Commit Graph

3487 Commits

Author SHA1 Message Date
Quentin Young
efa618369a
Merge pull request #5794 from mjstapp/remove_nexthop_matched_flag
lib,zebra: remove unused MATCHED nexthop flag
2020-02-12 11:29:22 -05:00
Mark Stapp
0641a955d7 lib,zebra: remove unused MATCHED nexthop flag
Remove an unused flag value from the nexthop struct.

Signed-off-by: Mark Stapp <mjs@voltanet.io>
2020-02-11 15:56:35 -05:00
Thibaut Collet
7e0f48c75d vty: add command to get route with table, vrf and protocol
Today vtysh can show the ip/ip6 routes through several commands:
- show_route_cmd
- show_route_detail_cmd
- show_route_summary_cmd
- show_route_table_cmd
- show_route_table_vrf_cmd
- show_route_all_table_vrf_cmd

Each command has its own set of filter rules:
- show_route_cmd can filter by vrf, protocol, tag, ... but not by table
- show_route_table_cmd always filter by table
- show_route_table_vrf_cmd always filter by table and can filter by vrf
too
- show_route_all_table_vrf_cmd show all route in any table for a vrf (or
all)

To reduce the number of commands and provide a possibility to filter by
any key add possibility for the show_route_cmd to filter by table with a
specific value or all to get route in all tables.

Then the show_route_table_cmd, show_route_table_vrf_cmd and
show_route_all_table_vrf_cmd functions can be removed as they are covered
by the generic show_route_cmd function.

It is to be noted that when zebra is started by default, it is possible
to execute show ip route command with both vrf and table parameters,
whereas before the command was not displayed. This is due to the fact
that this combination is only permitted when zebra is launched with vrf
network namespace mode. There, if zebra is configured with vrf-lite
backend, then a vty error message informs the user that the combination
of both table and vrf is not possible.

Signed-off-by: Thibaut Collet <thibaut.collet@6wind.com>
2020-02-11 17:07:47 +01:00
Renato Westphal
4b08a72ed1
Merge pull request #5763 from ton31337/fix/return_without_parent
*: Remove parenthesis on return for constants
2020-02-10 18:49:06 -03:00
Donatas Abraitis
95f7965d09 *: Remove parenthesis on return for constants
Signed-off-by: Donatas Abraitis <donatas.abraitis@gmail.com>
2020-02-09 14:21:56 +02:00
Chirag Shah
256f86b655 zebra:remote vtep delete handling
The existing behavior is when a remote VTEP is deleted,
its associatedneighbor (arp) and MAC entries are removed from
zebra database and do not wait for explicit type-2 route
withdraw from originating VTEP.
Remote type-2 route delete checks if VTEP is present before
removing the entry.
The behavior works fine when all evpn routes points to the
same nexthop as the VTEP IP.

In MLAG topology with advertise-pip, self type-2 and type-5 routes
are advertised with individual VTEP IP as nexthop ip for the route.

When a new VNI is created, it is assigned individual IP as tunnel-ip
then it transition to anycast IP (of the MLAG). During the transition,
type-3 route (VTEP delete) withdraw is sent for the individual IP.
The remote VTEP delete should not trigger to remove evpn routes pointing
to VTEP IP. Instead the route will be removed via explicit withdraw.

Ticket:CM-27752
Reviewed By:CCR-9722
Testing Done:

In evpn with MLAG deployment with advertise-pip and advertise-svi-ip
enabled, validated remote vtep delete does not remove self type-2 routes
from zebra DB. Upon explicit type-2 withdraw routes are removed.

Signed-off-by: Chirag Shah <chirag@cumulusnetworks.com>
2020-02-07 17:02:39 -08:00
Russ White
5bf7fe566d
Merge pull request #5722 from donaldsharp/kernel_routes
Kernel routes
2020-02-06 08:04:42 -05:00
Donatas Abraitis
975a328e2e *: Replace s_addr 0 => INADDR_ANY
Signed-off-by: Donatas Abraitis <donatas.abraitis@gmail.com>
2020-02-06 09:00:12 +02:00
Donald Sharp
792465c09f
Merge pull request #5104 from opensourcerouting/route-map-nbv2
lib: migrate route map to use northbound
2020-02-05 11:54:21 -05:00
Renato Westphal
ecaeb3b697
Merge pull request #5750 from qlyoung/fix-null-after-xfree
*: don't null after XFREE; XFREE does this itself
2020-02-05 01:49:08 -03:00
Renato Westphal
8f6ebcbeb2
Merge pull request #5760 from ton31337/fix/shorthand_operator
zebra: Use shorthand operator in ifm_read()
2020-02-05 01:45:55 -03:00
Quentin Young
e1b36e132b *: remove null check before XFREE
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-02-04 13:19:37 -05:00
Donatas Abraitis
b49a912271 zebra: Use shorthand operator in ifm_read()
Signed-off-by: Donatas Abraitis <donatas.abraitis@gmail.com>
2020-02-04 20:12:17 +02:00
Donatas Abraitis
5ee080f00a zebra, lib: Remove return from void functions
Signed-off-by: Donatas Abraitis <donatas.abraitis@gmail.com>
2020-02-04 20:05:21 +02:00
Rafael Zalamena
91835f1fd2 *: fix route map integration
Add the appropriated code to bootstrap route map northbound for all
daemons.

