Merge pull request #11626 from opensourcerouting/fix/avoid_buffer_overflow

zebra: Avoid buffer overflow using netlink_parse_rtattr_nested()

diff --git a/alpine/APKBUILD.in b/alpine/APKBUILD.in
index ccae9bfd0b50e556edf9ef705a8ac0494c5128ea..51986de2dd2af1a92c6e94c373ef43225b77994b 100644 (file)
--- a/alpine/APKBUILD.in
+++ b/alpine/APKBUILD.in
@@ -18,7 +18,7 @@ makedepends="ncurses-dev net-snmp-dev gawk texinfo perl
     ncurses-libs ncurses-terminfo ncurses-terminfo-base patch pax-utils pcre
     perl pkgconf python3 python3-dev readline readline-dev sqlite-libs
     squashfs-tools sudo tar texinfo xorriso xz-libs py-pip rtrlib rtrlib-dev
-    py3-sphinx elfutils elfutils-dev"
+    py3-sphinx elfutils elfutils-dev libyang-dev"
 checkdepends="pytest py-setuptools"
 install="$pkgname.pre-install $pkgname.pre-deinstall $pkgname.post-deinstall"
 subpackages="$pkgname-dev $pkgname-doc $pkgname-dbg"

diff --git a/bgpd/bgp_bmp.c b/bgpd/bgp_bmp.c
index ef985e08b241a197d94fcc1e1aaad9dd47072bfb..e7b936233e5379f7bbbcd3442dfe62476da86fbc 100644 (file)
--- a/bgpd/bgp_bmp.c
+++ b/bgpd/bgp_bmp.c
@@ -168,6 +168,16 @@ static int bmp_qhash_cmp(const struct bmp_queue_entry *a,
        else if (b->afi == AFI_L2VPN && b->safi == SAFI_EVPN)
                return -1;
 
+       if (a->afi == b->afi && a->safi == SAFI_MPLS_VPN &&
+           b->safi == SAFI_MPLS_VPN) {
+               ret = prefix_cmp(&a->rd, &b->rd);
+               if (ret)
+                       return ret;
+       } else if (a->safi == SAFI_MPLS_VPN)
+               return 1;
+       else if (b->safi == SAFI_MPLS_VPN)
+               return -1;
+
        ret = prefix_cmp(&a->p, &b->p);
        if (ret)
                return ret;
@@ -186,7 +196,8 @@ static uint32_t bmp_qhash_hkey(const struct bmp_queue_entry *e)
                    offsetof(struct bmp_queue_entry, refcount)
                            - offsetof(struct bmp_queue_entry, peerid),
                    key);
-       if (e->afi == AFI_L2VPN && e->safi == SAFI_EVPN)
+       if ((e->afi == AFI_L2VPN && e->safi == SAFI_EVPN) ||
+           (e->safi == SAFI_MPLS_VPN))
                key = jhash(&e->rd,
                            offsetof(struct bmp_queue_entry, rd)
                                    - offsetof(struct bmp_queue_entry, refcount)
@@ -985,7 +996,8 @@ afibreak:
        struct bgp_path_info *bpi = NULL, *bpiter;
        struct bgp_adj_in *adjin = NULL, *adjiter;
 
-       if (afi == AFI_L2VPN && safi == SAFI_EVPN) {
+       if ((afi == AFI_L2VPN && safi == SAFI_EVPN) ||
+           (safi == SAFI_MPLS_VPN)) {
                /* initialize syncrdpos to the first
                 * mid-layer table entry
                 */
@@ -1014,7 +1026,8 @@ afibreak:
                if (!bn) {
                        bn = bgp_table_get_next(table, &bmp->syncpos);
                        if (!bn) {
-                               if (afi == AFI_L2VPN && safi == SAFI_EVPN) {
+                               if ((afi == AFI_L2VPN && safi == SAFI_EVPN) ||
+                                   (safi == SAFI_MPLS_VPN)) {
                                        /* reset bottom-layer pointer */
                                        memset(&bmp->syncpos, 0,
                                               sizeof(bmp->syncpos));
@@ -1096,7 +1109,8 @@ afibreak:
 
