Skip to content

Commit 68ce5e6

Browse files
realsdxrealsdx
authored
Upgrade frr to version 10.5.0 (#15879)
1 parent a11ba1c commit 68ce5e6

9 files changed

Lines changed: 175 additions & 916 deletions

‎SPECS/frr/0001-enable-openssl.patch‎

Lines changed: 42 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,8 @@
1-
diff --git a/lib/subdir.am b/lib/subdir.am
2-
index 0b7af18..0533e24 100644
3-
--- a/lib/subdir.am
4-
+++ b/lib/subdir.am
5-
@@ -41,7 +41,6 @@ lib_libfrr_la_SOURCES = \
6-
lib/log.c \
7-
lib/log_filter.c \
8-
lib/log_vty.c \
9-
- lib/md5.c \
10-
lib/memory.c \
11-
lib/mgmt_be_client.c \
12-
lib/mgmt_fe_client.c \
13-
@@ -64,7 +64,6 @@ lib_libfrr_la_SOURCES = \
14-
lib/routemap_northbound.c \
15-
lib/sbuf.c \
16-
lib/seqlock.c \
17-
- lib/sha256.c \
18-
lib/sigevent.c \
19-
lib/skiplist.c \
20-
lib/sockopt.c \
21-
@@ -170,7 +170,6 @@ pkginclude_HEADERS += \
22-
lib/link_state.h \
23-
lib/log.h \
24-
lib/log_vty.h \
25-
- lib/md5.h \
26-
lib/memory.h \
27-
lib/mgmt.pb-c.h \
28-
lib/mgmt_be_client.h \
29-
@@ -191,7 +190,6 @@ pkginclude_HEADERS += \
30-
lib/route_opaque.h \
31-
lib/sbuf.h \
32-
lib/seqlock.h \
33-
- lib/sha256.h \
34-
lib/sigevent.h \
35-
lib/skiplist.h \
36-
lib/smux.h \
371
diff --git a/isisd/isis_lsp.c b/isisd/isis_lsp.c
38-
index 1991666..2e4fe55 100644
2+
index e3e4916..04118dd 100644
393
--- a/isisd/isis_lsp.c
404
+++ b/isisd/isis_lsp.c
41-
@@ -35,7 +35,9 @@
5+
@@ -22,7 +22,9 @@
426
#include "hash.h"
437
#include "if.h"
448
#include "checksum.h"
@@ -49,10 +13,10 @@ index 1991666..2e4fe55 100644
4913
#include "srcdest_table.h"
5014
#include "lib_errors.h"
5115
diff --git a/isisd/isis_pdu.c b/isisd/isis_pdu.c
52-
index 9c63311..7cf594c 100644
16+
index 1a3142e..7e7aba3 100644
5317
--- a/isisd/isis_pdu.c
5418
+++ b/isisd/isis_pdu.c
55-
@@ -33,7 +33,9 @@
19+
@@ -20,7 +20,9 @@
5620
#include "prefix.h"
5721
#include "if.h"
5822
#include "checksum.h"
@@ -63,10 +27,10 @@ index 9c63311..7cf594c 100644
6327

6428
#include "isisd/isis_constants.h"
6529
diff --git a/isisd/isis_te.c b/isisd/isis_te.c
66-
index 4ea6c2c..72ff0d2 100644
30+
index cf92ae4..91c21b7 100644
6731
--- a/isisd/isis_te.c
6832
+++ b/isisd/isis_te.c
69-
@@ -38,7 +38,9 @@
33+
@@ -24,7 +24,9 @@
7034
#include "if.h"
7135
#include "vrf.h"
7236
#include "checksum.h"
@@ -76,3 +40,39 @@ index 4ea6c2c..72ff0d2 100644
7640
#include "sockunion.h"
7741
#include "network.h"
7842
#include "sbuf.h"
43+
diff --git a/lib/subdir.am b/lib/subdir.am
44+
index 44090e6..a598fe4 100644
45+
--- a/lib/subdir.am
46+
+++ b/lib/subdir.am
47+
@@ -70,7 +70,6 @@ lib_libfrr_la_SOURCES = \
48+
lib/log_filter.c \
49+
lib/log_nb.c \
50+
lib/log_vty.c \
51+
- lib/md5.c \
52+
lib/memory.c \
53+
lib/mgmt_be_client.c \
54+
lib/mgmt_fe_client.c \
55+
@@ -105,7 +104,6 @@ lib_libfrr_la_SOURCES = \
56+
lib/routemap_northbound.c \
57+
lib/sbuf.c \
58+
lib/seqlock.c \
59+
- lib/sha256.c \
60+
lib/sigevent.c \
61+
lib/skiplist.c \
62+
lib/sockopt.c \
63+
@@ -257,7 +255,6 @@ nobase_pkginclude_HEADERS += \
64+
lib/link_state.h \
65+
lib/log.h \
66+
lib/log_vty.h \
67+
- lib/md5.h \
68+
lib/memory.h \
69+
lib/mgmt_be_client.h \
70+
lib/mgmt_defines.h \
71+
@@ -292,7 +289,6 @@ nobase_pkginclude_HEADERS += \
72+
lib/route_opaque.h \
73+
lib/sbuf.h \
74+
lib/seqlock.h \
75+
- lib/sha256.h \
76+
lib/sigevent.h \
77+
lib/skiplist.h \
78+
lib/smux.h \