Signed-off-by: Rafael Zalamena <rzalamena@opensourcerouting.org>
2020-02-04 14:05:43 -03:00
Renato Westphal
b2ce558967
Merge pull request #5739 from mjstapp/nhg_show_ordered
zebra: show zebra nexthop-groups without copying
2020-02-04 13:37:24 -03:00
Russ White
c7a754408e
Merge pull request #5746 from donaldsharp/bgp_sa
Coverioty sa stuff
2020-02-04 11:24:08 -05:00
Donald Sharp
a6bb6a1fe9
Merge pull request #5207 from Spantik/ZERBA_GR
Zebra: Adding GR infrastructure for clients.
2020-02-04 10:57:29 -05:00
Mark Stapp
b5e02d19dc zebra: show zebra nexthop-groups without copying
Use a hash walker/iterator instead of a temporary list to
show zebra's nexthop-groups/nexthop-hash-entries.

Signed-off-by: Mark Stapp <mjs@voltanet.io>
2020-02-04 08:39:41 -05:00
Russ White
05d0c66d8f
Merge pull request #5737 from mjstapp/zebra_disable_kern_nhs
zebra: add config to disable use of kernel nexthops
2020-02-04 08:12:34 -05:00
Donald Sharp
9275682559 zebra: top has already been derefed
The top variable has already been derefed by the time we get
to the test to see if it is non-NULL.  No need to check it.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-02-04 08:10:52 -05:00
Quentin Young
b3ba5dc7fe *: don't null after XFREE; XFREE does this itself
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-02-03 11:22:13 -05:00
Donald Sharp
88cafda739 zebra: nexthop groups vrf's are only a function of namespaces
Nexthop groups as a whole do not make sense to have a vrf'ness
As that you can have a arbitrary number of nexthops that point
to separate vrf's.

Modify the code to make this distinction, by clearly delineating
the line between the nhg and the nexthop a bit better.
Nexthop groups having a vrf_id only make sense if you are using
network namespaces to represent them.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-01-31 08:45:51 -05:00
Donald Sharp
417f01b751 zebra: Modify 'show nexthop-group rib ip|ipv6'
The zebra implementation of nexthop groups has
two types of nexthops groups currently.  Singleton
objects which have afi's and combined nexthop groups
that do not.  Specifically call this out in the code
to make this distinction.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-01-31 08:26:39 -05:00
Santosh P K
b9e6727acd zebra: Capabality and stale route handling for GR client.
Handling capability received from client. It may contain
GR enable/disable, Stale time changes, RIB update complete
for given AFi, ASAFI and instance. It also has changes for
stale route handling.

Signed-off-by: Santosh P K <sapk@vmware.com>
2020-01-31 03:36:37 -08:00
Stephen Worley
a7e1b02d4a zebra: add null check before connecting recursive depend
Add a null check in `handle_recursive_depend()` so it
doesn't try to add a NULL pointer to the RB tree.

This was found with clang SA.

Signed-off-by: Stephen Worley <sworley@cumulusnetworks.com>
2020-01-30 17:15:06 -05:00
Stephen Worley
c8b891b483 zebra: reset nexthop pointer in zread of nexthops
We were not resetting the nexthop pointer to NULL for each
new read of a nexthop from the zapi route. On the chance we
get a nexthop that does not have a proper type, we will not
create a new nexthop and update that pointer, thus it still
has the last valid one and will create a group with two
pointers to the same nexthop.

Then when it enters any code that iterates the group, it loops
endlessly.

