summaryrefslogtreecommitdiff
path: root/bgpd
AgeCommit message (Collapse)Author
2023-11-21bgpd: Flush attrs only if we don't have to announce a conditional routeDonatas Abraitis
To avoid USE: ``` ==587645==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000074050 at pc 0x55b34337d96c bp 0x7ffda59bb4c0 sp 0x7ffda59bb4b0 READ of size 8 at 0x604000074050 thread T0 0 0x55b34337d96b in bgp_attr_flush bgpd/bgp_attr.c:1289 1 0x55b34368ef85 in bgp_conditional_adv_routes bgpd/bgp_conditional_adv.c:111 2 0x55b34368ff58 in bgp_conditional_adv_timer bgpd/bgp_conditional_adv.c:301 3 0x7f7d41cdf81c in event_call lib/event.c:1980 4 0x7f7d41c1da37 in frr_run lib/libfrr.c:1214 5 0x55b343371e22 in main bgpd/bgp_main.c:510 6 0x7f7d41517082 in __libc_start_main ../csu/libc-start.c:308 7 0x55b3433769fd in _start (/usr/lib/frr/bgpd+0x2e29fd) 0x604000074050 is located 0 bytes inside of 40-byte region [0x604000074050,0x604000074078) freed by thread T0 here: #0 0x7f7d4207540f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122 1 0x55b343396afd in community_free bgpd/bgp_community.c:41 2 0x55b343396afd in community_free bgpd/bgp_community.c:28 3 0x55b343397373 in community_intern bgpd/bgp_community.c:458 4 0x55b34337bed4 in bgp_attr_intern bgpd/bgp_attr.c:967 5 0x55b34368165b in bgp_advertise_attr_intern bgpd/bgp_advertise.c:106 6 0x55b3435277d7 in bgp_adj_out_set_subgroup bgpd/bgp_updgrp_adv.c:587 7 0x55b34368f36b in bgp_conditional_adv_routes bgpd/bgp_conditional_adv.c:125 8 0x55b34368ff58 in bgp_conditional_adv_timer bgpd/bgp_conditional_adv.c:301 9 0x7f7d41cdf81c in event_call lib/event.c:1980 10 0x7f7d41c1da37 in frr_run lib/libfrr.c:1214 11 0x55b343371e22 in main bgpd/bgp_main.c:510 12 0x7f7d41517082 in __libc_start_main ../csu/libc-start.c:308 previously allocated by thread T0 here: #0 0x7f7d42075a06 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:153 1 0x7f7d41c3c28e in qcalloc lib/memory.c:105 2 0x55b3433976e8 in community_dup bgpd/bgp_community.c:514 3 0x55b34350273a in route_set_community bgpd/bgp_routemap.c:2589 4 0x7f7d41c96c06 in route_map_apply_ext lib/routemap.c:2690 5 0x55b34368f2d8 in bgp_conditional_adv_routes bgpd/bgp_conditional_adv.c:107 6 0x55b34368ff58 in bgp_conditional_adv_timer bgpd/bgp_conditional_adv.c:301 7 0x7f7d41cdf81c in event_call lib/event.c:1980 8 0x7f7d41c1da37 in frr_run lib/libfrr.c:1214 9 0x55b343371e22 in main bgpd/bgp_main.c:510 10 0x7f7d41517082 in __libc_start_main ../csu/libc-start.c:308 ``` And also a crash: ``` (gdb) bt 0 raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 1 0x00007ff3b7048ce0 in core_handler (signo=6, siginfo=0x7ffc8cf724b0, context=<optimized out>) at lib/sigevent.c:246 2 <signal handler called> 3 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 4 0x00007ff3b6bb8859 in __GI_abort () at abort.c:79 5 0x00007ff3b6c2326e in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ff3b6d4d298 "%s\n") at ../sysdeps/posix/libc_fatal.c:155 6 0x00007ff3b6c2b2fc in malloc_printerr ( str=str@entry=0x7ff3b6d4f628 "double free or corruption (fasttop)") at malloc.c:5347 7 0x00007ff3b6c2cc65 in _int_free (av=0x7ff3b6d82b80 <main_arena>, p=0x555c8fa70a10, have_lock=0) at malloc.c:4266 8 0x0000555c8da94bd3 in community_free (com=0x7ffc8cf72e70) at bgpd/bgp_community.c:41 9 community_free (com=com@entry=0x7ffc8cf72e70) at bgpd/bgp_community.c:28 10 0x0000555c8da8afc1 in bgp_attr_flush (attr=attr@entry=0x7ffc8cf73040) at bgpd/bgp_attr.c:1290 11 0x0000555c8dbc0760 in bgp_conditional_adv_routes (peer=peer@entry=0x555c8fa627c0, afi=afi@entry=AFI_IP, safi=SAFI_UNICAST, table=table@entry=0x555c8fa510b0, rmap=0x555c8fa71cb0, update_type=UPDATE_TYPE_ADVERTISE) at bgpd/bgp_conditional_adv.c:111 12 0x0000555c8dbc0b75 in bgp_conditional_adv_timer (t=<optimized out>) at bgpd/bgp_conditional_adv.c:301 13 0x00007ff3b705b84c in event_call (thread=thread@entry=0x7ffc8cf73440) at lib/event.c:1980 14 0x00007ff3b700bf98 in frr_run (master=0x555c8f27c090) at lib/libfrr.c:1214 15 0x0000555c8da85f05 in main (argc=<optimized out>, argv=0x7ffc8cf736a8) at bgpd/bgp_main.c:510 ``` Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org> (cherry picked from commit d410587bab67d1d492f724c6111ff7238a78e7b2)
2023-11-12bgpd: fix build errorIgor Ryzhov
I recieve the following error with GCC 9.4.0: ``` In file included from /usr/include/string.h:495, from ./lib/zebra.h:23, from bgpd/bgp_snmp_bgp4v2.c:7: In function ‘memset’, inlined from ‘bgp4v2PathAttrLookup’ at bgpd/bgp_snmp_bgp4v2.c:605:3, inlined from ‘bgp4v2PathAttrTable’ at bgpd/bgp_snmp_bgp4v2.c:747:9: /usr/include/x86_64-linux-gnu/bits/string_fortified.h:71:10: error: ‘__builtin_memset’ offset [9, 20] from the object at ‘paddr’ is out of the bounds of referenced subobject ‘_v4_addr’ with type ‘struct in_addr’ at offset 4 [-Werror=array-bounds] 71 | return __builtin___memset_chk (__dest, __ch, __len, __bos0 (__dest)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ``` Signed-off-by: Igor Ryzhov <iryzhov@nfware.com> (cherry picked from commit 6eb79dd6f20d54edff7e55eff9c6fda4c1711111)
2023-11-09bgpd: Set the software version capability received flag only after a validationDonatas Abraitis
We shouldn't set it blindly once the packet is received, but first we have to do some sanity checks. Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-11-09bgp: fix bgp4v2 MIB NLRI INDEX format and orderFrancois Dumontet
