summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--babeld/Makefile4
-rw-r--r--bird2/Makefile13
-rw-r--r--bird2/files/bird.init6
-rw-r--r--bird2/patches/0001-babel-Set-onlink-flag-for-IPv4-routes-with-unreachab.patch40
-rw-r--r--luci-app-bmx6/Makefile2
-rw-r--r--luci-app-bmx6/bmx6/usr/lib/lua/luci/view/admin_status/index/neighbours_simple.htm2
-rw-r--r--luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/nodes_j.htm2
-rw-r--r--luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/status_j.htm2
-rw-r--r--luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/tunnels_j.htm4
-rw-r--r--nodogsplash/Makefile4
-rw-r--r--opennds/Makefile88
-rw-r--r--quagga/Makefile22
-rw-r--r--quagga/patches/001-bgpd-Fix-AS_PATH-size-calculation-for-long-paths.patch28
-rw-r--r--quagga/patches/002-Quagga-2018-0543.patch58
-rw-r--r--quagga/patches/003-Quagga-2018-1114.patch99
-rw-r--r--quagga/patches/004-Quagga-2018-1550.patch104
-rw-r--r--quagga/patches/005-Quagga-2018-1975.patch32
-rw-r--r--quagga/patches/150-no-cross-fs-link.patch4
18 files changed, 446 insertions, 68 deletions
diff --git a/babeld/Makefile b/babeld/Makefile
index 022d0b8..5318889 100644
--- a/babeld/Makefile
+++ b/babeld/Makefile
@@ -8,12 +8,12 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=babeld
-PKG_VERSION:=1.9.1
+PKG_VERSION:=1.9.2
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://www.irif.fr/~jch/software/files/
-PKG_HASH:=1e1b3c01dd929177bc8d027aff1494da75e1e567e1f60df3bb45a78d5f1ca0b4
+PKG_HASH:=154f00e0a8bf35d6ea9028886c3dc5c3c342dd1a367df55ef29a547b75867f07
PKG_MAINTAINER:=Gabriel Kerneis <gabriel@kerneis.info>, \
Baptiste Jonglez <openwrt-pkg@bitsofnetworks.org>
diff --git a/bird2/Makefile b/bird2/Makefile
index f14b77c..cdc6ec1 100644
--- a/bird2/Makefile
+++ b/bird2/Makefile
@@ -7,17 +7,18 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=bird2
-PKG_VERSION:=2.0.4
+PKG_VERSION:=2.0.8
PKG_RELEASE:=1
PKG_SOURCE:=bird-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=ftp://bird.network.cz/pub/bird
-PKG_HASH:=676010b7517d4159b9af37401c26185f561ffcffeba73690a2ef2fad984714de
-PKG_BUILD_DEPENDS:=ncurses readline
+PKG_HASH:=19d2de83ee25a307b9e5b9e58797dd68766d439bcee33e3ac617ed502370e7f6
+
PKG_MAINTAINER:=Toke Høiland-Jørgensen <toke@toke.dk>
-PKG_BUILD_DIR:=$(BUILD_DIR)/bird-$(PKG_VERSION)
+PKG_LICENSE:=GPL-2.0-or-later
-PKG_LICENSE:=GPL-2.0
+PKG_BUILD_DEPENDS:=ncurses readline
+PKG_BUILD_DIR:=$(BUILD_DIR)/bird-$(PKG_VERSION)
include $(INCLUDE_DIR)/package.mk
@@ -96,7 +97,7 @@ protocols, telling BIRD to show various information, telling it to show
a routing table filtered by a filter, or asking BIRD to reconfigure.
