Skip to content

Releases

FRR Release 10.6.2

FRR Release 10.6.2

Choose a tag to compare

View all tags
@Jafaral Jafaral released this 31 Aug 13:23
frr-10.6.2
c8efb33

Debian Packages - https://deb.frrouting.org/
RPM Packages - https://rpm.frrouting.org/
Docker - quay.io/frrouting/frr

What's Changed

Read more

Contributors

ton31337, Jafaral, and 4 other contributors
Loading

FRR Release 10.5.5

FRR Release 10.5.5

Choose a tag to compare

View all tags
@Jafaral Jafaral released this 31 Aug 13:22
frr-10.5.5
e65d7f8

Debian Packages - https://deb.frrouting.org/
RPM Packages - https://rpm.frrouting.org/
Docker - quay.io/frrouting/frr

What's Changed

Read more

Contributors

ton31337, donaldsharp, and 4 other contributors
Loading

FRR Release 10.4.5

FRR Release 10.4.5

Choose a tag to compare

View all tags
@Jafaral Jafaral released this 31 Aug 13:21
frr-10.4.5
3353436

Debian Packages - https://deb.frrouting.org/
RPM Packages - https://rpm.frrouting.org/
Docker - quay.io/frrouting/frr

What's Changed

Full Changelog: frr-10.4.4...frr-10.4.5

Contributors

ton31337, cscarpitta, and mergify
Loading

FRR Release 10.7.1

FRR Release 10.7.1 Latest
Latest

Choose a tag to compare

View all tags
@Jafaral Jafaral released this 31 Aug 13:24
frr-10.7.1
f8c0b08

Debian Packages - https://deb.frrouting.org/
RPM Packages - https://rpm.frrouting.org/
Docker - quay.io/frrouting/frr

What's Changed

Full Changelog: frr-10.7.0...frr-10.7.1

Contributors

ton31337, mergify, and 2 other contributors
Assets 2
Loading

FRR Release 10.7.0

FRR Release 10.7.0

Choose a tag to compare

View all tags
@Jafaral Jafaral released this 01 Jul 23:34
frr-10.7.0
87fe21f

We are pleased to announce FRR release 10.7.0.

FRR 10.7.0 comes with 1433 commits from 105 developers.

Debian and RPM release packages are available at:

Debian Packages - https://deb.frrouting.org/
RPM Packages - https://rpm.frrouting.org/
Docker - quay.io/frrouting/frr

Thank you to all contributors!

Release Overview

New Features Highlight

  • BFD authentication with keychain support

    • BFD sessions can now use the FRR keychain framework for authentication.
    • Supported algorithms include cleartext, SHA-1, and the meticulous variant required by operators running strict authentication policies.
    • Keychains integrate with BFD profiles and northbound configuration for single-hop, multi-hop, and SBFD sessions.

  • BGP-LS SRv6 extensions

    • BGP Link-State now advertises and processes SRv6 topology information, including:
      • SRv6 Capabilities TLV
      • SRv6 Locator TLV
      • SRv6 SID NLRI (including End, End.X, and LAN End.X forms)
      • SRv6 Endpoint Behavior TLV
      • SRv6 SID Structure TLV
    • Static SRv6 SIDs configured in zebra can be exported into BGP-LS, enabling SRv6-aware TE controllers to consume locator and SID information from FRR.

  • BGP route-map based allowas-in

    • allowas-in can be applied selectively through route-maps instead of only as a blanket peer or address-family knob.
    • This allows finer control over which received routes may contain the local AS in the AS_PATH, improving policy flexibility in complex multihomed and hub-and-spoke designs.

  • OSPFv2 RFC 4222 control-plane DSCP marking

    • OSPFv2 can classify control packets into high- and low-priority queues per RFC 4222 recommendation 1.
    • Recommendation 2 extends the neighbor inactivity timer behavior for low-priority control traffic.
    • Operators can mark OSPF control traffic with DSCP values to protect routing protocol stability under congestion.

