Summary of Changes:
*:
- Fix overflow in comparator functions used by sorted containers
bfdd:
- Avoid close(-1) in bfd_dplane_finish_late
bgpd:
- Allow GR-helper stale paths through the evaluate_paths peer-down skip
- Fix crash when 'debug bgp updates out' enabled
- Fix self nexthop overwrite in unnumbered interfaces setup
- Fix route-map use count for EVPN no advertise
- Fix RD route_node refcount leak in bgp_safi_node_lookup()
- Fix link-bandwidth AS truncation for extended encoding
- Fix BAD_COPY_PASTE in bgp_path_info_cmp()
- Check against NULL for bgp_evpn when handling VNI from Zebra
- Make sure we do bgp_dest_unlock_node() after bgp_process()
- Fix link-bandwidth extended community handling above ~34 Gbps
- Fix crash for `no neighbor X path-attribute discard ...`
- Add boundary checks when parsing sub-sub TLVs for srv6 prefix sid
- Preserve disable_ieee_floating on link-bandwidth extended communities
- Reject malformed NHC attribute with a trailing partial TLV
- Don't emit "no neighbor X capability link-local" for unnumbered peers
- Do not accept AIGP for OAD peers if not enabled
- Fix bmp connect deletion with source-interface
- Ignore parsing ORF route-refresh messages
- Avoid memory leak via EVPN Type-4 nexthop churn
- Avoid using dangling evpn pointr for bgp_debug_rdpfxpath2str()
- Fix strlcat/strlcpy size parameter in NOTIFICATION send path
- Don't advertise LLGR stale routes to non-LLGR peers
- Reduce ibuf_scratch size to match ibuf_work
- Improve validation of snmp oids
- Fix extended optional parameters handling in OPEN message
- Lift !afc check in bgp_gr_check_all_eors
- Fix holdtime_ptr unsafe pointer aliasing in OPEN receive path
- Fix return NULL in bool function ecommunity_node_target_match
- Only use 32-bit AS in aggregator attr when negotiated
- Fix nexthop attr validation
- Add LLGR to capability length validation switch
- Fix community string truncation for big community sets
- Free srv6_l3service object in failed parse path
- Free community json object before regenerating
- Improve handling of single index in ecom2str()
- Avoid cluster list attribute truncation
- Set extended flag for NHC attribute when re-encoding
- Remove unneeded sort of communities in rmap delete
- Fix infinite loop in MRT route dump for oversized paths
- Skip route-map LPM optimisation for AF_FLOWSPEC
- Fix use-after-free for ORF case
- Fix attr comparison when using attr_intern_reuse cache
- Clear SRv6 unicast SIDs on locator delete
- BGPd crash due to multiple bnc entry linked to same peer.
- Cancel BFD strict hold timer on peer delete
- Cancel LLGR stale timer on peer AF delete
- Fix crash of bgp_bmp.c with a mirror situation
- Validate SRV6 service sid transposition values
- Only use srv6_l3service attr if it's present
- Validate EVPN Type-5 NLRI prefix length for IPv4
- Check if sub TLV's length is sufficient for BGP_PREFIX_SID_SRV6_L3_SERVICE_SID_INFO
- Skip route clearing for peers that were never established
- Allow `no network ....` form for safi = EVPN or MPLS_VPN
- Fix EVPN VRF auto RT deletion collision
- Prevent assert on shutdown in evpn setup
- Prevent crash when list is already NULL
- Fix shutdown crash by restricting evpn cleanup to owner instance
- Fix valgrind memory leaks on daemon shutdown
- Define a maximum number of TLVs for ENCAP attribute
- Replace assert() with a boundary check condition
- Remove dead code and cleanup in show_adj_route and peer_adj_routes
- Fix crash in bgp received-routes detail json
doc:
- Also build for linux/riscv64 on release
- Fix merge conflict in pim.rst
- Document AutoRP discovery purge and mapping agent
github:
- Drop commitlint check
isisd:
- Free json objects in error paths
- Consume incomplete Router Capability subTLV header
- Parse zero-length Router Capability subTLVs
- Skip only Router Capability bytes on bad subTLV
- Use subTLV header size in Router Capability parsing
- Reject duplicate SRv6 SID Structure Sub-Sub-TLV
- Validate ASLA sub-sub-TLV length before consuming bytes
ldpd:
- Free imsg object in error path
- Check fec elem length before accessing
- Allow event_add_read to work properly on initial
lib:
- Add missing linux headers to subdir.am
- Update if_tunnel.h from linux 7.1.8 (stable)
- Clear seg6local context when deleting seg6local state
- Fix ZAPI SRv6 nexthop comparison
- Fix wrong nexthop comparision for SRv6
- Bound masklen values, don't assert
- Test the right bytes in flowspec prefixes
- Fix NULL deref in frr_signal_timer
- Add missing hook_unregister_arg in mgmt_be_client_destroy
- Fix mgmt_msg recv to deal with mis-alignment
lib, zebra:
- Bound SRv6 locator name length in ZAPI
nhrpd:
- Validate strictly in nhrp_cie_pull() code path
- Validate more in parse_ether_packet() path
- Validate header sockunions
ospf6d:
- Bypass MinLSArrival for self-originated MaxAge LSAs
- Avoid route use after unlock in best route iterator
- Check length before accessing grace LSA TLVs
- Fix command output for default route
ospfd:
- Validate PREFIX_SID subtlv len before accessing
- Validate extended prefix TLV before accessing prefix SID
- Prevent stale LSA from corrupting local OSPF DB after reboot
- Remove unnecessary space
pimd:
- Free json object in "show pim autorp"
- Guard NULL channel_oil in pim_upstream_mroute_iif_update callers
