lib: use "protocol-independed API" from RFC3678, if that is available(This commit is based on the patch from BZ#420, and should fix that bug.)
* configure.ac: detect availability of that API
* sockopt.c (setsockopt_ipv4_multicast): use it for join/leave IPv4
multicast groups
lib: futher simplification of setsockopt_ipv4_multicast()* sockopt.c (setsockopt_ipv4_multicast): check for wrong optname with
assert(), rather than return an error.
lib: simplify interface of setsockopt_multicast_ipv4().* sockopt.[ch] (setsockopt_ipv4_multicast): ifindex is now mandatory (all
non-ancient OSes can use it anyway), and if_addr parameter (the address
of the interface) is now gone. (setsockopt_ipv4_multicast_if):
IP_MULTICAST_IF processing moved to this new function
* ospf_network.c (ospf_if_add_allspfrouters, ospf_if_drop_allspfrouters,
ospf_if_add_alldrouters, ospf_if_drop_alldrouters, o...
bgpd: check ATOMIC_AGGREGATE attr flags (BZ#678)* bgp_attr.c
* bgp_attr_atomic(): accept extra argument, add checks for
"optional", "transitive" and "partial" bits, log each error
condition independently
* bgp_attr_parse(): provide extra argument
bgpd: check LOCAL_PREF attribute flags (BZ#674)* bgp_attr.c
* bgp_attr_local_pref(): accept extra argument, add checks for
"optional" and "transitive" bits, log each error condition
independently
* bgp_attr_parse(): provide extra argument
ospf6d: fix crash on filter-list handling (BZ#530)This essentially merges the fix available from Debian build of Quagga.
* ospf6_area.c
* area_filter_list(): use correct argv indices
* no_area_filter_list(): idem
configure: fix FreeBSD header detection (BZ#408)This change is based on Xavier Beaudouin's patch (which fixes detection
of 3 config.h macros on FreeBSD without any impact to Linux build of
Quagga) and FreeBSD port patch (which fixes 5 config.h macros, but
breaks the Linux build), it fixes 5 macros and works for both FreeBSD 8
and Linux.
isisd: fix crash on "no router isis" (BZ#536)The crash is due to threads accessing data that gets destroyed
during the removal of the configuration.
* isis_circuit.c: Destroy adjacencies to stop adjacency expiry thread.
Stop PSNP threads.
* isisd.c: Change state of circuit back to INIT and reassign the
circuit structure to isis->init_circ_list rather than destroying
the circuit data structure. Stop SPF threads. Stop LSP generation
...
zebra: fix loss of metric for Linux routes* rt_netlink.c
* netlink_route_change(): fetch metric information like
netlink_routing_table() does and pass it further
ospfd: remove useless RFC1583 check* ospf_route.c: Function ospf_asbr_route_cmp is called uniquely from
ospf_route_cmp() when the flag OSPF_RFC1583_COMPATIBLE is not set.
Therefore, the check that the flag is set doesn't make sense at all
and it can consequently be removed without doing any harm.
Signed-off-by: Alexandre Chappuis <alc@open.ch>
Signed-off-by: Roman Hoog Antink <rha@open.ch>
doc: add missing word* ospfd.texi: Adjust meaning of the rfc1583compatibility option in
order to match the RFC specification and the actual source code.
ospf6d: CVE-2011-3323 (fortify packet reception)This vulnerability (CERT-FI #514840) was reported by CROSS project.
ospf6d processes IPv6 prefix structures in incoming packets without
verifying that the declared prefix length is valid. This leads to a
crash
caused by out of bounds memory access.
* ospf6_abr.h: new macros for size/alignment validation
* ospf6_asbr.h: idem
* ospf6_intra.h: idem
* ospf6_lsa.h: idem
* ospf6_message.h: idem
* o...
ospf6d: CVE-2011-3324 (DD LSA assertion)This vulnerability (CERT-FI #514839) was reported by CROSS project.
When Database Description LSA header list contains trailing zero octets,
ospf6d tries to process this data as an LSA header. This triggers an
assertion in the code and ospf6d shuts down.
