summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-networking/recipes-protocols/frr/frr/0001-tools-make-quiet-actually-suppress-output.patch58
-rw-r--r--meta-networking/recipes-protocols/frr/frr/CVE-2023-46752.patch125
-rw-r--r--meta-networking/recipes-protocols/frr/frr/CVE-2023-46753.patch117
-rw-r--r--meta-networking/recipes-protocols/frr/frr/CVE-2023-47234.patch95
-rw-r--r--meta-networking/recipes-protocols/frr/frr/CVE-2023-47235.patch112
-rw-r--r--meta-networking/recipes-protocols/frr/frr_9.1.bb (renamed from meta-networking/recipes-protocols/frr/frr_9.0.1.bb)9
6 files changed, 2 insertions, 514 deletions
diff --git a/meta-networking/recipes-protocols/frr/frr/0001-tools-make-quiet-actually-suppress-output.patch b/meta-networking/recipes-protocols/frr/frr/0001-tools-make-quiet-actually-suppress-output.patch
deleted file mode 100644
index 3e93cf3c47..0000000000
--- a/meta-networking/recipes-protocols/frr/frr/0001-tools-make-quiet-actually-suppress-output.patch
+++ /dev/null
@@ -1,58 +0,0 @@
1From 312d5ee1592f8c5b616d330233d1de2643f759e2 Mon Sep 17 00:00:00 2001
2From: Jonas Gorski <jonas.gorski@bisdn.de>
3Date: Thu, 14 Sep 2023 17:04:16 +0200
4Subject: [PATCH] tools: make --quiet actually suppress output
5
6When calling daemon_stop() with --quiet and e.g. the pidfile is empty,
7it won't return early since while "$fail" is set, "$2" is "--quiet", so
8the if condition isn't met and it will continue executing, resulting
9in error messages in the log:
10
11> Sep 14 14:48:33 localhost watchfrr[2085]: [YFT0P-5Q5YX] Forked background command [pid 2086]: /usr/lib/frr/watchfrr.sh restart all
12> Sep 14 14:48:33 localhost frrinit.sh[2075]: /usr/lib/frr/frrcommon.sh: line 216: kill: `': not a pid or valid job spec
13> Sep 14 14:48:33 localhost frrinit.sh[2075]: /usr/lib/frr/frrcommon.sh: line 216: kill: `': not a pid or valid job spec
14> Sep 14 14:48:33 localhost frrinit.sh[2075]: /usr/lib/frr/frrcommon.sh: line 216: kill: `': not a pid or valid job spec
15
16Fix this by moving the --quiet check into the block to log_failure_msg(),
17and also add the check to all other invocations of log_*_msg() to make
18--quiet properly suppress output.
19
20Fixes: 19a99d89f088 ("tools: suppress unuseful warnings during restarting frr")
21Signed-off-by: Jonas Gorski <jonas.gorski@bisdn.de>
22Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/312d5ee1592f8c5b616d330233d1de2643f759e2]
23---
24 tools/frrcommon.sh.in | 8 ++++----
25 1 file changed, 4 insertions(+), 4 deletions(-)
26
27diff --git a/tools/frrcommon.sh.in b/tools/frrcommon.sh.in
28index f1f70119097e..00b63a78e2bc 100755
29--- a/tools/frrcommon.sh.in
30+++ b/tools/frrcommon.sh.in
