* [PATCH] frr: Update to version 10.7.0
2026-08-08 13:07 [PATCH] fort-validator: Update to version 1.6.8 Adolf Belka
@ 2026-08-08 13:07 ` Adolf Belka
2026-08-08 13:07 ` [PATCH] haproxy: Update to version 3.4.3 Adolf Belka
1 sibling, 0 replies; 3+ messages in thread
From: Adolf Belka @ 2026-08-08 13:07 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 10.6.0 to 10.7.0
- Update of rootfile
- Changelog
10.7.0
New Features Highlight
BFD authentication with keychain support
BFD sessions can now use the FRR keychain framework for authentication.
Supported algorithms include cleartext, SHA-1, and the meticulous variant required by operators running strict authentication policies.
Keychains integrate with BFD profiles and northbound configuration for single-hop, multi-hop, and SBFD sessions.
BGP-LS SRv6 extensions
BGP Link-State now advertises and processes SRv6 topology information, including:
SRv6 Capabilities TLV
SRv6 Locator TLV
SRv6 SID NLRI (including End, End.X, and LAN End.X forms)
SRv6 Endpoint Behavior TLV
SRv6 SID Structure TLV
Static SRv6 SIDs configured in zebra can be exported into BGP-LS, enabling SRv6-aware TE controllers to consume locator and SID information from FRR.
BGP route-map based allowas-in
allowas-in can be applied selectively through route-maps instead of only as a blanket peer or address-family knob.
This allows finer control over which received routes may contain the local AS in the AS_PATH, improving policy flexibility in complex multihomed and hub-and-spoke designs.
OSPFv2 RFC 4222 control-plane DSCP marking
OSPFv2 can classify control packets into high- and low-priority queues per RFC 4222 recommendation 1.
Recommendation 2 extends the neighbor inactivity timer behavior for low-priority control traffic.
Operators can mark OSPF control traffic with DSCP values to protect routing protocol stability under congestion.
OSPF BFD quick neighbor
When BFD is enabled on OSPF interfaces, a quick-neighbor mode reduces the time needed to bring up OSPF adjacencies over BFD-monitored links.
This is useful on fabrics where fast reconvergence after link-up is required.
PIM IGMP proxy route-map filtering
IGMP proxy joins and prunes can be filtered with ip igmp proxy route-map.
A new route-map match condition, match multicast-source-interface, allows policy based on the interface where a join was learned.
This helps deployments that proxy IGMP between access and core segments while restricting which groups or sources are forwarded.
PIM dense-mode Assert on multi-access LAN
Dense-mode wrong-interface traffic on shared LANs now runs the RFC 3973 Assert procedure instead of immediately pruning all neighbors.
On point-to-point links the previous immediate-prune behavior is preserved.
This elects a single forwarder on multi-access segments and avoids pruning active branches when duplicate (S,G) packets arrive on a non-RPF interface.
PIM Auto-RP allow-rp support
A new allow-rp configuration accepts Auto-RP groups even when the embedded RP address does not match the local RP configuration.
IPv4 and IPv6 Auto-RP are supported through northbound/YANG modeling.
This helps mixed-vendor or transitional Auto-RP deployments where strict RP identity checking would otherwise drop valid control traffic.
Static route per-route metric and nexthop ECMP weight
Static routes now support a per-route metric as a non-key attribute, independent of the existing administrative-distance key.
Static ECMP nexthops can carry weights for unequal-cost multi-path forwarding.
Together these align static routing policy more closely with zebra’s nexthop-group handling used by other protocols.
What's Changed
EVPN RMAC management fixes and test coverage by @soumyar-roy in #20588
ospfd: Display message when clearing interface without OSPF by @soumyar-roy in #20267
zebra: FRR restart leads to zebra mlag core by @soumyar-roy in #20225
zebra: limit RTADV socket rcvbuf to 20MB by @hengwu0 in #20654
Evpn test abstraction by @donaldsharp in #20637
pimd,pim6d: fix last-member-query-count and add robustness value by @rzalamena in #20613
bgpd: Changes to include new fields in "show bgp router" command by @soumyar-roy in #20631
bgpd: Fix double-free crash in peer_delete() during doppelganger peer… by @routingrocks in #20661
staticd: Fix SRv6 SID use-after-free on locator deletion by @cscarpitta in #20660
yang: Correct pyang errors in frr-nexthop.yang by @y-bharath14 in #20694
bgpd: Replace 3 with BGP_ALLOWAS_IN_DEFAULT constant by @ton31337 in #20698
Fixes for op-state change notifications being sent to backend clients (daemons) by @choppsv1 in #20647
bgpd: Missing large community value in commAttriSentToNbr JSON by @soumyar-roy in #20608
lib,bgpd: Adding JSON str for time in dd:hh:mm:ss format by @soumyar-roy in #20632
bgpd: use BGP_PATH_INFO_NUM_LABELS macro in bgp_evpn_path_info_get_l3vni by @nick-bouliane in #20679
Add new show command to display only failed routes by @deepak-singhal0408 in #20343
bfdd: early return on socket allocation failure by @ethanmilon-6wind in #20700
zebra: add state column to 'show evpn es' command output by @shashanka-ks in #20711
zebra: add 'no encapsulation' command under segment-routing/srv6 by @hedrok in #20716
tests: Check PIM Register/-Stop handling in pim_igmp_vrf topotest by @gromit1811 in #18329
ospf6d: Fix stack buffer overflow in link LSA by @rminnikanti in #20695
bgpd: fix md5 password unset on dynamic nbr by @chiragshah6 in #20740
bgpd,zebra: EVPNv6 addressing coverity warnings by @Manpreet-k0 in #20680
bgpd: Fix suppress-fib-pending config race condition on startup by @krishna-samy in #20622
bgpd: fix batch clearing resume to use correct lookup APIs by @miteshkanjariya in #20738
bgpd: add a counter for received duplicate updates by @enkechen-panw in #20553
bgpd: Fix AS path exclude not working during VRF route re-import by @soumyar-roy in #20556
Nexthop weight support for static routes (ECMP/UCMP) by @iurmanj6WIND in #20559
Add memberCount into peer-grp json AND GR fields in fields in show bgp vrfs json by @raja-rajasekar in #20578
zebra: uninstall remote neigh even when ifp is down by @raja-rajasekar in #20587
vtysh: Add JSON output support for show memory by @ton31337 in #20605
bgpd: Ignore transitiveness flag when checking type for link bandwidth by @ton31337 in #20607
bgpd: Show all advertised paths including non-best paths only if addpath is enabled by @ton31337 in #20618
bgpd: implement new redistribute json command by @soumyar-roy in #20630
ospf6d: Fix FULL adjacency persisting despite MTU mismatch by @rminnikanti in #20681
doc: Fix VRF-related and PIM docs by @gromit1811 in #20717
zebra: rename BondState to State in 'show evpn es' output by @shashanka-ks in #20721
lib: use MTYPEs for northbound in several places by @mjstapp in #20733
Non route replace semantics by @donaldsharp in #20725
yang: Fix pyang errors in frr-bgp-filter.yang by @y-bharath14 in #20746
zebra: shorten label for RNH mem type by @mjstapp in #20749
*: Fixed coverity warnings in multiple areas by @Manpreet-k0 in #20610
bgpd: EVPN MH fix unimport ES route on vtep change by @Manpreet-k0 in #20730
Zebra fixup nhg handling from kernel by @donaldsharp in #20732
zebra: Updation of ifp->flags by @hnattamaisub in #20769
fix spell checks round 4 by @chiragshah6 in #20771
tests: Deleted duplicate imported modules by @y-bharath14 in #20779
Sharp send tableid for route by @donaldsharp in #20634
bgpd: unref routes when yielding during clearing iteration by @mjstapp in #20789
bgpd: fix premature deletion of already-stale routes during GR clearing by @miteshkanjariya in #20768
bgpd: validate incoming NOTIFICATION messages by @mjstapp in #20796
tests: Add a default route test to rip by @donaldsharp in #20799
yang: Fix pyang errors in frr-bgp-types.yang by @y-bharath14 in #20797
Multiple local fix by @donaldsharp in #20798
bgpd: improve flowspec NLRI validation by @mjstapp in #20814
bgpd: Reorder some struct attr members by @ton31337 in #20822
tests: Add additional wait tim to test_bgp_gr_functionality_topo2-3.py by @donaldsharp in #20788
Separate sg rpt sg ifchannels and add ability to set a override-interval and a test. by @donaldsharp in #20552
zebra: EVPN fix access BD deref of mbr intf by @chiragshah6 in #20791
tests: EVPN add dynamic nbr with ext router by @chiragshah6 in #20737
zebra: Allow redistribution events to pass reserved ranges by @donaldsharp in #20599
Fix ospf checksum #20706 by @Ko496-glitch in #20729
Kernel skip some route updates by @donaldsharp in #20666
bgpd: Force sending conditional updates by ignoring MRAI timer by @ton31337 in #20668
tests: Don't try to use identical rmacs in rare situation by @donaldsharp in #20844
tests: Fix rip_default_route_handling to be more consistent by @donaldsharp in #20838
pimd,ospfd: Passing local source address as part of BFD session creation by @usrivastava-nvidia in #20739
tests: Remove SRv6 SID check duplication by @cscarpitta in #20843
babeld: fix NULL pointer dereference in babel_clean_routing_process by @LyZephyr in #20727
vtysh: add additional options to ping command by @kaffarell in #20283
ospfd: prefer existing default route over generating by @rzalamena in #20699
tests: Do not fail zebra_nhg_check if skipped is not 0 on initial by @donaldsharp in #20855
Bgp peer sendq timing by @donaldsharp in #20839
tests: Unnecessary pass statement in test_bgp_lu.py by @y-bharath14 in #20860
Add info_count to route_table for accurate RIB entry reporting by @mike-dubrovsky in #20206
various spell check round 5 by @chiragshah6 in #20866
staticd: in route config, reject keywords as ifname by @mjstapp in #20311
debian: prefer libyang3 over libyang2 when building deb packages by @Jafaral in #20871
yang: Revision statements are not given in reverse chronological order by @y-bharath14 in #20870
