import CS frr10-10.4.1-3.el9

.fmf/version

@@ -1 +0,0 @@
-1

.frr10.metadata

@@ -0,0 +1 @@
+d1821bccda983da1bd3c7c1f3d45d2bffbdea74e SOURCES/frr-10.4.1.tar.gz

.gitignore

@@ -1,2 +1 @@
-/frr-10.4.1.tar.gz
-/frr-10.4.3.tar.gz
+SOURCES/frr-10.4.1.tar.gz

0015-fix-CVE-2026-37457.patch

@@ -1,42 +0,0 @@
-From 0e6882bc72c0278988a47b2f0f73b7a91099a25c Mon Sep 17 00:00:00 2001
-From: Jafar Al-Gharaibeh <jafar@atcorp.com>
-Date: Mon, 9 Mar 2026 14:36:22 -0500
-Subject: [PATCH] bgpd: fix off-by-one error in FlowSpec operator array bounds
- check
-
-Change loop > BGP_PBR_MATCH_VAL_MAX to loop >= BGP_PBR_MATCH_VAL_MAX
-in bgp_flowspec_op_decode() and bgp_flowspec_bitmask_decode() to
-prevent writing one element past the end of the mval[] array when
-more than 5 chained operators are present in a FlowSpec component.
-
-Reported-by: Jiahao Lei
-Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com>
----
- bgpd/bgp_flowspec_util.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/bgpd/bgp_flowspec_util.c b/bgpd/bgp_flowspec_util.c
-index f2da778c2e66..5528a4f6a0e3 100644
---- a/bgpd/bgp_flowspec_util.c
-+++ b/bgpd/bgp_flowspec_util.c
-@@ -274,8 +274,10 @@ int bgp_flowspec_op_decode(enum bgp_flowspec_util_nlri_t type,
- 	}
- 
- 	do {
--		if (loop > BGP_PBR_MATCH_VAL_MAX)
-+		if (loop >= BGP_PBR_MATCH_VAL_MAX) {
- 			*error = -2;
-+			return offset;
-+		}
- 
- 		if (offset >= max_len) {
- 			*error = -1;
-@@ -397,7 +399,7 @@ int bgp_flowspec_bitmask_decode(enum bgp_flowspec_util_nlri_t type,
- 	}
- 
- 	do {
--		if (loop > BGP_PBR_MATCH_VAL_MAX) {
-+		if (loop >= BGP_PBR_MATCH_VAL_MAX) {
- 			*error = -2;
- 			return offset;
- 		}

0016-fix-CVE-2026-37459.patch

@@ -1,30 +0,0 @@
-From 693a2e02687cdc9d16501275e05136edea9650d9 Mon Sep 17 00:00:00 2001
-From: Donatas Abraitis <donatas@opensourcerouting.org>
-Date: Tue, 10 Mar 2026 20:16:10 +0200
-Subject: [PATCH] bgpd: Check if the NHC length is enough to fill TLV value +
- TLV header
-
-BGP_NHC_TLV_MIN_LEN is 4 bytes (TLV code + TLV length), and when we parse TLVs,
-we subtract BGP_NHC_TLV_MIN_LEN as well, so we should include BGP_NHC_TLV_MIN_LEN
-when checking the remaining length too.
-
-Reported-by: Jiahao Lei
-
-Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
----
- bgpd/bgp_attr.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
-index 6bcf5f690613..b707e0531e94 100644
---- a/bgpd/bgp_attr.c
-+++ b/bgpd/bgp_attr.c
-@@ -3887,7 +3887,7 @@ static int bgp_attr_nhc(struct bgp_attr_parser_args *args)
- 		tlv_code = stream_getw(s);
- 		tlv_length = stream_getw(s);
- 
--		if (length < tlv_length) {
-+		if (length < tlv_length + BGP_NHC_TLV_MIN_LEN) {
- 			zlog_err("%pBP rcvd BGP NHC TLV length %d exceeds remaining length %d",
- 				 peer, tlv_length, length);
- 			bgp_nhc_free(nhc);