‎SPECS/frr/0003-fips-mode.patch‎

Lines changed: 88 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,115 +1,147 @@
1+
diff --git a/isisd/isis_circuit.c b/isisd/isis_circuit.c
2+
index 22ef39f..a31ccc5 100644
3+
--- a/isisd/isis_circuit.c
4+
+++ b/isisd/isis_circuit.c
5+
@@ -13,6 +13,10 @@
6+
#include <netinet/if_ether.h>
7+
#endif
8+
9+
+#ifdef CRYPTO_OPENSSL
10+
+#include <openssl/evp.h>
11+
+#endif
12+
+
13+
#include "log.h"
14+
#include "memory.h"
15+
#include "vrf.h"
16+
@@ -1536,6 +1540,10 @@ ferr_r isis_circuit_passwd_set(struct isis_circuit *circuit,
17+
return ferr_code_bug(
18+
"circuit password too long (max 254 chars)");
19+
20+
+
21+
+ //When in FIPS mode, the password never gets set in MD5
22+
+ if((passwd_type == ISIS_PASSWD_TYPE_HMAC_MD5) && EVP_default_properties_is_fips_enabled(NULL))
23+
+ return ferr_cfg_invalid("FIPS mode is enabled, md5 authentication is disabled");
24+
circuit->passwd.len = len;
25+
strlcpy((char *)circuit->passwd.passwd, passwd,
26+
sizeof(circuit->passwd.passwd));
27+
diff --git a/isisd/isisd.c b/isisd/isisd.c
28+
index 78fbbe1..b7cf6fb 100644
29+
--- a/isisd/isisd.c
30+
+++ b/isisd/isisd.c
31+
@@ -9,6 +9,10 @@
32+
33+
#include <zebra.h>
34+
35+
+
36+
+#ifdef CRYPTO_OPENSSL
37+
+#include <openssl/evp.h>
38+
+#endif
39+
#include "frrevent.h"
40+
#include "vty.h"
41+
#include "command.h"
42+
@@ -3087,6 +3091,10 @@ static int isis_area_passwd_set(struct isis_area *area, int level,
43+
if (len > 254)
44+
return -1;
45+
46+
+
47+
+ //When in FIPS mode, the password never get set in MD5
48+
+ if ((passwd_type == ISIS_PASSWD_TYPE_HMAC_MD5) && (EVP_default_properties_is_fips_enabled(NULL)))
49+
+ return ferr_cfg_invalid("FIPS mode is enabled, md5 authentication is disabled");
50+
modified.len = len;
51+
strlcpy((char *)modified.passwd, passwd,
52+
sizeof(modified.passwd));
153
diff --git a/ospfd/ospf_vty.c b/ospfd/ospf_vty.c
2-
index 631465f..e084ff3 100644
54+
index 26b3949..f27e6b6 100644
355
--- a/ospfd/ospf_vty.c
456
+++ b/ospfd/ospf_vty.c
5-
@@ -1136,6 +1136,11 @@ DEFUN (ospf_area_vlink,
57+
@@ -7,6 +7,10 @@
58+
#include <zebra.h>
59+
#include <string.h>
60+
61+
+#ifdef CRYPTO_OPENSSL
62+
+#include <openssl/evp.h>
63+
+#endif
64+
+
65+
#include "printfrr.h"
66+
#include "monotime.h"
67+
#include "memory.h"
68+
@@ -1105,6 +1109,11 @@ DEFUN (ospf_area_vlink,
669
vl_config.keychain = argv[idx+1]->arg;
770
} else if (argv_find(argv, argc, "message-digest", &idx)) {
871
/* authentication message-digest */
9-
+ if(FIPS_mode())
72+
+ if(EVP_default_properties_is_fips_enabled(NULL))
1073
+ {
1174
+ vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
1275
+ return CMD_WARNING_CONFIG_FAILED;
1376
+ }
1477
vl_config.auth_type = OSPF_AUTH_CRYPTOGRAPHIC;
1578
} else if (argv_find(argv, argc, "null", &idx)) {
1679
/* "authentication null" */
17-
@@ -1993,6 +1998,15 @@ DEFUN (ospf_area_authentication_message_digest,
80+
@@ -2024,6 +2033,15 @@ DEFUN (ospf_area_authentication_message_digest,
1881
? OSPF_AUTH_NULL
1982
: OSPF_AUTH_CRYPTOGRAPHIC;
2083

