The following patches are pulled directly from the GIT repository 

for the quagga community. They fix the following CVEs:

CVE-2012-0249

CVE-2012-0250

CVE-2012-0255

All of the patched CVEs are included in Quagga 0.99.20.1. This patch

file can be removed if Quagga is upgraded to that version.

From 5861739f8c38bc36ea9955e5cb2be2bf2f482d70 Mon Sep 17 00:00:00 2001

From: Paul Jakma <[email protected]>

Date: Mon, 09 Jan 2012 20:59:26 +0000

Subject: bgpd: Open option parse errors don't NOTIFY, resulting in abort & DoS

* bgp_packet.c: (bgp_open_receive) Errors from bgp_open_option_parse are

  detected, and the code will stop processing the OPEN and return.  However

  it does so without calling bgp_notify_send to send a NOTIFY - which means

  the peer FSM doesn't get stopped, and bgp_read will be called again later.

  Because it returns, it doesn't go through the code near the end of the

  function that removes the current message from the peer input streaam.

  Thus the next call to bgp_read will try to parse a half-parsed stream as

  if it were a new BGP message, leading to an assert later in the code when

  it tries to read stuff that isn't there. Add the required call to

  bgp_notify_send before returning.

* bgp_open.c: (bgp_capability_as4) Be a bit stricter, check the length field

  corresponds to the only value it can be, which is the amount we're going to

  read off the stream. And make sure the capability flag gets set, so

  callers can know this capability was read, regardless.

  (peek_for_as4_capability) Let bgp_capability_as4 do the length check.

---

diff --git bgpd/bgp_open.c bgpd/bgp_open.c

index 82deb3d..b5b50bb 100644

--- bgpd/bgp_open.c

+++ bgpd/bgp_open.c

@@ -421,13 +421,20 @@ bgp_capability_restart (struct peer *peer, struct capability_header *caphdr)

 static as_t

 bgp_capability_as4 (struct peer *peer, struct capability_header *hdr)

 {

+  SET_FLAG (peer->cap, PEER_CAP_AS4_RCV);

+  

+  if (hdr->length != CAPABILITY_CODE_AS4_LEN)

+    {

+      zlog_err ("%s AS4 capability has incorrect data length %d",

+                peer->host, hdr->length);

+      return 0;

+    }

+  

   as_t as4 = stream_getl (BGP_INPUT(peer));

   if (BGP_DEBUG (as4, AS4))

     zlog_debug ("%s [AS4] about to set cap PEER_CAP_AS4_RCV, got as4 %u",

                 peer->host, as4);

-  SET_FLAG (peer->cap, PEER_CAP_AS4_RCV);

-  

   return as4;

 }

@@ -689,9 +696,6 @@ peek_for_as4_capability (struct peer *peer, u_char length)

 	      if (hdr.code == CAPABILITY_CODE_AS4)

 	        {

-	          if (hdr.length != CAPABILITY_CODE_AS4_LEN)

-	            goto end;

-                  

 	          if (BGP_DEBUG (as4, AS4))

 	            zlog_info ("[AS4] found AS4 capability, about to parse");

 	          as4 = bgp_capability_as4 (peer, &hdr);

diff --git bgpd/bgp_packet.c bgpd/bgp_packet.c

index f5a74d1..5d8087a 100644

--- bgpd/bgp_packet.c

+++ bgpd/bgp_packet.c

@@ -1459,9 +1459,13 @@ bgp_open_receive (struct peer *peer, bgp_size_t size)

   /* Open option part parse. */

   if (optlen != 0) 

     {

-      ret = bgp_open_option_parse (peer, optlen, &capability);

-      if (ret < 0)

-	return ret;

+      if ((ret = bgp_open_option_parse (peer, optlen, &capability)) < 0)

+        {

+          bgp_notify_send (peer,

+                 BGP_NOTIFY_OPEN_ERR,

+                 BGP_NOTIFY_OPEN_UNACEP_HOLDTIME);

+	  return ret;

