The primary focus of this release is a fix of SEGV regression in ospfd, which was introduced in 0.99.19. It also features a series of minor improvements, including better RFC compliance in bgpd, better support of FreeBSD and some enhancements to isisd.

This release provides security fixes, which address assorted vulnerabilities in bgpd, ospfd and ospf6d (CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, CVE-2011-3326 and CVE-2011-3327).

• Building with Opaque-LSA support will fail. Workaround: do not specify either of the following arguments to ./configure: "--enable-opaque-lsa", "--enable-ospf-te". (fix).
• Bug #638: Building with "--disable-ipv6" or building on hosts where ./configure does not detect IPv6 support (e.g. some Linux security patches hide info in /proc) can cause build failures. Workaround: Do not specify "--disable-ipv6". (fix)
• Bug #637: Compile error occurs with recent GCC versions. Possible workaround: If an older version of GCC is installed, e.g. gcc34, specify it as a "CC=gcc34" argument to configure. (fix).

This release fixes 2 denial of services in bgpd, which can be remotely triggered by malformed AS-Pathlimit or Extended-Community attributes. These issues have been assigned CVE-2010-1674 and CVE-2010-1675. Support for AS-Pathlimit has been removed with this release.

The release includes a number of bug-fixes and enhancements, primarily for ospfd, ospf6d and bgpd.

A short summary of commits is shown below, for more details please look into the full changelog.

bgpd:
    Remove AS Path limit/TTL functionality
    bgpd/security: CVE-2010-1674 Fix crash due to extended-community parser error
    use Jenkins hash for BGP transit, cluster and attr hashes
    Remove extra lock on interior table node
    Fix display of unsigned attributes
    fix use of free memory by update_rsclient
    unlock node on aggregate error
    fix errors in aggregate address command
    use XCALLOC to allocate bgpd damp array
    fix bgp_node locking issues
    improve "monotonic" uptime correction
    VTY string fixes for debug commands
    fix handling of "Unsupported Capability"
    Set from even if binfo->extra is NULL.
    Simplify process queue init
    fix community-list error message spelling
    fix printed value of last-update timestamp

ospf6d:
    Extend the "[no] debug ospf6 route" vty commands
    Route locking (memory) cleanup
    Have ospf6d cleanup when it terminates normally
    Remove obsolete code
    Fix memory allocation issues in SPF
    fix crash in SPF calculation

ripd:
    resolve debug statements issue (bug 442)

ripngd:
    copy debug statements fix from ripd

ospfd:
    Remove oi field from LSA, have network_lsa_refresh look up when
needed
    potential fix for router-id change assert on refresh cleanup patch
    Fix maxage/flush to not try flood twice, remember maxages for longer
    Unify router and network LSA refresh logic with general refresher
    Remember network LSA sequence numbers across up/downs of an interface
    Prioritise hellos for sending by queueing to head of output buffer
    Reset neighbour inactivity timer for any packet arrival
    the maxage_lsa_remover should check whether it needs to yield the cpu
    Fix various route_unlock discrepencies
    fix lsa_refresh_walker unlock before use bug
    interface code should leave  network_lsa_self alone
    OSPF_MIN_LS_ARRIVAL compare should be >= to match ospf_flood
    ospf_if_free can leave dangling references on ISM events - cancel them
    Lower level of some common messages from info to debug

lib:
    zclient: fix router-id calculation for IPv6 (#595)
    lib: zlog should clean up its memory
    lib: Add a function to delete all interfaces
    lib: Better hashing of string values using Bernstein hash
    lib: Fix accounting of memory
    lib: Fix bug in prefix trie lookup
    lib: prefix.c nano-optimisation
    lib: Make workqueue more conservative about ramping up
    lib: Add a command to clear the thread CPU history data
    lib: Thread scheduler should be fair and not let events starve I/O and timers
    lib: thread history funcname shouldn't be constant, it's freed
    bgpd, lib: adopt afi_t and safi_t in several places
    lib/vty.c: add missing format string when printing out motd message
    Document rules for zalloc and friends.

zebra:
    Zebra zserv: bogus conditional

This release provides two important bugfixes, which address remote crash possibility in bgpd discovered by CROSS team.

