Commit Graph

33730 Commits

Author SHA1 Message Date
Louis Scalbert
016eb0cc62 zebra: fix crash if macvlan link in another netns
A macvlan interface can have its underlying link-interface in another
namespace (aka. netns). However, by default, zebra does not know the
interface from the other namespaces. It results in a crash the pointer
to the link interface is NULL.

> 6  0x0000559d77a329d3 in zebra_vxlan_macvlan_up (ifp=0x559d798b8e00) at /root/frr/zebra/zebra_vxlan.c:4676
> 4676		link_zif = link_ifp->info;
> (gdb) list
> 4671		struct interface *link_ifp, *link_if;
> 4672
> 4673		zif = ifp->info;
> 4674		assert(zif);
> 4675		link_ifp = zif->link;
> 4676		link_zif = link_ifp->info;
> 4677		assert(link_zif);
> 4678
> (gdb) p zif->link
> $2 = (struct interface *) 0x0
> (gdb) p zif->link_ifindex
> $3 = 15

Fix the crash by returning when the macvlan link-interface is in another
namespace. No need to go further because any vxlan under the macvlan
interface would not be accessible by zebra.

Link: https://github.com/FRRouting/frr/issues/15370
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
(cherry picked from commit 44e6e3868d)
2024-02-27 16:32:40 +00:00
Russ White
4c16604013
Merge pull request #15416 from opensourcerouting/fix/backport_ee1c3c5518b1fb5b3989b80f8bd71ad2c2bc049a
lib: Do not convert EVPN prefixes into IPv4/IPv6 if not needed
2024-02-27 10:43:57 -05:00
Olivier Dugeon
9bc0060487 ospfd: Solved crash in OSPF TE parsing
Iggy Frankovic discovered an ospfd crash when perfomring fuzzing of OSPF LSA
packets. The crash occurs in ospf_te_parse_te() function when attemping to
create corresponding egde from TE Link parameters. If there is no local
address, an edge is created but without any attributes. During parsing, the
function try to access to this attribute fields which has not been created
causing an ospfd crash.

The patch simply check if the te parser has found a valid local address. If not
found, we stop the parser which avoid the crash.

Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>
(cherry picked from commit a73e66d073)
2024-02-27 15:42:49 +00:00
Donatas Abraitis
8b02d3efe1
Merge pull request #15436 from FRRouting/mergify/bp/stable/9.1/pr-15387
bgpd: fix no bgp as-path access-list issue  (backport #15387)
2024-02-27 13:36:18 +02:00
Francois Dumontet
1d224e5a4c bgpd: fix no bgp as-path access-list issue
router bgp 65001
 no bgp ebgp-requires-policy
 neighbor 192.168.1.2 remote-as external
 neighbor 192.168.1.2 timers 3 10
 address-family ipv4 unicast
  neighbor 192.168.1.2 route-map r2 in
 exit-address-family
!
ip prefix-list p1 seq 5 permit 172.16.255.31/32
!
route-map r2 permit 10
 match ip address prefix-list p1
 set as-path exclude 65003
route-map r2 permit 20
 set as-path exclude all
!

we make the following commands

bgp as-path access-list FIRST permit ^65
bgp as-path access-list SECOND permit 2
 route-map r2 permit 6
  set as-path exclude as-path-access-list SECOND

and then

no bgp as-path access-list SECOND permit 2
clear bgp *

we have the following crash in bgp

               Stack trace of thread 536083:
                #0  0x00007f87f8aacfe1 raise (libpthread.so.0 + 0x12fe1)
                #1  0x00007f87f8cf6870 core_handler (libfrr.so.0 +
		    0xf6870)
                #2  0x00007f87f8aad140 __restore_rt (libpthread.so.0 +
		    0x13140)
                #3  0x00007f87f89a5122 __GI___regexec (libc.so.6 +
		    0xdf122)
                #4  0x000055d7f198b4a7 aspath_filter_exclude_acl (bgpd +
		    0x2054a7)
                #5  0x000055d7f1902187 route_set_aspath_exclude (bgpd +
		    0x17c187)
                #6  0x00007f87f8ce54b0 route_map_apply_ext (libfrr.so.0
		    + 0xe54b0)
                #7  0x000055d7f18da925 bgp_input_modifier (bgpd +
		    0x154925)
                #8  0x000055d7f18e0647 bgp_update (bgpd + 0x15a647)
                #9  0x000055d7f18e4772 bgp_nlri_parse_ip (bgpd +
		    0x15e772)
                #10 0x000055d7f18c38ae bgp_nlri_parse (bgpd + 0x13d8ae)
                #11 0x000055d7f18c6b7a bgp_update_receive (bgpd +
		    0x140b7a)
                #12 0x000055d7f18c8ff3 bgp_process_packet (bgpd +
		    0x142ff3)
                #13 0x00007f87f8d0dce0 thread_call (libfrr.so.0 +
		    0x10dce0)
                #14 0x00007f87f8cacb28 frr_run (libfrr.so.0 + 0xacb28)
                #15 0x000055d7f18435da main (bgpd + 0xbd5da)
                #16 0x00007f87f88e9d0a __libc_start_main (libc.so.6 +
		    0x23d0a)
                #17 0x000055d7f18415fa _start (bgpd + 0xbb5fa)

analysis

crash is due to the fact that there were always a pointer from
as-path exclude to deleted as-path access list.

fix
we add a backpointer mechanism to manage the dependency beetween
as-path access-list  and aspath exclude.