tools: Add ldp commands to support bundle generation by @donaldsharp in #20863
lib: minor RCU/atomics improvements by @eqvinox in #20864
ldpd: Reuse port for ldpd sockets that set local ports by @donaldsharp in #20858
tests: Fix grpc-query.py to find micronet by @donaldsharp in #20880
pimd: When address change ensure DR changes too. by @donaldsharp in #20881
A few small Coverity fixes by @mbaldessari in #20888
lib/typesafe: guard skiplist level generation against ctz(0) UB by @florath in #20899
ospf6d: recalculate AS-external routes on non-external RIB updates by @donaldsharp in #20882
tests: fix some python and test syntax by @mjstapp in #20905
Always compare med fix by @donaldsharp in #20909
bgpd: fix memory leak in cluster_intern() by @enkechen-panw in #20913
bgpd: clear several parameters in subgroup_announce_check() by @enkechen-panw in #20884
isisd: fix memory-related issues and RFC-violations by @SpadeMomo in #20333
lib, bgpd: add "unique mode" for route tables, supporting direct lookup only by @mjstapp in #20589
bfdd: BFD Admin-Down State Management Improvements by @sougatahitcs in #20151
zebra: add 'show evpn es-peer' command for EVPN-MH peer VTEP list by @shashanka-ks in #20868
tests: Allow for different bestpaths to be generated. by @donaldsharp in #20889
yang: Revision statements are not given in reverse chronological order at frr-staticd.yang by @y-bharath14 in #20921
bgpd: fix the local-preference setting for EBGP-OAD by @enkechen-panw in #20898
zebra: Modify rib_process_dplane_results to limmit work done by @donaldsharp in #20902
doc: add some text regarding libyang versions by @choppsv1 in #20862
bgpd: correct the display header by @anlancs in #20927
bgpd: commits for the listening port by @anlancs in #20929
bgpd: Support for new "show bgp bestpath [json]" show command by @soumyar-roy in #20616
Zebra neighbor changes by @donaldsharp in #20912
Add support for libyang5 by @choppsv1 in #20895
eigrpd: handle the gr neighbor list safely in update_receive by @mjstapp in #20933
nhrpd: fix packet and buffer handling errors by @mjstapp in #20932
tests: fix a regex in all_protos topotest by @mjstapp in #20911
lib, tests: add a srcdest get_next api by @mjstapp in #20906
zebra: bump dplane minor version for 10.7 by @mjstapp in #20943
doc: add multicast testing guide for topotests by @Jafaral in #20945
lib: display End.DX2 route with appropriate oif attribute by @pguibert6WIND in #20954
bgpd: Fix test for OPEN message with remote-as auto by @ton31337 in #20963
bgpd: Add missing PEER_FLAG_SEND_NHC_ATTRIBUTE for update group flags by @ton31337 in #20956
bgpd: Reuse prep_for_rmap_apply() before route_map_apply() by @ton31337 in #20957
pimd: fix msdp mesh group SA crash by @lpchambers in #20900
isisd: Fix remaining buffer size calculation in lsp_bits2string by @rbgarga in #20984
vrrpd: Notification from zebra is not sent to vrrp by @hnattamaisub in #20270
bgpd: make code more robust in bgp_advertise_attr_unintern() by @enkechen-panw in #20989
babeld: fix RFC violations in babel message parser by @SpadeMomo in #20339
pathd: add 'no traffic-eng' command, add test, don't output 'segment-routing/traffic-eng' in configuration always by @hedrok in #20638
bgpd: Fix condition when evaluating paths by @ton31337 in #20975
bgpd: Fix routes to be removed from rib when suppress fib pending is configed by @nishant111 in #20917
bgpd, isisd, ospfd: coverity fixes by @ashred-lnx in #20948
bgpd: Fix nht to properly notice a change by @donaldsharp in #20986
Zebra MetaQ and dplane provider fixes by @donaldsharp in #20944
bgpd: Fix EVPN-MH route cleanup race condition during interfaces flap by @krishna-samy in #20710
pcep: fix heap buffer overflow by @iurmanj6WIND in #20994
tests: bgp_nhc add test to expose NHC update race on peer changes by @donaldsharp in #20949
bgpd: update on l2attr ecommunity by @lsang6WIND in #20980
ospfd: harden TE/SR TLV iteration against malformed lengths by @Jafaral in #21002
GitHub ci improvements by @Jafaral in #21003
bfdd: Fix wrong memory free when using ttable code by @donaldsharp in #21020
More Neighbor Fixes by @donaldsharp in #20934
yang: Correct pyang errors in frr-pim-candidate.yang by @y-bharath14 in #21030
zebra: fix stale remote vtep entries by @Manpreet-k0 in #20977
Bfd QoL improvements by @donaldsharp in #21004
ospf6d: clear local ifp per ECMP path rebuild by @florath in #21037
lib: add rbtree pop_final api by @mjstapp in #21034
doc: bgp: add entry for neighbor PEER soft-reconfiguration inbound by @kaffarell in #21009
Fix docker (Alpine) compilation by @ton31337 in #21042
tests: Fix wrong filename and description in test_srv6_locator.py by @cscarpitta in #21044
bgpd: Fix SRv6 SID/locator memory leak in SID notify handler by @cscarpitta in #21049
zebra: Add no prefix command for SRv6 locators by @cscarpitta in #21048
Some Yang work by @donaldsharp in #21027
bgpd: fix off-by-one error in FlowSpec operator array bounds check by @Jafaral in #21054
bgpd: Support brief option for show bgp neighbors command by @hnattamaisub in #20914
Docs: Document import vrf route-map NAME, several EVPN improvements by @robinchrist in #20714
bgpd: avoid premature memory allocation in subgroup_announce_check() by @enkechen-panw in #21005
bgpd: Add support for BGP-LS (RFC 9552) by @cscarpitta in #20470
bgpd: Fix BGP best path reasoning when using ECMPs with router-id by @ton31337 in #21052
tests: Convert lots of places to use run_and_expect by @donaldsharp in #20893
*: fix spell checks round 6 by @chiragshah6 in #21057
yang: Fix pyang errors in frr-ospf6-route-map.yang by @y-bharath14 in #20991
lib: fix zclient crash when many peers reconnect after FRR restart by @nick-bouliane in #21056
zebra: Remove neighbor table read on rule addition by @donaldsharp in #21053
bgpd: Fix integer truncation of SRLG count when parsing SRLG TLV by @cscarpitta in #21077
bgpd: Check if the NHC length is enough to fill TLV value + TLV header by @ton31337 in #21074
lib: fix vty_is_closed() falsely reporting VTY_SHELL as closed by @Manpreet-k0 in #21082
lib: use const in vty-is-shell apis by @mjstapp in #21094
bgpd: Fix integer truncation of count when parsing Route Tag TLV by @cscarpitta in #21078
ospfd: fix sequence number check, avoid truncation ambiguity by @Jafaral in #21096
bgpd: Fix late reverse-edge destination linkage in BGP-LS code by @cscarpitta in #21109
nhrpd: Correct addrlen check in os_recvmsg() by @csiltala in #21100
ldpd: improve tlv validation in several places by @mjstapp in #21118
PIM message-handling code fixes by @donaldsharp in #21093
bgpd: Fix issues in BGP-LS node/link/prefix origination by @cscarpitta in #21108
bgpd: fix errors in several paths by @mjstapp in #21101
bgpd: fix I/O thread spinning when peer input queue is full by @kzhang-amzn in #21028
tests: Ensure upstream IIF is in correct state after interface events by @donaldsharp in #21114
lib: fix crash in thread_process_io_inner_loop on stale epoll event by @Manpreet-k0 in #21124
tests: Slow down test_config.py to allow for processing time to happen by @donaldsharp in #21127
isisd: fix edge condition in max_lsp_count computation by @mjstapp in #21159
bgpd: Return 0 if AS4 capability is malformed by @ton31337 in #21112
bgpd: Prevent heap use-after-free for tunnel encapsulation attribute by @ton31337 in #21176
CI: fix node js deprecation warning, limit mergify backports github ci runs by @Jafaral in #21175
tests: fix grpc_basic xdist collection mismatch by @Jafaral in #21158
bfdd: harden packet validation and reflector handling by @Jafaral in #21105
isisd: fix memory leak in remove_excess_adjs() by @quentinbaradat in #21183
bgpd: include length in cluster_hash_cmp() by @enkechen-panw in #20988
bgpd: add config "nexthop prefer-global" for ipv6 address family by @enkechen-panw in #21099
isisd: Fix missing neighbor address Sub-TLVs after link-params change by @cscarpitta in #21204
bgpd: Free hostname for FQDN capability if the parsing goes wrong by @ton31337 in #21043
bgpd: Do not process route-refresh for AFI/SAFI if it's not negotiated by @ton31337 in #21210
bgpd: fix NHT for explicit link-local BGP peers by @soumyar-roy in #21188
zebra: fix missing vlan change by @anlancs in #20350
bgpd: Validate MP_REACH_NLRI attribute against incorrect next-hop by @ton31337 in #21075
bgpd: harden attribute parsing and packet handling in a few places by @ton31337 in #21095
nhrpd: harden against malformed packets by @Jafaral in #21097
bgpd: Return original as-path when reconciling AS versus AS4 by @ton31337 in #21113
tests: add EVPN VTEP cleanup and recovery test on uplink flap by @Manpreet-k0 in #21126
bgpd: improve packet parsing for EVPN and ENCAP/VNC by @mjstapp in #21098
bgpd: fix BGP_ATTR_NEXT_HOP flag handling in bgp_attr_default_set() by @enkechen-panw in #21166
[WIP] nhrpd: guard AFI/table lookups in route resolution by @Jafaral in #21187
bgpd: Fix route-map cleanup ordering in SRv6 unicast SID export by @cscarpitta in #21191
tests: bgp_suppress_duplicates: simplify and split into four tests by @enkechen-panw in #21203
ripd: fix data-handling in several places by @mjstapp in #21215
ripd: fix ip rip send/receive version command by @Shbinging in #18217
bgpd: Fix coverity defects in BGP-LS code by @cscarpitta in #21102
ripngd: fix data handling in several places by @mjstapp in #21217
bfdd: moving bfd socket allocation from static to dynamic by @sougatahitcs in #20854
bgpd: Check if we are not overusing error_data buffer when unknown cap received by @ton31337 in #21211
bgpd: backpressure generic framework by @chiragshah6 in #21192
vrrrpd: improve error handling in several paths by @mjstapp in #21251
bgpd: fix BNC cleanup for explicit link-local peers by @soumyar-roy in #21264
zebra: add debug in route install around nhg not ready by @chiragshah6 in #21265
