Commit Graph

33841 Commits

Author SHA1 Message Date
Donald Sharp
18e2590772
Merge pull request #16998 from FRRouting/mergify/bp/stable/9.1/pr-16934
*: Modify clang-format column limit to 100 (backport #16934)
2024-10-04 07:41:46 -04:00
Donald Sharp
c19fee3cdd *: Modify clang-format column limit to 100
A bunch of recent discussion has gone on about this.  Let's see
if we are actually interested in making a change.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
(cherry picked from commit bc915893a2)
2024-10-03 19:52:26 +00:00
Donatas Abraitis
a62d592c04
Merge pull request #16984 from FRRouting/mergify/bp/stable/9.1/pr-16977
bgpd: fix printfrr_bp for non initialized peers (backport #16977)
2024-10-03 09:28:16 +03:00
Louis Scalbert
ba77ea13b8 bgpd: fix printfrr_bp for non initialized peers
Fix printfrr_bp for non initialized peers. For example:

> Sep 26 17:56:44 r1 bgpd[26295]: [GJPH1-W8PZV] Resetting peer (null)(Unknown) due to change in addpath config

Is now:

> Oct 02 14:00:59 r1 bgpd[12795]: [MNE5N-K0G4Z] Resetting peer 2.2.2.2 due to change in addpath config

Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
(cherry picked from commit b56cfc6c80)
2024-10-02 15:59:42 +00:00
Donald Sharp
a3b1e324a9
Merge pull request #16921 from FRRouting/mergify/bp/stable/9.1/pr-16918
zebra snmp fixes (backport #16918)
2024-10-01 18:02:18 -04:00
Donald Sharp
934b41ead3
Merge pull request #16966 from FRRouting/mergify/bp/stable/9.1/pr-16738
lib: Attach stdout to child only if --log=stdout and stdout FD is a tty (backport #16738)
2024-10-01 17:52:38 -04:00
Vladislav Odintsov
b496e4b1df lib: Attach stdout to child only if --log=stdout and stdout FD is a tty
Prior to this commit stdout of a process started in a daemon mode was
attached to a calling process.
As a result a calling process hung for infinity.

Signed-off-by: Vladislav Odintsov <vlodintsov@k2.cloud>
(cherry picked from commit 0e3c5e8e59)
2024-10-01 07:49:43 +00:00
Donald Sharp
691a63368f zebra: Add missing proto translations
Add missing isis and eigrp proto translations.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
(cherry picked from commit f53dde0e59)
2024-09-25 18:51:42 +00:00
Donald Sharp
448b9b2a7e zebra: Correctly report metrics
Report the routes metric in IPFORWARDMETRIC1 and return
-1 for the other metrics as required by the IP-FORWARD-MIB.

inetCidrRouteMetric2 OBJECT-TYPE
    SYNTAX     Integer32
    MAX-ACCESS read-create
    STATUS     current
    DESCRIPTION
           "An alternate routing metric for this route.  The
            semantics of this metric are determined by the routing-
            protocol specified in the route's inetCidrRouteProto
            value.  If this metric is not used, its value should be
            set to -1."
    DEFVAL { -1 }
    ::= { inetCidrRouteEntry 13 }

I've included metric2 but it's the same for all of them.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
(cherry picked from commit e41ae0acc1)
2024-09-25 18:51:42 +00:00
Donald Sharp
9488f0cc4f zebra: Let's use memset instead of walking bytes and setting to 0
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
(cherry picked from commit 659cd66427)
2024-09-25 18:51:41 +00:00
Donald Sharp
a001733a3d zebra: Fix snmp walk of zebra rib
The snmp walk of the zebra rib was skipping entries
because in_addr_cmp was replaced with a prefix_cmp
which worked slightly differently causing parts
of the zebra rib tree to be skipped.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
(cherry picked from commit ecd9d441b0)
2024-09-25 18:51:40 +00:00
Donald Sharp
cd82888fe8
Merge pull request #16844 from FRRouting/mergify/bp/stable/9.1/pr-16809
isisd: fix rcap tlv double-free crash (backport #16809)
2024-09-17 13:42:16 -04:00
Louis Scalbert
8c4ad31259 tests: update isisd fuzz test
Since the previous commit, if a router capability subTLV is not
readable, the previously read subTLVs are kept.

Update of the ISIS fuzz test.

> $ wuschl rebuild tests/isisd/test_fuzz_isis_tlv
> $ gzip -9 tests/isisd/test_fuzz_isis_tlv_tests.h

