summaryrefslogtreecommitdiffstats
path: root/ospf6d (follow)
Commit message (Collapse)AuthorAgeFilesLines
* ospf6d: Don't remove summary route if it is a rangeXiaodong Xu2022-08-201-1/+6
| | | | | | | | | | | | | | | | | | | | Fix issue #11839. When the user defines a range in an area other than the backbone area, the summary route will be announced to the backbone area as an inter-area LSA. However, if the prefix defined in the range is the same prefix as a connected route in that area, the LSA won't be announced to the backbone area. This is because when ospf6d is originating the summary route for the intra-area route, it finds the range configured by the user and tries to suppress the route by deleting the existing summary route, which happens to be the one created by the range. Although the range definition is not necessary in this case, it should not fail this use case. So let's just keep the summary route there if it is created from the user defined range. Signed-off-by: Xiaodong Xu <stid.smth@gmail.com>
* Merge pull request #11781 from donaldsharp/ospf_packet_helperDonatas Abraitis2022-08-151-5/+1
|\ | | | | Ospf packet helper
| * ospf6d: Remove unused variableDonald Sharp2022-08-111-5/+1
| | | | | | | | | | | | last_serviced_oi is always NULL. Remove Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* | Merge pull request #11785 from ↵Donald Sharp2022-08-131-8/+1
|\ \ | | | | | | | | | | | | opensourcerouting/fix/remove_ospf6Enabled_from_JSON ospf6d: Remove ospf6Enabled from JSON output
| * | ospf6d: Remove ospf6Enabled from JSON outputDonatas Abraitis2022-08-111-8/+1
| |/ | | | | | | | | | | Time to deprecate it. Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
* / ospf6d: fix missing cost changeanlan_cs2022-08-111-1/+4
|/ | | | | | | | | | | | | | | | | | | | | | | | | After all needed interfaces ( for example: interface "a1", vrf "vrf1", and "a1" is binded to "vrf1" ) are ready/created, then restart/start frr. zebra at startup will call `netlink_interface()` to process all interfaces and notify all clients, but its calling `get_iflink_speed()` maybe fails for unexpected order of the coming interfaces: when processing "a1", "vrf1" maybe is unknown at that time. `if_zebra_speed_update()` timer is introduced to deal with this order problem. Currently only ospfd and ospf6d deal with this speed change to recalculated route cost. ospfd can deal with this change, but ospf6d will wrongly missed it. Since both `ipv6 ospf6 cost COST` and `auto-cost reference-bandwidth COST` are not set, cost of this ospf6 interface should be calculated with interface speed, but it is wrongly kept to `10`, which is based on interface speed being `0` for it missed speed change. Further, ECMP function becomes invalid after restart frr, beacuse some ospf6 interfaces of one ECMP are wrongly with cost `10`. To avoid missing, recalculate cost for ospf6 interfaces based on potentially changed speed. Signed-off-by: anlan_cs <vic.lan@pica8.com>
* ospf6d: combine two conditions for lsa prefixanlan_cs2022-08-031-4/+2
| | | | | | | For both router and network LSAs, combine the two conditions and process lsa prefix uniformly. Signed-off-by: anlan_cs <vic.lan@pica8.com>
* ospf6d: corrected the debug stringsri-mohan12022-07-271-1/+1
| | | | | | Corrected the gramatical error for debug string Signed-off-by: sri-mohan1 <sri.mohan@samsung.com>
* Merge pull request #11462 from donaldsharp/random_stuff_rightmobash-rasool2022-06-241-1/+7
|\ | | | | Random stuff right
| * ospf6d: Ensure that ospf6d does not memcpy beyond end of dataDonald Sharp2022-06-231-1/+7
| | | | | | | | | | | | | | Ensure that received data size can fit into temp variable that is used to dump data. Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* | Merge pull request #11430 from mjstapp/fix_ospf6_zebra_delRafael Zalamena2022-06-241-9/+18
|\ \ | |/ |/| ospf6: permit route delete without nexthops
| * ospf6: permit route delete without nexthopsMark Stapp2022-06-171-9/+18