+        }

     }

   else

     {

--

cgit v0.9.0.2

From 393b2d64dc0625ba8e01e9e1516efac06d13072e Mon Sep 17 00:00:00 2001

From: Denis Ovsienko <[email protected]>

Date: Sun, 15 Jan 2012 15:12:19 +0000

Subject: ospfd: use LOOKUP() for ospf_packet_type_str

* ospf_packet.h: add proper str/max extern declarations

* ospf_packet.c

  * ospf_packet_type_str: rewrite in "struct message", add max value

  * ospf_packet_add(): use LOOKUP()

  * ospf_write(): ditto

  * ospf_hello(): ditto

  * ospf_read(): ditto

* ospf_dump.h: the declaration does not belong here

* ospf_dump.c

  * ospf_header_dump(): use LOOKUP()

  * show_debugging_ospf(): ditto

---

diff --git ospfd/ospf_dump.c ospfd/ospf_dump.c

index e65b2e3..8ace095 100644

--- ospfd/ospf_dump.c

+++ ospfd/ospf_dump.c

@@ -661,7 +661,7 @@ ospf_header_dump (struct ospf_header *ospfh)

   zlog_debug ("Header");

   zlog_debug ("  Version %d", ospfh->version);

   zlog_debug ("  Type %d (%s)", ospfh->type,

-	     ospf_packet_type_str[ospfh->type]);

+	     LOOKUP (ospf_packet_type_str, ospfh->type));

   zlog_debug ("  Packet Len %d", ntohs (ospfh->length));

   zlog_debug ("  Router ID %s", inet_ntoa (ospfh->router_id));

   zlog_debug ("  Area ID %s", inet_ntoa (ospfh->area_id));

@@ -1457,7 +1457,7 @@ DEFUN (show_debugging_ospf,

     if (IS_DEBUG_OSPF_PACKET (i, SEND) && IS_DEBUG_OSPF_PACKET (i, RECV))

       {

 	vty_out (vty, "  OSPF packet %s%s debugging is on%s",

-		 ospf_packet_type_str[i + 1],

+		 LOOKUP (ospf_packet_type_str, i + 1),

 		 IS_DEBUG_OSPF_PACKET (i, DETAIL) ? " detail" : "",

 		 VTY_NEWLINE);

       }

@@ -1465,12 +1465,12 @@ DEFUN (show_debugging_ospf,

       {

 	if (IS_DEBUG_OSPF_PACKET (i, SEND))

 	  vty_out (vty, "  OSPF packet %s send%s debugging is on%s",

-		   ospf_packet_type_str[i + 1],

+		   LOOKUP (ospf_packet_type_str, i + 1),

 		   IS_DEBUG_OSPF_PACKET (i, DETAIL) ? " detail" : "",

 		   VTY_NEWLINE);

 	if (IS_DEBUG_OSPF_PACKET (i, RECV))

 	  vty_out (vty, "  OSPF packet %s receive%s debugging is on%s",

-		   ospf_packet_type_str[i + 1],

+		   LOOKUP (ospf_packet_type_str, i + 1),

 		   IS_DEBUG_OSPF_PACKET (i, DETAIL) ? " detail" : "",

 		   VTY_NEWLINE);

       }

diff --git ospfd/ospf_dump.h ospfd/ospf_dump.h

index fb81371..455214f 100644

--- ospfd/ospf_dump.h

+++ ospfd/ospf_dump.h

@@ -121,7 +121,6 @@ extern unsigned long term_debug_ospf_zebra;

 extern unsigned long term_debug_ospf_nssa;

 /* Message Strings. */

-extern const char *ospf_packet_type_str[];

 extern char *ospf_lsa_type_str[];

 /* Prototypes. */

diff --git ospfd/ospf_packet.c ospfd/ospf_packet.c

index 0f338d3..03e6d2a 100644

--- ospfd/ospf_packet.c

+++ ospfd/ospf_packet.c

@@ -50,15 +50,16 @@

 #include "ospfd/ospf_dump.h"

 /* Packet Type String. */

-const char *ospf_packet_type_str[] =

-{

-  "unknown",

-  "Hello",

-  "Database Description",

-  "Link State Request",

-  "Link State Update",

-  "Link State Acknowledgment",

+const struct message ospf_packet_type_str[] =

+{

+  { OSPF_MSG_HELLO,   "Hello"                     },

+  { OSPF_MSG_DB_DESC, "Database Description"      },

+  { OSPF_MSG_LS_REQ,  "Link State Request"        },

+  { OSPF_MSG_LS_UPD,  "Link State Update"         },

+  { OSPF_MSG_LS_ACK,  "Link State Acknowledgment" },

 };