This was found with zapi fuzzing.

```
0x00007f728891f1c3 in jhash2 (k=<optimized out>, length=<optimized out>, initval=12183506) at lib/jhash.c:138
0x00007f728896d92c in nexthop_hash (nexthop=<optimized out>) at lib/nexthop.c:563
0x00007f7288979ece in nexthop_group_hash (nhg=<optimized out>) at lib/nexthop_group.c:394
0x0000000000621036 in zebra_nhg_hash_key (arg=<optimized out>) at zebra/zebra_nhg.c:356
0x00007f72888ec0e1 in hash_get (hash=<optimized out>, data=0x7ffffb94aef0, alloc_func=0x0) at lib/hash.c:138
0x00007f72888ee118 in hash_lookup (hash=0x7f7288de2f10, data=0x7f728908e7fc) at lib/hash.c:183
0x0000000000626613 in zebra_nhg_find (nhe=0x7ffffb94b080, id=0, nhg=0x6020000032d0, nhg_depends=0x0, vrf_id=<optimized out>,
    afi=<optimized out>, type=<optimized out>) at zebra/zebra_nhg.c:541
0x0000000000625f39 in zebra_nhg_rib_find (id=0, nhg=<optimized out>, rt_afi=AFI_IP) at zebra/zebra_nhg.c:1126
0x000000000065f953 in rib_add_multipath (afi=AFI_IP, safi=<optimized out>, p=0x7ffffb94b370, src_p=0x0, re=0x6070000013d0,
    ng=0x7f728908e7fc) at zebra/zebra_rib.c:2616
0x0000000000768f90 in zread_route_add (client=0x61f000000080, hdr=<optimized out>, msg=<optimized out>, zvrf=<optimized out>)
    at zebra/zapi_msg.c:1596
0x000000000077c135 in zserv_handle_commands (client=<optimized out>, msg=0x61b000000780) at zebra/zapi_msg.c:2636
0x0000000000575e1f in main (argc=<optimized out>, argv=<optimized out>) at zebra/main.c:309
```

```
(gdb) p *nhg->nexthop
$4 = {next = 0x5488e0, prev = 0x5488e0, vrf_id = 16843009, ifindex = 16843009, type = NEXTHOP_TYPE_IFINDEX, flags = 8 '\b', {gate = {ipv4 = {s_addr = 0},
      ipv6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}},
    bh_type = BLACKHOLE_UNSPEC}, src = {ipv4 = {s_addr = 0}, ipv6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0,
          0}, __u6_addr32 = {0, 0, 0, 0}}}}, rmap_src = {ipv4 = {s_addr = 0}, ipv6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0,
          0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}}, resolved = 0x0, rparent = 0x0, nh_label_type = ZEBRA_LSP_NONE, nh_label = 0x0, weight = 1 '\001'}
(gdb) quit

```

Signed-off-by: Stephen Worley <sworley@cumulusnetworks.com>
2020-01-30 17:15:06 -05:00
Stephen Worley
5bf15faa19 zebra: don't created connected if duplicate depend
Since we are using a UNIQUE RB tree, we need to handle the
case of adding in a duplicate entry into it.

The list API code returns NULL when a successfull add
occurs, so lets pull that handling further up into
the connected handlers. Then, free the allocated
connected struct if it is a duplicate.

This is a pretty unlikely situation to happen.

Also, pull up the RB handling of _del RB API as well.

This was found with the zapi fuzzing code.

```
==1052840==
==1052840== 200 bytes in 5 blocks are definitely lost in loss record 545 of 663
==1052840==    at 0x483BB1A: calloc (vg_replace_malloc.c:762)
==1052840==    by 0x48E1008: qcalloc (memory.c:110)
==1052840==    by 0x44D357: nhg_connected_new (zebra_nhg.c:73)
==1052840==    by 0x44D300: nhg_connected_tree_add_nhe (zebra_nhg.c:123)
==1052840==    by 0x44FBDC: depends_add (zebra_nhg.c:1077)
==1052840==    by 0x44FD62: depends_find_add (zebra_nhg.c:1090)
==1052840==    by 0x44E46D: zebra_nhg_find (zebra_nhg.c:567)
==1052840==    by 0x44E1FE: zebra_nhg_rib_find (zebra_nhg.c:1126)
==1052840==    by 0x45AD3D: rib_add_multipath (zebra_rib.c:2616)
==1052840==    by 0x4977DC: zread_route_add (zapi_msg.c:1596)
==1052840==    by 0x49ABB9: zserv_handle_commands (zapi_msg.c:2636)
==1052840==    by 0x428B11: main (main.c:309)
```

Signed-off-by: Stephen Worley <sworley@cumulusnetworks.com>
2020-01-30 17:15:05 -05:00
Santosh P K
851140a7bb zebra: Handling of connection disconnect and connect with GR.
Zebra will have special handling for clients with GR enabled.
When client disconnects with GR enabled, then a stale client
will be created and its RIB will be retained till stale timer
or client comes up and updated its RIB.

Co-authored-by: Santosh P K <sapk@vmware.com>
Co-authored-by: Soman K S <somanks@vmware.com>
Signed-off-by: Santosh P K <sapk@vmware.com>
2020-01-30 10:26:04 -08:00
Santosh P K
8062cbe2d0 zebra: Header file changes and show commands.
Adding header files changes where structure to hold
received graceful restart info from client is defined.
Also there are changes for show commands where exisiting
commands are extended.

Co-authored-by: Santosh P K <sapk@vmware.com>
Co-authored-by: Soman K S <somanks@vmware.com>
Signed-off-by: Santosh P K <sapk@vmware.com>
2020-01-30 10:26:04 -08:00
Mark Stapp
7c99d51beb zebra: add config to disable use of kernel nexthops
Add a config that disables use of kernel-level nexthop ids.
Currently, zebra always uses nexthop ids if the kernel supports
them.

Signed-off-by: Mark Stapp <mjs@voltanet.io>
2020-01-28 11:00:42 -05:00
Russ White
61678a82f8
Merge pull request #5706 from mjstapp/fix_nh_debug_show
zebra: include zebra nexthop debug in show runn
2020-01-28 10:27:43 -05:00
Donatas Abraitis
73c7d6e066
Merge pull request #5673 from qlyoung/fix-zebra-ipset-iptable-memleak-on-disconnect
zebra: fix ipset, iptable, ipset entry memleaks
2020-01-28 15:40:35 +02:00
Donald Sharp
3332f4f0fb zebra: Kernel routes w/ AD were not being marked as installed
When we are receiving a kernel route, with an admin distance
of 255 we are not marking it as installed.  This route
should be marked as installed.

