bgpd/security: CVE-2010-1674 Fix crash due to extended-community parser error

* bgp_attr.c: (bgp_attr_ext_communities) Certain extended-community attrs
  can leave attr->flag indicating ext-community is present, even though no
  extended-community object has been attached to the attr structure.  Thus a
  null-pointer dereference can occur later.
  (bgp_attr_community) No bug fixed here, but tidy up flow so it has same
  form as previous.

  Problem and fix thanks to anonymous reporter.
(cherry picked from commit 0c46638122f10019a12ae9668aec91691cf2e017)
bgpd: Remove AS Path limit/TTL functionality

* draft-ietf-idr-as-pathlimit doesn't seem to have gone anywhere, and its
  author does not think it will make progress in IDR. Remove all support
  introduced for it, but leave stubs for the commands to avoid breaking
  any configurations.

  Basically reverts cecab5e9725792e60a5e4b473e238a14cd85815d.
(cherry picked from commit c8f3fe3063cb9ff193b13011cfbda3e605395340)

* Fixes CVE-2010-1675 denial of service (session reset) via a malformed
  AS_PATHLIMIT path attribute.

Conflicts:

	bgpd/bgp_attr.c (caused by c8e7b895, resolved)
	bgpd/bgp_route.c (caused by type change in afi)
ospf6d: fix crash on filter-list handling (BZ#530)

This essentially merges the fix available from Debian build of Quagga.

* ospf6_area.c
  * area_filter_list(): use correct argv indices
  * no_area_filter_list(): idem
lib/vty.c: add missing format string when printing out motd message

Signed-off-by: G.Balaji <balajig81@gmail.com>
ospf6d: CVE-2011-3323 (fortify packet reception)

This vulnerability (CERT-FI #514840) was reported by CROSS project.

ospf6d processes IPv6 prefix structures in incoming packets without
verifying that the declared prefix length is valid. This leads to a
crash
caused by out of bounds memory access.

* ospf6_abr.h: new macros for size/alignment validation
* ospf6_asbr.h: idem
* ospf6_intra.h: idem
* ospf6_lsa.h: idem
* ospf6_message.h: idem
* ospf6_proto.h: idem
* ospf6_message.c
  * ospf6_packet_minlen: helper array for ospf6_packet_examin()
  * ospf6_lsa_minlen: helper array for ospf6_lsa_examin()
  * ospf6_hello_recv(): do not call ospf6_header_examin(), let upper
    layer verify the input data
  * ospf6_dbdesc_recv(): idem
  * ospf6_lsreq_recv(): idem
  * ospf6_lsupdate_recv(): idem
  * ospf6_lsack_recv(): idem
  * ospf6_prefixes_examin(): new function, implements A.4.1
  * ospf6_lsa_examin(): new function, implements A.4
  * ospf6_lsaseq_examin(): new function, an interface to above
  * ospf6_packet_examin(): new function, implements A.3
  * ospf6_rxpacket_examin(): new function, replaces
    ospf6_header_examin()
  * ospf6_header_examin(): sayonara
  * ospf6_receive(): perform passive interface check earliest possible,
    employ ospf6_rxpacket_examin()

Conflicts:

	ospf6d/ospf6_message.c (Caused by deprecated ospf6_header_examin(), removed.)
ospf6d: CVE-2011-3324 (DD LSA assertion)

This vulnerability (CERT-FI #514839) was reported by CROSS project.

When Database Description LSA header list contains trailing zero octets,
ospf6d tries to process this data as an LSA header. This triggers an
assertion in the code and ospf6d shuts down.

* ospf6_lsa.c
  * ospf6_lsa_is_changed(): handle header-only argument(s)
    appropriately, do not treat LSA length underrun as a fatal error.
ospfd: CVE-2011-3325 part 1 (OSPF header underrun)

This vulnerability (CERT-FI #514838) was reported by CROSS project.

When only 14 first bytes of a Hello packet is delivered, ospfd crashes.

* ospf_packet.c
  * ospf_read(): add size check

Conflicts:

	ospfd/ospf_packet.c (Due to conflict with new ospf_packet_examin())
ospfd: CVE-2011-3325 part 2 (OSPF pkt type segv)

This vulnerability (CERT-FI #514838) was reported by CROSS project.

The error is reproducible only when ospfd debugging is enabled:
  * debug ospf packet all
  * debug ospf zebra
When incoming packet header type field is set to 0x0a, ospfd will crash.