> $ ./test_fuzz_isis_tlv 2>/dev/null | grep failed
> Test 139 failed, output differs.
> Test 150 failed, output differs.
> 2 of 405 tests failed.
>
> $ ./test_fuzz_isis_tlv 139 2>/dev/null
> Test 139 failed, output differs.
> Expected output:
> Unpack log:
> Unpacking 564 bytes of TLVs...
>   Unpacking TLV...
>     Found TLV of type 193 and len 13.
>     Skipping unknown TLV 193 (13 bytes)
>   Unpacking TLV...
>     Found TLV of type 0 and len 0.
>     Skipping unknown TLV 0 (0 bytes)
>   Unpacking TLV...
>     Found TLV of type 0 and len 0.
>     Skipping unknown TLV 0 (0 bytes)
>   Unpacking TLV...
>     Found TLV of type 242 and len 12.
>     Unpacking Router Capability TLV...
>     WARNING: Router Capability subTLV length too large compared to expected size
> Unpacked TLVs:
> Received output:
> Unpack log:
> Unpacking 564 bytes of TLVs...
>   Unpacking TLV...
>     Found TLV of type 193 and len 13.
>     Skipping unknown TLV 193 (13 bytes)
>   Unpacking TLV...
>     Found TLV of type 0 and len 0.
>     Skipping unknown TLV 0 (0 bytes)
>   Unpacking TLV...
>     Found TLV of type 0 and len 0.
>     Skipping unknown TLV 0 (0 bytes)
>   Unpacking TLV...
>     Found TLV of type 242 and len 12.
>     Unpacking Router Capability TLV...
>     WARNING: Router Capability subTLV length too large compared to expected size
> Unpacked TLVs:
> Router Capability: 253.212.128.242 , D:1, S:1
>
> $ ./test_fuzz_isis_tlv 150 2>/dev/null
> Test 150 failed, output differs.
> Expected output:
> Unpack log:
> Unpacking 403 bytes of TLVs...
>   Unpacking TLV...
>     Found TLV of type 129 and len 13.
>     Unpacking Protocols Supported TLV...
>       Protocols Supported: 73, 16, 255, 255, 255, 101, 10, 11, 11, 11, 11, 11, 11
>   Unpacking TLV...
>     Found TLV of type 11 and len 11.
>     Skipping unknown TLV 11 (11 bytes)
>   Unpacking TLV...
>     Found TLV of type 242 and len 12.
>     Unpacking Router Capability TLV...
>     WARNING: Router Capability subTLV length too large compared to expected size
> Unpacked TLVs:
> Protocols Supported: 73, 16, 255, 255, 255, 101, 10, 11, 11, 11, 11, 11, 11
> Received output:
> Unpack log:
> Unpacking 403 bytes of TLVs...
>   Unpacking TLV...
>     Found TLV of type 129 and len 13.
>     Unpacking Protocols Supported TLV...
>       Protocols Supported: 73, 16, 255, 255, 255, 101, 10, 11, 11, 11, 11, 11, 11
>   Unpacking TLV...
>     Found TLV of type 11 and len 11.
>     Skipping unknown TLV 11 (11 bytes)
>   Unpacking TLV...
>     Found TLV of type 242 and len 12.
>     Unpacking Router Capability TLV...
>     WARNING: Router Capability subTLV length too large compared to expected size
> Unpacked TLVs:
> Protocols Supported: 73, 16, 255, 255, 255, 101, 10, 11, 11, 11, 11, 11, 11
> Router Capability: 253.212.128.242 , D:1, S:1

Link: https://pypi.org/project/wuschl/
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
(cherry picked from commit cfd050a0e5)
2024-09-17 12:35:28 +00:00
Louis Scalbert
31d39e7221 isisd: fix rcap tlv double-free crash
A double-free crash happens when a subTLV of the "Router Capability"
TLV is not readable and a previous "Router Capability" TLV was read.

rcap was supposed to be freed later by isis_free_tlvs() ->
free_tlv_router_cap(). In 78774bbcd5 ("isisd: add isis flex-algo lsp
advertisement"), this was not the case because rcap was not saved to
tlvs->router_cap when the function returned early because of a subTLV
length issue.

Always set tlvs->router_cap to free the memory.

Note that this patch has the consequence that in case of subTLV error,
the previously read "Router Capability" subTLVs are kept in memory.

Fixes: 49efc80d34 ("isisd: Ensure rcap is freed in error case")
Fixes: 78774bbcd5 ("isisd: add isis flex-algo lsp advertisement")
Reported-by: Iggy Frankovic <iggyfran@amazon.com>
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
(cherry picked from commit d61758140d)
2024-09-17 12:35:28 +00:00
Donald Sharp
55aa5a3c3f
Merge pull request #16825 from FRRouting/mergify/bp/stable/9.1/pr-16818
ospfd: missing '[no]ip ospf graceful-restart hello-delay <N>' commands (backport #16818)
2024-09-13 19:52:17 -04:00
Dmitrii Turlupov
e4c7784a91 ospfd: fix missing '[no]ip ospf graceful-restart hello-delay <N>' commands
Signed-off-by: Dmitrii Turlupov <turlupov@bk.ru>
(cherry picked from commit 69e31a547f)
2024-09-13 19:32:39 +00:00
Jafar Al-Gharaibeh
3c89f63530
Merge pull request #16821 from FRRouting/mergify/bp/stable/9.1/pr-16808
nhrpd: fixes duplicate auth extension (backport #16808)
2024-09-13 14:11:33 -04:00
Denys Haryachyy
087943eff8 nhrpd: fixes duplicate auth extension
When an NHRP peer was forwarding a message, it was copying all
extensions from the originally received packet. The authentication
extension must be regenerated hop by hop per RFC2332.
This fix checks for the auth extension when copying extensions
and omits the original packet auth and instead regenerates a new auth extension.

