Commit graph

308 commits

Author SHA1 Message Date
Donald Sharp 07a62e585d ospfd: Add some small doc to what each one is for future people
min lsa packet sizes are not always directly corresponding
to the actual LSA.  Add a bit of comments so it's easier
for future people to figure out.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2021-09-14 13:13:32 -04:00
Donald Sharp cf680c38a9 ospfd: Ensure we have some non header lsa data
In some cases FRR is receiving a lsa data packet
with a length set to the length of the header only.
If we are expecting data from a peer in the form
of lsa data.  Let's enforce it.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2021-09-14 13:07:06 -04:00
Russ White 12b5b2f9ff
Merge pull request #9551 from mobash-rasool/ospfv2-bug-fixes-04
ospfd: GR Conformance fix in Hello packet DR election
2021-09-07 10:47:09 -04:00
Mobashshera Rasool 3cb62bb387 ospfd: RFC conformance test case 25.23 issue fix
Problem Statement :
===================
LSA with InitialSequenceNumber is not originated
after MaxSequenceNumber.

ANVL Test case 25.33 states:
============================
As soon as this flooding of a LSA with LS sequence number
MaxSequenceNumber has been acknowledged by all adjacent neighbors,
a new instance can be originated with sequence number of InitialSequenceNumber.

RCA :
=====
DUT did not originated LSA with INITIAL_SEQUENCE number even
after receiving ACK for max sequence LSA.
Code is not present to handle this situation in the lsa ack flow.

Fix :
=====
Add code to originate LSA with initial sequence number in the
LSA ack flow in case of wrap around sequence number.

Signed-off-by: Mobashshera Rasool <mrasool@vmware.com>
2021-09-03 06:44:56 -07:00
Mobashshera Rasool 44d1115ad6 ospfd: ANVL Test case 25.22, 25.23 and 28.11 fixes
ANVL Test case 28.11
If the database copy has LS age equal to MaxAge and LS sequence number
equal to MaxSequenceNumber, simply discard the received LSA
without acknowledging it.

ANVL Test Case 25.22
When an attempt is made to increment the sequence number past the maximum
value of N - 1 (0x7fffffff; also referred to as MaxSequenceNumber),
the current instance of the LSA must first be flushed from the routing domain.

ANVL Test Case 25.23
As soon as this flooding of a LSA with LS sequence number MaxSequenceNumber
has been acknowledged by all adjacent neighbors, a new instance can be
originated with sequence number of InitialSequenceNumber.

RCA:
When IXIA sent LS Seq num as MAX and LS Age as (MAX - 3),
DUT dropped the packet instead of sending ACK.
In function ospf_ls_upd, at Line 2106 the code is there to drop the LSA.
Hence its failing.

Fix:
LSAs ACK must be sent when received LSA is having max sequence number
but not max-aged.
Considering  /* CVE-2017-3224 */ issue, have corrected the existing
code to prevent attacker from sending LSAs with max sequence number
and higher checksum and blocking the flooding of the Max-sequence numbered LSAs.

Signed-off-by: Mobashshera Rasool <mrasool@vmware.com>
2021-09-03 06:44:39 -07:00
Mobashshera Rasool d51715bb44 ospfd: GR Conformance fix for Hello packet DR election
Problem Statement:
===================
DUT selecting itself as DR when RR goes for reload.
Test Case 7.2

DUT (GR Helper) receives the Hello packet from the OSPF GR RESTARTER
(ANVL here) with DR and BDR set to 0.0.0.0 and DUT in its hello
neighbor list. DUT triggers the DR and BDR election although it is
in the Helper mode for that neighbor.

Root Cause Analysis:
====================
When hello packet is received with self router ID in the neighbor list,
there is no check in the code to handle this scenario. Hence the DR/BDR
election happens and it changes the DR although it is helper.

Fix:
===================
As per RFC 3623 Section 3.  Operation of Helper Neighbor, below point,
we need to maintain the DR relationship.
Also, if X was the Designated Router on network segment S when the
helping relationship began, Y maintains X as the Designated Router
until the helping relationship is terminated.

Adding the check when DUT is under neighbor helper mode, we need to avoid
ISM state change when hello packet is received with DR/BDR set to 0.0.0.0.

Signed-off-by: Mobashshera Rasool <mrasool@vmware.com>
2021-09-03 06:40:14 -07:00
Renato Westphal 1051417011 ospfd: introduce support for Graceful Restart (restarting mode)
RFC 3623 specifies the Graceful Restart enhancement to the OSPF
routing protocol. This PR implements support for the restarting mode,
whereas the helper mode was implemented by #6811.

This work is based on #6782, which implemented the pre-restart part
and settled the foundations for the post-restart part (behavioral
changes, GR exit conditions, and on-exit actions).

Here's a quick summary of how the GR restarting mode works:
* GR can be enabled on a per-instance basis using the `graceful-restart
  [grace-period (1-1800)]` command;
* To perform a graceful shutdown, the `graceful-restart prepare ospf`
  EXEC-level command needs to be issued before restarting the ospfd
  daemon (there's no specific requirement on how the daemon should
  be restarted);
* `graceful-restart prepare ospf` will initiate the graceful restart
  for all GR-enabled instances by taking the following actions:
  o Flooding Grace-LSAs over all interfaces
  o Freezing the OSPF routes in the RIB
  o Saving the end of the grace period in non-volatile memory (a JSON
    file stored in `$frr_statedir`)
* Once ospfd is started again, it will follow the procedures
  described in RFC 3623 until it detects it's time to exit the graceful
  restart (either successfully or unsuccessfully).