        const struct prefix *bn_p = bgp_dest_get_prefix(bn);
        struct prefix_rd *prd = NULL;
-       if (afi == AFI_L2VPN && safi == SAFI_EVPN)
+       if (((afi == AFI_L2VPN) && (safi == SAFI_EVPN)) ||
+           (safi == SAFI_MPLS_VPN))
                prd = (struct prefix_rd *)bgp_dest_get_prefix(bmp->syncrdpos);
 
        if (bpi)
@@ -1168,7 +1182,8 @@ static bool bmp_wrqueue(struct bmp *bmp, struct pullwr *pullwr)
 
        bn = bgp_node_lookup(bmp->targets->bgp->rib[afi][safi], &bqe->p);
        struct prefix_rd *prd = NULL;
-       if (bqe->afi == AFI_L2VPN && bqe->safi == SAFI_EVPN)
+       if ((bqe->afi == AFI_L2VPN && bqe->safi == SAFI_EVPN) ||
+           (bqe->safi == SAFI_MPLS_VPN))
                prd = &bqe->rd;
 
        if (bmp->targets->afimon[afi][safi] & BMP_MON_POSTPOLICY) {
@@ -1256,7 +1271,8 @@ static void bmp_process_one(struct bmp_targets *bt, struct bgp *bgp, afi_t afi,
        bqeref.afi = afi;
        bqeref.safi = safi;
 
-       if (afi == AFI_L2VPN && safi == SAFI_EVPN && bn->pdest)
+       if ((afi == AFI_L2VPN && safi == SAFI_EVPN && bn->pdest) ||
+           (safi == SAFI_MPLS_VPN))
                prefix_copy(&bqeref.rd,
                            (struct prefix_rd *)bgp_dest_get_prefix(bn->pdest));
 
@@ -2195,12 +2211,12 @@ DEFPY(bmp_stats_cfg,
 
 DEFPY(bmp_monitor_cfg,
       bmp_monitor_cmd,
-      "[no] bmp monitor <ipv4|ipv6|l2vpn> <unicast|multicast|evpn> <pre-policy|post-policy>$policy",
+      "[no] bmp monitor <ipv4|ipv6|l2vpn> <unicast|multicast|evpn|vpn> <pre-policy|post-policy>$policy",
       NO_STR
       BMP_STR
       "Send BMP route monitoring messages\n"
       "Address Family\nAddress Family\nAddress Family\n"
-      "Address Family\nAddress Family\nAddress Family\n"
+      "Address Family\nAddress Family\nAddress Family\nAddress Family\n"
       "Send state before policy and filter processing\n"
       "Send state with policy and filters applied\n")
 {

diff --git a/doc/user/bmp.rst b/doc/user/bmp.rst
index 764584f89ce532d4a02c52104802aa3e2e1885c5..1983995c1fdb8d85c2cc26b3747648af64e4736e 100644 (file)
--- a/doc/user/bmp.rst
+++ b/doc/user/bmp.rst
@@ -149,8 +149,9 @@ associated with a particular ``bmp targets``:
 .. clicmd:: bmp monitor AFI SAFI <pre-policy|post-policy>
 
    Perform Route Monitoring for the specified AFI and SAFI.  Only IPv4 and
-   IPv6 are currently valid for AFI, and only unicast and multicast are valid
-   for SAFI.  Other AFI/SAFI combinations may be added in the future.
+   IPv6 are currently valid for AFI. SAFI valid values are currently 
+   unicast, multicast, evpn and vpn.
+   Other AFI/SAFI combinations may be added in the future.
 