31@@ -207,8 +207,8 @@ daemon_stop() {
32 [ -z "$fail" -a -z "$pid" ] && fail="pid file is empty"
33 [ -n "$fail" ] || kill -0 "$pid" 2>/dev/null || fail="pid $pid not running"
34
35- if [ -n "$fail" ] && [ "$2" != "--quiet" ]; then
36- log_failure_msg "Cannot stop $dmninst: $fail"
37+ if [ -n "$fail" ]; then
38+ [ "$2" = "--quiet" ] || log_failure_msg "Cannot stop $dmninst: $fail"
39 return 1
40 fi
41
42@@ -220,11 +220,11 @@ daemon_stop() {
43 [ $(( cnt -= 1 )) -gt 0 ] || break
44 done
45 if kill -0 "$pid" 2>/dev/null; then
46- log_failure_msg "Failed to stop $dmninst, pid $pid still running"
47+ [ "$2" = "--quiet" ] || log_failure_msg "Failed to stop $dmninst, pid $pid still running"
48 still_running=1
49 return 1
50 else
51- log_success_msg "Stopped $dmninst"
52+ [ "$2" = "--quiet" ] || log_success_msg "Stopped $dmninst"
53 rm -f "$pidfile"
54 return 0
55 fi
56--
572.42.0
58
diff --git a/meta-networking/recipes-protocols/frr/frr/CVE-2023-46752.patch b/meta-networking/recipes-protocols/frr/frr/CVE-2023-46752.patch
deleted file mode 100644
index e1f30248ca..0000000000
--- a/meta-networking/recipes-protocols/frr/frr/CVE-2023-46752.patch
+++ /dev/null
@@ -1,125 +0,0 @@
1From b08afc81c60607a4f736f418f2e3eb06087f1a35 Mon Sep 17 00:00:00 2001
2From: Donatas Abraitis <donatas@opensourcerouting.org>
3Date: Fri, 20 Oct 2023 17:49:18 +0300
4Subject: [PATCH] bgpd: Handle MP_REACH_NLRI malformed packets with session
5 reset
6
7Avoid crashing bgpd.
8
9```
10(gdb)
11bgp_mp_reach_parse (args=<optimized out>, mp_update=0x7fffffffe140) at bgpd/bgp_attr.c:2341
122341 stream_get(&attr->mp_nexthop_global, s, IPV6_MAX_BYTELEN);
13(gdb)
14stream_get (dst=0x7fffffffe1ac, s=0x7ffff0006e80, size=16) at lib/stream.c:320
15320 {
16(gdb)
17321 STREAM_VERIFY_SANE(s);
18(gdb)
19323 if (STREAM_READABLE(s) < size) {
20(gdb)
2134 return __builtin___memcpy_chk (__dest, __src, __len, __bos0 (__dest));
22(gdb)
23
24Thread 1 "bgpd" received signal SIGSEGV, Segmentation fault.
250x00005555556e37be in route_set_aspath_prepend (rule=0x555555aac0d0, prefix=0x7fffffffe050,
26 object=0x7fffffffdb00) at bgpd/bgp_routemap.c:2282
272282 if (path->attr->aspath->refcnt)
28(gdb)
29```
30
31With the configuration:
32
33```
34 neighbor 127.0.0.1 remote-as external
35 neighbor 127.0.0.1 passive
36 neighbor 127.0.0.1 ebgp-multihop
37 neighbor 127.0.0.1 disable-connected-check
38 neighbor 127.0.0.1 update-source 127.0.0.2
39 neighbor 127.0.0.1 timers 3 90
40 neighbor 127.0.0.1 timers connect 1
41 address-family ipv4 unicast
42 redistribute connected
43 neighbor 127.0.0.1 default-originate
44 neighbor 127.0.0.1 route-map RM_IN in
45 exit-address-family
46!
