Commit Graph

33858 Commits

Author SHA1 Message Date
Mark Stapp
d1e11d48d4
Merge pull request #14862 from louis-6wind/fix-ctx-iptable
zebra: fix dplane_ctx_iptable use-after-free
2023-11-22 15:47:47 -05:00
Louis Scalbert
45140bb9e1 zebra: fix dplane_ctx_iptable use-after-free
Fix a crash because a use-after-free.

> =================================================================
> ==1249835==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000074210 at pc 0x7fa1b42a652c bp 0x7ffc477a2aa0 sp 0x7ffc477a2a98
> READ of size 8 at 0x604000074210 thread T0
>     #0 0x7fa1b42a652b in list_delete_all_node git/frr/lib/linklist.c:299:20
>     #1 0x7fa1b42a683f in list_delete git/frr/lib/linklist.c:312:2
>     #2 0x5ee515 in dplane_ctx_free_internal git/frr/zebra/zebra_dplane.c:858:4
>     #3 0x5ee59c in dplane_ctx_free git/frr/zebra/zebra_dplane.c:884:2
>     #4 0x5ee544 in dplane_ctx_fini git/frr/zebra/zebra_dplane.c:905:2
>     #5 0x7045c0 in rib_process_dplane_results git/frr/zebra/zebra_rib.c:4928:4
>     #6 0x7fa1b4434fb2 in event_call git/frr/lib/event.c:1970:2
>     #7 0x7fa1b42a0ccf in frr_run git/frr/lib/libfrr.c:1213:3
>     #8 0x556808 in main git/frr/zebra/main.c:488:2
>     #9 0x7fa1b3d0bd09 in __libc_start_main csu/../csu/libc-start.c:308:16
>     #10 0x4453e9 in _start (/usr/lib/frr/zebra+0x4453e9)
>
> 0x604000074210 is located 0 bytes inside of 40-byte region [0x604000074210,0x604000074238)
> freed by thread T0 here:
>     #0 0x4bf1dd in free (/usr/lib/frr/zebra+0x4bf1dd)
>     #1 0x7fa1b42df0c0 in qfree git/frr/lib/memory.c:130:2
>     #2 0x7fa1b42a68ce in list_free_internal git/frr/lib/linklist.c:24:2
>     #3 0x7fa1b42a6870 in list_delete git/frr/lib/linklist.c:313:2
>     #4 0x5ee515 in dplane_ctx_free_internal git/frr/zebra/zebra_dplane.c:858:4
>     #5 0x5ee59c in dplane_ctx_free git/frr/zebra/zebra_dplane.c:884:2
>     #6 0x5ee544 in dplane_ctx_fini git/frr/zebra/zebra_dplane.c:905:2
>     #7 0x7045c0 in rib_process_dplane_results git/frr/zebra/zebra_rib.c:4928:4
>     #8 0x7fa1b4434fb2 in event_call git/frr/lib/event.c:1970:2
>     #9 0x7fa1b42a0ccf in frr_run git/frr/lib/libfrr.c:1213:3
>     #10 0x556808 in main git/frr/zebra/main.c:488:2
>     #11 0x7fa1b3d0bd09 in __libc_start_main csu/../csu/libc-start.c:308:16
>
> previously allocated by thread T0 here:
>     #0 0x4bf5d2 in calloc (/usr/lib/frr/zebra+0x4bf5d2)
>     #1 0x7fa1b42dee18 in qcalloc git/frr/lib/memory.c:105:27
>     #2 0x7fa1b42a3784 in list_new git/frr/lib/linklist.c:18:9
>     #3 0x6d165f in pbr_iptable_alloc_intern git/frr/zebra/zebra_pbr.c:1015:29
>     #4 0x7fa1b426ad1f in hash_get git/frr/lib/hash.c:147:13
>     #5 0x6d15f2 in zebra_pbr_add_iptable git/frr/zebra/zebra_pbr.c:1030:13
>     #6 0x5db2a3 in zread_iptable git/frr/zebra/zapi_msg.c:3759:3
>     #7 0x5e365d in zserv_handle_commands git/frr/zebra/zapi_msg.c:4039:3
>     #8 0x7e09fc in zserv_process_messages git/frr/zebra/zserv.c:520:3
>     #9 0x7fa1b4434fb2 in event_call git/frr/lib/event.c:1970:2
>     #10 0x7fa1b42a0ccf in frr_run git/frr/lib/libfrr.c:1213:3
>     #11 0x556808 in main git/frr/zebra/main.c:488:2
>     #12 0x7fa1b3d0bd09 in __libc_start_main csu/../csu/libc-start.c:308:16

