File 0006-isisd-fix-10505-using-base64-encoding.patch of Package frr

Overview Repositories Revisions Requests Users Attributes Meta

File 0006-isisd-fix-10505-using-base64-encoding.patch of Package frr (Revision 80bb841138c12123bbb7c1fb60b34e8a)

Currently displaying revision 80bb841138c12123bbb7c1fb60b34e8a , Show latest

From ac3133450de12ba86c051265fc0f1b12bc57b40c Mon Sep 17 00:00:00 2001
From: whichbug <whichbug@github.com>
Date: Thu, 10 Feb 2022 22:49:41 -0500
Upstream: yes
References: bsc#1196506,CVE-2022-26126
Subject: [PATCH] isisd: fix #10505 using base64 encoding

Backport of the patch to frr-7.4 by Marius Tomaschewski <mt@suse.com>

Using base64 instead of the raw string to encode
the binary data.

Signed-off-by: whichbug <whichbug@github.com>

diff --git a/isisd/isis_nb.h b/isisd/isis_nb.h
index 58f6c3892..c2f727154 100644
--- a/isisd/isis_nb.h
+++ b/isisd/isis_nb.h
@@ -419,29 +419,33 @@ void isis_notif_lsp_exceed_max(const struct isis_area *area,
 			       const char *lsp_id);
 void isis_notif_max_area_addr_mismatch(const struct isis_circuit *circuit,
 				       uint8_t max_area_addrs,
-				       const char *raw_pdu);
+				       const char *raw_pdu, size_t raw_pdu_len);
 void isis_notif_authentication_type_failure(const struct isis_circuit *circuit,
-					    const char *raw_pdu);
+					    const char *raw_pdu, size_t raw_pdu_len);
 void isis_notif_authentication_failure(const struct isis_circuit *circuit,
-				       const char *raw_pdu);
+				       const char *raw_pdu, size_t raw_pdu_len);
 void isis_notif_adj_state_change(const struct isis_adjacency *adj,
 				 int new_state, const char *reason);
 void isis_notif_reject_adjacency(const struct isis_circuit *circuit,
-				 const char *reason, const char *raw_pdu);
+				 const char *reason, const char *raw_pdu,
+				 size_t raw_pdu_len);
 void isis_notif_area_mismatch(const struct isis_circuit *circuit,
-			      const char *raw_pdu);
+			      const char *raw_pdu, size_t raw_pdu_len);
 void isis_notif_lsp_received(const struct isis_circuit *circuit,
 			     const char *lsp_id, uint32_t seqno,
 			     uint32_t timestamp, const char *sys_id);
 void isis_notif_lsp_gen(const struct isis_area *area, const char *lsp_id,
 			uint32_t seqno, uint32_t timestamp);
 void isis_notif_id_len_mismatch(const struct isis_circuit *circuit,
-				uint8_t rcv_id_len, const char *raw_pdu);
+				uint8_t rcv_id_len, const char *raw_pdu,
+				size_t raw_pdu_len);
 void isis_notif_version_skew(const struct isis_circuit *circuit,
-			     uint8_t version, const char *raw_pdu);
+			     uint8_t version, const char *raw_pdu,
+			     size_t raw_pdu_len);
 void isis_notif_lsp_error(const struct isis_circuit *circuit,
 			  const char *lsp_id, const char *raw_pdu,
-			  uint32_t offset, uint8_t tlv_type);
+			  size_t raw_pdu_len, uint32_t offset,
+			  uint8_t tlv_type);
 void isis_notif_seqno_skipped(const struct isis_circuit *circuit,
 			      const char *lsp_id);
 void isis_notif_own_lsp_purge(const struct isis_circuit *circuit,
diff --git a/isisd/isis_nb_notifications.c b/isisd/isis_nb_notifications.c
index ea33ec10e..4b320950b 100644
--- a/isisd/isis_nb_notifications.c
+++ b/isisd/isis_nb_notifications.c
@@ -173,7 +173,7 @@ void isis_notif_lsp_exceed_max(const struct isis_area *area, const char *lsp_id)
  */
 void isis_notif_max_area_addr_mismatch(const struct isis_circuit *circuit,
 				       uint8_t max_area_addrs,
-				       const char *raw_pdu)
+				       const char *raw_pdu, size_t raw_pdu_len)
 {
 	const char *xpath = "/frr-isisd:max-area-addresses-mismatch";
 	struct list *arguments = yang_data_list_new();
@@ -187,7 +187,7 @@ void isis_notif_max_area_addr_mismatch(const struct isis_circuit *circuit,
 	data = yang_data_new_uint8(xpath_arg, max_area_addrs);
 	listnode_add(arguments, data);
 	snprintf(xpath_arg, sizeof(xpath_arg), "%s/raw-pdu", xpath);
-	data = yang_data_new(xpath_arg, raw_pdu);
+	data = yang_data_new_binary(xpath_arg, raw_pdu, raw_pdu_len);
 	listnode_add(arguments, data);
 