47route-map RM_IN permit 10
48 set as-path prepend 200
49exit
50```
51
52Reported-by: Iggy Frankovic <iggyfran@amazon.com>
53Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
54Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/b08afc81c60607a4f736f418f2e3eb06087f1a35]
55CVE: CVE-2023-46752
56Signed-off-by: Jonas Gorski <jonas.gorski@bisdn.de>
57---
58 bgpd/bgp_attr.c | 6 +-----
59 bgpd/bgp_attr.h | 1 -
60 bgpd/bgp_packet.c | 6 +-----
61 3 files changed, 2 insertions(+), 11 deletions(-)
62
63diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
64index 6925aff727e2..e7bb42a5d989 100644
65--- a/bgpd/bgp_attr.c
66+++ b/bgpd/bgp_attr.c
67@@ -2421,7 +2421,7 @@ int bgp_mp_reach_parse(struct bgp_attr_parser_args *args,
68
69 mp_update->afi = afi;
70 mp_update->safi = safi;
71- return BGP_ATTR_PARSE_EOR;
72+ return bgp_attr_malformed(args, BGP_NOTIFY_UPDATE_MAL_ATTR, 0);
73 }
74
75 mp_update->afi = afi;
76@@ -3759,10 +3759,6 @@ enum bgp_attr_parse_ret bgp_attr_parse(struct peer *peer, struct attr *attr,
77 goto done;
78 }
79
80- if (ret == BGP_ATTR_PARSE_EOR) {
81- goto done;
82- }
83-
84 if (ret == BGP_ATTR_PARSE_ERROR) {
85 flog_warn(EC_BGP_ATTRIBUTE_PARSE_ERROR,
86 "%s: Attribute %s, parse error", peer->host,
87diff --git a/bgpd/bgp_attr.h b/bgpd/bgp_attr.h
88index 961e5f122470..fc347e7a1b4b 100644
89--- a/bgpd/bgp_attr.h
90+++ b/bgpd/bgp_attr.h
91@@ -364,7 +364,6 @@ enum bgp_attr_parse_ret {
92 /* only used internally, send notify + convert to BGP_ATTR_PARSE_ERROR
93 */
94 BGP_ATTR_PARSE_ERROR_NOTIFYPLS = -3,
95- BGP_ATTR_PARSE_EOR = -4,
96 };
97
98 struct bpacket_attr_vec_arr;
99diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c
100index b585591e2f69..5ecf343b6657 100644
101--- a/bgpd/bgp_packet.c
102+++ b/bgpd/bgp_packet.c
103@@ -2397,8 +2397,7 @@ static int bgp_update_receive(struct peer_connection *connection,
104 * Non-MP IPv4/Unicast EoR is a completely empty UPDATE
105 * and MP EoR should have only an empty MP_UNREACH
106 */
107- if ((!update_len && !withdraw_len && nlris[NLRI_MP_UPDATE].length == 0)
108- || (attr_parse_ret == BGP_ATTR_PARSE_EOR)) {
109+ if (!update_len && !withdraw_len && nlris[NLRI_MP_UPDATE].length == 0) {
110 afi_t afi = 0;
111 safi_t safi;
112 struct graceful_restart_info *gr_info;
113@@ -2419,9 +2418,6 @@ static int bgp_update_receive(struct peer_connection *connection,
114 && nlris[NLRI_MP_WITHDRAW].length == 0) {
115 afi = nlris[NLRI_MP_WITHDRAW].afi;
116 safi = nlris[NLRI_MP_WITHDRAW].safi;
117- } else if (attr_parse_ret == BGP_ATTR_PARSE_EOR) {
118- afi = nlris[NLRI_MP_UPDATE].afi;
119- safi = nlris[NLRI_MP_UPDATE].safi;
120 }
121
122 if (afi && peer->afc[afi][safi]) {
123--
1242.42.1
125
diff --git a/meta-networking/recipes-protocols/frr/frr/CVE-2023-46753.patch b/meta-networking/recipes-protocols/frr/frr/CVE-2023-46753.patch
deleted file mode 100644
index 6bf159aba8..0000000000
--- a/meta-networking/recipes-protocols/frr/frr/CVE-2023-46753.patch
+++ /dev/null
@@ -1,117 +0,0 @@
1From d8482bf011cb2b173e85b65b4bf3d5061250cdb9 Mon Sep 17 00:00:00 2001
2From: Donatas Abraitis <donatas@opensourcerouting.org>
3Date: Mon, 23 Oct 2023 23:34:10 +0300
4Subject: [PATCH] bgpd: Check mandatory attributes more carefully for UPDATE
5 message
6
7If we send a crafted BGP UPDATE message without mandatory attributes, we do
8not check if the length of the path attributes is zero or not. We only check
9if attr->flag is at least set or not. Imagine we send only unknown transit
10attribute, then attr->flag is always 0. Also, this is true only if graceful-restart
11capability is received.