Signed-off-by: Francois Dumontet <francois.dumontet@6wind.com>
(cherry picked from commit 100ef15262)
2024-02-27 07:53:30 +00:00
Francois Dumontet
f00d489ec4 tests: extend tests for aspath exclude
adding a tests about:
"no bgp as-path access-list" command.

the folloxing "clear bgp *" command leads to the
crash exhibited above.

a sleep had been added to capture the crash befor the end of scenario.

50	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
[Current thread is 1 (Thread 0x7f5f05cbb9c0 (LWP 1371086))]
(gdb) bt
    context=0x7ffcf2c216c0) at lib/sigevent.c:248
    acl_list=0x55c976ec03c0) at bgpd/bgp_aspath.c:1688
    dummy=0x7ffcf2c22340, object=0x7ffcf2c21e70) at bgpd/bgp_routemap.c:2401
    match_object=0x7ffcf2c21e70, set_object=0x7ffcf2c21e70, pref=0x0)
    at lib/routemap.c:2687
    attr=0x7ffcf2c220b0, afi=AFI_IP, safi=SAFI_UNICAST, rmap_name=0x0, label=0x0,
    num_labels=0, dest=0x55c976ebeaf0) at bgpd/bgp_route.c:1807
    addpath_id=0, attr=0x7ffcf2c22450, afi=AFI_IP, safi=SAFI_UNICAST, type=10,
    sub_type=0, prd=0x0, label=0x0, num_labels=0, soft_reconfig=0, evpn=0x0)
    at bgpd/bgp_route.c:4424
    packet=0x7ffcf2c22410) at bgpd/bgp_route.c:6266
    packet=0x7ffcf2c22410, mp_withdraw=false) at bgpd/bgp_packet.c:341
    peer=0x55c976e89ed0, size=43) at bgpd/bgp_packet.c:2414
    at bgpd/bgp_packet.c:3899

Signed-off-by: Francois Dumontet <francois.dumontet@6wind.com>
(cherry picked from commit 324fa21015)
2024-02-27 07:53:29 +00:00
Donatas Abraitis
80c85dedb9 lib: Do not convert EVPN prefixes into IPv4/IPv6 if not needed
Convert only when this is really needed, e.g. `match ip address prefix-list ...`.

Otherwise, we can't have mixed match clauses, like:

```
match ip address prefix-list p1
match evpn route-type prefix
```

This won't work, because the prefix is already converted, and we can't extract
route type, vni, etc. from the original EVPN prefix.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit 439b739495)
2024-02-23 09:34:05 +02:00
Donatas Abraitis
ac6a3bfc78
Merge pull request #15345 from FRRouting/mergify/bp/stable/9.1/pr-15327
pimd: re-evaluated S,G OILs upon RP changes and empty SG upstream oils (backport #15327)
2024-02-10 16:55:35 +02:00
Donatas Abraitis
fde18a006f
Merge pull request #15350 from FRRouting/mergify/bp/stable/9.1/pr-15316
nhrp: fix race condition in  null lladdr from zebra (backport #15316)
2024-02-10 16:55:21 +02:00
Lou Berger
d2630a74ed nhrp: fix race condition
where null lladdr recieved from zebra before nhrp next hop
	is installed.

Signed-off-by: Lou Berger <lberger@labn.net>
(cherry picked from commit 5d9ebe6181)
2024-02-09 15:58:16 +00:00
Rajesh Varatharaj
22aef4344e pimd: re-evaluated S,G OILs upon RP changes and for empty SG upstream oils
Topology:

TOR11 (FHR) --- LEAF-11---SPINE1 (RP)MSDP SPINE-2(RP)MSDP --- LEAF-12 -- TOR12 (LHR)
        |         |                    |				|       |
	|         -----------------------------------------------------(ECMP)   |
	|         |		                                |               |
	 -----------------------------------------------------------------------(ECMP)
Issue:
In some triggers, S,G upstream is preserved even with the PP timer expiry, resulting
in S,G with NULL OILS. This could be because we create a dummy S,G upstream and
dummy channel_oif for *,G, where RPF is UNKNOWN. As a result, PIM+VXLAN traffic is never
forwarded downstream to LHR.