 	nb_notification_send(xpath, arguments);
@@ -197,7 +197,7 @@ void isis_notif_max_area_addr_mismatch(const struct isis_circuit *circuit,
  * XPath: /frr-isisd:authentication-type-failure
  */
 void isis_notif_authentication_type_failure(const struct isis_circuit *circuit,
-					    const char *raw_pdu)
+					    const char *raw_pdu, size_t raw_pdu_len)
 {
 	const char *xpath = "/frr-isisd:authentication-type-failure";
 	struct list *arguments = yang_data_list_new();
@@ -208,7 +208,7 @@ void isis_notif_authentication_type_failure(const struct isis_circuit *circuit,
 	notif_prep_instance_hdr(xpath, area, "default", arguments);
 	notif_prepr_iface_hdr(xpath, circuit, arguments);
 	snprintf(xpath_arg, sizeof(xpath_arg), "%s/raw-pdu", xpath);
-	data = yang_data_new(xpath_arg, raw_pdu);
+	data = yang_data_new_binary(xpath_arg, raw_pdu, raw_pdu_len);
 	listnode_add(arguments, data);
 
 	nb_notification_send(xpath, arguments);
@@ -218,7 +218,7 @@ void isis_notif_authentication_type_failure(const struct isis_circuit *circuit,
  * XPath: /frr-isisd:authentication-failure
  */
 void isis_notif_authentication_failure(const struct isis_circuit *circuit,
-				       const char *raw_pdu)
+				       const char *raw_pdu, size_t raw_pdu_len)
 {
 	const char *xpath = "/frr-isisd:authentication-failure";
 	struct list *arguments = yang_data_list_new();
@@ -229,7 +229,7 @@ void isis_notif_authentication_failure(const struct isis_circuit *circuit,
 	notif_prep_instance_hdr(xpath, area, "default", arguments);
 	notif_prepr_iface_hdr(xpath, circuit, arguments);
 	snprintf(xpath_arg, sizeof(xpath_arg), "%s/raw-pdu", xpath);
-	data = yang_data_new(xpath_arg, raw_pdu);
+	data = yang_data_new_binary(xpath_arg, raw_pdu, raw_pdu_len);
 	listnode_add(arguments, data);
 
 	nb_notification_send(xpath, arguments);
@@ -276,7 +276,8 @@ void isis_notif_adj_state_change(const struct isis_adjacency *adj,
  * XPath: /frr-isisd:rejected-adjacency
  */
 void isis_notif_reject_adjacency(const struct isis_circuit *circuit,
-				 const char *reason, const char *raw_pdu)
+				 const char *reason, const char *raw_pdu,
+				 size_t raw_pdu_len)
 {
 	const char *xpath = "/frr-isisd:rejected-adjacency";
 	struct list *arguments = yang_data_list_new();
@@ -290,7 +291,7 @@ void isis_notif_reject_adjacency(const struct isis_circuit *circuit,
 	data = yang_data_new_string(xpath_arg, reason);
 	listnode_add(arguments, data);
 	snprintf(xpath_arg, sizeof(xpath_arg), "%s/raw-pdu", xpath);
-	data = yang_data_new(xpath_arg, raw_pdu);
+	data = yang_data_new_binary(xpath_arg, raw_pdu, raw_pdu_len);
 	listnode_add(arguments, data);
 