  • OSPF BFD quick neighbor

    • When BFD is enabled on OSPF interfaces, a quick-neighbor mode reduces the time needed to bring up OSPF adjacencies over BFD-monitored links.
    • This is useful on fabrics where fast reconvergence after link-up is required.

  • PIM IGMP proxy route-map filtering

    • IGMP proxy joins and prunes can be filtered with ip igmp proxy route-map.
    • A new route-map match condition, match multicast-source-interface, allows policy based on the interface where a join was learned.
    • This helps deployments that proxy IGMP between access and core segments while restricting which groups or sources are forwarded.

  • PIM dense-mode Assert on multi-access LAN

    • Dense-mode wrong-interface traffic on shared LANs now runs the RFC 3973 Assert procedure instead of immediately pruning all neighbors.
    • On point-to-point links the previous immediate-prune behavior is preserved.
    • This elects a single forwarder on multi-access segments and avoids pruning active branches when duplicate (S,G) packets arrive on a non-RPF interface.

  • PIM Auto-RP allow-rp support

    • A new allow-rp configuration accepts Auto-RP groups even when the embedded RP address does not match the local RP configuration.
    • IPv4 and IPv6 Auto-RP are supported through northbound/YANG modeling.
    • This helps mixed-vendor or transitional Auto-RP deployments where strict RP identity checking would otherwise drop valid control traffic.

  • Static route per-route metric and nexthop ECMP weight

    • Static routes now support a per-route metric as a non-key attribute, independent of the existing administrative-distance key.
    • Static ECMP nexthops can carry weights for unequal-cost multi-path forwarding.
    • Together these align static routing policy more closely with zebra’s nexthop-group handling used by other protocols.

What's Changed

Read more

Contributors

mbaldessari, reinaldosaraiva, and 79 other contributors
Loading

FRR Release 10.6.1

FRR Release 10.6.1

Choose a tag to compare

View all tags
@Jafaral Jafaral released this 28 Apr 20:32
frr-10.6.1
71da51b

Debian Packages - https://deb.frrouting.org/
RPM Packages - https://rpm.frrouting.org/
Docker - quay.io/frrouting/frr

What's Changed

  • doc: fix indentation error in pim doc (backport #21373)
  • Fix/bgp hardening backports 10.6
  • isisd: improve validation of flex-algo decoder (backport #21314)
  • bgpd: Do not allocate stream if route-refresh capability is not received (backport #21394)
  • bgpd: Check dynamic capability action before validating ENHE capability (backport #21395)
  • bgpd: Do not allow triggering route-refresh path with a malformed ORF length (backport #21399)
  • pimd: guard channel OIL detach against stale pointers (backport #21431)
  • ospfd: add validation in several places before accessing message bodies (backport #21303)
  • pimd: fix NOCACHE MFC resync detection log, add vrf name too (backport #21481)
  • bgpd: Fix mixed remote-as for peer-groups when using auto (backport #21406)
  • bgpd: Don't mark nexthop as changed if a set next-hop unchanged is applied (backport #21445)
  • ospfd: add LSA validation in the apiserver path (backport #21536)
  • eigrpd: reject invalid prefix mask len (backport #21539)
  • eigrpd: enforce minimum TLV length in Hello handler (backport #21543)
  • isisd: use correct min size values for srv6 subtlvs (backport #21540)
  • bgpd: fix neighbor IP comparison for IPv6 memcmp return values (backport #21559)
  • bgp_evpn: fix memleak when configuring rd (backport #21566)
  • eigrpd: fix byte order in Hello authentication decode (backport #21545)
  • lib: Report IPv6 MTU and not IPv4 for if_update_state_mtu6 (backport #21501)
  • bgpd: Prevent out-of-bound reading handling soft version dynamic capability (backport #21602)
  • isisd: continue hardening SRV6 tlv parsing (backport #21585)
  • bgpd: Dynamic capability parsing fixes (backport #21603)
  • isisd: consume leftover bytes after FAD sub-sub-TLV loop (backport #21544)
  • bgpd: Harden SRv6 Service Data parser for SID Structure length (backport #21612)
  • nhrpd: stop debugging auth credentials (backport #21615)
  • bgpd: honor 'no activate' for dynamic neighbors in peer-group (backport #21658)
  • bgpd: migrate timers during peer_xfer_conn to fix stale route cleanup (backport #21558)
  • isisd: correct SRv6 End.X SID minimum size constants (backport #21541)
  • isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641)
  • bgpd: Validate if NHC BGPID TLV value is non-zero (backport #21611)
  • bgpd: Check if BGPID NHC TLV exists when IPv6 next-hop is link-local (backport #21377, #21605, #21611)

