summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| | * | bgpd: improve attr flags checksDenis Ovsienko2011-10-171-150/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not check each of the Optional/Transitive/Partial attribute flag bits, when their only valid combination is known in advance, but still perform bit-deep error message logging. This change assumes unused (low-order) 4 bits of the flag octet cleared. * bgp_attr.c * bgp_attr_origin(): rewrite check * bgp_attr_nexthop(): idem * bgp_attr_med(): idem * bgp_attr_local_pref(): idem * bgp_attr_atomic(): idem
| | * | bgpd: add missing "partial" flag checks (BZ#676)Denis Ovsienko2011-10-171-8/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ORIGIN handling function used to have "partial" bit check and recent commits added it for NEXT_HOP, MULTI_EXIT_DISC and ATOMIC_AGGREGATE cases. This commit adds "partial" check for AS_PATH and LOCAL_PREF cases, which should leave attributes 1 through 6 inclusive completely covered with attribute flags checks. * bgp_attr.c * bgp_attr_origin(): use bit-by-bit checks for better diagnostics * bgp_attr_aspath(): add flag check * bgp_attr_local_pref(): idem
| | * | bgpd: ignore 4 bits of attribute flags byteDenis Ovsienko2011-10-171-1/+4
| | | |
| | * | vtysh: [build] silence preprocessor errors in some casesDmitrij Tejblum2011-10-171-1/+1
| | | | | | | | | | | | | | | | * extract.pl.in: use configured CPPFLAGS in cpp invocation.
| | * | lib: compile even without IPV6_TCLASSDenis Ovsienko2011-10-171-1/+3
| | | |
| | * | IPv6 transport class suppportStephen Hemminger2011-10-175-1/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPv6 supports the same concept of differentiated service for routing protocols as IPv4, but like too many things, the standards committee decided that having two names for the same thing wasn't good enough and introduced a third more generic term transport class. The socket option to set transport class works the same as IPv4, but the arguments are different. * lib/sockopt.[ch] * setsockopt_ipv6_tclass(): new function * bgpd/bgp_network.c * bgp_connect(): set socket option * bgp_listener(): set socket option * ospf6d/ospf6_network.c * ospf6_set_transport_class(): new function * ospf6_serv_sock(): set socket option * ripngd/ripngd.c * ripng_make_socket(): set socket option
| | * | version RE-0.99.17.5RE-0.99.17.5Denis Ovsienko2011-09-291-1/+1
| | | |
| | * | ospfd: fix regression in recent commitYAMAMOTO Shigeru2011-09-291-10/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit '717750433839762d23a5f8d88fe0b4d57c8d490a' causes SEGV error, when 'oi = ospf_if_lookup_recv_if (ospf, iph->ip_src, ifp);' returns NULL. * ospf_packet.c * ospf_read(): change a place of calling 'ospf_verify_header()'
| | * | version RE-0.99.17.4RE-0.99.17.4Denis Ovsienko2011-09-261-1/+1
| | | |
| | * | ospf6d: CVE-2011-3323 (fortify packet reception)Denis Ovsienko2011-09-267-73/+492
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This vulnerability (CERT-FI #514840) was reported by CROSS project. ospf6d processes IPv6 prefix structures in incoming packets without verifying that the declared prefix length is valid. This leads to a crash caused by out of bounds memory access. * ospf6_abr.h: new macros for size/alignment validation * ospf6_asbr.h: idem * ospf6_intra.h: idem * ospf6_lsa.h: idem * ospf6_message.h: idem * ospf6_proto.h: idem * ospf6_message.c * ospf6_packet_minlen: helper array for ospf6_packet_examin() * ospf6_lsa_minlen: helper array for ospf6_lsa_examin() * ospf6_hello_recv(): do not call ospf6_header_examin(), let upper layer verify the input data * ospf6_dbdesc_recv(): idem * ospf6_lsreq_recv(): idem * ospf6_lsupdate_recv(): idem * ospf6_lsack_recv(): idem * ospf6_prefixes_examin(): new function, implements A.4.1 * ospf6_lsa_examin(): new function, implements A.4 * ospf6_lsaseq_examin(): new function, an interface to above * ospf6_packet_examin(): new function, implements A.3 * ospf6_rxpacket_examin(): new function, replaces ospf6_header_examin() * ospf6_header_examin(): sayonara * ospf6_receive(): perform passive interface check earliest possible, employ ospf6_rxpacket_examin()
| | * | ospf6d: CVE-2011-3324 (DD LSA assertion)Denis Ovsienko2011-09-261-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This vulnerability (CERT-FI #514839) was reported by CROSS project. When Database Description LSA header list contains trailing zero octets, ospf6d tries to process this data as an LSA header. This triggers an assertion in the code and ospf6d shuts down. * ospf6_lsa.c * ospf6_lsa_is_changed(): handle header-only argument(s) appropriately, do not treat LSA length underrun as a fatal error.