 	nb_notification_send(xpath, arguments);
@@ -300,7 +301,7 @@ void isis_notif_reject_adjacency(const struct isis_circuit *circuit,
  * XPath: /frr-isisd:area-mismatch
  */
 void isis_notif_area_mismatch(const struct isis_circuit *circuit,
-			      const char *raw_pdu)
+			      const char *raw_pdu, size_t raw_pdu_len)
 {
 	const char *xpath = "/frr-isisd:area-mismatch";
 	struct list *arguments = yang_data_list_new();
@@ -311,7 +312,7 @@ void isis_notif_area_mismatch(const struct isis_circuit *circuit,
 	notif_prep_instance_hdr(xpath, area, "default", arguments);
 	notif_prepr_iface_hdr(xpath, circuit, arguments);
 	snprintf(xpath_arg, sizeof(xpath_arg), "%s/raw-pdu", xpath);
-	data = yang_data_new(xpath_arg, raw_pdu);
+	data = yang_data_new_binary(xpath_arg, raw_pdu, raw_pdu_len);
 	listnode_add(arguments, data);
 
 	nb_notification_send(xpath, arguments);
@@ -377,7 +378,8 @@ void isis_notif_lsp_gen(const struct isis_area *area, const char *lsp_id,
  * XPath: /frr-isisd:id-len-mismatch
  */
 void isis_notif_id_len_mismatch(const struct isis_circuit *circuit,
-				uint8_t rcv_id_len, const char *raw_pdu)
+				uint8_t rcv_id_len, const char *raw_pdu,
+				size_t raw_pdu_len)
 {
 	const char *xpath = "/frr-isisd:id-len-mismatch";
 	struct list *arguments = yang_data_list_new();
@@ -391,7 +393,7 @@ void isis_notif_id_len_mismatch(const struct isis_circuit *circuit,
 	data = yang_data_new_uint8(xpath_arg, rcv_id_len);
 	listnode_add(arguments, data);
 	snprintf(xpath_arg, sizeof(xpath_arg), "%s/raw-pdu", xpath);
-	data = yang_data_new(xpath_arg, raw_pdu);
+	data = yang_data_new_binary(xpath_arg, raw_pdu, raw_pdu_len);
 	listnode_add(arguments, data);
 
 	nb_notification_send(xpath, arguments);
@@ -401,7 +403,8 @@ void isis_notif_id_len_mismatch(const struct isis_circuit *circuit,
  * XPath: /frr-isisd:version-skew
  */
 void isis_notif_version_skew(const struct isis_circuit *circuit,
-			     uint8_t version, const char *raw_pdu)
+			     uint8_t version, const char *raw_pdu,
+			     size_t raw_pdu_len)
 {
 	const char *xpath = "/frr-isisd:version-skew";
 	struct list *arguments = yang_data_list_new();
@@ -415,7 +418,7 @@ void isis_notif_version_skew(const struct isis_circuit *circuit,
 	data = yang_data_new_uint8(xpath_arg, version);
 	listnode_add(arguments, data);
 	snprintf(xpath_arg, sizeof(xpath_arg), "%s/raw-pdu", xpath);
-	data = yang_data_new(xpath_arg, raw_pdu);
+	data = yang_data_new_binary(xpath_arg, raw_pdu, raw_pdu_len);
 	listnode_add(arguments, data);
 
 	nb_notification_send(xpath, arguments);
@@ -426,6 +429,7 @@ void isis_notif_version_skew(const struct isis_circuit *circuit,
  */
 void isis_notif_lsp_error(const struct isis_circuit *circuit,
 			  const char *lsp_id, const char *raw_pdu,
+			  size_t raw_pdu_len,
 			  __attribute__((unused)) uint32_t offset,
 			  __attribute__((unused)) uint8_t tlv_type)
 {
@@ -441,7 +445,7 @@ void isis_notif_lsp_error(const struct isis_circuit *circuit,
 	data = yang_data_new_string(xpath_arg, lsp_id);
 	listnode_add(arguments, data);
 	snprintf(xpath_arg, sizeof(xpath_arg), "%s/raw-pdu", xpath);
-	data = yang_data_new(xpath_arg, raw_pdu);
+	data = yang_data_new_binary(xpath_arg, raw_pdu, raw_pdu_len);
 	listnode_add(arguments, data);
 	/* ignore offset and tlv_type which cannot be set properly */
 