Fix:
when the S,G stream is running, Determine if a reevaluation of the outgoing interface
 list (OIL) is required. S,G upstream should then inherit the OIL from *,G.

Testing:
- Evpn pim tests - TestEvpnPimSingleVtepOneMdt.test_02_broadcast_traffic_spt_zero
- pim-smoke

Ticket: #
Signed-off-by: Rajesh Varatharaj <rvaratharaj@nvidia.com>
(cherry picked from commit 071d43a052)
2024-02-09 15:17:03 +00:00
Donald Sharp
9aa5c6c781
Merge pull request #15340 from FRRouting/mergify/bp/stable/9.1/pr-15336
ospfd: add support for "no router-info [<area|as>] command" (backport #15336)
2024-02-09 09:53:45 -05:00
Donald Sharp
424b1d36cf
Merge pull request #15337 from FRRouting/mergify/bp/stable/9.1/pr-15333
ospfd: can not delete "segment-routing node-msd" when SR if off (backport #15333)
2024-02-09 09:52:57 -05:00
Christian Breunig
f490d6f318 ospfd: add support for "no router-info [<area|as>] command"
frr-reload.py will walk through all config contexts and prepend no to the CLI
command. This requires that the vtysh shell code accepts a full command.

To Reproduce

vtysh -c "conf t" -c "router ospf" -c "router-info area"
vtysh -c "conf t" -c "router ospf" -c "no router-info area"
% Unknown command: no router-info area
vtysh -c "conf t" -c "router ospf" -c "no router-info"

Signed-off-by: Christian Breunig <christian@breunig.cc>
(cherry picked from commit e744db5098)
2024-02-09 11:48:34 +00:00
Christian Breunig
e8eabb8d22 ospfd: can not delete "segment-routing node-msd" when SR if off
This fixes the initial implementation of commit 7743f2f8c0 ("OSPFd: Update
Segment Routing PR following review") where it wsa not possible to remove
the "segment-routing node-msd" CLI nodes via vtysh once segment-routing got
disabled.

Closes #14910

Signed-off-by: Christian Breunig <christian@breunig.cc>
(cherry picked from commit ba45aa62e7)
2024-02-09 10:35:45 +00:00
Donatas Abraitis
b61bd36e77
Merge pull request #15334 from c-po/stable-9.1
frr-reload: backport fixes from master for stable/9.1
2024-02-09 12:35:14 +02:00
Chirag Shah
c123649995 tools: fix frr-reload multiple no description cmds
Ensure to change description for index 0 from the list.

Ticket: #3628756
Testing Done:

After fix:
start with three interfaces description delete in lines_to_del:
(Pdb) lines_to_del
[(('interface swp1',), "description swp1 -> sp1's swp1"),
(('interface swp2',), "description swp2 -> sp2's swp
1"), (('interface swp3',), "description swp3 -> sp3's swp1")]

After first iteration swp1:
(Pdb) index
0
(Pdb) lines_to_del
[(('interface swp1',), 'description'), (('interface swp2',),
"description swp2 -> sp2's swp1"), (('interface swp
1s2',), "description swp3 -> sp3's swp1")]

After second iteration swp2:
(Pdb) lines_to_del
[(('interface swp1',), 'description'), (('interface swp2',),
'description'), (('interface swp3',), "description
swp3 -> sp3's swp1")]

After third iteration swp3 fix
(Pdb) lines_to_del
[(('interface swp1',), 'description'), (('interface swp2',),
'description'), (('interface swp3',), 'description'
)]

Signed-off-by: Chirag Shah <chirag@nvidia.com>
(cherry picked from commit 8a5c6e4389)
(cherry picked from commit dfc0a168d3)
2024-02-08 22:04:57 +01:00
Donatas Abraitis
d92497a6d4 tools: Use error log level when failing to execute commands via frr-reload.py
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit 204508433d)
(cherry picked from commit b1bdb55053)
2024-02-08 22:03:37 +01:00
Donatas Abraitis
d39fcdc22c tools: Apply black formatting for tools/frr-reload.py
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit 885613e45d)
2024-02-08 22:03:23 +01:00
Donatas Abraitis
44e0f76fb7
Merge pull request #15330 from FRRouting/mergify/bp/stable/9.1/pr-15325
bgpd: Do not show TCP MSS if the socket is broken (backport #15325)
2024-02-08 21:53:29 +02:00
Donatas Abraitis
0c679ffcbe bgpd: Do not show TCP MSS if the socket is broken
Just avoid calling for TCP MSS socket option if it's not in use.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit 65497556ed)
2024-02-08 15:34:55 +00:00
Donald Sharp
da5aeee0d6
Merge pull request #15313 from FRRouting/mergify/bp/stable/9.1/pr-15233
bgpd: fix VRF leaking with 'no bgp network import-check' (backport #15233)
2024-02-06 15:56:42 -05:00
Louis Scalbert
01bd36f70e topotests: vpnv4 route leaking with no import-check
Test vpnv4 route leaking with no import-check

Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
(cherry picked from commit 4bbfade7d6)
2024-02-06 10:29:47 +00:00
Louis Scalbert
78872311a0 bgpd: fix VRF leaking with 'no bgp network import-check'
BGP static routes are defined using the network statement, e.g.:

> router bgp XXX
>  address-family ipv4 unicast
>   network 192.168.0.0/24

When "no bgp network import-check" is set, it is impossible to
successfully import the static routes into the BGP VPN table. The prefix
is present in the table but is not marked as valid. This issue applies
regardless of whether or not routes are present in the router's RIB.