Fix bug #16507

Signed-off-by: Denys Haryachyy <garyachy@gmail.com>
(cherry picked from commit 8e3c278bbc)
2024-09-13 14:52:35 +00:00
Donald Sharp
bc98e705fd
Merge pull request #16804 from opensourcerouting/fix/backport_ABUILD_APK_INDEX_OPTS_9.1
9.1 Backport docker ABUILD_APK_INDEX_OPTS
2024-09-12 08:22:32 -04:00
Donatas Abraitis
a421c98617 docker: Set ABUILD_APK_INDEX_OPTS for frr build
In build() stage of abuild, it does `apk index ...` where frr* packages
are unsigned. We don't sign them here, and thus we need to specify `--allow-untrusted`.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2024-09-12 09:51:45 +03:00
Donatas Abraitis
d51ff30b24 docker: Set ABUILD_APK_INDEX_OPTS for libyang
In build() stage of abuild, it does `apk index ...` where libyang* packages
are unsigned. We don't sign them here, and thus we need to specify `--allow-untrusted`.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2024-09-12 09:51:42 +03:00
Donatas Abraitis
ffbac03d72 FRR Release 9.1.2
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2024-09-11 11:32:53 +03:00
Jafar Al-Gharaibeh
c709528028
Merge pull request #16785 from FRRouting/mergify/bp/stable/9.1/pr-16718
isisd: fix crash when reading asla (backport #16718)
2024-09-11 00:01:30 -04:00
Louis Scalbert
8b0130aaf4 isisd: fix crash when reading asla
isisd is crashing when reading a ASLA sub-TLV with Application
Identifier Bit Mask length greater than 1 octet.

Set a limit of 8 bytes in accordance with RFC9479 and check that the
received value does not exceed the limit.

Reported-by: Iggy Frankovic <iggyfran@amazon.com>
Link: https://www.rfc-editor.org/rfc/rfc9479.html#name-application-identifier-bit-
Fixes: 5749ac83a8 ("isisd: add ASLA support")
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
(cherry picked from commit f1bc6c5d81)
2024-09-10 14:49:52 +00:00
Donatas Abraitis
76b0754c53
Merge pull request #16741 from FRRouting/mergify/bp/stable/9.1/pr-16724
isisd: Add missing `exit` statement to `show running-config` output (backport #16724)
2024-09-04 13:34:43 +03:00
Carmine Scarpitta
a473fe258b isisd: Add missing exit statement
Add missing `exit` statement to `show running-config` output.

```
router isis ISIS_CORE
 is-type level-2-only
 net 49.0001.0000.0000.0004.00
 lsp-mtu 1300
 topology ipv6-unicast
 log-adjacency-changes
 segment-routing srv6
  locator ISIS_LOC
 exit   <<<<<<<<<<<<<<<<<<<<<<<<
exit
```

Fixes https://github.com/FRRouting/frr/issues/16694

Signed-off-by: Carmine Scarpitta <cscarpit@cisco.com>
(cherry picked from commit 8be8864ffd)
2024-09-04 05:17:03 +00:00
Jafar Al-Gharaibeh
f4bb779875
Merge pull request #16730 from FRRouting/mergify/bp/stable/9.1/pr-16667
isisd: fix update link params after circuit is up (backport #16667)
2024-09-03 16:22:41 -04:00
Louis Scalbert
8fb29a38ae isisd: fix update link params after circuit is up
If the link-params are set when the circuit not yet up, the link-params
are never updated.

isis_link_params_update() is called from isis_circuit_up() but returns
immediately because circuit->state != C_STATE_UP. circuit->state is
updated in isis_csm_state_change after isis_circuit_up().

> struct isis_circuit *isis_csm_state_change(enum isis_circuit_event event,
> 					   struct isis_circuit *circuit,
> 					   void *arg)
> {
> [...]
> 			if (isis_circuit_up(circuit) != ISIS_OK) {
> 				isis_circuit_deconfigure(circuit, area);
> 				break;
> 			}
> 			circuit->state = C_STATE_UP;
> 			isis_event_circuit_state_change(circuit, circuit->area,
> 							1);

Do not return isis_link_params_update() if circuit->state != C_STATE_UP.

Fixes: 0fdd8b2b11 ("isisd: update link params after circuit is up")
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
(cherry picked from commit 6ce6b7a856)
2024-09-03 14:57:05 +00:00
Donatas Abraitis
ee98186b60
Merge pull request #16624 from FRRouting/mergify/bp/stable/9.1/pr-16546
bgpd: fix, do not access peer->notify.data when it is null (backport #16546)
2024-08-22 12:29:59 +03:00
Donatas Abraitis
b4400f9427
Merge pull request #16612 from louis-6wind/fix-no-rpki-9.1
bgpd: fix crash at no rpki (backport 9.1 and lower)
2024-08-22 08:21:59 +02:00
Dmytro Shytyi
53c671eb2b topotest: test_bgp_snmp_bgpv4v2_notification
This test checks the bgp crash on rt2 when 2 commands
launched consequently:
T0: rr, config -> router bgp 65004 -> neighbor 192.168.12.2 password 8888
T1: rt2, snmpwalk -v 2c -c public 127.0.0.1 .1.3.6.1.4.1.7336.4.2.1
T2: test if rt2 bgp is crashed.

Signed-off-by: Dmytro Shytyi <dmytro.shytyi@6wind.com>
(cherry picked from commit e23005f407)
2024-08-22 05:19:46 +00:00
Dmytro Shytyi
4bb4169b17 bgpd: fix, do not access peer->notify.data when it is null
bgp crash on rt2 spotted when 2 commands
launched consequently:
T0: rr, config -> router bgp 65004 -> neighbor 192.168.12.2 password
8888
T1: rt2, snmpwalk -v 2c -c public 127.0.0.1 .1.3.6.1.4.1.7336.4.2.1
T2: rt2 bgp is crashed.

config rt2-bgp:
---------------

!
debug bgp updates
!
router bgp 65002
 no bgp ebgp-requires-policy
 no bgp network import-check
 no bgp default ipv4-unicast
 neighbor 192.168.12.4 remote-as external
 neighbor 192.168.12.4 timers 1 3
 neighbor 192.168.12.4 timers connect 1
 neighbor 2001:db8::12:4 remote-as external
 neighbor 2001:db8::12:4 timers 1 3
 neighbor 2001:db8::12:4 timers connect 1
 !
 address-family ipv4 unicast
  neighbor 192.168.12.4 activate
  neighbor 192.168.12.4 addpath-tx-all-paths

 exit-address-family
 address-family ipv6 unicast
  neighbor 2001:db8::12:4 activate
 exit-address-family
!
agentx
!