| | | | | | | | | | | | | | | | It's possible for ospf6 to decide to delete a route after it's removed all of the route's nexthops. It's ok to delete a prefix alone - be a little more forgiving when preparing a route delete. Signed-off-by: Mark Stapp <mstapp@nvidia.com>
* | ospf6d: cost is uint32_t so it cannot be greater than UINT32_MAXDonald Sharp2022-06-161-2/+0
| | | | | | | | | | | | Remove the extra test. Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* | *: Use autocomplete for route-maps under commands that require itDonatas Abraitis2022-06-131-4/+4
|/ | | | | | | | | | | | | | | | | | | | | | For example: ``` donatas-laptop# show bgp ipv4 unicast neighbors 127.0.0.2 advertised-routes route-map ? RMAP_NAME Name of the route map testas2 testas donatas-laptop(config)# router bgp donatas-laptop(config-router)# address-family ipv4 donatas-laptop(config-router-af)# redistribute connected route-map ? RMAP_NAME Pointer to route-map entries testas2 testas donatas-laptop(config-router-af)# network 192.168.0.0/23 route-map ? RMAP_NAME Name of the route map testas2 testas ``` Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
* ospf6d: fix rx/tx buffer sizesDavid Lamparter2022-06-011-11/+16
| | | | | | | | | | | | | | OSPFv3 packets can be fragmented and up to 64k long, regardless of interface MTU. Trying to size these buffers to MTU is just plain wrong. To not make this a super intrusive change during the 8.3 release freeze, just code this into ospf6_iobuf_size(). Since the buffer is now always 64k, don't waste time zeroing the entire thing in receive; instead just zero kind of a "sled" of 128 bytes after the buffer as a security precaution. Fixes: #11298 Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* ospf6d: Clean up thread interfaceDonald Sharp2022-05-209-53/+59
| | | | | | | | | a) Remove setting of thread pointer to NULL after thread invocation, this is already done. b) Use thread_is_scheduled() Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* ospf6d: Remove double check of default prefixDonald Sharp2022-05-201-8/+4
| | | | | | | | The ospf6_is_valid_summary_addr function is checking to see if a prefix is the default and also then double comparing it against the v6 prefix part. No need to do this. Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* ospf6d: Ensure the ospf6 interface hello timer pops in all casesDonald Sharp2022-05-162-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a end users does something like this: int enp39s0 ipv6 ospf6 hello-interval 65535 And then the timer pops and we send the hello and immediately if the end user does this: ipv6 ospf6 hello-interval 5 The timer is not being reset and FRR waits the full 65k seconds before sending the hello again, which then immediately sets the next hello to go out in 5 seconds. When FRR receives the new timer value, look at how much time is left on the timer in seconds. If this value is greater than the new hello timer, stop the timer and set it too that value. This should fix a CI system test failure found, where the system is testing setting timer from things like 12 seconds to 65k seconds then back down to 12 and that the ospf6 neighbor relationship stays up. The code was also changed from thread_add_event to thread_add_timer in all cases. I am not sure what would happen if a show command comes in for a thread timer remaining with an event instead of a timer just make it consistent. This was chased down because the support bundle showed this: r0# show ipv6 ospf6 vrf all interface r0-r1-eth0 is up, type BROADCAST Interface ID: 6 Internet Address: inet6: fe80::a4ea:d3ff:fe35:cef1/64 inet6: fd00::1/64 Instance ID 0, Interface MTU 1500 (autodetect: 1500) MTU mismatch detection: enabled Area ID 0.0.0.0, Cost 10 State DR, Transmit Delay 1 sec, Priority 1 Timer intervals configured: Hello 12(65480.960), Dead 48, Retransmit 5 And looking at the test code is doing stuff like this: 2022/05/16 17:08:15 OSPF6: [M7Q4P-46WDR] vty[5]@(config)# interface r1-r0-eth0 2022/05/16 17:08:15 OSPF6: [M7Q4P-46WDR] vty[5]@(config-if)# ipv6 ospf6 hello-interval 65535 2022/05/16 17:08:15 OSPF6: [M7Q4P-46WDR] vty[5]@(config-if)# no ipv6 ospf6 hello-interval 2022/05/16 17:08:16 OSPF6: [M7Q4P-46WDR] vty[5]@(config-if)# ipv6 ospf6 hello-interval 1 2022/05/16 17:08:16 OSPF6: [M7Q4P-46WDR] vty[5]@(config-if)# ipv6 ospf6 hello-interval 12 If the old timer value pops, the hello interval is set to 65k and never reset again. Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* ospf6d: Give time left in hello timer for `show ipv6 ospf6 int`Donald Sharp2022-05-161-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | When running `show ipv6 ospf6 interface` the hello timer period is shown, but there is no indication on how much time is left on the timer. Add a clue: sharpd@eva ~/frr5 (master)> vtysh -c "show ipv6 ospf6 int" enp39s0 is up, type BROADCAST Interface ID: 2 Internet Address: inet : 192.168.119.224/24 inet6: 2603:6080:602:509e:9a14:998:b154:9e9/64 Instance ID 0, Interface MTU 1500 (autodetect: 1500) MTU mismatch detection: enabled Area ID 0.0.0.0, Cost 1000 State DR, Transmit Delay 1 sec, Priority 1 Timer intervals configured: Hello 10(2.652), Dead 40, Retransmit 5 DR: 192.168.122.1 BDR: 0.0.0.0 Number of I/F scoped LSAs is 1 0 Pending LSAs for LSUpdate in Time 00:00:00 [thread off] 0 Pending LSAs for LSAck in Time 00:00:00 [thread off] Authentication Trailer is disabled Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* Merge pull request #11177 from opensourcerouting/fix/memset_memcpyDonald Sharp2022-05-137-12/+12
|\ | | | | *: memcpy/memset zeroing
| * *: Properly use memset() when zeroingDonatas Abraitis2022-05-117-12/+12
| | | | | | | | | | | | | | Wrong: memset(&a, 0, sizeof(struct ...)); Good: memset(&a, 0, sizeof(a)); Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
* | ospf6d: add header size check for LSAanlan_cs2022-05-101-0/+12
|/ | | | | | | Add header size check for safe. If the check fails, just jump out of current function. Signed-off-by: anlan_cs <vic.lan@pica8.com>
* Merge pull request #11163 from opensourcerouting/fix/same_type_castingIgor Ryzhov2022-05-091-6/+6
|\ | | | | *: Avoid casting to the same type as on the left
| * *: Avoid casting to the same type as on the leftDonatas Abraitis2022-05-081-6/+6
| | | | | | | | | | | | Just not necessary. Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
* | zebra, ospf6d: Do not check if NULL for XCALLOC()Donatas Abraitis2022-05-081-2/+0
|/ | | | Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
* *: remove the checking returned value for hash_get()anlan_cs2022-05-022-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Firstly, *keep no change* for `hash_get()` with NULL `alloc_func`. Only focus on cases with non-NULL `alloc_func` of `hash_get()`. Since `hash_get()` with non-NULL `alloc_func` parameter shall not fail, just ignore the returned value of it. The returned value must not be NULL. So in this case, remove the unnecessary checking NULL or not for the returned value and add `void` in front of it. Importantly, also *keep no change* for the two cases with non-NULL `alloc_func` - 1) Use `assert(<returned_data> == <searching_data>)` to ensure it is a created node, not a found node. Refer to `isis_vertex_queue_insert()` of isisd, there are many examples of this case in isid. 2) Use `<returned_data> != <searching_data>` to judge it is a found node, then free <searching_data>. Refer to `aspath_intern()` of bgpd, there are many examples of this case in bgpd. Here, <returned_data> is the returned value from `hash_get()`, and <searching_data> is the data, which is to be put into hash table. Signed-off-by: anlan_cs <vic.lan@pica8.com>
* Merge pull request #11051 from donaldsharp/speell_moreDonatas Abraitis2022-04-202-2/+2
|\ | | | | Speell more
| * *: Fix spelling of accidentlyDonald Sharp2022-04-191-1/+1
| | | | | | | | Signed-off-by: Donald Sharp <sharpd@nvidia.com>
| * *: Fix spelling of specifedDonald Sharp2022-04-191-1/+1
| | | | | | | | Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* | ospf6d: Check for MinLSInterval timer when adding to LSUpdate listYash Ranjan2022-04-181-15/+28
|/ | | | | | | | | | | | | | | | | | | | | A router has some static routes and redistributes turned on. "clear ipv6 ospf process" command is applied. Then static routes are deleted. In 1 in 5 runs, AS-External LSAs are not getting removed from the neighbors even though it gets removed from its own LSDB. Because of the clear process command, MAX_AGE LSAs are advertised and fresh LSAs are installed in the LSDB. When the MAX_LSAs are advertised back to the same router as part of the flooding process, it gets added to the LSUpdate list even though it comes inside the MinLSArrival time. When the static routes get deleted, it removed the LSA from the LSRetrans list but not from LSUpdate list. The LSAs present in the LSUpdate list gets advertised when sending LS Updates. When an old copy of an LSA is more recent than the new LSA, check if it has come inside the MinLSArrival time before adding to the LSUpdate list. Signed-off-by: Yash Ranjan <ranjany@vmware.com>
* *: Fix spelling of GracefullDonald Sharp2022-04-021-1/+1
| | | | Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* ospf6d: fix crash when applying a route-map on a temporary routeIgor Ryzhov2022-03-291-0/+1
| | | | | | | | | ospf6_routemap_rule_match_interface uses route->ospf6 field for matching so we must fill the field in our temporary variable. Fixes #10911. Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
* Merge pull request #10158 from ckishimo/ospf6d_norefreshRuss White2022-03-291-15/+36
|\ | | | | ospf6d: stop refreshing type-5 from NSSA
| * ospf6d: fix NSSA area-range commandckishimo2022-03-281-3/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When an area-range command is applied in an ABR, the more specific prefixes need to be removed. r2# sh ipv6 ospf database AS Scoped Link State Database Type LSId AdvRouter Age SeqNum Payload ASE 0.0.0.1 10.254.254.2 53 80000001 :: ASE 0.0.0.2 10.254.254.2 51 80000001 2001:db8:1::/64 ASE 0.0.0.3 10.254.254.2 51 80000001 2001:db8:3::/64 ASE 0.0.0.4 10.254.254.2 51 80000001 2001:db8:2::/64 ASE 0.0.0.5 10.254.254.2 46 80000001 2001:db8:1::/64 ASE 0.0.0.6 10.254.254.2 46 80000001 2001:db8:3::/64 ASE 0.0.0.7 10.254.254.2 46 80000001 2001:db8:2::/64 ASE 0.0.0.8 10.254.254.2 41 80000001 2001:db8:3::/64 ASE 0.0.0.9 10.254.254.2 41 80000001 2001:db8:1000::1/128 <-- ** ASE 0.0.0.10 10.254.254.2 41 80000001 2001:db8:1000::2/128 <-- ** ASE 0.0.0.12 10.254.254.2 24 80000001 2001:db8:1000::/64 ASE 0.0.0.1 10.254.254.3 52 80000001 2001:db8:2::/64 Signed-off-by: ckishimo <carles.kishimoto@gmail.com>
| * ospf6d: stop refreshing type-5 from NSSAckishimo2022-01-051-15/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the current code, in a topology like this: r1 ---- 0.0.0.0 ---- r2(ABR) ---- 1.1.1.1 -----r3(ASBR) NSSA where r3 is redistributing statics within the NSSA area, the ABR (r2) is translating type-7 lsa to type-5. Everytime the function ospf6_abr_nssa_task() is executed all translated type-5 are aged out and refreshed for no reason. So for instance having 3 lsas already advertised: r1# sh ipv6 os database AS Scoped Link State Database Type LSId AdvRouter Age SeqNum Payload ASE 0.0.0.1 2.2.2.2 39 80000001 3:3::3/128 ASE 0.0.0.2 2.2.2.2 39 80000001 4:4::4/128 ASE 0.0.0.3 2.2.2.2 39 80000001 5:5::5/128 Adversting a new route from r3: r3(config)# ipv6 route 6:6::6/128 Null0 r1# sh ipv6 os database AS Scoped Link State Database Type LSId AdvRouter Age SeqNum Payload ASE 0.0.0.1 2.2.2.2 124 80000001 3:3::3/128 ASE 0.0.0.2 2.2.2.2 124 80000001 4:4::4/128 ASE 0.0.0.3 2.2.2.2 124 80000001 5:5::5/128 ASE 0.0.0.4 2.2.2.2 8 80000001 6:6::6/128 That seems okay, however a few seconds later we see all prefixes refreshed r1# sh ipv6 os database AS Scoped Link State Database Type LSId AdvRouter Age SeqNum Payload ASE 0.0.0.1 2.2.2.2 3600 80000001 3:3::3/128 ASE 0.0.0.2 2.2.2.2 3600 80000001 4:4::4/128 ASE 0.0.0.3 2.2.2.2 3600 80000001 5:5::5/128 ASE 0.0.0.4 2.2.2.2 3600 