quagga/patches/004-Quagga-2018-1550.patch

   1 From 9e5251151894aefdf8e9392a2371615222119ad8 Mon Sep 17 00:00:00 2001
   2 From: Paul Jakma <paul@jakma.org>
   3 Date: Sat, 6 Jan 2018 22:31:52 +0000
   4 Subject: bgpd/security: debug print of received NOTIFY data can over-read msg
   5  array
   6
   7 Security issue: Quagga-2018-1550
   8 See: https://www.quagga.net/security/Quagga-2018-1550.txt
   9
  10 * bgpd/bgp_debug.c: (struct message) Nearly every one of the NOTIFY
  11   code/subcode message arrays has their corresponding size variables off
  12   by one, as most have 1 as first index.
  13
  14   This means (bgp_notify_print) can cause mes_lookup to overread the (struct
  15   message) by 1 pointer value if given an unknown index.
  16
  17   Fix the bgp_notify_..._msg_max variables to use the compiler to calculate
  18   the correct sizes.
  19
  20 --- a/bgpd/bgp_debug.c
  21 +++ b/bgpd/bgp_debug.c
  22 @@ -29,6 +29,7 @@ Software Foundation, Inc., 59 Temple Pla
  23  #include "log.h"
  24  #include "sockunion.h"
  25  #include "filter.h"
  26 +#include "memory.h"
  27
  28  #include "bgpd/bgpd.h"
  29  #include "bgpd/bgp_aspath.h"
  30 @@ -73,7 +74,8 @@ const struct message bgp_status_msg[] =
  31    { Clearing,    "Clearing"    },
  32    { Deleted,     "Deleted"     },
  33  };
  34 -const int bgp_status_msg_max = BGP_STATUS_MAX;
  35 +#define BGP_DEBUG_MSG_MAX(msg) const int msg ## _max = array_size (msg)
  36 +BGP_DEBUG_MSG_MAX (bgp_status_msg);
  37
  38  /* BGP message type string. */
  39  const char *bgp_type_str[] =
  40 @@ -84,7 +86,8 @@ const char *bgp_type_str[] =
  41    "NOTIFICATION",
  42    "KEEPALIVE",
  43    "ROUTE-REFRESH",
  44 -  "CAPABILITY"
  45 +  "CAPABILITY",
  46 +  NULL,
  47  };
  48
  49  /* message for BGP-4 Notify */
  50 @@ -98,15 +101,15 @@ static const struct message bgp_notify_m
  51    { BGP_NOTIFY_CEASE, "Cease"},
  52    { BGP_NOTIFY_CAPABILITY_ERR, "CAPABILITY Message Error"},
  53  };
  54 -static const int bgp_notify_msg_max = BGP_NOTIFY_MAX;
  55 +BGP_DEBUG_MSG_MAX (bgp_notify_msg);
  56
  57  static const struct message bgp_notify_head_msg[] =
  58  {
  59    { BGP_NOTIFY_HEADER_NOT_SYNC, "/Connection Not Synchronized"},
  60    { BGP_NOTIFY_HEADER_BAD_MESLEN, "/Bad Message Length"},
  61 -  { BGP_NOTIFY_HEADER_BAD_MESTYPE, "/Bad Message Type"}
  62 +  { BGP_NOTIFY_HEADER_BAD_MESTYPE, "/Bad Message Type"},
  63  };
  64 -static const int bgp_notify_head_msg_max = BGP_NOTIFY_HEADER_MAX;
  65 +BGP_DEBUG_MSG_MAX (bgp_notify_head_msg);
  66
  67  static const struct message bgp_notify_open_msg[] =
  68  {
  69 @@ -119,7 +122,7 @@ static const struct message bgp_notify_o
  70    { BGP_NOTIFY_OPEN_UNACEP_HOLDTIME, "/Unacceptable Hold Time"},
  71    { BGP_NOTIFY_OPEN_UNSUP_CAPBL, "/Unsupported Capability"},
  72  };
  73 -static const int bgp_notify_open_msg_max = BGP_NOTIFY_OPEN_MAX;
  74 +BGP_DEBUG_MSG_MAX (bgp_notify_open_msg);
  75
  76  static const struct message bgp_notify_update_msg[] =
  77  {
  78 @@ -136,7 +139,7 @@ static const struct message bgp_notify_u
  79    { BGP_NOTIFY_UPDATE_INVAL_NETWORK, "/Invalid Network Field"},
  80    { BGP_NOTIFY_UPDATE_MAL_AS_PATH, "/Malformed AS_PATH"},
  81  };
  82 -static const int bgp_notify_update_msg_max = BGP_NOTIFY_UPDATE_MAX;
  83 +BGP_DEBUG_MSG_MAX (bgp_notify_update_msg);
  84
  85  static const struct message bgp_notify_cease_msg[] =
  86  {
  87 @@ -150,7 +153,7 @@ static const struct message bgp_notify_c
  88    { BGP_NOTIFY_CEASE_COLLISION_RESOLUTION, "/Connection collision resolution"},
  89    { BGP_NOTIFY_CEASE_OUT_OF_RESOURCE, "/Out of Resource"},
  90  };
  91 -static const int bgp_notify_cease_msg_max = BGP_NOTIFY_CEASE_MAX;
  92 +BGP_DEBUG_MSG_MAX (bgp_notify_cease_msg);
  93
  94  static const struct message bgp_notify_capability_msg[] =
  95  {
  96 @@ -159,7 +162,7 @@ static const struct message bgp_notify_c
  97    { BGP_NOTIFY_CAPABILITY_INVALID_LENGTH, "/Invalid Capability Length"},
  98    { BGP_NOTIFY_CAPABILITY_MALFORMED_CODE, "/Malformed Capability Value"},
  99  };
 100 -static const int bgp_notify_capability_msg_max = BGP_NOTIFY_CAPABILITY_MAX;
 101 +BGP_DEBUG_MSG_MAX (bgp_notify_capability_msg);
 102
 103  /* Origin strings. */
 104  const char *bgp_origin_str[] = {"i","e","?"};