config rt2-snmpd:
agentAddress 127.0.0.1,[::1]

group public_group v1 public
group public_group v2c public
access public_group "" any noauth prefix all all none

rocommunity public default

view all included .1

iquerySecName frr
rouser frr

master agentx

agentXSocket /etc/frr/agentx
agentXPerms 777 755 root frr

config rt2-zebra:
-----------------

!
interface r2-eth0
 ip address 192.168.12.2/24
 ipv6 address 2001:db8::12:2/64
!

config rr-bgpd:
---------------

!
debug bgp updates
!
router bgp 65004
 no bgp ebgp-requires-policy
 no bgp network import-check
 no bgp default ipv4-unicast
 neighbor 192.168.12.1 remote-as external
 neighbor 192.168.12.1 timers 1 3
 neighbor 192.168.12.1 timers connect 1
 neighbor 192.168.12.2 remote-as external
 neighbor 192.168.12.2 timers 1 3
 neighbor 192.168.12.2 timers connect 1
 neighbor 192.168.12.3 remote-as external
 neighbor 192.168.12.3 timers 1 3
 neighbor 192.168.12.3 timers connect 1
 neighbor 2001:db8::12:1 remote-as external
 neighbor 2001:db8::12:1 timers 1 3
 neighbor 2001:db8::12:1 timers connect 1
 neighbor 2001:db8::12:2 remote-as external
 neighbor 2001:db8::12:2 timers 1 3
 neighbor 2001:db8::12:2 timers connect 1
 neighbor 2001:db8::12:3 remote-as external
 neighbor 2001:db8::12:3 timers 1 3
 neighbor 2001:db8::12:3 timers connect 1
 !
 address-family ipv4 unicast
  neighbor 192.168.12.1 activate
  neighbor 192.168.12.1 addpath-tx-all-paths
  neighbor 192.168.12.1 route-server-client
  neighbor 192.168.12.2 activate
  neighbor 192.168.12.2 addpath-tx-all-paths
  neighbor 192.168.12.2 route-server-client
  neighbor 192.168.12.3 activate
  neighbor 192.168.12.3 addpath-tx-all-paths
  neighbor 192.168.12.3 route-server-client
 exit-address-family
 address-family ipv6 unicast
  neighbor 2001:db8::12:1 activate
  neighbor 2001:db8::12:1 route-server-client
  neighbor 2001:db8::12:2 activate
  neighbor 2001:db8::12:2 route-server-client
  neighbor 2001:db8::12:3 activate
  neighbor 2001:db8::12:3 route-server-client
 exit-address-family
!
agentx
!

config rr-zebra:
----------------
!
interface rr-eth0
 ip address 192.168.12.4/24
 ipv6 address 2001:db8::12:4/64
!

Fixes: 2d8fff6b81bb ("bgpd: Implement BGP4V2-MIB(bgp4V2PeerErrorsTable)")

Signed-off-by: Dmytro Shytyi <dmytro.shytyi@6wind.com>
(cherry picked from commit d534605545)
2024-08-22 05:19:46 +00:00
Louis Scalbert
c4e4e6c47a bgpd: fix crash at no rpki
When 'no rpki' is requested and the rtrlib RPKI object was freed, bgpd
is crashing.

RPKI is configured in VRF red.

> ip l set red down
> ip l del red
> printf 'conf\n vrf red\n no rpki' | vtysh

> Core was generated by `/usr/bin/bgpd -A 127.0.0.1 -M snmp -M rpki -M bmp'.
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  __pthread_kill_implementation (no_tid=0, signo=11, threadid=140411103615424) at ./nptl/pthread_kill.c:44
> 44	./nptl/pthread_kill.c: No such file or directory.
> [Current thread is 1 (Thread 0x7fb401f419c0 (LWP 190226))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11, threadid=140411103615424) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=140411103615424) at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=140411103615424, signo=signo@entry=11) at ./nptl/pthread_kill.c:89
> #3  0x00007fb4021ad476 in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007fb4025ce22b in core_handler (signo=11, siginfo=0x7fff831b2d70, context=0x7fff831b2c40) at lib/sigevent.c:248
> #5  <signal handler called>
> #6  rtr_mgr_remove_group (config=0x55fe8789f750, preference=11) at /build/make-pkg/output/source/DIST_RTRLIB/rtrlib/rtrlib/rtr_mgr.c:607
> #7  0x00007fb40145f518 in rpki_delete_all_cache_nodes (rpki_vrf=0x55fe8789f4f0) at bgpd/bgp_rpki.c:442
> #8  0x00007fb401463098 in no_rpki_magic (self=0x7fb40146bba0 <no_rpki_cmd>, vty=0x55fe877f5130, argc=2, argv=0x55fe877fccd0) at bgpd/bgp_rpki.c:1732
> #9  0x00007fb40145c09a in no_rpki (self=0x7fb40146bba0 <no_rpki_cmd>, vty=0x55fe877f5130, argc=2, argv=0x55fe877fccd0) at ./bgpd/bgp_rpki_clippy.c:37
> #10 0x00007fb402527abc in cmd_execute_command_real (vline=0x55fe877fd150, vty=0x55fe877f5130, cmd=0x0, up_level=0) at lib/command.c:984
> #11 0x00007fb402527c35 in cmd_execute_command (vline=0x55fe877fd150, vty=0x55fe877f5130, cmd=0x0, vtysh=0) at lib/command.c:1043
> #12 0x00007fb4025281e5 in cmd_execute (vty=0x55fe877f5130, cmd=0x55fe877fb8c0 "no rpki\n", matched=0x0, vtysh=0) at lib/command.c:1209
> #13 0x00007fb4025f0aed in vty_command (vty=0x55fe877f5130, buf=0x55fe877fb8c0 "no rpki\n") at lib/vty.c:615
> #14 0x00007fb4025f2a11 in vty_execute (vty=0x55fe877f5130) at lib/vty.c:1378
> #15 0x00007fb4025f513d in vtysh_read (thread=0x7fff831b5fa0) at lib/vty.c:2373
> #16 0x00007fb4025e9611 in event_call (thread=0x7fff831b5fa0) at lib/event.c:2011
> #17 0x00007fb402566976 in frr_run (master=0x55fe871a14a0) at lib/libfrr.c:1212
> #18 0x000055fe857829fa in main (argc=9, argv=0x7fff831b6218) at bgpd/bgp_main.c:549