Fixes: 1cc380679e ("zebra: Actually free all memory associated ctx->u.iptable.interface_name_list")
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
2023-11-22 18:32:24 +01:00
Donatas Abraitis
af22ff0bd5
Merge pull request #14830 from fdumontet6WIND/snmpv2
tests: bgp_snmp_bgp4v2mib fix some random failure
2023-11-22 14:45:15 +02:00
Christian Hopps
79b7b8df1f
Merge pull request #14815 from idryzhov/lib-mgmt-deps
Remove lib dependency on mgmtd
2023-11-22 10:51:40 +01:00
Francois Dumontet
a5bee822f4 tests: bgp_snmp_bgp4v2mib fix some random failure
avoid to consider additionnal traps randomly received later

Signed-off-by: Francois Dumontet <francois.dumontet@6wind.com>
2023-11-22 07:24:00 +00:00
Donatas Abraitis
b84476e0bb
Merge pull request #14850 from donaldsharp/IFNAMSIZ_GET_YOUR_SHIT_TOGETHER
*: Let's use the native IFNAMSIZ instead of INTERFACE_NAMSIZ
2023-11-22 09:13:58 +02:00
Donald Sharp
01af05fbd5
Merge pull request #14834 from opensourcerouting/zclient-nexthop-update
*: move common NHT update decoding bits into lib/
2023-11-21 10:56:47 -05:00
Donald Sharp
b41f7b1b8e
Merge pull request #14845 from opensourcerouting/fix/bgp_conditional_double_free
bgpd: Prevent USE case for conditional advertisements with `set` actions
2023-11-21 10:48:33 -05:00
Russ White
86fb83c68b
Merge pull request #14757 from ryndia/aspath_fix
bgpd:aspath leak fix
2023-11-21 10:39:59 -05:00
Donald Sharp
07b91ca096 *: Let's use the native IFNAMSIZ instead of INTERFACE_NAMSIZ
INTERFACE_NAMSIZ is just a redefine of IFNAMSIZ and IFNAMSIZ
is the standard for interface name length on all platforms
that FRR currently compiles on.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 08:08:29 -05:00
Donatas Abraitis
77ff93b8f5
Merge pull request #14710 from teletajp/fix_show_ospf_gr_helper_cmd
ospfd:fix show_ip_ospf_gr_helper
2023-11-21 11:39:31 +02:00
Donatas Abraitis
d410587bab bgpd: Flush attrs only if we don't have to announce a conditional route
To avoid USE:

```
==587645==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000074050 at pc 0x55b34337d96c bp 0x7ffda59bb4c0 sp 0x7ffda59bb4b0
READ of size 8 at 0x604000074050 thread T0
    0 0x55b34337d96b in bgp_attr_flush bgpd/bgp_attr.c:1289
    1 0x55b34368ef85 in bgp_conditional_adv_routes bgpd/bgp_conditional_adv.c:111
    2 0x55b34368ff58 in bgp_conditional_adv_timer bgpd/bgp_conditional_adv.c:301
    3 0x7f7d41cdf81c in event_call lib/event.c:1980
    4 0x7f7d41c1da37 in frr_run lib/libfrr.c:1214
    5 0x55b343371e22 in main bgpd/bgp_main.c:510
    6 0x7f7d41517082 in __libc_start_main ../csu/libc-start.c:308
    7 0x55b3433769fd in _start (/usr/lib/frr/bgpd+0x2e29fd)

0x604000074050 is located 0 bytes inside of 40-byte region [0x604000074050,0x604000074078)
freed by thread T0 here:
    #0 0x7f7d4207540f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
    1 0x55b343396afd in community_free bgpd/bgp_community.c:41
    2 0x55b343396afd in community_free bgpd/bgp_community.c:28
    3 0x55b343397373 in community_intern bgpd/bgp_community.c:458
    4 0x55b34337bed4 in bgp_attr_intern bgpd/bgp_attr.c:967
    5 0x55b34368165b in bgp_advertise_attr_intern bgpd/bgp_advertise.c:106
    6 0x55b3435277d7 in bgp_adj_out_set_subgroup bgpd/bgp_updgrp_adv.c:587
    7 0x55b34368f36b in bgp_conditional_adv_routes bgpd/bgp_conditional_adv.c:125
    8 0x55b34368ff58 in bgp_conditional_adv_timer bgpd/bgp_conditional_adv.c:301
    9 0x7f7d41cdf81c in event_call lib/event.c:1980
    10 0x7f7d41c1da37 in frr_run lib/libfrr.c:1214
    11 0x55b343371e22 in main bgpd/bgp_main.c:510
    12 0x7f7d41517082 in __libc_start_main ../csu/libc-start.c:308

previously allocated by thread T0 here:
    #0 0x7f7d42075a06 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:153
    1 0x7f7d41c3c28e in qcalloc lib/memory.c:105
    2 0x55b3433976e8 in community_dup bgpd/bgp_community.c:514
    3 0x55b34350273a in route_set_community bgpd/bgp_routemap.c:2589
    4 0x7f7d41c96c06 in route_map_apply_ext lib/routemap.c:2690
    5 0x55b34368f2d8 in bgp_conditional_adv_routes bgpd/bgp_conditional_adv.c:107
    6 0x55b34368ff58 in bgp_conditional_adv_timer bgpd/bgp_conditional_adv.c:301
    7 0x7f7d41cdf81c in event_call lib/event.c:1980
    8 0x7f7d41c1da37 in frr_run lib/libfrr.c:1214
    9 0x55b343371e22 in main bgpd/bgp_main.c:510
    10 0x7f7d41517082 in __libc_start_main ../csu/libc-start.c:308
```