84+
+
2185
+ if(area->auth_type == OSPF_AUTH_CRYPTOGRAPHIC)
2286
+ {
23-
+ if(FIPS_mode())
87+
+ if(EVP_default_properties_is_fips_enabled(NULL))
2488
+ {
2589
+ vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
2690
+ return CMD_WARNING_CONFIG_FAILED;
2791
+ }
2892
+ }
29-
+
3093
return CMD_SUCCESS;
3194
}
3295

33-
@@ -6665,6 +6679,11 @@ DEFUN (ip_ospf_authentication_args,
96+
@@ -7446,6 +7464,11 @@ DEFUN (ip_ospf_authentication_args,
3497

3598
/* Handle message-digest authentication */
3699
if (argv[idx_encryption]->arg[0] == 'm') {
37-
+ if(FIPS_mode())
100+
+ if(EVP_default_properties_is_fips_enabled(NULL))
38101
+ {
39102
+ vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
40103
+ return CMD_WARNING_CONFIG_FAILED;
41104
+ }
42105
SET_IF_PARAM(params, auth_type);
43106
params->auth_type = OSPF_AUTH_CRYPTOGRAPHIC;
44107
UNSET_IF_PARAM(params, keychain_name);
45-
@@ -6971,6 +6990,11 @@ DEFUN (ip_ospf_message_digest_key,
108+
@@ -7776,6 +7799,11 @@ DEFUN (ip_ospf_message_digest_key,
46109
"The OSPF password (key)\n"
47110
"Address of interface\n")
48111
{
49-
+ if(FIPS_mode())
112+
+ if(EVP_default_properties_is_fips_enabled(NULL))
50113
+ {
51114
+ vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
52115
+ return CMD_WARNING_CONFIG_FAILED;
53116
+ }
54117
VTY_DECLVAR_CONTEXT(interface, ifp);
55118
struct crypt_key *ck;
56119
uint8_t key_id;
57-
diff --git a/isisd/isis_circuit.c b/isisd/isis_circuit.c
58-
index 81b4b39..cce33d9 100644
59-
--- a/isisd/isis_circuit.c
60-
+++ b/isisd/isis_circuit.c
61-
@@ -1318,6 +1318,10 @@ static int isis_circuit_passwd_set(struct isis_circuit *circuit,
62-
return ferr_code_bug(
63-
"circuit password too long (max 254 chars)");
64-
65-
+ //When in FIPS mode, the password never gets set in MD5
66-
+ if((passwd_type == ISIS_PASSWD_TYPE_HMAC_MD5) && FIPS_mode())
67-
+ return ferr_cfg_invalid("FIPS mode is enabled, md5 authentication is disabled");
68-
+
69-
circuit->passwd.len = len;
70-
strlcpy((char *)circuit->passwd.passwd, passwd,
71-
sizeof(circuit->passwd.passwd));
72-
diff --git a/isisd/isisd.c b/isisd/isisd.c
73-
index 419127c..a6c36af 100644
74-
--- a/isisd/isisd.c
75-
+++ b/isisd/isisd.c
76-
@@ -1638,6 +1638,10 @@ static int isis_area_passwd_set(struct isis_area *area, int level,
77-
if (len > 254)
78-
return -1;
79-
80-
+ //When in FIPS mode, the password never get set in MD5
81-
+ if ((passwd_type == ISIS_PASSWD_TYPE_HMAC_MD5) && (FIPS_mode()))
82-
+ return ferr_cfg_invalid("FIPS mode is enabled, md5 authentication is disabled");
83-
+
84-
modified.len = len;
85-
strlcpy((char *)modified.passwd, passwd,
86-
sizeof(modified.passwd));
87120
diff --git a/ripd/rip_cli.c b/ripd/rip_cli.c
88-
index 5bb81ef..02a09ef 100644
121+
index 7540f98..a010b64 100644
89122
--- a/ripd/rip_cli.c
90123
+++ b/ripd/rip_cli.c
91-
@@ -796,6 +796,12 @@ DEFPY (ip_rip_authentication_mode,
124+
@@ -7,6 +7,10 @@
125+
126+
#include <zebra.h>
127+
128+
+
129+
+#ifdef CRYPTO_OPENSSL
130+
+#include <openssl/evp.h>
131+
+#endif
132+
#include "if.h"
133+
#include "if_rmap.h"
134+
#include "vrf.h"
135+
@@ -903,6 +907,12 @@ DEFPY_YANG (ip_rip_authentication_mode,
92136
value = "20";
93137
}
94138