Fixes: 8156765abe ("bgpd: Add `no rpki` command")
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
(cherry picked from commit 4e053d65f1)

There is also an issue when doing "rpki reset" and then "no rpki".

Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
2024-08-21 10:29:06 +02:00
Donald Sharp
00d1dbaede
Merge pull request #16562 from FRRouting/mergify/bp/stable/9.1/pr-16554
zebra: Ensure non-equal id's are not same nhg's (backport #16554)
2024-08-13 08:45:31 -04:00
Donald Sharp
b39cdb3ed4 zebra: Ensure non-equal id's are not same nhg's
The function zebra_nhg_hash_equal is only used
as a hash function for storage of NHG's and retrieval.
If you have say two nhg's:

31 (25/26)
32 (25/26)

This function would return them as being equal.  Which
of course leads to the problem when you attempt to
hash_release 32 but release 31 from the hash.  Then later
when you attempt to do hash comparisons 32 has actually
been freed leaving to use after free situations and shit
goes down hill fast.

This hash is only used as part of the hash comparison
function for nexthop group storage.  Since this is so
let's always return the 31/32 nhg's are not equal at all.

We possibly have a different problem where we are creating
31 and 32 ( when 31 should have just been used instead of 32 )
but we need to prevent any type of hash release problem at all.
This supercedes any other issue( that should be tracked down
on it's own ).  Since you can have use after free situation
that leads to a crash -vs- some possible nexthop group duplication
which is very minor in comparison.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
(cherry picked from commit 5a1b61aeba)
2024-08-12 19:00:58 +00:00
Donald Sharp
3f6b0281f0
Merge pull request #16504 from FRRouting/mergify/bp/stable/9.1/pr-16497
bgpd: Check the actual remaining stream length before taking TLV value (backport #16497)
2024-07-31 12:34:37 -04:00
Donatas Abraitis
21cd931a5f bgpd: Check the actual remaining stream length before taking TLV value
```
    0 0xb50b9f898028 in __sanitizer_print_stack_trace (/home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/.libs/bgpd+0x368028) (BuildId: 3292703ed7958b20076550c967f879db8dc27ca7)
    1 0xb50b9f7ed8e4 in fuzzer::PrintStackTrace() (/home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/.libs/bgpd+0x2bd8e4) (BuildId: 3292703ed7958b20076550c967f879db8dc27ca7)
    2 0xb50b9f7d4d9c in fuzzer::Fuzzer::CrashCallback() (/home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/.libs/bgpd+0x2a4d9c) (BuildId: 3292703ed7958b20076550c967f879db8dc27ca7)
    3 0xe0d12d7469cc  (linux-vdso.so.1+0x9cc) (BuildId: 1a77697e9d723fe22246cfd7641b140c427b7e11)
    4 0xe0d12c88f1fc in __pthread_kill_implementation nptl/pthread_kill.c:43:17
    5 0xe0d12c84a678 in gsignal signal/../sysdeps/posix/raise.c:26:13
    6 0xe0d12c83712c in abort stdlib/abort.c:79:7
    7 0xe0d12d214724 in _zlog_assert_failed /home/ubuntu/frr-public/frr_public_private-libfuzzer/lib/zlog.c:789:2
    8 0xe0d12d1285e4 in stream_get /home/ubuntu/frr-public/frr_public_private-libfuzzer/lib/stream.c:324:3
    9 0xb50b9f8e47c4 in bgp_attr_encap /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_attr.c:2758:3
    10 0xb50b9f8dcd38 in bgp_attr_parse /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_attr.c:3783:10
    11 0xb50b9faf74b4 in bgp_update_receive /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_packet.c:2383:20
    12 0xb50b9faf1dcc in bgp_process_packet /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_packet.c:4075:11
    13 0xb50b9f8c90d0 in LLVMFuzzerTestOneInput /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_main.c:582:3
```