New behavior:
K>* 4.5.7.0/24 [255/8192] via 192.168.209.1, enp0s8, 00:10:14

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-01-23 17:17:01 -05:00
Mark Stapp
be3a8fa8f8
Merge pull request #5620 from qlyoung/fix-zebra-vrf-label-afi-check
Fix zebra vrf label afi check
2020-01-23 10:59:19 -05:00
Donald Sharp
54bea4e537 zebra: Re-add onlink flag due to loss in earlier commit
commit: 0eb97b860d

Removed this chunk of code in zebra:
-       if (ifp)
-               if (connected_is_unnumbered(ifp))
-                       SET_FLAG(nexthop->flags, NEXTHOP_FLAG_ONLINK);

Effectively if we had a NEXTHOP_TYPE_IPV4_IFINDEX we would
auto set the onlink flag.  This commit dropped it for some reason.

Add it back in an intelligent manner.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-01-22 17:10:20 -05:00
Quentin Young
663d3a9115 zebra: check afi validity in vrf label message
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-22 14:12:15 -05:00
Mark Stapp
cb6070bd79 zebra: include zebra nexthop debug in show runn
Add show output for 'debug zebra nexthop [detail]' category.

Signed-off-by: Mark Stapp <mjs@voltanet.io>
2020-01-21 09:26:44 -05:00
Quentin Young
cc815be71a zebra: print unknown rule family as number
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-16 20:53:10 -05:00
Quentin Young
b147e20433 zebra: fix ipset, iptable, ipset entry memleaks
Removed from hash, but not freed, on client disconnect.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-16 13:31:34 -05:00
David Lamparter
d25827acfb
zebra: Fix label manager memory leak (#5680)
zebra: Fix label manager memory leak
2020-01-16 10:20:57 +01:00
David Lamparter
1176e59625
Merge pull request #5674 from qlyoung/fix-zebra-redist-disconnect-memleak
zebra: fix redist memleak on client disconnect
2020-01-16 10:18:35 +01:00
David Lamparter
c36fbd565e
Merge pull request #5672 from qlyoung/fix-zebra-pbr-iptable-heap-uaf
zebra: fix iptable install heap UAF
2020-01-16 10:14:45 +01:00
David Lamparter
3fde74fdea
zebra: fix assert crash on corrupt vxlan msg (#5670)
zebra: fix assert crash on corrupt vxlan msg
2020-01-16 10:13:59 +01:00
David Lamparter
ba16266644
zebra: Do not accept illegal safi's for route installation (#5679)
zebra: Do not accept illegal safi's for route installation
2020-01-16 10:12:44 +01:00
Mark Stapp
d26e2d9be4
Merge pull request #5600 from sworleys/NHG-Depend-Crash
zebra: can't improve efficiency for recursive depends
2020-01-15 16:31:55 -05:00
Mark Stapp
a67b69c024
Merge pull request #5616 from sworleys/NHG-Fix-Recurse-to-Group
zebra: just set nexthop member in handle_recursive_depend()
2020-01-15 16:26:06 -05:00
Quentin Young
7fb29f49ab zebra: fix assert crash on corrupt vxlan msg
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-15 14:20:22 -05:00
Quentin Young
592af4cc0a zebra: fix iptable install heap UAF
My previous patch to fix a memory leak, caused by not properly freeing
the iptable iface list on stream parse failure, created/exposed a heap
use after free because we were not doing a deep copy

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-15 14:19:56 -05:00
Quentin Young
24c370dd46 zebra: fix redist memleak on client disconnect
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-15 14:18:40 -05:00
Donatas Abraitis
3b1c9f84c6
Merge pull request #5666 from donaldsharp/more_nhg_fixes
bgpd, ospfd, zebra: Do not use 0 as VRF_DEFAULT
2020-01-15 20:38:54 +02:00
Stephen Worley
1d049aba72 zebra: just set nexthop member in handle_recursive_depend()
With recent changes to the lib nexthop_group
APIs (e1f3a8eb19), we are making
new assumptions that this should be adding a single nexthop
to a group, not a list of nexthops.

This broke the case of a recursive nexthop resolving to a group:

```
D>  2.2.2.1/32 [150/0] via 1.1.1.1 (recursive), 00:00:09
  *                      via 1.1.1.1, dummy1 onlink, 00:00:09
                       via 1.1.1.2 (recursive), 00:00:09
  *                      via 1.1.1.2, dummy2 onlink, 00:00:09
D>  3.3.3.1/32 [150/0] via 2.2.2.1 (recursive), 00:00:04
  *                      via 1.1.1.1, dummy1 onlink, 00:00:04
K * 10.0.0.0/8 [0/1] via 172.27.227.148, tun0, 00:00:21
```

This group can instead just directly point to the nh that was passed.
Its only being used for a lookup (the memory gets copied and used
elsewhere if the nexthop is not found).