12
13A crash:
14
15```
16bgpd[7834]: [TJ23Y-GY0RH] 127.0.0.1 Unknown attribute is received (type 31, length 16)
17bgpd[7834]: [PCFFM-WMARW] 127.0.0.1(donatas-pc) rcvd UPDATE wlen 0 attrlen 20 alen 17
18BGP[7834]: Received signal 11 at 1698089639 (si_addr 0x0, PC 0x55eefd375b4a); aborting...
19BGP[7834]: /usr/local/lib/libfrr.so.0(zlog_backtrace_sigsafe+0x6d) [0x7f3205ca939d]
20BGP[7834]: /usr/local/lib/libfrr.so.0(zlog_signal+0xf3) [0x7f3205ca9593]
21BGP[7834]: /usr/local/lib/libfrr.so.0(+0xf5181) [0x7f3205cdd181]
22BGP[7834]: /lib/x86_64-linux-gnu/libpthread.so.0(+0x12980) [0x7f3204ff3980]
23BGP[7834]: /usr/lib/frr/bgpd(+0x18ab4a) [0x55eefd375b4a]
24BGP[7834]: /usr/local/lib/libfrr.so.0(route_map_apply_ext+0x310) [0x7f3205cd1290]
25BGP[7834]: /usr/lib/frr/bgpd(+0x163610) [0x55eefd34e610]
26BGP[7834]: /usr/lib/frr/bgpd(bgp_update+0x9a5) [0x55eefd35c1d5]
27BGP[7834]: /usr/lib/frr/bgpd(bgp_nlri_parse_ip+0xb7) [0x55eefd35e867]
28BGP[7834]: /usr/lib/frr/bgpd(+0x1555e6) [0x55eefd3405e6]
29BGP[7834]: /usr/lib/frr/bgpd(bgp_process_packet+0x747) [0x55eefd345597]
30BGP[7834]: /usr/local/lib/libfrr.so.0(event_call+0x83) [0x7f3205cef4a3]
31BGP[7834]: /usr/local/lib/libfrr.so.0(frr_run+0xc0) [0x7f3205ca10a0]
32BGP[7834]: /usr/lib/frr/bgpd(main+0x409) [0x55eefd2dc979]
33```
34
35Sending:
36
37```
38import socket
39import time
40
41OPEN = (b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
42b"\xff\xff\x00\x62\x01\x04\xfd\xea\x00\x5a\x0a\x00\x00\x01\x45\x02"
43b"\x06\x01\x04\x00\x01\x00\x01\x02\x02\x02\x00\x02\x02\x46\x00\x02"
44b"\x06\x41\x04\x00\x00\xfd\xea\x02\x02\x06\x00\x02\x06\x45\x04\x00"
45b"\x01\x01\x03\x02\x0e\x49\x0c\x0a\x64\x6f\x6e\x61\x74\x61\x73\x2d"
46b"\x70\x63\x00\x02\x04\x40\x02\x00\x78\x02\x09\x47\x07\x00\x01\x01"
47b"\x80\x00\x00\x00")
48
49KEEPALIVE = (b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
50b"\xff\xff\xff\xff\xff\xff\x00\x13\x04")
51
52UPDATE = bytearray.fromhex("ffffffffffffffffffffffffffffffff003c0200000014ff1f001000040146464646460004464646464646664646f50d05800100010200ffff000000")
53
54s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
55s.connect(('127.0.0.2', 179))
56s.send(OPEN)
57data = s.recv(1024)
58s.send(KEEPALIVE)
59data = s.recv(1024)
60s.send(UPDATE)
61data = s.recv(1024)
62time.sleep(1000)
63s.close()
64```
65
66Reported-by: Iggy Frankovic <iggyfran@amazon.com>
67Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
68Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/d8482bf011cb2b173e85b65b4bf3d5061250cdb9]
69CVE: CVE-2023-46753