Testing done:
* New topotest featuring a multi-area OSPF topology (including stub
  and NSSA areas);
* Successful interop tests against IOS-XR routers acting as helpers.

Co-authored-by: GalaxyGorilla <sascha@netdef.org>
Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
2021-07-05 11:43:02 -03:00
Renato Westphal cd52c44c00 ospfd: rename the graceful restart header
Both the GR helper code and the upcoming GR restarting code are going
to share a lot of definitions. As such, rename ospf_gr_helper.h to
ospf_gr.h, which will be the central point of all GR definitions
and prototypes.

Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
2021-07-05 11:43:02 -03:00
GalaxyGorilla 3f87e1d8b3 ospfd: adjust log config for GR
Remove previous log config

	debug ospf graceful-restart helper

and just use

	debug ospf graceful-restart

for everything related to OSPF GR.

Signed-off-by: GalaxyGorilla <sascha@netdef.org>
2021-07-05 11:43:02 -03:00
Renato Westphal e9505bc63a ospfd: print extra LSA information in some log messages
Log the LSA advertising router in addition to the LSA type and
ID in the places where that information is necessary to uniquely
identify the LSA in the LSDB.

This is useful, for example, to know exactly which LSA has changed
when the router is exiting from the GR helper mode when a topology
change was detected.

Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
2021-07-05 11:43:02 -03:00
Renato Westphal 231af0a5d6 ospfd: fix wrong NSSA debug guards
Fix usage of NSSA debug guards in code paths that have nothing to
do with NSSA areas.

Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
2021-06-08 11:41:33 -03:00
Renato Westphal 98cb53f96a zebra, ospfd: fix typos in the graceful restart code
Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
2021-06-08 11:41:33 -03:00
Donald Sharp a4544597f4 ospfd: Use _func__ instead of __PRETTY_FUNCTION__
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2021-05-12 12:03:59 -04:00
Reuben Dowle 686967467c ospfd: Suppress spurious write message when using ip nhrp map multicast
When ip nhrp map multicast is being used, this is usually accompanied by an
iptables rule to block the original multicast packet. This causes sendmsg to
return EPERM.

Signed-off-by: Reuben Dowle <reuben.dowle@4rf.com>
2021-04-06 09:23:42 +12:00
Amol Lad 0c5506a856 ospfd: changes for PMP network /32 prefix length
Operation with PMP network on /32 prefix is needed for DMVPN

Signed-off-by: Reuben Dowle <reuben.dowle@4rf.com>
2021-04-06 09:23:42 +12:00
Donald Sharp c067e23e54 ospfd: Convert to using proper string formatting
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2021-03-09 20:00:45 -05:00
Donald Sharp 555691e96e ospfd: Prevent duplicate packet read in certain vrf situations
Currently if the sysctl net.ipv4.raw_l3mdev_accept is 1, packets
destined to a specific vrf also end up being delivered to the default
vrf.  We will see logs like this in ospf:

2021/02/10 21:17:05.245727 OSPF: ospf_recv_packet: fd 20(default) on interface 1265(swp1s1.26)
2021/02/10 21:17:05.245740 OSPF: Hello received from [9.9.36.12] via [swp1s1.26:200.254.26.13]
2021/02/10 21:17:05.245741 OSPF:  src [200.254.26.14],
2021/02/10 21:17:05.245743 OSPF:  dst [224.0.0.5]
2021/02/10 21:17:05.245769 OSPF: ospf_recv_packet: fd 45(vrf1036) on interface 1265(swp1s1.26)
2021/02/10 21:17:05.245774 OSPF: Hello received from [9.9.36.12] via [swp1s1.26:200.254.26.13]
2021/02/10 21:17:05.245775 OSPF:  src [200.254.26.14],
2021/02/10 21:17:05.245777 OSPF:  dst [224.0.0.5]

This really really makes ospf unhappy in the vrf we are running in.

I am approaching the problem by just dropping the packet if read in the
default vrf because of:

commit 0556fc33c7
Author: Donald Sharp <sharpd@cumulusnetworks.com>
Date:   Fri Feb 1 11:54:59 2019 -0500

    lib: Allow bgp to always create a listen socket for the vrf

Effectively if we have `router ospf vrf BLUE` but no ospf running
in the default vrf, we will not have a listener and that would
require a fundamental change in our approach to handle the ospf->fd
at a global level.  I think this is less than ideal at the moment
but it will get us moving again and allow FRR to work with
a bunch of vrf's and ospf neighbors.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2021-02-11 07:31:05 -05:00
Mark Stapp b3d6bc6ef0 * : update signature of thread_cancel api
Change thread_cancel to take a ** to an event, NULL-check
before dereferencing, and NULL the caller's pointer. Update
many callers to use the new signature.

Signed-off-by: Mark Stapp <mjs@voltanet.io>
2020-10-23 08:59:34 -04:00
Mark Stapp 96b663a381 ospfd: replace inet_ntoa
Stop using inet_ntoa, use %pI4 etc or inet_ntop instead

Signed-off-by: Mark Stapp <mjs@voltanet.io>
2020-10-22 13:37:25 -04:00
rgirada 5a77dd8feb ospfd: GR Helper functionality changes
Description:
	1. Skipping inactivity timer during  graceful restart to make
	   the RESTARTER active even after dead timer expiry.
	2. Handling HELPER on unplanned outages.