Signed-off-by: Stephen Worley <sworley@cumulusnetworks.com>
2020-01-15 13:35:29 -05:00
Stephen Worley
77bf9504bf lib,zebra: tighten up the nexthop_copy/nexthop_dup APIs
Make the nexthop_copy/nexthop_dup APIs more consistent by
adding a secondary, non-recursive, version of them. Before,
it was inconsistent whether the APIs were expected to copy
recursive info or not. Make it clear now that the default is
recursive info is copied unless the _no_recurse() version is
called. These APIs are not heavily used so it is fine to
change them for now.

Signed-off-by: Stephen Worley <sworley@cumulusnetworks.com>
2020-01-15 13:35:04 -05:00
Stephen Worley
0fff714efa zebra: can't improve efficiency for recursive depends
cb86eba3ab was causing zebra to crash
when handling a nexthop group that had a nexthop which was recursively resolved.

Steps to recreate:

!
nexthop-group red
 nexthop 1.1.1.1
 nexthop 1.1.1.2
!

sharp install routes 8.8.8.1 nexthop-group red 1

=========================================
==11898== Invalid write of size 8
==11898==    at 0x48E53B4: _nexthop_add_sorted (nexthop_group.c:254)
==11898==    by 0x48E5336: nexthop_group_add_sorted (nexthop_group.c:296)
==11898==    by 0x453593: handle_recursive_depend (zebra_nhg.c:481)
==11898==    by 0x451CA8: zebra_nhg_find (zebra_nhg.c:572)
==11898==    by 0x4530FB: zebra_nhg_find_nexthop (zebra_nhg.c:597)
==11898==    by 0x4536B4: depends_find (zebra_nhg.c:1065)
==11898==    by 0x453526: depends_find_add (zebra_nhg.c:1087)
==11898==    by 0x451C4D: zebra_nhg_find (zebra_nhg.c:567)
==11898==    by 0x4519DE: zebra_nhg_rib_find (zebra_nhg.c:1126)
==11898==    by 0x452268: nexthop_active_update (zebra_nhg.c:1729)
==11898==    by 0x461517: rib_process (zebra_rib.c:1049)
==11898==    by 0x4610C8: process_subq_route (zebra_rib.c:1967)
==11898==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

Zebra crashes because we weren't handling the case of the depend nexthop
being recursive.

For this case, we cannot make the function more efficient. A nexthop
could resolve to a group of any size, thus we need allocs/frees.

To solve this and retain the goal of the original patch, we separate out the
two cases so it will still be more efficient if the nexthop is not recursive.

Signed-off-by: Stephen Worley <sworley@cumulusnetworks.com>
2020-01-15 13:35:04 -05:00
Donald Sharp
946de1b95a bgpd, ospfd, zebra: Do not use 0 as VRF_DEFAULT
Explicitly spell out what we are trying to do.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-01-15 08:29:36 -05:00
Donald Sharp
5e7939a561 zebra: Do not accept illegal safi's for route installation
The only two safi's that are usable for zebra for installation
of routes into the rib are SAFI_UNICAST and SAFI_MULTICAST.
The acceptance of other safi's is causing a memory leak:

Direct leak of 56 byte(s) in 1 object(s) allocated from:
    #0 0x5332f2 in calloc (/usr/lib/frr/zebra+0x5332f2)
    #1 0x7f594adc29db in qcalloc /opt/build/frr/lib/memory.c:110:27
    #2 0x686849 in zebra_vrf_get_table_with_table_id /opt/build/frr/zebra/zebra_vrf.c:390:11
    #3 0x65a245 in rib_add_multipath /opt/build/frr/zebra/zebra_rib.c:2591:10
    #4 0x7211bc in zread_route_add /opt/build/frr/zebra/zapi_msg.c:1616:8
    #5 0x73063c in zserv_handle_commands /opt/build/frr/zebra/zapi_msg.c:2682:2
Collapse

Sequence of events:

Upon vrf creation there is a zvrf->table[afi][safi] data structure
that tables are auto created for.  These tables only create SAFI_UNICAST
and SAFI_MULTICAST tables.  Since these are the only safi types that
are zebra can actually work on.  zvrf data structures also have a
zvrf->otable data structure that tracks in a RB tree other tables
that are created ( say you have routes stuck in any random table
in the 32bit route table space in linux ).  This data structure is
only used if the lookup in zvrf->table[afi][safi] fails.

After creation if we pass a route down from an upper level protocol
that has non unicast or multicast safi *but* has the actual
tableid of the vrf we are in, the initial lookup will always
return NULL leaving us to look in the otable.  This will create
a data structure to track this data.