- Clean stale upstream NHT tracking on RP delete
- MLAG: gate silent pimreg-add in pim_upstream_switch() on could_register
- MLAG: gate FHR flag on DR check in wrvifwhole/wholepkt upcalls
- Fix elected BSR not updating when priority changes
- Fix BSR_PENDING timer being overwritten by BS liveness timer
- Use RFC 3973 dm graft retry period for retransmission
- Fix wrong endian convertion
- Fix dense mode State Refresh relay forwarding
- Fix heap OOB write in BSM fragmenter
- Clarify TIB IGMP loop protection vs split-horizon enforcement
- Reject adding an OIF that matches the MFC incoming interface
- Enforce split horizon when installing (S,G) MFC entries
- Defer AutoRP default discovery until config is applied
- Drop duplicate pim_dm.h include in pim_nb_config.c
- Remove unused PIM_DM_STANDARD_RANGE define
- Pass outgoing interface when forwarding State Refresh
- Restore I_am_RP guard in pim_upstream_kat_start_ok
- Use correct IP TTL for State Refresh and Graft-Ack
- Unicast Graft-Ack to the Graft sender
- Join AutoRP multicast groups based on active role
- Purge learned AutoRP RPs when discovery is disabled
- Fix AutoRP holdtime parsing and minor cleanup
- Defer static mroute install until interfaces are ready
- Fix static mroute list destroy NB callback
- Preserve first-match order in pim_access_list_apply
- Fix non-extended cisco ACL matching in pim_cisco_match
- Drop duplicate rec_type from IGMPv3 report debug log
- Cache boundary list pointers and refresh via hooks
- Move dense (S,G) to sparse mode when an RP is added
- Apply candidate-BSR priority changes directly
- Remove duplicate PIM_BSM_FRAG mtype declarations
- Count BSM stats for unicast Candidate-RP messages
- Free BSR Candidate-RP database on instance teardown
- Handle BSR unicast socket creation failure
- Fix candidate-BSR JSON address formatting
- Fix Candidate-RP group bounds check for PIMv6
- Fix inverted PIM socket receive failure counter
- Refresh i_am_rp after BSR RP mapping updates
- Fix mapping agent AutoRP discovery packet size
- Guard NULL rp lookup in pim_bsm_clear upstream refresh
- Guard NULL rp_all when instating BSM pending RP list
- Guard NULL rp lookup in pim_rp_del upstream refresh
- Fix crash when up->channel_oil is NULL
- MLAG: skip pim_register_join on non-DR
- Tighten Auto-RP announcement acceptance
- Validate multicast group prefixes in Auto-RP messages
- Cap Auto-RP learned RP entries and groups per RP
- Cap neighbors and reject PIM when iface has no PIM
- Provide better ordering for calling pim_upstream_use_rpt
- Harden BSM group/RP parsing paths
- Cap PIM Hello secondary address list parsing
- Reject truncated IP datagrams before IGMP/mtrace handling
tests:
- Update IS-IS TLV fuzzing data
- Cover EVPN advertise route-map counter cleanup
- Cover SRv6 locator delete after no prefix
- Promote `check_srv6_locator` helpers to module level
- Check if AIGP attribute is ignored at inbound if not enabled
- Pim_cand_rp_bsr: add elected BSR priority change test
- Load frr.conf by default
- Normalize timeouts in bgp snmp topotest
- Add community unit tests
- Add coverage for State Refresh relay forwarding
- Verify SSM delivery to h3 with collect_receiver_sources
- Verify SSM mroute split horizon in multicast_ssm_topo1
- Tune multicast_ssm_topo1 for shared-LAN SSM debugging
- Add multicast receiver source-reporting helper
- Verify SSM (S,G) join state
- Expand multicast_ssm_topo1 for SSM debugging
- Extend pim_dense topotest for DM mode coverage
- Verify AutoRP joins only required multicast groups
- Verify AutoRP RPs are purged when discovery is disabled
- Skip grpc_basic when FRR gRPC module is missing
- Ignore pytest-xdist worker ids in analyze.py reruns
- Drop flaky grpc collection-time --check under xdist
- Cover deferred static mroute install and delete
- Cover boundary list deletion and mixed ACL ordering
- Fix multicast_pim_sm_topo2 TC_15/TC_7 mroute flakiness
- Add DM->SM transition coverage to pim_dense topotest
- Expand PIM candidate BSR/RP topotest coverage
- Add BSR RP daemon-kill failover topotests
- Extend BSR fallback topotests to verify iAmRP
- Fix flaky IGMP source checks in pim_boundary_acl
- Make gcov coverage robust under parallel topotests
- Fail fast when --cov-topotest lacks gcov build
- Add a bgp bmp mirror test
- Ensure that `no network ...` actually works
- Avoid hang opening ExaBGP peer FIFOs
- Reap mutini children during munet and xdist teardown
- Skip support bundle collection after topology teardown
- Reap mutini zombies in xdist worker cleanup
tools:
- Syntax refactoring with black 26.5.1
- Fix frr-reload.py crashes with UnboundLocalError
- Add show neigh to support bundle generation
yang:
- Inet type mismatch in frr-bfdd.yang
- Fix typo in dm-prefix-list description
- Allow match-metric value of zero
zebra:
- Notify the client when an SRv6 SID allocation fails
- Add TUNNEL_CSUM to netlink EVPN DVNI IPv6 encode
- Free json object in error path
- Don't leave stale interface pointers in the VNI databases
- Fix heap use after free link interface invalid when ifp freed
- Fix SRv6 locator delete after no prefix
- Fix SRv6 source-address config output
- Fix neighbor entries ns_id
- Tear down old L3VNI before adding new one on VNI value change
Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com>