endef
-CONFIGURE_ARGS += --with-linux-headers="$(LINUX_DIR)" --disable-libssh
+CONFIGURE_ARGS += --disable-libssh
define Package/bird2/conffiles
/etc/bird.conf
diff --git a/bird2/files/bird.init b/bird2/files/bird.init
index 18db4af..5f7a442 100644
--- a/bird2/files/bird.init
+++ b/bird2/files/bird.init
@@ -11,10 +11,14 @@ BIRD_PID_FILE="/var/run/bird.pid"
start_service() {
mkdir -p /var/run
procd_open_instance
- procd_set_param command $BIRD_BIN -c $BIRD_CONF -P $BIRD_PID_FILE
+ procd_set_param command $BIRD_BIN -f -c $BIRD_CONF -P $BIRD_PID_FILE
procd_set_param file "$BIRD_CONF"
procd_set_param stdout 1
procd_set_param stderr 1
procd_set_param respawn
procd_close_instance
}
+
+reload_service() {
+ procd_send_signal bird
+}
diff --git a/bird2/patches/0001-babel-Set-onlink-flag-for-IPv4-routes-with-unreachab.patch b/bird2/patches/0001-babel-Set-onlink-flag-for-IPv4-routes-with-unreachab.patch
deleted file mode 100644
index 5d194d2..0000000
--- a/bird2/patches/0001-babel-Set-onlink-flag-for-IPv4-routes-with-unreachab.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 0ca3156f64a46c52c6d6fc913958f83970d3e57f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
-Date: Mon, 30 Apr 2018 11:13:02 +0200
-Subject: [PATCH] babel: Set onlink flag for IPv4 routes with unreachable next
- hop
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-If the next hop of a route is not a reachable address, the route should be
-installed as onlink. This enables a configuration common in mesh networks
-where the mesh interface is assigned a /32 and babel handles the routing by
-installing onlink routes.
-
-Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
----
- proto/babel/babel.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/proto/babel/babel.c b/proto/babel/babel.c
-index ce05191c..afd2eb19 100644
---- a/proto/babel/babel.c
-+++ b/proto/babel/babel.c
-@@ -640,6 +640,13 @@ babel_announce_rte(struct babel_proto *p, struct babel_entry *e)
- .nh.iface = r->neigh->ifa->iface,
- };
-
-+ /* If we cannot find a reachable neighbour, set the entry to be onlink. This
-+ * makes it possible to, e.g., assign /32 addresses on a mesh interface and
-+ * have routing work.
-+ */
-+ if (!neigh_find(&p->p, r->next_hop, r->neigh->ifa->iface, 0))
-+ a0.nh.flags = RNF_ONLINK;
-+
- rta *a = rta_lookup(&a0);
- rte *rte = rte_get_temp(a);
- rte->u.babel.seqno = r->seqno;
---
-2.17.0
-
diff --git a/luci-app-bmx6/Makefile b/luci-app-bmx6/Makefile
index bb37c20..6ee9390 100644
--- a/luci-app-bmx6/Makefile
+++ b/luci-app-bmx6/Makefile
@@ -20,7 +20,7 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=luci-app-bmx6
-PKG_RELEASE:=5
+PKG_RELEASE:=6
PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
PKG_LICENSE:=GPL-2.0+
diff --git a/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/admin_status/index/neighbours_simple.htm b/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/admin_status/index/neighbours_simple.htm
index 97d6e0e..07412b7 100644
--- a/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/admin_status/index/neighbours_simple.htm
+++ b/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/admin_status/index/neighbours_simple.htm
@@ -1,6 +1,6 @@
<script type="text/javascript">//<![CDATA[
- XHR.poll(5, '/cgi-bin/bmx6-info', { '$neighbours': '' },
+ XHR.poll(5, '/cgi-bin/bmx6-info', { 'neighbours': '' },
function(x, st)
{
var originators = st.neighbours[0].originators;
diff --git a/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/nodes_j.htm b/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/nodes_j.htm
index 8ebd5ee..6a43e2d 100644
--- a/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/nodes_j.htm
+++ b/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/nodes_j.htm
@@ -87,7 +87,7 @@
document.getElementById('extra-info').innerHTML = document.getElementById(id).innerHTML;
}
- new TablePooler(5,"/cgi-bin/bmx6-info", {'$neighbours':''}, "descriptions_table", function(st){
+ new TablePooler(5,"/cgi-bin/bmx6-info", {'neighbours':''}, "descriptions_table", function(st){
var infoicon = "<%=resource%>/bmx6/world_small.png";
var nodeicon = "<%=resource%>/bmx6/world.png";
var originators = st.neighbours[0].originators;
diff --git a/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/status_j.htm b/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/status_j.htm
index bf21106..55015a0 100644
--- a/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/status_j.htm
+++ b/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/status_j.htm
@@ -63,7 +63,7 @@ Visit <a href="http://bmx6.net">bmx6.net</a> for more info.