Always mark as valid the nexthops of BGP static routes when "no bgp
network import-check" is set.

Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
(cherry picked from commit 45bf46441a)
2024-02-06 10:29:46 +00:00
Donald Sharp
da022905ca
Merge pull request #15228 from FRRouting/mergify/bp/stable/9.1/pr-15206
pbrd: Fix PBR handling for last rule deletion (backport #15206)
2024-01-25 09:35:59 -05:00
Donatas Abraitis
684e21f62f
Merge pull request #15217 from FRRouting/mergify/bp/stable/9.1/pr-15210
bgpd: Fix format overflow for graceful-restart debug logs (backport #15210)
2024-01-25 11:13:57 +02:00
Rajesh Varatharaj
9de12e5683 pbrd: Fix PBR handling for last rule deletion
Issue:
Previously, the PBR common was updated for every rule update or deletion

example:
let say we have three rule 11, 12, 13 and if we are removing rule 12. in the current code
we are making the entire map "valid" to false.

pbr-map MAP1 seq 11
match src-ip 90.1.1.2/32
set nexthop 20.1.1.2 swp1

pbr-map MAP1 seq 12
match src-ip 90.1.1.3/32
set nexthop 20.1.1.2 swp1

pbr-map MAP1 seq 13
match src-ip 90.1.1.4/32
set nexthop 20.1.1.2 swp1

no pbr-map MAP1 seq 12 ==> turns whole map valid to false.

r1(config)# end
r1# show pbr map
  pbr-map MAP1 valid: no
    Seq: 11 rule: 310
        Installed: yes Reason: Valid
        SRC IP Match: 90.1.1.2/32
        nexthop 20.1.1.2 swp1
          Installed: yes Tableid: 10002
    Seq: 13 rule: 312
        Installed: yes Reason: Valid
        SRC IP Match: 90.1.1.4/32
        nexthop 20.1.1.2 swp1
          Installed: yes Tableid: 10004

Fix:
Now, the PBR common will only be updated when the last rule is being deleted.
This change ensures that we only send a delete request to Zebra once, and only
set the valid and installed flags to false when the last rule is deleted.
This optimizes the handling of PBR rules and reduces unnecessary interactions with Zebra

Testing: UT in MR notes

Ticket: #
Signed-off-by: Rajesh Varatharaj <rvaratharaj@nvidia.com>
(cherry picked from commit aa12c72c2a)
2024-01-25 08:01:07 +00:00
Donatas Abraitis
c12c5c1114 bgpd: Fix format overflow for graceful-restart debug logs
Use enum instead of int, and make the compiler happy when using -format-overflow.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit 2c69b4b516)
2024-01-24 17:27:34 +00:00
Donald Sharp
b1107dcbac
Merge pull request #15188 from opensourcerouting/fix/revert_noprefixroute_9.1
Revert noprefixroute stuff
2024-01-23 13:58:02 -05:00
Donald Sharp
1a5bb4314d
Merge pull request #15204 from FRRouting/mergify/bp/stable/9.1/pr-15197
pimd: fix crash when configuring ssmpingd (backport #15197)
2024-01-23 13:46:23 -05:00
Igor Ryzhov
c278b55ba8 pimd: fix crash when configuring ssmpingd
Command: `ip ssmpingd 1.1.1.1`

