Donald Sharp [Thu, 1 Jun 2023 13:57:48 +0000 (09:57 -0400)]
tests: new mgmt_startup tests are failing due to insufficient time
The tests are failing due to heavily loaded system and insufficient
time for large configs to be handled. Increasing the time
allows the tests to complete locally for me under heavy load.
David Ward [Wed, 31 May 2023 20:44:44 +0000 (16:44 -0400)]
ospf6d: Prevent redundant LSA generation before interface goes down
Commit 76249532faad ("ospf6d: Handle Premature Aging of LSAs") added a
duplicate call to OSPF6_INTRA_PREFIX_LSA_EXECUTE_TRANSIT(), when the
interface state changes to "Down".
Fixes: #1738 Signed-off-by: David Ward <david.ward@ll.mit.edu>
Yuan Yuan [Tue, 30 May 2023 19:20:09 +0000 (19:20 +0000)]
lib: fix vtysh core when handling questionmark
When issue vtysh command with ?, the initial buf size for the
element is 16. Then it would loop through each element in the cmd
output vector. If the required size for printing out the next
element is larger than the current buf size, realloc the buf memory
by doubling the current buf size regardless of the actual size
that's needed. This would cause vtysh core when the doubled size
is not enough for the next element.
Donatas Abraitis [Wed, 31 May 2023 20:08:57 +0000 (23:08 +0300)]
doc: Update reference table for current and upcoming release dates
Keep only 3 release dates, current and two upcoming. On the next release,
just update one, instead of multiple (zero point looking too much in the
future).
Yuan Yuan [Tue, 30 May 2023 18:53:32 +0000 (18:53 +0000)]
bgpd: fix bgpd core when unintern attr
When the remote peer is neither EBGP nor confed, aspath is the
shadow copy of attr->aspath in bgp_packet_attribute(). Striping
AS4_PATH should not be done on the aspath directly, since
that would lead to bgpd core dump when unintern the attr.
Sarita Patra [Fri, 5 May 2023 17:52:33 +0000 (10:52 -0700)]
pim6d: Fix crash in ipv6 pim command
Problem:
Execute the below commands, pim6d core happens.
interface ens193
ip address 69.0.0.2/24
ipv6 address 8000::1/120
ipv6 mld
ipv6 pim
We see crash only if the interface is not configured, and
we are executing PIM/MLD commands.
RootCause:
Interface ens193 is not configured. So, it will have
ifindex = 0 and mroute_vif_index = -1.
Currently, we don't enable MLD on an interface if
mroute_vif_index < 0. So, pim_ifp->MLD = NULL.
In the API pim_if_membership_refresh(), we are accessing
pim_ifp->MLD NULL pointer which leads to crash.
Fix:
Added NULL check before accessing pim_ifp->MLD pointer in
the API pim_if_membership_refresh().
Donald Sharp [Sun, 28 May 2023 14:13:16 +0000 (10:13 -0400)]
lib, zebra: Ensure that the ifp->node exists
On removal, ensure that the ifp->node is set to a null
pointer so that FRR does not use data after freed.
In addition ensure that the ifp->node exists before
attempting to free it.
Donald Sharp [Sat, 27 May 2023 12:50:01 +0000 (08:50 -0400)]
tests: Allow ping to run multiple times before failing
the bgp_default_originate test brings up the topology and
then immediately pings. Which sometimes fails. This is
of course possible since the first ping might actually fail
due to arp going on. So let's give it a second chance or two.
Especially since the test, at this point, is just installing
a default route.
Christian Hopps [Thu, 4 May 2023 03:49:16 +0000 (23:49 -0400)]
lib: dont be tricky with session_id just make it a session_id
- Previously was substituting a pointer to local allocated session for the
session_id returned from the FE adapter. This complexity isn't needed.
- Get rid of "%llu" format and the casts that came with it, instead use PRIu64
and the actual (uint64_t) type.