</div>
<script type="text/javascript">//<![CDATA[
- new TablePooler(5,"/cgi-bin/bmx6-info", {'$info':''}, "status_table", function(st){
+ new TablePooler(5,"/cgi-bin/bmx6-info", {'info':''}, "status_table", function(st){
var res = Array();
var sta = st.info[0].status;
var ifaces = st.info[1].interfaces;
diff --git a/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/tunnels_j.htm b/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/tunnels_j.htm
index 92b22a9..244d04f 100644
--- a/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/tunnels_j.htm
+++ b/luci-app-bmx6/bmx6/usr/lib/lua/luci/view/bmx6/tunnels_j.htm
@@ -81,7 +81,7 @@
</div>
<script type="text/javascript">//<![CDATA[
- new TablePooler(5,"/cgi-bin/bmx6-info", {'$tunnels':''}, "descriptions_table", function(st){
+ new TablePooler(5,"/cgi-bin/bmx6-info", {'tunnels':''}, "descriptions_table", function(st){
var tunicon = "<%=resource%>/icons/tunnel.png";
var tunicon_dis = "<%=resource%>/icons/tunnel_disabled.png";
var applyicon = "<%=resource%>/cbi/apply.gif";
@@ -91,7 +91,7 @@
var nodename = tunnel.remoteName.replace(/\..+$/,'');
var advnet = tunnel.advNet;
var status = '<img src="'+tunicon_dis+'"/>';
-
+
if ( tunnel.tunName != "---" ) status = '<img src="'+tunicon+'"/>';
if ( advnet == "0.0.0.0/0" ) advnet = "<b>Internet</b>";
diff --git a/nodogsplash/Makefile b/nodogsplash/Makefile
index cd4e0a2..3079fd4 100644
--- a/nodogsplash/Makefile
+++ b/nodogsplash/Makefile
@@ -7,12 +7,12 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=nodogsplash
PKG_FIXUP:=autoreconf
-PKG_VERSION:=4.0.1
+PKG_VERSION:=4.0.3
PKG_RELEASE:=1
PKG_SOURCE_URL:=https://codeload.github.com/nodogsplash/nodogsplash/tar.gz/v$(PKG_VERSION)?
PKG_SOURCE:=nodogsplash-$(PKG_VERSION).tar.gz
-PKG_HASH:=b6787d042ab65f8cdc6982bd083a28a85ac3494896ae5c97e9de9b216585b1e7
+PKG_HASH:=cae212fe7f3c1be8ff5a294a97ab414798f03425635407e18f069e7e4670b250
PKG_BUILD_DIR:=$(BUILD_DIR)/nodogsplash-$(PKG_VERSION)
PKG_MAINTAINER:=Moritz Warning <moritzwarning@web.de>
diff --git a/opennds/Makefile b/opennds/Makefile
new file mode 100644
index 0000000..249a124
--- /dev/null
+++ b/opennds/Makefile
@@ -0,0 +1,88 @@
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=opennds
+PKG_FIXUP:=autoreconf
+PKG_VERSION:=5.2.0
+PKG_RELEASE:=1
+
+PKG_SOURCE_URL:=https://codeload.github.com/opennds/opennds/tar.gz/v$(PKG_VERSION)?
+PKG_SOURCE:=opennds-$(PKG_VERSION).tar.gz
+PKG_HASH:=8b8d8ab0b3d13f9b7c5fddb9423161e9e89c7051503ab219805209296eb00074
+PKG_BUILD_DIR:=$(BUILD_DIR)/openNDS-$(PKG_VERSION)
+
+PKG_MAINTAINER:=Rob White <rob@blue-wave.net>
+PKG_BUILD_PARALLEL:=1
+PKG_LICENSE:=GPL-2.0+
+
+include $(INCLUDE_DIR)/package.mk
+
+
+define Package/opennds
+ SUBMENU:=Captive Portals
+ SECTION:=net
+ CATEGORY:=Network
+ DEPENDS:=+libpthread +iptables-mod-ipopt +libmicrohttpd-no-ssl
+ TITLE:=Open public network gateway daemon
+ URL:=https://github.com/opennds/opennds
+ CONFLICTS:=nodogsplash nodogsplash2
+endef
+
+define Package/opennds/description
+ openNDS is a Captive Portal that offers a simple way to
+ provide restricted access to the Internet by showing a splash
+ page to the user before Internet access is granted.
+ It also incorporates an API that allows the creation of
+ sophisticated authentication applications.