zebra: Move allow-external-route-update to mgmt frontend side by @donaldsharp in #21276
Enable RFC8342 YANG NMDA functionality and add router-id oper-state that uses it. by @choppsv1 in #21065
zebra: lib: use old compatible value for lyd_new_term by @choppsv1 in #21281
bgpd: BGP-LS: add Prefix SID (TLV 1158) by @hedrok in #21076
tests: Fix wrong expectations in bgp_srv6_unicast topotest by @cscarpitta in #21284
bgpd: Fix SRv6 SID export route-map update not taking effect by @cscarpitta in #21283
bgpd: Fix incorrect comparisons in BGP-LS *_cmp() functions by @cscarpitta in #21285
pimd: In sparse-dense mode, treat a group as sparse if an RP is configured by @Jafaral in #21216
tests: Give more time for interface information to show up by @donaldsharp in #21278
bgpd: call init, term, copy LS attr admin_group by @mjstapp in #21289
zebra: fix spurious tag mismatch in rib_route_match_ctx() by @enkechen-panw in #21293
bgpd: add brief JSON for ipv4/ipv6 unicast loc-rib by @hnattamaisub in #21050
bgpd: brief JSON for L2VPN EVPN loc-rib by @hnattamaisub in #21019
ospfd, ospf6d: do not install routes for directly attached networks by @rzalamena in #20720
bgpd: Add SRv6 uDT46 SID support for GRT by @cscarpitta in #21041
Move import table around by @donaldsharp in #21068
bgpd: Fix a couple of issues in BGP-LS NLRI encoding/decoding by @cscarpitta in #21092
pceplib, pathd: improve pcep parsing and error-handling by @mjstapp in #21208
lib: fix swapped values, bad setsockopt, and intermittent test failure by @choppsv1 in #21214
bgpd: fix suppress-fib-pending blocking EVPN GR by @Manpreet-k0 in #21231
lib: also compare rmap source address when comparing nexthop source a… by @ak503 in #21233
bgpd: Fix BGP-LS initial TED sync and cleanup on peer deactivation by @cscarpitta in #21286
doc: Update json handling specification in workflow.rst by @donaldsharp in #21244
bgpd: flowspec foobar hardening by @ton31337 in #21308
Soumya/pim allowrp by @soumyar-roy in #20326
pceplib: validate during of_list TLV decoding by @mjstapp in #21310
bgpd: Revalidate locally originated routes against RPKI changes by @ton31337 in #21302
ospf6d: improve/harden packet processing by @mjstapp in #21277
Rpki fix and test improvements by @donaldsharp in #21315
pimd: fix crash due to double free by @Jafaral in #21354
eigrpd: improve validation and error-handling in tlv parsing by @mjstapp in #21316
bgpd: Verify if we correctly parsed BGP-LS attribute by @ton31337 in #21344
bgpd: More validations for labeled unicast and ENCAP attribute by @ton31337 in #21343
bgpd: Reset the stream to attr_start + attribute_len when WITHDRAWN by @ton31337 in #21351
ci: Adjust github workflows (actions) by @ton31337 in #21353
doc: document common daemon options and link -w references by @kaffarell in #21342
bgpd: A couple fixes for NLRI label parsing and flowspec decoding overflow by @ton31337 in #21340
doc: fix indentation error in pim doc by @mjstapp in #21373
bgpd: fix "use-after-free" for updgrp by @anlancs in #21081
bgpd: remove dest list from batch-clearing code by @mjstapp in #21382
bgpd: EVPN json brief optimization by @hnattamaisub in #21352
bgpd: Fix srv6 type parsing and EVPN type-5 NLRI prefix lengh parsing for IPv4 by @ton31337 in #21345
bgpd: Check if Local-Node and Remote-Node TLVs length is within boundaries by @ton31337 in #21349
bgpd: add additional attributes for evpn detail/ipv4/ipv6 detail json by @hnattamaisub in #21035
bgpd: display aggregate->count in show bgp detail for aggregate route by @enkechen-panw in #21309
isisd: improve validation of flex-algo decoder by @mjstapp in #21314
bgpd: Return an error for unknown flowspec component type by @ton31337 in #21350
bgpd: Modify early route processing to include send to zebra by @donaldsharp in #21357
pceplib: add validation to PCEP PST TLV decode by @mjstapp in #21372
bgpd: Fix memory leak for nhc attribute if ipv6 is link-local address by @ton31337 in #21377
tests: Fix time re in all_protocol_startup/test_all_protocol_startup by @hedrok in #21378
doc: fix BGP interface neighbor IPv4, IPv6, and v6only documentation by @nick-bouliane in #21383
zebra: EVPN prevent stale mbr_zifs entries from early return by @chiragshah6 in #21391
staticd: fix static_disable_vrf() to always send a route DELETE by @enkechen-panw in #21392
bgpd: Do not allocate stream if route-refresh capability is not received by @ton31337 in #21394
bgpd: Check dynamic capability action before validating ENHE capability by @ton31337 in #21395
bgpd: fix wrong overwritten for evpn by @anlancs in #21398
bgpd: Do not allow triggering route-refresh path with a malformed ORF length by @ton31337 in #21399
tools: Upgrade configuration to current format for Mergify by @ton31337 in #21409
topotests: split bgp_evpn_mh_v4_v6_num v4/v6 layout by @ashred-lnx in #21389
doc: fix SRv6 route commands by @iurmanj6WIND in #21416
pimd: guard channel OIL detach against stale pointers by @Jafaral in #21431
yang: Correct pyang errors in frr-pim-route-map.yang by @y-bharath14 in #21433
doc: fix SRv6 route commands (bis) by @iurmanj6WIND in #21432
bgpd: Fix copy-paste error in SRv6 DT46 SID duplicate install check (CID 1670455) by @cscarpitta in #21443
bgpd,lib,zebra: use explicit casts in tracepoint definitions by @mjstapp in #21438
bgpd: Skip oversized BGP-LS Node and Link Name TLVs by @cscarpitta in #21455
pimd: pim_inet4_dump -> %pI4s by @eqvinox in #21458
bgpd: Use %pI4/%pI6 formatters in BGP-LS NLRI display by @cscarpitta in #21456
bgpd: Fix wrong union member access in bgp_ls_nlri_display() by @cscarpitta in #21453
bgpd: Allow overriding "remote-as" per-neighbor by @ton31337 in #21450
zebra: remove kernel route on last address deletion by @hedrok in #19564
bfdd: avoid prefix-list memory allocation in bfd to solve oom issue by @sougatahitcs in #21073
watchfrr,tools: add --collect-core to core dump unresponsive daemon by @nishant111 in #21051
bgpd: remove unreachable json_paths free in evpn_show_all_routes() by @Jafaral in #21461
bfdd: bfd tx timeout topotest cleanup by @sougatahitcs in #21026
ripd,yang: log neighbor events by @rzalamena in #21442
ci: gate github-ci Build/Test jobs on non-doc paths; add HTML doc job by @Jafaral in #21475
Mgmt frontend problems in zebra by @donaldsharp in #21252
ospf6d: Remove ospf6 route when connected wins by @donaldsharp in #21476
pceplib: obj is already de-refed, no need to check for NULL by @donaldsharp in #21462
zebra: support brief json for show ip route command by @hnattamaisub in #20950
mgmtd: align commit config request argument order by @Babaijan in #21483
pceplib: ignore NULL obj in free_obj api by @mjstapp in #21487
staticd: fix static_cleanup_vrf() nexthop-VRF removal ordering by @enkechen-panw in #21413
bgpd: fix last Reset timer losing day part after 24 hours by @soumyar-roy in #21489
ospfd: add validation in several places before accessing message bodies by @mjstapp in #21303
pimd: fix NOCACHE MFC resync detection log, add vrf name too by @Jafaral in #21481
doc: refresh README with project links, badges, and contributor notes by @Jafaral in #21499
bgpd: Avoid unnecessary code path for brief command flow by @hnattamaisub in #21412
fix unnecessary BGP peer re-establishment in confederation by @wangdan1323 in #21439
Watchfrr phased restart by @donaldsharp in #21460
lib: mgmt: expose short-circuit bool as is_mgmtd by @choppsv1 in #21508
bgpd: Support established and failed options for show bgp neighbor co… by @hnattamaisub in #21066
zebra: add numMacs and numArpNd to L3 VNI detail output by @sougatahitcs in #21263
pimd: improve logging in a few places by @Jafaral in #21356
tests: clean up a build warning in a unit-test by @mjstapp in #21509
zebra: convert EVPN neigh hashes to typesafe (+.h cleanups) by @eqvinox in #21388
tests: Use abs_srcdir for tests. by @jkroonza in #21390
bgpd: add configurable advertisement delay for suppress-fib-pending by @deepak-singhal0408 in #21384
zebra: fix wrong hash count function call by @rzalamena in #21512
bgpd: Fix mixed remote-as for peer-groups when using auto by @ton31337 in #21406
bgpd: Don't mark nexthop as changed if a set next-hop unchanged is applied by @ton31337 in #21445
tests: update .gitignore for isis test by @mjstapp in #21530
tests: Check if IPv6 MTU change is triggering BGP updates correctly by @ton31337 in #21500
bgpd: PMSI tunnel attribute compatibility by @mjstapp in #21507
ospfd: add LSA validation in the apiserver path by @mjstapp in #21536
eigrpd: reject invalid prefix mask len by @mjstapp in #21539
eigrpd: enforce minimum TLV length in Hello handler by @TristanInSec in #21543
isisd: use correct min size values for srv6 subtlvs by @mjstapp in #21540
bgp_evpn: fix memleak when configuring rd by @lsang6WIND in #21566
bgpd: fix neighbor IP comparison for IPv6 memcmp return values by @hnattamaisub in #21559
bgpd: Replace the actual local-as when using replace-as with the confederation by @ton31337 in #21551
lib: northbound: distinguish unknown schema node from key mismatch by @reinaldosaraiva in #21534
bfdd: Move bfdproflist declaration to header by @pguibert6WIND in #21518
ospfd,tests: fix OSPF connected overlapping prefix bug by @rzalamena in #21510
bgpd: Print neighbor link type correctly according to local-as by @ton31337 in #21486
ospf6d: update auth sequence number after validating digest by @mjstapp in #21588
isisd: Preserve flags when copying SRv6 End SID sub-TLV by @cscarpitta in #21584
eigrpd: fix byte order in Hello authentication decode by @TristanInSec in #21545
lib: Report IPv6 MTU and not IPv4 for if_update_state_mtu6 by @ton31337 in #21501
bgpd: Prevent out-of-bound reading handling soft version dynamic capability by @ton31337 in #21602
bgpd: fix valgrind memory leaks on daemon shutdown by @soumyar-roy in #21511
isisd: continue hardening SRV6 tlv parsing by @mjstapp in #21585