diff --git a/isisd/isis_pdu.c b/isisd/isis_pdu.c
index e8a0ba02e..ebf8fd3a2 100644
--- a/isisd/isis_pdu.c
+++ b/isisd/isis_pdu.c
@@ -583,7 +583,7 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 #ifndef FABRICD
 			isis_notif_reject_adjacency(
 				circuit, "p2p hello on non p2p circuit",
-				raw_pdu);
+				raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 			return ISIS_WARNING;
 		}
@@ -594,7 +594,7 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 #ifndef FABRICD
 			isis_notif_reject_adjacency(
 				circuit, "lan hello on non broadcast circuit",
-				raw_pdu);
+				raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 			return ISIS_WARNING;
 		}
@@ -608,7 +608,7 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 			isis_notif_reject_adjacency(
 				circuit,
 				"LAN Hello received over circuit with externalDomain = true",
-				raw_pdu);
+				raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 			return ISIS_WARNING;
 		}
@@ -623,7 +623,7 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 			circuit->rej_adjacencies++;
 #ifndef FABRICD
 			isis_notif_reject_adjacency(
-				circuit, "Interface level mismatch", raw_pdu);
+				circuit, "Interface level mismatch", raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 			return ISIS_WARNING;
 		}
@@ -653,7 +653,7 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 		circuit->rej_adjacencies++;
 #ifndef FABRICD
 		isis_notif_reject_adjacency(circuit, "Invalid PDU length",
-					    raw_pdu);
+					    raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 		return ISIS_WARNING;
 	}
@@ -665,7 +665,7 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 		circuit->rej_adjacencies++;
 #ifndef FABRICD
 		isis_notif_reject_adjacency(
-			circuit, "LAN Hello with wrong IS-level", raw_pdu);
+			circuit, "LAN Hello with wrong IS-level", raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 		return ISIS_ERROR;
 	}
@@ -679,7 +679,7 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 		circuit->rej_adjacencies++;
 #ifndef FABRICD
 		isis_notif_reject_adjacency(circuit, "Failed to unpack TLVs",
-					    raw_pdu);
+					    raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 		goto out;
 	}
@@ -688,7 +688,7 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 		zlog_warn("No Area addresses TLV in %s", pdu_name);
 #ifndef FABRICD
 		/* send northbound notification */
-		isis_notif_area_mismatch(circuit, raw_pdu);
+		isis_notif_area_mismatch(circuit, raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 		goto out;
 	}
@@ -698,7 +698,7 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 		circuit->rej_adjacencies++;
 #ifndef FABRICD
 		isis_notif_reject_adjacency(
-			circuit, "No supported protocols TLV", raw_pdu);
+			circuit, "No supported protocols TLV", raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 		goto out;
 	}
@@ -715,11 +715,11 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 				pdu_end - pdu_start);
 		if (auth_code == ISIS_AUTH_FAILURE) {
 			circuit->auth_failures++;
-			isis_notif_authentication_failure(circuit, raw_pdu);
+			isis_notif_authentication_failure(circuit, raw_pdu, sizeof(raw_pdu));
 		} else { /* AUTH_TYPE_FAILURE or NO_VALIDATOR */
 			circuit->auth_type_failures++;
 			isis_notif_authentication_type_failure(circuit,
-							       raw_pdu);
+							       raw_pdu, sizeof(raw_pdu));
 		}
 #endif /* ifndef FABRICD */
 		goto out;
@@ -732,7 +732,7 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 		circuit->rej_adjacencies++;
 #ifndef FABRICD
 		isis_notif_reject_adjacency(