70Signed-off-by: Jonas Gorski <jonas.gorski@bisdn.de>
71---
72 bgpd/bgp_attr.c | 10 ++++++----
73 1 file changed, 6 insertions(+), 4 deletions(-)
74
75diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
76index e7bb42a5d989..cf2dbe65b805 100644
77--- a/bgpd/bgp_attr.c
78+++ b/bgpd/bgp_attr.c
79@@ -3385,13 +3385,15 @@ bgp_attr_unknown(struct bgp_attr_parser_args *args)
80 }
81
82 /* Well-known attribute check. */
83-static int bgp_attr_check(struct peer *peer, struct attr *attr)
84+static int bgp_attr_check(struct peer *peer, struct attr *attr,
85+ bgp_size_t length)
86 {
87 uint8_t type = 0;
88
89 /* BGP Graceful-Restart End-of-RIB for IPv4 unicast is signaled as an
90 * empty UPDATE. */
91- if (CHECK_FLAG(peer->cap, PEER_CAP_RESTART_RCV) && !attr->flag)
92+ if (CHECK_FLAG(peer->cap, PEER_CAP_RESTART_RCV) && !attr->flag &&
93+ !length)
94 return BGP_ATTR_PARSE_PROCEED;
95
96 /* "An UPDATE message that contains the MP_UNREACH_NLRI is not required
97@@ -3443,7 +3445,7 @@ enum bgp_attr_parse_ret bgp_attr_parse(struct peer *peer, struct attr *attr,
98 enum bgp_attr_parse_ret ret;
99 uint8_t flag = 0;
100 uint8_t type = 0;
101- bgp_size_t length;
102+ bgp_size_t length = 0;
103 uint8_t *startp, *endp;
104 uint8_t *attr_endp;
105 uint8_t seen[BGP_ATTR_BITMAP_SIZE];
106@@ -3831,7 +3833,7 @@ enum bgp_attr_parse_ret bgp_attr_parse(struct peer *peer, struct attr *attr,
107 }
108
109 /* Check all mandatory well-known attributes are present */
110- ret = bgp_attr_check(peer, attr);
111+ ret = bgp_attr_check(peer, attr, length);
112 if (ret < 0)
113 goto done;
114
115--
1162.42.1
117
diff --git a/meta-networking/recipes-protocols/frr/frr/CVE-2023-47234.patch b/meta-networking/recipes-protocols/frr/frr/CVE-2023-47234.patch
deleted file mode 100644
index 754f9345a0..0000000000
--- a/meta-networking/recipes-protocols/frr/frr/CVE-2023-47234.patch
+++ /dev/null
@@ -1,95 +0,0 @@
1From c37119df45bbf4ef713bc10475af2ee06e12f3bf Mon Sep 17 00:00:00 2001
2From: Donatas Abraitis <donatas@opensourcerouting.org>
3Date: Sun, 29 Oct 2023 22:44:45 +0200
4Subject: [PATCH] bgpd: Ignore handling NLRIs if we received MP_UNREACH_NLRI
5
6If we receive MP_UNREACH_NLRI, we should stop handling remaining NLRIs if
7no mandatory path attributes received.
8
9In other words, if MP_UNREACH_NLRI received, the remaining NLRIs should be handled
10as a new data, but without mandatory attributes, it's a malformed packet.
11
12In normal case, this MUST not happen at all, but to avoid crashing bgpd, we MUST
13handle that.
