proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-13 19:39:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

bgpd: relax ORF capability length handling

Browse Source 
commit fe9bb64... "bgpd: CVE-2012-1820, DoS in bgp_capability_orf()"
made the length test in bgp_capability_orf_entry() stricter and is now
causing us to refuse (with CEASE) ORF capabilites carrying any excess
data.  This does not conform to the robustness principle as laid out by
RFC1122 ("be liberal in what you accept").

Even worse, RFC5291 is quite unclear on how to use the ORF capability
with multiple AFI/SAFIs.  It can be interpreted as either "use one
instance, stuff everything in" but also as "use multiple instances".
So, if not for applying robustness, we end up clearing sessions from
implementations going by the former interpretation.  (or if anyone dares
add a byte of padding...)

Cc: Denis Ovsienko <infrastation@yandex.ru>
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
This commit is contained in:
David Lamparter 2013-01-23 05:50:24 +01:00
parent f47e5a18b5
commit 5e728e9299
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bgpd/bgp_open.c
View File

@ -230,7 +230,7 @@ bgp_capability_orf_entry (struct peer *peer, struct capability_header *hdr)
}
/* validate number field */
if (sizeof (struct capability_orf_entry) + (entry.num * 2) != hdr->length)
if (sizeof (struct capability_orf_entry) + (entry.num * 2) > hdr->length)
{
zlog_info ("%s ORF Capability entry length error,"
" Cap length %u, num %u",