Add new BGP SRv6L3VPN sid configuration test / Add associate test by @pguibert6WIND in #21386
bgpd: Dynamic capability parsing fixes by @ton31337 in #21603
nhrpd: stop debugging auth credentials by @mjstapp in #21615
bgpd: Consolidate redundant stream bounds checks in bgp_ls_decode_nlri by @cscarpitta in #21607
bgpd: Harden SRv6 Service Data parser for SID Structure length by @cscarpitta in #21612
bgpd: Clearly check for AS4 against 0 value by @ton31337 in #21610
isisd: consume leftover bytes after FAD sub-sub-TLV loop by @TristanInSec in #21544
bgpd: Prevent zero-length BGP-LS MT-ID TLV by @cscarpitta in #21600
bgpd: Reject BGP-LS Link NLRIs without Link Descriptor by @cscarpitta in #21609
tests: Remove show running bgpd from the topotests by @donaldsharp in #21629
Coverity cleanup some more items found by @donaldsharp in #21627
isisd: correct SRv6 End.X SID minimum size constants by @TristanInSec in #21541
bgpd: honor 'no activate' for dynamic neighbors in peer-group by @enissim in #21658
lib: mgmt: use SOMAXCONN for mgmtd socket listen backlog by @reinaldosaraiva in #21514
bgpd: Simplify BGP-LS NLRI TLV encoding by inlining helper functions by @cscarpitta in #21657
bgpd: migrate timers during peer_xfer_conn to fix stale route cleanup by @shashanka-ks in #21558
bgpd: Validate if NHC BGPID TLV value is non-zero by @ton31337 in #21611
isisd: Reject SRv6 Locator TLV with Loc-Size of zero by @cscarpitta in #21641
tests: bgp_suppress_fib was not stable before testing by @donaldsharp in #21649
bgpd: Do not allocate NHC TLV with an extra trailer by @ton31337 in #21606
bgpd: Avoid having a dangling pointer after we free NHC attribute by @ton31337 in #21605
bgpd: v4/v6 neigh advertised & received routes brief json by @hnattamaisub in #21411
tests: Update pytestmark value in scripts by @donaldsharp in #21684
static route bfd admin down state handling improvements by @sougatahitcs in #21400
bgpd: add advertisement-delay to hold route advertisements after startup by @karthikeyav in #21430
bgpd: Add support for BGP-LS for BGP fabric by @cscarpitta in #20726
tests: fix uptime check in test_bgp_default_originate_2links.py by @enkechen-panw in #21480
bgpd: Do not reject the route if confederation AS matches peer AS by @ton31337 in #21532
isisd: Use LAN End.X context for SRv6 sub-sub-TLV parsing by @cscarpitta in #21589
bgpd: Add BGP_AIGP_TLV_MIN_LEN constant to easily read what it is by @ton31337 in #21608
isisd: validate ASLA sub-sub-TLV length before consuming bytes by @TristanInSec in #21542
pimd: reject truncated IP datagrams before IGMP/mtrace handling by @Jafaral in #21705
lib: fix mgmt_msg recv to deal with mis-alignment by @choppsv1 in #21651
isisd: Reject duplicate SRv6 SID Structure Sub-Sub-TLV by @cscarpitta in #21656
Pim fixes in test by @donaldsharp in #21691
ospfd: Fix setting of type by @donaldsharp in #21712
pimd: cap PIM Hello secondary address list parsing by @Jafaral in #21707
tests: Ensure test_bgp_vpnv4_per_nexthop_label.py actually has a chance by @donaldsharp in #21699
zebra: fix EVPN MACIP DEL flag mixup in neighbor delete path by @nick-bouliane in #21733
bgpd: move auto config flag from bgp to srv6 unicast policy by @lsang6WIND in #21735
bgpd: Fixed crash in bgp received-routes detail json and code cleanup by @sougatahitcs in #20930
bgpd: Use BGP_LS_TLV_SET macro to set present_tlvs bits by @cscarpitta in #21604
BFD miscellaneous fixes by @pguibert6WIND in #21613
bgpd: Replace BGP_LS_TLV_* macros with standard FRR FLAG macros by @cscarpitta in #21755
nhrpd: improve validation in packet parsing by @mjstapp in #21686
pimd: harden BSM group/RP parsing paths by @Jafaral in #21734
pimd: fix crash in JP agg list due to stale upstream entry by @soumyar-roy in #21704
pimd: Provide better ordering for calling pim_upstream_use_rpt by @donaldsharp in #21764
bgpd: fix NHT for link-local nexthops from global-address peers by @soumyar-roy in #21687
bgpd: dynamic neighbors not up with md5 in non default vrf by @hnattamaisub in #21467
zebra: Fix incorrect update of 'nhe_received' in route_entry_update_nhe() by @GaladrielZhao in #21104
ospf6d: reinstall routes after zebra reconnect by @florath in #21011
Gre fixes by @pguibert6WIND in #21300
bgpd: Add json support for show bgp vrfs cmd by @sougatahitcs in #21485
bgpd: Add some defences for AS4/ENCAP handling by @ton31337 in #21777
add successful commit info msg by @choppsv1 in #21711
bgpd: fix aggregate->count undercount when dampening is cleared by @enkechen-panw in #21786
Bgp crashes by @donaldsharp in #21778
lib, isisd, bgpd: BGP-LS add several tlvs by @hedrok in #21376
tests: Remove invalid link-params command from BGP-LS topotest configs by @cscarpitta in #21793
*: consolidate sockopt_ apis in sockopt.c module by @mjstapp in #21746
tests: Add evpn pytestmark to tests that are missing by @donaldsharp in #21782
bgpd: fix shutdown crash by restricting evpn cleanup to owner instance by @soumyar-roy in #21698
ospf6d: packet- and auth-handling improvements by @mjstapp in #21783
pathd: add optional params to no cmd versions for frr-reload by @hedrok in #21710
tests: Fix zebra_vrf_netns topotest by @donaldsharp in #21741
*: Support gcc 15 by @mjstapp in #21812
zebra: fix memleak in ip import-table rmap by @chiragshah6 in #21811
Some more bgp connection rework by @donaldsharp in #21810
tests: Catch core dumps after teardown has completed by @donaldsharp in #21697
bgpd: fix aggregate->count not decremented when route is dampened by @enkechen-panw in #21787
zebra: Allow quick flaps of interfaces to be handled properly in next… by @donaldsharp in #21769
mgmtd: add periodic notify mode with mode/mode_data and FE test support by @ashred-lnx in #21253
bgpd: Treat malformed BGP-LS TLV as NLRI discard per RFC 9552 by @cscarpitta in #21827
tests: Fix invalid escape warning in BGP-LS test by @cscarpitta in #21829
tests: Fix invalid ISIS max-lsp-lifetime in BGP-LS configs by @cscarpitta in #21828
bgpd: Reject BGP-LS node/link names containing non-printable characters by @cscarpitta in #21825
tests: bgp_community_change_update: use receivedPrefixDup counter by @enkechen-panw in #21816
bgpd: fix aggregate->count errors in ZAPI route notifications by @enkechen-panw in #21789
bgpd: fix EVPN VRF auto RT deletion collision by @kaffarell in #21808
bgpd: set mp_nexthop_len consistently in subgroup_default_originate() by @enkechen-panw in #21840
staticd: nexthop identity as path-list key, and per-route metric by @enkechen-panw in #21296
bgpd: EVPN rd all or specific rd options based route table by @chiragshah6 in #21843
Startup after crash issues by @donaldsharp in #21550
bfdd: avoid close(-1) in bfd_dplane_finish_late by @sougatahitcs in #21841
Sockunion cmp wrong by @donaldsharp in #21833
bgpd: fix F-bit incorrectly set after port flap by @shashanka-ks in #21839
bgpd: enforce guards consistently at aggregate count entry points by @enkechen-panw in #21837
bgpd: send dynamic ENHE capability to peer-group members by @hnattamaisub in #21817
zebra: add json support for svd vxlan type by @sougatahitcs in #20886
bgpd: add detail json fields for v4/v6 neigh adver & recev routes by @sougatahitcs in #20951
docs: evpn: Add new Linux VXLAN Dataplane section by @robinchrist in #21664
zebra: align ctx nh cursor with RIB when skipping DUPLICATE nexthops by @hnattamaisub in #21709
pimd: validate PIM LAN sources and cap neighbors by @Jafaral in #21747
zebra: tear down old L3VNI before adding new one on VNI value change by @enissim in #21757
lib: bound masklen values, don't assert by @mjstapp in #21628
ospfd: add instance shutdown command by @rzalamena in #21759
bgpd: use bgp_node_match() instead of bgp_node_get() in aggregate count by @enkechen-panw in #21862
bgpd: Add BGP-LS Extensions for SRv6 (RFC 9514) by @cscarpitta in #21830
bgpd: warmboot failure when wfi enabled by @Manpreet-k0 in #21818
bgpd: Allow no network .... form for safi = EVPN or MPLS_VPN by @donaldsharp in #21860
bgpd: Skip route clearing for peers that were never established by @krishna-samy in #21867
bgpd: A couple link-state nits by @ton31337 in #21842
zebra: route EVPN FDB/neighbor reads through dplane by @rjarry in #21206
bgpd: add EVPN local RT-2 MAC+IP leaking to unicast by @louis-6wind in #20005
yang: allow match-metric value of zero by @mjstapp in #21888
*: don't use static char buffer in srv6 zapi code by @mjstapp in #21884
ospf6d: Fix command output for default route by @hedrok in #21886
bgpd: Remove redundant BGP-LS NLRI forward declarations by @cscarpitta in #21895
Memory leak problems. by @donaldsharp in #21844
debian: add pkg.frr.tcmalloc build profile for tcmalloc support by @rminnikanti in #21866
doc: fix spell check in developer and user rst guide by @chiragshah6 in #21901
bgpd: Reject malformed SRv6 End.X sub-TLV payloads with leftover bytes by @cscarpitta in #21904
zebra: Fix docstr mismatches in show ip route by @mhrn83 in #21865
Log file cleanup by @donaldsharp in #21907
bgpd: only use srv6_l3service attr if it's present by @mjstapp in #21916
bgpd: fix aggregate route not removed on de-configuration by @enkechen-panw in #21025
bgpd: Use ST token for BGP-LS STATIC protocol in NLRI output by @cscarpitta in #21909
bgpd: Fix incorrect BGP_PATH_MULTIPATH flag when route becomes invalid by @yuxuehong in #21106
tools: Add bfd commands to support bundle generation by @donaldsharp in #21914
pimd: Auto-RP hardening for discovery and announcements by @Jafaral in #21745
bgpd: Fix missing Multi-Topology ID in BGP-LS NLRIs by @cscarpitta in #21910
ospfd: Implement rfc4222 Recommendation 1 and 2 by @dfedyk in #20936
pimd: MLAG: skip pim_register_join on non-DR by @hnattamaisub in #21920
bgpd: validate SRV6 service sid transposition values by @mjstapp in #21903
bgpd: delete GR stale routes when nexthop becomes unreachable by @karthikeyav in #21742