Full Changelog: frr-10.6.0...frr-10.6.1

Loading

FRR Release 10.5.4

FRR Release 10.5.4

Choose a tag to compare

View all tags
@Jafaral Jafaral released this 28 Apr 20:32
frr-10.5.4
4cb6d9e

Debian Packages - https://deb.frrouting.org/
RPM Packages - https://rpm.frrouting.org/
Docker - quay.io/frrouting/frr

What's Changed

  • pimd: When address change ensure DR changes too. (backport #20881)
  • lib/typesafe: guard skiplist level generation against ctz(0) UB (backport #20899)
  • bgpd: fix memory leak in cluster_intern() (backport #20913)
  • doc: add some text regarding libyang versions (backport #20862)
  • eigrpd: handle the gr neighbor list safely in update_receive (backport #20933)
  • nhrpd: fix packet and buffer handling errors (backport #20932)
  • bgpd: Fix test for OPEN message with remote-as auto (backport #20963)
  • bgpd: Add missing PEER_FLAG_SEND_NHC_ATTRIBUTE for update group flags (backport)
  • bgpd: check more during flowspec nlri parsing (backport #19909)
  • bgpd: Fix condition when evaluating paths (backport #20975)
  • ospfd: harden TE/SR TLV iteration against malformed lengths (backport #21002)
  • bfdd: Fix wrong memory free when using ttable code (backport #21020)
  • bgpd: fix off-by-one error in FlowSpec operator array bounds check (backport #21054)
  • lib: fix zclient crash when many peers reconnect after FRR restart (backport #21056)
  • lib: fix vty_is_closed() falsely reporting VTY_SHELL as closed (backport #21082)
  • bgpd: Check if the NHC length is enough to fill TLV value + TLV header (backport #21074)
  • ospfd: fix sequence number check, avoid truncation ambiguity (backport #21096)
  • nhrpd: Correct addrlen check in os_recvmsg() (backport #21100)
  • ldpd: improve tlv validation in several places (backport #21118)
  • PIM message-handling code fixes (backport #21093)
  • lib: disable warning in zlog.c to match master
  • bgpd: fix some packet-parsing issues (10.5 version)
  • bgpd: Return 0 if AS4 capability is malformed (backport #21112)
  • isisd: fix edge condition in max_lsp_count computation (backport #21159)
  • bgpd: Prevent heap use-after-free for tunnel encapsulation attribute (backport #21176)
  • isisd: fix memory leak in remove_excess_adjs() (backport #21183)
  • isisd: Fix missing neighbor address Sub-TLVs after link-params change (backport #21204)
  • bgpd: improve packet parsing for EVPN and ENCAP/VNC (backport #21098)
  • nhrpd: harden against malformed packets (backport #21097)
  • ripngd: fix data handling in several places (10.5 backport)
  • bgpd: Recent bugs for 10.5
  • vrrrpd: improve error handling in several paths (backport #21251)
  • bgpd: fix NHT for explicit link-local BGP peers (backport)
