Created attachment 228647 [details]
Patch for libyang
Fixes mutiple CVEs however there's no support in FRR v7.x for libyang 2.x
Connect unit testing to port
1.x branch is also deprecated by upstream as of 1.0.240, there's a tagged 1.0.255 release in repo but it's not listed on as a release on upstream's website
Created attachment 228648 [details]
Patch for libyang v2
Do not hardcode -O2 optimization
because FRR7 only support libyang 1.x, my idea was:
1. Upgrading net/libyang to 1.0.240
2. Adding new net/libyang2, that will be used by FRR 8
What are your thoughts about that ?
I have a local FRR8 and net/libyang2 since weeks but still not committed because I meet strange bug with FRR8 on my side.
Due to the CVEs I highly think that you at least should move to 240 if you want to have frr 7.x and 8.x in tree at the same time. Since frr is the only user I don't see it being much of an issue but in general my personal opinion is that we should avoid having parallel versions of libraries in tree if possible since it complicates and causes issues (conflicts).
Please try to connect upstream's test suites (as in this patch) if possible as it makes regression testing easier.
I'm not a user of frr (I just noticed the CVEs regarding libyang) so I can't help much but are you seeing similar issues https://elegantnetwork.github.io/posts/followup-measuring-BGP-stacks/ or is it something else? Have you submitted a bug report upstream?
A commit in branch main references this bug:
Author: Olivier Cochard <olivier@FreeBSD.org>
AuthorDate: 2021-10-13 12:43:05 +0000
Commit: Olivier Cochard <olivier@FreeBSD.org>
CommitDate: 2021-10-13 12:55:58 +0000
net/libyang: Fixes mutiple CVEs and connect upstream's test suite
CVEs: CVE-2021-28902, CVE-2021-28903, CVE-2021-28904, CVE-2021-28905,
Reported by: diizzy
net/libyang/Makefile | 9 ++++++++-
net/libyang/distinfo | 6 +++---
net/libyang/pkg-plist | 2 +-
3 files changed, 12 insertions(+), 5 deletions(-)