From 81b029c569bbafd3e8ff38406d93fb8632bb623b Mon Sep 17 00:00:00 2001 From: anolis-bot Date: Tue, 16 May 2023 20:35:30 +0800 Subject: [PATCH 1/3] update to frr-7.5.1-7.el8 Signed-off-by: anolis-bot --- 0012-graceful-restart.patch | 79 +++++++++++++++++++++++++++++++++++++ 0013-CVE-2022-37032.patch | 32 +++++++++++++++ frr.fc | 2 +- frr.spec | 39 +++++++++--------- frr.te | 2 + 5 files changed, 132 insertions(+), 22 deletions(-) create mode 100644 0012-graceful-restart.patch create mode 100644 0013-CVE-2022-37032.patch diff --git a/0012-graceful-restart.patch b/0012-graceful-restart.patch new file mode 100644 index 0000000..7e874cc --- /dev/null +++ b/0012-graceful-restart.patch @@ -0,0 +1,79 @@ +From 12f9f8472d0f8cfc026352906b8e5342df2846cc Mon Sep 17 00:00:00 2001 +From: Donatas Abraitis +Date: Tue, 27 Sep 2022 17:30:16 +0300 +Subject: [PATCH] bgpd: Do not send Deconfig/Shutdown message when restarting + +We might disable sending unconfig/shutdown notifications when +Graceful-Restart is enabled and negotiated. + +Signed-off-by: Donatas Abraitis +--- + bgpd/bgpd.c | 35 ++++++++++++++++++++++++++--------- + 1 file changed, 26 insertions(+), 9 deletions(-) + +diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c +index 3d4ef7c..f8089c6 100644 +--- a/bgpd/bgpd.c ++++ b/bgpd/bgpd.c +@@ -2564,11 +2564,34 @@ int peer_group_remote_as(struct bgp *bgp, const char *group_name, as_t *as, + + void peer_notify_unconfig(struct peer *peer) + { ++ if (BGP_PEER_GRACEFUL_RESTART_CAPABLE(peer)) { ++ if (bgp_debug_neighbor_events(peer)) ++ zlog_debug( ++ "%pBP configured Graceful-Restart, skipping unconfig notification", ++ peer); ++ return; ++ } ++ + if (BGP_IS_VALID_STATE_FOR_NOTIF(peer->status)) + bgp_notify_send(peer, BGP_NOTIFY_CEASE, + BGP_NOTIFY_CEASE_PEER_UNCONFIG); + } + ++static void peer_notify_shutdown(struct peer *peer) ++{ ++ if (BGP_PEER_GRACEFUL_RESTART_CAPABLE(peer)) { ++ if (bgp_debug_neighbor_events(peer)) ++ zlog_debug( ++ "%pBP configured Graceful-Restart, skipping shutdown notification", ++ peer); ++ return; ++ } ++ ++ if (BGP_IS_VALID_STATE_FOR_NOTIF(peer->status)) ++ bgp_notify_send(peer, BGP_NOTIFY_CEASE, ++ BGP_NOTIFY_CEASE_ADMIN_SHUTDOWN); ++} ++ + void peer_group_notify_unconfig(struct peer_group *group) + { + struct peer *peer, *other; +@@ -3380,11 +3403,8 @@ int bgp_delete(struct bgp *bgp) + } + + /* Inform peers we're going down. */ +- for (ALL_LIST_ELEMENTS(bgp->peer, node, next, peer)) { +- if (BGP_IS_VALID_STATE_FOR_NOTIF(peer->status)) +- bgp_notify_send(peer, BGP_NOTIFY_CEASE, +- BGP_NOTIFY_CEASE_ADMIN_SHUTDOWN); +- } ++ for (ALL_LIST_ELEMENTS(bgp->peer, node, next, peer)) ++ peer_notify_shutdown(peer); + + /* Delete static routes (networks). */ + bgp_static_delete(bgp); +@@ -7238,11 +7258,7 @@ void bgp_terminate(void) + + for (ALL_LIST_ELEMENTS(bm->bgp, mnode, mnnode, bgp)) + for (ALL_LIST_ELEMENTS(bgp->peer, node, nnode, peer)) +- if (peer->status == Established +- || peer->status == OpenSent +- || peer->status == OpenConfirm) +- bgp_notify_send(peer, BGP_NOTIFY_CEASE, +- BGP_NOTIFY_CEASE_PEER_UNCONFIG); ++ peer_notify_unconfig(peer); + + if (bm->process_main_queue) + work_queue_free_and_null(&bm->process_main_queue); diff --git a/0013-CVE-2022-37032.patch b/0013-CVE-2022-37032.patch new file mode 100644 index 0000000..4899c72 --- /dev/null +++ b/0013-CVE-2022-37032.patch @@ -0,0 +1,32 @@ +From ff6db1027f8f36df657ff2e5ea167773752537ed Mon Sep 17 00:00:00 2001 +From: Donald Sharp +Date: Thu, 21 Jul 2022 08:11:58 -0400 +Subject: [PATCH] bgpd: Make sure hdr length is at a minimum of what is + expected + +Ensure that if the capability length specified is enough data. + +Signed-off-by: Donald Sharp +--- + bgpd/bgp_packet.