80000001 6:6::6/128 ASE 0.0.0.5 2.2.2.2 3 80000001 3:3::3/128 ASE 0.0.0.6 2.2.2.2 3 80000001 4:4::4/128 ASE 0.0.0.7 2.2.2.2 3 80000001 5:5::5/128 ASE 0.0.0.8 2.2.2.2 3 80000001 6:6::6/128 This PR prevents the LSA of being refreshed by unsetting the OSPF6_LSA_UNAPPROVED flag so advertising the last prefix will not refresh all of them: r1# sh ipv6 os database AS Scoped Link State Database Type LSId AdvRouter Age SeqNum Payload ASE 0.0.0.1 2.2.2.2 90 80000001 3:3::3/128 ASE 0.0.0.2 2.2.2.2 47 80000001 4:4::4/128 ASE 0.0.0.3 2.2.2.2 35 80000001 5:5::5/128 ASE 0.0.0.4 2.2.2.2 7 80000001 6:6::6/128 Signed-off-by: ckishimo <carles.kishimoto@gmail.com>
* | *: add SAFI argument to zclient_send_rnhDavid Lamparter2022-03-271-2/+2
| | | | | | | | | | | | Just pushing that SAFI_UNICAST up 1 level to the caller. Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* | ospf6d: crash in ospf6_decrement_retrans_count.Manoj Naragund2022-03-172-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: ospf6d crash is observed when lsack is received from the neighbour for AS External LSA. RCA: The crash is observed in ospf6_decrement_retrans_count while decrementing retransmit counter for the LSA when lsack is recived. This is because in ospf6_flood_interace when new LSA is being added to the neighbour's list the incrementing is happening on the received LSA instead of the already present LSA in scope DB which is already carrying counters. when this new LSA replaces the old one, the already present counters are not copied on the new LSA this creates counter mismatch which results in a crash when lsack is recevied due to counter going to negative. Fix: The fix involves following changes. 1. In ospf6_flood_interace when LSA is being added to retrans list check if there is alreday lsa in the scoped db and increment the counter on that if present. 2. In ospf6_lsdb_add copy the retrans counter from old to new lsa when its being replaced. Signed-off-by: Manoj Naragund <mnaragund@vmware.com>
* | Merge pull request #10447 from ton31337/fix/json_with_whitespacesDonald Sharp2022-03-133-5/+37
|\ \ | | | | | | *: Fix JSON keys with whitespaces and PascalCase
| * | *: Add camelCase JSON keys in addition to PascalCaseDonatas Abraitis2022-02-032-4/+23
| | | | | | | | | | | | Signed-off-by: Donatas Abraitis <donatas.abraitis@gmail.com>
| * | ospfd,ospf6d: Add JSON additional keys with no whitespaces insideDonatas Abraitis2022-02-031-1/+14
| | | | | | | | | | | | Signed-off-by: Donatas Abraitis <donatas.abraitis@gmail.com>
* | | *: When matching against a nexthop send and process what it matched againstDonald Sharp2022-03-121-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the nexthop tracking code is only sending to the requestor what it was requested to match against. When the nexthop tracking code was simplified to not need an import check and a nexthop check in b8210849b8ac1abe2d5d9a5ab2459abfde65efa5 for bgpd. It was not noticed that a longer prefix could match but it would be seen as a match because FRR was not sending up both the resolved route prefix and the route FRR was asked to match against. This code change causes the nexthop tracking code to pass back up the matched requested route (so that the calling protocol can figure out which one it is being told about ) as well as the actual prefix that was matched to. Fixes: #10766 Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* | | ospfd,ospf6d: Add missing newline for `graceful-restart prepare` CLIDonatas Abraitis2022-03-091-1/+1
| | | | | | | | | | | | Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
* | | *: Change thread->func to return void instead of intDonald Sharp2022-02-2416-208/+129
| | | | | | | | | | | | | | | | | | | | | The int return value is never used. Modify the code base to just return a void instead. Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* | | Merge pull request #10571 from rameshabhinay/ospf6_auth_trailerRuss White2022-02-153-21/+18
|\ \ \ | | | | | | | | ospf6d: fix coverity issues.
