| Age | Commit message (Collapse) | Author |
|---|
|
|
|
To set the TOS bits on TCP connections, platforms that restrict
capabilities need the priv level to be raised before the sockopt
is set, and this requires the ZCAP_NET_ADMIN priv.
* bgp_main.c: update _caps_p to include ZCAP_NET_ADMIN
* bgp_network.c
* bgp_connect(): request ZPRIVS_RAISE/ZPRIVS_LOWER
* bgp_listener(): request ZPRIVS_RAISE earlier
|
|
|
|
Commit 05a4936b713b9882171d0f7fb20b8439df23939e fixed some of the
attributes involved, but not all. This commit should do it.
* bgp_attr.c
* bgp_attr_originator_id()
* bgp_attr_cluster_list()
* bgp_mp_reach_parse()
* bgp_mp_unreach_parse()
|
|
Older versions of Quagga/Zebra would output a value in MRT table
dump files for "uptime" aka "ORIGINATED" that was a WALL clock
value. Given that uptime is now internally a bgp_clock MONOTONIC
value, the output in the MRT files is showing up as monotonic.
Note: time of MRT dump is still recorded correctly as a
time() based value, so we haven't lost that value.
Proposal is to correct the uptime output on the vty and in the
MRT files to again display something more akin to WALL time.
* bgp_dump.c: (bgp_dump_routes_func) add conditional correction
* bgp_route.c: (route_vty_out_detail) make correction conditional, move
variable declaration to beginning of the function
|
|
* bgp_attr.[ch]
* bgp_mp_reach_parse(): add extra arguments and a uniform flag
check block
* bgp_mp_unreach_parse(): idem
* bgp_attr_parse(): provide extra arguments
* bgp_mp_attr_test.c
* parse_test(): justify respective calls
|
|
* bgp_attr.c
* bgp_attr_parse(): provide extra argument to bgp_attr_aggregator()
* bgp_attr_local_pref(): use bgp_notify_send_with_data()
* bgp_attr_atomic(): idem
* bgp_attr_aggregator(): idem
|
|
|
|
* bgp_attr.c
* bgp_attr_cluster_list(): accept extra argument, add checks for
"optional", "transitive" and "partial" bits, log each error
condition independently
* bgp_attr_parse(): provide extra arguments
|
|
* bgp_attr.c
* bgp_attr_originator_id(): accept extra argument, add checks for
"optional", "transitive" and "partial" bits, log each error
condition independently
* bgp_attr_parse(): provide extra arguments
|
|
Commit 2febf323411c1aed9d7694898f852ce2ef36a7e5 assumed every flag
bit except optional/transitive/partial unset, which at times could
not be true for "extended length" bit.
* bgp_attr.c
* bgp_attr_origin(): exclude BGP_ATTR_FLAG_EXTLEN from comparison
* bgp_attr_nexthop(): idem
* bgp_attr_med(): idem
* bgp_attr_local_pref(): idem
* bgp_attr_atomic(): idem
|
|
Do not check each of the Optional/Transitive/Partial attribute
flag bits, when their only valid combination is known in advance,
but still perform bit-deep error message logging. This change
assumes unused (low-order) 4 bits of the flag octet cleared.
* bgp_attr.c
* bgp_attr_origin(): rewrite check
* bgp_attr_nexthop(): idem
* bgp_attr_med(): idem
* bgp_attr_local_pref(): idem
* bgp_attr_atomic(): idem
|
|
ORIGIN handling function used to have "partial" bit check and recent
commits added it for NEXT_HOP, MULTI_EXIT_DISC and ATOMIC_AGGREGATE
cases. This commit adds "partial" check for AS_PATH and LOCAL_PREF
cases, which should leave attributes 1 through 6 inclusive completely
covered with attribute flags checks.
* bgp_attr.c
* bgp_attr_origin(): use bit-by-bit checks for better diagnostics
* bgp_attr_aspath(): add flag check
* bgp_attr_local_pref(): idem
|
|
|
|
IPv6 supports the same concept of differentiated service for routing
protocols as IPv4, but like too many things, the standards committee
decided that having two names for the same thing wasn't good enough and
introduced a third more generic term transport class.
The socket option to set transport class works the same as IPv4, but the
arguments are different.