  • bgpd: flowspec foobar hardening (backport #21308)
  • bgpd: fix import vrf on non existing vrf (backport)
  • ospf6d: improve/harden packet processing (backport #21277)
  • bfdd: harden packet validation and reflector handling (backport #21105) (backport #21255)
  • pceplib: validate during of_list TLV decoding (backport #21310)
  • pimd: fix crash due to double free (backport #21354)
  • eigrpd: improve validation and error-handling in tlv parsing (backport #21316 to 10.5)
  • bgpd: Revalidate locally originated routes against RPKI changes (backport #21302)
  • bgpd: hardening backports 10.5
  • bgpd: Move rpki strict check to bgp_accept() (backport #21328)
  • bgpd: Do not allocate stream if route-refresh capability is not received (backport #21394)
  • bgpd: Check dynamic capability action before validating ENHE capability (backport #21395)
  • pimd: guard channel OIL detach against stale pointers (backport #21431)
  • isisd: improve validation of flex-algo decoder (backport)
  • ospfd: add validation in several places before accessing message bodies (backport #21303)
  • pimd: fix NOCACHE MFC resync detection log, add vrf name too (backport #21481)
  • bgpd: Fix mixed remote-as for peer-groups when using auto (backport #21406)
  • bgpd: Don't mark nexthop as changed if a set next-hop unchanged is applied (backport #21445)
  • ospfd: add LSA validation in the apiserver path (backport #21536)
  • eigrpd: enforce minimum TLV length in Hello handler (backport #21543)
  • eigrpd: reject invalid prefix mask len (backport #21539)
  • isisd: use correct min size values for srv6 subtlvs (backport #21540)
  • eigrpd: Handling for malformed update packets (10.5 version)
  • bgpd: fix neighbor IP comparison for IPv6 memcmp return values (backport #21559)
  • eigrpd: fix byte order in Hello authentication decode (backport #21545)
  • bgp_evpn: fix memleak when configuring rd (backport #21566)
  • lib: Report IPv6 MTU and not IPv4 for if_update_state_mtu6 (backport #21501)
  • bgpd: Dynamic capability parsing fixes (backport #21603)
  • isisd: consume leftover bytes after FAD sub-sub-TLV loop (backport #21544)
  • nhrpd: stop debugging auth credentials (backport #21615)
  • bgpd: honor 'no activate' for dynamic neighbors in peer-group (backport #21658)
  • bgpd: migrate timers during peer_xfer_conn to fix stale route cleanup (backport #21558)
  • isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641)
  • bgpd: Validate if NHC BGPID TLV value is non-zero (backport #21611)
  • bgpd: Check if BGPID NHC TLV exists when IPv6 next-hop is link-local (backport #21377, #21605, #21611)
  • bgpd: Do not allocate NHC TLV with an extra trailer (backport #21606)

