summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-12-29FRR Release 8.4.7frr-8.4.7docker/8.4.7rc/8.4.7Donatas Abraitis
- bgpd - Add `bgp ipv6-auto-ra` command - Include structure when removing End.DT4/6 SID - Include structure when installing End.DT4/6 SID - lib - Include SID structure in seg6local nexthop - ospfd - Fix heap corruption vulnerability when parsing SR-Algorithm TLV - zebra - Fix crash during reconnect - Add missing proto translations - Correctly report metrics - Let's use memset instead of walking bytes and setting to 0 - Fix snmp walk of zebra rib Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2024-12-29FRR Release 8.4.6Donatas Abraitis
- bgpd - Fix for CVE-2024-44070 - Fix crash at no rpki - isisd - Fix update link params after circuit is up - tools - Ignore errors for frr reload stuff Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2024-10-29Merge pull request #17290 from opensourcerouting/16354-bp-8.4Russ White
(8.4 backport) bgpd: add `bgp ipv6-auto-ra` command
2024-10-29Merge pull request #17213 from ↵Donatas Abraitis
cscarpitta/fix/backport_add-sid-structure-to-seg6local-nh_for_8.4 bgpd, lib: Include SID structure in seg6local nexthop (backport for 8.4)
2024-10-29bgpd: add `bgp ipv6-auto-ra` commandMikhail Sokolovskiy
Introduce a command to stop bgpd from enabling IPv6 router advertisement messages sending on interfaces. Signed-off-by: Mikhail Sokolovskiy <sokolmish@gmail.com>
2024-10-28bgpd: Include structure when removing End.DT4/6 SIDCarmine Scarpitta
Include SID structure information when removing an SRv6 End.DT4 or End.DT6 SID from the forwarding plane. Signed-off-by: Carmine Scarpitta <cscarpit@cisco.com>
2024-10-28bgpd: Include structure when installing End.DT4/6 SIDCarmine Scarpitta
Include SID structure information when installing an SRv6 End.DT6 or End.DT4 SID in the forwarding plane. Signed-off-by: Carmine Scarpitta <cscarpit@cisco.com>
2024-10-23lib: Include SID structure in seg6local nexthopCarmine Scarpitta
Include SID structure information in seg6local nexthop data structure. Signed-off-by: Carmine Scarpitta <cscarpit@cisco.com>
2024-10-08Merge pull request #17008 from FRRouting/mergify/bp/stable/8.4/pr-17000Donatas Abraitis
zebra: Fix crash during reconnect (backport #17000)
2024-10-04zebra: Fix crash during reconnectIgor Zhukov
fpm_enqueue_rmac_table expects an fpm_rmac_arg* as its argument. The issue can be reproduced by dropping the TCP session using: ss -K dst 127.0.0.1 dport = 2620 I used Fedora 40 and frr 9.1.2 and I got the gdb backtrace: (gdb) bt 0 0x00007fdd7d6997ea in fpm_enqueue_rmac_table (bucket=0x2134dd0, arg=0x2132b60) at zebra/dplane_fpm_nl.c:1217 1 0x00007fdd7dd1560d in hash_iterate (hash=0x21335f0, func=0x7fdd7d6997a0 <fpm_enqueue_rmac_table>, arg=0x2132b60) at lib/hash.c:252 2 0x00007fdd7dd1560d in hash_iterate (hash=0x1e5bf10, func=func@entry=0x7fdd7d698900 <fpm_enqueue_l3vni_table>, arg=arg@entry=0x7ffed983bef0) at lib/hash.c:252 3 0x00007fdd7d698b5c in fpm_rmac_send (t=<optimized out>) at zebra/dplane_fpm_nl.c:1262 4 0x00007fdd7dd6ce22 in event_call (thread=thread@entry=0x7ffed983c010) at lib/event.c:1970 5 0x00007fdd7dd20758 in frr_run (master=0x1d27f10) at lib/libfrr.c:1213 6 0x0000000000425588 in main (argc=10, argv=0x7ffed983c2e8) at zebra/main.c:492 Signed-off-by: Igor Zhukov <fsb4000@yandex.ru> (cherry picked from commit a3877e4444dc3a1253135d3b9479935fc9a966f8)
2024-10-01Merge pull request #16924 from FRRouting/mergify/bp/stable/8.4/pr-16918Donald Sharp
zebra snmp fixes (backport #16918)
2024-09-25zebra: Add missing proto translationsDonald Sharp
Add missing isis and eigrp proto translations. Signed-off-by: Donald Sharp <sharpd@nvidia.com> (cherry picked from commit f53dde0e5921aafae0a00d993257ea7423b5ee97)
2024-09-25zebra: Correctly report metricsDonald Sharp
Report the routes metric in IPFORWARDMETRIC1 and return -1 for the other metrics as required by the IP-FORWARD-MIB. inetCidrRouteMetric2 OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-create STATUS current DESCRIPTION "An alternate routing metric for this route. The semantics of this metric are determined by the routing- protocol specified in the route's inetCidrRouteProto value. If this metric is not used, its value should be set to -1." DEFVAL { -1 } ::= { inetCidrRouteEntry 13 } I've included metric2 but it's the same for all of them. Signed-off-by: Donald Sharp <sharpd@nvidia.com> (cherry picked from commit e41ae0acc1940b568def5018efad3df019023f85)
