matthieu/frr
1
0
Fork 0
forked from Mirror/frr
Code Pull requests Activity
frr/bgpd
History
Donatas Abraitis e7bc47b501 bgpd: Check against extended community unit size for link bandwidth 
If we receive a malformed packets, this could lead ptr_get_be64() reading
the packets more than needed (heap overflow).

```
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
    0 0xaaaaaadf86ec in __asan_memcpy (/home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/.libs/bgpd+0x3586ec) (BuildId: 78123cd26ada92b8b59fc0d74d292ba70c9d2e01)
    1 0xaaaaaaeb60fc in ptr_get_be64 /home/ubuntu/frr-public/frr_public_private-libfuzzer/./lib/stream.h:377:2
    2 0xaaaaaaeb5b90 in ecommunity_linkbw_present /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_ecommunity.c:1895:10
    3 0xaaaaaae50f30 in bgp_attr_ext_communities /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_attr.c:2639:8
    4 0xaaaaaae49d58 in bgp_attr_parse /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_attr.c:3776:10
    5 0xaaaaab063260 in bgp_update_receive /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_packet.c:2371:20
    6 0xaaaaab05df00 in bgp_process_packet /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_packet.c:4063:11
    7 0xaaaaaae36110 in LLVMFuzzerTestOneInput /home/ubuntu/frr-public/frr_public_private-libfuzzer/bgpd/bgp_main.c:582:3
```

This is triggered when receiving such a packet (malformed):

```
(gdb) bt
0  ecommunity_linkbw_present (ecom=0x555556287990, bw=bw@entry=0x7fffffffda68)
    at bgpd/bgp_ecommunity.c:1802
1  0x000055555564fcac in bgp_attr_ext_communities (args=0x7fffffffd840) at bgpd/bgp_attr.c:2619
2  bgp_attr_parse (peer=peer@entry=0x55555628cdf0, attr=attr@entry=0x7fffffffd960, size=size@entry=20,
    mp_update=mp_update@entry=0x7fffffffd940, mp_withdraw=mp_withdraw@entry=0x7fffffffd950)
    at bgpd/bgp_attr.c:3755
3  0x00005555556aa655 in bgp_update_receive (connection=connection@entry=0x5555562aa030,
    peer=peer@entry=0x55555628cdf0, size=size@entry=41) at bgpd/bgp_packet.c:2324
4  0x00005555556afab7 in bgp_process_packet (thread=<optimized out>) at bgpd/bgp_packet.c:3897
5  0x00007ffff7ac2f73 in event_call (thread=thread@entry=0x7fffffffdc70) at lib/event.c:2011
6  0x00007ffff7a6fb90 in frr_run (master=0x555555bc7c90) at lib/libfrr.c:1212
7  0x00005555556457e1 in main (argc=<optimized out>, argv=<optimized out>) at bgpd/bgp_main.c:543
(gdb) p *ecom
$1 = {refcnt = 1, unit_size = 8 '\b', disable_ieee_floating = false, size = 2, val = 0x555556282150 "",
  str = 0x5555562a9c30 "UNK:0, 255 UNK:2, 6"}
```

Reported-by: Iggy Frankovic <iggyfran@amazon.com>
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2024-06-11 10:03:17 +03:00
..