Backtrace:
```
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
0x00007fd1d3b02859 in __GI_abort () at abort.c:79
0x00007fd1d3e323e1 in yang_dnode_xpath_get_canon (dnode=<optimized out>, xpath_fmt=<optimized out>, ap=<optimized out>) at lib/yang_wrappers.c:61
0x00007fd1d3e34f41 in yang_dnode_get_ipv4 (addr=addr@entry=0x7ffc368554d4, dnode=<optimized out>, xpath_fmt=xpath_fmt@entry=0x5556af8680d4 "./source-addr") at lib/yang_wrappers.c:826
0x00005556af8216d3 in routing_control_plane_protocols_control_plane_protocol_pim_address_family_ssm_pingd_source_ip_create (args=0x7ffc36855530) at pimd/pim_nb_config.c:925
0x00007fd1d3dec13f in nb_callback_create (nb_node=0x5556b197ea40, nb_node=0x5556b197ea40, errmsg_len=8192, errmsg=0x7ffc36855a90 "", resource=0x5556b18fa6f8, dnode=0x5556b1ad7a10, event=NB_EV_APPLY, context=0x5556b1ad75c0) at lib/northbound.c:1260
nb_callback_configuration (context=0x5556b1ad75c0, event=NB_EV_APPLY, change=<optimized out>, errmsg=0x7ffc36855a90 "", errmsg_len=8192) at lib/northbound.c:1648
0x00007fd1d3deca6c in nb_transaction_process (event=event@entry=NB_EV_APPLY, transaction=transaction@entry=0x5556b1ad75c0, errmsg=errmsg@entry=0x7ffc36855a90 "", errmsg_len=errmsg_len@entry=8192) at lib/northbound.c:1779
0x00007fd1d3decdd6 in nb_candidate_commit_apply (transaction=0x5556b1ad75c0, save_transaction=save_transaction@entry=true, transaction_id=transaction_id@entry=0x0, errmsg=errmsg@entry=0x7ffc36855a90 "", errmsg_len=errmsg_len@entry=8192) at lib/northbound.c:1129
0x00007fd1d3decf15 in nb_candidate_commit (context=..., candidate=<optimized out>, save_transaction=save_transaction@entry=true, comment=comment@entry=0x0, transaction_id=transaction_id@entry=0x0, errmsg=0x7ffc36855a90 "", errmsg_len=8192) at lib/northbound.c:1162
0x00007fd1d3ded4af in nb_cli_classic_commit (vty=vty@entry=0x5556b1ada2a0) at lib/northbound_cli.c:50
0x00007fd1d3df025f in nb_cli_apply_changes_internal (vty=vty@entry=0x5556b1ada2a0, xpath_base=xpath_base@entry=0x7ffc36859b50 ".", clear_pending=clear_pending@entry=false) at lib/northbound_cli.c:177
0x00007fd1d3df06ad in nb_cli_apply_changes (vty=vty@entry=0x5556b1ada2a0, xpath_base_fmt=xpath_base_fmt@entry=0x0) at lib/northbound_cli.c:233
0x00005556af80fdd5 in pim_process_ssmpingd_cmd (vty=0x5556b1ada2a0, operation=NB_OP_CREATE, src_str=0x5556b1ad9630 "1.1.1.1") at pimd/pim_cmd_common.c:3423
0x00007fd1d3da7b0e in cmd_execute_command_real (vline=vline@entry=0x5556b1ac9520, vty=vty@entry=0x5556b1ada2a0, cmd=cmd@entry=0x0, up_level=up_level@entry=0) at lib/command.c:982
0x00007fd1d3da7cb1 in cmd_execute_command (vline=vline@entry=0x5556b1ac9520, vty=vty@entry=0x5556b1ada2a0, cmd=0x0, vtysh=vtysh@entry=0) at lib/command.c:1040
0x00007fd1d3da7e50 in cmd_execute (vty=vty@entry=0x5556b1ada2a0, cmd=cmd@entry=0x5556b1ae0a30 "ip ssmpingd 1.1.1.1", matched=matched@entry=0x0, vtysh=vtysh@entry=0) at lib/command.c:1207
0x00007fd1d3e278be in vty_command (vty=vty@entry=0x5556b1ada2a0, buf=<optimized out>) at lib/vty.c:591
0x00007fd1d3e27afd in vty_execute (vty=0x5556b1ada2a0) at lib/vty.c:1354
0x00007fd1d3e2bb23 in vtysh_read (thread=<optimized out>) at lib/vty.c:2362
0x00007fd1d3e22254 in event_call (thread=thread@entry=0x7ffc3685cd80) at lib/event.c:2003
0x00007fd1d3dce9e8 in frr_run (master=0x5556b183c830) at lib/libfrr.c:1218
0x00005556af803653 in main (argc=6, argv=<optimized out>, envp=<optimized out>) at pimd/pim_main.c:162
```

Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
(cherry picked from commit 8ffc3640f0)
2024-01-23 15:39:05 +00:00
Donald Sharp
3723c05471
Merge pull request #15198 from FRRouting/mergify/bp/stable/9.1/pr-15193
bgpd: fix route-map match probability deconfiguration callback (backport #15193)
2024-01-23 10:36:46 -05:00
Igor Ryzhov
b8fb7fe147 bgpd: fix route-map match probability deconfiguration callback
Add missing break. Currently, lib_route_map_entry_match_destroy is
called on every commit stage, but it should run only on APPLY.

Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
(cherry picked from commit 7006880bc2)
2024-01-23 06:50:21 +00:00
Donatas Abraitis
1c0dd8ce88 Revert "zebra: Add ability to note that a address is NOPREFIXROUTE"
This reverts commit e2b180cc90.
2024-01-21 23:14:06 +02:00
Donatas Abraitis
fa68e7c285 Revert "zebra: Add connected with noprefixroute"
This reverts commit b311787366.
2024-01-21 23:14:02 +02:00
Donatas Abraitis
aa5ff67844 Revert "tests: Add a noprefixroute test"
This reverts commit d5214b1182.
2024-01-21 23:13:57 +02:00
Donald Sharp
153a38db8d
Merge pull request #15147 from FRRouting/mergify/bp/stable/9.1/pr-15121 2024-01-12 19:24:07 -05:00
Donald Sharp
f8cce3727f
Merge pull request #15139 from FRRouting/mergify/bp/stable/9.1/pr-15091
bgpd: fix ecommunity_fill_pbr_action heap-buffer-overflow (backport #15091)
2024-01-12 14:34:31 -05:00
Rajesh Varatharaj
130550dc1b bgpd: Set correct TTL for the dynamic neighbor peers
In an EBGP multihop configuration with dynamic neighbors, the TTL configured is not being updated for the socket.

Issue:
Assume the following topology:
Host (Dynamic peer to spine - 192.168.1.100) - Leaf - Spine (192.168.1.1)

When the host establishes a BGP multihop session to the spine,
the connection uses the MAXTTL value instead of the configured TTL (in this case, 2).
This issue is only observed with dynamic peers.

Logs: look at the TTL is still MAXTTL, instead of “2” configured.

18:13:18.872395 48:b0:2d:0c:58:0b > 48:b0:2d:66:64:6b, ethertype IPv4 (0x0800), length 85: (tos 0xc0, ttl 255, id 32078, offset 0, flags [DF], proto TCP (6), length 71)
192.168.1.100.179 > 192.168.1.1.40967: Flags [P.], cksum 0xfe89 (correct), seq 28406:28425, ack 28424, win 255, options [nop,nop,TS val 4192664793 ecr 2814447051], length 19: BGP
Keepalive Message (4), length: 19

Fix:
Whenever a dynamic peer is created, the socket TTL should be updated with the configured TTL, in this case 2.

19:13:24.894890 48:b0:2d:0c:58:0b > 48:b0:2d:66:64:6b, ethertype IPv4 (0x0800), length 85: (tos 0xc0, ttl 2, id 1131, offset 0, flags [DF], proto TCP (6), length 71)
    192.168.1.100.179 > 192.168.1.1.41937: Flags [P.], cksum 0x7a67 (correct), seq 2046150759:2046150778, ack 4286110599, win 255, options [nop,nop,TS val 4196270815 ecr 2818051226], length 19: BGP
        Keepalive Message (4), length: 19

Testing: UT

UT logs:
2023-12-29T19:13:21.892205+00:00 host bgpd[1591425]: [WWPV7-YSZB5] Dynamic Neighbor 192.168.1.1/32 matches group test listen range 192.168.1.0/30
2023-12-29T19:13:21.892654+00:00 host bgpd[1591425]: [GBPAR-M31QF] 192.168.1.1 Dynamic Neighbor added, group test count 1
2023-12-29T19:13:21.892993+00:00 host bgpd[1591425]: [GPE2H-K9QRE] bgp_set_socket_ttl:  set TxTTL on peer (rtrid 0.0.0.0) socket, err = 2, peer ttl 2

 Conflicts:
	bgpd/bgp_network.c

Ticket: #
Signed-off-by: Rajesh Varatharaj <rvaratharaj@nvidia.com>
(cherry picked from commit 68573c34d4)
2024-01-12 18:27:40 +00:00
Louis Scalbert
26187b03d9 bgpd: fix ecommunity_fill_pbr_action heap-buffer-overflow
Fix the following heap-buffer-overflow:

