtrancid.in
@@ -236,10 +236,12 @@ sub SystemLicensePrint {
sub Export {
print STDERR " In Export: $_" if ($debug);
my $buffer = "";
+ my $ovpn = 0;

while (<INPUT>) {
tr/\015//d;
if (/$prompt/) { $found_end=1; $clean_run=1; return 0};
+ if (/interface ovpn-server server/) { $ovpn = 1; }
next if(/^(\s*|\s*$cmd\s*)$/);
next if(/^#/);
return(1) if /(bad command name )/;
@@ -259,7 +261,11 @@ sub Export {
# Fix quoted strings
$buffer =~ s/(\S+)="(\S+)"/$1=$2/g;

- ProcessHistory("","","","$buffer");
+ if ($ovpn && $buffer =~ m/\s*set auth/) {
+ $ovpn = 0;
+ } else {
+ ProcessHistory("","","","$buffer");
+ }
$buffer = "";
}
}

[IT-Info]

Hi Steven,


I came across this as well; pretty frustrating.

The only fix I discovered was to statically set the MAC address of the open-vpn server anything, preferably to something meaningless:

/interface ovpn-server server
set auth=sha1,md5 certificate=none cipher=blowfish128,aes128 default-profile=default enabled=no keepalive-timeout=60 mac-address=00:00:00:00:00:01 max-mtu=1500 mode=ip netmask=24 port=1194 require-client-certificate=no

This way it won't dynamically change and RANCID won't be emailing you about it. In my opinion, this is much simpler than writing code to systematically ignore the changing MAC addresses, even with 100+ Mikrotik devices. Kudos for your efforts, though. Hope this helps.


Regards,
Brian

[Steven Saner]

Post by IT-Info
Hi Steven,
I came across this as well; pretty frustrating.
/interface ovpn-server server
set auth=sha1,md5 certificate=none cipher=blowfish128,aes128 default-profile=default enabled=no keepalive-timeout=60 mac-address=00:00:00:00:00:01 max-mtu=1500 mode=ip netmask=24 port=1194 require-client-certificate=no
This way it won't dynamically change and RANCID won't be emailing you about it. In my opinion, this is much simpler than writing code to systematically ignore the changing MAC addresses, even with 100+ Mikrotik devices. Kudos for your efforts, though. Hope this helps.
Regards,
Brian

Indeed. Thank you for that. I sort of figured that someone might know
how to change the MT behavior. This is a better solution.

Thanks

Steve

[heasley]

Post by IT-Info
Hi Steven,
I came across this as well; pretty frustrating.
/interface ovpn-server server
set auth=sha1,md5 certificate=none cipher=blowfish128,aes128 default-profile=default enabled=no keepalive-timeout=60 mac-address=00:00:00:00:00:01 max-mtu=1500 mode=ip netmask=24 port=1194 require-client-certificate=no

This seems like a bug that should be reported to Microtik.

is FE:... a valid OUI? if that is consistent and invalid, it could filter
based on that.

Post by IT-Info
This way it won't dynamically change and RANCID won't be emailing you about it. In my opinion, this is much simpler than writing code to systematically ignore the changing MAC addresses, even with 100+ Mikrotik devices. Kudos for your efforts, though. Hope this helps.
Regards,
Brian
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo/rancid-discuss