    All BGP neighbors are included in Route Monitoring.  Options to select
    a subset of BGP sessions may be added in the future.

diff --git a/docker/alpine/Dockerfile b/docker/alpine/Dockerfile
index fa4b9859b91a7ca743303674f307d777aa2732e7..187b5285244695f0d35250293d3784ecee6ebe7f 100644 (file)
--- a/docker/alpine/Dockerfile
+++ b/docker/alpine/Dockerfile
@@ -15,11 +15,12 @@ RUN adduser -D -G abuild builder && su builder -c 'abuild-keygen -a -n'
 # This stage builds a libyang APK from source
 FROM alpine-builder as libyang-builder
 RUN mkdir -p /libyang && chown -R builder /pkgs /libyang
-COPY docker/alpine/libyang/ /libyang
-USER builder
-RUN cd /libyang \
-       && abuild checksum \
-       && abuild -r -P /pkgs/apk
+# -- Not currently needed - libyang currently available in Alpine upstream
+# COPY docker/alpine/libyang/ /libyang
+# USER builder
+# RUN cd /libyang \
+#      && abuild checksum \
+#      && abuild -r -P /pkgs/apk
 
 # This stage builds a dist tarball from the source
 FROM alpine:3.15 as source-builder
@@ -37,10 +38,11 @@ RUN source /src/alpine/APKBUILD.in \
        && pip install pytest
 
 RUN mkdir -p /pkgs/apk
-COPY --from=libyang-builder /pkgs/apk/ /pkgs/apk/
-RUN apk add \
-               --no-cache \
-               --allow-untrusted /pkgs/apk/*/*.apk
+# -- Not needed while libyang is not built
+# COPY --from=libyang-builder /pkgs/apk/ /pkgs/apk/
+# RUN apk add \
+#              --no-cache \
+#              --allow-untrusted /pkgs/apk/*/*.apk \
 
 COPY . /src
 ARG PKGVER
@@ -53,12 +55,13 @@ RUN cd /src \
 
 # This stage builds an APK from the dist tarball
 FROM alpine-builder as frr-apk-builder
-COPY --from=libyang-builder /pkgs/apk/ /pkgs/apk/
+# -- Not needed while libyang is not built
+# COPY --from=libyang-builder /pkgs/apk/ /pkgs/apk/
+# RUN apk add \
+#              --no-cache \
+#              --allow-untrusted /pkgs/apk/*/*.apk
 COPY --from=source-builder /src/frr-*.tar.gz /src/alpine/* /dist/
 RUN find /pkgs/apk -type f -name APKINDEX.tar.gz -delete
-RUN apk add \
-               --no-cache \
-               --allow-untrusted /pkgs/apk/*/*.apk
 RUN chown -R builder /dist /pkgs
 USER builder
 RUN cd /dist \

diff --git a/docker/alpine/libyang/APKBUILD b/docker/alpine/libyang/APKBUILD
index 9fa20bf4d1badc3a1b57e6b42a82c6d03a7b6a1b..aa792e7f0b91fde3da01029f095e4f9e11c8c5c3 100755 (executable)
--- a/docker/alpine/libyang/APKBUILD
+++ b/docker/alpine/libyang/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Sören Tempel <soeren+alpine@soeren-tempel.net>
 # Maintainer: Christian Franke <nobody@nowhere.ws>
 pkgname=libyang
-pkgver=2.0.7
+pkgver=2.0.194
 pkgrel=0
 pkgdesc="YANG data modelling language parser and toolkit"
 url="https://github.com/CESNET/libyang"
@@ -10,9 +10,7 @@ license="BSD-3-Clause-Clear"
 makedepends="bison cmake cmocka-dev flex pcre2-dev"
 checkdepends="expect grep shunit2"
 subpackages="$pkgname-dev $pkgname-doc"
-source="$pkgname-$pkgver.tar.gz::https://github.com/CESNET/libyang/archive/v$pkgver.tar.gz
-       10-remove-non-standard-headers.patch
-       11-utest-dont-parse-dlerror.patch"
+source="$pkgname-$pkgver.tar.gz::https://github.com/CESNET/libyang/archive/v$pkgver.tar.gz"
 