-			circuit, "Received IIH with our own sysid", raw_pdu);
+			circuit, "Received IIH with our own sysid", raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 		goto out;
 	}
@@ -750,7 +750,7 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 		}
 #ifndef FABRICD
 		/* send northbound notification */
-		isis_notif_area_mismatch(circuit, raw_pdu);
+		isis_notif_area_mismatch(circuit, raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 		goto out;
 	}
@@ -771,7 +771,7 @@ static int process_hello(uint8_t pdu_type, struct isis_circuit *circuit,
 #ifndef FABRICD
 		isis_notif_reject_adjacency(
 			circuit, "Neither IPv4 not IPv6 considered usable",
-			raw_pdu);
+			raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 		goto out;
 	}
@@ -934,7 +934,7 @@ static int process_lsp(uint8_t pdu_type, struct isis_circuit *circuit,
 		 * will send dummy values which are ignored in the callback
 		 */
 		isis_notif_lsp_error(circuit, rawlspid_print(hdr.lsp_id),
-				     raw_pdu, 0, 0);
+				     raw_pdu, sizeof(raw_pdu), 0, 0);
 #endif /* ifndef FABRICD */
 		goto out;
 	}
@@ -958,11 +958,11 @@ static int process_lsp(uint8_t pdu_type, struct isis_circuit *circuit,
 		/* send northbound notification */
 		if (auth_code == ISIS_AUTH_FAILURE) {
 			circuit->auth_failures++;
-			isis_notif_authentication_failure(circuit, raw_pdu);
+			isis_notif_authentication_failure(circuit, raw_pdu, sizeof(raw_pdu));
 		} else { /* AUTH_TYPE_FAILURE or NO_VALIDATOR */
 			circuit->auth_type_failures++;
 			isis_notif_authentication_type_failure(circuit,
-							       raw_pdu);
+							       raw_pdu, sizeof(raw_pdu));
 		}
 #endif /* ifndef FABRICD */
 		goto out;
@@ -1397,11 +1397,11 @@ static int process_snp(uint8_t pdu_type, struct isis_circuit *circuit,
 			if (auth_code == ISIS_AUTH_FAILURE) {
 				circuit->auth_failures++;
 				isis_notif_authentication_failure(circuit,
-								  raw_pdu);
+								  raw_pdu, sizeof(raw_pdu));
 			} else { /* AUTH_TYPE_FAILURE or NO_VALIDATOR */
 				circuit->auth_type_failures++;
 				isis_notif_authentication_type_failure(circuit,
-								       raw_pdu);
+								       raw_pdu, sizeof(raw_pdu));
 			}
 #endif /* ifndef FABRICD */
 			goto out;
@@ -1627,7 +1627,7 @@ int isis_handle_pdu(struct isis_circuit *circuit, uint8_t *ssnpa)
 		zlog_warn("Unsupported ISIS version %" PRIu8, version1);
 #ifndef FABRICD
 		/* send northbound notification */
-		isis_notif_version_skew(circuit, version1, raw_pdu);
+		isis_notif_version_skew(circuit, version1, raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 		return ISIS_WARNING;
 	}
@@ -1641,7 +1641,7 @@ int isis_handle_pdu(struct isis_circuit *circuit, uint8_t *ssnpa)
 		circuit->id_len_mismatches++;
 #ifndef FABRICD
 		/* send northbound notification */
-		isis_notif_id_len_mismatch(circuit, id_len, raw_pdu);
+		isis_notif_id_len_mismatch(circuit, id_len, raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 		return ISIS_ERROR;
 	}
@@ -1671,7 +1671,7 @@ int isis_handle_pdu(struct isis_circuit *circuit, uint8_t *ssnpa)
 		zlog_warn("Unsupported ISIS PDU version %" PRIu8, version2);
 #ifndef FABRICD
 		/* send northbound notification */
-		isis_notif_version_skew(circuit, version2, raw_pdu);
+		isis_notif_version_skew(circuit, version2, raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 		return ISIS_WARNING;
 	}
@@ -1695,7 +1695,7 @@ int isis_handle_pdu(struct isis_circuit *circuit, uint8_t *ssnpa)
 #ifndef FABRICD
 		/* send northbound notification */
 		isis_notif_max_area_addr_mismatch(circuit, max_area_addrs,
-						  raw_pdu);
+						  raw_pdu, sizeof(raw_pdu));