2024-09-25zebra: Let's use memset instead of walking bytes and setting to 0Donald Sharp
Signed-off-by: Donald Sharp <sharpd@nvidia.com> (cherry picked from commit 659cd66427ac8a6fe705b4a319245b7c88f80c05)
2024-09-25zebra: Fix snmp walk of zebra ribDonald Sharp
The snmp walk of the zebra rib was skipping entries because in_addr_cmp was replaced with a prefix_cmp which worked slightly differently causing parts of the zebra rib tree to be skipped. Signed-off-by: Donald Sharp <sharpd@nvidia.com> (cherry picked from commit ecd9d441b082e3f24139eb96915b18fc17996c08)
2024-09-19Merge pull request #16867 from FRRouting/mergify/bp/stable/8.4/pr-16860Donald Sharp
ospfd: Fix heap corruption vulnerability when parsing SR-Algorithm TLV (backport #16860)
2024-09-18ospfd: Fix heap corruption vulnerability when parsing SR-Algorithm TLVAcee Lindem
When parsing the SR-Algorithm TLV in the OSPF Router Information Opaque LSA, assure that not more than the maximum number of supported algorithms are copied from the TLV. Signed-off-by: Acee Lindem <acee@lindem.com> (cherry picked from commit 0dc969185fdd75fd007c9b29e11be57a078236df)
2024-09-13Merge pull request #16817 from opensourcerouting/fix/backports_for_8.4Donald Sharp
Manual backport for 8.4
2024-09-13bgpd: Check the actual remaining stream length before taking TLV valueDonatas Abraitis
``` 0 0xb50b9f898028 in __sanitizer_print_stack_trace (/home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/.libs/bgpd+0x368028) (BuildId: 3292703ed7958b20076550c967f879db8dc27ca7) 1 0xb50b9f7ed8e4 in fuzzer::PrintStackTrace() (/home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/.libs/bgpd+0x2bd8e4) (BuildId: 3292703ed7958b20076550c967f879db8dc27ca7) 2 0xb50b9f7d4d9c in fuzzer::Fuzzer::CrashCallback() (/home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/.libs/bgpd+0x2a4d9c) (BuildId: 3292703ed7958b20076550c967f879db8dc27ca7) 3 0xe0d12d7469cc (linux-vdso.so.1+0x9cc) (BuildId: 1a77697e9d723fe22246cfd7641b140c427b7e11) 4 0xe0d12c88f1fc in __pthread_kill_implementation nptl/pthread_kill.c:43:17 5 0xe0d12c84a678 in gsignal signal/../sysdeps/posix/raise.c:26:13 6 0xe0d12c83712c in abort stdlib/abort.c:79:7 7 0xe0d12d214724 in _zlog_assert_failed /home/ubuntu/frr-public/frr_public_private-libfuzzer/lib/zlog.c:789:2 8 0xe0d12d1285e4 in stream_get /home/ubuntu/frr-public/frr_public_private-libfuzzer/lib/stream.c:324:3 9 0xb50b9f8e47c4 in bgp_attr_encap /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_attr.c:2758:3 10 0xb50b9f8dcd38 in bgp_attr_parse /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_attr.c:3783:10 11 0xb50b9faf74b4 in bgp_update_receive /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_packet.c:2383:20 12 0xb50b9faf1dcc in bgp_process_packet /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_packet.c:4075:11 13 0xb50b9f8c90d0 in LLVMFuzzerTestOneInput /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_main.c:582:3 ``` Reported-by: Iggy Frankovic <iggyfran@amazon.com> Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2024-09-13bgpd: fix crash at no rpkiLouis Scalbert
When 'no rpki' is requested and the rtrlib RPKI object was freed, bgpd is crashing. RPKI is configured in VRF red. > ip l set red down > ip l del red > printf 'conf\n vrf red\n no rpki' | vtysh > Core was generated by `/usr/bin/bgpd -A 127.0.0.1 -M snmp -M rpki -M bmp'. > Program terminated with signal SIGSEGV, Segmentation fault. > #0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=140411103615424) at ./nptl/pthread_kill.c:44 > 44 ./nptl/pthread_kill.c: No such file or directory. > [Current thread is 1 (Thread 0x7fb401f419c0 (LWP 190226))] > (gdb) bt > #0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=140411103615424) at ./nptl/pthread_kill.c:44 > #1 __pthread_kill_internal (signo=11, threadid=140411103615424) at ./nptl/pthread_kill.c:78 > #2 __GI___pthread_kill (threadid=140411103615424, signo=signo@entry=11) at ./nptl/pthread_kill.c:89 > #3 0x00007fb4021ad476 in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26 > #4 0x00007fb4025ce22b in core_handler (signo=11, siginfo=0x7fff831b2d70, context=0x7fff831b2c40) at lib/sigevent.c:248 > #5 <signal handler called> > #6 rtr_mgr_remove_group (config=0x55fe8789f750, preference=11) at /build/make-pkg/output/source/DIST_RTRLIB/rtrlib/rtrlib/rtr_mgr.c:607 > #7 0x00007fb40145f518 in rpki_delete_all_cache_nodes (rpki_vrf=0x55fe8789f4f0) at bgpd/bgp_rpki.c:442 > #8 0x00007fb401463098 in no_rpki_magic (self=0x7fb40146bba0 <no_rpki_cmd>, vty=0x55fe877f5130, argc=2, argv=0x55fe877fccd0) at bgpd/bgp_rpki.c:1732 > #9 0x00007fb40145c09a in no_rpki (self=0x7fb40146bba0 <no_rpki_cmd>, vty=0x55fe877f5130, argc=2, argv=0x55fe877fccd0) at ./bgpd/bgp_rpki_clippy.c:37 > #10 0x00007fb402527abc in cmd_execute_command_real (vline=0x55fe877fd150, vty=0x55fe877f5130, cmd=0x0, up_level=0) at lib/command.c:984 > #11 0x00007fb402527c35 in cmd_execute_command (vline=0x55fe877fd150, vty=0x55fe877f5130, cmd=0x0, vtysh=0) at lib/command.c:1043 > #12 0x00007fb4025281e5 in cmd_execute (vty=0x55fe877f5130, cmd=0x55fe877fb8c0 "no rpki\n", matched=0x0, vtysh=0) at lib/command.c:1209 > #13 0x00007fb4025f0aed in vty_command (vty=0x55fe877f5130, buf=0x55fe877fb8c0 "no rpki\n") at lib/vty.c:615 > #14 0x00007fb4025f2a11 in vty_execute (vty=0x55fe877f5130) at lib/vty.c:1378 > #15 0x00007fb4025f513d in vtysh_read (thread=0x7fff831b5fa0) at lib/vty.c:2373 > #16 0x00007fb4025e9611 in event_call (thread=0x7fff831b5fa0) at lib/event.c:2011 > #17 0x00007fb402566976 in frr_run (master=0x55fe871a14a0) at lib/libfrr.c:1212 > #18 0x000055fe857829fa in main (argc=9, argv=0x7fff831b6218) at bgpd/bgp_main.c:549 Fixes: 8156765abe ("bgpd: Add `no rpki` command") Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com> Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2024-09-13isisd: fix update link params after circuit is upLouis Scalbert
If the link-params are set when the circuit not yet up, the link-params are never updated. isis_link_params_update() is called from isis_circuit_up() but returns immediately because circuit->state != C_STATE_UP. circuit->state is updated in isis_csm_state_change after isis_circuit_up(). > struct isis_circuit *isis_csm_state_change(enum isis_circuit_event event, > struct isis_circuit *circuit, > void *arg) > { > [...] > if (isis_circuit_up(circuit) != ISIS_OK) { > isis_circuit_deconfigure(circuit, area); > break; > } > circuit->state = C_STATE_UP; > isis_event_circuit_state_change(circuit, circuit->area, > 1); Do not return isis_link_params_update() if circuit->state != C_STATE_UP. Fixes: 0fdd8b2b11 ("isisd: update link params after circuit is up") Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
2024-07-25Merge pull request #16468 from ↵Donald Sharp
opensourcerouting/fix/243e27abccf8d02caabc6ae1ea758c4bdc3069e2_8.4 tools: Ignore errors for frr reload stuff
2024-07-25tools: Ignore errors for frr reload stuffDonatas Abraitis
When we pass an unknown/wrong command and do `systemctl reload frr`, all processes are killed, and not started up. Like doing with frr-reload.py, all good: ``` $ /usr/lib/frr/frr-reload.py --reload /etc/frr/frr.conf vtysh failed to process new configuration: vtysh (mark file) exited with status 2: b'line 20: % Unknown command: neighbor 192.168.10.123 bfd 300 300\n\n' ``` Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2024-06-06FRR Release 8.4.5frr-8.4.5docker/8.4.5rc/8.4Jafar Al-Gharaibeh
Changelog: babeld Fix #11808 to avoid infinite loops bgpd Check mandatory attributes more carefully for update message Do not explicitly print maxttl value for ebgp-multihop vty output Do not process nlris if the attribute length is zero Don't read the first byte of orf header if we are ahead of stream Ensure community data is freed in some cases. Ensure that the correct aspath is free'd Evpn code was not properly unlocking rd_dest Fix error handling when receiving bgp prefix sid attribute Fix null argument warning Fix session reset issue caused by malformed core attributes Fix use beyond end of stream of labeled unicast parsing Handle