rfapi bgpd: move labels from extra to extra->labels 2024-06-05 13:11:29 +02:00
rfp-example *: Convert struct event_master to struct event_loop 2023-03-24 08:32:17 -04:00
.gitignore
bgp_addpath.c bgpd: Handle Addpath capability using dynamic capabilities 2023-10-03 17:44:19 +03:00
bgp_addpath.h bgpd: Avoid padding for bgp_paths_limit_capability struct 2024-03-14 09:50:49 +02:00
bgp_addpath_types.h bgpd: Implement neighbor X addpath-tx-best-selected command 2023-06-07 22:27:29 +03:00
bgp_advertise.c bgpd: fix labels in adj-rib-in 2024-06-05 13:11:29 +02:00
bgp_advertise.h bgpd: fix label in adj-rib-out 2024-06-05 13:11:29 +02:00
bgp_aspath.c bgpd: Add some missing data to show bgp attribute-info 2024-03-14 06:51:45 -04:00
bgp_aspath.h bgpd: fix no bgp as-path access-list issue 2024-02-26 14:58:54 +01:00
bgp_attr.c bgpd: store number of labels with 8 bits 2024-06-05 13:11:29 +02:00
bgp_attr.h bgpd: store number of labels with 8 bits 2024-06-05 13:11:29 +02:00
bgp_attr_evpn.c *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_attr_evpn.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_bfd.c bgpd: fix disable bfd profile for neighbors. 2024-03-13 01:15:16 +03:00
bgp_bfd.h *: Convert struct event_master to struct event_loop 2023-03-24 08:32:17 -04:00
bgp_bmp.c bgpd: move labels from extra to extra->labels 2024-06-05 13:11:29 +02:00
bgp_bmp.h bgpd: add 'bmp stat send-experimental' command 2024-04-26 08:12:38 +02:00
bgp_btoa.c *: zebra.h should not have fcntl.h 2024-01-09 12:50:40 -05:00
bgp_clist.c bgpd: Return success if lcomm/comm/extcomm name or entry is not found 2024-05-24 11:25:00 -07:00
bgp_clist.h bgpd: Removed unused COMMUNITY_LIST_ERR_CANT_FIND_LIST 2024-05-24 11:25:16 -07:00
bgp_community.c bgpd: Remove deprecated COMMUNITY_INTERNET community 2023-08-03 17:12:19 +03:00
bgp_community.h bgpd: Remove deprecated COMMUNITY_INTERNET community 2023-08-03 17:12:19 +03:00
bgp_community_alias.c *: Add a hash_clean_and_free() function 2023-03-21 08:54:21 -04:00
bgp_community_alias.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_conditional_adv.c bgpd: Ensure community data is freed in some cases. 2024-03-13 19:28:11 -04:00
bgp_conditional_adv.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_damp.c bgpd: Put dest into work queue when the path is really withdrawn by dampening 2024-05-03 09:30:33 +03:00
bgp_damp.h bgpd: Pass the right reuse_list when handling it via bgp_reuse_timer thread 2024-05-03 09:30:33 +03:00
bgp_debug.c bgpd: store number of labels with 8 bits 2024-06-05 13:11:29 +02:00
bgp_debug.h bgpd: store number of labels with 8 bits 2024-06-05 13:11:29 +02:00
bgp_dump.c *: remove sys/stat.h from zebra.h 2024-01-09 12:39:23 -05:00
bgp_dump.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_ecommunity.c bgpd: Check against extended community unit size for link bandwidth 2024-06-11 10:03:17 +03:00
bgp_ecommunity.h bgpd: Update IPv6 extended community sub-type for extended link bandwidth 2024-04-23 08:55:00 +03:00
bgp_encap_tlv.c *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_encap_tlv.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_encap_types.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_errors.c Revert "bgpd: store bgp link-state prefixes" 2023-10-10 16:45:00 -04:00
bgp_errors.h Revert "bgpd: store bgp link-state prefixes" 2023-10-10 16:45:00 -04:00
bgp_evpn.c bgpd: move labels from extra to extra->labels 2024-06-05 13:11:29 +02:00
bgp_evpn.h bgpd: store number of labels with 8 bits 2024-06-05 13:11:29 +02:00
bgp_evpn_mh.c Merge pull request #15900 from mikemallin/v6-vtep-lib-upstream 2024-06-07 14:34:11 -04:00
bgp_evpn_mh.h bgpd : backpressure - Handle BGP-Zebra(EPVN) Install evt Creation 2024-04-08 10:51:43 -07:00