If after this event you pass in a second route with the same
afi/safi/table_id, the otable will be created and attempted
to be stored, but the RB_TREE_UNIQ data structure when it sees
this will return the original otable returned and the lookup function
zebra_vrf_get_table_with_table_id will just drop the second otable.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-01-15 08:23:14 -05:00
Donald Sharp
7feb884d15 zebra: Fix label manager memory leak
==25402==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x533302 in calloc (/usr/lib/frr/zebra+0x533302)
    #1 0x7fee84cdc80b in qcalloc /home/qlyoung/frr/lib/memory.c:110:27
    #2 0x5a3032 in create_label_chunk /home/qlyoung/frr/zebra/label_manager.c:188:3
    #3 0x5a3c2b in assign_label_chunk /home/qlyoung/frr/zebra/label_manager.c:354:8
    #4 0x5a2a38 in label_manager_get_chunk /home/qlyoung/frr/zebra/label_manager.c:424:9
    #5 0x5a1412 in hook_call_lm_get_chunk /home/qlyoung/frr/zebra/label_manager.c:60:1
    #6 0x5a1412 in lm_get_chunk_call /home/qlyoung/frr/zebra/label_manager.c:81:2
    #7 0x72a234 in zread_get_label_chunk /home/qlyoung/frr/zebra/zapi_msg.c:2026:2
    #8 0x72a234 in zread_label_manager_request /home/qlyoung/frr/zebra/zapi_msg.c:2073:4
    #9 0x73150c in zserv_handle_commands /home/qlyoung/frr/zebra/zapi_msg.c:2688:2

When creating label chunk that has a specified base, we eventually are
calling assign_specific_label_chunk. This function finds the appropriate
list node and deletes it from the lbl_mgr.lc_list but since
the function uses list_delete_node() the deletion function that is
specified for lbl_mgr.lc_list is not called thus dropping the memory.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-01-15 08:18:50 -05:00
David Lamparter
429576883e doc: rename man pages to frr-*
The vrrpd one conflicts with the standalone vrrpd package; also we're
installing daemons to /usr/lib/frr on some systems so they're not on
PATH.

Signed-off-by: David Lamparter <equinox@diac24.net>
2020-01-15 14:05:11 +01:00
David Lamparter
f014634e85
Merge pull request #5677 from qlyoung/fix-my-bfd-screwups
zebra: bfd message handling cleanup foo
2020-01-15 14:04:44 +01:00
Quentin Young
011a713915 zebra: bfd message handling cleanup foo
Previous patches introduced various issues:
- Removal of stream_free() to fix double free caused memleak
- Patch for memleak was incomplete

This should fix it hopefully.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-14 13:57:10 -05:00
Renato Westphal
4a8788360c
Merge pull request #5627 from chiragshah6/mdev
*:  modify two evpn debugs
2020-01-14 13:32:35 -03:00
Mark Stapp
4112bfee9f
Merge pull request #5663 from donaldsharp/nhg_topotests_fixes
Nhg topotests fixes
2020-01-10 18:19:23 -05:00
Donald Sharp
40d86eba41 zebra: Actually add the NLA_F_NESTED flag to our code
The existing usage of the rta_nest and addattr_nest
functions were not adding the NLA_F_NESTED flag
to the type.  As such the new nexthop functionality was
actually looking for this flag, while apparently older
code did not.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-01-10 15:13:36 -05:00
Chirag Shah
c1c292e777 zebra: fix debug in macvlan down event
fix a debug where display parent interface name
only if it exists.

Ticket:CM-27733

Signed-off-by: Chirag Shah <chirag@cumulusnetworks.com>
2020-01-10 11:15:36 -08:00
Quentin Young
4fa2974c44 zebra: fix bfd deregister message memleak
Removing double frees accidentally introduced a memleak

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-09 18:50:18 -05:00
Stephen Worley
9ab0b2a37a lib,zebra: add zapi msg top level error handling
Add error handling for top level failures (not able to
execute command, unable to find vrf for command, etc.)

With this error handling we add a new zapi message type
of ZEBRA_ERROR used when we are unable to properly handle
a zapi command and pass it down into the lower level code.

In the event of this, we reply with a message of type
enum zebra_error_types containing the error type.

The sent packet will look like so:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|             Length            |     Marker    |    Version    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                             VRF ID                            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|            Command            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|            ERROR TYPE         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Also add appropriate hooks for clients to subscribe to for
handling these types of errors.

Signed-off-by: Stephen Worley <sworley@cumulusnetworks.com>
2020-01-08 12:22:29 -05:00
Donald Sharp
f84f7121f6
Merge pull request #5551 from mjstapp/fix_zebra_show_nhg
zebra: make current show nexthop-group cli zebra-specific
2020-01-08 11:54:01 -05:00
Mark Stapp
2553fde18d zebra: make current show nexthop-group cli zebra-specific
There's confusion between the nexthop-group configuration and a
zebra-specific show command. For now, make the zebra show
command string RIB-specific until we're able to unify these
paths.