With a BGP configuration with ipv4 peering, and ipv6 peering, an snmpwalk is stopped while walking over the bgp4v2NlriTable snmpwalk -c TEST -v2c -On -Ln 1.1.1.2 .1.3.6.1.3.5.1.1.4 [...] .1.3.6.1.3.5.1.1.4.1.2.1.2.32.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1 = Gauge32: 13380 .1.3.6.1.3.5.1.1.9.1.1.1.1.1.1.1.0.24.0.0.0.0 = Gauge32: 0 .1.3.6.1.3.5.1.1.9.1.1.1.1.1.1.1.0.24.0.0.0.0 = Gauge32: 0 >= .1.3.6.1.3.5.1.1.9.1.1.1.1.1.1.1.0.24.0.0.0.0 The walk stopped because the index used in the NlriTable entries is decrementing, and this is against the snmp specifications. Also, the computed index is wrong, and does not match the provided draft-ietf-idr-bgp4-mibv2-1 specification. Fix this by computing a valid index, and by finding out the next consecutive prefix. The resulting changes do not break the walk, and the output is changed: root@dut-vm:~# snmpwalk -v 2c -c public -Ln -On localhost 1.3.6.1.3.5.1.1.9.1 .1.3.6.1.3.5.1.1.9.1.1.1.1.1.1.10.200.0.0.24.1.10.125.0.2.1 = Gauge32: 0 .1.3.6.1.3.5.1.1.9.1.1.1.1.1.1.10.244.0.0.24.1.10.125.0.2.1 = Gauge32: 0 .1.3.6.1.3.5.1.1.9.1.2.1.1.1.1.10.200.0.0.24.1.10.125.0.2.1 = INTEGER: 1 .1.3.6.1.3.5.1.1.9.1.2.1.1.1.1.10.244.0.0.24.1.10.125.0.2.1 = INTEGER: 1 .1.3.6.1.3.5.1.1.9.1.3.1.1.1.1.10.200.0.0.24.1.10.125.0.2.1 = INTEGER: 1 .1.3.6.1.3.5.1.1.9.1.3.1.1.1.1.10.244.0.0.24.1.10.125.0.2.1 = INTEGER: 1 .1.3.6.1.3.5.1.1.9.1.4.1.1.1.1.10.200.0.0.24.1.10.125.0.2.1 = INTEGER: 1 .1.3.6.1.3.5.1.1.9.1.4.1.1.1.1.10.244.0.0.24.1.10.125.0.2.1 = INTEGER: 1 .1.3.6.1.3.5.1.1.9.1.5.1.1.1.1.10.200.0.0.24.1.10.125.0.2.1 = Hex-STRING: 0A C8 00 00 .1.3.6.1.3.5.1.1.9.1.5.1.1.1.1.10.244.0.0.24.1.10.125.0.2.1 = Hex-STRING: 0A F4 00 00 Fixes: c681e937d7ae8904f748819fce37498ce0ea8f7d (bgpd: Implement SNMP BGP4V2-MIB (bgp4V2NlriTable), part 1) Fixes: 2ce69011c4199bead8172b5ee7e63485e2f861c8 (bgpd: Implement SNMP BGP4V2-MIB (bgp4V2NlriTable), part 2) Signed-off-by: Francois Dumontet <francois.dumontet@6wind.com> (cherry picked from commit fc3c9b177cdec2868941232427754f834e6be5f2)
2023-11-05bgpd: Ignore handling NLRIs if we received MP_UNREACH_NLRIDonatas Abraitis
If we receive MP_UNREACH_NLRI, we should stop handling remaining NLRIs if no mandatory path attributes received. In other words, if MP_UNREACH_NLRI received, the remaining NLRIs should be handled as a new data, but without mandatory attributes, it's a malformed packet. In normal case, this MUST not happen at all, but to avoid crashing bgpd, we MUST handle that. Reported-by: Iggy Frankovic <iggyfran@amazon.com> Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org> (cherry picked from commit c37119df45bbf4ef713bc10475af2ee06e12f3bf)
2023-11-05bgpd: Treat EOR as withdrawn to avoid unwanted handling of malformed attrsDonatas Abraitis
Treat-as-withdraw, otherwise if we just ignore it, we will pass it to be processed as a normal UPDATE without mandatory attributes, that could lead to harmful behavior. In this case, a crash for route-maps with the configuration such as: ``` router bgp 65001 no bgp ebgp-requires-policy neighbor 127.0.0.1 remote-as external neighbor 127.0.0.1 passive neighbor 127.0.0.1 ebgp-multihop neighbor 127.0.0.1 disable-connected-check neighbor 127.0.0.1 update-source 127.0.0.2 neighbor 127.0.0.1 timers 3 90 neighbor 127.0.0.1 timers connect 1 ! address-family ipv4 unicast neighbor 127.0.0.1 addpath-tx-all-paths neighbor 127.0.0.1 default-originate neighbor 127.0.0.1 route-map RM_IN in exit-address-family exit ! route-map RM_IN permit 10 set as-path prepend 200 exit ``` Send a malformed optional transitive attribute: ``` import socket import time OPEN = (b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff" b"\xff\xff\x00\x62\x01\x04\xfd\xea\x00\x5a\x0a\x00\x00\x01\x45\x02" b"\x06\x01\x04\x00\x01\x00\x01\x02\x02\x02\x00\x02\x02\x46\x00\x02" b"\x06\x41\x04\x00\x00\xfd\xea\x02\x02\x06\x00\x02\x06\x45\x04\x00" b"\x01\x01\x03\x02\x0e\x49\x0c\x0a\x64\x6f\x6e\x61\x74\x61\x73\x2d" b"\x70\x63\x00\x02\x04\x40\x02\x00\x78\x02\x09\x47\x07\x00\x01\x01" b"\x80\x00\x00\x00") KEEPALIVE = (b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff" b"\xff\xff\xff\xff\xff\xff\x00\x13\x04") UPDATE = bytearray.fromhex("ffffffffffffffffffffffffffffffff002b0200000003c0ff00010100eb00ac100b0b001ad908ac100b0b") s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(('127.0.0.2', 179)) s.send(OPEN) data = s.recv(1024) s.send(KEEPALIVE) data = s.recv(1024) s.send(UPDATE) data = s.recv(1024) time.sleep(100) s.close() ``` Reported-by: Iggy Frankovic <iggyfran@amazon.com> Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org> (cherry picked from commit 6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
2023-10-25bgpd: Check mandatory attributes more carefully for UPDATE messageDonatas Abraitis
If we send a crafted BGP UPDATE message without mandatory attributes, we do not check if the length of the path attributes is zero or not. We only check if attr->flag is at least set or not. Imagine we send only unknown transit attribute, then attr->flag is always 0. Also, this is true only if graceful-restart capability is received. A crash: ``` bgpd[7834]: [TJ23Y-GY0RH] 127.0.0.1 Unknown attribute is received (type 31, length 16) bgpd[7834]: [PCFFM-WMARW] 127.0.0.1(donatas-pc) rcvd UPDATE wlen 0 attrlen 20 alen 17 BGP[7834]: Received signal 11 at 1698089639 (si_addr 0x0, PC 0x55eefd375b4a); aborting... BGP[7834]: /usr/local/lib/libfrr.so.0(zlog_backtrace_sigsafe+0x6d) [0x7f3205ca939d] BGP[7834]: /usr/local/lib/libfrr.so.0(zlog_signal+0xf3) [0x7f3205ca9593] BGP[7834]: /usr/local/lib/libfrr.so.0(+0xf5181) [0x7f3205cdd181] BGP[7834]: /lib/x86_64-linux-gnu/libpthread.so.0(+0x12980) [0x7f3204ff3980] BGP[7834]: /usr/lib/frr/bgpd(+0x18ab4a) [0x55eefd375b4a] BGP[7834]: /usr/local/lib/libfrr.so.0(route_map_apply_ext+0x310) [0x7f3205cd1290] BGP[7834]: /usr/lib/frr/bgpd(+0x163610) [0x55eefd34e610] BGP[7834]: /usr/lib/frr/bgpd(bgp_update+0x9a5) [0x55eefd35c1d5] BGP[7834]: /usr/lib/frr/bgpd(bgp_nlri_parse_ip+0xb7) [0x55eefd35e867] BGP[7834]: /usr/lib/frr/bgpd(+0x1555e6) [0x55eefd3405e6] BGP[7834]: /usr/lib/frr/bgpd(bgp_process_packet+0x747) [0x55eefd345597] BGP[7834]: /usr/local/lib/libfrr.so.0(event_call+0x83) [0x7f3205cef4a3] BGP[7834]: /usr/local/lib/libfrr.so.0(frr_run+0xc0) [0x7f3205ca10a0] BGP[7834]: /usr/lib/frr/bgpd(main+0x409) [0x55eefd2dc979] ``` Sending: ``` import socket import time OPEN = (b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff" b"\xff\xff\x00\x62\x01\x04\xfd\xea\x00\x5a\x0a\x00\x00\x01\x45\x02" b"\x06\x01\x04\x00\x01\x00\x01\x02\x02\x02\x00\x02\x02\x46\x00\x02" b"\x06\x41\x04\x00\x00\xfd\xea\x02\x02\x06\x00\x02\x06\x45\x04\x00" b"\x01\x01\x03\x02\x0e\x49\x0c\x0a\x64\x6f\x6e\x61\x74\x61\x73\x2d" b"\x70\x63\x00\x02\x04\x40\x02\x00\x78\x02\x09\x47\x07\x00\x01\x01" b"\x80\x00\x00\x00") KEEPALIVE = (b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff" b"\xff\xff\xff\xff\xff\xff\x00\x13\x04") UPDATE = bytearray.fromhex("ffffffffffffffffffffffffffffffff003c0200000014ff1f001000040146464646460004464646464646664646f50d05800100010200ffff000000") s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(('127.0.0.2', 179)) s.send(OPEN) data = s.recv(1024) s.send(KEEPALIVE) data = s.recv(1024) s.send(UPDATE) data = s.recv(1024) time.sleep(1000) s.close() ``` Reported-by: Iggy Frankovic <iggyfran@amazon.com> Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org> (cherry picked from commit d8482bf011cb2b173e85b65b4bf3d5061250cdb9)