bgp_evpn_private.h bgpd: bgp_best_selection is inherently pi based 2024-04-01 10:24:14 -04:00
bgp_evpn_vty.c bgpd: MTYPE_BGP was being overused split up 2023-11-21 12:41:18 -05:00
bgp_evpn_vty.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_filter.c bgpd: fix no bgp as-path access-list issue 2024-02-26 14:58:54 +01:00
bgp_filter.h bgpd: fix no bgp as-path access-list issue 2024-02-26 14:58:54 +01:00
bgp_flowspec.c bgpd: Free temp memory 2023-05-29 13:39:14 +04:00
bgp_flowspec.h bgpd: Treat withdraw variable as a bool 2023-04-06 17:41:32 -04:00
bgp_flowspec_private.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_flowspec_util.c bgpd: add some flowspec sanity returns 2023-04-28 22:28:16 +02:00
bgp_flowspec_util.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_flowspec_vty.c *: Let's use the native IFNAMSIZ instead of INTERFACE_NAMSIZ 2023-11-21 08:08:29 -05:00
bgp_fsm.c bgpd: fix dynamic peer graceful restart race condition 2024-05-16 15:19:11 +02:00
bgp_fsm.h bgpd: Send "Send Hold Timer Expired" on such events notification 2024-02-29 15:37:53 +02:00
bgp_io.c bgpd: bgp_fsm_change_status/BGP_TIMER_ON and BGP_EVENT_ADD 2023-09-10 08:31:25 -04:00
bgp_io.h bgpd: Convert bgp_io.c to take struct peer_connection 2023-08-18 09:29:04 -04:00
bgp_keepalives.c bgpd: make bgp_keepalives_on|off connection oriented 2023-09-10 08:31:25 -04:00
bgp_keepalives.h bgpd: make bgp_keepalives_on|off connection oriented 2023-09-10 08:31:25 -04:00
bgp_label.c bgpd: move labels from extra to extra->labels 2024-06-05 13:11:29 +02:00
bgp_label.h bgpd: move labels from extra to extra->labels 2024-06-05 13:11:29 +02:00
bgp_labelpool.c bgpd: bgp_sync_label_manager failure case 2024-01-06 20:26:14 -05:00
bgp_labelpool.h bgpd: Use synchronous way to get labels from Zebra 2023-06-20 20:50:10 +03:00
bgp_lcommunity.c bgpd: Fix lcom->str string length to correctly cover aliases 2023-04-20 16:51:56 -04:00
bgp_lcommunity.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_mac.c bgpd: move labels from extra to extra->labels 2024-06-05 13:11:29 +02:00
bgp_mac.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_main.c bgpd: add bgp_labels hash 2024-06-05 13:11:29 +02:00
bgp_memory.c bgpd: add bgp_labels hash 2024-06-05 13:11:29 +02:00
bgp_memory.h bgpd: add bgp_labels hash 2024-06-05 13:11:29 +02:00
bgp_mpath.c bgpd: Include IPv6 extended community into multipath considerations 2024-04-22 17:50:08 +03:00
bgp_mpath.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_mplsvpn.c bgpd: move labels from extra to extra->labels 2024-06-05 13:11:29 +02:00
bgp_mplsvpn.h bgpd: do allocate vrf label only when necessary 2024-04-18 14:55:25 +02:00
bgp_mplsvpn_snmp.c bgpd: MTYPE_BGP was being overused split up 2023-11-21 12:41:18 -05:00
bgp_mplsvpn_snmp.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_network.c bgpd: Adjust terminology related to DSCP 2024-06-02 06:44:59 -04:00
bgp_network.h bgpd: Set TCP min MSS per listener 2023-09-18 22:34:45 +03:00
bgp_nexthop.c bgpd: add resolved_prefix visibility on nht 2024-03-29 17:20:31 +01:00
bgp_nexthop.h bgpd: add resolved_prefix visibility on nht 2024-03-29 17:20:31 +01:00
bgp_nhg.c bgpd: move l3nhg functions in separate bgp_nhg.[ch] file 2023-12-11 21:03:33 +01:00
bgp_nhg.h bgpd: move l3nhg functions in separate bgp_nhg.[ch] file 2023-12-11 21:03:33 +01:00
bgp_nht.c bgpd: add bgp_path_info_num_labels() 2024-06-05 11:08:46 +02:00
bgp_nht.h bgpd: move l3nhg functions in separate bgp_nhg.[ch] file 2023-12-11 21:03:33 +01:00
bgp_open.c bgpd: Add sanity check for capability lengths before processing them 2024-05-24 10:35:42 +03:00
