bgpd: fix crashes caused by missing input validation

[mirror_frr.git] / bgpd / bgp_fsm.c

diff --git a/bgpd/bgp_fsm.c b/bgpd/bgp_fsm.c
index 3f5ff12cbc0306c19f86d983f8cda55d55401a24..14d692ebf0934d2eee3def8f0e1be2286876c9c8 100644 (file)
--- a/bgpd/bgp_fsm.c
+++ b/bgpd/bgp_fsm.c
@@ -34,11 +34,13 @@
 #include "queue.h"
 #include "filter.h"
 #include "command.h"
+#include "lib_errors.h"
 
 #include "lib/json.h"
 #include "bgpd/bgpd.h"
 #include "bgpd/bgp_attr.h"
 #include "bgpd/bgp_debug.h"
+#include "bgpd/bgp_errors.h"
 #include "bgpd/bgp_fsm.h"
 #include "bgpd/bgp_packet.h"
 #include "bgpd/bgp_network.h"
@@ -164,7 +166,8 @@ static struct peer *peer_xfer_conn(struct peer *from_peer)
                 * runs in our pthread.
                 */
                if (peer->curr) {
-                       zlog_err(
+                       flog_err(
+                               BGP_ERR_PKT_PROCESS,
                                "[%s] Dropping pending packet on connection transfer:",
                                peer->host);
                        uint16_t type = stream_getc_from(peer->curr,
@@ -194,7 +197,6 @@ static struct peer *peer_xfer_conn(struct peer *from_peer)
        peer->as = from_peer->as;
        peer->v_holdtime = from_peer->v_holdtime;
        peer->v_keepalive = from_peer->v_keepalive;
-       peer->routeadv = from_peer->routeadv;
        peer->v_routeadv = from_peer->v_routeadv;
        peer->v_gr_restart = from_peer->v_gr_restart;
        peer->cap = from_peer->cap;
@@ -243,7 +245,8 @@ static struct peer *peer_xfer_conn(struct peer *from_peer)
        }
 
        if (bgp_getsockname(peer) < 0) {
-               zlog_err(
+               flog_err(
+                       LIB_ERR_SOCKET,
                        "%%bgp_getsockname() failed for %s peer %s fd %d (from_peer fd %d)",
                        (CHECK_FLAG(peer->sflags, PEER_STATUS_ACCEPT_PEER)
                                 ? "accept"
@@ -255,8 +258,10 @@ static struct peer *peer_xfer_conn(struct peer *from_peer)
        }
        if (from_peer->status > Active) {
                if (bgp_getsockname(from_peer) < 0) {
-                       zlog_err(
+                       flog_err(
+                               LIB_ERR_SOCKET,
                                "%%bgp_getsockname() failed for %s from_peer %s fd %d (peer fd %d)",
+
                                (CHECK_FLAG(from_peer->sflags,
                                            PEER_STATUS_ACCEPT_PEER)
                                         ? "accept"
@@ -1144,7 +1149,7 @@ int bgp_stop(struct peer *peer)
        }
 
        /* Reset keepalive and holdtime */
-       if (PEER_OR_GROUP_TIMER_SET(peer)) {
+       if (CHECK_FLAG(peer->flags, PEER_FLAG_TIMER)) {
                peer->v_keepalive = peer->keepalive;
                peer->v_holdtime = peer->holdtime;
        } else {
@@ -1281,15 +1286,17 @@ static int bgp_connect_check(struct thread *thread)
 static int bgp_connect_success(struct peer *peer)
 {
        if (peer->fd < 0) {
-               zlog_err("bgp_connect_success peer's fd is negative value %d",
-                        peer->fd);
+               flog_err(BGP_ERR_CONNECT,
+                         "bgp_connect_success peer's fd is negative value %d",
+                         peer->fd);
                bgp_stop(peer);
                return -1;
        }
 
        if (bgp_getsockname(peer) < 0) {
-               zlog_err("%s: bgp_getsockname(): failed for peer %s, fd %d",
-                        __FUNCTION__, peer->host, peer->fd);
+               flog_err_sys(LIB_ERR_SOCKET,
+                            "%s: bgp_getsockname(): failed for peer %s, fd %d",
+                            __FUNCTION__, peer->host, peer->fd);
                bgp_notify_send(peer, BGP_NOTIFY_FSM_ERR,
                                0); /* internal error */
                bgp_writes_on(peer);
@@ -1347,10 +1354,10 @@ int bgp_start(struct peer *peer)
 