A short summary of commits is shown below, for more details please look into the full changelog.

bgpd:
    fix handling of AS path data
    tighten bounds checking in RR ORF msg reader

ospfd:
    Only refresh external default route once.
    Make sure ospf_distribute_list_update_timer() eventually runs.
    Make sure all external routes are updated.

zebra:
    fix infinite loop when deleting an interface

ospf6d:
    Fix crash when '[no] ipv6 ospf6 advertise prefix-list' is in startup-config

isisd:
    change ISIS_METHOD to use C preprocessor

other:
    build: ignore mkinstalldirs and texinfo.tex
    build: Add QuaggaId to README.NetBSD
    build/extra: Enhance README.NetBSD make/gmake decision.
    git: add pointers to out-of-tree work
    git: add (generated) m4 files to .gitignore
    Update for git and emphasize asking for good reports.
    doc: fixed spelling in bgpd.texi

This release mostly features bugfixing and cleanup work contributed through quagga-dev mailing list by various authors. Around 30 patches have been merged since the last release. This version is recommended for all users of 0.99 branch of Quagga.

A short summary of commits is shown below, for more details please look into the full changelog.

bgpd:
    use monotonic clock for time of day
    code cleanup
    compile warnings cleanup
    work around warning in assegments_parse()

ospfd:
    fix debug messages that were masked by DISCARD_LSA
    remove unneeded memset from a very hot function
    VTY strings cleanup
    comment out unused function
    make local functions static
    enable more OSPF cost command aliases

lib:
    fix memory logging
    make some structures constant
    move check_bit into prefix common code
    fix warning on little endian
    make match functions take const args
    remove unused function: route_dump_node()
    log source of vty connections (bug #566)

zebra:
    change router-id selection algo
    deal with irdp compile warnings
    cleanup RIB meta queue code
    fix more warnings in rtadv
    fix more compiler warnings
    remove unused function to fix warning
    handle RTF_CLONING removal from FreeBSD 8.0
    fix argument reference in strncpy() call for BSD
    fix RIB debug message for IPv6
    make declaration const in rtm_flag_dump()
    fix router advertisements for non-Ethernet link layer addresses

ospf6d:
    remove dead code
    fix warnings from recent prefix bit commit
    review LSA sequence number comparison
    fix LSA locking in ospf6_new_ls_id()

other:
    ripd: fix compiler warnings
    ripngd: compiler warnings cleanup
    isisd: fix --enable-isis-topology for 64-bit Linux
    isisd: fix BPF ioctl() calls, treat "true" and "false" as reserved
    configure: fix spelling
    configure: fix HAVE_CLOCK_MONOTONIC spelling

This release still contains a regression in the "no ip address ..." command, at least on Linux. See bug #486, which contains a workaround patch.

This release should be considered a 1.0.0 release candidate. Please test this release as widely as possible.

The quick summary of user-visible changes is below, see the full changelog for more details.

bgpd:
    fix md5 set on listen sockets
    missing pieces from listener patch
    Workaround for invalid MBGP next hop
    Allow inbound connections to non-default view
    fd leak in bgpd
    Delete AS_CONFED_SEQUENCE when prepending an AS_SEQUENCE type segment
    Implement BGP confederation error handling (RFC5065, Par. 5)
    start listener on first instance
    peer action table static/const
    Restore ability of 'neighbor ... update-source' to take interface name

ospfd:
    Make sure priority is respected.
    Tighten up the connected check for redistribution
    fix performance problem with redistribute delete
    Make sure route table is recalculated.
    Make "Packet ... received on wrong link" conditional on debug
    Change struct ospf_path *oi to ifindex.
    Discriminate better when selecting links between vertices in SPF
    Make ospf_if_lookup_recv_if() find the right unnumbered i/f
    export ospf_if_table_lookup() and use it in ospf_network_run_interface()

ospf6d:
    bug #529, fix endianness problem in earlier commit

ripd:
    set IP TOS for control socket

zebra:
    do not touch socket before pidfile locking

doc:
    zebra.8 via Christian Hammers (#531)

This release contains a regression fix for ospf6d, various small fixes and some hopefully very significant bgpd stability fixes.

This release should be considered a 1.0.0 release candidate. Please test this release as widely as possible.