+endef
+
+define Package/opennds/install
+
+ $(INSTALL_DIR) $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/opennds $(1)/usr/bin/
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/ndsctl $(1)/usr/bin/
+
+ $(INSTALL_DIR) $(1)/etc/opennds/htdocs/images
+ $(INSTALL_DIR) $(1)/etc/config
+ $(INSTALL_DIR) $(1)/etc/init.d
+ $(INSTALL_DIR) $(1)/etc/uci-defaults
+ $(INSTALL_DIR) $(1)/usr/lib/opennds
+ $(CP) $(PKG_BUILD_DIR)/resources/splash.html $(1)/etc/opennds/htdocs/
+ $(CP) $(PKG_BUILD_DIR)/resources/splash.css $(1)/etc/opennds/htdocs/
+ $(CP) $(PKG_BUILD_DIR)/resources/status.html $(1)/etc/opennds/htdocs/
+ $(CP) $(PKG_BUILD_DIR)/resources/splash.jpg $(1)/etc/opennds/htdocs/images/
+ $(CP) $(PKG_BUILD_DIR)/openwrt/opennds/files/etc/config/opennds $(1)/etc/config/
+ $(CP) $(PKG_BUILD_DIR)/openwrt/opennds/files/etc/init.d/opennds $(1)/etc/init.d/
+ $(CP) $(PKG_BUILD_DIR)/openwrt/opennds/files/etc/uci-defaults/40_opennds $(1)/etc/uci-defaults/
+ $(CP) $(PKG_BUILD_DIR)/openwrt/opennds/files/usr/lib/opennds/restart.sh $(1)/usr/lib/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/binauth/binauth_log.sh $(1)/usr/lib/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/binauth/binauth_sitewide.sh $(1)/usr/lib/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/binauth/userlist.dat $(1)/etc/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/binauth/splash_sitewide.html $(1)/etc/opennds/htdocs/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/PreAuth/login.sh $(1)/usr/lib/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/PreAuth/login-remote-image.sh $(1)/usr/lib/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/libs/get_client_interface.sh $(1)/usr/lib/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/libs/get_client_token.sh $(1)/usr/lib/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/libs/unescape.sh $(1)/usr/lib/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/libs/authmon.sh $(1)/usr/lib/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/libs/post-request.php $(1)/usr/lib/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/fas-aes/fas-aes.php $(1)/etc/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/fas-hid/fas-hid.php $(1)/etc/opennds/
+ $(CP) $(PKG_BUILD_DIR)/forward_authentication_service/fas-aes/fas-aes-https.php $(1)/etc/opennds/
+endef
+
+define Package/opennds/postrm
+#!/bin/sh
+uci delete firewall.opennds
+uci commit firewall
+endef
+
+define Package/opennds/conffiles
+/etc/config/opennds
+endef
+
+$(eval $(call BuildPackage,opennds))
diff --git a/quagga/Makefile b/quagga/Makefile
index e2751f4..91fee84 100644
--- a/quagga/Makefile
+++ b/quagga/Makefile
@@ -8,12 +8,21 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=quagga
-PKG_VERSION:=1.1.0
+PKG_VERSION:=1.1.1
PKG_RELEASE:=1
-PKG_HASH:=f7a43a9c59bfd3722002210530b2553c8d5cc05bfea5acd56d4f102b9f55dc63
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=@SAVANNAH/quagga/
+PKG_HASH:=b5a94e5bdad3062e04595a5692b8cc435f0a85102f75dfdca0a06d093b4ef63f
+
+PKG_MAINTAINER:=Vasilis Tsiligiannis <acinonyx@openwrt.gr>
+PKG_LICENSE:=GPL-2.0-or-later
+PKG_LICENSE_FILES:=COPYING
+
+PKG_BUILD_PARALLEL:=1
+PKG_FIXUP:=autoreconf
+PKG_INSTALL:=1
+
PKG_CONFIG_DEPENDS:= \
CONFIG_IPV6 \
CONFIG_PACKAGE_quagga-watchquagga \
@@ -26,10 +35,6 @@ PKG_CONFIG_DEPENDS:= \
CONFIG_PACKAGE_quagga-ripd \
CONFIG_PACKAGE_quagga-ripngd \
CONFIG_PACKAGE_quagga-vtysh
-PKG_BUILD_PARALLEL:=1
-PKG_FIXUP:=autoreconf
-PKG_INSTALL:=1
-PKG_LICENSE:=GPL-2.0
include $(INCLUDE_DIR)/package.mk
@@ -37,10 +42,9 @@ define Package/quagga/Default
SECTION:=net
CATEGORY:=Network
SUBMENU:=Routing and Redirection
- DEPENDS:=quagga
TITLE:=The Quagga Software Routing Suite
- URL:=http://www.quagga.net
- MAINTAINER:=Vasilis Tsiligiannis <acinonyx@openwrt.gr>
+ URL:=https://www.quagga.net
+ DEPENDS:=quagga
endef
define Package/quagga
diff --git a/quagga/patches/001-bgpd-Fix-AS_PATH-size-calculation-for-long-paths.patch b/quagga/patches/001-bgpd-Fix-AS_PATH-size-calculation-for-long-paths.patch
new file mode 100644
index 0000000..3ecbc0e
--- /dev/null
+++ b/quagga/patches/001-bgpd-Fix-AS_PATH-size-calculation-for-long-paths.patch
@@ -0,0 +1,28 @@
+From: Andreas Jaggi <aj@open.ch>
+Date: Mon, 2 Oct 2017 19:38:43 +0530
+Subject: bgpd: Fix AS_PATH size calculation for long paths
+Origin: http://git.savannah.gnu.org/cgit/quagga.git/commit?id=7a42b78be9a4108d98833069a88e6fddb9285008
+Bug-Debian: https://bugs.debian.org/879474
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-16227
+
+If you have an AS_PATH with more entries than
+what can be written into a single AS_SEGMENT_MAX
+it needs to be broken up. The code that noticed
+that the AS_PATH needs to be broken up was not
+correctly calculating the size of the resulting
+message. This patch addresses this issue.