Full Changelog: frr-10.5.2...frr-10.5.4

Loading

FRR Release 10.4.4

FRR Release 10.4.4

Choose a tag to compare

View all tags
@Jafaral Jafaral released this 28 Apr 20:32
frr-10.4.4
f00436f

Debian Packages - https://deb.frrouting.org/
RPM Packages - https://rpm.frrouting.org/
Docker - quay.io/frrouting/frr

What's Changed

  • pimd: When address change ensure DR changes too. (backport #20881)
  • bgpd: fix memory leak in cluster_intern() (backport #20913)
  • doc: add some text regarding libyang versions (backport #20862)
  • eigrpd: handle the gr neighbor list safely in update_receive (backport #20933)
  • nhrpd: fix packet and buffer handling errors (backport #20932)
  • bgpd: Add missing PEER_FLAG_SEND_NHC_ATTRIBUTE for update group flags (backport)
  • bgpd: check more during flowspec nlri parsing (backport #19909)
  • bgpd: Fix test for OPEN message with remote-as auto (backport #20963)
  • ospfd: harden TE/SR TLV iteration against malformed lengths (backport #21002)
  • bfdd: Fix wrong memory free when using ttable code (backport #21020)
  • bgpd: fix off-by-one error in FlowSpec operator array bounds check (backport #21054)
  • bgpd: Check if the NHC length is enough to fill TLV value + TLV header (backport #21074)
  • ospfd: fix sequence number check, avoid truncation ambiguity (backport #21096)
  • nhrpd: Correct addrlen check in os_recvmsg() (backport #21100)
  • ldpd: improve tlv validation in several places (backport #21118)
  • PIM message-handling code fixes (backport #21093)
  • lib: disable warning in zlog.c to match master
  • bgpd: fix some packet-parsing issues (10.4 version)
  • isisd: fix edge condition in max_lsp_count computation (backport #21159)
  • bgpd: Return 0 if AS4 capability is malformed (backport #21112)
  • bgpd: Prevent heap use-after-free for tunnel encapsulation attribute (backport #21176)
  • isisd: fix memory leak in remove_excess_adjs() (backport #21183)
  • bgpd: improve packet parsing for EVPN and ENCAP/VNC (backport #21098)
  • nhrpd: harden against malformed packets (backport #21097)
  • bgpd: fix NHT for explicit link-local BGP peers (backport)
  • ripngd: fix data handling in several places (10.4 version)
  • bgpd: Recent bugs for 10.4
  • vrrrpd: improve error handling in several paths (backport #21251)
  • lib: fix zclient crash when many peers reconnect after FRR restart (backport #21056)
  • bgpd: flowspec foobar hardening (backport #21308)
  • bgpd: fix import vrf on non existing vrf (backport)
  • ospf6d: improve/harden packet processing (backport #21277)
  • pceplib: validate during of_list TLV decoding (backport #21310)
  • bgpd: Revalidate locally originated routes against RPKI changes (backport)
  • bfdd: harden packet validation and reflector handling (backport #21105)
  • pimd: fix crash due to double free (backport #21354)
  • eigrpd: improve validation and error-handling in tlv parsing (backport #21316)
  • bgpd: hardening backports 10.4
  • bgpd: Do not allocate stream if route-refresh capability is not received (backport #21394)
  • bgpd: Check dynamic capability action before validating ENHE capability (backport #21395)
  • pimd: guard channel OIL detach against stale pointers (backport #21431)
  • isisd: improve validation of flex-algo decoder (backport) (backport #21463)
  • ospfd: add validation in several places before accessing message bodies (backport #21303)
  • bgpd: Fix mixed remote-as for peer-groups when using auto (backport #21406)
  • ospfd: add LSA validation in the apiserver path (backport #21536)
  • bgpd: Don't mark nexthop as changed if a set next-hop unchanged is applied (backport #21445)
  • eigrpd: enforce minimum TLV length in Hello handler (backport #21543)
  • isisd: use correct min size values for srv6 subtlvs (backport #21540)
  • eigrpd: reject invalid prefix mask len (backport #21539)
  • bgpd: fix neighbor IP comparison for IPv6 memcmp return values (backport #21559)
  • eigrpd: Handling for malformed update packets (10.4 version)
  • eigrpd: fix byte order in Hello authentication decode (backport #21545)
  • lib: Report IPv6 MTU and not IPv4 for if_update_state_mtu6 (backport #21501)
  • bgp_evpn: fix memleak when configuring rd (backport #21566)
  • isisd: consume leftover bytes after FAD sub-sub-TLV loop (backport #21544)
  • nhrpd: stop debugging auth credentials (backport #21615)
  • bgpd: honor 'no activate' for dynamic neighbors in peer-group (backport #21658)
  • bgpd: Dynamic capability parsing fixes (backport #21603)
  • isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641)

Full Changelog: frr-10.4.3...frr-10.4.4

Loading

FRR Release 10.3.4

FRR Release 10.3.4

Choose a tag to compare

View all tags
@Jafaral Jafaral released this 28 Apr 20:31
frr-10.3.4
26a2cba

Debian Packages - https://deb.frrouting.org/
RPM Packages - https://rpm.frrouting.org/
Docker - quay.io/frrouting/frr