Reported-by: Iggy Frankovic <iggyfran@amazon.com>
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit 0998b38e4d)
2024-07-31 12:17:41 +00:00
Jafar Al-Gharaibeh
cfcc247aa3
Merge pull request #16478 from FRRouting/mergify/bp/stable/9.1/pr-16472
pimd: Fix msdp setting of sa->rp (backport #16472)
2024-07-25 16:58:40 -04:00
Donald Sharp
2c1981776f pimd: Fix msdp setting of sa->rp
The code is clearly incorrect.  After consultation with
the original author this is the decided change.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
(cherry picked from commit c4b4c242ec)
2024-07-25 18:10:22 +00:00
Russ White
52b95312f3
Merge pull request #16445 from FRRouting/mergify/bp/stable/9.1/pr-16376
ospfd: fix internal ldp-sync state flags when feature is disabled (backport #16376)
2024-07-23 17:52:53 -04:00
Christian Breunig
430903f36a ospfd: fix internal ldp-sync state flags when feature is disabled
When enabling "mpls ldp-sync" under "router ospf" ospfd configures
SET_FLAG(ldp_sync_info->flags, LDP_SYNC_FLAG_IF_CONFIG) so internally knowing
that the ldp-sync feature is enabled. However the flag is not cleared when
turning of the feature using "nompls ldp-sync"!

https://github.com/FRRouting/frr/issues/16375

Signed-off-by: Christian Breunig <christian@breunig.cc>
(cherry picked from commit 5a70378a47)
2024-07-23 14:53:14 +00:00
Donald Sharp
4d7932ae5e
Merge pull request #16435 from FRRouting/mergify/bp/stable/9.1/pr-16309
pimd: fix crash on non-existent interface (backport #16309)
2024-07-23 10:44:42 -04:00
Louis Scalbert
b51fe77ac8 pimd: fix crash on non-existent interface
Fix the following crash when pim options are (un)configured on an
non-existent interface.

> r1(config)# int fgljdsf
> r1(config-if)# no ip pim unicast-bsm
> vtysh: error reading from pimd: Connection reset by peer (104)Warning: closing connection to pimd because of an I/O error!

> #0  raise (sig=<optimized out>) at ../sysdeps/unix/sysv/linux/raise.c:50
> #1  0x00007f70c8f32249 in core_handler (signo=11, siginfo=0x7fffff88e4f0, context=0x7fffff88e3c0) at lib/sigevent.c:258
> #2  <signal handler called>
> #3  0x0000556cfdd9b16d in lib_interface_pim_address_family_unicast_bsm_modify (args=0x7fffff88f130) at pimd/pim_nb_config.c:1910
> #4  0x00007f70c8efdcb5 in nb_callback_modify (context=0x556d00032b60, nb_node=0x556cffeeb9b0, event=NB_EV_APPLY, dnode=0x556d00031670, resource=0x556d00032b48, errmsg=0x7fffff88f710 "", errmsg_len=8192)
>     at lib/northbound.c:1538
> #5  0x00007f70c8efe949 in nb_callback_configuration (context=0x556d00032b60, event=NB_EV_APPLY, change=0x556d00032b10, errmsg=0x7fffff88f710 "", errmsg_len=8192) at lib/northbound.c:1888
> #6  0x00007f70c8efee82 in nb_transaction_process (event=NB_EV_APPLY, transaction=0x556d00032b60, errmsg=0x7fffff88f710 "", errmsg_len=8192) at lib/northbound.c:2016
> #7  0x00007f70c8efd658 in nb_candidate_commit_apply (transaction=0x556d00032b60, save_transaction=true, transaction_id=0x0, errmsg=0x7fffff88f710 "", errmsg_len=8192) at lib/northbound.c:1356
> #8  0x00007f70c8efd78e in nb_candidate_commit (context=..., candidate=0x556cffeb0e80, save_transaction=true, comment=0x0, transaction_id=0x0, errmsg=0x7fffff88f710 "", errmsg_len=8192) at lib/northbound.c:1389
> #9  0x00007f70c8f03e58 in nb_cli_classic_commit (vty=0x556d00025a80) at lib/northbound_cli.c:51
> #10 0x00007f70c8f043f8 in nb_cli_apply_changes_internal (vty=0x556d00025a80,
>     xpath_base=0x7fffff893bb0 "/frr-interface:lib/interface[name='fgljdsf']/frr-pim:pim/address-family[address-family='frr-routing:ipv4']", clear_pending=false) at lib/northbound_cli.c:178
> #11 0x00007f70c8f0475d in nb_cli_apply_changes (vty=0x556d00025a80, xpath_base_fmt=0x556cfdde9fe0 "./frr-pim:pim/address-family[address-family='%s']") at lib/northbound_cli.c:234
> #12 0x0000556cfdd8298f in pim_process_no_unicast_bsm_cmd (vty=0x556d00025a80) at pimd/pim_cmd_common.c:3493
> #13 0x0000556cfddcf782 in no_ip_pim_ucast_bsm (self=0x556cfde40b20 <no_ip_pim_ucast_bsm_cmd>, vty=0x556d00025a80, argc=4, argv=0x556d00031500) at pimd/pim_cmd.c:4950
> #14 0x00007f70c8e942f0 in cmd_execute_command_real (vline=0x556d00032070, vty=0x556d00025a80, cmd=0x0, up_level=0) at lib/command.c:1002
> #15 0x00007f70c8e94451 in cmd_execute_command (vline=0x556d00032070, vty=0x556d00025a80, cmd=0x0, vtysh=0) at lib/command.c:1061
> #16 0x00007f70c8e9499f in cmd_execute (vty=0x556d00025a80, cmd=0x556d00030320 "no ip pim unicast-bsm", matched=0x0, vtysh=0) at lib/command.c:1227
> #17 0x00007f70c8f51e44 in vty_command (vty=0x556d00025a80, buf=0x556d00030320 "no ip pim unicast-bsm") at lib/vty.c:616
> #18 0x00007f70c8f53bdd in vty_execute (vty=0x556d00025a80) at lib/vty.c:1379
> #19 0x00007f70c8f55d59 in vtysh_read (thread=0x7fffff896600) at lib/vty.c:2374
> #20 0x00007f70c8f4b209 in event_call (thread=0x7fffff896600) at lib/event.c:2011
> #21 0x00007f70c8ed109e in frr_run (master=0x556cffdb4ea0) at lib/libfrr.c:1217
> #22 0x0000556cfdddec12 in main (argc=2, argv=0x7fffff896828, envp=0x7fffff896840) at pimd/pim_main.c:165
> (gdb) f 3
> #3  0x0000556cfdd9b16d in lib_interface_pim_address_family_unicast_bsm_modify (args=0x7fffff88f130) at pimd/pim_nb_config.c:1910
> 1910			pim_ifp->ucast_bsm_accept =
> (gdb) list
> 1905		case NB_EV_ABORT:
> 1906			break;
> 1907		case NB_EV_APPLY:
> 1908			ifp = nb_running_get_entry(args->dnode, NULL, true);
> 1909			pim_ifp = ifp->info;
> 1910			pim_ifp->ucast_bsm_accept =
> 1911				yang_dnode_get_bool(args->dnode, NULL);
> 1912
> 1913			break;
> 1914		}
> (gdb) p pim_ifp
> $1 = (struct pim_interface *) 0x0