| | * | ospfd: CVE-2011-3325 part 2 (OSPF pkt type segv)Denis Ovsienko2011-09-261-14/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This vulnerability (CERT-FI #514838) was reported by CROSS project. The error is reproducible only when ospfd debugging is enabled: * debug ospf packet all * debug ospf zebra When incoming packet header type field is set to 0x0a, ospfd will crash. * ospf_packet.c * ospf_verify_header(): add type field check * ospf_read(): perform input checks early
| | * | ospfd: CVE-2011-3325 part 1 (OSPF header underrun)Denis Ovsienko2011-09-261-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This vulnerability (CERT-FI #514838) was reported by CROSS project. When only 14 first bytes of a Hello packet is delivered, ospfd crashes. * ospf_packet.c * ospf_read(): add size check
| | * | ospfd: CVE-2011-3326 (uknown LSA type segfault)CROSS2011-09-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This vulnerability (CERT-FI #514837) was reported by CROSS project. They have also suggested a fix to the problem, which was found acceptable. Quagga ospfd does not seem to handle unknown LSA types in a Link State Update message correctly. If LSA type is something else than one supported by Quagga, the default handling of unknown types leads to an error. * ospf_flood.c * ospf_flood(): check return value of ospf_lsa_install()
| | * | bgpd: CVE-2011-3327 (ext. comm. buffer overflow)CROSS2011-09-261-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This vulnerability (CERT-FI #513254) was reported by CROSS project. They have also suggested a fix to the problem, which was found acceptable. The problem occurs when bgpd receives an UPDATE message containing 255 unknown AS_PATH attributes in Path Attribute Extended Communities. This causes a buffer overlow in bgpd. * bgp_ecommunity.c * ecommunity_ecom2str(): perform size check earlier
| | * | bgpd: improve NEXT_HOP attribute checks (BZ#680)Denis Ovsienko2011-09-252-8/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * lib/prefix.h * IPV4_CLASS_DE(): new helper macro * bgp_attr.c * bgp_attr_nexthop(): add check for "partial" bit, refresh flag error reporting, explain meaning of RFC4271 section 6.3 and implement it
| | * | bgpd: don't be confused by "unspecific" subcode in the NOTIFY message.Dmitrij Tejblum2011-09-252-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | * bgp_debug.c (bgp_notify_open_msg, bgp_notify_update_msg, bgp_notify_cease_msg, bgp_notify_capability_msg): add messages for "unspecific" subcode.
| | * | lib: provide more information in case of failed LOOKUP.Dmitrij Tejblum2011-09-252-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * log.[ch] * mes_lookup: add a parameter with the name of the message list, print the name in case of failure. * LOOKUP macro: pass the name of the message list.
| | * | bgpd: check ATOMIC_AGGREGATE attr flags (BZ#678)Denis Ovsienko2011-09-251-2/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * bgp_attr.c * bgp_attr_atomic(): accept extra argument, add checks for "optional", "transitive" and "partial" bits, log each error condition independently * bgp_attr_parse(): provide extra argument
| | * | bgpd: check MULTI_EXIT_DISC attr flags (BZ#677)Denis Ovsienko2011-09-251-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | * bgp_attr.c * bgp_attr_med(): add checks for "optional", "transitive" and "partial" bits, log each error condition independently
| | * | bgpd: check LOCAL_PREF attribute flags (BZ#674)Denis Ovsienko2011-09-251-2/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * bgp_attr.c * bgp_attr_local_pref(): accept extra argument, add checks for "optional" and "transitive" bits, log each error condition independently * bgp_attr_parse(): provide extra argument
| | * | configure: test for glibc backtrace even without glibc.Dmitrij Tejblum2011-09-251-8/+6
| | | | | | | | | | | | | | | | Other platform may have compatible facilities.
| | * | ospfd: remove unused macroDenis Ovsienko2011-09-251-4/+0
| | | |
| | * | doc: fix typoRoman Hoog Antink2011-09-251-1/+1
| | | |
| | * | isisd: raise hello rate for DIS (BZ#539)Fritz Reichmann2011-09-251-2/+24
| | | | | | | | | | | | | | | | | | | | * isis_pdu.c: Divide hello interval by three, depending if we are DIS or not.
| | * | isisd: fix crash on "no router isis" (BZ#536)Fritz Reichmann2011-09-256-3/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The crash is due to threads accessing data that gets destroyed during the removal of the configuration. * isis_circuit.c: Destroy adjacencies to stop adjacency expiry thread. Stop PSNP threads. * isisd.c: Change state of circuit back to INIT and reassign the circuit structure to isis->init_circ_list rather than destroying the circuit data structure. Stop SPF threads. Stop LSP generation threads. * isisd.h: Add pointers to LSP threads into area structure in order to stop them in isisd.c * isis_lsp.c: Store pointer to LSP thread in area structure. * isis_pdu.c: Stop PDU generation for a circuit with a removed area. * isis_pfpacket.c: Stop processing received PDUs for a circuit with a removed area.