* lib/sockopt.[ch]
* setsockopt_ipv6_tclass(): new function
* bgpd/bgp_network.c
* bgp_connect(): set socket option
* bgp_listener(): set socket option
* ospf6d/ospf6_network.c
* ospf6_set_transport_class(): new function
* ospf6_serv_sock(): set socket option
* ripngd/ripngd.c
* ripng_make_socket(): set socket option
|
|
This vulnerability (CERT-FI #513254) was reported by CROSS project.
They have also suggested a fix to the problem, which was found
acceptable.
The problem occurs when bgpd receives an UPDATE message containing
255 unknown AS_PATH attributes in Path Attribute Extended Communities.
This causes a buffer overlow in bgpd.
* bgp_ecommunity.c
* ecommunity_ecom2str(): perform size check earlier
|
|
* lib/prefix.h
* IPV4_CLASS_DE(): new helper macro
* bgp_attr.c
* bgp_attr_nexthop(): add check for "partial" bit, refresh flag error
reporting, explain meaning of RFC4271 section 6.3 and implement it
|
|
* bgp_debug.c (bgp_notify_open_msg, bgp_notify_update_msg,
bgp_notify_cease_msg, bgp_notify_capability_msg): add messages for
"unspecific" subcode.
|
|
* bgp_attr.c
* bgp_attr_atomic(): accept extra argument, add checks for
"optional", "transitive" and "partial" bits, log each error
condition independently
* bgp_attr_parse(): provide extra argument
|
|
* bgp_attr.c
* bgp_attr_med(): add checks for "optional", "transitive" and
"partial" bits, log each error condition independently
|
|
* bgp_attr.c
* bgp_attr_local_pref(): accept extra argument, add checks for
"optional" and "transitive" bits, log each error condition
independently
* bgp_attr_parse(): provide extra argument
|
|
"While setting up a testbed, I ran across a little problem in the
parsing of the "graceful restart" BGP capability that resulted in
Quagga not actually activating it for the peer in question - when
the peer sent a single AFI/SAFI block."
* bgp_open.c
* bgp_capability_restart(): actually process the last AFI/SAFI block
|
|
* bgp_packet.c
* bgp_notify_send_with_data(): add calls to zlog_info()
|
|
|
|
|
|
* bgp_nexthop.c (show_ip_bgp_scan_tables): access proper structure field
in AF_INET6 case, handle ifindex NH type properly
|
|
bgp_nexthop_onlink(): zlookup is not used here at all
bgp_nexthop_lookup_ipv6(): rely on the detection performed by "query"
function (this also changes the fallback value to 0), reorder if-block
bgp_nexthop_lookup(): idem
|
|
* bgp_nexthop.c: (show_ip_bgp_scan) transform into
show_ip_bgp_scan_tables(), which uses inet_ntop() and can dump
nexthops on request; (show_ip_bgp_scan_detail_cmd) new function
|
|
bgp_nexthop_lookup_ipv6(): declare variables where they are actually
used, drop no-op initialization (the field is already 0)
bgp_nexthop_lookup(): ditto
bgp_nexthop_check_ebgp(): rename to bgp_nexthop_onlink()
bgp_nexthop_cache_changed(): rename to bgp_nexthop_cache_different()
|
|
* bgpd: (bgp_damp_parameter_set) The BGP reuse_index is not initialized
properly. This would cause sporadic crash when disabling dampening. Use
XCALLOC correctly and the right size array is initialized and no memset is
needed.
|
|
* bgp_route.c: (route_vty_out*) The local prefix, metric and weight values
are all stored as uint32_t. Change the format to %u so that large values
are not displayed as negative integers.
|
|
* bgp_route.c: ({no_,}ipv6_bgp_network_ttl_cmd) depends on ipv6_bgp_network
which is HAVE_IPV6, so these should be too.
(bgp_route_init) and the installs should be similarly ifdefed
|
|
- SAFI value 3 is reserved. It was assigned by RFC 2858 for a use
that was never fully implemented, so it is deprecated by this
document.
* zebra.h: rename macro
* bgp_fsm.c: (bgp_graceful_restart_timer_expire,
bgp_graceful_stale_timer_expire, bgp_stop, bgp_establish): update
* bgpd.c: (peer_nsf_stop): update
* bgp_open.c: (bgp_capability_vty_out): SAFI 3 isn't a recognized case
any more
|
|
Two macros resolving to the same integer constant broke a case block and
a more thorough merge of BGP_SAFI_VPNV4 and BGP_SAFI_VPNV6 was
performed.