bgpd: Initialize BGP-LS Node MSD only after parsing it by @cscarpitta in #21929
bgpd: Harden BGP-LS Node NLRI descriptor length validation by @cscarpitta in #21938
lib: add missing hook_unregister_arg in mgmt_be_client_destroy by @routingrocks in #21940
zebra: show nexthop-group rib brief json by @hnattamaisub in #20953
bgpd: support brief json for bgp v4 and v6 neighbors route by @hnattamaisub in #21414
lib,pceplib: fix DNS resolver and PCEP memory leaks by @jaredmauch in #20034
Tc dplane conversion by @donaldsharp in #21883
Fix event bugs in ldpd/lib and fix bgp_bmp misshandling of memory that leads to a crash by @donaldsharp in #21952
bgpd: Add route-map based allowas-in for flexible route filtering by @karthikeyav in #20659
pimd: Fix crash when up->channel_oil is NULL by @usrivastava-nvidia in #21961
zebra: Get link from the correct netns for vxlan by @leonshaw in #8895
ospfd: eliminate direct origination of Type-5 LSAs on NSSA routers by @rzalamena in #20894
zebra: fix EVPN zero-RMAC in some situations by @chdxD1 in #21448
bgpd: Move some optional feature-specific attributes from struct attr to struct attr_extra by @ton31337 in #21859
ospf6d: fix missing updating the global table by @anlancs in #21960
bgpd: cancel LLGR stale timer on peer AF delete by @Z-Yivon in #21947
topotests: Add a topotest for the no bgp client-to-client reflection command by @PierreNeltner6WIND in #21754
bgpd: limit GR-stale NHT-unreach delete to GR helper context by @karthikeyav in #21942
bgpd: cancel BFD strict hold timer on peer delete by @Z-Yivon in #21926
bgpd: skip stalepath-timer clear for LLGR-negotiated AFI/SAFIs by @hnattamaisub in #21932
*: small fixes roll-up pile by @eqvinox in #21957
lib: remove netns_other.c (unused) by @eqvinox in #21973
tests: Add VRF support for check_ping command by @ton31337 in #21753
bgpd: Fix missing SRv6 advertisement with distribute bgp-fabric-link-state by @cscarpitta in #21912
bgpd: Format IGP Router-ID in BGP-LS NLRI based on protocol by @cscarpitta in #21908
bgpd: Fix BGP-LS Attribute Node Name TLV by @cscarpitta in #21951
*: GCC 16 warnings by @eqvinox in #21985
bgpd: BGPd crash due to multiple bnc entry linked to same peer. by @usrivastava-nvidia in #21962
bgpd: preserve IPv6 nexthops when importing EVPN IPv4 routes by @kaffarell in #21958
ospfd: remove unnecessary space by @anlancs in #21979
bgpd: initialise nh_flag attribute by @fdumontet6WIND in #21498
bgpd: Check boundaries when parsing NHC and Prefix SID attributes by @ton31337 in #21981
bgpd: Fix GR helper retaining stale routes after Hard Reset by @selva-nexthop in #21823
tools: Revert 'no interface' when no configuration for interface left by @hedrok in #20378
ospfd: quick neighbor feature with BFD by @nabahr in #21784
ospf6d: only allow positive time strings by @jeremie6wind in #21928
bgpd: validate rfapi subtlv before accessing data octets by @mjstapp in #21974
zebra: clean up VRF handling by using dataplane provided vrf_id by @maxime-leroy in #20318
lib, zebra: bound SRv6 locator name length in ZAPI by @jamestiotio in #21868
bgpd: random format string fixes by @eqvinox in #21999
bgpd: fix AS-path routemap corruption and stale multipath on bestpath, fix tests by @donaldsharp in #21982
bgpd: Fix missing SRv6 unicast SID cleanup on locator delete by @cscarpitta in #21948
BFD authentication support by @pguibert6WIND in #21678
topotests: fix parallel run hangs (mutini teardown, ExaBGP FIFO, Docker hosts) by @Jafaral in https://github.com/FRRouting/frr/pull/22007
ci: fail topotest step when parallel run lacks JUnit failures by @Jafaral in https://github.com/FRRouting/frr/pull/22011
tests: Use show module to get bgp's pid by @donaldsharp in https://github.com/FRRouting/frr/pull/22023
lib: warn once when process fd limit is very large by @Jafaral in https://github.com/FRRouting/frr/pull/22031
pimd: fix shared-LAN (S,G) MFC loop and expand ssm topotest by @Jafaral in https://github.com/FRRouting/frr/pull/21998
ospfd: prevent stale LSA from corrupting local OSPF DB after reboot by @Jafaral in https://github.com/FRRouting/frr/pull/20601
pimd: add IGMP/MLD proxy route-map filtering by @Jafaral in https://github.com/FRRouting/frr/pull/21906
Fix keychain acceptance in BFD authentication by @donaldsharp in https://github.com/FRRouting/frr/pull/22028
bgpd: fix attr comparison when using attr_intern_reuse cache by @mjstapp in https://github.com/FRRouting/frr/pull/22008
bgpd: Fix stack overflow when debug printing label information & BMP code by @ton31337 in https://github.com/FRRouting/frr/pull/22056
bgpd: Move OTC and IPv6 extended community attributes to attr_extra by @ton31337 in https://github.com/FRRouting/frr/pull/22021
staticd: add 'show static routes' command by @kaffarell in https://github.com/FRRouting/frr/pull/21232
ripd: add full RTE bounds check to response/request processing loops by @DeadPackets in https://github.com/FRRouting/frr/pull/21889
pceplib: Validate lengths during object decoding by @mjstapp in https://github.com/FRRouting/frr/pull/22032
tests: fix flaky IGMP source baseline in pim_boundary_acl by @Jafaral in https://github.com/FRRouting/frr/pull/22055
pimd: move dense (S,G) to sparse mode when an RP is added by @Jafaral in https://github.com/FRRouting/frr/pull/20003
tests: harden bgp_conditional_advertisement_track_peer convergence waits by @Jafaral in https://github.com/FRRouting/frr/pull/22057
pimd: fix AutoRP stale RPs and selective multicast joins, add missing docs by @Jafaral in https://github.com/FRRouting/frr/pull/22039
bgpd: bmp: don't prepend local-AS to AS_PATH in BMP updates by @kalash-nexthop in https://github.com/FRRouting/frr/pull/21815
pimd,tests: refactor PIM join prune packet generation by @rzalamena in https://github.com/FRRouting/frr/pull/21795
zebra: fix neighbor entries ns_id by @louis-6wind in https://github.com/FRRouting/frr/pull/22034
Cleanup of memory allocation and usage of events by @donaldsharp in https://github.com/FRRouting/frr/pull/21943
zebra: fix DVNI route encap type for IPv6 VTEPs by @Manpreet-k0 in https://github.com/FRRouting/frr/pull/21911
No kernel nhg original by @donaldsharp in https://github.com/FRRouting/frr/pull/21893
bgpd: Fix use-after-free for ORF case by @ton31337 in https://github.com/FRRouting/frr/pull/22080
zebra: Track netlink carrier changes value by @donaldsharp in https://github.com/FRRouting/frr/pull/22084
In a removal operation do not allow a creation of the route_node in bgp by @donaldsharp in https://github.com/FRRouting/frr/pull/21878
bgpd: Move srte_color from attr struct to bgp_path_info_extra by @ton31337 in https://github.com/FRRouting/frr/pull/22059
Revert "bgpd: do not flag old best as multipath when it is also the n… by @donaldsharp in https://github.com/FRRouting/frr/pull/22095
bgpd: Move link_bw from attr_extra to bgp_path_info_extra by @ton31337 in https://github.com/FRRouting/frr/pull/22093
bgpd: Skip route-map LPM optimisation for AF_FLOWSPEC by @ton31337 in https://github.com/FRRouting/frr/pull/22083
bgpd: Fix infinite loop in MRT route dump for oversized paths by @ton31337 in https://github.com/FRRouting/frr/pull/22082
tests: reap mutini zombies and skip post-teardown support bundles by @Jafaral in https://github.com/FRRouting/frr/pull/22096
build, lib, zebra: OpenBSD fixes by @eqvinox in https://github.com/FRRouting/frr/pull/22009
tests: add multi-edit test with commit for mgmtd by @choppsv1 in https://github.com/FRRouting/frr/pull/22010
zebra: fix missing cleaning vni entry by @anlancs in https://github.com/FRRouting/frr/pull/22079
tests: fix grpc topotest xdist collection mismatch in CI by @Jafaral in https://github.com/FRRouting/frr/pull/22048
tests: harden topotest gcov coverage setup and reporting by @Jafaral in https://github.com/FRRouting/frr/pull/22104
Fix some topotest skipping problems by @donaldsharp in https://github.com/FRRouting/frr/pull/22113
pimd: fix AutoRP holdtime parsing and minor cleanup by @Jafaral in https://github.com/FRRouting/frr/pull/22120
docker: Add snmptrapd to list of thingies to install by @donaldsharp in https://github.com/FRRouting/frr/pull/22125
bgpd: Cleanup debug memory on shutdown by @donaldsharp in https://github.com/FRRouting/frr/pull/22123
tests: Remove unknown pytest.mark.tools by @donaldsharp in https://github.com/FRRouting/frr/pull/22114
bgpd: Add vrf name to more bestpath debugs by @donaldsharp in https://github.com/FRRouting/frr/pull/22124
tests: fix bgp_soo topotest by separating IPv4/IPv6 address families by @enkechen-panw in https://github.com/FRRouting/frr/pull/22128
yang: use relative path for remaining route-map when clauses by @enkechen-panw in https://github.com/FRRouting/frr/pull/22127
bgpd: refactor bgp_aggregate_{increment,decrement} by @enkechen-panw in https://github.com/FRRouting/frr/pull/22126
pimd: guard NULL RP lookups in BSM and RP deletion paths by @Jafaral in https://github.com/FRRouting/frr/pull/22131
pimd: fix mapping agent AutoRP discovery packet size by @Jafaral in https://github.com/FRRouting/frr/pull/22121
mgmtd: fix link order for libmgmt_be_nb by @enkechen-panw in https://github.com/FRRouting/frr/pull/22119
ospf6d: bypass MinLSArrival for self-originated MaxAge LSAs by @hnattamaisub in https://github.com/FRRouting/frr/pull/22103
lib: test the right bytes in flowspec prefixes by @mjstapp in https://github.com/FRRouting/frr/pull/22138
bgpd: remove unneeded sort of communities in rmap delete by @mjstapp in https://github.com/FRRouting/frr/pull/22151
pimd: fix BSR failover RP not setting i_am_rp locally by @Jafaral in https://github.com/FRRouting/frr/pull/22157
bgpd: reorder parameters in bgp_remove_route_from_aggregate() by @enkechen-panw in https://github.com/FRRouting/frr/pull/22136
zebra: fix wrong comparision for nexthop by @anlancs in https://github.com/FRRouting/frr/pull/21503