* ospf_packet.c
  * ospf_verify_header(): add type field check
  * ospf_read(): perform input checks early
ospfd: fix regression in recent commit

commit '717750433839762d23a5f8d88fe0b4d57c8d490a' causes SEGV error,
when 'oi = ospf_if_lookup_recv_if (ospf, iph->ip_src, ifp);' returns
NULL.

* ospf_packet.c
  * ospf_read(): change a place of calling 'ospf_verify_header()'
ospfd: CVE-2011-3326 (uknown LSA type segfault)

This vulnerability (CERT-FI #514837) was reported by CROSS project.
They have also suggested a fix to the problem, which was found
acceptable.

Quagga ospfd does not seem to handle unknown LSA types in a Link State
Update message correctly. If LSA type is something else than one
supported
by Quagga, the default handling of unknown types leads to an error.

* ospf_flood.c
  * ospf_flood(): check return value of ospf_lsa_install()
bgpd: CVE-2011-3327 (ext. comm. buffer overflow)

This vulnerability (CERT-FI #513254) was reported by CROSS project.
They have also suggested a fix to the problem, which was found
acceptable.

The problem occurs when bgpd receives an UPDATE message containing
255 unknown AS_PATH attributes in Path Attribute Extended Communities.
This causes a buffer overlow in bgpd.

* bgp_ecommunity.c
  * ecommunity_ecom2str(): perform size check earlier
Zebra zserv: bogus conditional

This looks like a bug in original code from misunderstanding
of C rules of evaluation.
zebra: optional system interface route management

Author:  Stephen Hemminger
URL:     http://marc.info/?l=quagga-dev&m=124950755024583&w=4
Subject: zebra: optional system interface route management

This patch adds support for removing FIB entry for interface when
link goes down. Normally on Linux, if eth0 is marked down (or loses carrier),
the connected route will stay in the FIB. This behaviour is good for
a host, but not what a router should do.

Since zebra is now doing connected route management, it also needs
to record more info about the route in the RIB (protocol, scope).
Remove bogus zebra workaround, to prevent loss of routes.

This removes an old zebra<-->Linux kernel workaround that resulted in
routes ending up in zebra but not in the kernel routing table.
Patchwork [quagga-dev,8377] Removal of interfaces doesn't delete routes

Author:  Daniel Fahlgren <fahlgren@tutus.se>
URL:     http://patchwork.quagga.net/patch/492/
Subject: Patchwork [quagga-dev,8377] Removal of interfaces doesn't delete routes
zebra: Don't delete too many routes.

Author:  Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
URL:     http://patchwork.quagga.net/patch/314/
Subject: [PATCH] [zebra] Don't delete too many routes.

If there are two paralell PtP links to the same router:
 C * 192.168.101.112/32 is directly connected, p1-4-19-4-20
 C>* 192.168.101.112/32 is directly connected, p1-4-17-4-18
and the cable is to one of the ppp links is pulled, Zebra
deletes both routes instead of just the one that got yanked.
This fixes it to only delete the route to the interface that
got yanked. In fact, the whole delete route pattern matching
expressions needed a total makeover.

Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
zebra: consider all nexthops when looking for a gateway match

Author:  Tom Goff <thomas.goff@boeing.com>
URL:     http://patchwork.quagga.net/patch/391/
Subject: quagga-dev,7774: zebra: consider all nexthops when looking for a gateway match

* zebra_rib.c: (rib_delete_ipv4 and rib_delete_ipv6) A route is not
deleted unless the given gateway is first in the nexthop list.  This
can leave a route containing an invalid nexthop in the routing table
which might later be used.  Instead look at all nexthops to find a
match.

forward-ported to apply on top of Joakim Tjernlund's "don't delete too
many routes" by David Lamparter.

Signed-off-by: David Lamparter <equinox@diac24.net>
zebra: Quagga doesn't handle interface routes

Author:  Daniel Fahlgren <fahlgren@tutus.se>
URL:     http://patchwork.quagga.net/patch/494/
Subject: quagga-dev,8385: Re: Quagga doesn't handle interface routes
zebra: Delete route even if there are no next hops

Author:  Stephen Hemminger <shemminger@vyatta.com>
URL:     http://patchwork.quagga.net/patch/2/
Subject: quagga-dev,8479: zebra: Delete route even if there are no next hops

Zebra won't delete route in FIB? It only will modify existing entries
when kernel_delete_ipv4 calls netlink_route_multipath (with RTM_DELROUTE).
Old code will not delete existing FIB entries.

   https://bugzilla.vyatta.com/show_bug.cgi?id=5927
lib/privs.c: Missing %s string formatting fixes.