What's Changed

  • Alpine Docker fix ups for 3.22 (backport #20004)
  • bgpd: update source address for bgp neighbor (backport #20330)
  • docker: Add missing pytest package for Alpine as dependency (backport #20369)
  • bgpd: Use the default local-preference value and not 0 when adjusting (backport #20400)
  • eigrpd: Prevent crash in packet handling (backport #20410)
  • zebra: Fix memory leak when SRv6 explicit SID allocation fails (backport #20429)
  • isisd: fix crash when changing isis type (backport #20171)
  • zebra: Fix memory leak when SRv6 dynamic SID allocation fails (backport #20445)
  • ospfd: fixed ospf nssa flush issue (backport #20428)
  • zebra: EVPN check l3vni vxlan intf exist in rmac install (backport #20494)
  • bgpd: Fix multipath decision when multipath is 1 (backport #20493)
  • bgpd: reduce ibuf_work ring buffer size (backport #20554)
  • zebra: fix crash on inactive VRF and import table (backport #20525)
  • zebra: FRR restart leads to zebra mlag core (backport #20225)
  • bgpd: Fix double-free crash in peer_delete() during doppelganger peer… (backport #20661)
  • staticd: Fix SRv6 SID use-after-free on locator deletion (backport #20660 for 10.3)
  • bgpd: fix md5 password unset on dynamic nbr (backport #20740)
  • bgpd: Ignore transitiveness flag when checking type for link bandwidth (backport #20607)
  • bgpd: EVPN MH fix unimport ES route on vtep change (backport #20730)
  • Zebra fixup nhg handling from kernel (backport #20732)
  • bgpd: validate incoming NOTIFICATION messages (backport #20796)
  • Multiple local fix (backport #20798)
  • bgpd: improve flowspec NLRI validation (backport #20814)
  • zebra: EVPN fix access BD deref of mbr intf (backport #20791)
  • doc: add some text regarding libyang versions (backport #20862)
  • bgpd: Fix test for OPEN message with remote-as auto (backport #20963)
  • ospfd: harden TE/SR TLV iteration against malformed lengths (backport #21002)
  • bfdd: Fix wrong memory free when using ttable code (backport #21020)
  • bgpd: fix off-by-one error in FlowSpec operator array bounds check (backport #21054)
  • ospfd: fix sequence number check, avoid truncation ambiguity (backport #21096)
  • ldpd: improve tlv validation in several places (backport #21118)
  • isisd: fix edge condition in max_lsp_count computation (backport #21159)
  • bgpd: Return 0 if AS4 capability is malformed (backport #21112)
  • bgpd: Prevent heap use-after-free for tunnel encapsulation attribute (backport #21176)
  • bgpd: improve packet parsing for EVPN and ENCAP/VNC (backport #21098)
  • nhrpd: harden against malformed packets (backport #21097)
  • vrrrpd: improve error handling in several paths (backport #21251)
  • ripngd: fix data handling in several places (backport #21257)
  • ospf6d: improve/harden packet processing (backport #21277)
  • bgpd: Revalidate locally originated routes against RPKI changes (backport)
  • lib: fix zclient crash when many peers reconnect after FRR restart (backport #21056)
  • pceplib: validate during of_list TLV decoding (backport #21310)
  • bgpd: Do not allocate stream if route-refresh capability is not received (backport #21394)
  • bgpd: Check dynamic capability action before validating ENHE capability (backport #21395)
  • bgpd: Don't mark nexthop as changed if a set next-hop unchanged is applied (backport #21445)
  • ospfd: add LSA validation in the apiserver path (backport #21536)
  • eigrpd: enforce minimum TLV length in Hello handler (backport #21543)
  • lib: ignore gcc warning in 10.3 zlog lttng code
  • eigrpd: reject invalid prefix mask len (10.3 backport)
  • isisd: use correct min size values for srv6 subtlvs (backport #21540)
  • ospfd: add validation in several places before accessing message bodies (backport #21303)
  • bgpd: fix neighbor IP comparison for IPv6 memcmp return values (backport #21559)
  • eigrpd: fix byte order in Hello authentication decode (backport #21545)
  • bgpd: Dynamic capability parsing fixes (backport #21603)
  • isisd: consume leftover bytes after FAD sub-sub-TLV loop (backport #21544)
  • nhrpd: stop debugging auth credentials (backport #21615)
  • isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641)