| * | | ospf6d: fix coverity issues.Abhinay Ramesh2022-02-143-21/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixed below coverity issues ________________________________________________________________________________________________________ *** CID 1511366: (TAINTED_SCALAR) /ospf6d/ospf6_message.c: 2631 in ospf6_make_lsupdate_list() 2625 + OSPF6_HEADER_SIZE) 2626 > ospf6_packet_max(on->ospf6_if)) { 2627 ospf6_fill_header(on->ospf6_if, (*op)->s, 2628 length + OSPF6_HEADER_SIZE); 2629 (*op)->length = length + OSPF6_HEADER_SIZE; 2630 ospf6_fill_lsupdate_header((*op)->s, *lsa_cnt); >>> CID 1511366: (TAINTED_SCALAR) >>> Passing tainted variable "(*op)->length" to a tainted sink. 2631 ospf6_send_lsupdate(on, NULL, *op); 2632 2633 /* refresh packet */ 2634 *op = ospf6_packet_new(on->ospf6_if->ifmtu); 2635 length = OSPF6_LS_UPD_MIN_SIZE; 2636 *lsa_cnt = 0; /ospf6d/ospf6_message.c: 2631 in ospf6_make_lsupdate_list() 2625 + OSPF6_HEADER_SIZE) 2626 > ospf6_packet_max(on->ospf6_if)) { 2627 ospf6_fill_header(on->ospf6_if, (*op)->s, 2628 length + OSPF6_HEADER_SIZE); 2629 (*op)->length = length + OSPF6_HEADER_SIZE; 2630 ospf6_fill_lsupdate_header((*op)->s, *lsa_cnt); >>> CID 1511366: (TAINTED_SCALAR) >>> Passing tainted variable "(*op)->length" to a tainted sink. 2631 ospf6_send_lsupdate(on, NULL, *op); ________________________________________________________________________________________________________ *** CID 1511365: (TAINTED_SCALAR) /ospf6d/ospf6_message.c: 2674 in ospf6_make_ls_retrans_list() 2669 if (on->ospf6_if->state == OSPF6_INTERFACE_POINTTOPOINT) 2670 (*op)->dst = allspfrouters6; 2671 else 2672 (*op)->dst = on->linklocal_addr; 2673 >>> CID 1511365: (TAINTED_SCALAR) >>> Passing tainted variable "(*op)->length" to a tainted sink. 2674 ospf6_fill_hdr_checksum(on->ospf6_if, *op); 2675 ospf6_packet_add(on->ospf6_if, *op); 2676 OSPF6_MESSAGE_WRITE_ON(on->ospf6_if); /ospf6d/ospf6_message.c: 2674 in ospf6_make_ls_retrans_list() 2669 if (on->ospf6_if->state == OSPF6_INTERFACE_POINTTOPOINT) 2670 (*op)->dst = allspfrouters6; 2671 else 2672 (*op)->dst = on->linklocal_addr; 2673 >>> CID 1511365: (TAINTED_SCALAR) >>> Passing tainted variable "(*op)->length" to a tainted sink. 2674 ospf6_fill_hdr_checksum(on->ospf6_if, *op); 2675 ospf6_packet_add(on->ospf6_if, *op); 2676 OSPF6_MESSAGE_WRITE_ON(on->ospf6_if); /ospf6d/ospf6_message.c: 2674 in ospf6_make_ls_retrans_list() 2668 ospf6_fill_lsupdate_header((*op)->s, *lsa_cnt); 2669 if (on->ospf6_if->state == OSPF6_INTERFACE_POINTTOPOINT) 2670 (*op)->dst = allspfrouters6; 2671 else 2672 (*op)->dst = on->linklocal_addr; 2673 >>> CID 1511365: (TAINTED_SCALAR) >>> Passing tainted variable "(*op)->length" to a tainted sink. 2674 ospf6_fill_hdr_checksum(on->ospf6_if, *op); 2675 ospf6_packet_add(on->ospf6_if, *op); 2676 OSPF6_MESSAGE_WRITE_ON(on->ospf6_if); ________________________________________________________________________________________________________ *** CID 1511364: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_message.c: 2125 in ospf6_write() 2120 if (oi->at_data.flags != 0) { 2121 at_len = ospf6_auth_len_get(oi); 2122 if (at_len) { 2123 iovector[0].iov_len = 2124 ntohs(oh->length) + at_len; >>> CID 1511364: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "iovector[0].iov_len" to a tainted sink. 2125 ospf6_auth_digest_send(oi->linklocal_addr, oi, 2126 oh, at_len, 2127 iovector[0].iov_len); 2128 } else { 2129 iovector[0].iov_len = ntohs(oh->length); 2130 } ________________________________________________________________________________________________________ *** CID 1511363: (DEADCODE) /ospf6d/ospf6_auth_trailer.c: 275 in ospf6_hash_hmac_sha_digest() 269 case KEYCHAIN_ALGO_HMAC_SHA512: 270 #ifdef CRYPTO_OPENSSL 271 sha512_digest(mes, len, digest); 272 #endif 273 break; 274 case KEYCHAIN_ALGO_NULL: >>> CID 1511363: (DEADCODE) >>> Execution cannot reach this statement: "case KEYCHAIN_ALGO_MAX:". 