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c +index dbf6c0b2e99..45752a8ab6d 100644 +--- a/bgpd/bgp_packet.c ++++ b/bgpd/bgp_packet.c +@@ -2620,6 +2620,14 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt, + "%s CAPABILITY has action: %d, code: %u, length %u", + peer->host, action, hdr->code, hdr->length); + ++ if (hdr->length < sizeof(struct capability_mp_data)) { ++ zlog_info( ++ "%pBP Capability structure is not properly filled out, expected at least %zu bytes but header length specified is %d", ++ peer, sizeof(struct capability_mp_data), ++ hdr->length); ++ return BGP_Stop; ++ } ++ + /* Capability length check. */ + if ((pnt + hdr->length + 3) > end) { + zlog_info("%s Capability length error", peer->host); diff --git a/frr.fc b/frr.fc index acc5508..8cd3b3d 100644 --- a/frr.fc +++ b/frr.fc @@ -1,4 +1,4 @@ -/usr/libexec/frr(/.*)? gen_context(system_u:object_r:frr_exec_t,s0) +/usr/libexec/frr/(.*)? gen_context(system_u:object_r:frr_exec_t,s0) /usr/lib/systemd/system/frr.* gen_context(system_u:object_r:frr_unit_file_t,s0) diff --git a/frr.spec b/frr.spec index f96da72..647ee27 100644 --- a/frr.spec +++ b/frr.spec @@ -1,4 +1,3 @@ -%define anolis_release .0.1 %global frrversion 7.5.1 %global frr_libdir /usr/libexec/frr @@ -8,7 +7,7 @@ Name: frr Version: 7.5.1 -Release: 4%{?checkout}%{anolis_release}%{?dist} +Release: 7%{?checkout}%{?dist} Summary: Routing daemon License: GPLv2+ URL: http://www.frrouting.org @@ -33,14 +32,12 @@ Requires(preun): systemd /sbin/install-info Requires(postun): systemd Requires: iproute Requires: initscripts -Requires: glibc %if 0%{?with_selinux} Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype}) %endif Provides: routingdaemon = %{version}-%{release} -Provides: /usr/bin/mtracebis Obsoletes: frr-sysvinit quagga frr-contrib Patch0000: 0000-remove-babeld-and-ldpd.patch @@ -54,6 +51,8 @@ Patch0008: 0008-designated-router.patch Patch0009: 0009-routemap.patch Patch0010: 0010-moving-executables.patch Patch0011: 0011-reload-bfd-profile.patch +Patch0012: 0012-graceful-restart.patch +Patch0013: 0013-CVE-2022-37032.patch %description FRRouting is free software that manages TCP/IP based routing protocols. It takes @@ -78,14 +77,6 @@ SELinux policy modules for FRR package %endif -%package doc -Summary: Documents for %{name} -BuildArch: noarch -Requires: %{name} = %{version}-%{release} - -%description doc -Doc pages for %{name}. - %prep %autosetup -S git #SELinux @@ -226,8 +217,10 @@ fi %selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 %selinux_relabel_post -s %{selinuxtype} #/var/tmp and /var/run need to be relabeled as well if FRR is running before upgrade -%{_sbindir}/restorecon -R /var/tmp/frr &> /dev/null -%{_sbindir}/restorecon -R /var/run/frr &> /dev/null +if [ $1 == 2 ]; then + %{_sbindir}/restorecon -R /var/tmp/frr &> /dev/null + %{_sbindir}/restorecon -R /var/run/frr &> /dev/null +fi %postun selinux if [ $1 -eq 0 ]; then @@ -251,6 +244,7 @@ make check PYTHON=%{__python3} %doc ospf6d/ospf6d.conf.sample %doc ripngd/ripngd.conf.sample %doc pimd/pimd.conf.sample +%doc doc/mpls %dir %attr(740,frr,frr) %{_sysconfdir}/frr %dir %attr(755,frr,frr) /var/log/frr %dir %attr(755,frr,frr) /run/frr @@ -278,15 +272,18 @@ make check PYTHON=%{__python3} %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} %endif -%files doc -%doc doc/mpls - %changelog -* Tue Dec 13 2022 DengXiewei - 7.5.1-4.0.1 -- Add doc sub package +* Wed Nov 30 2022 Michal Ruprich - 7.5.1-7 +- Resolves: #2128737 - out-of-bounds read in the BGP daemon may lead to information disclosure or denial of service + +* Tue Nov 29 2022 Michal Ruprich - 7.5.1-6 +- Resolves: #1939516 - frr service cannot reload itself, due to executing in the wrong SELinux context + +* Mon Nov 14 2022 Michal Ruprich - 7.5.1-5 +- Resolves: #2127140 - Frr is unable