A quick summary of other changes is below, see the full changelog for more details.

lib:
    Fix IPv6 normalisation
    Allow for large-file support, e.g. for log files >2GB

zebra:
    Silence noisy process_subq
    RFC 4191 Default Router Preference support for router advertisements
    linux policy routing support with ipv6
    Static route does not reach kernel.

bgpd:
    Fix nexthop reachability check on confederations
    fix typo made by paul in previous commit
    Avoid zombie accepted peer entries
    Small buffer overrun in bgp_clear_node_queue_init
    Stability fixes including bugs 397, 492
    Fix compiler warnings related to MD5
    Bug #533: Fix crash with copy/pasted commands, inc 'no bgp ...'
    Log a debug/update warning if filters are configured but don't exist
    Add 'show ip bgp view WORD neighbors IP (advertised|received)-routes'
    review 32-bit AS-path hotfix for 0.99.12
    Fix "show ip bgp dampened-paths" garbage output.
    Fixes to RFC2385/MD5 BGP

ospfd:
    Do not use stale Network/Router LSAs
    compare ifIndex too when matching paths
    external LSA route_unlock_node() fixes
    Fix a few LSA performance "bugs"
    discount IP header size from a new LSA pkt
    cancel OSPF timer hack in nsm_change_state

ospf6d:
    Fix regression in monotonic time patch - LSA max-aging broke

vtysh:
    Save vtysh history to a file
    Fix vtysh based "write term" output.

doc:
    Add "--disable-doc" to configure

This release is contains a number of small fixes, for potentially irritating issues, as well as small enhancements to vtysh and support for linking to PCRE (a much faster regex library).

A quick summary of other changes is below, see the full changelog for more details.

build:

    [configure] fix check for GNU awk/gawk to abort ./configure if missing
    [configure] add configure support for PCRE Posix library
    [configure] Detect support for monotonic clock

zebra:

    [zebra] Force rib_update when connected route deleted
    [zebra] Only announce connected routes if link is detected
    [zebra] MTU is unsigned
    [zebra] remove incorrect debug message
    [zebra] Cleanup meta-queue code
    [zebra] netlink interface minor cleanup
    [zebra] Fix vyatta bug 2814: Add "show ip route summary" command.

bgpd:

    [bgpd] Fix 'update-source' command: It doesn't accept interface names
    [bgpd] reference count the BGP instance
    [bgpd] Add support for the old Linux 2.4, TCP_MD5_AUTH RFC2385 patch
    [bgpd] Fixed as-path prepend/exclude ASN handling
    [bgp] Fix crash on SIGHUP, deref of freed workqueues
    [bgpd] 64-bit bugfix in community_del_val

ospfd:

    [ospfd] Fix OSPF route refcount leak
    [ospfd] fix vty ospfd no ospf abr-type standard

ospf6d:

    Convert ospf6d over to quagga_gettime() wrappers.
    [ospf6d] Remove 'no router' from OSPF6_NODE
    [ospf6d] Fix ospf6d crash if removing interface with no area
    [ospf6d] Fix ospf6d crash in show border routers
    [ospf6] Add no router ospf6
    [ospf6d] Fix ospf6d crash if range defined twice

ripd:

    [ripd] Ignore non-running interfaces in rip status
    [ripd] Fix metrix in call to rip_zebra_ipv4_delete

vtysh:

    [vtysh] Add a --noerror option
    [vtysh] Return non-zero exit code on error.
    [vtysh] Make vtysh more useable for scripting
    [vtysh] Force line buffered mode.

misc:

    [daemons/cleanup] Remove disabled log_mode argument support.
    [lib] Put symbolic backtrace on system log
    [lib] sockopt_tcp_signature: sin6 requires HAVE_IPV6
    [smux] 64-bit fix for lib/smux.h SNMP_INTEGER() macro
                                                                                                                                        

This release fixes an urgent bug in bgpd where it could hit an assert if it received a long AS_PATH with a 4-byte ASN.

A quick summary of other changes is below, see the full changelog for more details.

bgpd:
    Fix bgp ipv4/ipv6 accept handling
    [bgpd] AS4 bugfix by Chris Caputo
    [bgpd] Add 'show bgp views' command
    [bgpd] Allow accepted peers to progress even if realpeer is in Connect

ospfd:
    [lib] Move type cast in Fletcher checksum
    [lib] Switch Fletcher checksum back to old ospfd version
    Justified OSPF cost function names and added support for:
     ospf cost <1-65535> A.B.C.D
     no ospf cost <1-65535>

library:
    [lib] Fix timer precision.
    [lib] fix missing sockunion_normalise_mapped

vtysh:
    [vtysh] Add commands from zebra_routemap.c to vtysh

misc:
    [build] tools/multiple-bgpd.sh should be in 'make dist'

Thanks to everyone who helped by reporting bugs, contributing and testing fixes.