mp_reach_nlri malformed packets with session reset Ignore handling nlris if we received mp_unreach_nlri Include unsuppress-map as a valid outgoing policy Prevent from one more cve triggering this place Treat eor as withdrawn to avoid unwanted handling of malformed attrs Use enum bgp_create_error_code as argument in header Use treat-as-withdraw for tunnel encapsulation attribute isisd Fix heap-after-free with prefix sid need to link directly against libyang lib Fix evpn nexthop config order Allow unsetting walltime-warning and cpu-warning Make cmd_element->attr a bitmask & clarify Replace deprecated ares_gethostbyname Replace deprecated ares_process() nhrpd Fix nhrp_peer leak Fix core dump on shutdown ospf6d Fix crash because neighbor structure was freed Fix uninitialized warnings Ospfv3 route change comparision fixed for asbr-only change Stop crash in ospf6_write Prevent heap-buffer-overflow with unknown type ospfd Check for nulls in vty code Correct opaque lsa extended parser Prevent use after free( and crash of ospf ) when no router ospf Protect call to get_edge() in ospf_te.c Solved crash in ospf te parsing Solved crash in ri parsing with ospf te pimd Fix dr-priority range Fix null register before aging out reg-stop Fix order of operations for evaluating join Re-evaluated s,g oils upon rp changes and for empty sg upstream oils Fix crash when mixing ssm/any-source joins ripd Revert "cleanup memory allocations on shutdown" ripngd Revert "cleanup memory allocations on shutdown" vtysh Print uniq lines when parsing `no service ...` zebra Deny the routes if ip protocol cli refers to an undefined rmap Fix connected route deletion when multiple entry exists Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com>
2024-06-06Merge pull request #16174 from Jafaral/nhrp-8.4Donald Sharp
[8.4] nhrp: backport fixes #16141 and #16166
2024-06-05nhrpd: Fix nhrp_peer leakKeelan10
- Addressed memory leak by removing `&c->peer_notifier` from the notifier list on termination. Retaining it caused the notifier list to stay active, preventing the deletion of `c->cur.peer` thereby causing a memory leak. - Reordered termination steps to call `vrf_terminate` before `nhrp_vc_terminate`, preventing a heap-use-after-free issue when `nhrp_vc_notify_del` is invoked in `nhrp_peer_check_delete`. - Added an if statement to avoid passing NULL as hash to `hash_release`, which leads to a SIGSEGV. The ASan leak log for reference: ``` *********************************************************************************** Address Sanitizer Error detected in nhrp_topo.test_nhrp_topo/r1.asan.nhrpd.20265 ================================================================= ==20265==ERROR: LeakSanitizer: detected memory leaks Direct leak of 112 byte(s) in 1 object(s) allocated from: #0 0x7f80270c9b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f8026ac1eb8 in qmalloc lib/memory.c:100 #2 0x560fd648f0a6 in nhrp_peer_create nhrpd/nhrp_peer.c:175 #3 0x7f8026a88d3f in hash_get lib/hash.c:147 #4 0x560fd6490a5d in nhrp_peer_get nhrpd/nhrp_peer.c:228 #5 0x560fd648a51a in nhrp_nhs_resolve_cb nhrpd/nhrp_nhs.c:297 #6 0x7f80266b000f in resolver_cb_literal lib/resolver.c:234 #7 0x7f8026b62e0e in event_call lib/event.c:1969 #8 0x7f8026aa5437 in frr_run lib/libfrr.c:1213 #9 0x560fd6488b4f in main nhrpd/nhrp_main.c:166 #10 0x7f8025eb2c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) SUMMARY: AddressSanitizer: 112 byte(s) leaked in 1 allocation(s). *********************************************************************************** *********************************************************************************** Address Sanitizer Error detected in nhrp_topo.test_nhrp_topo/r2.asan.nhrpd.20400 ================================================================= ==20400==ERROR: LeakSanitizer: detected memory leaks Direct leak of 112 byte(s) in 1 object(s) allocated from: #0 0x7fb6e3ca5b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7fb6e369deb8 in qmalloc lib/memory.c:100 #2 0x562652de40a6 in nhrp_peer_create nhrpd/nhrp_peer.c:175 #3 0x7fb6e3664d3f in hash_get lib/hash.c:147 #4 0x562652de5a5d in nhrp_peer_get nhrpd/nhrp_peer.c:228 #5 0x562652de1e8e in nhrp_packet_recvraw nhrpd/nhrp_packet.c:325 #6 0x7fb6e373ee0e in event_call lib/event.c:1969 #7 0x7fb6e3681437 in frr_run lib/libfrr.c:1213 #8 0x562652dddb4f in main nhrpd/nhrp_main.c:166 #9 0x7fb6e2a8ec86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) SUMMARY: AddressSanitizer: 112 byte(s) leaked in 1 allocation(s). *********************************************************************************** ``` Signed-off-by: Keelan Cannoo <keelan.cannoo@icloud.com> Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2024-06-05nhrpd: core dump on shutdown backport fixDave LeRoy