        if (BGP_PEER_START_SUPPRESSED(peer)) {
                if (bgp_debug_neighbor_events(peer))
-                       zlog_err(
-                               "%s [FSM] Trying to start suppressed peer"
-                               " - this is never supposed to happen!",
-                               peer->host);
+                       flog_err(BGP_ERR_FSM,
+                                 "%s [FSM] Trying to start suppressed peer"
+                                 " - this is never supposed to happen!",
+                                 peer->host);
                return -1;
        }
 
@@ -1382,7 +1389,8 @@ int bgp_start(struct peer *peer)
 
        if (peer->bgp->vrf_id == VRF_UNKNOWN) {
                if (bgp_debug_neighbor_events(peer))
-                       zlog_err(
+                       flog_err(
+                               BGP_ERR_FSM,
                                "%s [FSM] In a VRF that is not initialised yet",
                                peer->host);
                return -1;
@@ -1436,8 +1444,9 @@ int bgp_start(struct peer *peer)
                                "%s [FSM] Non blocking connect waiting result, fd %d",
                                peer->host, peer->fd);
                if (peer->fd < 0) {
-                       zlog_err("bgp_start peer's fd is negative value %d",
-                                peer->fd);
+                       flog_err(BGP_ERR_FSM,
+                                 "bgp_start peer's fd is negative value %d",
+                                 peer->fd);
                        return -1;
                }
                /*
@@ -1483,8 +1492,9 @@ static int bgp_fsm_open(struct peer *peer)
    peer and change to Idle status. */
 static int bgp_fsm_event_error(struct peer *peer)
 {
-       zlog_err("%s [FSM] unexpected packet received in state %s", peer->host,
-                lookup_msg(bgp_status_msg, peer->status, NULL));
+       flog_err(BGP_ERR_FSM,
+                 "%s [FSM] unexpected packet received in state %s", peer->host,
+                 lookup_msg(bgp_status_msg, peer->status, NULL));
 
        return bgp_stop_with_notify(peer, BGP_NOTIFY_FSM_ERR, 0);
 }
@@ -1516,7 +1526,7 @@ static int bgp_establish(struct peer *peer)
        other = peer->doppelganger;
        peer = peer_xfer_conn(peer);
        if (!peer) {
-               zlog_err("%%Neighbor failed in xfer_conn");
+               flog_err(BGP_ERR_CONNECT, "%%Neighbor failed in xfer_conn");
                return -1;
        }
 
@@ -1675,7 +1685,8 @@ static int bgp_fsm_update(struct peer *peer)
 /* This is empty event. */
 static int bgp_ignore(struct peer *peer)
 {
-       zlog_err(
+       flog_err(
+               BGP_ERR_FSM,
                "%s [FSM] Ignoring event %s in state %s, prior events %s, %s, fd %d",
                peer->host, bgp_event_str[peer->cur_event],
                lookup_msg(bgp_status_msg, peer->status, NULL),
@@ -1687,7 +1698,8 @@ static int bgp_ignore(struct peer *peer)
 /* This is to handle unexpected events.. */
 static int bgp_fsm_exeption(struct peer *peer)
 {
-       zlog_err(
+       flog_err(
+               BGP_ERR_FSM,
                "%s [FSM] Unexpected event %s in state %s, prior events %s, %s, fd %d",
                peer->host, bgp_event_str[peer->cur_event],
                lookup_msg(bgp_status_msg, peer->status, NULL),
@@ -1961,7 +1973,8 @@ int bgp_event_update(struct peer *peer, int event)
                 * code.
                 */
                if (!dyn_nbr && !passive_conn && peer->bgp) {
-                       zlog_err(
+                       flog_err(
+                               BGP_ERR_FSM,
                                "%s [FSM] Failure handling event %s in state %s, "
                                "prior events %s, %s, fd %d",
                                peer->host, bgp_event_str[peer->cur_event],