> ==3901635==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020003a5940 at pc 0x56260067bb48 bp 0x7ffe8a4f3840 sp 0x7ffe8a4f3838
> READ of size 4 at 0x6020003a5940 thread T0
>     #0 0x56260067bb47 in ecommunity_fill_pbr_action bgpd/bgp_ecommunity.c:1587
>     #1 0x5626007a246e in bgp_pbr_build_and_validate_entry bgpd/bgp_pbr.c:939
>     #2 0x5626007b25e6 in bgp_pbr_update_entry bgpd/bgp_pbr.c:2933
>     #3 0x562600909d18 in bgp_zebra_announce bgpd/bgp_zebra.c:1351
>     #4 0x5626007d5efd in bgp_process_main_one bgpd/bgp_route.c:3528
>     #5 0x5626007d6b43 in bgp_process_wq bgpd/bgp_route.c:3641
>     #6 0x7f450f34c2cc in work_queue_run lib/workqueue.c:266
>     #7 0x7f450f327a27 in event_call lib/event.c:1970
>     #8 0x7f450f21a637 in frr_run lib/libfrr.c:1213
>     #9 0x56260062fc04 in main bgpd/bgp_main.c:540
>     #10 0x7f450ee2dd09 in __libc_start_main ../csu/libc-start.c:308
>     #11 0x56260062ca29 in _start (/usr/lib/frr/bgpd+0x2e3a29)
>
> 0x6020003a5940 is located 0 bytes to the right of 16-byte region [0x6020003a5930,0x6020003a5940)
> allocated by thread T0 here:
>     #0 0x7f450f6aa1f8 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
>     #1 0x7f450f244f8a in qrealloc lib/memory.c:112
>     #2 0x562600673313 in ecommunity_add_val_internal bgpd/bgp_ecommunity.c:143
>     #3 0x5626006735bc in ecommunity_uniq_sort_internal bgpd/bgp_ecommunity.c:193
>     #4 0x5626006737e3 in ecommunity_parse_internal bgpd/bgp_ecommunity.c:228
>     #5 0x562600673890 in ecommunity_parse bgpd/bgp_ecommunity.c:236
>     #6 0x562600640469 in bgp_attr_ext_communities bgpd/bgp_attr.c:2674
>     #7 0x562600646eb3 in bgp_attr_parse bgpd/bgp_attr.c:3893
>     #8 0x562600791b7e in bgp_update_receive bgpd/bgp_packet.c:2141
>     #9 0x56260079ba6b in bgp_process_packet bgpd/bgp_packet.c:3406
>     #10 0x7f450f327a27 in event_call lib/event.c:1970
>     #11 0x7f450f21a637 in frr_run lib/libfrr.c:1213
>     #12 0x56260062fc04 in main bgpd/bgp_main.c:540
>     #13 0x7f450ee2dd09 in __libc_start_main ../csu/libc-start.c:308

Fixes: dacf6ec120 ("bgpd: utility routine to convert flowspec actions into pbr actions")
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
(cherry picked from commit 6001c765e2)
2024-01-12 14:29:51 +00:00
Donald Sharp
c066b835b4
Merge pull request #15096 from FRRouting/mergify/bp/stable/9.1/pr-15083
isisd: fix _isis_spftree_del heap-use-after-free (backport #15083)
2024-01-05 09:25:03 -05:00
Louis Scalbert
3eeed525ab isisd: fix _isis_spftree_del heap-use-after-free
Fix the following heap-use-after-free

> ==82961==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020001e4750 at pc 0x55a8cc7f63ac bp 0x7ffd6948e340 sp 0x7ffd6948e330
> READ of size 8 at 0x6020001e4750 thread T0
>     #0 0x55a8cc7f63ab in isis_route_node_cleanup isisd/isis_route.c:335
>     #1 0x7ff25ec617c1 in route_node_free lib/table.c:75
>     #2 0x7ff25ec619fc in route_table_free lib/table.c:111
>     #3 0x7ff25ec61661 in route_table_finish lib/table.c:46
>     #4 0x55a8cc800d83 in _isis_spftree_del isisd/isis_spf.c:397
>     #5 0x55a8cc800e45 in isis_spftree_clear isisd/isis_spf.c:414
>     #6 0x55a8cc80bd9a in isis_run_spf isisd/isis_spf.c:2020
>     #7 0x55a8cc80c370 in isis_run_spf_with_protection isisd/isis_spf.c:2076
>     #8 0x55a8cc80cf52 in isis_run_spf_cb isisd/isis_spf.c:2165
>     #9 0x7ff25ec7c4dc in event_call lib/event.c:1970
>     #10 0x7ff25eb64423 in frr_run lib/libfrr.c:1213
>     #11 0x55a8cc7799da in main isisd/isis_main.c:318
>     #12 0x7ff25e623d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
>     #13 0x7ff25e623e3f in __libc_start_main_impl ../csu/libc-start.c:392
>     #14 0x55a8cc778e44 in _start (/usr/lib/frr/isisd+0x109e44)
>
> 0x6020001e4750 is located 0 bytes inside of 16-byte region [0x6020001e4750,0x6020001e4760)
> freed by thread T0 here:
>     #0 0x7ff25f000537 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
>     #1 0x7ff25eb9012e in qfree lib/memory.c:130
>     #2 0x55a8cc7f6485 in isis_route_table_info_free isisd/isis_route.c:351
>     #3 0x55a8cc800cf4 in _isis_spftree_del isisd/isis_spf.c:395
>     #4 0x55a8cc800e45 in isis_spftree_clear isisd/isis_spf.c:414
>     #5 0x55a8cc80bd9a in isis_run_spf isisd/isis_spf.c:2020
>     #6 0x55a8cc80c370 in isis_run_spf_with_protection isisd/isis_spf.c:2076
>     #7 0x55a8cc80cf52 in isis_run_spf_cb isisd/isis_spf.c:2165
>     #8 0x7ff25ec7c4dc in event_call lib/event.c:1970
>     #9 0x7ff25eb64423 in frr_run lib/libfrr.c:1213
>     #10 0x55a8cc7799da in main isisd/isis_main.c:318
>     #11 0x7ff25e623d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
>
> previously allocated by thread T0 here:
>     #0 0x7ff25f000a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>     #1 0x7ff25eb8ffdc in qcalloc lib/memory.c:105
>     #2 0x55a8cc7f63eb in isis_route_table_info_alloc isisd/isis_route.c:343
>     #3 0x55a8cc80052a in _isis_spftree_init isisd/isis_spf.c:334
>     #4 0x55a8cc800e51 in isis_spftree_clear isisd/isis_spf.c:415
>     #5 0x55a8cc80bd9a in isis_run_spf isisd/isis_spf.c:2020
>     #6 0x55a8cc80c370 in isis_run_spf_with_protection isisd/isis_spf.c:2076
>     #7 0x55a8cc80cf52 in isis_run_spf_cb isisd/isis_spf.c:2165
>     #8 0x7ff25ec7c4dc in event_call lib/event.c:1970
>     #9 0x7ff25eb64423 in frr_run lib/libfrr.c:1213
>     #10 0x55a8cc7799da in main isisd/isis_main.c:318
>     #11 0x7ff25e623d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Fixes: 7153c3cabf ("isisd: update struct isis_route_info has multiple sr info by algorithm")
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
(cherry picked from commit 9fa9a9d865)
2024-01-05 08:47:58 +00:00
Donald Sharp
30f4de3dd0
Merge pull request #15039 from FRRouting/mergify/bp/stable/9.1/pr-15032
bgpd: "default-originate" shouldn't withdraw non-default routes (backport #15032)
2023-12-18 15:00:11 -05:00
Xiao Liang
2330ed61e7 tests: Check for 0.0.0.0/1 in bgp_default_route
Ensure that 0.0.0.0/1 route can be advertised along with
default-originate.