bgpd: Set extended flag for NHC attribute when re-encoding by @ton31337 in https://github.com/FRRouting/frr/pull/22159
pimd: dense mode fixes and topotest coverage by @Jafaral in https://github.com/FRRouting/frr/pull/22115
pimd: BSR/C-RP fixes with expanded topotest coverage by @Jafaral in https://github.com/FRRouting/frr/pull/22117
bgpd: Avoid cluster list attribute truncation by @ton31337 in https://github.com/FRRouting/frr/pull/22081
pimd: fix multicast boundary list lifetime and ACL evaluation by @Jafaral in https://github.com/FRRouting/frr/pull/22122
bgpd: Fixes in comm/lcomm/ecomm str functions by @mjstapp in https://github.com/FRRouting/frr/pull/22176
bgpd: comment style modifications for verify source test by @PierreNeltner6WIND in https://github.com/FRRouting/frr/pull/22112
yang: Prefix mismatch in frr-zebra.yang by @y-bharath14 in https://github.com/FRRouting/frr/pull/22189
bgpd: Fix stale EVPN type-5 route for suppressed prefix during L3VNI bounce by @raja-rajasekar in https://github.com/FRRouting/frr/pull/21992
pimd: defer static mroute install until interfaces are ready by @Jafaral in https://github.com/FRRouting/frr/pull/22156
pimd: fix dense mode State Refresh relay forwarding by @Jafaral in https://github.com/FRRouting/frr/pull/22177
ospf: fix the return value for the invalid VRF name by @SindhuParvathi-Gopi in https://github.com/FRRouting/frr/pull/22161
bgpd: free srv6_l3service object in failed parse path by @mjstapp in https://github.com/FRRouting/frr/pull/22198
zebra: EVPN clean up stale L2 NH/NHG from kernel at startup by @Manpreet-k0 in https://github.com/FRRouting/frr/pull/22002
ospfd: validate extended prefix TLV before accessing prefix SID by @mjstapp in https://github.com/FRRouting/frr/pull/22215
bgpd: Limit as-path segments up to 255 by @ton31337 in https://github.com/FRRouting/frr/pull/22212
bgpd: Clearly put 4-bytes when encoding SAFI_FLOWSPEC MP_REACH msg by @ton31337 in https://github.com/FRRouting/frr/pull/22213
pimd: fix heap OOB write in BSM fragmenter by @Jafaral in https://github.com/FRRouting/frr/pull/22222
lib: use XSTRDUP/XFREE for yang_data value field by @enkechen-panw in https://github.com/FRRouting/frr/pull/22196
staticd: avoid XPath set_sort in ecmp_path_list_validate by @enkechen-panw in https://github.com/FRRouting/frr/pull/22118
zebra: Allow rnh evaluation for a queued and !installed rn by @donaldsharp in https://github.com/FRRouting/frr/pull/22221
ospfd: Validate PREFIX_SID subtlv len before accessing by @mjstapp in https://github.com/FRRouting/frr/pull/22218
bfdd: fix show bfd peers brief json output identical to show bfd peers by @JackeySparrow in https://github.com/FRRouting/frr/pull/22064
bgpd: Fix community string truncation for big community sets by @ton31337 in https://github.com/FRRouting/frr/pull/22160
zebra: remove unused struct buf_req by @iurmanj6WIND in https://github.com/FRRouting/frr/pull/22242
pimd: fix wrong endian convertion by @anlancs in https://github.com/FRRouting/frr/pull/22244
yang: inet type mismatch in frr-bfdd.yang by @y-bharath14 in https://github.com/FRRouting/frr/pull/22241
lib: Some smaller code fixes for typesafe hash _member function by @robinchrist in https://github.com/FRRouting/frr/pull/22233
bgpd: fix local rt2 mac+ip leak race conditions by @louis-6wind in https://github.com/FRRouting/frr/pull/21967
zebra: add dplane helpers to provide interface speed by @maxime-leroy in https://github.com/FRRouting/frr/pull/19412
bgpd: add LLGR to capability length validation switch by @guoguojia2021 in https://github.com/FRRouting/frr/pull/22249
bgpd: fixes for NH and aggregator attribute parsing by @mjstapp in https://github.com/FRRouting/frr/pull/22200
bgpd: remove duplicate snprintf in FlowSpec redirect VRF display by @guoguojia2021 in https://github.com/FRRouting/frr/pull/22272
bgpd: fix return NULL in bool function ecommunity_node_target_match by @guoguojia2021 in https://github.com/FRRouting/frr/pull/22273
eigrpd: fix out-of-bounds reads in SHA256 digest computation by @arshsmith in https://github.com/FRRouting/frr/pull/22271
bgpd: fix holdtime_ptr unsafe pointer aliasing in OPEN receive path by @guoguojia2021 in https://github.com/FRRouting/frr/pull/22270
Network Byte Order Fixes for Little Endian Machines by @donaldsharp in https://github.com/FRRouting/frr/pull/22251
bgpd: skip peers not activated for AFI/SAFI in bgp_gr_check_all_eors() (backport #22295) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22302
bgpd: Fix extended optional parameters handling in OPEN message (backport #22308) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22321
pceplib: slightly relax a pcep object validation (backport #22298) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22309
tools: Use the topotest log directory instead of /tmp (backport #22315) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22326
pceplib: add length validation for pcep obj decoders (backport #22318) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22335
zebra: bump dplane major version for 10.7 by @mjstapp in https://github.com/FRRouting/frr/pull/22337
Also build for linux/riscv64 on release (backport #22256) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22341
tools: Normalize aggregate-address command when doing frr-reload (backport #22284) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22344
bgpd,tests: improve validation of incoming oid arrays (backport #22116) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22379
tests, tools: Shutdown daemons in tests same order in systemd (backport #22314) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22382
tools: Fix frr-reload.py crashes with UnboundLocalError (backport #22378) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22386
pimd: use RFC 3973 dm graft retry period for retransmission (backport #22376) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22389
tests: Fix bgp conditional advertisement test to ensure route is received (backport #22327) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22384
bgpd: don't advertise LLGR stale routes to non-LLGR peers (backport #22297) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22400
tests: load frr.conf by default (backport #22398) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22415
bgpd: reduce ibuf_scratch size to match ibuf_work (backport #22347) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22393
pimd: run Assert for dense mode wrong-interface handling (backport #22377) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22424
pimd: compensate for missing WRVIFWHOLE upcall on old kernels (backport #22240) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22395
bgpd: fix strlcat/strlcpy size parameter in NOTIFICATION send path (backport #22279) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22431
Add restart_frr, document topotest router and daemon restart helpers (backport #22399) by @Jafaral in https://github.com/FRRouting/frr/pull/22435
yang: Swapped RPF lookup mode descriptions (backport #22375) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22437
doc, tests: require frr.conf and load_frr_config() in new topotests (backport #22420) by @Jafaral in https://github.com/FRRouting/frr/pull/22436
debian, redhat: 10.7.0 release preparation by @Jafaral in https://github.com/FRRouting/frr/pull/22438
bgpd: Ignore parsing ORF route-refresh messages (backport #22429) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22455
ospf6d: log KillNbr adjacency changes on interface down (backport #22459) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22462
pimd: fix BSR_PENDING timer being overwritten by BS liveness timer (backport #22460) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22463
Revert #20005 for stable/10.7 only by @ton31337 in https://github.com/FRRouting/frr/pull/22471
pimd: fix NOCACHE forwarding for non-connected sources and static mroute upcalls (backport #22466) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22487
pimd: fix elected BSR not updating when priority changes (backport #22465) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22477
bgpd: fix bmp connect deletion with source-interface (backport #22469) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22508
bgpd: Do not accept AIGP for OAD peers if not enabled (backport #22519) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22525
Merge pull request #22423 from rdemsystems/fix/bgp-extended-message-r… by @rdemsystems in https://github.com/FRRouting/frr/pull/22545
ospf6d: check length before accessing grace LSA TLVs (backport #22539) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22556
ldpd: check fec elem length before accessing (backport #22537) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22559
pimd: fix C-RP processing crash during BSR_PENDING state (backport #22467) by @Jafaral in https://github.com/FRRouting/frr/pull/22566
pimd: MLAG: gate FHR flag on DR check in wrvifwhole/wholepkt upcalls (backport #22529) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22572
*: fix overflow in comparator functions used by sorted containers (backport #22498) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22574
pimd: fix stack overflow and IGMPv3 fragmentation in group_retransmit_sources (backport #21047) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22604
pimd: clean stale upstream NHT tracking on RP delete (backport #22505) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22605
pimd: prefer kernel ingress on WRONGVIF when MFC iif is stale (backport #22607) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22624
lib: Print multicast-source-interface rmap match (backport #22612) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22618
pimd: allow WRONGVIF prefer-ingress with (*,G)-only ifchannel (backport #22626) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22641