+const size_t ospf_packet_type_str_max = sizeof (ospf_packet_type_str) /

+  sizeof (ospf_packet_type_str[0]);

 /* OSPF authentication checking function */

 static int

@@ -201,7 +202,7 @@ ospf_packet_add (struct ospf_interface *oi, struct ospf_packet *op)

 	       "destination %s) called with NULL obuf, ignoring "

 	       "(please report this bug)!\n",

 	       IF_NAME(oi), oi->state, LOOKUP (ospf_ism_state_msg, oi->state),

-	       ospf_packet_type_str[stream_getc_from(op->s, 1)],

+	       LOOKUP (ospf_packet_type_str, stream_getc_from(op->s, 1)),

 	       inet_ntoa (op->dst));

       return;

     }

@@ -755,7 +756,7 @@ ospf_write (struct thread *thread)

 	}

       zlog_debug ("%s sent to [%s] via [%s].",

-		 ospf_packet_type_str[type], inet_ntoa (op->dst),

+		 LOOKUP (ospf_packet_type_str, type), inet_ntoa (op->dst),

 		 IF_NAME (oi));

       if (IS_DEBUG_OSPF_PACKET (type - 1, DETAIL))

@@ -801,7 +802,7 @@ ospf_hello (struct ip *iph, struct ospf_header *ospfh,

         {

           zlog_debug ("ospf_header[%s/%s]: selforiginated, "

                      "dropping.",

-                     ospf_packet_type_str[ospfh->type],

+                     LOOKUP (ospf_packet_type_str, ospfh->type),

                      inet_ntoa (iph->ip_src));

         }

       return;

@@ -2571,7 +2572,7 @@ ospf_read (struct thread *thread)

         }

       zlog_debug ("%s received from [%s] via [%s]",

-                 ospf_packet_type_str[ospfh->type],

+                 LOOKUP (ospf_packet_type_str, ospfh->type),

                  inet_ntoa (ospfh->router_id), IF_NAME (oi));

       zlog_debug (" src [%s],", inet_ntoa (iph->ip_src));

       zlog_debug (" dst [%s]", inet_ntoa (iph->ip_dst));

diff --git ospfd/ospf_packet.h ospfd/ospf_packet.h

index 9a47208..2115f11 100644

--- ospfd/ospf_packet.h

+++ ospfd/ospf_packet.h

@@ -163,4 +163,7 @@ extern int ospf_ls_ack_timer (struct thread *);

 extern int ospf_poll_timer (struct thread *);

 extern int ospf_hello_reply_timer (struct thread *);

+extern const struct message ospf_packet_type_str[];

+extern const size_t ospf_packet_type_str_max;

+

 #endif /* _ZEBRA_OSPF_PACKET_H */

--

cgit v0.9.0.2

From 099ed6744881e71957f2bfeebc4c0727714d2394 Mon Sep 17 00:00:00 2001

From: Denis Ovsienko <[email protected]>

Date: Fri, 20 Jan 2012 18:32:10 +0000

Subject: ospfd: fix ospf_packet_add_top() to use LOOKUP()

---

diff --git ospfd/ospf_packet.c ospfd/ospf_packet.c

index 03e6d2a..500f245 100644

--- ospfd/ospf_packet.c

+++ ospfd/ospf_packet.c

@@ -223,7 +223,7 @@ ospf_packet_add_top (struct ospf_interface *oi, struct ospf_packet *op)

 	       "destination %s) called with NULL obuf, ignoring "

 	       "(please report this bug)!\n",

 	       IF_NAME(oi), oi->state, LOOKUP (ospf_ism_state_msg, oi->state),

-	       ospf_packet_type_str[stream_getc_from(op->s, 1)],

+	       LOOKUP (ospf_packet_type_str, stream_getc_from(op->s, 1)),

 	       inet_ntoa (op->dst));

       return;

     }

--

cgit v0.9.0.2

From 3092cd57fb44c8293995d013bd86937d1a91745f Mon Sep 17 00:00:00 2001

From: Denis Ovsienko <[email protected]>

Date: Mon, 30 Jan 2012 11:41:39 +0000

Subject: ospfd: introduce ospf_packet_minlen[] (BZ#705)

This commit ports some of the OSPFv3 packet reception checks

to OSPFv2.