14
15Reported-by: Iggy Frankovic <iggyfran@amazon.com>
16Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
17Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/c37119df45bbf4ef713bc10475af2ee06e12f3bf]
18CVE: CVE-2023-47234
19Signed-off-by: Jonas Gorski <jonas.gorski@bisdn.de>
20---
21 bgpd/bgp_attr.c | 19 ++++++++++---------
22 bgpd/bgp_attr.h | 1 +
23 bgpd/bgp_packet.c | 7 ++++++-
24 3 files changed, 17 insertions(+), 10 deletions(-)
25
26diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
27index 1473dc772502..75aa2ac7cce6 100644
28--- a/bgpd/bgp_attr.c
29+++ b/bgpd/bgp_attr.c
30@@ -3399,15 +3399,6 @@ static int bgp_attr_check(struct peer *peer, struct attr *attr,
31 !length)
32 return BGP_ATTR_PARSE_WITHDRAW;
33
34- /* "An UPDATE message that contains the MP_UNREACH_NLRI is not required
35- to carry any other path attributes.", though if MP_REACH_NLRI or NLRI
36- are present, it should. Check for any other attribute being present
37- instead.
38- */
39- if ((!CHECK_FLAG(attr->flag, ATTR_FLAG_BIT(BGP_ATTR_MP_REACH_NLRI)) &&
40- CHECK_FLAG(attr->flag, ATTR_FLAG_BIT(BGP_ATTR_MP_UNREACH_NLRI))))
41- return BGP_ATTR_PARSE_PROCEED;
42-
43 if (!CHECK_FLAG(attr->flag, ATTR_FLAG_BIT(BGP_ATTR_ORIGIN)))
44 type = BGP_ATTR_ORIGIN;
45
46@@ -3426,6 +3417,16 @@ static int bgp_attr_check(struct peer *peer, struct attr *attr,
47 && !CHECK_FLAG(attr->flag, ATTR_FLAG_BIT(BGP_ATTR_LOCAL_PREF)))
48 type = BGP_ATTR_LOCAL_PREF;
49
50+ /* An UPDATE message that contains the MP_UNREACH_NLRI is not required
51+ * to carry any other path attributes. Though if MP_REACH_NLRI or NLRI
52+ * are present, it should. Check for any other attribute being present
53+ * instead.
54+ */
55+ if (!CHECK_FLAG(attr->flag, ATTR_FLAG_BIT(BGP_ATTR_MP_REACH_NLRI)) &&
56+ CHECK_FLAG(attr->flag, ATTR_FLAG_BIT(BGP_ATTR_MP_UNREACH_NLRI)))
57+ return type ? BGP_ATTR_PARSE_MISSING_MANDATORY
58+ : BGP_ATTR_PARSE_PROCEED;
59+
60 /* If any of the well-known mandatory attributes are not present
61 * in an UPDATE message, then "treat-as-withdraw" MUST be used.
62 */
63diff --git a/bgpd/bgp_attr.h b/bgpd/bgp_attr.h
64index fc347e7a1b4b..d30155e6dba0 100644
65--- a/bgpd/bgp_attr.h
66+++ b/bgpd/bgp_attr.h
67@@ -364,6 +364,7 @@ enum bgp_attr_parse_ret {
68 /* only used internally, send notify + convert to BGP_ATTR_PARSE_ERROR
69 */
70 BGP_ATTR_PARSE_ERROR_NOTIFYPLS = -3,
71+ BGP_ATTR_PARSE_MISSING_MANDATORY = -4,
72 };
73
74 struct bpacket_attr_vec_arr;
75diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c
76index a7514a26aa64..5dc35157ebf6 100644
77--- a/bgpd/bgp_packet.c
78+++ b/bgpd/bgp_packet.c
79@@ -2359,7 +2359,12 @@ static int bgp_update_receive(struct peer_connection *connection,
80 /* Network Layer Reachability Information. */
81 update_len = end - stream_pnt(s);
82
83- if (update_len && attribute_len) {
84+ /* If we received MP_UNREACH_NLRI attribute, but also NLRIs, then
85+ * NLRIs should be handled as a new data. Though, if we received
86+ * NLRIs without mandatory attributes, they should be ignored.