bgpd: anchor parsed attr in bgp_nlri_parse_vpn to preserve srv6_l3service (backport #22492) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22620
Missing show run output (backport #22619) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22644
bgpd: fix const-qualifier build error with strrchr (backport #22642) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22647
pimd: do not proxy IGMP leave while other downstream receivers remain (backport #22622) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22658
pimd: defer join-group socket joins until the interface exists (backport #22634) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22668
bgpd: Validate NEXT_HOP attribute if we have NLRIs and MP_REACH_ATTR (backport #22637) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22660
pimd: avoid stale RPF ifp during vrf/interface events (backport #22650) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22669
bgpd: don't emit "no neighbor X capability link-local" for unnumbered… (backport #22540) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22664
10.6.1
What's Changed
doc: fix indentation error in pim doc (backport #21373)
Fix/bgp hardening backports 10.6
isisd: improve validation of flex-algo decoder (backport #21314)
bgpd: Do not allocate stream if route-refresh capability is not received (backport #21394)
bgpd: Check dynamic capability action before validating ENHE capability (backport #21395)
bgpd: Do not allow triggering route-refresh path with a malformed ORF length (backport #21399)
pimd: guard channel OIL detach against stale pointers (backport #21431)
ospfd: add validation in several places before accessing message bodies (backport #21303)
pimd: fix NOCACHE MFC resync detection log, add vrf name too (backport #21481)
bgpd: Fix mixed remote-as for peer-groups when using auto (backport #21406)
bgpd: Don't mark nexthop as changed if a set next-hop unchanged is applied (backport #21445)
ospfd: add LSA validation in the apiserver path (backport #21536)
eigrpd: reject invalid prefix mask len (backport #21539)
eigrpd: enforce minimum TLV length in Hello handler (backport #21543)
isisd: use correct min size values for srv6 subtlvs (backport #21540)
bgpd: fix neighbor IP comparison for IPv6 memcmp return values (backport #21559)
bgp_evpn: fix memleak when configuring rd (backport #21566)
eigrpd: fix byte order in Hello authentication decode (backport #21545)
lib: Report IPv6 MTU and not IPv4 for if_update_state_mtu6 (backport #21501)
bgpd: Prevent out-of-bound reading handling soft version dynamic capability (backport #21602)
isisd: continue hardening SRV6 tlv parsing (backport #21585)
bgpd: Dynamic capability parsing fixes (backport #21603)
isisd: consume leftover bytes after FAD sub-sub-TLV loop (backport #21544)
bgpd: Harden SRv6 Service Data parser for SID Structure length (backport #21612)
nhrpd: stop debugging auth credentials (backport #21615)
bgpd: honor 'no activate' for dynamic neighbors in peer-group (backport #21658)
bgpd: migrate timers during peer_xfer_conn to fix stale route cleanup (backport #21558)
isisd: correct SRv6 End.X SID minimum size constants (backport #21541)
isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641)
bgpd: Validate if NHC BGPID TLV value is non-zero (backport #21611)
bgpd: Check if BGPID NHC TLV exists when IPv6 next-hop is link-local (backport #21377, #21605, #21611)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/packages/frr | 3 +++
lfs/frr | 6 +++---
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/config/rootfiles/packages/frr b/config/rootfiles/packages/frr
index 84a3753e6..cce3d9983 100644
--- a/config/rootfiles/packages/frr
+++ b/config/rootfiles/packages/frr
@@ -15,6 +15,7 @@ usr/bin/vtysh
#usr/include/frr/lib/assert
#usr/include/frr/lib/assert/assert.h
#usr/include/frr/lib/atomlist.h
+#usr/include/frr/lib/atomptr.h
#usr/include/frr/lib/base64.h
#usr/include/frr/lib/bfd.h
#usr/include/frr/lib/bitfield.h
@@ -184,6 +185,7 @@ usr/bin/vtysh
#usr/include/frr/zebra/zebra_dplane.h
#usr/include/frr/zebra/zebra_errors.h
#usr/include/frr/zebra/zebra_evpn.h
+#usr/include/frr/zebra/zebra_evpn_base.h
#usr/include/frr/zebra/zebra_evpn_mac.h
#usr/include/frr/zebra/zebra_evpn_mh.h
#usr/include/frr/zebra/zebra_evpn_neigh.h
@@ -303,6 +305,7 @@ usr/sbin/zebra
#usr/share/yang/frr-route-types.yang
#usr/share/yang/frr-routing.yang
#usr/share/yang/frr-staticd.yang
+#usr/share/yang/frr-test-config.yang
#usr/share/yang/frr-test-module.yang
#usr/share/yang/frr-vrf.yang
#usr/share/yang/frr-vrrpd.yang
diff --git a/lfs/frr b/lfs/frr
index 4757a8544..0188d5e8f 100644
--- a/lfs/frr
+++ b/lfs/frr
@@ -26,7 +26,7 @@ include Config
SUMMARY = FRRouting Routing daemon
-VER = 10.6.0
+VER = 10.7.0
THISAPP = frr-frr-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = frr
-PAK_VER = 17
+PAK_VER = 18
DEPS =
@@ -50,7 +50,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = ed90d54b832cb041cbc0e5bf833472ab2434b0b5fa0dfa89e56da6d6fae6cca272d6419b8004b1861469c4d2aeaee7d2858cfc148ec1d1313f5d41172fe46ead
+$(DL_FILE)_BLAKE2 = 4adc266bb68788d084986ec5ada3aff2f8cee29203556340932930f8232b217ca649d126b982e03f8c7f82144ef6efed29eea2055d32d08cde242c52c6acca89
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH] haproxy: Update to version 3.4.3
2026-08-08 13:07 [PATCH] fort-validator: Update to version 1.6.8 Adolf Belka
2026-08-08 13:07 ` [PATCH] frr: Update to version 10.7.0 Adolf Belka
@ 2026-08-08 13:07 ` Adolf Belka
1 sibling, 0 replies; 3+ messages in thread
From: Adolf Belka @ 2026-08-08 13:07 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 3.4.2 to 3.4.3
- No change in rootfile
- Changelog
3.4.3
This release contains one important fix and a handful of security hardening
fixes reported by Red Hat/AISLE Research and others, on top of the usual set
of bug fixes.
* ssl/ocsp: An issue about missing lock was fixed.
The OCSP stapling callback read the cached OCSP response buffer without
any lock, while the buffer can be freed and replaced at any moment by a
"set ssl ocsp-response" CLI command, the ocsp-update task, or a reload. A
concurrent update could either crash the worker (use-after-free) or leak
freed/reused heap contents to a remote client requesting the stapled
response. The reads are now protected by the existing OCSP tree lock. This
was reported and fixes by Matt Suiche from Tolmo Inc.
* QUIC/H3 : Three bugs were fixed around QUIC/H3 stream shutdown and error
handling.
A parser desync could occur when an H3 error was detected in the middle of
a multi-frame buffer, causing the caller to remove only part of the data
and restart parsing at a wrong offset, which usually produced a new,
unrelated error or an unwarranted full connection closure. A QCS instance
could also be wrongly freed if a STOP_SENDING was still scheduled for it,
most impactful on the backend side where a server could keep emitting data
on a stream haproxy already considered closed. Finally, shutting down a
stream's read side (e.g. an aborted request) did not always send a
STOP_SENDING to the peer, so a server backend could keep sending data for
a request haproxy no longer cared about.
* fd: A deadlock when closing file descriptors of other thread groups was
fixed.
Destroying a listener while holding the listener lock could deadlock when
it needed to close an fd belonging to another thread group and another
thread was waiting on the same listener lock. This was easier to reproduce
with a suspend/resume loop on ABNS sockets. The fd is now closed using a
reference-counting scheme instead of thread isolation, avoiding the
deadlock.
* tcpcheck: The internal proxy used to parse "healthcheck" sections was not
added to the proxies list, so its initialization was not fully finalized;
this notably broke some arguments such as regular expressions and could
lead to crashes because of a NULL pointer dereference at runtime.
* applet: An issue leading to a stale task expiration date was fixed.
When an applet was waiting for a connection (e.g. the Lua Socket applet)
and reads were re-enabled once the connection became available, this was
usually done from the connection's context, so the applet's task
expiration date was not refreshed. With small timeouts this could cause
the task to appear scheduled in the past, triggering a BUG_ON() in
sc_notify(). This was fixed by moving the changes in the applet's context.
Related to this issue, a bug about lua cosockets was fixed. the Lua
cosocket timeout being applied on the wrong side. It was applied to both
the client and server sides, while it must only apply to the server side.
* stats: Two issues about the stats page, reported by Red Hat/AISLE
Research, were fixed.
Proxies updated through the stats page while in "stats admin" mode were
not subject to the "stats scope" filtering, meaning a scope meant to
restrict which proxies are visible/actionable could be silently bypassed
on POST requests.
Separately, POST requests to the stats interface did not validate that the
Origin (or Referer) header matched the Host, which is now checked to
mitigate CSRF attacks.
* cache: A leak preventing the cache from reserving rows under "Vary" was
fixed.
When a secondary cache entry matching a request with a "Vary" header was
still incomplete (being written by another stream), the request was
forwarded without reattaching its row to the available list, leaking
it. Over a Vary-heavy workload this eventually exhausted the cache and
prevented any further row reservation.
* ssl-gencert: A memory leak on every certificate generation was fixed.
Two temporary buffers were not freed after generating a certificate on the
fly, leaking memory each time a new SNI triggered certificate
generation. This issue was reported by Red Hat/AISLE Research.