Signed-off-by: Rajesh Girada <rgirada@vmware.com>
2020-09-22 00:02:37 -07:00
Jakub Urbańczyk a92706bb83 ospfd: make proactive ARP configurable
OSPFD sends ARP proactively to speed up convergence for /32 networks
on a p2p connection. It is only an optimization, so it can be disabled.

It is enabled by default.

Signed-off-by: Jakub Urbańczyk <xthaid@gmail.com>
2020-08-20 17:19:25 +02:00
Jakub Urbańczyk aa530b627d ospfd: send ARP requests using zebra
Signed-off-by: Jakub Urbańczyk <xthaid@gmail.com>
2020-08-12 23:20:52 +02:00
David Lamparter 3efd0893d0 *: un-split strings across lines
Remove mid-string line breaks, cf. workflow doc:

  .. [#tool_style_conflicts] For example, lines over 80 characters are allowed
     for text strings to make it possible to search the code for them: please
     see `Linux kernel style (breaking long lines and strings)
     <https://www.kernel.org/doc/html/v4.10/process/coding-style.html#breaking-long-lines-and-strings>`_
     and `Issue #1794 <https://github.com/FRRouting/frr/issues/1794>`_.

Scripted commit, idempotent to running:
```
python3 tools/stringmangle.py --unwrap `git ls-files | egrep '\.[ch]$'`
```

Signed-off-by: David Lamparter <equinox@diac24.net>
2020-07-14 10:37:25 +02:00
Olivier Dugeon 0b4b9672b7
Merge pull request #6218 from qlyoung/fix-ospf-router-lsa-missing-length-check
ospfd: router LSA link info missing length check
2020-04-14 19:49:53 +02:00
Quentin Young 04d6a0f823 ospfd: router LSA link info missing length check
Fix
- Modulo check on data length not inclusive enough
- Garbage heap read when bounds checking

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-04-14 11:29:10 -04:00
Quentin Young f45be0e105 ospfd: fix uaf upon rx of self-originated lsa
ospf_opaque_self_originated_lsa_received decrements refcount which can
result in a free, this is followed by a call to ospf_ls_ack_send which
accesses the freed LSA

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2020-04-14 01:43:13 -04:00
David Lamparter 63efca0e95 *: remove line breaks from log messages
Line break at the end of the message is implicit for zlog_* and flog_*,
don't put it in the string.  Mid-message line breaks are currently
unsupported.  (LF is "end of message" in syslog.)

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2020-03-24 19:43:18 +01:00
Ruben Kerkhof bdee80838f ospfd: stop checking for ancient OpenBSD
Signed-off-by: Ruben Kerkhof <ruben@rubenkerkhof.com>
2020-03-19 16:16:47 +01:00
Donatas Abraitis 0d6f7fd6fd *: Replace sizeof something to sizeof(something)
Satisfy checkpatch.pl requirements (check for sizeof without parenthesis)

Signed-off-by: Donatas Abraitis <donatas.abraitis@gmail.com>
2020-03-08 21:44:53 +02:00
Donatas Abraitis 15569c58f8 *: Replace __PRETTY_FUNCTION__/__FUNCTION__ to __func__
Just keep the code cool.

Signed-off-by: Donatas Abraitis <donatas.abraitis@gmail.com>
2020-03-05 20:23:23 +02:00
Donatas Abraitis 752022670a *: Remove break after return
Just a deadcode.

Signed-off-by: Donatas Abraitis <donatas.abraitis@gmail.com>
2020-02-13 15:39:54 +02:00
Donatas Abraitis 975a328e2e *: Replace s_addr 0 => INADDR_ANY
Signed-off-by: Donatas Abraitis <donatas.abraitis@gmail.com>
2020-02-06 09:00:12 +02:00
Quentin Young e947b307fc ospfd: tiny style fix
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2019-12-12 01:03:18 -05:00
Quentin Young 5405a012b4 ospfd: sizeof(pointer) -> sizeof(pointed-at)
14 years old eh?

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2019-12-12 01:03:18 -05:00
Quentin Young 01e3c3764d ospfd: fix misplaced trust in ip header length
We actually don't validate the IHL field, although it certainly looks
like we do at a casual glance.

This patch saves us from an assert in case we actually do get an IP
packet with an incorrect header length field.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2019-12-12 01:03:13 -05:00
Donald Sharp 45559c4dfe ospfd: nbr->oi is never null
We test nbr->oi in a couple of places for null, but
in the majority of places of the nbr->oi data is being
used we just access it.  Touch up code to trust this
assertion and make the code more consistent in others.

Found in Coverity.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2019-11-21 18:47:13 -05:00
Donald Sharp 0263751346 ospfd: Rework ospf_read_packet into 2 functions
The indentation level for ospf_read was starting to be pretty
extremene.  Rework into 2 functions for improved readability.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2019-11-19 08:09:56 -05:00
Donald Sharp 4392cc4337 ospfd: Allow packet reads based upon read/write packet counts
Read in up to 20(ospf write-multipler X) packets, for handling of data.