Signed-off-by: Xiao Liang <shaw.leon@gmail.com>
(cherry picked from commit 4538247c99)
2023-12-18 14:17:46 +00:00
Xiao Liang
275a4b508a bgpd: "default-originate" shouldn't withdraw non-default routes
Prevent "default-originate" from withdrawing non-default routes like
0.0.0.0/1 by checking prefix length.

Signed-off-by: Xiao Liang <shaw.leon@gmail.com>
(cherry picked from commit 4d74ba929d)
2023-12-18 14:17:45 +00:00
Donald Sharp
80ce05dc59
Merge pull request #15009 from opensourcerouting/fix/8a5c6e4389a8f56c1a25941977a1f6acaf92f53e_9.1
tools: fix frr-reload multiple no description cmds
2023-12-18 08:58:24 -05:00
Donald Sharp
34c584225d
Merge pull request #15028 from FRRouting/mergify/bp/stable/9.1/pr-15026
ospfd: Correct LSA parser which fulfill the TED (backport #15026)
2023-12-14 20:23:12 -05:00
Olivier Dugeon
4104f3c4ce tests: Update OSPF TE topotests
The OSPF TE topotest is using switches to interconnect router. During the test,
interfaces are shutdown on some routers to simulate link failure and check that
the TED is correctly updated. However, the switche between router avoid the
detection by the neighbor router that the interface is down i.e. the interface
line remains up as it is conneted to the switch and not to the router.

This patch update the tested topology by removing the switch and connect
directly the router excepted the inter AS link on R3. Interface are also
renamed accordingly.

Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>
(cherry picked from commit 55ad785753)
2023-12-14 21:17:34 +00:00
Olivier Dugeon
74576417f8 ospfd: Correct LSA parser which fulfill the TED
Traffic Engineering Database (TED) is fulfill from the various LSA advertised
and received by the router. To remove information on the TED, 2 mechanisms are
used: i) parse TE Opaque LSA when there are flushed and ii) compare the list of
prefixes advertised in the Router LSA with the list of corresponding edges and
subnets contained in the TED. However, this second mechanism assumes that the
Router LSA is unique and contains all prefixes of the advertised router.
But, this is wrong. Prefixes could be advertised with several Router LSA.
This conduct to remove edge and subnet in the TED while it should be maintained.
The result is a faulty test with ospf_sr_te_topo1 topotest when server is heavy
loaded.

This simple patch removed deletion of edges and subnets when parsing the Router
LSA and only removed them when the corresponding TE Opaque LSA is flushed. In
addition, TE Opaque LSA are not flushed when OSPF ajacency goes down. This
patch also correct this second problem.

Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>
(cherry picked from commit a3230323f7)
2023-12-14 21:17:32 +00:00
Donald Sharp
02601690f3
Merge pull request #15019 from FRRouting/mergify/bp/stable/9.1/pr-15014
ospfd: fix some ospf cmds' param range (backport #15014)
2023-12-14 10:37:55 -05:00