~cdwertmann/cumulus-frr/+git/trunk:stable/8.4

Branch merges

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related charm recipes

73dbcc9... by David Lamparter <email address hidden> on 2024-05-06

Merge pull request #15934 from FRRouting/mergify/bp/stable/8.4/pr-15628

CVE-2024-31948

28cf10f... by David Lamparter <email address hidden> on 2024-05-06

Merge pull request #15933 from opensourcerouting/8.4-backport-20240506

CVE-2023-47234, CVE-2023-47235, and CVE-2024-27913

bbe8ca4... by Donatas Abraitis <email address hidden> on 2024-03-27

bgpd: Prevent from one more CVE triggering this place

If we receive an attribute that is handled by bgp_attr_malformed(), use
treat-as-withdraw behavior for unknown (or missing to add - if new) attributes.

Signed-off-by: Donatas Abraitis <email address hidden>
(cherry picked from commit babb23b74855e23c987a63f8256d24e28c044d07)

9b0d3e7... by Donatas Abraitis <email address hidden> on 2024-03-27

bgpd: Fix error handling when receiving BGP Prefix SID attribute

Without this patch, we always set the BGP Prefix SID attribute flag without
checking if it's malformed or not. RFC8669 says that this attribute MUST be discarded.

Also, this fixes the bgpd crash when a malformed Prefix SID attribute is received,
with malformed transitive flags and/or TLVs.

Reported-by: Iggy Frankovic <email address hidden>
Signed-off-by: Donatas Abraitis <email address hidden>
(cherry picked from commit ba6a8f1a31e1a88df2de69ea46068e8bd9b97138)

34ec605... by Olivier Dugeon <email address hidden> on 2024-02-26

ospfd: Solved crash in OSPF TE parsing

Iggy Frankovic discovered an ospfd crash when perfomring fuzzing of OSPF LSA
packets. The crash occurs in ospf_te_parse_te() function when attemping to
create corresponding egde from TE Link parameters. If there is no local
address, an edge is created but without any attributes. During parsing, the
function try to access to this attribute fields which has not been created
causing an ospfd crash.

The patch simply check if the te parser has found a valid local address. If not
found, we stop the parser which avoid the crash.

Signed-off-by: Olivier Dugeon <email address hidden>
(cherry picked from commit a73e66d07329d721f26f3f336f7735de420b0183)

b21e7b8... by Donatas Abraitis <email address hidden> on 2023-10-29

bgpd: Ignore handling NLRIs if we received MP_UNREACH_NLRI

If we receive MP_UNREACH_NLRI, we should stop handling remaining NLRIs if
no mandatory path attributes received.

In other words, if MP_UNREACH_NLRI received, the remaining NLRIs should be handled
as a new data, but without mandatory attributes, it's a malformed packet.

In normal case, this MUST not happen at all, but to avoid crashing bgpd, we MUST
handle that.

Reported-by: Iggy Frankovic <email address hidden>
Signed-off-by: Donatas Abraitis <email address hidden>
(cherry picked from commit c37119df45bbf4ef713bc10475af2ee06e12f3bf)

3f79135... by Donatas Abraitis <email address hidden> on 2023-10-27

bgpd: Treat EOR as withdrawn to avoid unwanted handling of malformed attrs

Treat-as-withdraw, otherwise if we just ignore it, we will pass it to be
processed as a normal UPDATE without mandatory attributes, that could lead
to harmful behavior. In this case, a crash for route-maps with the configuration
such as:

```
router bgp 65001
 no bgp ebgp-requires-policy
 neighbor 127.0.0.1 remote-as external
 neighbor 127.0.0.1 passive
 neighbor 127.0.0.1 ebgp-multihop
 neighbor 127.0.0.1 disable-connected-check
 neighbor 127.0.0.1 update-source 127.0.0.2
 neighbor 127.0.0.1 timers 3 90
 neighbor 127.0.0.1 timers connect 1
 !
 address-family ipv4 unicast
  neighbor 127.0.0.1 addpath-tx-all-paths
  neighbor 127.0.0.1 default-originate
  neighbor 127.0.0.1 route-map RM_IN in
 exit-address-family
exit
!
route-map RM_IN permit 10
 set as-path prepend 200
exit
```

Send a malformed optional transitive attribute:

```
import socket
import time

OPEN = (b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
b"\xff\xff\x00\x62\x01\x04\xfd\xea\x00\x5a\x0a\x00\x00\x01\x45\x02"
b"\x06\x01\x04\x00\x01\x00\x01\x02\x02\x02\x00\x02\x02\x46\x00\x02"
b"\x06\x41\x04\x00\x00\xfd\xea\x02\x02\x06\x00\x02\x06\x45\x04\x00"
b"\x01\x01\x03\x02\x0e\x49\x0c\x0a\x64\x6f\x6e\x61\x74\x61\x73\x2d"
b"\x70\x63\x00\x02\x04\x40\x02\x00\x78\x02\x09\x47\x07\x00\x01\x01"
b"\x80\x00\x00\x00")

KEEPALIVE = (b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
b"\xff\xff\xff\xff\xff\xff\x00\x13\x04")

UPDATE = bytearray.fromhex("ffffffffffffffffffffffffffffffff002b0200000003c0ff00010100eb00ac100b0b001ad908ac100b0b")

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('127.0.0.2', 179))
s.send(OPEN)
data = s.recv(1024)
s.send(KEEPALIVE)
data = s.recv(1024)
s.send(UPDATE)
data = s.recv(1024)
time.sleep(100)
s.close()
```

Reported-by: Iggy Frankovic <email address hidden>
Signed-off-by: Donatas Abraitis <email address hidden>
(cherry picked from commit 6814f2e0138a6ea5e1f83bdd9085d9a77999900b)

44c0ea2... by David Lamparter <email address hidden> on 2024-05-06

Merge pull request #15932 from opensourcerouting/8.4-fix-build

6365b6c... by Donatas Abraitis <email address hidden> on 2023-06-13

bgpd: Use enum bgp_create_error_code as argument in header

```
bgpd/bgp_vty.c:865:5: warning: conflicting types for ‘bgp_vty_return’ due to enum/integer mismatch; have ‘int(struct vty *, enum bgp_create_error_code)’ [-Wenum-int-mismatch]
  865 | int bgp_vty_return(struct vty *vty, enum bgp_create_error_code ret)
      | ^~~~~~~~~~~~~~
In file included from ./bgpd/bgp_mplsvpn.h:15,
                 from bgpd/bgp_vty.c:48:
./bgpd/bgp_vty.h:148:12: note: previous declaration of ‘bgp_vty_return’ with type ‘int(struct vty *, int)’
  148 | extern int bgp_vty_return(struct vty *vty, int ret);
      | ^~~~~~~~~~~~~~
```

Fixing stuff regarding GCC13.

Signed-off-by: Donatas Abraitis <email address hidden>
(cherry picked from commit cc280c74cea8183b31f60ef16bda617eca364c9d)

6251f1d... by David Lamparter <email address hidden> on 2023-09-16

ospf6d: fix uninitialized warnings

GCC 13.2.0 complains:

```
ospf6d/ospf6_intra.c:139:25: error: ‘json_arr’ may be used uninitialized [-Werror=maybe-uninitialized]
ospf6d/ospf6_intra.c:485:20: error: ‘json_arr’ may be used uninitialized [-Werror=maybe-uninitialized]
```

Signed-off-by: David Lamparter <email address hidden>
(cherry picked from commit 55bbef1356418168833fba98d3e7d4691f8f1408)