+---
+ bgpd/bgp_aspath.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/bgpd/bgp_aspath.c
++++ b/bgpd/bgp_aspath.c
+@@ -903,7 +903,7 @@ aspath_put (struct stream *s, struct asp
+ assegment_header_put (s, seg->type, AS_SEGMENT_MAX);
+ assegment_data_put (s, seg->as, AS_SEGMENT_MAX, use32bit);
+ written += AS_SEGMENT_MAX;
+- bytes += ASSEGMENT_SIZE (written, use32bit);
++ bytes += ASSEGMENT_SIZE (AS_SEGMENT_MAX, use32bit);
+ }
+
+ /* write the final segment, probably is also the first */
diff --git a/quagga/patches/002-Quagga-2018-0543.patch b/quagga/patches/002-Quagga-2018-0543.patch
new file mode 100644
index 0000000..1f77143
--- /dev/null
+++ b/quagga/patches/002-Quagga-2018-0543.patch
@@ -0,0 +1,58 @@
+From cc2e6770697e343f4af534114ab7e633d5beabec Mon Sep 17 00:00:00 2001
+From: Paul Jakma <paul@jakma.org>
+Date: Wed, 3 Jan 2018 23:57:33 +0000
+Subject: bgpd/security: invalid attr length sends NOTIFY with data overrun
+
+Security issue: Quagga-2018-0543
+
+See: https://www.quagga.net/security/Quagga-2018-0543.txt
+
+* bgpd/bgp_attr.c: (bgp_attr_parse) An invalid attribute length is correctly
+ checked, and a NOTIFY prepared. The NOTIFY can include the incorrect
+ received data with the NOTIFY, for debug purposes. Commit
+ c69698704806a9ac5 modified the code to do that just, and also send the
+ malformed attr with the NOTIFY. However, the invalid attribute length was
+ used as the length of the data to send back.
+
+ The result is a read past the end of data, which is then written to the
+ NOTIFY message and sent to the peer.
+
+ A configured BGP peer can use this bug to read up to 64 KiB of memory from
+ the bgpd process, or crash the process if the invalid read is caught by
+ some means (unmapped page and SEGV, or other mechanism) resulting in a DoS.
+
+ This bug _ought_ /not/ be exploitable by anything other than the connected
+ BGP peer, assuming the underlying TCP transport is secure. For no BGP
+ peer should send on an UPDATE with this attribute. Quagga will not, as
+ Quagga always validates the attr header length, regardless of type.
+
+ However, it is possible that there are BGP implementations that do not
+ check lengths on some attributes (e.g. optional/transitive ones of a type
+ they do not recognise), and might pass such malformed attrs on. If such
+ implementations exists and are common, then this bug might be triggerable
+ by BGP speakers further hops away. Those peers will not receive the
+ NOTIFY (unless they sit on a shared medium), however they might then be
+ able to trigger a DoS.
+
+ Fix: use the valid bound to calculate the length.