And also a crash:

```
(gdb) bt
0  raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
1  0x00007ff3b7048ce0 in core_handler (signo=6, siginfo=0x7ffc8cf724b0, context=<optimized out>)
    at lib/sigevent.c:246
2  <signal handler called>
3  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
4  0x00007ff3b6bb8859 in __GI_abort () at abort.c:79
5  0x00007ff3b6c2326e in __libc_message (action=action@entry=do_abort,
    fmt=fmt@entry=0x7ff3b6d4d298 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
6  0x00007ff3b6c2b2fc in malloc_printerr (
    str=str@entry=0x7ff3b6d4f628 "double free or corruption (fasttop)") at malloc.c:5347
7  0x00007ff3b6c2cc65 in _int_free (av=0x7ff3b6d82b80 <main_arena>, p=0x555c8fa70a10, have_lock=0)
    at malloc.c:4266
8  0x0000555c8da94bd3 in community_free (com=0x7ffc8cf72e70) at bgpd/bgp_community.c:41
9  community_free (com=com@entry=0x7ffc8cf72e70) at bgpd/bgp_community.c:28
10 0x0000555c8da8afc1 in bgp_attr_flush (attr=attr@entry=0x7ffc8cf73040) at bgpd/bgp_attr.c:1290
11 0x0000555c8dbc0760 in bgp_conditional_adv_routes (peer=peer@entry=0x555c8fa627c0,
    afi=afi@entry=AFI_IP, safi=SAFI_UNICAST, table=table@entry=0x555c8fa510b0, rmap=0x555c8fa71cb0,
    update_type=UPDATE_TYPE_ADVERTISE) at bgpd/bgp_conditional_adv.c:111
12 0x0000555c8dbc0b75 in bgp_conditional_adv_timer (t=<optimized out>)
    at bgpd/bgp_conditional_adv.c:301
13 0x00007ff3b705b84c in event_call (thread=thread@entry=0x7ffc8cf73440) at lib/event.c:1980
14 0x00007ff3b700bf98 in frr_run (master=0x555c8f27c090) at lib/libfrr.c:1214
15 0x0000555c8da85f05 in main (argc=<optimized out>, argv=0x7ffc8cf736a8) at bgpd/bgp_main.c:510
```