This fixes a merge conflict encountered when backporting PR 15879 Signed-off-by: Dave LeRoy <dleroy@labn.net>
2024-06-01Merge pull request #16138 from FRRouting/mergify/bp/stable/8.4/pr-16111Donald Sharp
ospf6d: Prevent heap-buffer-overflow with unknown type (backport #16111)
2024-05-31Merge pull request #16129 from FRRouting/mergify/bp/stable/8.4/pr-16115Jafar Al-Gharaibeh
pimd: fix crash when mixing ssm/any-source joins (backport #16115)
2024-05-31ospf6d: Prevent heap-buffer-overflow with unknown typeIggy Frankovic
When parsing a osf6 grace lsa field and we receive an unknown tlv type, ospf6d was not incrementing the pointer to get beyond the tlv. Leaving a situation where ospf6d would parse the packet incorrectly. Signed-off-by: Iggy Frankovic <iggy07@gmail.com> (cherry picked from commit 826f2510e67711045e52cf4b5e3ddef514ed556e)
2024-05-31pimd: fix crash when mixing ssm/any-source joinsJafar Al-Gharaibeh
There is no reason to call `igmp_anysource_forward_stop()` inside a call to `igmp_get_source_by_addr()`; not only it is not expected for a "get" function to perform such an action, but also the decision to start/stop forwarding is already handled correctly by pim outside `igmp_get_source_by_addr()`. That call was left there from the days pim was initially imported into the sources. The problem/crash was happening because `igmp_find_source_by_addr()` would fail to find the group/source combo when mixing `(*, G)` and `(S, G)`. When having an existing flow `(*, G)`, and a new `(S, G)` igmp is received, a new entry is correctly created. `igmp_anysource_forward_stop(group)` always stops and eventually frees `(*, G)`, even when the new igmp is `(S, G)`, leaving a bad state. I.e, the new entry for `(S, G)` causes `(*, G)` to be deleted. Tested the fix with multiple receivers on the same interface with several ssm and any source senders and receivers with various combination of start/stop orders and they all worked correctly. Fixes: #15630 Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com> (cherry picked from commit a951960a15e8b6b5ed248abb0ecc9eb4e9a3427f)
2024-05-29Merge pull request #16108 from FRRouting/mergify/bp/stable/8.4/pr-16098Donald Sharp
ospf6d: OSPFv3 route change comparision fixed for ASBR-only change (backport #16098)
2024-05-29ospf6d: OSPFv3 route change comparision fixed for ASBR-only changeAcee
When a router route already exists in the area border routers table as an ABR and it solely changes its ABR or ASBR status, the change was missed and border route is not updated. This fixes the comparison for the router_bits in the ospf6_path structure. This fixes issue https://github.com/FRRouting/frr/issues/16053 although the actual problem is not the computing router (r2) and not the OSPFv3 redistribution (r3). Signed-off-by: Acee <aceelindem@gmail.com> (cherry picked from commit 772688d2d3c03d8eeeb711c2fe3735c9e0885498)
2024-05-25Merge pull request #16088 from FRRouting/mergify/bp/stable/8.4/pr-15674Donald Sharp
ospfd: Solved crash in RI parsing with OSPF TE (backport #15674)
2024-05-24ospfd: protect call to get_edge() in ospf_te.cOlivier Dugeon
During fuzzing, Iggy Frankovic discovered that get_edge() function in ospf_te.c could return null pointer, in particular when the link_id or advertised router IP addresses are fuzzed. As the null pointer returned by get_edge() function is not handlei by calling functions, this could cause ospfd crash. This patch introduces new verification of returned pointer by get_edge() function and stop the processing in case of null pointer. In addition, link ID and advertiser router ID are validated before calling ls_find_edge_by_key() to avoid the creation of a new edge with an invalid key. CVE-2024-34088 Co-authored-by: Iggy Frankovic <iggyfran@amazon.com> Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com> (cherry picked from commit 8c177d69e32b91b45bda5fc5da6511fa03dc11ca)