Fixes: 3bb513c399 ("lib: adapt to version 2 of libyang")
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
(cherry picked from commit 6952bea5cd)
2024-07-22 16:40:18 +00:00
Jafar Al-Gharaibeh
6b77433cd6
Merge pull request #16397 from FRRouting/mergify/bp/stable/9.1/pr-16365
isisd: fix crash when calculating the neighbor spanning tree based on the fragmented LSP (backport #16365)
2024-07-17 12:15:59 -04:00
zhou-run
5658142ebc isisd: fix crash when calculating the neighbor spanning tree based on the fragmented LSP
1. When the root IS regenerates an LSP, it calls lsp_build() -> lsp_clear_data() to free the TLV memory of the first fragment and all other fragments. If the number of fragments in the regenerated LSP decreases or if no fragmentation is needed, the extra LSP fragments are not immediately deleted. Instead, lsp_seqno_update() -> lsp_purge() is called to set the remaining time to zero and start aging, while also notifying other IS nodes to age these fragments. lsp_purge() usually does not reset lsp->hdr.seqno to zero because the LSP might recover during the aging process.
2. When other IS nodes receive an LSP, they always call process_lsp() -> isis_unpack_tlvs() to allocate TLV memory for the LSP. This does not differentiate whether the received LSP has a remaining lifetime of zero. Therefore, it is rare for an LSP of a non-root IS to have empty TLVs. Of course, if an LSP with a remaining time of zero and already corrupted is received, lsp_update() -> lsp_purge() will be called to free the TLV memory of the LSP, but this scenario is rare.
3. In LFA calculations, neighbors of the root IS are traversed, and each neighbor is taken as a new root to compute the neighbor SPT. During this process, the old root IS will serve as a neighbor of the new root IS, triggering a call to isis_spf_process_lsp() to parse the LSP of the old root IS and obtain its IP vertices and neighboring IS vertices. However, isis_spf_process_lsp() only checks whether the TLVs in the first fragment of the LSP exist, and does not check the TLVs in the fragmented LSP. If the TLV memory of the fragmented LSP of the old root IS has been freed, it can lead to a null pointer access, causing the current crash.

Additionally, for the base SPT, there are only two places where the LSP of the root IS is parsed:
1. When obtaining the UP neighbors of the root IS via spf_adj_list_parse_lsp().
2. When preloading the IP vertices of the root IS via isis_lsp_iterate_ip_reach().
Both of these checks ensure that frag->tlvs is not null, and they do not subsequently call isis_spf_process_lsp() to parse the root IS's LSP. It is very rare for non-root IS LSPs to have empty TLVs unless they are corrupted LSPs awaiting deletion. If it happens, a crash will occur.

The backtrace is as follows:
(gdb) bt
#0  0x00007f3097281fe1 in raise () from /lib/x86_64-linux-gnu/libpthread.so.0
#1  0x00007f30973a2972 in core_handler (signo=11, siginfo=0x7ffce66c2870, context=0x7ffce66c2740) at ../lib/sigevent.c:261
#2  <signal handler called>
#3  0x000055dfa805512b in isis_spf_process_lsp (spftree=0x55dfa950eee0, lsp=0x55dfa94cb590, cost=10, depth=1, root_sysid=0x55dfa950ef6c "", parent=0x55dfa952fca0)
    at ../isisd/isis_spf.c:898
#4  0x000055dfa805743b in isis_spf_loop (spftree=0x55dfa950eee0, root_sysid=0x55dfa950ef6c "") at ../isisd/isis_spf.c:1688
#5  0x000055dfa805784f in isis_run_spf (spftree=0x55dfa950eee0) at ../isisd/isis_spf.c:1808
#6  0x000055dfa8037ff5 in isis_spf_run_neighbors (spftree=0x55dfa9474440) at ../isisd/isis_lfa.c:1259
#7  0x000055dfa803ac17 in isis_spf_run_lfa (area=0x55dfa9477510, spftree=0x55dfa9474440) at ../isisd/isis_lfa.c:2300
#8  0x000055dfa8057964 in isis_run_spf_with_protection (area=0x55dfa9477510, spftree=0x55dfa9474440) at ../isisd/isis_spf.c:1827
#9  0x000055dfa8057c15 in isis_run_spf_cb (thread=0x7ffce66c38e0) at ../isisd/isis_spf.c:1889
#10 0x00007f30973bbf04 in thread_call (thread=0x7ffce66c38e0) at ../lib/thread.c:1990
#11 0x00007f309735497b in frr_run (master=0x55dfa91733c0) at ../lib/libfrr.c:1198
#12 0x000055dfa8029d5d in main (argc=5, argv=0x7ffce66c3b08, envp=0x7ffce66c3b38) at ../isisd/isis_main.c:273
(gdb) f 3
#3  0x000055dfa805512b in isis_spf_process_lsp (spftree=0x55dfa950eee0, lsp=0x55dfa94cb590, cost=10, depth=1, root_sysid=0x55dfa950ef6c "", parent=0x55dfa952fca0)
    at ../isisd/isis_spf.c:898
898     ../isisd/isis_spf.c: No such file or directory.
(gdb) p te_neighs
$1 = (struct isis_item_list *) 0x120
(gdb) p lsp->tlvs
$2 = (struct isis_tlvs *) 0x0
(gdb) p lsp->hdr
$3 = {pdu_len = 27, rem_lifetime = 0, lsp_id = "\000\000\000\000\000\001\000\001", seqno = 4, checksum = 59918, lsp_bits = 1 '\001'}