+
+--- a/bgpd/bgp_attr.c
++++ b/bgpd/bgp_attr.c
+@@ -2079,6 +2079,8 @@ bgp_attr_parse (struct peer *peer, struc
+ memset (seen, 0, BGP_ATTR_BITMAP_SIZE);
+
+ /* End pointer of BGP attribute. */
++ assert (size <= stream_get_size (BGP_INPUT (peer)));
++ assert (size <= stream_get_endp (BGP_INPUT (peer)));
+ endp = BGP_INPUT_PNT (peer) + size;
+
+ /* Get attributes to the end of attribute length. */
+@@ -2160,7 +2162,7 @@ bgp_attr_parse (struct peer *peer, struc
+ bgp_notify_send_with_data (peer,
+ BGP_NOTIFY_UPDATE_ERR,
+ BGP_NOTIFY_UPDATE_ATTR_LENG_ERR,
+- startp, attr_endp - startp);
++ startp, endp - startp);
+ return BGP_ATTR_PARSE_ERROR;
+ }
+
diff --git a/quagga/patches/003-Quagga-2018-1114.patch b/quagga/patches/003-Quagga-2018-1114.patch
new file mode 100644
index 0000000..a4b91c5
--- /dev/null
+++ b/quagga/patches/003-Quagga-2018-1114.patch
@@ -0,0 +1,99 @@
+From e69b535f92eafb599329bf725d9b4c6fd5d7fded Mon Sep 17 00:00:00 2001
+From: Paul Jakma <paul@jakma.org>
+Date: Sat, 6 Jan 2018 19:52:10 +0000
+Subject: bgpd/security: Fix double free of unknown attribute
+
+Security issue: Quagga-2018-1114
+See: https://www.quagga.net/security/Quagga-2018-1114.txt
+
+It is possible for bgpd to double-free an unknown attribute. This can happen
+via bgp_update_receive receiving an UPDATE with an invalid unknown attribute.
+bgp_update_receive then will call bgp_attr_unintern_sub and bgp_attr_flush,
+and the latter may try free an already freed unknown attr.
+
+* bgpd/bgp_attr.c: (transit_unintern) Take a pointer to the caller's storage
+ for the (struct transit *), so that transit_unintern can NULL out the
+ caller's reference if the (struct transit) is freed.
+ (cluster_unintern) By inspection, appears to have a similar issue.
+ (bgp_attr_unintern_sub) adjust for above.
+
+--- a/bgpd/bgp_attr.c
++++ b/bgpd/bgp_attr.c
+@@ -186,15 +186,17 @@ cluster_intern (struct cluster_list *clu
+ }
+
+ void
+-cluster_unintern (struct cluster_list *cluster)
++cluster_unintern (struct cluster_list **cluster)
+ {
+- if (cluster->refcnt)
+- cluster->refcnt--;
++ struct cluster_list *c = *cluster;
++ if (c->refcnt)
++ c->refcnt--;
+
+- if (cluster->refcnt == 0)
++ if (c->refcnt == 0)
+ {
+- hash_release (cluster_hash, cluster);
+- cluster_free (cluster);
++ hash_release (cluster_hash, c);
++ cluster_free (c);
++ *cluster = NULL;
+ }
+ }
+
+@@ -344,15 +346,18 @@ transit_intern (struct transit *transit)
+ }
+
+ void
+-transit_unintern (struct transit *transit)
++transit_unintern (struct transit **transit)
+ {
+- if (transit->refcnt)
+- transit->refcnt--;
++ struct transit *t = *transit;
++
++ if (t->refcnt)
++ t->refcnt--;
+
+- if (transit->refcnt == 0)
++ if (t->refcnt == 0)
+ {
+- hash_release (transit_hash, transit);
+- transit_free (transit);
++ hash_release (transit_hash, t);
++ transit_free (t);
++ *transit = NULL;
+ }
+ }
+
+@@ -793,11 +798,11 @@ bgp_attr_unintern_sub (struct attr *attr
+ UNSET_FLAG(attr->flag, ATTR_FLAG_BIT (BGP_ATTR_EXT_COMMUNITIES));
+
+ if (attr->extra->cluster)
+- cluster_unintern (attr->extra->cluster);
++ cluster_unintern (&attr->extra->cluster);
+ UNSET_FLAG(attr->flag, ATTR_FLAG_BIT (BGP_ATTR_CLUSTER_LIST));
+
+ if (attr->extra->transit)
+- transit_unintern (attr->extra->transit);
++ transit_unintern (&attr->extra->transit);
+ }
+ }
+
+--- a/bgpd/bgp_attr.h
++++ b/bgpd/bgp_attr.h
+@@ -184,10 +184,10 @@ extern unsigned long int attr_unknown_co
+
+ /* Cluster list prototypes. */
+ extern int cluster_loop_check (struct cluster_list *, struct in_addr);
+-extern void cluster_unintern (struct cluster_list *);
++extern void cluster_unintern (struct cluster_list **);
+
+ /* Transit attribute prototypes. */
+-void transit_unintern (struct transit *);
++void transit_unintern (struct transit **);
+
+ /* Below exported for unit-test purposes only */
+ struct bgp_attr_parser_args {
diff --git a/quagga/patches/004-Quagga-2018-1550.patch b/quagga/patches/004-Quagga-2018-1550.patch
new file mode 100644
index 0000000..4bd3da8
--- /dev/null
+++ b/quagga/patches/004-Quagga-2018-1550.patch
@@ -0,0 +1,104 @@
+From 9e5251151894aefdf8e9392a2371615222119ad8 Mon Sep 17 00:00:00 2001
+From: Paul Jakma <paul@jakma.org>
+Date: Sat, 6 Jan 2018 22:31:52 +0000
+Subject: bgpd/security: debug print of received NOTIFY data can over-read msg
+ array
+
+Security issue: Quagga-2018-1550
+See: https://www.quagga.net/security/Quagga-2018-1550.txt
+
+* bgpd/bgp_debug.c: (struct message) Nearly every one of the NOTIFY
+ code/subcode message arrays has their corresponding size variables off
+ by one, as most have 1 as first index.