* ospf6_lsa.c
* ospf6_lsa_is_changed(): handle header-only argument(s)
appropriately, do not treat LSA length underrun as a fatal error.
ospfd: CVE-2011-3325 part 2 (OSPF pkt type segv)This vulnerability (CERT-FI #514838) was reported by CROSS project.
The error is reproducible only when ospfd debugging is enabled:
* debug ospf packet all
* debug ospf zebra
When incoming packet header type field is set to 0x0a, ospfd will crash.
* ospf_packet.c
* ospf_verify_header(): add type field check
* ospf_read(): perform input checks early
ospfd: CVE-2011-3325 part 1 (OSPF header underrun)This vulnerability (CERT-FI #514838) was reported by CROSS project.
When only 14 first bytes of a Hello packet is delivered, ospfd crashes.
* ospf_packet.c
* ospf_read(): add size check
ospfd: CVE-2011-3326 (uknown LSA type segfault)This vulnerability (CERT-FI #514837) was reported by CROSS project.
They have also suggested a fix to the problem, which was found
acceptable.
Quagga ospfd does not seem to handle unknown LSA types in a Link State
Update message correctly. If LSA type is something else than one
supported
by Quagga, the default handling of unknown types leads to an error.
* ospf_flood.c
* ospf_flood(): check...
bgpd: CVE-2011-3327 (ext. comm. buffer overflow)This vulnerability (CERT-FI #513254) was reported by CROSS project.
They have also suggested a fix to the problem, which was found
acceptable.
The problem occurs when bgpd receives an UPDATE message containing
255 unknown AS_PATH attributes in Path Attribute Extended Communities.
This causes a buffer overlow in bgpd.
* bgp_ecommunity.c
* ecommunity_ecom2str(): perform size check earlier
ospf6d: add missing includeTwo extern declarations in ospf6_abr.h are based on struct ospf6_route,
which may not be available at the time ospf6_abr.h is included. This may
lead to warnings after including ospf6_abr.h just for the structures
defined in it.
Merge branch 'attr-errors'Contains BGP fixes:
- set extcommunity crash: tihs patch tries to make the refcounting more robust
but does not fully solve the problem, sadly.
- BGP attribute error handling: Little testing.
ospf6d: copy "mtu-ignore" option from ospfd"mtu-ignore" is an option ospfd used to mimic from the vendor's
implementation, now ospf6d will also implement it.
* ospf6_interface.h: extend ospf6_interface structure by one flag
* ospf6_interface.c: (ipv6_ospf6_mtu_ignore, no_ipv6_ospf6_mtu_ignore):
new declarations; (ospf6_interface_create): show initial value for
consistency; (ospf6_interface_show): print flag status
* ospf6_message.c...
bgpd: trivial format / warning fixes* bgp_aspath.c: (assegments_parse) just bail early if length doesn't match
and fix the formatting.
* bgp_network.c: add include needed for set_nonblocking
* bgp_packet.c: formatting
ospf: Fix OSPF API and ospf-te LSA refreshers to match recent API change* ospf_apiserver.{c,h}: (ospf_apiserver_lsa_refresher) refreshers must now
return the refreshed LSA.
* ospf_te.{c,h}: (ospf_mpls_te_lsa_refresh) ditto
* ospf_api.c: trivial compiler warning fix
ospf6d: fix crash if zebra_interface_state_read can't find interface* ospf6_zebra.c: (ospf6_zebra_if_state_update) zebra_interface_state_read
may return NULL, if it can't find an interface, deal with it.
ospf6d: fix crash if zebra_interface_state_read can't find interface* ospf6_zebra.c: (ospf6_zebra_if_state_update) zebra_interface_state_read
may return NULL, if it can't find an interface, deal with it.
bgpd: fix memory leak when deleting a community* bgp_routemap.c: (route_set_community_delete) When deleting a
community in a route-map the old community was being orphaned. Like
the description of the same code in route_set_community, this is a
hack, not a true fix.
Denis Ovsienko
Paul Jakma
Greg Troxel