2024-05-24ospfd: Correct Opaque LSA Extended parserOlivier Dugeon
Iggy Frankovic discovered another ospfd crash when performing fuzzing of OSPF LSA packets. The crash occurs in ospf_te_parse_ext_link() function when attemping to read Segment Routing Adjacency SID subTLVs. The original code doesn't check if the size of the Extended Link TLVs and subTLVs have the correct length. In presence of erronous LSA, this will cause a buffer overflow and ospfd crashes. This patch introduces new verification of the subTLVs size for Extended Link TLVs and subTLVs. Similar check has been also introduced for the Extended Prefix TLV. Co-authored-by: Iggy Frankovic <iggyfran@amazon.com> Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com> (cherry picked from commit 5557a289acdaeec8cc63ffc97b5c2abf6dee7b3a)
2024-05-24ospfd: Solved crash in RI parsing with OSPF TEOlivier Dugeon
Iggy Frankovic discovered another ospfd crash when performing fuzzing of OSPF LSA packets. The crash occurs in ospf_te_parse_ri() function when attemping to read Segment Routing subTLVs. The original code doesn't check if the size of the SR subTLVs have the correct length. In presence of erronous LSA, this will cause a buffer overflow and ospfd crash. This patch introduces new verification of the subTLVs size for Router Information TLV. Co-authored-by: Iggy Frankovic <iggyfran@amazon.com> Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com> (cherry picked from commit f69d1313b19047d3d83fc2b36a518355b861dfc4)
2024-05-24Merge pull request #16081 from FRRouting/mergify/bp/stable/8.4/pr-16021Donald Sharp
isisd: fix heap-after-free with prefix sid (backport #16021)
2024-05-23isisd: fix heap-after-free with prefix sidLouis Scalbert
> ==2334217==ERROR: AddressSanitizer: heap-use-after-free on address 0x61000001d0a0 at pc 0x563828c8de6f bp 0x7fffbdaee560 sp 0x7fffbdaee558 > READ of size 1 at 0x61000001d0a0 thread T0 > #0 0x563828c8de6e in prefix_sid_cmp isisd/isis_spf.c:187 > #1 0x7f84b8204f71 in hash_get lib/hash.c:142 > #2 0x7f84b82055ec in hash_lookup lib/hash.c:184 > #3 0x563828c8e185 in isis_spf_prefix_sid_lookup isisd/isis_spf.c:209 > #4 0x563828c90642 in isis_spf_add2tent isisd/isis_spf.c:598 > #5 0x563828c91cd0 in process_N isisd/isis_spf.c:824 > #6 0x563828c93852 in isis_spf_process_lsp isisd/isis_spf.c:1041 > #7 0x563828c98dde in isis_spf_loop isisd/isis_spf.c:1821 > #8 0x563828c998de in isis_run_spf isisd/isis_spf.c:1983 > #9 0x563828c99c7b in isis_run_spf_with_protection isisd/isis_spf.c:2009 > #10 0x563828c9a60d in isis_run_spf_cb isisd/isis_spf.c:2090 > #11 0x7f84b835c72d in event_call lib/event.c:2011 > #12 0x7f84b8236d93 in frr_run lib/libfrr.c:1217 > #13 0x563828c21918 in main isisd/isis_main.c:346 > #14 0x7f84b7e4fd09 in __libc_start_main ../csu/libc-start.c:308 > #15 0x563828c20df9 in _start (/usr/lib/frr/isisd+0xf5df9) > > 0x61000001d0a0 is located 96 bytes inside of 184-byte region [0x61000001d040,0x61000001d0f8) > freed by thread T0 here: > #0 0x7f84b88a9b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123 > #1 0x7f84b8263bae in qfree lib/memory.c:130 > #2 0x563828c8e433 in isis_vertex_del isisd/isis_spf.c:249 > #3 0x563828c91c95 in process_N isisd/isis_spf.c:811 > #4 0x563828c93852 in isis_spf_process_lsp isisd/isis_spf.c:1041 > #5 0x563828c98dde in isis_spf_loop isisd/isis_spf.c:1821 > #6 0x563828c998de in isis_run_spf isisd/isis_spf.c:1983 > #7 0x563828c99c7b in isis_run_spf_with_protection isisd/isis_spf.c:2009 > #8 0x563828c9a60d in isis_run_spf_cb isisd/isis_spf.c:2090 > #9 0x7f84b835c72d in event_call lib/event.c:2011 > #10 0x7f84b8236d93 in frr_run lib/libfrr.c:1217 > #11 0x563828c21918 in main isisd/isis_main.c:346 > #12 0x7f84b7e4fd09 in __libc_start_main ../csu/libc-start.c:308 > > previously allocated by thread T0 here: > #0 0x7f84b88aa037 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 > #1 0x7f84b8263a6c in qcalloc lib/memory.c:105 > #2 0x563828c8e262 in isis_vertex_new isisd/isis_spf.c:225 > #3 0x563828c904db in isis_spf_add2tent isisd/isis_spf.c:588 > #4 0x563828c91cd0 in process_N isisd/isis_spf.c:824 > #5 0x563828c93852 in isis_spf_process_lsp isisd/isis_spf.c:1041 > #6 0x563828c98dde in isis_spf_loop isisd/isis_spf.c:1821 > #7 0x563828c998de in isis_run_spf isisd/isis_spf.c:1983 > #8 0x563828c99c7b in isis_run_spf_with_protection isisd/isis_spf.c:2009 > #9 0x563828c9a60d in isis_run_spf_cb isisd/isis_spf.c:2090 > #10 0x7f84b835c72d in event_call lib/event.c:2011 > #11 0x7f84b8236d93 in frr_run lib/libfrr.c:1217 > #12 0x563828c21918 in main isisd/isis_main.c:346 > #13 0x7f84b7e4fd09 in __libc_start_main ../csu/libc-start.c:308 > > SUMMARY: AddressSanitizer: heap-use-after-free isisd/isis_spf.c:187 in prefix_sid_cmp > Shadow bytes around the buggy address: > 0x0c207fffb9c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 > 0x0c207fffb9d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa > 0x0c207fffb9e0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 > 0x0c207fffb9f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa > 0x0c207fffba00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd > =>0x0c207fffba10: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fa > 0x0c207fffba20: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 > 0x0c207fffba30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa > 0x0c207fffba40: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 > 0x0c207fffba50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa > 0x0c207fffba60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa > Shadow byte legend (one shadow byte represents 8 application bytes): > Addressable: 00 > Partially addressable: 01 02 03 04 05 06 07 > Heap left redzone: fa > Freed heap region: fd > Stack left redzone: f1 > Stack mid redzone: f2 > Stack right redzone: f3 > Stack after return: f5 > Stack use after scope: f8 > Global redzone: f9 > Global init order: f6 > Poisoned by user: f7 > Container overflow: fc > Array cookie: ac > Intra object redzone: bb > ASan internal: fe > Left alloca redzone: ca > Right alloca redzone: cb > Shadow gap: cc > ==2334217==ABORTING Fixes: 2f7cc7bcd3 ("isisd: detect Prefix-SID collisions and handle them appropriately") Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com> (cherry picked from commit e697de58431474cdb06eff79bcbc70de4215e222)
2024-05-21Merge pull request #16064 from FRRouting/mergify/bp/stable/8.4/pr-16032Donald Sharp
zebra: Deny the routes if ip protocol CLI refers to an undefined rmap (backport #16032)
2024-05-21zebra: Deny the routes if ip protocol CLI refers to an undefined rmapPooja Jagadeesh Doijode
Currently zebra does not deny the routes if `ip protocol <proto> route-map FOO` commmand is configured with reference to an undefined route-map (FOO in this case). However, on FRR restart, in zebra_route_map_check() routes get denied if route-map name is available but the route-map is not defined. This change was introduced in fd303a4ba14c762550db972317e1e88528768005. Fix: When `ip protocol <proto> route-map FOO` CLI is configured with reference to an undefined route-map FOO, let the processing in ip_protocol_rm_add() and ip_protocol_rm_del() go through so that zebra can deny the routes instead of simply returning. This will result in consistent behavior. Testing Done: Before fix: ``` spine-1# configure spine-1(config)# ip protocol bgp route-map rmap7 root@spine-1:mgmt:/var/home/cumulus# vtysh -c "show run" | grep rmap7 ip protocol bgp route-map rmap7 root@spine-1:mgmt:/var/home/cumulus# spine-1(config)# do show ip route Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, T - Table, A - Babel, D - SHARP, F - PBR, f - OpenFabric, Z - FRR, > - selected route, * - FIB route, q - queued, r - rejected, b - backup t - trapped, o - offload failure C>* 27.0.0.1/32 is directly connected, lo, 02:27:45 B>* 27.0.0.3/32 [20/0] via fe80::202:ff:fe00:21, downlink_1, weight 1, 02:27:35 B>* 27.0.0.4/32 [20/0] via fe80::202:ff:fe00:29, downlink_2, weight 1, 02:27:40 B>* 27.0.0.5/32 [20/0] via fe80::202:ff:fe00:31, downlink_3, weight 1, 02:27:40 B>* 27.0.0.6/32 [20/0] via