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-11-21 10:49:36 +02:00
Donatas Abraitis
8eba97d395 tests: Set community for conditionally advertised routes
Just to make sure we don't crash bgpd with double-free if an existing route
already exists.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-11-21 10:49:36 +02:00
Donatas Abraitis
b9228127df
Merge pull request #14835 from donaldsharp/multipath_evpn_encap_attr
zebra: Fix fpm multipath encap addition
2023-11-21 09:08:40 +02:00
Donald Sharp
83cbdcc267
Merge pull request #14813 from idryzhov/vtysh-file-lock
vtysh: clean vtysh_file_locked when exiting config node
2023-11-20 15:18:42 -05:00
Donald Sharp
9ec7aa95f5
Merge pull request #14833 from opensourcerouting/fix/frrtrace_bmp
bgpd: Fix frrtrace arguments for bmp_eor tracing
2023-11-20 15:17:13 -05:00
Donald Sharp
c1420682c4
Merge pull request #14823 from opensourcerouting/isis-adj-cleanup
isisd: remove unused router_address fields
2023-11-20 10:44:25 -05:00
Donald Sharp
e05bb2ddbf
Merge pull request #14825 from mjstapp/fix_opcode_switches
zebra: reduce number of switch statements with dplane opcodes
2023-11-20 10:43:16 -05:00
Christian Hopps
9c1b357bb6
Merge pull request #14831 from opensourcerouting/libyang-multi-err-ifdef
lib: use LYD_VALIDATE_MULTI_ERROR only if available
2023-11-20 15:56:16 +01:00
Donald Sharp
6b23ece88b zebra: Fix fpm multipath encap addition
The fpm code path in building a ecmp route for evpn has
a bug that caused it to not add the encap attribute to
the netlink message.  See #f0f7b285b99dbd971400d33feea007232c0bd4a9
for the single path case being fixed.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-20 09:47:31 -05:00
David Lamparter
03c4375a4a lib: make zapi_nexthop_update_decode private
zapi_nexthop_update_decode() is no longer called externally.

Also move the comment to zclient->nexthop_update where it now belongs.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-20 11:28:39 +01:00
David Lamparter
409a693165 bgpd: use zclient->nexthop_update
Same as before.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-20 11:28:35 +01:00
David Lamparter
f115dc5889 ospf6d: use zclient->nexthop_update
Same as before.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-20 11:28:23 +01:00
David Lamparter
53a82c1c2f ospfd: use zclient->nexthop_update
Same as before.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-20 11:28:20 +01:00
David Lamparter
088250ff04 staticd: use zclient->nexthop_update
Same as before.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-20 11:24:28 +01:00
David Lamparter
94fc9c04fc sharpd: use zclient->nexthop_update
Same as above.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-20 11:24:28 +01:00
David Lamparter
ac18d56a0b pimd: use zclient->nexthop_update
Same as before, use shared nexthop decode function.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-20 11:24:28 +01:00
David Lamparter
20007eb773 pbrd: use zclient->nexthop_update
Have the library decode the nexthop.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-20 11:24:28 +01:00
David Lamparter
b951e59300 lib: add common NHT update decode callback
All users of `ZEBRA_NEXTHOP_UPDATE` check the VRF and then call into
`zapi_nexthop_update_decode` before further processing.  Begin moving
this into common code in lib/.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-20 11:24:21 +01:00
Donatas Abraitis
88db20c4c8 bgpd: Fix frrtrace arguments for bmp_eor tracing
Arguments number was wrong.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-11-20 12:21:13 +02:00
David Lamparter
75a7b5b6b6 lib: use LYD_VALIDATE_MULTI_ERROR only if available
LYD_VALIDATE_MULTI_ERROR was added in libyang 2.1.36.  The currently
enforced minimum of libyang is 2.0.0.  Stick an #ifdef around it.

Fixes: 51a2a4b3f4 ("lib: print all errors when validating a config")
Cc: Igor Ryzhov <iryzhov@nfware.com>
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-20 10:32:52 +01:00
mobash-rasool
f9012ed5cf
Merge pull request #14824 from opensourcerouting/ospf6-p2xp-fixuninit
ospf6d: fix uninitialized value warning in p2xp
2023-11-19 22:28:51 +05:30
Christian Hopps
94659cf9e5
Merge pull request #14657 from idryzhov/mgmtd-remove-batch-ids
mgmtd, lib: remove batch ids from all messages
2023-11-18 05:59:44 +01:00
Donatas Abraitis
df4e4f82ce
Merge pull request #14827 from qlyoung/doc-restore-frr-theme
doc: fix docs path to requirements.txt
2023-11-17 23:03:37 +02:00
Quentin Young
9d963dc3f1 doc: fix docs path to requirements.txt
Signed-off-by: Quentin Young <qlyoung@qlyoung.net>
2023-11-17 12:11:09 -05:00
Donatas Abraitis
d9c606aebb
Merge pull request #14806 from mxyns/master
bgpd: bmp bgp asn & router_id coverity fix
2023-11-17 16:34:22 +02:00
David Lamparter
484608f065 ospf6d: fix uninitialized value warning in p2xp
GCC is complaining prev_cost may be used uninitialized.  It really
can't, but let's get rid of the warning.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-17 14:42:28 +01:00
Mark Stapp
bb3faf1b95 zebra: reduce number of switch statements with dplane opcodes
Replace several switch blocks that contain every dplane opcode
with simpler sets of if()s. In these cases the code only
uses a couple of opcodes.

