Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

zebra: fix table heap-after-free crash #16614

Open
wants to merge 8 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions lib/zclient.c
Original file line number Diff line number Diff line change
Expand Up @@ -1236,6 +1236,8 @@ int zapi_route_encode(uint8_t cmd, struct stream *s, struct zapi_route *api)
stream_putc(s, api->type);

stream_putw(s, api->instance);
if (CHECK_FLAG(api->message, ZAPI_MESSAGE_TABLEID))
SET_FLAG(api->flags, ZEBRA_FLAG_TABLEID);
stream_putl(s, api->flags);
stream_putl(s, api->message);

Expand Down Expand Up @@ -1295,6 +1297,8 @@ int zapi_route_encode(uint8_t cmd, struct stream *s, struct zapi_route *api)
return -1;
}

if (CHECK_FLAG(api->message, ZAPI_MESSAGE_TABLEID))
SET_FLAG(api->flags, ZEBRA_FLAG_TABLEID);
if (zapi_nexthop_encode(s, api_nh, api->flags,
api->message)
!= 0)
Expand Down Expand Up @@ -1334,6 +1338,9 @@ int zapi_route_encode(uint8_t cmd, struct stream *s, struct zapi_route *api)
return -1;
}

if (CHECK_FLAG(api->message, ZAPI_MESSAGE_TABLEID))
SET_FLAG(api->flags, ZEBRA_FLAG_TABLEID);

if (zapi_nexthop_encode(s, api_nh, api->flags,
api->message)
!= 0)
Expand Down
6 changes: 6 additions & 0 deletions lib/zclient.h
Original file line number Diff line number Diff line change
Expand Up @@ -563,6 +563,12 @@ struct zapi_route {
* kernel (NLM_F_APPEND at the very least )
*/
#define ZEBRA_FLAG_OUTOFSYNC 0x400
/*
* This flag lets us know that the route entry is
* associated to the table ID and must remain when the
* table ID is de-associated from a VRF.
*/
#define ZEBRA_FLAG_TABLEID 0x800

/* The older XXX_MESSAGE flags live here */
uint32_t message;
Expand Down
8 changes: 4 additions & 4 deletions tests/topotests/zebra_rib/r1/import_mrib_table_2.json
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -97,7 +97,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -126,7 +126,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -155,7 +155,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down
10 changes: 5 additions & 5 deletions tests/topotests/zebra_rib/r1/import_mrib_table_3.json
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -97,7 +97,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -126,7 +126,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -155,7 +155,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -238,7 +238,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down
8 changes: 4 additions & 4 deletions tests/topotests/zebra_rib/r1/import_mrib_table_4.json
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -97,7 +97,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -126,7 +126,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -155,7 +155,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down
8 changes: 4 additions & 4 deletions tests/topotests/zebra_rib/r1/import_table_2.json
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -97,7 +97,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -126,7 +126,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -155,7 +155,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down
10 changes: 5 additions & 5 deletions tests/topotests/zebra_rib/r1/import_table_3.json
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -97,7 +97,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -126,7 +126,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -155,7 +155,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -238,7 +238,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down
8 changes: 4 additions & 4 deletions tests/topotests/zebra_rib/r1/import_table_4.json
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -97,7 +97,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -126,7 +126,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down Expand Up @@ -155,7 +155,7 @@
"installed": true,
"table": 254,
"internalStatus": 16,
"internalFlags": 9,
"internalFlags": 2057,
"nexthops": [
{
"flags": 3,
Expand Down
54 changes: 54 additions & 0 deletions tests/topotests/zebra_rib/r1/v4_route_table_1_no_vrf.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
{
"0.0.0.0/0": [
{
"protocol": "kernel",
"vrfName": "default",
"installed": true,
"table": 1,
"nexthops": [
{
"fib": true,
"unreachable": true,
"blackhole": true,
"active": true
}
]
}
],
"10.0.0.0/24": [
{
"protocol": "static",
"vrfName": "default",
"installed": true,
"table": 1,
"nexthops": [
{
"fib": true,
"unreachable": true,
"blackhole": true,
"active": true
}
]
}
],
"10.1.0.0/24": [
{
"protocol": "static",
"vrfName": "default",
"installed": true,
"table": 1,
"nexthops": [
{
"fib": true,
"ip": "192.168.211.254",
"interfaceName": "r1-eth1",
"active": true
}
]
}
],
"10.2.0.0/24": null,
"10.3.0.0/24": null,
"192.168.210.0/24": null,
"192.168.210.1/32": null
}
3 changes: 3 additions & 0 deletions tests/topotests/zebra_rib/r1/v4_route_table_1_no_vrf.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
blackhole default
blackhole 10.0.0.0/24 proto XXXX metric 20
10.1.0.0/24 via 192.168.211.254 dev r1-eth1 proto XXXX metric 20
Loading
Loading