275 case KEYCHAIN_ALGO_MAX: 276 default: /ospf6d/ospf6_auth_trailer.c: 274 in ospf6_hash_hmac_sha_digest() 269 case KEYCHAIN_ALGO_HMAC_SHA512: 270 #ifdef CRYPTO_OPENSSL 271 sha512_digest(mes, len, digest); 272 #endif 273 break; >>> CID 1511363: (DEADCODE) >>> Execution cannot reach this statement: "case KEYCHAIN_ALGO_NULL:". 274 case KEYCHAIN_ALGO_NULL: 275 case KEYCHAIN_ALGO_MAX: 276 default: ________________________________________________________________________________________________________ *** CID 1511362: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_auth_trailer.c: 541 in ospf6_auth_check_digest() 535 536 auth_len = ntohs(ospf6_auth->length); 537 538 memcpy(temp_hash, ospf6_auth->data, hash_len); 539 memcpy(ospf6_auth->data, apad, hash_len); 540 >>> CID 1511362: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "oh_len + auth_len + lls_block_len" to a tainted sink. 541 ospf6_auth_update_digest(oi, oh, ospf6_auth, auth_str, 542 (oh_len + auth_len + lls_block_len), 543 hash_algo); ________________________________________________________________________________________________________ *** CID 1511361: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_auth_trailer.c: 124 in ospf6_auth_hdr_dump_recv() 118 at_len = length - (oh_len + lls_len); 119 if (at_len > 0) { 120 ospf6_at_hdr = 121 (struct ospf6_auth_hdr *)((uint8_t *)ospfh + oh_len); 122 at_hdr_len = ntohs(ospf6_at_hdr->length); 123 hash_len = at_hdr_len - OSPF6_AUTH_HDR_MIN_SIZE; >>> CID 1511361: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "hash_len" to a tainted sink. 124 memcpy(temp, ospf6_at_hdr->data, hash_len); 125 temp[hash_len] = '\0'; ________________________________________________________________________________________________________ *** CID 1482146: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_message.c: 2787 in ospf6_lsupdate_send_neighbor_now() 2781 2782 if (IS_OSPF6_DEBUG_FLOODING 2783 || IS_OSPF6_DEBUG_MESSAGE(OSPF6_MESSAGE_TYPE_LSUPDATE, SEND_HDR)) 2784 zlog_debug("%s: Send lsupdate with lsa %s (age %u)", __func__, 2785 lsa->name, ntohs(lsa->header->age)); 2786 >>> CID 1482146: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "op->length" to a tainted sink. 2787 ospf6_send_lsupdate(on, NULL, op); Signed-off-by: Abhinay Ramesh <rabhinay@vmware.com>
* | | | ospf6d: Fix spelling mistakesDonald Sharp2022-02-144-7/+7
|/ / / | | | | | | | | | Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* | | ospf6d: Enable the feature using configure.acAbhinay Ramesh2022-02-092-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem Statement: ================= The feature is not enabled, needs to be enabled by doing required initialization. RCA: ==== Changes to support the feature is present, but the feature macro needs to be enabled. Fix: ==== This commit has changes to enable the code. Risk: ===== Medium Need to ensure all existing ospf6 related topotests pass. to ensure packet processing is not impacted. Tests Executed: =============== Have tested the functionality with enabling openssl and also disabling openssl. Signed-off-by: Abhinay Ramesh <rabhinay@vmware.com>
* | | ospf6d: Stitching the auth trailer code with rest of ospf6.Abhinay Ramesh2022-02-0915-263/+698
