proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-08 12:49:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

bgpd: Validate maximum length of software version when handling via dynamic caps

Browse Source 
We should not allow exceeding the stream's length, and also software version
can't be larger than 64 bytes.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
This commit is contained in:
Donatas Abraitis 2023-09-29 12:13:43 +03:00
parent 3518fe70cb
commit 5e8a8d0ed6
1 changed files with 36 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
bgpd/bgp_packet.c
View File

@ -3064,6 +3064,40 @@ static void bgp_dynamic_capability_graceful_restart(uint8_t *pnt, int action,
} }
} }
static void bgp_dynamic_capability_software_version(uint8_t *pnt, int action,
struct capability_header *hdr,
struct peer *peer)
{
uint8_t *data = pnt + 3;
uint8_t *end = data + hdr->length;
uint8_t len = *data;
char soft_version[BGP_MAX_SOFT_VERSION + 1] = {};
if (action == CAPABILITY_ACTION_SET) {
if (data + len > end) {
zlog_err("%pBP: Received invalid Software Version capability length %d",
peer, len);
return;
}
data++;
if (len > BGP_MAX_SOFT_VERSION)
len = BGP_MAX_SOFT_VERSION;
memcpy(&soft_version, data, len);
soft_version[len] = '\0';
XFREE(MTYPE_BGP_SOFT_VERSION, peer->soft_version);
peer->soft_version = XSTRDUP(MTYPE_BGP_SOFT_VERSION,
soft_version);
SET_FLAG(peer->cap, PEER_CAP_SOFT_VERSION_RCV);
} else {
UNSET_FLAG(peer->cap, PEER_CAP_SOFT_VERSION_RCV);
XFREE(MTYPE_BGP_SOFT_VERSION, peer->soft_version);
}
}
/** /**
* Parse BGP CAPABILITY message for peer. * Parse BGP CAPABILITY message for peer.
* *
@ -3082,7 +3116,6 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
afi_t afi; afi_t afi;
iana_safi_t pkt_safi; iana_safi_t pkt_safi;
safi_t safi; safi_t safi;
char soft_version[BGP_MAX_SOFT_VERSION + 1] = {};
const char *capability; const char *capability;
end = pnt + length; end = pnt + length;
@ -3129,22 +3162,8 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
switch (hdr->code) { switch (hdr->code) {
case CAPABILITY_CODE_SOFT_VERSION: case CAPABILITY_CODE_SOFT_VERSION:
if (action == CAPABILITY_ACTION_SET) { bgp_dynamic_capability_software_version(pnt, action,
SET_FLAG(peer->cap, PEER_CAP_SOFT_VERSION_RCV); hdr, peer);
memcpy(&soft_version, pnt + 3, hdr->length);
soft_version[hdr->length] = '\0';
XFREE(MTYPE_BGP_SOFT_VERSION,
peer->soft_version);
peer->soft_version =
XSTRDUP(MTYPE_BGP_SOFT_VERSION,
soft_version);
} else {
UNSET_FLAG(peer->cap, PEER_CAP_SOFT_VERSION_RCV);
XFREE(MTYPE_BGP_SOFT_VERSION,
peer->soft_version);
}
break; break;
case CAPABILITY_CODE_MP: case CAPABILITY_CODE_MP:
if (hdr->length < sizeof(struct capability_mp_data)) { if (hdr->length < sizeof(struct capability_mp_data)) {