This improves performance because we allow ospf to have a bit more data
to work on in one go for spf calculations instead of 1 packet at a time.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2019-11-19 07:47:19 -05:00
Donald Sharp edca5860cb ospfd: The ip header dump is crazy long and useless
Turning on packet debugs and seeing a header dump that is 11
lines long is useless

2019/11/07 01:07:05.941798 OSPF: ip_v 4
2019/11/07 01:07:05.941806 OSPF: ip_hl 5
2019/11/07 01:07:05.941813 OSPF: ip_tos 192
2019/11/07 01:07:05.941821 OSPF: ip_len 68
2019/11/07 01:07:05.941831 OSPF: ip_id 48576
2019/11/07 01:07:05.941838 OSPF: ip_off 0
2019/11/07 01:07:05.941845 OSPF: ip_ttl 1
2019/11/07 01:07:05.941857 OSPF: ip_p 89
2019/11/07 01:07:05.941865 OSPF: ip_sum 0xcf33
2019/11/07 01:07:05.941873 OSPF: ip_src 200.254.30.14
2019/11/07 01:07:05.941882 OSPF: ip_dst 224.0.0.5

We already have this debugged, it's not going to change and the
end developer can stick this back in if needed by hand to debug
something that is not working properly.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2019-11-19 07:47:19 -05:00
Donald Sharp 868a0861d2 ospfd: Add/fix some debugs to handle vrf
This commit has:
The received packet path in ospf, had absolutely no debugs associated with
it.  This makes it extremely hard to know when we receive packets for
consumption.  Add some breadcrumbs to this end.

Large chunks of commands have no ability to debug what is happening
in what vrf.  With ip overlap X vrf this becomes a bit of a problem
Add some breadcrumbs here.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2019-11-19 07:47:19 -05:00
Donald Sharp f573ec607c ospfd: Remove ORIGINAL_CODING check
We have a bunch of places that look for ORIGINAL_CODING.  There is
nothing in our configure system to define this value and a quick
git blame shows this code as being original to the import a very
very long time ago.  This is dead code, removing.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2019-11-19 07:47:19 -05:00
Satheesh Kumar K e6a22aeb42 ospfd: Adding Debugs to dump OSPF DD Seqnumber
Recently Lot of issues are seen in  OSPF adjacnecy establishements,
sessions was tear down because of DD Sequence Number mismatch.

adding Debugs to capture Master & slave generated sequence numbers.

Signed-off-by: Satheesh Kumar K <sathk@cumulusnetworks.com>
2019-11-14 01:16:05 -08:00
Donald Sharp 96db9cd3a1 ospfd: Remove flog_warn for a situation user can never do anything with
When OSPF receives a Database description packet and is in
`Down`, `Attempt` or `2-Way` state we are creating a warning
for the end user.

rfc2328 states(10.6):
Down - The packet should be rejected
Attempt - The packet should be rejected
2-Way - The packet should be ignored

I cannot find any instructions in the rfc to state what the operational
difference is between rejected and ignored.  Neither can I figure
out what FRR expects the end user to do with this information.
I can see this information being useful if we encounter a bug
down the line and we have gathered a bunch of data.  As such
let's modify the code to remove the flog_warn and convert
the message to a debug level message that can be controlled by
appropriate debug statements.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2019-09-05 12:30:26 -04:00
Donald Sharp 36a106e0e4 ospfd: Cleanup oi->obuf to always be created
This looks like a finish up of the partial cleanup that
ocurred at some point in time in the past.  When we
alloc oi also always alloc the oi->obuf.  When we delete
oi always delete the oi->obuf right before.

This cleans up a bunch of code to be simpler and hopefully
easier to follow.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2019-08-30 16:48:07 -04:00
Donald Sharp 7cec50a533 ospfd: tighten up what functions can be used outside of ospf_packet.c
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2019-08-30 16:48:07 -04:00
Donald Sharp 4173cc8e23 ospfd: Do not turn on write thread unless we have something in it
I am rarely seeing this crash:

r2: ospfd crashed. Core file found - Backtrace follows:
[New LWP 32748]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/lib/frr/ospfd'.
Program terminated with signal SIGABRT, Aborted.
2019-08-29 15:59:36,149 ERROR: assert failed at "test_ospf_sr_topo1/test_memory_leak":

Which translates to this code:

	node = listhead(ospf->oi_write_q);
	assert(node);
	oi = listgetdata(node);
	assert(oi);

So if we get into ospf_write without anything on the oi_write_q
we are stopping the program.

This is happening because in ospf_ls_upd_queue_send we are calling
ospf_write.  Imagine that we have a interface already on the on_write_q
and then ospf_write handles the packet send for all functions.  We
are not clearing the t_write thread and we are popping and causing
a crash.

Additionally modify OSPF_ISM_WRITE_ON(O) to not just blindly
turn on the t_write thread.  Only do so if we have data.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>

ospfd: Remove redundant asserts

assert(oi) is impossible all listgetdata(node) directly proceeding
it already asserts here, besides a node cannot be created
with a null pointer!

If list_isempty is called directly before the listhead call
it is impossilbe that we do not have a valid pointer here.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2019-08-30 16:48:07 -04:00
Michal Ruprich 0513a27153 ospfd,ripd: Enabling build with openssl
Enabling openssl library for md5 authentication in RIP and OSPF

Signed-off-by: Michal Ruprich <michalruprich@gmail.com>
2019-08-08 16:03:20 +02:00
Chirag Shah c32eba04f3 ospfd: no router ospf crash fix
no router ospf triggers to cancel all threads
including read/write (receive/send packets) threads,
cleans up resources fd, message queue and data.

Last job of write (packet) thread invoked where the
ospf instance is referenced is not running nor
the socket fd valid.