 # secfixes:
 #   1.0.215-r1:
@@ -40,7 +38,3 @@ build() {
 package() {
        make -C build DESTDIR="$pkgdir" install
 }
-
-sha512sums="edb1d8d372b25ed820fa312e0dc96d4af7c8cd5ddeb785964de73f64774062ea7a5586bb27e2039ad24189d4a2ba04268921ca86e82423fc48647d1d10a2a0a7  libyang-2.0.7.tar.gz
-385008c715e6b0dc9e8f33c9cb550b3af7ee16f056f35d09a4ba01b9e00ddb88940915f93fc608fedd30b4f9a6a1503df414ae0be64b1263681b0ee18e6f4db8  10-remove-non-standard-headers.patch
-b16881d301a6aec68fbe6bfb7ba53a8fcdb4b9eead3b03573e0e2a4a8c3c3d6962db623be14d29c023b5a7ad0f685da1f6033dd9985f7a2914ad2f4da07e60cb  11-utest-dont-parse-dlerror.patch"

diff --git a/ldpd/adjacency.c b/ldpd/adjacency.c
index bbc8a277a624d3434a163ae9189d6ccffcbb0956..7eb5663492437cb21569d94f10fe334cef7c4dfe 100644 (file)
--- a/ldpd/adjacency.c
+++ b/ldpd/adjacency.c
@@ -386,7 +386,9 @@ adj_to_ctl(struct adj *adj)
        }
        actl.holdtime = adj->holdtime;
        actl.holdtime_remaining =
-           thread_timer_remain_second(adj->inactivity_timer);
+               thread_is_scheduled(adj->inactivity_timer)
+                       ? thread_timer_remain_second(adj->inactivity_timer)
+                       : 0;
        actl.trans_addr = adj->trans_addr;
        actl.ds_tlv = adj->ds_tlv;
 

diff --git a/lib/filter_nb.c b/lib/filter_nb.c
index 35b97a9bde8993539083544f22a46f1b4d14ecbd..3ed1f3e03e96dc6737150d4799d6114e3e5e9a88 100644 (file)
--- a/lib/filter_nb.c
+++ b/lib/filter_nb.c
@@ -428,7 +428,7 @@ static void plist_dnode_to_prefix(const struct lyd_node *dnode, bool *any,
 static int _plist_is_dup(const struct lyd_node *dnode, void *arg)
 {
        struct plist_dup_args *pda = arg;
-       struct prefix p;
+       struct prefix p = {};
        int ge, le;
        bool any;
 

diff --git a/pimd/pim_zebra.h b/pimd/pim_zebra.h
index 5879cdefb09784f4ec3793e4e39477e42aa928ab..6710f19995f2a9b8dfe80d2553d458aa06142222 100644 (file)
--- a/pimd/pim_zebra.h
+++ b/pimd/pim_zebra.h
@@ -28,7 +28,6 @@
 void pim_zebra_init(void);
 void pim_zebra_zclient_update(struct vty *vty);
 
-void pim_scan_individual_oil(struct channel_oil *c_oil, int in_vif_index);
 void pim_scan_oil(struct pim_instance *pim_matcher);
 
 void pim_forward_start(struct pim_ifchannel *ch);

diff --git a/zebra/zebra_nhg.c b/zebra/zebra_nhg.c
index 8a255981b77d4a70e23ee064ffd8ffe61d23f07e..f846164834423bb6f0ae1862efe694515b668192 100644 (file)
--- a/zebra/zebra_nhg.c
+++ b/zebra/zebra_nhg.c
@@ -1611,6 +1611,8 @@ void zebra_nhg_free(struct nhg_hash_entry *nhe)
                                   nhe->nhg.nexthop);
        }
 
+       THREAD_OFF(nhe->timer);
+
        if (nhe->refcnt)
                zlog_debug("nhe_id=%pNG hash refcnt=%d", nhe, nhe->refcnt);
 

diff --git a/zebra/zebra_vty.c b/zebra/zebra_vty.c
index e6038d0bc277a39d4d82b164ff3e7406ae36bc8e..525e0366e78263381b31abe98bfd8d5f63665e43 100644 (file)
--- a/zebra/zebra_vty.c
+++ b/zebra/zebra_vty.c
@@ -4033,6 +4033,7 @@ DEFUN (show_zebra,
        vty_out(vty, "%s\n", out);
        XFREE(MTYPE_TMP, out);
 
+       ttable_del(table);
        vty_out(vty,
                "                            Route      Route      Neighbor   LSP        LSP\n");
        vty_out(vty,