bgp_open.h bgpd: Add sanity check for capability lengths before processing them 2024-05-24 10:35:42 +03:00
bgp_packet.c bgpd: Send End-of-RIB not only if Graceful Restart capability is received 2024-05-31 15:03:55 +03:00
bgp_packet.h bgpd: First pass of BGP_EVENT_ADD 2023-09-10 08:31:25 -04:00
bgp_pbr.c bgpd: bgp_path_info_extra memory optimization 2023-08-08 10:48:07 +00:00
bgp_pbr.h *: Let's use the native IFNAMSIZ instead of INTERFACE_NAMSIZ 2023-11-21 08:08:29 -05:00
bgp_rd.c Merge pull request #12248 from pguibert6WIND/bgpasdot 2023-02-21 08:01:03 -05:00
bgp_rd.h bgpd: Optimize memory for rd_ip struct 2024-01-31 11:29:30 +02:00
bgp_regex.c *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_regex.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_route.c bgpd: fix labels in adj-rib-in 2024-06-05 13:11:29 +02:00
bgp_route.h bgpd: move labels from extra to extra->labels 2024-06-05 13:11:29 +02:00
bgp_routemap.c bgpd: move labels from extra to extra->labels 2024-06-05 13:11:29 +02:00
bgp_routemap_nb.c bgpd, yang: fix missing mandatory/default statements on some leafs 2024-02-26 01:03:27 +02:00
bgp_routemap_nb.h bgpd, yang: fix missing mandatory/default statements on some leafs 2024-02-26 01:03:27 +02:00
bgp_routemap_nb_config.c bgpd: Implement draft-li-idr-link-bandwidth-ext-01 2024-04-22 17:50:08 +03:00
bgp_rpki.c bgpd: move labels from extra to extra->labels 2024-06-05 13:11:29 +02:00
bgp_rpki.h bgpd: create cache server socket in vrf 2024-01-18 13:22:19 +01:00
bgp_script.c bgpd: Convert struct peer_connection to dynamically allocated 2023-08-18 09:29:04 -04:00
bgp_script.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_snmp.c bgpd: fix new Formatting / Styling warning 2023-10-24 17:16:47 +02:00
bgp_snmp.h bgpd: add [no] bgp snmp traps bgp4-mibv2 command 2023-10-24 17:16:47 +02:00
bgp_snmp_bgp4.c Revert "bgpd: fix pointer arithmetic in bgp snmp module" 2024-04-23 11:39:29 +02:00
bgp_snmp_bgp4.h bgpd: add snmp traps for bgp4-mibv2 2023-10-24 17:16:47 +02:00
bgp_snmp_bgp4v2.c bgpd: move mp_nexthop_prefer_global boolean attribute to nh_flags 2024-02-22 18:20:34 +01:00
bgp_snmp_bgp4v2.h bgpd: add snmp traps for bgp4-mibv2 2023-10-24 17:16:47 +02:00
bgp_table.c bgpd: When using dev build add pointer information to %pBD 2024-03-14 09:45:09 +00:00
bgp_table.h bgpd : backpressure - Handle BGP-Zebra(EPVN) Install evt Creation 2024-04-08 10:51:43 -07:00
bgp_trace.c *: Add missing SPDX-License-Identifier for some .c/.h files 2024-03-21 16:46:58 +02:00
bgp_trace.h bgpd: lttng tp add ethtag to macip zebra send 2023-12-27 18:01:50 -08:00
bgp_updgrp.c bgpd: Drop periodic merge check functions 2024-03-20 16:44:13 +02:00
bgp_updgrp.h bgpd: Drop periodic merge check functions 2024-03-20 16:44:13 +02:00
bgp_updgrp_adv.c bgpd: fix label in adj-rib-out 2024-06-05 13:11:29 +02:00
bgp_updgrp_packet.c bgpd: move labels from extra to extra->labels 2024-06-05 13:11:29 +02:00
bgp_vnc_types.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_vpn.c bgpd: Fix display when using missing-as-worst 2024-04-15 12:33:53 -04:00
bgp_vpn.h *: auto-convert to SPDX License IDs 2023-02-09 14:09:11 +01:00
bgp_vty.c bgpd: Adjust terminology related to DSCP 2024-06-02 06:44:59 -04:00
bgp_vty.h lib,bgpd,vtysh: move bgp vty defines to lib 2024-04-24 08:23:12 -04:00
bgp_zebra.c bgpd: move labels from extra to extra->labels 2024-06-05 13:11:29 +02:00
bgp_zebra.h bgpd: store number of labels with 8 bits 2024-06-05 13:11:29 +02:00
bgpd.c Merge pull request #15434 from louis-6wind/labels-hash 2024-06-06 16:27:38 -04:00
bgpd.h bgpd: Adjust terminology related to DSCP 2024-06-02 06:44:59 -04:00
Makefile
subdir.am bgpd: move l3nhg functions in separate bgp_nhg.[ch] file 2023-12-11 21:03:33 +01:00