Write thread callback should check if fd is valid and
ospf instance is running before proceeding to send a
message over socket.

Ticket:CM-20095
Testing Done:

Performed the multiple 'no router ospf' with the fix
in topology where the crash was seen.
Post fix the crash is not observed.

Signed-off-by: Chirag Shah <chirag@cumulusnetworks.com>
2019-07-15 09:55:54 -07:00
Donald Sharp 24d9575d53 ospfd: continue statement is redundant
The continue statement is redundant because DISCARD_LSA
has one in it already.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2019-05-03 05:05:19 -04:00
Saravanan K 9570f7378b ospfd: Remaining packet calculation while fragmenting lsu, ls-ack and ls-req
While fragmenting ospf ls packets, before appending the link state info,
wrong value is checked to see if current packet can fit in another ls info.
Because of this, when a lower mtu is configured, it couldn't fit in even 1
ls ack, which tries to send all the available ls ack in the list in loop.
This keeps allocating memory to send the packet and ends up putting the
packet buffer without ls-ack into deferred send que(ospf_ls_ack_send_delayed).
This infinite loop causes infinite memory being allocated in a loop causing
system to be unstable. This commit takes care of calculating the right value
to compare for checking oif this buffer can fit in more.

Signed-off-by: Saravanan K <saravanank@vmware.com>
2019-03-25 06:23:17 -07:00
Quentin Young c531be7c94 ospfd: fix link MTU warning style
Kernel style dictates that we do not break log messages across lines

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2019-02-25 16:59:31 +00:00
Chirag Shah 76c1efd755 ospfd: address CVE-2017-3224
Based on the vulnerability mentioned in 793496 an attacker can craft an
LSA with MaxSequence number wtih invalid links and not set age to MAX_AGE
so the lsa would not be flush from the database.

To address the issue, check incoming LSA is MaxSeq but Age is not set
to MAX_AGE 3600, discard the LSA from processing it.
Based on  RFC-2328 , When a LSA update sequence reaches MaxSequence
number, it should be prematurely aged out from the database with age set
to MAX_AGE (3600).

Ticket:CM-18989
Reviewed By:
Testing Done:

Signed-off-by: Chirag Shah <chirag@cumulusnetworks.com>
2019-02-03 14:42:37 -08:00
Russ White 3bce6932ef
Merge pull request #3657 from nitinsoniism/ospf_mtu_crash
ospfd: ospfd core if hello packet exceeds link MTU
2019-01-29 09:58:53 -05:00
Nitin Soni 9b18d58e17 ospfd: ospfd core if hello packet exceeds link MTU
Ospfd cored because of an assert when we try to write more than the MTU
size to the ospf packet buffer stream. The problem is - we allocate only MTU
sized buffer. The expectation is that Hello packets are never large
enough to approach MTU. Instead of crashing, this fix discards hello and
logs an error. One should not have so many neighbors behind an
interface.

Ticket: CM-22380
Signed-off-by: Nitin Soni <nsoni@cumulusnetworks.com>
Reviewed-by: CCR-8204
2019-01-27 20:27:58 -08:00
Ruben Kerkhof 4d762f2607 Treewide: use ANSI function definitions
Signed-off-by: Ruben Kerkhof <ruben@rubenkerkhof.com>
2019-01-24 11:21:59 +01:00
David Lamparter 3e30070331 Revert "isisd lib ospfd pbrd python: fix empty init"
This reverts commit 48944eb65e.

We're using GNU C, not ISO C - and this commit triggers new (real)
warnings about {0} instead of bogus ones about {}.

Signed-off-by: David Lamparter <equinox@diac24.net>
2018-12-01 16:49:45 +01:00
F. Aragon 48944eb65e
isisd lib ospfd pbrd python: fix empty init
ISO C forbids empty initializer braces. Empty initializers have been
replaced with {0}

Signed-off-by: F. Aragon <paco@voltanet.io>
2018-11-21 14:45:42 +01:00
David Lamparter 0437e10517 *: spelchek
Signed-off-by: David Lamparter <equinox@diac24.net>
2018-10-25 20:10:57 +02:00
Donald Sharp 4bb420ab81 ospfd: Do not allow thread drop
When the ospf->oi_write_q is not empty that means that ospf could
already have a thread scheduled for running.  Just dropping
the pointer before resheduling does not stop the one currently
scheduled for running from running.  The calling of thread_add_write
checks to see if we are already running and does the right thing here
so it is sufficient to just call thread_add_write.

This issue was tracked down from this stack trace:

Oct 19 18:04:00 VYOS-R1 ospfd[1811]: [EC 134217739] interface eth2.1032:172.16.4.110: ospf_check_md5 bad sequence 5333618 (expect 5333649)
Oct 19 18:04:00 VYOS-R1 ospfd[1811]: message repeated 3 times: [ [EC 134217739] interface eth2.1032:172.16.4.110: ospf_check_md5 bad sequence 5333618 (expect 5333649)]
Oct 19 18:04:00 VYOS-R1 ospfd[1811]: Assertion `node’ failed in file ospfd/ospf_packet.c, line 666, function ospf_write
Oct 19 18:04:00 VYOS-R1 ospfd[1811]: Backtrace for 8 stack frames:
Oct 19 18:04:00 VYOS-R1 ospfd[1811]: [bt 0] /usr/lib/libfrr.so.0(zlog_backtrace+0x3a) [0x7fef3efe9f8a]
Oct 19 18:04:00 VYOS-R1 ospfd[1811]: [bt 1] /usr/lib/libfrr.so.0(_zlog_assert_failed+0x61) [0x7fef3efea501]
Oct 19 18:04:00 VYOS-R1 ospfd[1811]: [bt 2] /usr/lib/frr/ospfd(+0x2f15e) [0x562e0c91815e]
Oct 19 18:04:00 VYOS-R1 ospfd[1811]: [bt 3] /usr/lib/libfrr.so.0(thread_call+0x60) [0x7fef3f00d430]
Oct 19 18:04:00 VYOS-R1 ospfd[1811]: [bt 4] /usr/lib/libfrr.so.0(frr_run+0xd8) [0x7fef3efe7938]
Oct 19 18:04:00 VYOS-R1 ospfd[1811]: [bt 5] /usr/lib/frr/ospfd(main+0x153) [0x562e0c901753]
Oct 19 18:04:00 VYOS-R1 ospfd[1811]: [bt 6] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7fef3d83db45]
Oct 19 18:04:00 VYOS-R1 ospfd[1811]: [bt 7] /usr/lib/frr/ospfd(+0x190be) [0x562e0c9020be]
Oct 19 18:04:00 VYOS-R1 ospfd[1811]: Current thread function ospf_write, scheduled from file ospfd/ospf_packet.c, line 881
Oct 19 18:04:00 VYOS-R1 zebra[1771]: [EC 4043309116] Client ‘ospf’ encountered an error and is shutting down.
Oct 19 18:04:00 VYOS-R1 zebra[1771]: client 41 disconnected. 0 ospf routes removed from the rib

We had an assert(node) in ospf_write, which means that the list was empty.  So I just
searched until I saw a code path that allowed multiple writes to the ospf_write function.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2018-10-20 09:04:25 -04:00
David Lamparter 6a154c8812 *: list_delete_and_null() -> list_delete()
Signed-off-by: David Lamparter <equinox@diac24.net>
2018-10-02 11:40:52 +02:00
Quentin Young 1c50c1c0d6 *: style for EC replacements
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2018-09-13 19:38:57 +00:00
Quentin Young 450971aa99 *: LIB_[ERR|WARN] -> EC_LIB
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2018-09-13 19:34:28 +00:00
Quentin Young cf444bcf40 ospfd: OSPF_[ERR|WARN] -> EC_OSPF
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2018-09-13 18:56:04 +00:00
Donald Sharp fc6eb7d827
Merge pull request #3006 from pacovn/static_analysis__shadow_variables1
bgpd isisd ospf6d ospfd: variable shadowing fixes
2018-09-13 08:37:22 -04:00
F. Aragon f7813c7c7f
bgpd isisd ospf6d ospfd: variable shadowing fixes
Signed-off-by: F. Aragon <paco@voltanet.io>
2018-09-12 16:44:36 +02:00
Donald Sharp c9cc11f669 ospfd: Modify ospf_packet.c to use new error-cards subsystem
Signed-off-by: Donald sharp <sharpd@cumulusnetworks.com>
2018-09-06 20:50:58 +00:00
Donald Sharp 5b3d4186de ospfd: Add ospf_lsa_new_and_data function and abstract away
In all but one instance we were following this pattern
with ospf_lsa_new:

ospf_lsa_new()
ospf_lsa_data_new()

so let's create a ospf_lsa_new_and_data to abstract
this bit of fun and cleanup all the places where
it assumes these function calls can fail.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2018-08-20 20:41:37 -04:00
Quentin Young af4c27286d *: rename zlog_fer -> flog_err
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2018-08-14 20:02:05 +00:00
Chirag Shah 313d7993a3 ospfd: zlog_ferr facility
Ticket:CM-21333

Signed-off-by: Chirag Shah <chirag@cumulusnetworks.com>
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2018-08-14 20:02:05 +00:00
paco 5f18adf01b
eigrpd, isisd, lib, ospfd: no effect (cppcheck)
Assignment of function parameter has no effect outside the function.

Signed-off-by: F. Aragon <paco@voltanet.io>
2018-06-19 10:19:05 +02:00
Quentin Young d7c0a89a3a
*: use C99 standard fixed-width integer types
The following types are nonstandard:
- u_char
- u_short
- u_int
- u_long
- u_int8_t
- u_int16_t
- u_int32_t

Replace them with the C99 standard types:
- uint8_t
- unsigned short
- unsigned int
- unsigned long
- uint8_t
- uint16_t
- uint32_t

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2018-03-27 15:13:34 -04:00
Lou Berger 996c93142d *: conform with COMMUNITY.md formatting rules, via 'make indent'
Signed-off-by: Lou Berger <lberger@labn.net>
2018-03-06 14:04:32 -05:00
Olivier Dugeon 19274fe8c7 ospfd: Fix ospfd crash
- ospfd/ospf_opaque.c: Update issue #1652 by introducing a new
function 'free_opaque_info_owner()' to clean list of callback owner
and call this function in appropriate place where 'listdelete_and_null'
is not used.

 - ospfd/ospf_packet.c: In case of crash, ospfd is not been able to
flush LSA. In case of self Opaque LSA, when restarting, ospfd crash
during the resynchronisation process with its neighbor due to an
empty list of LSA to flood. Just add a control on the list count
in 'ospf_ls_upd_queue_send()' to escape the function and avoid the
problem.

Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>
2018-02-09 12:13:07 +01:00
Chirag Shah 05ba78e4d9 ospfd: Set filter to unbound debug logs
Ticket:CM-19213

Signed-off-by: Chirag Shah <chirag@cumulusnetworks.com>
2017-12-27 10:13:38 -08:00
Quentin Young 2d34fb80b8
*: don't use deprecated stream.h macros
Some of the deprecated stream.h macros see such little use that we may
as well just remove them and use the non-deprecated macros.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2017-12-01 13:51:06 -05:00
Chirag Shah 046460a1e0 ospfd: flush self-originated lsa upon restart frr
Router-ID change or ospf instance going down,
send LS-Upd with MAXAGE to self origintated LSAs to
all ospf neighbors.

Ticket:CM-1576
Testing Done:
Bring R1 - R2, Change Router-ID on R2, restart frr on R2
Validated R1 ospf LSDB for max aged 3600 LSA from R2.

Signed-off-by: Chirag Shah <chirag@cumulusnetworks.com>
2017-11-07 18:14:14 -08:00
Chirag Shah c93396633c ospfd: show comand for ospf packet stats
Display OSPFv2 Protocol packets stats per interface.

tor-1# show ip ospf vrf all interface traffic

Interface    HELLO    DB-Desc   LS-Req LS-Update   LS-Ack
             Rx/Tx    Rx/Tx     Rx/Tx  Rx/Tx       Rx/Tx
------------------------------------------------------------
swp1         1/0      2/3       1/1    2/2         1/1
swp2         6/0      2/7       1/1    1/4         3/2

Signed-off-by: Chirag Shah <chirag@cumulusnetworks.com>
2017-10-23 14:47:59 -07:00
Donald Sharp acdf5e2510 *: Convert list_free usage to list_delete
list_free is occassionally being used to delete the
list and accidently not deleting all the nodes.
We keep running across this usage pattern.  Let's
remove the temptation and only allow list_delete
to handle list deletion.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2017-10-05 10:53:17 -04:00
Donald Sharp affe9e9983 *: Convert list_delete(struct list *) to ** to allow nulling
Convert the list_delete(struct list *) function to use
struct list **.  This is to allow the list pointer to be nulled.

I keep running into uses of this list_delete function where we
forget to set the returned pointer to NULL and attempt to use
it and then experience a crash, usually after the developer
has long since left the building.

Let's make the api explicit in it setting the list pointer
to null.

Cynical Prediction:  This code will expose a attempt
to use the NULL'ed list pointer in some obscure bit
of code.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2017-10-05 10:53:13 -04:00
Chirag Shah e1b18df1ea ospfd: fix vrf bind sock non-linux system
For non GNU_LINUX like open Bsd avoid sending packet
to non vrf aware device using in_pktinfo.

Signed-off-by: Chirag Shah <chirag@cumulusnetworks.com>
2017-10-03 09:22:47 -07:00
Chirag Shah e7503eab31 ospfd: Bind socket to vrf device
Signed-off-by: Chirag Shah <chirag@cumulusnetworks.com>
2017-10-03 09:22:47 -07:00
Chirag Shah 35955c14c2 ospfd: OSPFv2 VRF fixesI
Fix ospf interface running config to display vrf
fix clang warnings

Signed-off-by: Chirag Shah <chirag@cumulusnetworks.com>
2017-10-03 09:22:47 -07:00
Chirag Shah b5a8894de6 ospfd: OSPFv2 VRF Support
Signed-off-by: Chirag Shah <chirag@cumulusnetworks.com>
2017-10-03 09:15:19 -07:00
Vincent JARDIN 89a48046dd ospf_packet: scan-build/clang clean up
get the code safer using snprintf().
2017-10-02 09:14:03 +02:00
Jorge Boncompte 19aad877b7 lib: optimize IPV4_ADDR_[SAME|COPY]()
Change all callers of IPV4_ADDR_SAME() to pass a pointer to a struct in_addr

Use assignment and comparison instead of memcpy() and memcmp(). Avoids function
calls. Faster.

Signed-off-by: Jorge Boncompte <jbonor@gmail.com>
2017-08-17 17:58:35 +02:00
David Lamparter 9d303b37d7 Revert "*: reindent pt. 2"
This reverts commit c14777c6bf.

clang 5 is not widely available enough for people to indent with.  This
is particularly problematic when rebasing/adjusting branches.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2017-07-22 14:52:33 +02:00
whitespace / reindent c14777c6bf
*: reindent pt. 2
w/ clang 5

* reflow comments
* struct members go 1 per line
* binpack algo was adjusted
2017-07-17 15:26:02 -04:00
whitespace / reindent d62a17aede *: reindent
indent.py `git ls-files | pcregrep '\.[ch]$' | pcregrep -v '^(ldpd|babeld|nhrpd)/'`

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2017-07-17 14:04:07 +02:00
David Lamparter acd738fc7f *: fix GCC 7 switch/case fallthrough warnings
Need a comment on these.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2017-07-14 16:59:43 +02:00
Quentin Young 56b4067930 *: simplify log message lookup
log.c provides functionality for associating a constant (typically a
protocol constant) with a string and finding the string given the
constant. However this is highly delicate code that is extremely prone
to stack overflows and off-by-one's due to requiring the developer to
always remember to update the array size constant and to do so correctly
which, as shown by example, is never a good idea.b

The original goal of this code was to try to implement lookups in O(1)
time without a linear search through the message array. Since this code
is used 99% of the time for debugs, it's worth the 5-6 additional cmp's
worst case if it means we avoid explitable bugs due to oversights...