2023-10-25bgpd: Handle MP_REACH_NLRI malformed packets with session resetDonatas Abraitis
Avoid crashing bgpd. ``` (gdb) bgp_mp_reach_parse (args=<optimized out>, mp_update=0x7fffffffe140) at bgpd/bgp_attr.c:2341 2341 stream_get(&attr->mp_nexthop_global, s, IPV6_MAX_BYTELEN); (gdb) stream_get (dst=0x7fffffffe1ac, s=0x7ffff0006e80, size=16) at lib/stream.c:320 320 { (gdb) 321 STREAM_VERIFY_SANE(s); (gdb) 323 if (STREAM_READABLE(s) < size) { (gdb) 34 return __builtin___memcpy_chk (__dest, __src, __len, __bos0 (__dest)); (gdb) Thread 1 "bgpd" received signal SIGSEGV, Segmentation fault. 0x00005555556e37be in route_set_aspath_prepend (rule=0x555555aac0d0, prefix=0x7fffffffe050, object=0x7fffffffdb00) at bgpd/bgp_routemap.c:2282 2282 if (path->attr->aspath->refcnt) (gdb) ``` With the configuration: ``` neighbor 127.0.0.1 remote-as external neighbor 127.0.0.1 passive neighbor 127.0.0.1 ebgp-multihop neighbor 127.0.0.1 disable-connected-check neighbor 127.0.0.1 update-source 127.0.0.2 neighbor 127.0.0.1 timers 3 90 neighbor 127.0.0.1 timers connect 1 address-family ipv4 unicast redistribute connected neighbor 127.0.0.1 default-originate neighbor 127.0.0.1 route-map RM_IN in exit-address-family ! route-map RM_IN permit 10 set as-path prepend 200 exit ``` Reported-by: Iggy Frankovic <iggyfran@amazon.com> Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org> (cherry picked from commit b08afc81c60607a4f736f418f2e3eb06087f1a35)
2023-10-23bgpd: Do not suppress conditional advertisement updates if triggeredDonatas Abraitis
If we have a prefix-list with one entry, and after some time we append a prefix-list with some more additional entries, conditional advertisement is triggered, and the old entries are suppressed (because they look identical as sent before). Hence, the old entries are sent as withdrawals and only new entries sent as updates. Force re-sending all BGP updates for conditional advertisement. The same is done for route-refresh, and/or soft clear operations. Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org> (cherry picked from commit 2d8e85958526493f59e7cb9bf6dac829ed3d687f)
2023-10-13bgpd: Ecommunity_dup memory leak fixryndia
The shallow copy of attr wasn't freed when there was no valid label for the momentand the function return therefore creating leaks. The leak below are solved by flushing the shallow copy of attr. Address Sanitizer Error detected in bgp_vpnv6_per_nexthop_label.test_bgp_vpnv6_per_nexthop_label/r1.asan.bgpd.13409 ================================================================= ==13409==ERROR: LeakSanitizer: detected memory leaks Direct leak of 280 byte(s) in 7 object(s) allocated from: #0 0x7f62cd0c9d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f62ccac21c3 in qcalloc lib/memory.c:105 #2 0x5623b8810dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x5623b88be8eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x5623b88c13b3 in vpn_leak_from_vrf_update_all bgpd/bgp_mplsvpn.c:2005 #5 0x5623b89beabc in vpn_leak_postchange bgpd/bgp_mplsvpn.h:287 #6 0x5623b89beabc in af_label_vpn_export_allocation_mode_magic bgpd/bgp_vty.c:9464 #7 0x5623b89beabc in af_label_vpn_export_allocation_mode bgpd/bgp_vty_clippy.c:2809 #8 0x7f62cca45511 in cmd_execute_command_real lib/command.c:978 #9 0x7f62cca459d5 in cmd_execute_command lib/command.c:1036 #10 0x7f62cca45e54 in cmd_execute lib/command.c:1203 #11 0x7f62ccb6ee20 in vty_command lib/vty.c:591 #12 0x7f62ccb6f2cb in vty_execute lib/vty.c:1354 #13 0x7f62ccb77b95 in vtysh_read lib/vty.c:2362 #14 0x7f62ccb62b8f in event_call lib/event.c:1969 #15 0x7f62ccaa5462 in frr_run lib/libfrr.c:1213 #16 0x5623b87e054b in main bgpd/bgp_main.c:510 #17 0x7f62cbae7c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Direct leak of 280 byte(s) in 7 object(s) allocated from: #0 0x7f62cd0c9d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f62ccac21c3 in qcalloc lib/memory.c:105 #2 0x5623b8810dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x5623b88be8eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x5623b892e86d in bgp_update bgpd/bgp_route.c:4969 #5 0x5623b893134d in bgp_nlri_parse_ip bgpd/bgp_route.c:6213 #6 0x5623b88e2a0e in bgp_nlri_parse bgpd/bgp_packet.c:341 #7 0x5623b88e4f7c in bgp_update_receive bgpd/bgp_packet.c:2220 #8 0x5623b88f0474 in bgp_process_packet bgpd/bgp_packet.c:3386 #9 0x7f62ccb62b8f in event_call lib/event.c:1969 #10 0x7f62ccaa5462 in frr_run lib/libfrr.c:1213 #11 0x5623b87e054b in main bgpd/bgp_main.c:510 #12 0x7f62cbae7c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Direct leak of 280 byte(s) in 7 object(s) allocated from: #0 0x7f62cd0c9d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f62ccac21c3 in qcalloc lib/memory.c:105 #2 0x5623b8810dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x5623b88be8eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x5623b88c13b3 in vpn_leak_from_vrf_update_all bgpd/bgp_mplsvpn.c:2005 #5 0x5623b89bdebb in vpn_leak_postchange bgpd/bgp_mplsvpn.h:287 #6 0x5623b89bdebb in af_label_vpn_export_magic bgpd/bgp_vty.c:9547 #7 0x5623b89bdebb in af_label_vpn_export bgpd/bgp_vty_clippy.c:2868 #8 0x7f62cca45511 in cmd_execute_command_real lib/command.c:978 #9 0x7f62cca459d5 in cmd_execute_command lib/command.c:1036 #10 0x7f62cca45e54 in cmd_execute lib/command.c:1203 #11 0x7f62ccb6ee20 in vty_command lib/vty.c:591 #12 0x7f62ccb6f2cb in vty_execute lib/vty.c:1354 #13 0x7f62ccb77b95 in vtysh_read lib/vty.c:2362 #14 0x7f62ccb62b8f in event_call lib/event.c:1969 #15 0x7f62ccaa5462 in frr_run lib/libfrr.c:1213 #16 0x5623b87e054b in main bgpd/bgp_main.c:510 #17 0x7f62cbae7c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Direct leak of 240 byte(s) in 6 object(s) allocated from: #0 0x7f62cd0c9d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f62ccac21c3 in qcalloc lib/memory.c:105 #2 0x5623b8810dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x5623b88be8eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x5623b88dc289 in evaluate_paths bgpd/bgp_nht.c:1384 #5 0x5623b88ddb0b in bgp_process_nexthop_update bgpd/bgp_nht.c:733 #6 0x5623b88de027 in bgp_parse_nexthop_update bgpd/bgp_nht.c:934 #7 0x5623b8a03163 in bgp_read_nexthop_update bgpd/bgp_zebra.c:104 #8 0x7f62ccb92d8a in zclient_read lib/zclient.c:4425 #9 0x7f62ccb62b8f in event_call lib/event.c:1969 #10 0x7f62ccaa5462 in frr_run lib/libfrr.c:1213 #11 0x5623b87e054b in main bgpd/bgp_main.c:510 #12 0x7f62cbae7c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Direct leak of 120 byte(s) in 3 object(s) allocated from: #0 0x7f62cd0c9d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f62ccac21c3 in qcalloc lib/memory.c:105 #2 0x5623b8810dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x5623b88be8eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x5623b893a406 in bgp_redistribute_add bgpd/bgp_route.c:8692 #5 0x5623b8a02b3b in zebra_read_route bgpd/bgp_zebra.c:595 #6 0x7f62ccb92d8a in zclient_read lib/zclient.c:4425 #7 0x7f62ccb62b8f in event_call lib/event.c:1969 #8 0x7f62ccaa5462 in frr_run lib/libfrr.c:1213 #9 0x5623b87e054b in main bgpd/bgp_main.c:510 #10 0x7f62cbae7c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Direct leak of 80 byte(s) in 2 object(s) allocated from: #0 0x7f62cd0c9d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f62ccac21c3 in qcalloc lib/memory.c:105 #2 0x5623b8810dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x5623b88be8eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x5623b88dc188 in evaluate_paths bgpd/bgp_nht.c:1348 #5 0x5623b88ddb0b in bgp_process_nexthop_update bgpd/bgp_nht.c:733 #6 0x5623b88de027 in bgp_parse_nexthop_update bgpd/bgp_nht.c:934 #7 0x5623b8a03163 in bgp_read_nexthop_update bgpd/bgp_zebra.c:104 #8 0x7f62ccb92d8a in zclient_read lib/zclient.c:4425 #9 0x7f62ccb62b8f in event_call lib/event.c:1969 #10 0x7f62ccaa5462 in frr_run lib/libfrr.c:1213 #11 0x5623b87e054b in main bgpd/bgp_main.c:510 #12 0x7f62cbae7c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 56 byte(s) in 7 object(s) allocated from: #0 0x7f62cd0c9b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f62ccac1ee3 in qmalloc lib/memory.c:100 #2 0x5623b8810eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x5623b88be8eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x5623b88c13b3 in vpn_leak_from_vrf_update_all bgpd/bgp_mplsvpn.c:2005 #5 0x5623b89beabc in vpn_leak_postchange bgpd/bgp_mplsvpn.h:287 #6 0x5623b89beabc in af_label_vpn_export_allocation_mode_magic bgpd/bgp_vty.c:9464 #7 0x5623b89beabc in af_label_vpn_export_allocation_mode bgpd/bgp_vty_clippy.c:2809 #8 0x7f62cca45511 in cmd_execute_command_real lib/command.c:978 #9 0x7f62cca459d5 in cmd_execute_command lib/command.c:1036 #10 0x7f62cca45e54 in cmd_execute lib/command.c:1203 #11 0x7f62ccb6ee20 in vty_command lib/vty.c:591 #12 0x7f62ccb6f2cb in vty_execute lib/vty.c:1354 #13 0x7f62ccb77b95 in vtysh_read lib/vty.c:2362 #14 0x7f62ccb62b8f in event_call lib/event.c:1969 #15 0x7f62ccaa5462 in frr_run lib/libfrr.c:1213 #16 0x5623b87e054b in main bgpd/bgp_main.c:510 #17 0x7f62cbae7c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 56 byte(s) in 7 object(s) allocated from: #0 0x7f62cd0c9b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f62ccac1ee3 in qmalloc lib/memory.c:100 #2 0x5623b8810eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x5623b88be8eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x5623b892e86d in bgp_update bgpd/bgp_route.c:4969 #5 0x5623b893134d in bgp_nlri_parse_ip bgpd/bgp_route.c:6213 #6 0x5623b88e2a0e in bgp_nlri_parse bgpd/bgp_packet.c:341 #7 0x5623b88e4f7c in bgp_update_receive bgpd/bgp_packet.c:2220 #8 0x5623b88f0474 in bgp_process_packet bgpd/bgp_packet.c:3386 #9 0x7f62ccb62b8f in event_call lib/event.c:1969 #10 0x7f62ccaa5462 in frr_run lib/libfrr.c:1213 #11 0x5623b87e054b in main bgpd/bgp_main.c:510 #12 0x7f62cbae7c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 56 byte(s) in 7 object(s) allocated from: #0 0x7f62cd0c9b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f62ccac1ee3 in qmalloc lib/memory.c:100 #2 0x5623b8810eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x5623b88be8eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x5623b88c13b3 in vpn_leak_from_vrf_update_all bgpd/bgp_mplsvpn.c:2005 #5 0x5623b89bdebb in vpn_leak_postchange bgpd/bgp_mplsvpn.h:287 #6 0x5623b89bdebb in af_label_vpn_export_magic bgpd/bgp_vty.c:9547 #7 0x5623b89bdebb in af_label_vpn_export bgpd/bgp_vty_clippy.c:2868 #8 0x7f62cca45511 in cmd_execute_command_real lib/command.c:978 #9 0x7f62cca459d5 in cmd_execute_command lib/command.c:1036 #10 0x7f62cca45e54 in cmd_execute lib/command.c:1203 #11 0x7f62ccb6ee20 in vty_command lib/vty.c:591 #12 0x7f62ccb6f2cb in vty_execute lib/vty.c:1354 #13 0x7f62ccb77b95 in vtysh_read lib/vty.c:2362 #14 0x7f62ccb62b8f in event_call lib/event.c:1969 #15 0x7f62ccaa5462 in frr_run lib/libfrr.c:1213 #16 0x5623b87e054b in main bgpd/bgp_main.c:510 #17 0x7f62cbae7c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 48 byte(s) in 6 object(s) allocated from: #0 0x7f62cd0c9b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f62ccac1ee3 in qmalloc lib/memory.c:100 #2 0x5623b8810eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x5623b88be8eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x5623b88dc289 in evaluate_paths bgpd/bgp_nht.c:1384 #5 0x5623b88ddb0b in bgp_process_nexthop_update bgpd/bgp_nht.c:733 #6 0x5623b88de027 in