Signed-off-by: Mark Stapp <mjs@voltanet.io>
2020-01-08 09:01:19 -05:00
Mark Stapp
025f44802b
Merge pull request #5650 from qlyoung/fix-cast-malloc
zebra: remove cast from l3vni XMALLOC
2020-01-07 16:46:29 -05:00
Rafael Zalamena
6e882c5c55
Merge pull request #5624 from qlyoung/fix-zebra-ptm-buffer-overrun
Fix PTM ZAPI stream parsing
2020-01-07 17:02:07 -03:00
Quentin Young
8264e9b74f zebra: remove cast from l3vni XMALLOC
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-07 13:54:41 -05:00
Mark Stapp
58700d822e
Merge pull request #5617 from donaldsharp/zebra_bites
zebra: misc zebra cleanups
2020-01-07 13:41:03 -05:00
Mark Stapp
dba6ddda0f
Merge pull request #5639 from qlyoung/fix-zebra-ptm-double-free
zebra: fix ptm heap double free
2020-01-07 11:20:22 -05:00
Russ White
9e1a733051
Merge pull request #5628 from donaldsharp/rtm_getneigh
zebra: Ignore RTM_GETNEIGH messages from the linux kernel
2020-01-07 10:47:50 -05:00
Renato Westphal
eada87a4ab
Merge pull request #5623 from qlyoung/fix-zebra-rtadv-interval-overflow
zebra: disallow negative rtadv intvl, fix overflow
2020-01-06 23:51:44 -03:00
Renato Westphal
cf84bf26cf
Merge pull request #5625 from qlyoung/fix-zapi-ipset-name-nullterm
zebra: ensure ipset name is null terminated
2020-01-06 23:47:41 -03:00
Renato Westphal
da0047f411
Merge pull request #5614 from qlyoung/fix-zebra-zapi-crashes
Fix zebra zapi crashes
2020-01-06 23:45:49 -03:00
Renato Westphal
2441dc0daa
Merge pull request #5580 from mjstapp/zebra_nhg_debug_category
zebra: add a debug category for nexthops
2020-01-06 23:44:23 -03:00
Donald Sharp
6cc75d2d4e
Merge pull request #5546 from mjstapp/fix_notify_nht
zebra: route changes via notify path should trigger nht
2020-01-06 20:34:24 -05:00
Donald Sharp
c4db327d82
Merge pull request #5553 from slankdev/slankdev-fix-kernel-route-deletion-on-vrf
zebra: fix kernel-route's deletion on vrf
2020-01-06 20:32:16 -05:00
Donald Sharp
f096bae46b zebra: Handle crash when backpointer does not exist
=================================================================
==3058==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x7f5bf3ef7477 bp 0x7ffdfaa20d40 sp 0x7ffdfaa204c8 T0)
==3058==The signal is caused by a READ memory access.
==3058==Hint: address points to the zero page.
    #0 0x7f5bf3ef7476 in memcpy /build/glibc-OTsEL5/glibc-2.27/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:134
    #1 0x4d158a in __asan_memcpy (/usr/lib/frr/zebra+0x4d158a)
    #2 0x7f5bf58da8ad in stream_put /home/qlyoung/frr/lib/stream.c:605:3
    #3 0x67d428 in zsend_ipset_entry_notify_owner /home/qlyoung/frr/zebra/zapi_msg.c:851:2
    #4 0x5c70b3 in zebra_pbr_add_ipset_entry /home/qlyoung/frr/zebra/zebra_pbr.c
    #5 0x68e1bb in zread_ipset_entry /home/qlyoung/frr/zebra/zapi_msg.c:2465:4
    #6 0x68f958 in zserv_handle_commands /home/qlyoung/frr/zebra/zapi_msg.c:2611:3
    #7 0x55666d in main /home/qlyoung/frr/zebra/main.c:309:2
    #8 0x7f5bf3e5db96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #9 0x4311d9 in _start (/usr/lib/frr/zebra+0x4311d9)

the ipset->backpointer was NULL as that the hash lookup failed to find
anything.  Prevent this crash from happening.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-01-06 20:25:54 -05:00
Donald Sharp
0bd371c61e zebra: Refactor _add and _del to use a common function
The decoding of _add and _del functions is practically identical
do a bit of work and make them so.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-01-06 20:25:51 -05:00
Donald Sharp
4824d144b6 zebra: Prevent zebra vxlan remote macip del buffer overflow
=================================================================
==13611==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe9e5c8694 at pc 0x0000004d18ac bp 0x7ffe9e5c8330 sp 0x7ffe9e5c7ae0
WRITE of size 17 at 0x7ffe9e5c8694 thread T0
    #0 0x4d18ab in __asan_memcpy (/usr/lib/frr/zebra+0x4d18ab)
    #1 0x7f16f04bd97f in stream_get2 /home/qlyoung/frr/lib/stream.c:277:2
    #2 0x6410ec in zebra_vxlan_remote_macip_del /home/qlyoung/frr/zebra/zebra_vxlan.c:7718:4
    #3 0x68fa98 in zserv_handle_commands /home/qlyoung/frr/zebra/zapi_msg.c:2611:3
    #4 0x556add in main /home/qlyoung/frr/zebra/main.c:309:2
    #5 0x7f16eea3bb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #6 0x431249 in _start (/usr/lib/frr/zebra+0x431249)

This decode is the result of a buffer overflow because we are
not checking ipa_len.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-01-06 20:22:56 -05:00
Quentin Young
ad1b29c91d zebra: fix ptm heap double free
Don't need to free these, they're freed by the caller.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-06 19:48:08 -05:00
Mark Stapp
193c7b4caf
Merge pull request #5626 from qlyoung/fix-zapi-pbr-foo
zebra: Fix zapi pbr foo, pseudowire ifname termination
2020-01-06 14:59:07 -05:00
Quentin Young
6d097bf15c zebra: free ptm message on error
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-06 12:09:23 -05:00
Mark Stapp
9287b4c50f zebra: route changes via notify path trigger nht and mpls
Changes to a route via the dataplane notify path should
trigger nht and mpls lsp processing.