| | * | ospf6d: Fix memory allocation issues in SPFTom Goff2011-09-252-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * ospf6_area.c: Call ospf6_spf_table_finish() before deleting the spf table. This ensures that the associated ospf6_vertex structures are also freed. * ospf6_spf.c: Only allocate a priority queue when a spf calculation is actually performed.
| | * | ospf6d: Extend the "[no] debug ospf6 route" vty commandsTom Goff2011-09-251-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | * ospf6_route.c ([no_]debug_ospf6_route) Include memory as a debug option. This allows ospf6 route memory debugging to be enabled or disabled interactively or from a config file.
| | * | isisd: include hash.h, not hash.cPeter Szilagyi2011-09-251-1/+1
| | | |
| | * | configure: dismiss libutil.hStephen Hemminger2011-09-252-5/+1
| | | | | | | | | | | | | | | | | | | | Recent versions of libc on Linux (Debian Testing) create lots of compile warnings about direct usage of libutil.h
| | * | doc: add missing wordAlexandre Chappuis2011-09-251-1/+1
| | | | | | | | | | | | | | | | | | | | * ospfd.texi: Adjust meaning of the rfc1583compatibility option in order to match the RFC specification and the actual source code.
| | * | ospf6d: add lost lines to area config blockJon Andersson2011-09-251-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | * ospf6_area.c * ospf6_area_config_write(): write filter-list, import-list and export-list lines
| | * | bgpd: fix parsing of graceful restart cap. (#663)Peter Pentchev2011-09-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "While setting up a testbed, I ran across a little problem in the parsing of the "graceful restart" BGP capability that resulted in Quagga not actually activating it for the peer in question - when the peer sent a single AFI/SAFI block." * bgp_open.c * bgp_capability_restart(): actually process the last AFI/SAFI block
| | * | ospf6d: fix crash on filter-list handling (BZ#530)Christian Hammers2011-09-251-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This essentially merges the fix available from Debian build of Quagga. * ospf6_area.c * area_filter_list(): use correct argv indices * no_area_filter_list(): idem
| | * | bgpd: add useful notification logs (BZ#616)heasley2011-09-251-3/+16
| | | | | | | | | | | | | | | | | | | | * bgp_packet.c * bgp_notify_send_with_data(): add calls to zlog_info()
| | * | doc: BGP route-flap dampeningAlexandre Chappuis2011-09-251-0/+30
| | | |
| | * | zebra: fix loss of metric for Linux routesDmitry Popov2011-09-251-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | * rt_netlink.c * netlink_route_change(): fetch metric information like netlink_routing_table() does and pass it further
| | * | ospfd: spellingDenis Ovsienko2011-09-101-1/+1
| | | |
| | * | bgpd: spellingDenis Ovsienko2011-09-101-1/+1
| | | |
| | * | bgpd: spellingDenis Ovsienko2011-09-101-1/+1
| | | |
| | * | ospfd: use existing macro for consistencyDenis Ovsienko2011-09-101-2/+2
| | | |
| | * | version RE-0.99.17.3RE-0.99.17.3Denis Ovsienko2011-09-071-1/+1
| | | |
| | * | ospfd: revert recent PIE change to fix amd64 buildDenis Ovsienko2011-09-071-3/+0
| | | | | | | | | | | | | | | | This reverts commit 68575f4babf4d6fc302c366898a1047f13629214.
| | * | version RE-0.99.17.2RE-0.99.17.2Denis Ovsienko2011-09-071-1/+1
| | | |
| | * | build: build ospfd as Position-Independed Executable (if appropriate)Dmitrij Tejblum2011-09-051-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | Since 46bc0e432e75, all the binaries are built as Position-Independed Executables (if available and enabled). ospfd was missed for some unknown reason.
| | * | ospfd: address more trivial compiler warningsDenis Ovsienko2011-08-281-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | * ospf_ase.c * ospf_ase_complete_direct_routes(): dismiss unused variable * ospf_ase_calculate_route(): put assignments into parentheses
| | * | zebra: add missing includesDenis Ovsienko2011-08-282-0/+5
| | | |
| | * | ospf6d: address more trivial compiler warningsDenis Ovsienko2011-08-273-2/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * ospf6_main.c: include required headers * ospf6_asbr.h: idem * ospf6_spf.c * ospf6_spf_install(): remove unused variables
| | * | ospfd: sizing macros cleanupDenis Ovsienko2011-08-232-10/+8
| | | | | | | | | | | | | | | | | | | | | | | | * ospf_spf.c * ROUTER_LSA_TOS_SIZE: prepend OSPF_ and move to ospf_lsa.h * ROUTER_LSA_MIN_SIZE: replace with existing OSPF_ROUTER_LSA_LINK_SIZE
| | * | lib: use "protocol-independed API" from RFC3678, if that is availableDmitrij Tejblum2011-08-222-4/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (This commit is based on the patch from BZ#420, and should fix that bug.) * configure.ac: detect availability of that API * sockopt.c (setsockopt_ipv4_multicast): use it for join/leave IPv4 multicast groups
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 10:49:30 +0000