Full Changelog: frr-10.3.3...frr-10.3.4

Loading

FRR Release 10.2.6

FRR Release 10.2.6

Choose a tag to compare

View all tags
@Jafaral Jafaral released this 28 Apr 20:31
frr-10.2.6
99443b3

Debian Packages - https://deb.frrouting.org/
RPM Packages - https://rpm.frrouting.org/
Docker - quay.io/frrouting/frr

What's Changed

  • Alpine Docker fix ups for 3.22 (backport #20004)
  • docker: Add missing pytest package for Alpine as dependency (backport #20369)
  • isisd: fix crash when changing isis type (backport #20171)
  • zebra: Fix memory leak when SRv6 dynamic SID allocation fails (backport #20445)
  • ospfd: fixed ospf nssa flush issue (backport #20428)
  • zebra: EVPN check l3vni vxlan intf exist in rmac install (backport #20494)
  • bgpd: Fix multipath decision when multipath is 1 (backport #20493)
  • bgpd: reduce ibuf_work ring buffer size (backport #20554)
  • zebra: fix crash on inactive VRF and import table (backport #20525)
  • zebra: FRR restart leads to zebra mlag core (backport #20225)
  • bgpd: Fix double-free crash in peer_delete() during doppelganger peer… (backport #20661)
  • bgpd: fix md5 password unset on dynamic nbr (backport #20740)
  • bgpd: validate incoming NOTIFICATION messages (backport #20796)
  • bgpd: improve flowspec NLRI validation (backport #20814)
  • zebra: EVPN fix access BD deref of mbr intf (backport #20791)
  • bgpd: Fix test for OPEN message with remote-as auto (backport #20963)
  • ospfd: harden TE/SR TLV iteration against malformed lengths (backport #21002)
  • bgpd: fix off-by-one error in FlowSpec operator array bounds check (backport #21054)
  • ospfd: fix sequence number check, avoid truncation ambiguity (backport #21096)
  • ldpd: improve tlv validation in several places (backport #21118)
  • isisd: fix edge condition in max_lsp_count computation (backport #21159)
  • bgpd: Return 0 if AS4 capability is malformed (backport #21112)
  • bgpd: Prevent heap use-after-free for tunnel encapsulation attribute (backport #21176)
  • bgpd: improve packet parsing for EVPN and ENCAP/VNC (backport #21098)
  • bgpd: fix NHT for explicit link-local BGP peers (backport #21188)
  • nhrpd: harden against malformed packets (backport #21097)
  • vrrrpd: improve error handling in several paths (backport #21251)
  • ripngd: fix data handling in several places (backport #21257)
  • ospf6d: improve/harden packet processing (backport #21277)
  • bgpd: Do not allocate stream if route-refresh capability is not received (backport #21394)
  • bgpd: Don't mark nexthop as changed if a set next-hop unchanged is applied (backport #21445)
  • ospfd: add validation in several places before accessing message bodies (backport #21303)
  • bgpd: fix neighbor IP comparison for IPv6 memcmp return values (backport #21559)
  • eigrpd: fix byte order in Hello authentication decode (backport #21545)
  • isisd: consume leftover bytes after FAD sub-sub-TLV loop (backport #21544)
  • nhrpd: stop debugging auth credentials (backport #21615)
  • isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641)
  • bgpd: Revalidate locally originated routes against RPKI changes (backport)

Full Changelog: frr-10.2.5...frr-10.2.6

Loading