Signed-off-by: Mark Stapp <mjs@voltanet.io>
2020-01-06 10:09:47 -05:00
Quentin Young
67188ca253 zebra: fix undefined bitshifts in netlink stuff
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-04 14:12:46 -05:00
Donald Sharp
951f8bcbba zebra: Ignore RTM_GETNEIGH messages from the linux kernel
The linux kernel will occassionally send RTM_GETNEIGH when
it expects user space to help in resolution of an ARP entry.
See linux kernel commit:

commit 3e25c65ed085b361cc91a8f02e028f1158c9f255
Author: Tim Gardner <tim.gardner@canonical.com>
Date:   Thu Aug 29 06:38:47 2013 -0600

    net: neighbour: Remove CONFIG_ARPD

Since we don't care about this, let's just safely ignore this
message for the moment.  I imagine in the future we might
care when we implement neighbor managment in the system.

Reported By: Stefan Priebe <s.priebe@profihost.ag>
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2020-01-04 07:45:22 -05:00
Quentin Young
aa8cb96489 zebra: reject ingress packets that are too large
There may be logic to prevent this ever happening earlier in the network
read path, but it doesn't hurt to double check it here, because clearly
deeper paths rely on this being the case.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-03 22:33:56 -05:00
Quentin Young
ab12ca856c zebra: fix multiple bfd buffer issues
Whatever this BFD re-transmission function is had a few problems.

1. Used memcpy instead of the (more concise) stream APIs, which include
   bounds checking.
2. Did not sufficiently check packet sizes.

Actually, 2) is mitigated but is still a problem, because the BFD header
is 2 bytes larger than the "normal" ZAPI header, while the overall
message size remains the same. So if the source message being duplicated
is actually right up against the ZAPI_MAX_PACKET_SIZ, you still can't
fit the whole message into your duplicated message. I have no idea what
the intent was here but at least there's a warning if it happens now.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-03 22:33:52 -05:00
Quentin Young
f223b3d1d4 zebra: null terminate interface name from wire
We read an ifname from the wire but don't make sure its null terminated,
fix it

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-03 22:30:33 -05:00
Quentin Young
8b5c4dce07 zebra: fix iptable memleak, fix free funcs
- Fix iptable freeing code to free malloc'd list
- malloc iptable in zapi handler and use those functions to free it when
  done to fix a linked list memleak

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-03 22:30:20 -05:00
Quentin Young
261462c3aa zebra: ensure ipset name is null terminated
We copy a fixed length buffer from the wire but don't ensure it is null
terminated. Then print it as a c-string. Lul.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-03 21:40:30 -05:00
Quentin Young
40441c3da9 zebra: disallow negative rtadv intvl, fix overflow
- Disallow RA interval < 0
- Fix integer overflow issue converting interval to seconds from
  milliseconds
- Add missing "m" to "ms"

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-03 20:26:09 -05:00
Quentin Young
4719fd7613 zebra: check pbr rule msg for correct afi
further down we hash the src & dst ip, which asserts that the afi is one
of the well known ones, given the field names i assume the correct afis
here are af_inet[6]

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-03 11:38:24 -05:00
Quentin Young
bd2481c4e8 zebra: use correct attr size for netlink enc
a bool is not 4 bytes

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-01-03 02:14:36 -05:00
Philippe Guibert
d7cce42cc7
Merge pull request #5350 from sworleys/Fix-NS-Defualt-Info
zebra: Fix default ns->info should point to default zebra_ns
2019-12-26 17:46:08 +01:00
Mark Stapp
d4b4b70cdc zebra: add a debug category for nexthops
Add a category for nexthops and nh-groups, since we've got
quite a bit of code in there now.

Signed-off-by: Mark Stapp <mjs@voltanet.io>
2019-12-23 08:47:38 -05:00
Hiroki Shirokura
760f39dc08 zebra: fix kernel-route's deletion on vrf
zebra can catch the kernel's route deletion by netlink.
but current FRR can't delete kernel-route on vrf(l3mdev)
when kernel operator delete the route on out-side of FRR.
It looks problem about kernel-route deletion.

This problem is caused around _nexthop_cmp_no_labels(nh1,nh2)
that checks the each nexthop's member 'vrf_id'.
And _nexthop_cmp_no_labels's caller doesn't set the vrf_id
of nexthop structure. This commit fix that case.

Signed-off-by: Hiroki Shirokura <slank.dev@gmail.com>
2019-12-23 15:25:12 +09:00