+
+ This means (bgp_notify_print) can cause mes_lookup to overread the (struct
+ message) by 1 pointer value if given an unknown index.
+
+ Fix the bgp_notify_..._msg_max variables to use the compiler to calculate
+ the correct sizes.
+
+--- a/bgpd/bgp_debug.c
++++ b/bgpd/bgp_debug.c
+@@ -29,6 +29,7 @@ Software Foundation, Inc., 59 Temple Pla
+ #include "log.h"
+ #include "sockunion.h"
+ #include "filter.h"
++#include "memory.h"
+
+ #include "bgpd/bgpd.h"
+ #include "bgpd/bgp_aspath.h"
+@@ -73,7 +74,8 @@ const struct message bgp_status_msg[] =
+ { Clearing, "Clearing" },
+ { Deleted, "Deleted" },
+ };
+-const int bgp_status_msg_max = BGP_STATUS_MAX;
++#define BGP_DEBUG_MSG_MAX(msg) const int msg ## _max = array_size (msg)
++BGP_DEBUG_MSG_MAX (bgp_status_msg);
+
+ /* BGP message type string. */
+ const char *bgp_type_str[] =
+@@ -84,7 +86,8 @@ const char *bgp_type_str[] =
+ "NOTIFICATION",
+ "KEEPALIVE",
+ "ROUTE-REFRESH",
+- "CAPABILITY"
++ "CAPABILITY",
++ NULL,
+ };
+
+ /* message for BGP-4 Notify */
+@@ -98,15 +101,15 @@ static const struct message bgp_notify_m
+ { BGP_NOTIFY_CEASE, "Cease"},
+ { BGP_NOTIFY_CAPABILITY_ERR, "CAPABILITY Message Error"},
+ };
+-static const int bgp_notify_msg_max = BGP_NOTIFY_MAX;
++BGP_DEBUG_MSG_MAX (bgp_notify_msg);
+
+ static const struct message bgp_notify_head_msg[] =
+ {
+ { BGP_NOTIFY_HEADER_NOT_SYNC, "/Connection Not Synchronized"},
+ { BGP_NOTIFY_HEADER_BAD_MESLEN, "/Bad Message Length"},
+- { BGP_NOTIFY_HEADER_BAD_MESTYPE, "/Bad Message Type"}
++ { BGP_NOTIFY_HEADER_BAD_MESTYPE, "/Bad Message Type"},
+ };
+-static const int bgp_notify_head_msg_max = BGP_NOTIFY_HEADER_MAX;
++BGP_DEBUG_MSG_MAX (bgp_notify_head_msg);
+
+ static const struct message bgp_notify_open_msg[] =
+ {
+@@ -119,7 +122,7 @@ static const struct message bgp_notify_o
+ { BGP_NOTIFY_OPEN_UNACEP_HOLDTIME, "/Unacceptable Hold Time"},
+ { BGP_NOTIFY_OPEN_UNSUP_CAPBL, "/Unsupported Capability"},
+ };
+-static const int bgp_notify_open_msg_max = BGP_NOTIFY_OPEN_MAX;
++BGP_DEBUG_MSG_MAX (bgp_notify_open_msg);
+
+ static const struct message bgp_notify_update_msg[] =
+ {
+@@ -136,7 +139,7 @@ static const struct message bgp_notify_u
+ { BGP_NOTIFY_UPDATE_INVAL_NETWORK, "/Invalid Network Field"},
+ { BGP_NOTIFY_UPDATE_MAL_AS_PATH, "/Malformed AS_PATH"},
+ };
+-static const int bgp_notify_update_msg_max = BGP_NOTIFY_UPDATE_MAX;
++BGP_DEBUG_MSG_MAX (bgp_notify_update_msg);
+
+ static const struct message bgp_notify_cease_msg[] =
+ {
+@@ -150,7 +153,7 @@ static const struct message bgp_notify_c
+ { BGP_NOTIFY_CEASE_COLLISION_RESOLUTION, "/Connection collision resolution"},