* sample/protobuf/net-helper: buffer overflows after pointer-shift
converters, reported by Red Hat/AISLE Research and Charles Vosburgh, were
fixed.
Several converters (protobuf/ungrpc field extraction, eth.data, eth.src,
ip.data, bytes(), ltrim()) move the sample's data pointer forward on
success but did not shrink the sample's recorded buffer capacity
accordingly. A converter chained afterwards that relies on that capacity
(e.g. padding via memset()) could then write past the end of the buffer,
leading to heap corruption or a worker crash. All the affected converters
now adjust the capacity together with the pointer.
* protobuf: A nested-path validation bypass reported by Red Hat/AISLE
Research was fixed.
The protobuf field lookup used for the protobuf()/ungrpc() converters did
not strictly enforce hierarchical boundaries, so a flat sibling field
could incorrectly satisfy a nested-path lookup (e.g. matching a root-level
field as if it were nested under a parent). The lookup was rewritten as a
strict, non-recursive path walker that correctly bounds each nesting
level.
Separately, a crash because of deprecated protobuf group wire types was
fixed. These wire types are now explicitly rejected.
* proxy/server: Some CLI commands dumping info were not protected against
concurrent proxy/server/backend deletion.
"show servers conn/state", "show backend" and "show errors" all loop over
lists of proxies or servers and may yield in case of a large output; if
the entry the dump was paused on got deleted (e.g. via dynamic
backend/server removal) in the meantime, the worker could crash on
restart. These commands now rely on the existing watcher mechanism,
already used by "show stat", to survive concurrent deletion.
Separately, the check refusing to delete a server still attached to
streams was not exhaustive: two paths (a failed connection attempt still
referencing the server, and cookie persistence set very early) were not
covered by the existing counters, allowing a server to be deleted while
still referenced. A new per-thread-group stream counter now tracks this
reliably.
* ssl: A kTLS splicing regression and a wrongly typo'd macro were fixed.
A wrong macro name (USE_VANILLA_OPENSSL instead of HAVE_VANILLA_OPENSSL)
could let kTLS start splicing while data was still pending in OpenSSL's
internal buffers, causing data not to be properly read.
Separately, when kTLS splicing received a non-application-data record
(e.g. a TLSv1.3 KeyUpdate), splicing failed outright instead of falling
back to a regular recvmsg() long enough to consume the record and resume
splicing afterwards.
* mux-h1: The case of header names were not being adjusted on some outgoing
messages.
When a map was configured to adjust the case of some header names for
legacy applications, it was not applied to the low-level error messages
generated during th request parsing. And for all other messages,
"Sec-Websocket-Key" and "Sec-Websocket-Accept" headers, inserted by the H1
multiplexer, were also concerned.
* http-fetch: Two crashes reachable from health-check configurations were
fixed.
"res.body"/"res.hdr"/... and similar response fetches assumed the
health-check receive buffer always held an HTX message, which is only true
for actual HTTP checks; on a plain TCP check, a hostile/misbehaving server
could craft the first bytes of its reply to be misinterpreted as HTX
internal fields, causing a wild read and worker crash (or leaking
arbitrary process memory).
Separately, "capture.req.hdr"/"capture.res.hdr" only validated the upper
bound of their index argument, so a negative capture id was accepted at
boot and dereferenced an out-of-bounds array entry at runtime, crashing
the worker on the very first request.
* tools: Converter to encode URLs was fixed to avoid silent truncation.
encode_chunk(), used among others by the url_enc converter and OCSP
encoding, used to silently truncate its output when the destination was
too small, which could produce a partially-encoded URL. It can now fail
explicitly instead; the url_enc converter and OCSP code were updated
accordingly.
* slz: Several issues were fixed in the SLZ library.
A stream alternating many literals in the 144-255 range with cheap
back-references could keep inflating indefinitely instead of falling
back to a stored block, exceeding the library's documented worst-case
output size by several percent. A new accounting mechanism now bounds
this overhead. Practical impact on haproxy requires tune.bufsize above
~43 kB with the default reserve.
Five small correctness fixes inherited from upstream libslz were also
backported: Avoid reading up to a few bytes past the end of very short
inputs on architectures without fast unaligned access; stop appending an
extra, misplaced block to an already-finished deflate/gzip/zlib stream
(which could corrupt the trailing checksum in ~2% of fuzzed streams); fix
the Adler32 checksum accumulator sign handling on 32-bit systems
(affecting the zlib format only); avoid an undefined-behaviour signed left
shift when assembling input words byte by byte; and use the exact bit cost
when deciding whether to emit the last literals of a block as a stored
block, avoiding compressed output slightly larger than the documented
worst case.
* peers: A heap overflow when replicating large stick-table dictionary
entries was fixed.
peer_prepare_updatemsg() never verified that a stick-table entry's
dictionary value (e.g. server_key, up to ~16 kB) actually fit in the
update message being built. Since the peers protocol is plain-text and
unauthenticated, a rogue or compromised peer could plant an oversized
entry that overflows the 16 kB trash buffer as soon as the victim
replicates ("teaches") it, confirmed as a heap-buffer-overflow write. The
function now checks the available room before encoding and fails clea nly
if it doesn't fit. This was reported and fixes by Matt Suiche from Tolmo
Inc.
* chunk: The code was reviewed to avoid retrieving a large trash buffer by
mistake.
All call sites of the trash-chunk allocation helpers were reviewed to make
sure a large buffer is only handed out when the caller's own buffer is
already large and genuinely needs it, preventing unexpected extra memory
usage. Several call sites were switched to the new
get_best_trash_chunk()/alloc_best_trash_chunk() helpers.
* resolvers: Possible conflicts between the internal backend used for the
"default" resolvers sections and regular backends with the same name were
fixed.
Since a "default" resolvers section is now created automatically, a
same-named internal TCP backend proxy also appeared, and a config using
"default_backend default" could either fail with a confusing "mode"
error or silently route real traffic to the internal resolvers backend.
Resolvers no longer need to be looked up by name in the proxies index,
so they are no longer indexed there. Fixes GitHub issue #3445.
* server-template: Duplicated entries created from a "server-template" line
did not properly inherit several settings that are only initialized once
for the base line by srv_settings_init().
The <alt_proto> field, used to select an alternative protocol such as
MPTCP, was not copied to server-template duplicates, resulting in the
wrong protocol being selected on connect. The "check-reuse-pool" flag,
forcefully enabled for rHTTP servers, was not propagated either, causing
health checks to always fail on rHTTP server-template entries. And the
QUIC transport was never set up for these duplicates at all, since it was
only performed in _srv_parse_init(), preventing any QUIC communication on
server-template entries with a quic4/6 address. All three settings are now
properly duplicated/initialized in srv_settings_cpy(), or moved to a
callback that also runs for duplicates. A related improvement makes
parsing error messages usable for server-template lines, which used to
show "server-template be/(null)" instead of the template's name.
* cebtree: A bug in the duplicate-key detection of the lookup shortcut was
fixed.
It could make a lookup return the wrong entry among a list of duplicates,
or make the walk to the previous/next duplicate fail to find it, as soon
as the tree was deep enough to enter the shortcut path. This affects the
cebis_tree used since 3.3 to index server names (conf.name), where it
could sometimes let a duplicate server name go undetected.
And, as usual, the bunch of minor fixes here and there, mainly raised during
AI-assisted code reviews. Most were never noticed:
* HTX API: Some bugs about how the HTX API was used were fixed here and
there.
* http-act: Double-frees and a couple of state bugs on parsing errors were
fixed.
* http-fetch/http/http-ana/http-htx: Few out-of-bounds reads and a missing
NULL/allocation check were fixed.
* h1: The right error offset is now reported for an authority/Host mismatch
when "accept-unsafe-violations-in-http-request" option is enabled
* http-conv: The last input character could be lost when calling url-dec
converter, when the input buffer was full. This was fixed by failing the
converter in that case.
* http-rules: A crash on error path when parsing "set-cookie-fmt" redirect
rule was fixed.
* mux-h1: An extra 200ms delay was observed on some H2-to-H1 messages
because the end of the message was not always properly detected. This case
is now properly handled.
* sample: Two edge cases in be2hex() and bytes() were fixed.
* shctx: An issue in the shctx was fixed. This notably broke revalidation of
cached responses whose ETag was stored beyond the first block, causing a
full 200 response to be served instead of a 304.
* ssl: "show ssl sni -f <frontend>" command was silently falling back to the
first proxy when the given frontend did not exist. An error is now
reported.
* stream: Custom per-request timeouts/retries set on listeners via
"set-timeout" and "set-retries" action are now preserved, except when the
stream is routed to a diffent backend. The configuration manual was
updated to document this case.
Otherwise, two changes were backported:
* htx: To avoid trouble with large buffers, it is no longer possible to
handle HTTP headers exceeding the size of a regular buffer. It is
mandatory to avoid interoperability issues with H2 and H3.
* ssl: tune.ssl.keyupdate-rate-limit global directive was added to mitigate
costly TLSv1.3 KeyUpdate floods.
Processing a TLSv1.3 KeyUpdate is CPU-expensive and there is normally
little reason to receive many of them. This new tunable caps the number
of KeyUpdates accepted per second (default 100, 0 disables the limit).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
lfs/haproxy | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/lfs/haproxy b/lfs/haproxy
index 8004ef479..030219275 100644
--- a/lfs/haproxy
+++ b/lfs/haproxy
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -26,7 +26,7 @@ include Config
SUMMARY = The Reliable, High Performance TCP/HTTP Load Balancer
-VER = 3.4.2
+VER = 3.4.3
# From: https://www.haproxy.org/download/
@@ -36,7 +36,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = haproxy
-PAK_VER = 35
+PAK_VER = 36
DEPS =
@@ -54,7 +54,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = a6f5c1d84d2c0082fd40792edbf97477499703c062b58de794db874bcab9f62b2df792c3fbde88196f8c7412d0d5b8cbbe0e38197caa817cac071cad3bab1e9a
+$(DL_FILE)_BLAKE2 = 75e8edf463e1e9a53a17aee51ef5995c800fe8e1bc043bb08aee55eb528b937f382f2488a8c7e155bbe5fad979c268cbc427d9317ef2bc9ac117940e7ac5bdd0
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 3+ messages in thread