bgp_parse_nexthop_update bgpd/bgp_nht.c:934 #7 0x5623b8a03163 in bgp_read_nexthop_update bgpd/bgp_zebra.c:104 #8 0x7f62ccb92d8a in zclient_read lib/zclient.c:4425 #9 0x7f62ccb62b8f in event_call lib/event.c:1969 #10 0x7f62ccaa5462 in frr_run lib/libfrr.c:1213 #11 0x5623b87e054b in main bgpd/bgp_main.c:510 #12 0x7f62cbae7c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 24 byte(s) in 3 object(s) allocated from: #0 0x7f62cd0c9b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f62ccac1ee3 in qmalloc lib/memory.c:100 #2 0x5623b8810eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x5623b88be8eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x5623b893a406 in bgp_redistribute_add bgpd/bgp_route.c:8692 #5 0x5623b8a02b3b in zebra_read_route bgpd/bgp_zebra.c:595 #6 0x7f62ccb92d8a in zclient_read lib/zclient.c:4425 #7 0x7f62ccb62b8f in event_call lib/event.c:1969 #8 0x7f62ccaa5462 in frr_run lib/libfrr.c:1213 #9 0x5623b87e054b in main bgpd/bgp_main.c:510 #10 0x7f62cbae7c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 16 byte(s) in 2 object(s) allocated from: #0 0x7f62cd0c9b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f62ccac1ee3 in qmalloc lib/memory.c:100 #2 0x5623b8810eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x5623b88be8eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x5623b88dc188 in evaluate_paths bgpd/bgp_nht.c:1348 #5 0x5623b88ddb0b in bgp_process_nexthop_update bgpd/bgp_nht.c:733 #6 0x5623b88de027 in bgp_parse_nexthop_update bgpd/bgp_nht.c:934 #7 0x5623b8a03163 in bgp_read_nexthop_update bgpd/bgp_zebra.c:104 #8 0x7f62ccb92d8a in zclient_read lib/zclient.c:4425 #9 0x7f62ccb62b8f in event_call lib/event.c:1969 #10 0x7f62ccaa5462 in frr_run lib/libfrr.c:1213 #11 0x5623b87e054b in main bgpd/bgp_main.c:510 #12 0x7f62cbae7c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) SUMMARY: AddressSanitizer: 1536 byte(s) leaked in 64 allocation(s). *********************************************************************************** Address Sanitizer Error detected in bgp_vpnv4_per_nexthop_label.test_bgp_vpnv4_per_nexthop_label/r1.asan.bgpd.10610 ================================================================= ==10610==ERROR: LeakSanitizer: detected memory leaks Direct leak of 280 byte(s) in 7 object(s) allocated from: #0 0x7f81fc562d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f81fbf5b1c3 in qcalloc lib/memory.c:105 #2 0x55cdc9b28dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9c4686d in bgp_update bgpd/bgp_route.c:4969 #5 0x55cdc9c4934d in bgp_nlri_parse_ip bgpd/bgp_route.c:6213 #6 0x55cdc9bfaa0e in bgp_nlri_parse bgpd/bgp_packet.c:341 #7 0x55cdc9bfcf7c in bgp_update_receive bgpd/bgp_packet.c:2220 #8 0x55cdc9c08474 in bgp_process_packet bgpd/bgp_packet.c:3386 #9 0x7f81fbffbb8f in event_call lib/event.c:1969 #10 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #11 0x55cdc9af854b in main bgpd/bgp_main.c:510 #12 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Direct leak of 280 byte(s) in 7 object(s) allocated from: #0 0x7f81fc562d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f81fbf5b1c3 in qcalloc lib/memory.c:105 #2 0x55cdc9b28dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9bd93b3 in vpn_leak_from_vrf_update_all bgpd/bgp_mplsvpn.c:2005 #5 0x55cdc9cd6abc in vpn_leak_postchange bgpd/bgp_mplsvpn.h:287 #6 0x55cdc9cd6abc in af_label_vpn_export_allocation_mode_magic bgpd/bgp_vty.c:9464 #7 0x55cdc9cd6abc in af_label_vpn_export_allocation_mode bgpd/bgp_vty_clippy.c:2809 #8 0x7f81fbede511 in cmd_execute_command_real lib/command.c:978 #9 0x7f81fbede9d5 in cmd_execute_command lib/command.c:1036 #10 0x7f81fbedee54 in cmd_execute lib/command.c:1203 #11 0x7f81fc007e20 in vty_command lib/vty.c:591 #12 0x7f81fc0082cb in vty_execute lib/vty.c:1354 #13 0x7f81fc010b95 in vtysh_read lib/vty.c:2362 #14 0x7f81fbffbb8f in event_call lib/event.c:1969 #15 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #16 0x55cdc9af854b in main bgpd/bgp_main.c:510 #17 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Direct leak of 280 byte(s) in 7 object(s) allocated from: #0 0x7f81fc562d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f81fbf5b1c3 in qcalloc lib/memory.c:105 #2 0x55cdc9b28dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9bd93b3 in vpn_leak_from_vrf_update_all bgpd/bgp_mplsvpn.c:2005 #5 0x55cdc9cd5ebb in vpn_leak_postchange bgpd/bgp_mplsvpn.h:287 #6 0x55cdc9cd5ebb in af_label_vpn_export_magic bgpd/bgp_vty.c:9547 #7 0x55cdc9cd5ebb in af_label_vpn_export bgpd/bgp_vty_clippy.c:2868 #8 0x7f81fbede511 in cmd_execute_command_real lib/command.c:978 #9 0x7f81fbede9d5 in cmd_execute_command lib/command.c:1036 #10 0x7f81fbedee54 in cmd_execute lib/command.c:1203 #11 0x7f81fc007e20 in vty_command lib/vty.c:591 #12 0x7f81fc0082cb in vty_execute lib/vty.c:1354 #13 0x7f81fc010b95 in vtysh_read lib/vty.c:2362 #14 0x7f81fbffbb8f in event_call lib/event.c:1969 #15 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #16 0x55cdc9af854b in main bgpd/bgp_main.c:510 #17 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Direct leak of 240 byte(s) in 6 object(s) allocated from: #0 0x7f81fc562d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f81fbf5b1c3 in qcalloc lib/memory.c:105 #2 0x55cdc9b28dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9bf4289 in evaluate_paths bgpd/bgp_nht.c:1384 #5 0x55cdc9bf5b0b in bgp_process_nexthop_update bgpd/bgp_nht.c:733 #6 0x55cdc9bf6027 in bgp_parse_nexthop_update bgpd/bgp_nht.c:934 #7 0x55cdc9d1b163 in bgp_read_nexthop_update bgpd/bgp_zebra.c:104 #8 0x7f81fc02bd8a in zclient_read lib/zclient.c:4425 #9 0x7f81fbffbb8f in event_call lib/event.c:1969 #10 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #11 0x55cdc9af854b in main bgpd/bgp_main.c:510 #12 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Direct leak of 80 byte(s) in 2 object(s) allocated from: #0 0x7f81fc562d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f81fbf5b1c3 in qcalloc lib/memory.c:105 #2 0x55cdc9b28dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9bf4188 in evaluate_paths