87+ */
88+ if (update_len && attribute_len &&
89+ attr_parse_ret != BGP_ATTR_PARSE_MISSING_MANDATORY) {
90 /* Set NLRI portion to structure. */
91 nlris[NLRI_UPDATE].afi = AFI_IP;
92 nlris[NLRI_UPDATE].safi = SAFI_UNICAST;
93--
942.42.1
95
diff --git a/meta-networking/recipes-protocols/frr/frr/CVE-2023-47235.patch b/meta-networking/recipes-protocols/frr/frr/CVE-2023-47235.patch
deleted file mode 100644
index b06ba94a34..0000000000
--- a/meta-networking/recipes-protocols/frr/frr/CVE-2023-47235.patch
+++ /dev/null
@@ -1,112 +0,0 @@
1From 6814f2e0138a6ea5e1f83bdd9085d9a77999900b Mon Sep 17 00:00:00 2001
2From: Donatas Abraitis <donatas@opensourcerouting.org>
3Date: Fri, 27 Oct 2023 11:56:45 +0300
4Subject: [PATCH] bgpd: Treat EOR as withdrawn to avoid unwanted handling of
5 malformed attrs
6
7Treat-as-withdraw, otherwise if we just ignore it, we will pass it to be
8processed as a normal UPDATE without mandatory attributes, that could lead
9to harmful behavior. In this case, a crash for route-maps with the configuration
10such as:
11
12```
13router bgp 65001
14 no bgp ebgp-requires-policy
15 neighbor 127.0.0.1 remote-as external
16 neighbor 127.0.0.1 passive
17 neighbor 127.0.0.1 ebgp-multihop
18 neighbor 127.0.0.1 disable-connected-check
19 neighbor 127.0.0.1 update-source 127.0.0.2
20 neighbor 127.0.0.1 timers 3 90
21 neighbor 127.0.0.1 timers connect 1
22 !
23 address-family ipv4 unicast
24 neighbor 127.0.0.1 addpath-tx-all-paths
25 neighbor 127.0.0.1 default-originate
26 neighbor 127.0.0.1 route-map RM_IN in
27 exit-address-family
28exit
29!
30route-map RM_IN permit 10
31 set as-path prepend 200
32exit
33```
34
35Send a malformed optional transitive attribute:
36
37```
38import socket
39import time
40
41OPEN = (b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
42b"\xff\xff\x00\x62\x01\x04\xfd\xea\x00\x5a\x0a\x00\x00\x01\x45\x02"
43b"\x06\x01\x04\x00\x01\x00\x01\x02\x02\x02\x00\x02\x02\x46\x00\x02"
44b"\x06\x41\x04\x00\x00\xfd\xea\x02\x02\x06\x00\x02\x06\x45\x04\x00"
45b"\x01\x01\x03\x02\x0e\x49\x0c\x0a\x64\x6f\x6e\x61\x74\x61\x73\x2d"
46b"\x70\x63\x00\x02\x04\x40\x02\x00\x78\x02\x09\x47\x07\x00\x01\x01"
47b"\x80\x00\x00\x00")
48
49KEEPALIVE = (b"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
50b"\xff\xff\xff\xff\xff\xff\x00\x13\x04")
51
52UPDATE = bytearray.fromhex("ffffffffffffffffffffffffffffffff002b0200000003c0ff00010100eb00ac100b0b001ad908ac100b0b")
53
54s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
55s.connect(('127.0.0.2', 179))
56s.send(OPEN)
57data = s.recv(1024)
58s.send(KEEPALIVE)
59data = s.recv(1024)
60s.send(UPDATE)
61data = s.recv(1024)
62time.sleep(100)
63s.close()
64```
65
66Reported-by: Iggy Frankovic <iggyfran@amazon.com>
67Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
68Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/6814f2e0138a6ea5e1f83bdd9085d9a77999900b]
69CVE: CVE-2023-47235
70Signed-off-by: Jonas Gorski <jonas.gorski@bisdn.de>
71---
72 bgpd/bgp_attr.c | 15 ++++++++++++---
73 1 file changed, 12 insertions(+), 3 deletions(-)
74
75diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
76index cf2dbe65b805..1473dc772502 100644
77--- a/bgpd/bgp_attr.c
78+++ b/bgpd/bgp_attr.c
79@@ -3391,10 +3391,13 @@ static int bgp_attr_check(struct peer *peer, struct attr *attr,
80 uint8_t type = 0;
81
82 /* BGP Graceful-Restart End-of-RIB for IPv4 unicast is signaled as an
83- * empty UPDATE. */
84+ * empty UPDATE. Treat-as-withdraw, otherwise if we just ignore it,
85+ * we will pass it to be processed as a normal UPDATE without mandatory
86+ * attributes, that could lead to harmful behavior.