* ospf_packet.c

  * ospf_packet_minlen[]: a direct equivalent of ospf6_packet_minlen[]

  * ospf_packet_examin(): new function designed after the first part

    of ospf6_packet_examin()

  * ospf_read(): verify received packet with ospf_packet_examin()

* ospf_packet.h: add convenience macros

---

diff --git ospfd/ospf_packet.c ospfd/ospf_packet.c

index 500f245..f425da8 100644

--- ospfd/ospf_packet.c

+++ ospfd/ospf_packet.c

@@ -61,6 +61,18 @@ const struct message ospf_packet_type_str[] =

 const size_t ospf_packet_type_str_max = sizeof (ospf_packet_type_str) /

   sizeof (ospf_packet_type_str[0]);

+/* Minimum (besides OSPF_HEADER_SIZE) lengths for OSPF packets of

+   particular types, offset is the "type" field of a packet. */

+static const u_int16_t ospf_packet_minlen[] =

+{

+  0,

+  OSPF_HELLO_MIN_SIZE,

+  OSPF_DB_DESC_MIN_SIZE,

+  OSPF_LS_REQ_MIN_SIZE,

+  OSPF_LS_UPD_MIN_SIZE,

+  OSPF_LS_ACK_MIN_SIZE,

+};

+

 /* OSPF authentication checking function */

 static int

 ospf_auth_type (struct ospf_interface *oi)

@@ -2309,6 +2321,47 @@ ospf_check_sum (struct ospf_header *ospfh)

   return 1;

 }

+/* Verify a complete OSPF packet for proper sizing/alignment. */

+static unsigned

+ospf_packet_examin (struct ospf_header * oh, const unsigned bytesonwire)

+{

+  u_int16_t bytesdeclared;

+

+  /* Length, 1st approximation. */

+  if (bytesonwire < OSPF_HEADER_SIZE)

+  {

+    if (IS_DEBUG_OSPF_PACKET (0, RECV))

+      zlog_debug ("%s: undersized (%u B) packet", __func__, bytesonwire);

+    return MSG_NG;

+  }

+  /* Now it is safe to access header fields. Performing length check, allow

+   * for possible extra bytes of crypto auth/padding, which are not counted

+   * in the OSPF header "length" field. */

+  bytesdeclared = ntohs (oh->length);

+  if (bytesdeclared > bytesonwire)

+  {

+    if (IS_DEBUG_OSPF_PACKET (0, RECV))

+      zlog_debug ("%s: packet length error (%u real, %u declared)",

+                  __func__, bytesonwire, bytesdeclared);

+    return MSG_NG;

+  }

+  /* Length, 2nd approximation. The type-specific constraint is checked

+     against declared length, not amount of bytes on wire. */

+  if

+  (

+    oh->type >= OSPF_MSG_HELLO &&

+    oh->type <= OSPF_MSG_LS_ACK &&

+    bytesdeclared < OSPF_HEADER_SIZE + ospf_packet_minlen[oh->type]

+  )

+  {

+    if (IS_DEBUG_OSPF_PACKET (0, RECV))

+      zlog_debug ("%s: undersized (%u B) %s packet", __func__,

+                  bytesdeclared, LOOKUP (ospf_packet_type_str, oh->type));

+    return MSG_NG;

+  }

+  return MSG_OK;

+}

+

 /* OSPF Header verification. */

 static int

 ospf_verify_header (struct stream *ibuf, struct ospf_interface *oi,

@@ -2404,10 +2457,10 @@ ospf_read (struct thread *thread)

   /* prepare for next packet. */

   ospf->t_read = thread_add_read (master, ospf_read, ospf, ospf->fd);

-  /* read OSPF packet. */

   stream_reset(ospf->ibuf);

   if (!(ibuf = ospf_recv_packet (ospf->fd, &ifp, ospf->ibuf)))

     return -1;