95-
+ if(strmatch(mode, "md5") && FIPS_mode())
139+
+
140+
+ if(strmatch(mode, "md5") && EVP_default_properties_is_fips_enabled(NULL))
96141
+ {
97142
+ vty_out(vty, "FIPS mode is enabled, md5 authentication id disabled\n");
98143
+ return CMD_WARNING_CONFIG_FAILED;
99144
+ }
100-
+
101145
nb_cli_enqueue_change(vty, "./authentication-scheme/mode", NB_OP_MODIFY,
102146
strmatch(mode, "md5") ? "md5" : "plain-text");
103147
if (strmatch(mode, "md5"))
104-
diff --git a/lib/zebra.h b/lib/zebra.h
105-
index 53ae5b4..930307f 100644
106-
--- a/lib/zebra.h
107-
+++ b/lib/zebra.h
108-
@@ -114,6 +114,7 @@
109-
#ifdef CRYPTO_OPENSSL
110-
#include <openssl/evp.h>
111-
#include <openssl/hmac.h>
112-
+#include <openssl/fips.h>
113-
#endif
114-
115-
#include "openbsd-tree.h"

‎SPECS/frr/0004-remove-grpc-test.patch‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
diff --git a/tests/lib/subdir.am b/tests/lib/subdir.am
2-
index 7b5eaa4..5c82f69 100644
2+
index ca74306..9b0980f 100644
33
--- a/tests/lib/subdir.am
44
+++ b/tests/lib/subdir.am
5-
@@ -18,18 +18,6 @@ tests_lib_test_frrscript_SOURCES = tests/lib/test_frrscript.c
6-
test -e tests/lib/script1.lua || \
5+
@@ -25,20 +25,6 @@ copy_script: tests/lib/script1.lua
76
$(INSTALL_SCRIPT) $< tests/lib/script1.lua
87

9-
-##############################################################################
10-
-GRPC_TESTS_LDADD = staticd/libstatic.a grpc/libfrrgrpc_pb.la -lgrpc++ -lprotobuf $(ALL_TESTS_LDADD) $(LIBYANG_LIBS) -lm
8+
##############################################################################
9+
-GRPC_TESTS_LDADD = mgmtd/libmgmt_be_nb.la staticd/libstatic.a grpc/libfrrgrpc_pb.la $(GRPC_LIBS) $(ALL_TESTS_LDADD) $(LIBYANG_LIBS) -lm
1110
-
1211
-if GRPC
1312
-check_PROGRAMS += tests/lib/test_grpc
@@ -16,8 +15,11 @@ index 7b5eaa4..5c82f69 100644
1615
-tests_lib_test_grpc_CPPFLAGS = $(TESTS_CPPFLAGS)
1716
-tests_lib_test_grpc_LDADD = $(GRPC_TESTS_LDADD)
1817
-tests_lib_test_grpc_SOURCES = tests/lib/test_grpc.cpp
18+
-nodist_tests_lib_test_grpc_SOURCES = \
19+
- yang/frr-bfdd.yang.c \
20+
- yang/frr-staticd.yang.c \
21+
- # end
1922
-
20-
-
23+
2124
##############################################################################
2225
if ZEROMQ
23-
check_PROGRAMS += tests/lib/test_zmq

‎SPECS/frr/CVE-2024-44070.patch‎

Lines changed: 0 additions & 48 deletions
This file was deleted.

0 commit comments

Comments
 (0)