87+ */
88 if (CHECK_FLAG(peer->cap, PEER_CAP_RESTART_RCV) && !attr->flag &&
89 !length)
90- return BGP_ATTR_PARSE_PROCEED;
91+ return BGP_ATTR_PARSE_WITHDRAW;
92
93 /* "An UPDATE message that contains the MP_UNREACH_NLRI is not required
94 to carry any other path attributes.", though if MP_REACH_NLRI or NLRI
95@@ -3889,7 +3892,13 @@ done:
96 aspath_unintern(&as4_path);
97
98 transit = bgp_attr_get_transit(attr);
99- if (ret != BGP_ATTR_PARSE_ERROR) {
100+ /* If we received an UPDATE with mandatory attributes, then
101+ * the unrecognized transitive optional attribute of that
102+ * path MUST be passed. Otherwise, it's an error, and from
103+ * security perspective it might be very harmful if we continue
104+ * here with the unrecognized attributes.
105+ */
106+ if (ret == BGP_ATTR_PARSE_PROCEED) {
107 /* Finally intern unknown attribute. */
108 if (transit)
109 bgp_attr_set_transit(attr, transit_intern(transit));
110--
1112.42.1
112
diff --git a/meta-networking/recipes-protocols/frr/frr_9.0.1.bb b/meta-networking/recipes-protocols/frr/frr_9.1.bb
index c447df0512..9db6710d9c 100644
--- a/meta-networking/recipes-protocols/frr/frr_9.0.1.bb
+++ b/meta-networking/recipes-protocols/frr/frr_9.1.bb
@@ -11,16 +11,11 @@ LIC_FILES_CHKSUM = "file://doc/licenses/GPL-2.0;md5=b234ee4d69f5fce4486a80fdaf4a
11 11
12PR = "r1" 12PR = "r1"
13 13
14SRC_URI = "git://github.com/FRRouting/frr.git;protocol=https;branch=stable/9.0 \ 14SRC_URI = "git://github.com/FRRouting/frr.git;protocol=https;branch=stable/9.1 \
15 file://frr.pam \ 15 file://frr.pam \
16 file://0001-tools-make-quiet-actually-suppress-output.patch \
17 file://CVE-2023-46752.patch \
18 file://CVE-2023-46753.patch \
19 file://CVE-2023-47235.patch \
20 file://CVE-2023-47234.patch \
21 " 16 "
22 17
23SRCREV = "31ed3dd753d62b5d8916998bc32814007e91364b" 18SRCREV = "312faf8008bb4f3b9e84b8e2758cd2cbdf5742b5"
24 19
25UPSTREAM_CHECK_GITTAGREGEX = "frr-(?P<pver>\d+(\.\d+)+)$" 20UPSTREAM_CHECK_GITTAGREGEX = "frr-(?P<pver>\d+(\.\d+)+)$"
26 21
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-11-08 11:55:36 +0000