The backtrace provided above pertains to version 8.5.4, but it seems that the same issue exists in the code of the master branch as well.

I have reviewed the process for calculating the SPT based on the LSP, and isis_spf_process_lsp() is the only function that does not check whether the TLVs in the fragments are empty. Therefore, I believe that modifying this function alone should be sufficient. If the TLVs of the current fragment are already empty, we do not need to continue processing subsequent fragments. This is consistent with the behavior where we do not process fragments if the TLVs of the first fragment are empty.
Of course, one could argue that lsp_purge() should still retain the TLV memory, freeing it and then reallocating it if needed. However, this is a debatable point because in some scenarios, it is permissible for the LSP to have empty TLVs. For example, after receiving an SNP (Sequence Number PDU) message, an empty LSP (with lsp->hdr.seqno = 0) might be created by calling lsp_new. If the corresponding LSP message is discarded due to domain or area authentication failure, the TLV memory wouldn't be allocated.

Test scenario:
In an LFA network, importing a sufficient number of static routes to cause LSP fragmentation, and then rolling back the imported static routes so that the LSP is no longer fragmented, can easily result in this issue.

Signed-off-by: zhou-run <zhou.run@h3c.com>
(cherry picked from commit e905177a8c)
2024-07-16 14:08:00 +00:00
Mark Stapp
f412949f8b
Merge pull request #16389 from FRRouting/mergify/bp/stable/9.1/pr-16373
staticd: fix missing static routes (backport #16373)
2024-07-16 07:55:50 -04:00
anlan_cs
b8ecfc0e97 zebra: fix missing static routes
Use `vtysh` with this input file:
```
ip route A nh1
ip route A nh2
ip route B nh1
ip route B nh2
```

When running "ip route B" with "nh1" and "nh2", the procedure maybe is:
1) Create the two nexthops: "nh1" and "nh2".
2) Register "nh1" with `static_zebra_nht_register()`, then the states of both
   "nh1" and "nht2" are set to "STATIC_SENT_TO_ZEBRA".
3) Register "nh2" with `static_zebra_nht_register()`, then only the routes with
   nexthop of "STATIC_START" will be sent to zebra.

So, send the routes with the nexthop of "STATIC_SENT_TO_ZEBRA" to zebra.

Signed-off-by: anlan_cs <vic.lan@pica8.com>
(cherry picked from commit 4518d386f7)
2024-07-15 18:46:25 +00:00
Jafar Al-Gharaibeh
6e117e73ab
Merge pull request #16381 from FRRouting/mergify/bp/stable/9.1/pr-16350
zebra: Fix to avoid two Vrfs with same table ids (backport #16350)
2024-07-15 14:43:02 -04:00
Rajasekar Raja
95a5e7a7f3 zebra: Fix to avoid two Vrfs with same table ids
During internal testing, when the following sequence is followed, two
non default vrfs end up pointing to the same table-id

 - Initially vrf201 has table id 1002
 - ip link add dev vrf202 type vrf table 1002
 - ip link set dev vrf202 up
 - ip link set dev <intrerface> master vrf202

This will ideally lead to zebra exit since this is a misconfiguration as
expected.

However if we perform a restart frr.service at this point, we end up
having two vrfs pointing to same table-id and bad things can happen.
This is because in the interface_vrf_change, we incorrectly check for
vrf_lookup_by_id() to evaluate if there is a misconfig. This works well
for a non restart case but not for the startup case.

root@mlx-3700-20:mgmt:/var/log/frr# sudo vtysh -c "sh vrf"
vrf mgmt id 37 table 1001
vrf vrf201 id 46 table 1002
vrf vrf202 id 59 table 1002 >>>>

Fix: in all cases of misconfiguration, exit zebra as expected.

Ticket :#3970414

Signed-off-by: Donald Sharp <sharpd@nvidia.com>

Signed-off-by: Rajasekar Raja <rajasekarr@nvidia.com>
(cherry picked from commit c77e15710d)
2024-07-14 00:14:29 +00:00
Donald Sharp
badb6f1fce
Merge pull request #16337 from FRRouting/mergify/bp/stable/9.1/pr-16226
ldpd: fix wrong gtsm count (backport #16226)
2024-07-03 08:41:37 -04:00