+  /* This raw packet is known to be at least as big as its IP header. */

   /* Note that there should not be alignment problems with this assignment

      because this is at the beginning of the stream data buffer. */

@@ -2442,16 +2495,10 @@ ospf_read (struct thread *thread)

      by ospf_recv_packet() to be correct). */

   stream_forward_getp (ibuf, iph->ip_hl * 4);

-  /* Make sure the OSPF header is really there. */

-  if (stream_get_endp (ibuf) - stream_get_getp (ibuf) < OSPF_HEADER_SIZE)

-  {

-    zlog_debug ("ospf_read: ignored OSPF packet with undersized (%u bytes) header",

-                stream_get_endp (ibuf) - stream_get_getp (ibuf));

+  ospfh = (struct ospf_header *) STREAM_PNT (ibuf);

+  if (MSG_OK != ospf_packet_examin (ospfh, stream_get_endp (ibuf) - stream_get_getp (ibuf)))

     return -1;

-  }

-

   /* Now it is safe to access all fields of OSPF packet header. */

-  ospfh = (struct ospf_header *) STREAM_PNT (ibuf);

   /* associate packet with ospf interface */

   oi = ospf_if_lookup_recv_if (ospf, iph->ip_src, ifp);

diff --git ospfd/ospf_packet.h ospfd/ospf_packet.h

index 2115f11..3cbe889 100644

--- ospfd/ospf_packet.h

+++ ospfd/ospf_packet.h

@@ -46,6 +46,10 @@

 #define OSPF_HELLO_REPLY_DELAY          1

+/* Return values of functions involved in packet verification, see ospf6d. */

+#define MSG_OK    0

+#define MSG_NG    1

+

 struct ospf_packet

 {

   struct ospf_packet *next;

--

cgit v0.9.0.2

From 3779a3bf9d27b3cccda7e45223884257af362c28 Mon Sep 17 00:00:00 2001

From: Denis Ovsienko <[email protected]>

Date: Mon, 30 Jan 2012 12:07:18 +0000

Subject: ospfd: review ospf_check_auth()

1. The only purpose of "ibuf" argument was to get stream size, which

was always equal to OSPF_MAX_PACKET_SIZE + 1, exactly as initialized

in ospf_new().

2. Fix the packet size check condition, which was incorrect for very

large packets, at least in theory.

---

diff --git ospfd/ospf_packet.c ospfd/ospf_packet.c

index f425da8..a71cc99 100644

--- ospfd/ospf_packet.c

+++ ospfd/ospf_packet.c

@@ -2255,8 +2255,7 @@ ospf_check_network_mask (struct ospf_interface *oi, struct in_addr ip_src)

 }

 static int

-ospf_check_auth (struct ospf_interface *oi, struct stream *ibuf,

-		 struct ospf_header *ospfh)

+ospf_check_auth (struct ospf_interface *oi, struct ospf_header *ospfh)

 {

   int ret = 0;

   struct crypt_key *ck;

@@ -2282,7 +2281,7 @@ ospf_check_auth (struct ospf_interface *oi, struct stream *ibuf,

       /* This is very basic, the digest processing is elsewhere */

       if (ospfh->u.crypt.auth_data_len == OSPF_AUTH_MD5_SIZE && 

           ospfh->u.crypt.key_id == ck->key_id &&

-          ntohs (ospfh->length) + OSPF_AUTH_SIMPLE_SIZE <= stream_get_size (ibuf))

+          ntohs (ospfh->length) + OSPF_AUTH_MD5_SIZE <= OSPF_MAX_PACKET_SIZE)

         ret = 1;

       else

         ret = 0;

@@ -2406,7 +2405,7 @@ ospf_verify_header (struct stream *ibuf, struct ospf_interface *oi,

       return -1;

     }

-  if (! ospf_check_auth (oi, ibuf, ospfh))

+  if (! ospf_check_auth (oi, ospfh))

     {

       zlog_warn ("interface %s: ospf_read authentication failed.",

 		 IF_NAME (oi));

--

cgit v0.9.0.2

From 7edfc01207f3eee8f26d5c22cfef7c7f030c52ce Mon Sep 17 00:00:00 2001

From: Denis Ovsienko <[email protected]>

Date: Mon, 30 Jan 2012 16:32:39 +0000

Subject: ospfd: review ospf_check_md5_digest()

Rewrite some pointer arithmetics without the additional variables and

move byte order conversion inside the function.