* bgpd.h: MPLS-labeled VPN SAFI is AFI-independent, switch to single
* macro
* bgp_capability_test.c: update test data
* bgp_mp_attr_test.c: idem
* bgp_route.c: (bgp_maximum_prefix_overflow, bgp_table_stats_vty) update
macro and check conditions (where appropriate)
* bgp_packet.c: (bgp_route_refresh_send, bgp_capability_send,
bgp_update_receive, bgp_route_refresh_receive): idem
* bgp_open.c: (bgp_capability_vty_out, bgp_afi_safi_valid_indices,
bgp_open_capability_orf, bgp_open_capability): idem
* bgp_attr.c: (bgp_mp_reach_parse, bgp_packet_attribute,
bgp_packet_withdraw): idem
|
|
* bgpd.h: change value of BGP_SAFI_VPNV6 to 128 (RFC4659, BZ#659)
* bgp_route.c: (bgp_table_stats_vty) fix length argument to strncmp()
|
|
|
|
* draft-ietf-idr-as-pathlimit doesn't seem to have gone anywhere, and its
author does not think it will make progress in IDR. Remove all support
introduced for it, but leave stubs for the commands to avoid breaking
any configurations.
Basically reverts cecab5e9725792e60a5e4b473e238a14cd85815d.
(cherry picked from commit c8f3fe3063cb9ff193b13011cfbda3e605395340)
Conflicts:
bgpd/bgp_attr.c (caused by c8e7b895, resolved)
|
|
* bgp_attr.c: (bgp_attr_ext_communities) Certain extended-community attrs
can leave attr->flag indicating ext-community is present, even though no
extended-community object has been attached to the attr structure. Thus a
null-pointer dereference can occur later.
(bgp_attr_community) No bug fixed here, but tidy up flow so it has same
form as previous.
Problem and fix thanks to anonymous reporter.
(cherry picked from commit 0c46638122f10019a12ae9668aec91691cf2e017)
|
|
* bgpd/bgp_debug.c: fix VTY strings for BGP debug commands to match
correct syntax
(cherry picked from commit 6e22b9017e1ae2ce61c383b1b2b63973207704ac)
|
|
* bgp_packet.c: (bgp_notify_receive) justify the difference between
BGP_NOTIFY_OPEN_UNSUP_PARAM and BGP_NOTIFY_OPEN_UNSUP_CAPBL cases, as
it is explained in RFC5492, page 3, paragraph 1.
"Unsupported Capability" error does not mean, that the peer doesn't
support capabilities advertisement -- quite the opposite (if the peer
would not support capabilities advertisement, the code would be
"Unsupported Optional Parameter"). Thus there is no reason to mark
the peer as one non-supporting capabilities advertisement.
Example: suppose the peer is in fact IPv6-only, but we didn't configure
anything address-family specific for it. Then, the peer would refuse
the session with "Unsupported Capability" code. If we internally set
the peer as non-supporting capabilities advertisement after that, we
will not be able to establish the session with it ever, even with a
fixed configuration -- IPv6-only BGP session cannot be established
without capabilities.
In practice an edge case would be seen as the same IPv6 peer working
with its "neighbor" block read from bgpd.conf, but not working, when
slowly input in "conf t" mode.
(cherry picked from commit c7aa8abd8788c3607ad0131f02e892cf92221e40)
|
|
* bgp_vty.c: (community_list_perror, show_ip_community_list_arg,
show_ip_extcommunity_list_arg) fix spelling
(cherry picked from commit b729294c8c5c6f2af8ddf6cfbea2374b6faabe9d)
|
|
* bgp_route.c: (route_vty_out_detail) calculate time value
in a way, which works regardless of monotonic clock
being used or not
|
|
* bgpd/bgp_attr.c, bgpd/bgp_open.h, bgpd/bgp_route.c, lib/prefix.c,
lib/prefix.h: Various integer types were being used where, if we
had strict type checking, afi_t and safi_t would be required.
Signed-off-by: G.Balaji <balajig81@gmail.com>
(cherry picked from commit c8af35ffa2dc79ff7d7ff00b1b61f1f50a100ab6)
|
|
bgpd/bgp_packet.c:bgp_update_packet(): When extracting the peer, don't
fail to extract it because "binfo->extra" is NULL. While one should
certainly avoid dereferencing binfo->extra, that's not a good reason
not to use binfo->peer.
Fixes https://bugzilla.quagga.net/show_bug.cgi?id=497.