 #endif /* ifndef FABRICD */
 		return ISIS_ERROR;
 	}
diff --git a/lib/base64.c b/lib/base64.c
new file mode 100644
index 000000000..e3f238969
--- /dev/null
+++ b/lib/base64.c
@@ -0,0 +1,193 @@
+/*
+ * This is part of the libb64 project, and has been placed in the public domain.
+ * For details, see http://sourceforge.net/projects/libb64
+ */
+
+#include "base64.h"
+
+static const int CHARS_PER_LINE = 72;
+static const char *ENCODING =
+	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+void base64_init_encodestate(struct base64_encodestate *state_in)
+{
+	state_in->step = step_A;
+	state_in->result = 0;
+	state_in->stepcount = 0;
+}
+
+char base64_encode_value(char value_in)
+{
+	if (value_in > 63)
+		return '=';
+	return ENCODING[(int)value_in];
+}
+
+int base64_encode_block(const char *plaintext_in, int length_in, char *code_out,
+			struct base64_encodestate *state_in)
+{
+	const char *plainchar = plaintext_in;
+	const char *const plaintextend = plaintext_in + length_in;
+	char *codechar = code_out;
+	char result;
+	char fragment;
+
+	result = state_in->result;
+
+	switch (state_in->step) {
+		while (1) {
+			case step_A:
+				if (plainchar == plaintextend) {
+					state_in->result = result;
+					state_in->step = step_A;
+					return codechar - code_out;
+				}
+				fragment = *plainchar++;
+				result = (fragment & 0x0fc) >> 2;
+				*codechar++ = base64_encode_value(result);
+				result = (fragment & 0x003) << 4;
+				/* fall through */
+			case step_B:
+				if (plainchar == plaintextend) {
+					state_in->result = result;
+					state_in->step = step_B;
+					return codechar - code_out;
+				}
+				fragment = *plainchar++;
+				result |= (fragment & 0x0f0) >> 4;
+				*codechar++ = base64_encode_value(result);
+				result = (fragment & 0x00f) << 2;
+				/* fall through */
+			case step_C:
+				if (plainchar == plaintextend) {
+					state_in->result = result;
+					state_in->step = step_C;
+					return codechar - code_out;
+				}
+				fragment = *plainchar++;
+				result |= (fragment & 0x0c0) >> 6;
+				*codechar++ = base64_encode_value(result);
+				result  = (fragment & 0x03f) >> 0;
+				*codechar++ = base64_encode_value(result);
+
+				++(state_in->stepcount);
+				if (state_in->stepcount == CHARS_PER_LINE/4) {
+					*codechar++ = '\n';
+					state_in->stepcount = 0;
+				}
+		}
+	}
+	/* control should not reach here */
+	return codechar - code_out;
+}
+
+int base64_encode_blockend(char *code_out, struct base64_encodestate *state_in)
+{
+	char *codechar = code_out;
+
+	switch (state_in->step) {
+	case step_B:
+		*codechar++ = base64_encode_value(state_in->result);
+		*codechar++ = '=';
+		*codechar++ = '=';
+		break;
+	case step_C:
+		*codechar++ = base64_encode_value(state_in->result);
+		*codechar++ = '=';
+		break;
+	case step_A:
+		break;
+	}
+	*codechar++ = '\n';
+
+	return codechar - code_out;
+}
+
+
+signed char base64_decode_value(signed char value_in)
+{
+	static const signed char decoding[] = {
+		62, -1, -1, -1, 63, 52, 53, 54,
+		55, 56, 57, 58, 59, 60, 61, -1,
+		-1, -1, -2, -1, -1, -1, 0, 1,
+		2,  3, 4, 5, 6, 7, 8, 9,
+		10, 11, 12, 13, 14, 15, 16, 17,
+		18, 19, 20, 21, 22, 23, 24, 25,
+		-1, -1, -1, -1, -1, -1, 26, 27,
+		28, 29, 30, 31, 32, 33, 34, 35,
+		36, 37, 38, 39, 40, 41, 42, 43,
+		44, 45, 46, 47, 48, 49, 50, 51
+	};
+	value_in -= 43;
+	if (value_in < 0 || value_in >= 80)
+		return -1;
+	return decoding[(int)value_in];
+}
+
+void base64_init_decodestate(struct base64_decodestate *state_in)
+{
+	state_in->step = step_a;
+	state_in->plainchar = 0;
+}
+