---

diff --git ospfd/ospf_packet.c ospfd/ospf_packet.c

index a71cc99..5704f9d 100644

--- ospfd/ospf_packet.c

+++ ospfd/ospf_packet.c

@@ -304,24 +304,14 @@ ospf_packet_max (struct ospf_interface *oi)

 static int

-ospf_check_md5_digest (struct ospf_interface *oi, struct stream *s,

-                       u_int16_t length)

+ospf_check_md5_digest (struct ospf_interface *oi, struct ospf_header *ospfh)

 {

-  unsigned char *ibuf;

   MD5_CTX ctx;

   unsigned char digest[OSPF_AUTH_MD5_SIZE];

-  unsigned char *pdigest;

   struct crypt_key *ck;

-  struct ospf_header *ospfh;

   struct ospf_neighbor *nbr;

+  u_int16_t length = ntohs (ospfh->length);

-

-  ibuf = STREAM_PNT (s);

-  ospfh = (struct ospf_header *) ibuf;

-

-  /* Get pointer to the end of the packet. */

-  pdigest = ibuf + length;

-

   /* Get secret key. */

   ck = ospf_crypt_key_lookup (OSPF_IF_PARAM (oi, auth_crypt),

 			      ospfh->u.crypt.key_id);

@@ -347,12 +337,12 @@ ospf_check_md5_digest (struct ospf_interface *oi, struct stream *s,

   /* Generate a digest for the ospf packet - their digest + our digest. */

   memset(&ctx, 0, sizeof(ctx));

   MD5Init(&ctx);

-  MD5Update(&ctx, ibuf, length);

+  MD5Update(&ctx, ospfh, length);

   MD5Update(&ctx, ck->auth_key, OSPF_AUTH_MD5_SIZE);

   MD5Final(digest, &ctx);

   /* compare the two */

-  if (memcmp (pdigest, digest, OSPF_AUTH_MD5_SIZE))

+  if (memcmp ((caddr_t)ospfh + length, digest, OSPF_AUTH_MD5_SIZE))

     {

       zlog_warn ("interface %s: ospf_check_md5 checksum mismatch",

 		 IF_NAME (oi));

@@ -2426,7 +2416,7 @@ ospf_verify_header (struct stream *ibuf, struct ospf_interface *oi,

     {

       if (ospfh->checksum != 0)

 	return -1;

-      if (ospf_check_md5_digest (oi, ibuf, ntohs (ospfh->length)) == 0)

+      if (ospf_check_md5_digest (oi, ospfh) == 0)

 	{

 	  zlog_warn ("interface %s: ospf_read md5 authentication failed.",

 		     IF_NAME (oi));

--

cgit v0.9.0.2

From fba10fc38f482c617fdfbb81b8d855df56eeda51 Mon Sep 17 00:00:00 2001

From: Denis Ovsienko <[email protected]>

Date: Fri, 17 Feb 2012 12:20:50 +0000

Subject: ospfd: introduce ospf_lsa_minlen[] (BZ#705)

This commit ports more packet checks to OSPFv2, in particular, LSA size

verification and Router-LSA link blocks verification.

* ospf_lsa.h: add LSA size macros

* ospf_packet.h: add struct ospf_ls_update

* ospf_packet.c

  * ospf_lsa_minlen[]: a direct equivalent of ospf6_lsa_minlen[]

  * ospf_router_lsa_links_examin(): new function, verifies trailing

    part of a Router-LSA

  * ospf_lsa_examin(): new function like ospf6_lsa_examin()

  * ospf_lsaseq_examin(): new function like ospf6_lsaseq_examin()

  * ospf_packet_examin(): add type-specific deeper level checks

---

diff --git ospfd/ospf_lsa.h ospfd/ospf_lsa.h

index bf3b083..ca0653c 100644

--- ospfd/ospf_lsa.h

+++ ospfd/ospf_lsa.h

@@ -153,6 +153,7 @@ struct router_lsa_link

 };