Patch by Eric Sobocinksi.
|
|
* bgpd/bgp_aspath.c
* assegments_parse(): add handling of AS4_PATH input, update bounds
checks, add check for AS segment type
* aspath_parse(): add handling of AS4_PATH input, expect
assegments_parse() to do length checking
* aspath_empty(): update for the new function prototype
* bgpd/bgp_aspath.h: ditto
* tests/aspath_test.c: ditto
* bgpd/bgp_attr.c
* bgp_attr_aspath(): add handling of AS4_PATH input, update flags
checks, change returned type
* bgp_attr_as4_path(): discard, superseded by bgp_attr_aspath()
* bgp_attr_parse(): update respectively
|
|
* bgp_packet.c: (bgp_route_refresh_receive) add validation of
"Length" (RFC5292) field value, check input stream bounds
each time bytes are pulled from it
|
|
BGP uses time() to get system time of day; but that value
fluctuates with time adjustments from NTP. This can cause premature
flapping of peer sessions and other failures.
Use the system monotonic clock supported by Quagga thread library
to avoid issue.
See: http://bugzilla.vyatta.com/show_bug.cgi?id=4467
* bgpd/bgp_fsm.c
* bgp_uptime_reset(): dismiss function
* bgpd/bgpd.c
* bgp_clock(): new function
* bgpd/bgp_damp.c
* bgp_reuse_timer(): employ bgp_clock() instead of time(NULL)
* bgp_damp_withdraw(): idem
* bgp_damp_update(): idem
* bgp_damp_scan(): idem
* bgp_damp_info_vty(): idem
* bgp_damp_reuse_time_vty(): idem
* bgpd/bgp_fsm.c
* bgp_routeadv_timer(): idem
* bgp_stop(): idem
* bgp_establish(): idem
* bgpd/bgp_packet.c
* bgp_update_receive(): idem
* bgpd/bgp_route.c
* bgp_update_rsclient(): idem
* bgp_update_main(): idem
* bgp_static_update_rsclient(): idem
* bgp_static_update_main(): idem
* bgp_static_update_vpnv4(): idem
* bgp_aggregate_route(): idem
* bgp_aggregate_add(): idem
* bgp_redistribute_add(): idem
* bgpd/bgp_snmp.c
* bgpPeerTable(): idem
* bgpTrapEstablished(): idem
* bgpTrapBackwardTransition(): idem
* bgpd/bgpd.c
* peer_create(): idem
* peer_uptime(): idem
* bgp_master_init(): idem
|
|
* bgpd/bgp_aspath.c
* ashash: only used in one file, make static
* aspath_count_numas(): dead code, sayonara
* bgpd/bgpd.c
* peer_nsf_stop(): only used in one file, make static
* bgpd/bgp_packet.h
* bgp_capability_receive(): add missing prototype for a
global function
|
|
* bgpd/bgp_fsm.c
* bgp_clearing_completed(): only used in one file, can be static
* bgpd/bgp_packet.c
* afi2str(): sayonara
* safi2str(): sayonara
* bgpd/bgp_route.c
* bgp_distance_reset(): sayonara
* bgpd/bgp_zebra.c
* bgp_ifindex_by_nexthop(): sayonara
|
|
Make one version of check prefix bit, and put it inline
with proper prototype. This gets rid of some macro's and also some
assert() that can never happen on a non-broken compiler.
* bgpd/bgp_table.c
* CHECK_BIT(): sayonara
* check_bit(): sayonara
* SET_LINK(): sayonara
* set_link(): make use of prefix_bit() instead of check_bit()
* bgp_node_match(): idem
* bgp_node_lookup(): idem
* bgp_node_get(): idem
* lib/prefix.h
* prefix_bit(): new inline version of check_bit()
* lib/table.c
* CHECK_BIT(): sayonara
* check_bit(): sayonara
* SET_LINK(): sayonara
* set_link(): make use of prefix_bit() instead of check_bit()
* route_node_match(): idem
* route_node_lookup(): idem
* route_node_get(): idem
* ospf6d/ospf6_lsdb.c
* CHECK_BIT(): sayonara
* ospf6_lsdb_lookup_next(): make use of prefix_bit() instead of
CHECK_BIT()
* ospf6_lsdb_type_router_head(): idem
* ospf6_lsdb_type_head(): idem
* ospf6d/ospf6_route.c
* CHECK_BIT(): sayonara
* ospf6_route_match_head() make use of prefix_bit() instead of
* CHECK_BIT()
|