+ { BGP_NOTIFY_CEASE_OUT_OF_RESOURCE, "/Out of Resource"},
+ };
+-static const int bgp_notify_cease_msg_max = BGP_NOTIFY_CEASE_MAX;
++BGP_DEBUG_MSG_MAX (bgp_notify_cease_msg);
+
+ static const struct message bgp_notify_capability_msg[] =
+ {
+@@ -159,7 +162,7 @@ static const struct message bgp_notify_c
+ { BGP_NOTIFY_CAPABILITY_INVALID_LENGTH, "/Invalid Capability Length"},
+ { BGP_NOTIFY_CAPABILITY_MALFORMED_CODE, "/Malformed Capability Value"},
+ };
+-static const int bgp_notify_capability_msg_max = BGP_NOTIFY_CAPABILITY_MAX;
++BGP_DEBUG_MSG_MAX (bgp_notify_capability_msg);
+
+ /* Origin strings. */
+ const char *bgp_origin_str[] = {"i","e","?"};
diff --git a/quagga/patches/005-Quagga-2018-1975.patch b/quagga/patches/005-Quagga-2018-1975.patch
new file mode 100644
index 0000000..5e0c6ee
--- /dev/null
+++ b/quagga/patches/005-Quagga-2018-1975.patch
@@ -0,0 +1,32 @@
+From ce07207c50a3d1f05d6dd49b5294282e59749787 Mon Sep 17 00:00:00 2001
+From: Paul Jakma <paul@jakma.org>
+Date: Sat, 6 Jan 2018 21:20:51 +0000
+Subject: bgpd/security: fix infinite loop on certain invalid OPEN messages
+
+Security issue: Quagga-2018-1975
+See: https://www.quagga.net/security/Quagga-2018-1975.txt
+
+* bgpd/bgp_packet.c: (bgp_capability_msg_parse) capability parser can infinite
+ loop due to checks that issue 'continue' without bumping the input
+ pointer.
+
+--- a/bgpd/bgp_packet.c
++++ b/bgpd/bgp_packet.c
+@@ -2251,7 +2251,8 @@ bgp_capability_msg_parse (struct peer *p
+
+ end = pnt + length;
+
+- while (pnt < end)
++ /* XXX: Streamify this */
++ for (; pnt < end; pnt += hdr->length + 3)
+ {
+ /* We need at least action, capability code and capability length. */
+ if (pnt + 3 > end)
+@@ -2339,7 +2340,6 @@ bgp_capability_msg_parse (struct peer *p
+ zlog_warn ("%s unrecognized capability code: %d - ignored",
+ peer->host, hdr->code);
+ }
+- pnt += hdr->length + 3;
+ }
+ return 0;
+ }
diff --git a/quagga/patches/150-no-cross-fs-link.patch b/quagga/patches/150-no-cross-fs-link.patch
index 8445103..18078bc 100644
--- a/quagga/patches/150-no-cross-fs-link.patch
+++ b/quagga/patches/150-no-cross-fs-link.patch
@@ -1,6 +1,6 @@
--- a/lib/command.c
+++ b/lib/command.c
-@@ -3198,6 +3198,13 @@ DEFUN (config_write_file,
+@@ -3200,6 +3200,13 @@ DEFUN (config_write_file,
VTY_NEWLINE);
goto finished;
}
@@ -14,7 +14,7 @@
if (link (config_file, config_file_sav) != 0)
{
vty_out (vty, "Can't backup old configuration file %s.%s", config_file_sav,
-@@ -3211,7 +3218,23 @@ DEFUN (config_write_file,
+@@ -3213,7 +3220,23 @@ DEFUN (config_write_file,
VTY_NEWLINE);
goto finished;
}
generated by cgit (git 2.46.0) at 2026-10-12 02:06:44 +0000