Signed-off-by: Mark Stapp <mjs@labn.net>
2023-11-17 08:40:58 -05:00
Donald Sharp
f671c92857
Merge pull request #14814 from idryzhov/staticd-debug
staticd: fix debug commands
2023-11-17 07:25:40 -05:00
Igor Ryzhov
057f442309 lib, mgmtd: remove function duplication
And also remove lib dependency on mgmtd.

Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
2023-11-17 11:27:03 +01:00
Igor Ryzhov
c0568d4f9e lib, mgmtd: move common header to lib
The common header included from lib and other daemons should be located
in lib, not in mgmt directory.

Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
2023-11-17 11:27:03 +01:00
Donatas Abraitis
51d14b910d
Merge pull request #14812 from qlyoung/doc-restore-frr-theme
doc: restore frr docs theme
2023-11-17 12:07:30 +02:00
Igor Ryzhov
649f04d679 staticd: fix debug commands
Debug commands should be installed in staticd, not in mgmtd.

Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
2023-11-17 03:18:28 +01:00
Igor Ryzhov
40def43dfa vtysh: clean vtysh_file_locked when exiting config node
The flag should be cleared to make sure it's not reused the next time
we enter the config node.

Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
2023-11-17 03:16:36 +01:00
Quentin Young
5b7563c7e9 doc: restore frr docs theme
Signed-off-by: Quentin Young <qlyoung@qlyoung.net>
2023-11-16 18:44:28 -05:00
David Lamparter
c1f665a075 isisd: remove unused router_address fields
These were added in e38e0df01a but never used anywhere.  Also the code
grabs any random /32 or /128 that is directly connected to the adjacent
router, which may not even be an address of that router itself.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-16 17:09:38 +01:00
Donatas Abraitis
c599ed56fc
Merge pull request #14807 from Keelan10/fix-babel-int-delete-leak
babeld: Free IPv4 Memory in babel_interface_free
2023-11-16 14:54:03 +02:00
Keelan10
419cc234c1 babeld: Free IPv4 Memory in babel_interface_free
Ensure proper memory cleanup by freeing the `babel_ifp->ipv4` when
babel interface is deleted. This prevents memory leaks.

The ASan leak log for reference:

```
***********************************************************************************
Address Sanitizer Error detected in all_protocol_startup.test_all_protocol_startup/r1.asan.babeld.4141

=================================================================
==4141==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 40 byte(s) in 10 object(s) allocated from:
    #0 0x7f1cde6a9b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40)
    #1 0x562b8eff328d in babel_interface_address_add babeld/babel_interface.c:112
    #2 0x7f1cde1772cb in zclient_read lib/zclient.c:4425
    #3 0x7f1cde14729c in event_call lib/event.c:1980
    #4 0x7f1cde08a3bf in frr_run lib/libfrr.c:1214
    #5 0x562b8eff481b in main babeld/babel_main.c:202
    #6 0x7f1cdd8acc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)

SUMMARY: AddressSanitizer: 40 byte(s) leaked in 10 allocation(s).
***********************************************************************************
```

Signed-off-by: Keelan Cannoo <keelan.cannoo@icloud.com>
2023-11-16 02:09:11 +04:00
Donald Sharp
93379c01d1
Merge pull request #14792 from mobash-rasool/fixes2
pim6d: Fix memory leaks
2023-11-15 13:19:53 -05:00
Donald Sharp
520bb404f5
Merge pull request #14800 from idryzhov/nb-validate-errors
Print all errors when validating NB configuration
2023-11-15 13:19:11 -05:00