+int base64_decode_block(const char *code_in, int length_in, char *plaintext_out,
+			struct base64_decodestate *state_in)
+{
+	const char *codec = code_in;
+	char *plainc = plaintext_out;
+	signed char fragmt;
+
+	*plainc = state_in->plainchar;
+
+	switch (state_in->step) {
+		while (1) {
+			case step_a:
+				do {
+					if (codec == code_in+length_in) {
+						state_in->step = step_a;
+						state_in->plainchar = *plainc;
+						return plainc - plaintext_out;
+					}
+					fragmt = base64_decode_value(*codec++);
+				} while (fragmt < 0);
+				*plainc = (fragmt & 0x03f) << 2;
+				/* fall through */
+			case step_b:
+				do {
+					if (codec == code_in+length_in) {
+						state_in->step = step_b;
+						state_in->plainchar = *plainc;
+						return plainc - plaintext_out;
+					}
+					fragmt = base64_decode_value(*codec++);
+				} while (fragmt < 0);
+				*plainc++ |= (fragmt & 0x030) >> 4;
+				*plainc = (fragmt & 0x00f) << 4;
+				/* fall through */
+			case step_c:
+				do {
+					if (codec == code_in+length_in) {
+						state_in->step = step_c;
+						state_in->plainchar = *plainc;
+						return plainc - plaintext_out;
+					}
+					fragmt = base64_decode_value(*codec++);
+				} while (fragmt < 0);
+				*plainc++ |= (fragmt & 0x03c) >> 2;
+				*plainc = (fragmt & 0x003) << 6;
+				/* fall through */
+			case step_d:
+				do {
+					if (codec == code_in+length_in) {
+						state_in->step = step_d;
+						state_in->plainchar = *plainc;
+						return plainc - plaintext_out;
+					}
+					fragmt = base64_decode_value(*codec++);
+				} while (fragmt < 0);
+				*plainc++   |= (fragmt & 0x03f);
+		}
+	}
+	/* control should not reach here */
+	return plainc - plaintext_out;
+}
diff --git a/lib/base64.h b/lib/base64.h
new file mode 100644
index 000000000..3dc1559aa
--- /dev/null
+++ b/lib/base64.h
@@ -0,0 +1,45 @@
+/*
+ * This is part of the libb64 project, and has been placed in the public domain.
+ * For details, see http://sourceforge.net/projects/libb64
+ */
+
+#ifndef _BASE64_H_
+#define _BASE64_H_
+
+enum base64_encodestep {
+	step_A, step_B, step_C
+};
+
+struct base64_encodestate {
+	enum base64_encodestep step;
+	char result;
+	int stepcount;
+};
+
+void base64_init_encodestate(struct base64_encodestate *state_in);
+
+char base64_encode_value(char value_in);
+
+int base64_encode_block(const char *plaintext_in, int length_in, char *code_out,
+			struct base64_encodestate *state_in);
+
+int base64_encode_blockend(char *code_out, struct base64_encodestate *state_in);
+
+
+enum base64_decodestep {
+	step_a, step_b, step_c, step_d
+};
+
+struct base64_decodestate {
+	enum base64_decodestep step;
+	char plainchar;
+};
+
+void base64_init_decodestate(struct base64_decodestate *state_in);
+
+signed char base64_decode_value(signed char value_in);
+
+int base64_decode_block(const char *code_in, int length_in, char *plaintext_out,
+			struct base64_decodestate *state_in);
+
+#endif /* _BASE64_H_ */
diff --git a/lib/subdir.am b/lib/subdir.am
index b2f3e7c5d..44573964c 100644
--- a/lib/subdir.am
+++ b/lib/subdir.am
@@ -8,6 +8,7 @@ lib_libfrr_la_LIBADD = $(LIBCAP) $(UNWIND_LIBS) $(LIBYANG_LIBS) $(LUA_LIB) $(LIB
 lib_libfrr_la_SOURCES = \
 	lib/agg_table.c \
 	lib/atomlist.c \
+	lib/base64.c \
 	lib/bfd.c \
 	lib/buffer.c \
 	lib/checksum.c \
@@ -159,6 +160,7 @@ clippy_scan += \
 pkginclude_HEADERS += \
 	lib/agg_table.h \
 	lib/atomlist.h \
+	lib/base64.h \
 	lib/bfd.h \
 	lib/bitfield.h \
 	lib/buffer.h \
diff --git a/lib/yang_wrappers.c b/lib/yang_wrappers.c
index c31ba3fcc..1a4a93164 100644
--- a/lib/yang_wrappers.c
+++ b/lib/yang_wrappers.c
@@ -19,6 +19,7 @@
 