Release notes

Stable release candidate

Most regressions in 0.99 over 0.98 are now believed to be fixed. This release should be considered a release-candidate for a new stable series, and we urge any remaining users of 0.98 to test this release and report any bugs. A blocker meta-bug exists to track critical regressions.

bgpd: Preliminary UI and Linux-IPv4 support for TCP-MD5 merged

Initial support for TCP-MD5 has been merged. This adds the neighbor ... password command, and some support for setting TCP-MD5 on pure-IPv4 connections on Linux. On Linux systems with IPv6 available, passing the -l 0.0.0.0 argument to bgpd may allow TCP-MD5 support to work. It's not possible at this point to have IPv6 sessions and also use TCP-MD5 on IPv4 sessions. This will hopefully be rectified in a future release.

bgpd: Fix double-free crash in bgp_table_finish, seen with rs-client

Though diagnosed with rs-clients, this fix very likely addresses a number of crashes reported to Quagga bugzilla.

zebra: ignore dead routes in RIB update

This fix may address some issues reported with routes not being consistent between the zebra RIB and the kernel FIB, remaining after the fixes in last release.

Solaris: Sync SMF bits with OpenSolaris SFW

The Quagga packaging support for Solaris has been updated to synchronise with OpenSolaris SFW. Of particular note is that SMF schema has been updated to match the Sun PSARC approved schema, which is supported by the OpenSolaris routeadm utility. User's may need to familiarise themselves with the changed FMRIs, and may need to update any administrative scripts.

A short-form list of more notable, code related changes:

bgpd:
 [bgpd] Document the FSM dummy-peer race that sometimes afflicts session setup
 [bgpd] Fix definition of an rsclient command
 [bgpd] Fix double-free crash in bgp_table_finish, seen with rs-client
 [bgpd] Fix triggerable crash when compiled with --disable-bgp-announce
 [bgpd] TCP-MD5: password vty configuration and initial Linux support

build:
 [build] --enable...user/group didn't match help text
 [build] Fix --enable-pie so it can actually be disabled
 [build] Linux netlink doesn't need IF_PROC
 [build] Test for GNU-style PIE support in toolchain and enable
 Make --enable-snmp cross compile and make libcrypto optional with --without-crypto

isisd:
 [isisd:DLPI] Try open vanity-named DLPI dev before style 1,2
 [isisd] Fix packet filtering with DLPI
 [ospfd/isisd] Switch to lib/ Fletcher checksum, fixing bug in isisd

lib:
 [lib] Add fletcher checksum implementation
 [vty] Add support for a 'restricted mode' with anonymous vty connections
 [vty] Allow delete during password entry
 [vty] CMD_AS_RANGE accidently quoted and so not expanded in vty

ospfd:
 [ospfd] Default route needs to be refreshed after neighbour state change
 [ospfd] Fix SEGV during startup introduced in recent commit
 [ospfd] Move passive interface check
 [ospfd] Restructure opsf_if_update() and ospf_network_run()
 Fix SEGV in ip ospf neighbor all
 Ignore host routes to self.
 Set destination for PtP links to OSPF_ALLSPFROUTERS.

packaging:
 [solaris] Sync SMF bits with OpenSolaris SFW

tools:
 [tools/multiple-bgpd.sh] make it easier to use IPv6 peer addresses
 [tools/multiple-bgpd] setup IPv6 advertisments

vtysh:
 [vtysh] small fix to previous CMD_AS_RANGE patch, and add missing command

zebra:
 [zebra:linux] Filter out unwanted netlink messages by PID
 [zebra:linux] clean up blocking setting of netlink sockets
 [zebra:linux] netlink buffer size tweaking only needed on receive socket
 [zebra:linux] netlink: no need to change privs for receive
 [zebra:linux] netlink: quiet harmless errors
 [zebra:netlink] Set proto/scope on all route update messages
 [zebra] Make BSD link-state deal more gracefully with GIFMEDIA ioctl error
 [zebra] ignore dead routes in RIB update