to push routes to the system routing table -* Thu Sep 15 2022 Michal Ruprich - 7.5.1-4 -- Resolves: #2126040 - Frr is unable to push routes to the system routing table +* Mon Nov 14 2022 Michal Ruprich - 7.5.1-4 +- Resolves: #1948422 - BGP incorrectly withdraws routes on graceful restart capable routers * Thu Aug 25 2022 Michal Ruprich - 7.5.1-3 - Resolves: #2054160 - FRR reloader does not disable BFD when unsetting BFD profile diff --git a/frr.te b/frr.te index 1dac7e4..e41b75d 100644 --- a/frr.te +++ b/frr.te @@ -93,6 +93,7 @@ corenet_tcp_bind_zebra_port(frr_t) domain_use_interactive_fds(frr_t) fs_read_nsfs_files(frr_t) +fs_search_cgroup_dirs(frr_t) sysnet_exec_ifconfig(frr_t) @@ -119,4 +120,5 @@ optional_policy(` optional_policy(` userdom_admin_home_dir_filetrans(frr_t, frr_conf_t, file, ".history_frr") + userdom_inherit_append_admin_home_files(frr_t, frr_conf_t, file, ".history_frr") ') -- Gitee From a4c20ac1d25b36390f232b525a6c41f2adf606cc Mon Sep 17 00:00:00 2001 From: DengXiewei Date: Sun, 17 Jul 2022 15:37:56 +0800 Subject: [PATCH 2/3] Add doc sub package Signed-off-by: DengXiewei --- frr.spec | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/frr.spec b/frr.spec index 647ee27..4e10c3f 100644 --- a/frr.spec +++ b/frr.spec @@ -1,3 +1,4 @@ +%define anolis_release .0.1 %global frrversion 7.5.1 %global frr_libdir /usr/libexec/frr @@ -7,7 +8,7 @@ Name: frr Version: 7.5.1 -Release: 7%{?checkout}%{?dist} +Release: 7%{?checkout}%{anolis_release}%{?dist} Summary: Routing daemon License: GPLv2+ URL: http://www.frrouting.org @@ -32,12 +33,14 @@ Requires(preun): systemd /sbin/install-info Requires(postun): systemd Requires: iproute Requires: initscripts +Requires: glibc %if 0%{?with_selinux} Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype}) %endif Provides: routingdaemon = %{version}-%{release} +Provides: /usr/bin/mtracebis Obsoletes: frr-sysvinit quagga frr-contrib Patch0000: 0000-remove-babeld-and-ldpd.patch @@ -77,6 +80,14 @@ SELinux policy modules for FRR package %endif +%package doc +Summary: Documents for %{name} +BuildArch: noarch +Requires: %{name} = %{version}-%{release} + +%description doc +Doc pages for %{name}. + %prep %autosetup -S git #SELinux @@ -244,7 +255,6 @@ make check PYTHON=%{__python3} %doc ospf6d/ospf6d.conf.sample %doc ripngd/ripngd.conf.sample %doc pimd/pimd.conf.sample -%doc doc/mpls %dir %attr(740,frr,frr) %{_sysconfdir}/frr %dir %attr(755,frr,frr) /var/log/frr %dir %attr(755,frr,frr) /run/frr @@ -272,7 +282,13 @@ make check PYTHON=%{__python3} %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} %endif +%files doc +%doc doc/mpls + %changelog +* Fri May 26 2023 DengXiewei - 7.5.1-7.0.1 +- Add doc sub package + * Wed Nov 30 2022 Michal Ruprich - 7.5.1-7 - Resolves: #2128737 - out-of-bounds read in the BGP daemon may lead to information disclosure or denial of service -- Gitee From 04f0e508f7c49c2e32d18581333056cf9b9cf727 Mon Sep 17 00:00:00 2001 From: Zhao Hang Date: Fri, 30 Jun 2023 15:48:00 +0800 Subject: [PATCH 3/3] Remove loongarch64 arch Signed-off-by: Zhao Hang --- frr.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/frr.spec b/frr.spec index 4e10c3f..529bae4 100644 --- a/frr.spec +++ b/frr.spec @@ -17,6 +17,7 @@ Source1: %{name}-tmpfiles.conf Source2: frr.fc Source3: frr.te Source4: frr.if +Excludearch: loongarch64 BuildRequires: perl-generators BuildRequires: gcc BuildRequires: net-snmp-devel @@ -288,6 +289,7 @@ make check PYTHON=%{__python3} %changelog * Fri May 26 2023 DengXiewei - 7.5.1-7.0.1 - Add doc sub package +- Remove loongarch64 arch (wb-zh951434@alibaba-inc.com) * Wed Nov 30 2022 Michal Ruprich - 7.5.1-7 - Resolves: #2128737 - out-of-bounds read in the BGP daemon may lead to information disclosure or denial of service -- Gitee