Donald Sharp [Fri, 26 May 2023 11:44:11 +0000 (07:44 -0400)]
vtysh: Give actual pam error messages
Code was was written where the pam error message put out
was the result from a previous call to the pam modules
instead of the current call to the pam module.
Christian Hopps [Thu, 25 May 2023 09:01:37 +0000 (05:01 -0400)]
tests: selecting results by regexp and ragnes, add container support
- Allow selecting results using a regexp
- Allow selecting results using commasep range specs
- Add support for getting and saving results from a docker/podman
container.
- update docs
Christian Hopps [Fri, 26 May 2023 08:57:00 +0000 (04:57 -0400)]
tests: ospfapi: fix non-determinism in test
fixes #13584
The test had the ospf client injecting multiple opaque LSAs on 5s pace,
but the test itself verified and advanced on an LSA in the middle of
that sequence and not the last one. Then the test reset the ospf client
and originating router. If a later injected LSA managed to get in to the
router and flooded prior to the client/router reset then the opaque data
or sequence number could differ from the expected value.
Donatas Abraitis [Tue, 23 May 2023 06:20:27 +0000 (09:20 +0300)]
ripd: Use argv_find to avoid buffer overflow when parsing allow-ecmp args
==13211==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000af158 at pc 0x55d48c5f1e38 bp 0x7fffd8a713d0 sp 0x7fffd8a713c0
READ of size 8 at 0x6020000af158 thread T0
#0 0x55d48c5f1e37 in rip_allow_ecmp ripd/rip_cli.c:98
#1 0x7f2ec125aa0f in cmd_execute_command_real lib/command.c:990
#2 0x7f2ec125ae90 in cmd_execute_command lib/command.c:1049
#3 0x7f2ec125b406 in cmd_execute lib/command.c:1217
#4 0x7f2ec137ca36 in vty_command lib/vty.c:551
#5 0x7f2ec137ce52 in vty_execute lib/vty.c:1314
#6 0x7f2ec1384f9e in vtysh_read lib/vty.c:2223
#7 0x7f2ec137041b in event_call lib/event.c:1995
#8 0x7f2ec12b54bf in frr_run lib/libfrr.c:1204
#9 0x55d48c5f0f32 in main ripd/rip_main.c:171
#10 0x7f2ec0ad9c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
#11 0x55d48c5f1349 in _start (/usr/lib/frr/ripd+0x3b349)
0x6020000af158 is located 0 bytes to the right of 8-byte region [0x6020000af150,0x6020000af158)
allocated by thread T0 here:
#0 0x7f2ec18ccb40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40)
#1 0x7f2ec12d2e41 in qmalloc lib/memory.c:100
#2 0x7f2ec125a815 in cmd_execute_command_real lib/command.c:955
#3 0x7f2ec125ae90 in cmd_execute_command lib/command.c:1049
#4 0x7f2ec125b406 in cmd_execute lib/command.c:1217
#5 0x7f2ec137ca36 in vty_command lib/vty.c:551
#6 0x7f2ec137ce52 in vty_execute lib/vty.c:1314
#7 0x7f2ec1384f9e in vtysh_read lib/vty.c:2223
#8 0x7f2ec137041b in event_call lib/event.c:1995
#9 0x7f2ec12b54bf in frr_run lib/libfrr.c:1204
#10 0x55d48c5f0f32 in main ripd/rip_main.c:171
#11 0x7f2ec0ad9c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
SUMMARY: AddressSanitizer: heap-buffer-overflow ripd/rip_cli.c:98 in rip_allow_ecmp
Shadow bytes around the buggy address:
0x0c048000ddd0: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa
0x0c048000dde0: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fd
0x0c048000ddf0: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
0x0c048000de00: fa fa fd fa fa fa fd fd fa fa 00 03 fa fa fd fa
0x0c048000de10: fa fa fd fa fa fa 00 00 fa fa fd fa fa fa 00 03
=>0x0c048000de20: fa fa 00 03 fa fa fd fa fa fa 00[fa]fa fa fa fa
0x0c048000de30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c048000de40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c048000de50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c048000de60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c048000de70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==13211==ABORTING