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2017-06-21 15:22:21 +00:00
David Lamparter 896014f4bc *: make consistent & update GPLv2 file headers
The FSF's address changed, and we had a mixture of comment styles for
the GPL file header.  (The style with * at the beginning won out with
580 to 141 in existing files.)

Note: I've intentionally left intact other "variations" of the copyright
header, e.g. whether it says "Zebra", "Quagga", "FRR", or nothing.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2017-05-15 16:37:41 +02:00
Quentin Young 66e78ae64b *: update thread_add_* calls
Pass pointer to pointer instead of assigning by return value. See
previous commit message.

To ensure that the behavior stays functionally correct, any assignments
with the result of a thread_add* function have been transformed to set
the pointer to null before passing it. These can be removed wherever the
pointer is known to already be null.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2017-05-09 20:44:22 +00:00
Quentin Young ffa2c8986d *: remove THREAD_ON macros, add nullity check
The way thread.c is written, a caller who wishes to be able to cancel a
thread or avoid scheduling it twice must keep a reference to the thread.
Typically this is done with a long lived pointer whose value is checked
for null in order to know if the thread is currently scheduled.  The
check-and-schedule idiom is so common that several wrapper macros in
thread.h existed solely to provide it.

This patch removes those macros and adds a new parameter to all
thread_add_* functions which is a pointer to the struct thread * to
store the result of a scheduling call. If the value passed is non-null,
the thread will only be scheduled if the value is null. This helps with
consistency.

A Coccinelle spatch has been used to transform code of the form:

  if (t == NULL)
    t = thread_add_* (...)

to the form

  thread_add_* (..., &t)

The THREAD_ON macros have also been transformed to the underlying
thread.c calls.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2017-05-09 20:44:19 +00:00
Donald Sharp 95af5f130a lib, ospfd, ripd: Convert if_lookup_address to be vrf aware
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2017-03-15 10:31:10 -04:00
Donald Sharp 7e2b760345 *: Remove non-vrf based ifindex lookup
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2017-03-15 10:26:53 -04:00
David Lamparter 4525281af1 *: get rid of zlog(*, LOG_LEVEL, ...)
Result of running the following Coccinelle patch + fixups:
<<EOF
/* long-forms: zlog(NULL, <level>, ...)
 *    =>       zlog_level(...)
 */

@@
expression list args;
@@
- zlog(NULL, LOG_DEBUG, args)
+ zlog_debug(args)

@@
expression list args;
@@
- zlog(NULL, LOG_NOTICE, args)
+ zlog_notice(args)

@@
expression list args;
@@
- zlog(NULL, LOG_INFO, args)
+ zlog_info(args)

@@
expression list args;
@@
- zlog(NULL, LOG_WARNING, args)
+ zlog_warn(args)

@@
expression list args;
@@
- zlog(NULL, LOG_ERR, args)
+ zlog_err(args)

/* long-forms: zlog(base->log, <level>, ...)
 *    =>       zlog_level(...)
 */

@@
expression base;
expression list args;
@@
- zlog(base->log, LOG_DEBUG, args)
+ zlog_debug(args)

@@
expression base;
expression list args;
@@
- zlog(base->log, LOG_NOTICE, args)
+ zlog_notice(args)

@@
expression base;
expression list args;
@@
- zlog(base->log, LOG_INFO, args)
+ zlog_info(args)

@@
expression base;
expression list args;
@@
- zlog(base->log, LOG_WARNING, args)
+ zlog_warn(args)

@@
expression base;
expression list args;
@@
- zlog(base->log, LOG_ERR, args)
+ zlog_err(args)

EOF

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2017-03-08 00:15:39 +01:00
David Lamparter cf672a8654 *: use monotime()
This is largely a bulk-replace made with coccinelle.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2017-01-23 18:26:32 +01:00
David Lamparter cbf3e3eb3a ospfd: time: replace local helpers with monotime
This ditches tv_add, tv_sub, tv_cmp, etc. in favour of
monotime{,_since,_until}() which actually makes the code much more
readable in some locations.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2017-01-23 18:26:28 +01:00
Renato Westphal de587d745e ospfd: set the OSPF socket's send buffer size only once
This reverts commit b7fe4141, which introduced a logic where the OSPF
send buffer size was dynamically updated to reflect the maximum MTU
of the OSPF enabled interfaces (this was done to make ospfd work with
interfaces configured for jumbo frames).

Since commit a78d75b0, this is not necessary anymore because
ospf_sock_init() now sets the OSPF send buffer size to a very high value
(8MB). Also, the previous logic was broken because it didn't account
for run-time interface MTU changes.

Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2016-12-08 12:50:25 +01:00
Renato Westphal b10ce84103 ripd: fix the "neighbor" command.
We can't use if_lookup_prefix() in rip_update_process() because this
function uses prefix_cmp() internally to try matching an interface
address to a static neighbor's address.

Since prefix_cmp() tries to match exact prefixes, if_lookup_prefix()
was always returning NULL.

What we really need here is to use prefix_match(), which checks if
one prefix includes the other (e.g. one /24 interface including a /32
static neighbor's address). The fix then is to replace the call to
if_lookup_prefix() and use if_lookup_address() instead, which uses
prefix_match() internally.

Fixes IxANVL RIP test 17.1

Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
2016-11-25 11:46:06 -02:00