bgpd/bgp_nht.c:1348 #5 0x55cdc9bf5b0b in bgp_process_nexthop_update bgpd/bgp_nht.c:733 #6 0x55cdc9bf6027 in bgp_parse_nexthop_update bgpd/bgp_nht.c:934 #7 0x55cdc9d1b163 in bgp_read_nexthop_update bgpd/bgp_zebra.c:104 #8 0x7f81fc02bd8a in zclient_read lib/zclient.c:4425 #9 0x7f81fbffbb8f in event_call lib/event.c:1969 #10 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #11 0x55cdc9af854b in main bgpd/bgp_main.c:510 #12 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Direct leak of 80 byte(s) in 2 object(s) allocated from: #0 0x7f81fc562d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f81fbf5b1c3 in qcalloc lib/memory.c:105 #2 0x55cdc9b28dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9bd93b3 in vpn_leak_from_vrf_update_all bgpd/bgp_mplsvpn.c:2005 #5 0x55cdc9bdafd5 in vpn_leak_postchange bgpd/bgp_mplsvpn.h:287 #6 0x55cdc9bdafd5 in vpn_leak_label_callback bgpd/bgp_mplsvpn.c:581 #7 0x55cdc9bb2606 in lp_cbq_docallback bgpd/bgp_labelpool.c:118 #8 0x7f81fc0164b5 in work_queue_run lib/workqueue.c:266 #9 0x7f81fbffbb8f in event_call lib/event.c:1969 #10 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #11 0x55cdc9af854b in main bgpd/bgp_main.c:510 #12 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Direct leak of 40 byte(s) in 1 object(s) allocated from: #0 0x7f81fc562d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) #1 0x7f81fbf5b1c3 in qcalloc lib/memory.c:105 #2 0x55cdc9b28dc8 in ecommunity_dup bgpd/bgp_ecommunity.c:252 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9c52406 in bgp_redistribute_add bgpd/bgp_route.c:8692 #5 0x55cdc9d1ab3b in zebra_read_route bgpd/bgp_zebra.c:595 #6 0x7f81fc02bd8a in zclient_read lib/zclient.c:4425 #7 0x7f81fbffbb8f in event_call lib/event.c:1969 #8 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #9 0x55cdc9af854b in main bgpd/bgp_main.c:510 #10 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 56 byte(s) in 7 object(s) allocated from: #0 0x7f81fc562b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f81fbf5aee3 in qmalloc lib/memory.c:100 #2 0x55cdc9b28eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9bd93b3 in vpn_leak_from_vrf_update_all bgpd/bgp_mplsvpn.c:2005 #5 0x55cdc9cd6abc in vpn_leak_postchange bgpd/bgp_mplsvpn.h:287 #6 0x55cdc9cd6abc in af_label_vpn_export_allocation_mode_magic bgpd/bgp_vty.c:9464 #7 0x55cdc9cd6abc in af_label_vpn_export_allocation_mode bgpd/bgp_vty_clippy.c:2809 #8 0x7f81fbede511 in cmd_execute_command_real lib/command.c:978 #9 0x7f81fbede9d5 in cmd_execute_command lib/command.c:1036 #10 0x7f81fbedee54 in cmd_execute lib/command.c:1203 #11 0x7f81fc007e20 in vty_command lib/vty.c:591 #12 0x7f81fc0082cb in vty_execute lib/vty.c:1354 #13 0x7f81fc010b95 in vtysh_read lib/vty.c:2362 #14 0x7f81fbffbb8f in event_call lib/event.c:1969 #15 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #16 0x55cdc9af854b in main bgpd/bgp_main.c:510 #17 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 56 byte(s) in 7 object(s) allocated from: #0 0x7f81fc562b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f81fbf5aee3 in qmalloc lib/memory.c:100 #2 0x55cdc9b28eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9bd93b3 in vpn_leak_from_vrf_update_all bgpd/bgp_mplsvpn.c:2005 #5 0x55cdc9cd5ebb in vpn_leak_postchange bgpd/bgp_mplsvpn.h:287 #6 0x55cdc9cd5ebb in af_label_vpn_export_magic bgpd/bgp_vty.c:9547 #7 0x55cdc9cd5ebb in af_label_vpn_export bgpd/bgp_vty_clippy.c:2868 #8 0x7f81fbede511 in cmd_execute_command_real lib/command.c:978 #9 0x7f81fbede9d5 in cmd_execute_command lib/command.c:1036 #10 0x7f81fbedee54 in cmd_execute lib/command.c:1203 #11 0x7f81fc007e20 in vty_command lib/vty.c:591 #12 0x7f81fc0082cb in vty_execute lib/vty.c:1354 #13 0x7f81fc010b95 in vtysh_read lib/vty.c:2362 #14 0x7f81fbffbb8f in event_call lib/event.c:1969 #15 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #16 0x55cdc9af854b in main bgpd/bgp_main.c:510 #17 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 56 byte(s) in 7 object(s) allocated from: #0 0x7f81fc562b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f81fbf5aee3 in qmalloc lib/memory.c:100 #2 0x55cdc9b28eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9c4686d in bgp_update bgpd/bgp_route.c:4969 #5 0x55cdc9c4934d in bgp_nlri_parse_ip bgpd/bgp_route.c:6213 #6 0x55cdc9bfaa0e in bgp_nlri_parse bgpd/bgp_packet.c:341 #7 0x55cdc9bfcf7c in bgp_update_receive bgpd/bgp_packet.c:2220 #8 0x55cdc9c08474 in bgp_process_packet bgpd/bgp_packet.c:3386 #9 0x7f81fbffbb8f in event_call lib/event.c:1969 #10 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #11 0x55cdc9af854b in main bgpd/bgp_main.c:510 #12 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 48 byte(s) in 6 object(s) allocated from: #0 0x7f81fc562b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f81fbf5aee3 in qmalloc lib/memory.c:100 #2 0x55cdc9b28eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9bf4289 in evaluate_paths bgpd/bgp_nht.c:1384 #5 0x55cdc9bf5b0b in bgp_process_nexthop_update bgpd/bgp_nht.c:733 #6 0x55cdc9bf6027 in bgp_parse_nexthop_update bgpd/bgp_nht.c:934 #7 0x55cdc9d1b163 in bgp_read_nexthop_update bgpd/bgp_zebra.c:104 #8 0x7f81fc02bd8a in zclient_read lib/zclient.c:4425 #9 0x7f81fbffbb8f in event_call lib/event.c:1969 #10 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #11 0x55cdc9af854b in main bgpd/bgp_main.c:510 #12 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 16 byte(s) in 2 object(s) allocated from: #0 0x7f81fc562b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f81fbf5aee3 in qmalloc lib/memory.c:100 #2 0x55cdc9b28eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9bf4188 in evaluate_paths bgpd/bgp_nht.c:1348 #5 0x55cdc9bf5b0b in bgp_process_nexthop_update bgpd/bgp_nht.c:733 #6 0x55cdc9bf6027 in bgp_parse_nexthop_update bgpd/bgp_nht.c:934 #7 0x55cdc9d1b163 in bgp_read_nexthop_update bgpd/bgp_zebra.c:104 #8 0x7f81fc02bd8a in zclient_read lib/zclient.c:4425 #9 0x7f81fbffbb8f in event_call lib/event.c:1969 #10 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #11 0x55cdc9af854b