 #include <zebra.h>
 
+#include "base64.h"
 #include "log.h"
 #include "lib_errors.h"
 #include "northbound.h"
@@ -784,6 +785,78 @@ void yang_get_default_string_buf(char *buf, size_t size, const char *xpath_fmt,
 			  xpath);
 }
 
+/*
+ * Primitive type: binary.
+ */
+struct yang_data *yang_data_new_binary(const char *xpath, const char *value,
+				       size_t len)
+{
+	char *value_str;
+	struct base64_encodestate s;
+	int cnt;
+	char *c;
+	struct yang_data *data;
+
+	value_str = (char *)malloc(len * 2);
+	base64_init_encodestate(&s);
+	cnt = base64_encode_block(value, len, value_str, &s);
+	c = value_str + cnt;
+	cnt = base64_encode_blockend(c, &s);
+	c += cnt;
+	*c = 0;
+	data = yang_data_new(xpath, value_str);
+	free(value_str);
+	return data;
+}
+
+size_t yang_dnode_get_binary_buf(char *buf, size_t size,
+				 const struct lyd_node *dnode,
+				 const char *xpath_fmt, ...)
+{
+	const struct lyd_node_leaf_list *dleaf;
+	const char *canon;
+	size_t cannon_len;
+	size_t decode_len;
+	size_t ret_len;
+	size_t cnt;
+	char *value_str;
+	struct base64_decodestate s;
+
+	assert(dnode);
+	if (xpath_fmt) {
+		va_list ap;
+		char xpath[XPATH_MAXLEN];
+
+		va_start(ap, xpath_fmt);
+		vsnprintf(xpath, sizeof(xpath), xpath_fmt, ap);
+		va_end(ap);
+		dnode = yang_dnode_get(dnode, xpath);
+		YANG_DNODE_GET_ASSERT(dnode, xpath);
+	}
+
+	dleaf = (const struct lyd_node_leaf_list *)dnode;
+	canon = dleaf->value_str;
+	cannon_len = strlen(canon);
+	decode_len = cannon_len;
+	value_str = (char *)malloc(decode_len);
+	base64_init_decodestate(&s);
+	cnt = base64_decode_block(canon, cannon_len, value_str, &s);
+
+	ret_len = size > cnt ? cnt : size;
+	memcpy(buf, value_str, ret_len);
+	if (size < cnt) {
+		char xpath[XPATH_MAXLEN];
+
+		yang_dnode_get_path(dnode, xpath, sizeof(xpath));
+		flog_warn(EC_LIB_YANG_DATA_TRUNCATED,
+			  "%s: value was truncated [xpath %s]", __func__,
+			  xpath);
+	}
+	free(value_str);
+	return ret_len;
+}
+
+
 /*
  * Primitive type: empty.
  */
diff --git a/lib/yang_wrappers.h b/lib/yang_wrappers.h
index ba2cf5139..77289a303 100644
--- a/lib/yang_wrappers.h
+++ b/lib/yang_wrappers.h
@@ -118,6 +118,13 @@ extern const char *yang_get_default_string(const char *xpath_fmt, ...);
 extern void yang_get_default_string_buf(char *buf, size_t size,
 					const char *xpath_fmt, ...);
 
+/* binary */
+extern struct yang_data *yang_data_new_binary(const char *xpath,
+					      const char *value, size_t len);
+extern size_t yang_dnode_get_binary_buf(char *buf, size_t size,
+					const struct lyd_node *dnode,
+					const char *xpath_fmt, ...);
+
 /* empty */
 extern struct yang_data *yang_data_new_empty(const char *xpath);
 
-- 
2.34.1

Places

File 0006-isisd-fix-10505-using-base64-encoding.patch of Package frr (Revision 80bb841138c12123bbb7c1fb60b34e8a)

Places