fe80::202:ff:fe00:39, downlink_4, weight 1, 02:27:40 ``` After fix: ``` spine-1(config)# ip protocol bgp route-map route-map67 spine-1(config)# do show ip route Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, T - Table, A - Babel, D - SHARP, F - PBR, f - OpenFabric, Z - FRR, > - selected route, * - FIB route, q - queued, r - rejected, b - backup t - trapped, o - offload failure C>* 27.0.0.1/32 is directly connected, lo, 00:35:03 B 27.0.0.3/32 [20/0] via fe80::202:ff:fe00:21, downlink_1 inactive, weight 1, 00:34:58 B 27.0.0.4/32 [20/0] via fe80::202:ff:fe00:29, downlink_2 inactive, weight 1, 00:34:57 B 27.0.0.5/32 [20/0] via fe80::202:ff:fe00:31, downlink_3 inactive, weight 1, 00:34:57 B 27.0.0.6/32 [20/0] via fe80::202:ff:fe00:39, downlink_4 inactive, weight 1, 00:34:58 spine-1(config)# root@spine-1:mgmt:/var/home/cumulus# ip route show root@spine-1:mgmt:/var/home/cumulus# ``` Signed-off-by: Pooja Jagadeesh Doijode <pdoijode@nvidia.com> (cherry picked from commit 705e8ef78f84dea3af5943a74571f968ad076c8d)
2024-05-13Merge pull request #15992 from Jafaral/pim-fixes-8.4Donatas Abraitis
pimd: fixes split off from #15969 (backport #15975)
2024-05-10pimd: fix order of operations for evaluating joinDavid Lamparter
join_desired looks at whether up->channel_oil is empty. up->channel_oil is updated from pim_forward_stop(), calling pim_channel_del_oif(). But that was being called *after* updating join_desired, so join_desired saw a non-empty OIL. Pull up the pim_forward_stop() call to before updating join_desired. Signed-off-by: David Lamparter <equinox@opensourcerouting.org> (cherry picked from commit fdb1a6fed5a8e42447b5b9633ad9df0f3042d0a9)
2024-05-10pimd: fix null register before aging out reg-stopDavid Lamparter
It looks like the code was trying to do this with the null_register parameter on pim_upstream_start_register_stop_timer(), but that didn't quite work right. Restructure a bit to get it right. Signed-off-by: David Lamparter <equinox@opensourcerouting.org> (cherry picked from commit dce38da8061a7ac62c690dbb8a89cae7f9a758d6) # Conflicts: # pimd/pim_upstream.c
2024-05-10pimd: fix dr-priority rangeDavid Lamparter
0 is a valid DR priority. Signed-off-by: David Lamparter <equinox@opensourcerouting.org> (cherry picked from commit b564c1d890aef75067db22df09e608faf72b99f5)
2024-05-06Merge pull request #15934 from FRRouting/mergify/bp/stable/8.4/pr-15628David Lamparter
CVE-2024-31948
2024-05-06Merge pull request #15933 from opensourcerouting/8.4-backport-20240506David Lamparter
CVE-2023-47234, CVE-2023-47235, and CVE-2024-27913
2024-05-06bgpd: Prevent from one more CVE triggering this placeDonatas Abraitis
If we receive an attribute that is handled by bgp_attr_malformed(), use treat-as-withdraw behavior for unknown (or missing to add - if new) attributes. Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org> (cherry picked from commit babb23b74855e23c987a63f8256d24e28c044d07)
2024-05-06bgpd: Fix error handling when receiving BGP Prefix SID attributeDonatas Abraitis
Without this patch, we always set the BGP Prefix SID attribute flag without checking if it's malformed or not. RFC8669 says that this attribute MUST be discarded. Also, this fixes the bgpd crash when a malformed Prefix SID attribute is received, with malformed transitive flags and/or TLVs. Reported-by: Iggy Frankovic <iggyfran@amazon.com> Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org> (cherry picked from commit ba6a8f1a31e1a88df2de69ea46068e8bd9b97138)
2024-05-06ospfd: Solved crash in OSPF TE parsingOlivier Dugeon
Iggy Frankovic discovered an ospfd crash when perfomring fuzzing of OSPF LSA packets. The crash occurs in ospf_te_parse_te() function when attemping to create corresponding egde from TE Link parameters. If there is no local address, an edge is created but without any attributes. During parsing, the function try to access to this attribute fields which has not been created causing an ospfd crash. The patch simply check if the te parser has found a valid local address. If not found, we stop the parser which avoid the crash. Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com> (cherry picked from commit a73e66d07329d721f26f3f336f7735de420b0183)