in main bgpd/bgp_main.c:510 #12 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 16 byte(s) in 2 object(s) allocated from: #0 0x7f81fc562b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f81fbf5aee3 in qmalloc lib/memory.c:100 #2 0x55cdc9b28eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9bd93b3 in vpn_leak_from_vrf_update_all bgpd/bgp_mplsvpn.c:2005 #5 0x55cdc9bdafd5 in vpn_leak_postchange bgpd/bgp_mplsvpn.h:287 #6 0x55cdc9bdafd5 in vpn_leak_label_callback bgpd/bgp_mplsvpn.c:581 #7 0x55cdc9bb2606 in lp_cbq_docallback bgpd/bgp_labelpool.c:118 #8 0x7f81fc0164b5 in work_queue_run lib/workqueue.c:266 #9 0x7f81fbffbb8f in event_call lib/event.c:1969 #10 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #11 0x55cdc9af854b in main bgpd/bgp_main.c:510 #12 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) Indirect leak of 8 byte(s) in 1 object(s) allocated from: #0 0x7f81fc562b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40) #1 0x7f81fbf5aee3 in qmalloc lib/memory.c:100 #2 0x55cdc9b28eb8 in ecommunity_dup bgpd/bgp_ecommunity.c:256 #3 0x55cdc9bd68eb in vpn_leak_from_vrf_update bgpd/bgp_mplsvpn.c:1628 #4 0x55cdc9c52406 in bgp_redistribute_add bgpd/bgp_route.c:8692 #5 0x55cdc9d1ab3b in zebra_read_route bgpd/bgp_zebra.c:595 #6 0x7f81fc02bd8a in zclient_read lib/zclient.c:4425 #7 0x7f81fbffbb8f in event_call lib/event.c:1969 #8 0x7f81fbf3e462 in frr_run lib/libfrr.c:1213 #9 0x55cdc9af854b in main bgpd/bgp_main.c:510 #10 0x7f81faf80c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) SUMMARY: AddressSanitizer: 1536 byte(s) leaked in 64 allocation(s). *********************************************************************************** Signed-off-by: ryndia <dindyalsarvesh@gmail.com> (cherry picked from commit 78b6cadc16f75cc7411bb535beed6703a150d38a)
2023-10-11Revert "lib: register bgp link-state afi/safi"Donald Sharp
This reverts commit 1642a68d60cfade4b2fce72aaef58dea700c65c3. (cherry picked from commit 0dc12c9003a865c7ee829543d40e8c285863abe8)
2023-10-11Revert "bgpd: add bgp link-state address-family configuration context"Donald Sharp
This reverts commit ae2f3bb5b4eed01df1f7a69c7710c9be519390f6. (cherry picked from commit ddd96b51b06e7cd5ff5471aa6f8ddb390708b858)
2023-10-11Revert "bgpd: accept bgp link-state capability"Donald Sharp
This reverts commit 67fe40676eb4e2ca78a41ddd70887af09b29fd9d. (cherry picked from commit a4fcdc4e48460dc067b0ff8f4dab20bf18fe9694)
2023-10-11Revert "bgpd: store bgp link-state prefixes"Donald Sharp
This reverts commit 39a8d354c11f6f063fa5154f5807e7a0c9b04b46. (cherry picked from commit 59c3a491667d8022f996af65612d476ec964049c)
2023-10-11Revert "bgpd: send bgp link-state prefixes"Donald Sharp
This reverts commit 0c94fb9cc853b3bcc98e8acca9fd03a036d33c92. (cherry picked from commit f75d9050fc16469b519630abe7ed61de725e64a5)
2023-10-11Revert "bgpd, lib: extend the size of the prefix string buffer"Donald Sharp
This reverts commit bdb3fa3b9216aede64c5b982011fb04ef25c67f7. (cherry picked from commit 8b3e765d19158e3be146304d40d0563bf945310d)
2023-10-11Revert "bgpd: do not display vty output headers for link-state prefixes"Donald Sharp
This reverts commit 3098772467ad8a46a8f35cdd4e502806740b2064. (cherry picked from commit 85a63731dc8231923796345ba8bb1843ba48d59b)
2023-10-11Revert "bgpd: display link-state prefixes detail"Donald Sharp
This reverts commit 7e0d9ff8ba984966689562553afe2734b04c8539. (cherry picked from commit 8a6b65f7fde9c3bc5fce6a18f8e1d04db9fcf937)
2023-10-11Revert "bgpd: do not announce link-state routes to zebra"Donald Sharp
This reverts commit 39fb34275f827b3e1134549ed1731d74e72e6c79. (cherry picked from commit 4ab7fa86b0360fb79cbe4905a167e8ac25f7f6bf)
2023-10-11Revert "bgpd: add bgp default link-state command"Donald Sharp
This reverts commit 38a7e20fc98ed750d9b2cdae1c79d1e19ceadcd3. (cherry picked from commit 7679d6056b96f707c01157fe5cefab06a7a6392b)
2023-10-11Revert "bgpd: add show bgp link-state link-state commands"Donald Sharp
This reverts commit f11f67033fe20f0b4aeb6c885949abb060324749. (cherry picked from commit d3261fd83f921cb2defd17fd93ab5099d48c952d)
2023-10-11Revert "bgpd: add linkstate debug"Donald Sharp
This reverts commit de38eada9c0527758bca34984d2f018670d74c9a. (cherry picked from commit 68bae363762894d6703e405d2cb1b60d7381be3a)
2023-10-11Revert "bgpd: store and send bgp link-state attributes"Donald Sharp
This reverts commit 8b531b110756bf8627b5716f433190a0748b5e76. (cherry picked from commit 166e52d6a31c517861be316af6c5737e43c2f48f)
2023-10-11Revert "bgpd: do not check attr in bgp_packet_attribute"Donald Sharp
This reverts commit eb9e2865116777661c44963769c1a5fed764b7f9. (cherry picked from commit e7c0191e820d7a57370ed11434a79f3a65e49b57)
2023-10-11Revert "bgpd: fix illegal memory access in bgp_ls_tlv_check_size()"Donald Sharp
This reverts commit dae5791c446cd18d8cda93a1e578fff2cd27be10. (cherry picked from commit 73a4891ab39bf22f5d0120b378fb7d6cd4b75dd5)
2023-10-11Revert "bgpd: fix link_state_hash_cmp()"Donald Sharp
This reverts commit 25408c8dbf7d9e0149ceb2dcbd2058860ce4f6c5. (cherry picked from commit 2263d1163074f24cc20d75156ee9efe1042b0c6a)
2023-10-11Revert "bgpd: fix insecure data write with ip addresses"Donald Sharp
This reverts commit 54222f921305edbce74e81996e9303c0c6b03823. (cherry picked from commit 298d53401344d2832bf462d143d0c32057f13139)
2023-10-11Revert "bgpd: fix insecure data write with area addresses"Donald Sharp
This reverts commit 57d0dc565f6a99c3d61b9b67a40ad88a83773eb6. (cherry picked from commit c0d3acb0a0813e8d56bf890183bf71fba7f53b2c)
2023-10-11Revert "bgpd: fix printing link state ospf opaque data"Donald Sharp
This reverts commit e1333d12e0d3ba8a9a0ca914dc72d0908dea494e. (cherry picked from commit 28dab7387770f33cbf0f726708ebd085ad93b3f6)
2023-10-10Merge pull request #14535 from opensourcerouting/fix/bgp_aggregate_stuffRuss White
bgpd: Drop redundant assignment for aspath segment type and length
2023-10-08Merge pull request #10733 from anlancs/zebra-remove-updateRafael Zalamena
zebra: remove ZEBRA_INTERFACE_VRF_UPDATE