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem Statement: ================== RFC 7166 support for OSPF6 in FRR code. RCA: ==== This feature is newly supported in FRR Fix: ==== Core functionality implemented in previous commit is stitched with rest of ospf6 code as part of this commit. Risk: ===== Low risk Tests Executed: =============== Have executed the combination of commands. Signed-off-by: Abhinay Ramesh <rabhinay@vmware.com>
* | | ospf6d: Core functionality of auth trailer implementation..Abhinay Ramesh2022-02-094-0/+912
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem Statement: ================== Implement RFC 7166 support for OSPF6 in FRR code. RCA: ==== This feature is newly supported in FRR. Fix: ==== Changes are done to implement ospf6 ingress and egress packet processing. This commit has the core functionality. It supports below debugability commands: --------------------------------------- debug ospf6 authentication [<tx|rx>] It supports below clear command: -------------------------------- clear ipv6 ospf6 auth-counters interface [IFNAME] It supports below show commands: -------------------------------- frr# show ipv6 ospf6 interface ens192 ens192 is up, type BROADCAST Interface ID: 5 Number of I/F scoped LSAs is 2 0 Pending LSAs for LSUpdate in Time 00:00:00 [thread off] 0 Pending LSAs for LSAck in Time 00:00:00 [thread off] Authentication trailer is enabled with manual key ==> new info added Packet drop Tx 0, Packet drop Rx 0 ==> drop counters frr# show ipv6 ospf6 neighbor 2.2.2.2 detail Neighbor 2.2.2.2%ens192 Area 1 via interface ens192 (ifindex 3) 0 Pending LSAs for LSUpdate in Time 00:00:00 [thread off] 0 Pending LSAs for LSAck in Time 00:00:00 [thread off] Authentication header present ==> new info added hello DBDesc LSReq LSUpd LSAck Higher sequence no 0x0 0x0 0x0 0x0 0x0 Lower sequence no 0x242E 0x1DC4 0x1DC3 0x23CC 0x1DDA frr# show ipv6 ospf6 OSPFv3 Routing Process (0) with Router-ID 2.2.2.2 Number of areas in this router is 1 Authentication Sequence number info ==> new info added Higher sequence no 3, Lower sequence no 1656 Risk: ===== Low risk Tests Executed: =============== Have executed the combination of commands. Signed-off-by: Abhinay Ramesh <rabhinay@vmware.com>
* | | ospf6d: Auth trailer CLI implementation.Abhinay Ramesh2022-02-092-0/+288
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem Statement: ================== RFC 7166 support for OSPF6 in FRR code. RCA: ==== This feature is newly supported in FRR Fix: ==== Changes are done to add support for two new CLIs to configure ospf6 authentication trailer feature. One CLI is to support manual key configuration. Other CLI is to configure key using keychain. below CLIs are implemented as part of this commit. this configuration is applied on interface level. Without openssl: ipv6 ospf6 authentication key-id (1-65535) hash-algo <md5|hmac-sha-256> key WORD With openssl: ipv6 ospf6 authentication key-id (1-65535) hash-algo <md5|hmac-sha-256|hmac-sha-1|hmac-sha-384|hmac-sha-512> key WORD With keychain support: ipv6 ospf6 authentication keychain KEYCHAIN_NAME Running config for these command: frr# show running-config Building configuration... Current configuration: ! interface ens192 ipv6 address 2001:DB8:1::2/64 ipv6 ospf6 authentication key-id 10 hash-algo hmac-sha-256 key abhinay ! interface ens224 ipv6 address 2001:DB8:2::2/64 ipv6 ospf6 authentication keychain abhinay ! Risk: ===== Low risk Tests Executed: =============== Have executed the combination of commands. Signed-off-by: Abhinay Ramesh <rabhinay@vmware.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-03 16:50:40 +0100