2023-10-07*: remove ZEBRA_INTERFACE_VRF_UPDATEanlan_cs
Currently when one interface changes its VRF, zebra will send these messages to all daemons in *order*: 1) `ZEBRA_INTERFACE_DELETE` ( notify them delete from old VRF ) 2) `ZEBRA_INTERFACE_VRF_UPDATE` ( notify them move from old to new VRF ) 3) `ZEBRA_INTERFACE_ADD` ( notify them added into new VRF ) When daemons deal with `VRF_UPDATE`, they use `zebra_interface_vrf_update_read()->if_lookup_by_name()` to check the interface exist or not in old VRF. This check will always return *NULL* because `DELETE` ( deleted from old VRF ) is already done, so can't find this interface in old VRF. Send `VRF_UPDATE` is redundant and unuseful. `DELETE` and `ADD` are enough, they will deal with RB tree, so don't send this `VRF_UPDATE` message when vrf changes. Since all daemons have good mechanism to deal with changing vrf, and don't use this `VRF_UPDATE` mechanism. So, it is safe to completely remove all the code with `VRF_UPDATE`. Signed-off-by: anlan_cs <anlan_cs@tom.com>
2023-10-05bgpd: Drop redundant assignment for aspath segment type and lengthDonatas Abraitis
They are already initialized via assegment_new(). Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-10-03bgpd: Add guards for zlog_debug when setting GTSM for the peerDonatas Abraitis
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-10-03Merge pull request #14511 from ↵Russ White
opensourcerouting/fix/bgpd_software_version_capability bgpd: Validate maximum length of software version when handling via dynamic caps
2023-10-02bgpd: add 'match community-list any' functionPhilippe Guibert
There is no match mechanism to match one community from the incoming community-list. Add the 'any' keyword to the 'match route-map' command of communit-list and large-community-list. > match community-list AAA any > match large-community-list AAA any Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
2023-09-29bgpd: Validate maximum length of software version when handling via dynamic capsDonatas Abraitis
We should not allow exceeding the stream's length, and also software version can't be larger than 64 bytes. Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-09-29*: Do not cast to the same type as the destination isDonatas Abraitis
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-09-29Merge pull request #14506 from louis-6wind/fix-bgp-link-stateDonatas Abraitis
bgpd: fix link state coverity scan issues
2023-09-28Merge pull request #14483 from ↵Donald Sharp
opensourcerouting/fix/ignore_setting_ttl_for_negative_socket bgpd: Set the TTL for the correct socket
2023-09-28bgpd: fix printing link state ospf opaque dataLouis Scalbert
Fix printing link state ospf opaque data. pnt address was not moving in the loop. Fixes: 8b531b1107 ("bgpd: store and send bgp link-state attributes") Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
2023-09-28bgpd: fix insecure data write with area addressesLouis Scalbert
Fix an issue where an attacker may inject a tainted length value to corrupt the memory. > CID 1568380 (#1 of 1): Untrusted value as argument (TAINTED_SCALAR) > 9. tainted_data: Passing tainted expression length to bgp_linkstate_nlri_value_display, which uses it as an offset Fixes: 8b531b1107 ("bgpd: store and send bgp link-state attributes") Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
2023-09-28bgpd: fix insecure data write with ip addressesLouis Scalbert
Fix issues where an attacker may inject a tainted length value to corrupt the memory. > CID 1568378 (#1-6 of 6): Untrusted value as argument (TAINTED_SCALAR) > 16. tainted_data: Passing tainted expression length to bgp_linkstate_tlv_attribute_value_display, which uses it as an offset. [show details] Fixes: 7e0d9ff8ba ("bgpd: display link-state prefixes detail") Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
2023-09-28bgpd: fix link_state_hash_cmp()Louis Scalbert
Fix comparaison of link state attributes pointers in link_state_hash_cmp(). > CID 1568379 (#1 of 1): Logically dead code (DEADCODE) > dead_error_line: Execution cannot reach this statement: return false;. Fixes: 8b531b1107 ("bgpd: store and send bgp link-state attributes") Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
2023-09-28bgpd: fix illegal memory access in bgp_ls_tlv_check_size()Louis Scalbert
Fix illegal memory access bgp_ls_tlv_check_size() if type is 1253. > CID 1568377 (#4 of 4): Out-of-bounds read (OVERRUN) > 5. overrun-local: Overrunning array bgp_linkstate_tlv_infos of 1253 16-byte elements at element index 1253 (byte offset 20063) using index type (which evaluates to 1253). Fixes: 7e0d9ff8ba ("bgpd: display link-state prefixes detail") Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
2023-09-28bgpd: do not check attr in bgp_packet_attributeLouis Scalbert
Fix the following coverity issue. attr cannot be NULL. > CID 1568376 (#1 of 1): Dereference before null check (REVERSE_INULL) > check_after_deref: Null-checking attr suggests that it may be null, but it has already been dereferenced on all paths leading to the check. Fixes: 8b531b1107 ("bgpd: store and send bgp link-state attributes") Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
2023-09-27Merge pull request #14342 from fdumontet6WIND/fix_crash_snmpDonald Sharp
bgpd: fix crash in *bgpv2PeerErrorsTable"
2023-09-26Merge pull request #12649 from louis-6wind/bgp-link-stateRuss White
bgpd: add basic support of BGP Link-State RFC7752
2023-09-25bgpd: Set the TTL for the correct socketDonatas Abraitis
When we accept a connection, we try to set TTL for the socket, but the socket is not yet created/assigned and we are trying to set it on the wrong socket fd. ``` [Event] connection from 127.0.0.1 fd 25, active peer status 3 fd -1 can't set sockopt IP_TTL 255 to socket -1 bgp_set_socket_ttl: Can't set TxTTL on peer (rtrid 0.0.0.0) socket, err = 9 Unable to set min/max TTL on peer 127.0.0.1, Continuing ``` Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-09-24Merge pull request #14468 from donaldsharp/bgp_send_orderingDonatas Abraitis
bgpd: Ensure send order is 100% consistent