0017-fix-CVE-2026-37460.patch

@@ -1,97 +0,0 @@
-From bbb2a8a4c25957b1920f03571c0e43f21fbe9736 Mon Sep 17 00:00:00 2001
-From: Mark Stapp <mjs@cisco.com>
-Date: Wed, 11 Mar 2026 14:52:54 -0400
-Subject: [PATCH] bgpd: improve packet parsing for EVPN and ENCAP/VNC
-
-Improve packet validation for EVPN NLRIs and for ENCAP/VNC.
-
-Signed-off-by: Mark Stapp <mjs@cisco.com>
----
- bgpd/bgp_evpn.c        | 17 +++++++++++++++++
- bgpd/bgp_evpn_mh.c     | 10 +++++++++-
- bgpd/rfapi/rfapi_rib.c |  9 +++++++++
- 3 files changed, 35 insertions(+), 1 deletion(-)
-
-diff --git a/bgpd/bgp_evpn.c b/bgpd/bgp_evpn.c
-index a8fa99fcd..ef9e607ab 100644
---- a/bgpd/bgp_evpn.c
-+++ b/bgpd/bgp_evpn.c
-@@ -4984,6 +4984,14 @@ static int process_type2_route(struct peer *peer, afi_t afi, safi_t safi,
- 		goto fail;
- 	}
- 
-+	/* Validate ipaddr_len against the NLRI length */
-+	if ((psize != 33 + (ipaddr_len / 8)) && (psize != 36 + (ipaddr_len / 8))) {
-+		flog_err(EC_BGP_EVPN_ROUTE_INVALID,
-+			 "%u:%s - Rx EVPN Type-2 NLRI with invalid IP address length %d",
-+			 peer->bgp->vrf_id, peer->host, ipaddr_len);
-+		goto fail;
-+	}
-+
- 	if (ipaddr_len) {
- 		ipaddr_len /= 8; /* Convert to bytes. */
- 		p.prefix.macip_addr.ip.ipa_type = (ipaddr_len == IPV4_MAX_BYTELEN)
-@@ -5081,6 +5089,15 @@ static int process_type3_route(struct peer *peer, afi_t afi, safi_t safi,
- 
- 	/* Get the IP. */
- 	ipaddr_len = *pfx++;
-+
-+	/* Validate */
-+	if (psize != 13 + (ipaddr_len / 8)) {
-+		flog_err(EC_BGP_EVPN_ROUTE_INVALID,
-+			 "%u:%s - Rx EVPN Type-3 NLRI with invalid IP address length %d",
-+			 peer->bgp->vrf_id, peer->host, ipaddr_len);
-+		return -1;
-+	}
-+
- 	if (ipaddr_len == IPV4_MAX_BITLEN) {
- 		p.prefix.imet_addr.ip.ipa_type = IPADDR_V4;
- 		memcpy(&p.prefix.imet_addr.ip.ip.addr, pfx, IPV4_MAX_BYTELEN);
-diff --git a/bgpd/bgp_evpn_mh.c b/bgpd/bgp_evpn_mh.c
-index f03678af6..71b2ba0b2 100644
---- a/bgpd/bgp_evpn_mh.c
-+++ b/bgpd/bgp_evpn_mh.c
-@@ -752,9 +752,17 @@ int bgp_evpn_type4_route_process(struct peer *peer, afi_t afi, safi_t safi,
- 	memcpy(&esi, pfx, ESI_BYTES);
- 	pfx += ESI_BYTES;
- 
--
- 	/* Get the IP. */
- 	ipaddr_len = *pfx++;
-+
-+	/* Validate */
-+	if (psize != 19 + (ipaddr_len / 8)) {
-+		flog_err(EC_BGP_EVPN_ROUTE_INVALID,
-+			 "%u:%s - Rx EVPN Type-4 NLRI with invalid IP address length %d",
-+			 peer->bgp->vrf_id, peer->host, ipaddr_len);
-+		return -1;
-+	}
-+
- 	if (ipaddr_len == IPV4_MAX_BITLEN) {
- 		memcpy(&vtep_ip, pfx, IPV4_MAX_BYTELEN);
- 	} else {
-diff --git a/bgpd/rfapi/rfapi_rib.c b/bgpd/rfapi/rfapi_rib.c
-index 9a3d56b06..11384b51c 100644
---- a/bgpd/rfapi/rfapi_rib.c
-+++ b/bgpd/rfapi/rfapi_rib.c
-@@ -668,11 +668,20 @@ static void rfapiRibBi2Ri(struct bgp_path_info *bpi, struct rfapi_info *ri,
- 			break;
- 
- 		case BGP_VNC_SUBTLV_TYPE_RFPOPTION:
-+			/* Check for short subtlv: drop */
-+			if (pEncap->length < 3)
-+				break;
-+
-+			/* Length of zero not valid */
-+			if (pEncap->value[1] == 0)
-+				break;
-+
- 			hop = XCALLOC(MTYPE_BGP_TEA_OPTIONS,
- 				      sizeof(struct bgp_tea_options));
- 			assert(hop);
- 			hop->type = pEncap->value[0];
- 			hop->length = pEncap->value[1];
-+
- 			hop->value = XCALLOC(MTYPE_BGP_TEA_OPTIONS_VALUE,
- 					     pEncap->length - 2);
- 			assert(hop->value);

SOURCES/frr-tmpfiles.conf

@@ -0,0 +1 @@
+d /run/frr 0755 frr frr -

SPECS/frr10.spec

@@ -7,8 +7,8 @@
 %bcond_without selinux
 
 Name: frr10
-Version: 10.4.3
-Release: 4%{?checkout}%{?dist}
+Version: 10.4.1
+Release: 3%{?checkout}%{?dist}
 Summary: Routing daemon
 License: GPLv2+
 URL: http://www.frrouting.org
@@ -31,7 +31,7 @@ BuildRequires:  groff
 BuildRequires:  json-c-devel
 BuildRequires:  libcap-devel
 BuildRequires:  libtool
-BuildRequires:  libyang-devel >= 2.1.148
+BuildRequires:  libyang-devel >= 2.0.0
 BuildRequires:  make
 BuildRequires:  ncurses
 BuildRequires:  ncurses-devel
@@ -51,7 +51,6 @@ BuildRequires:  protobuf-c-devel
 
 Requires: net-snmp
 Requires: ncurses
-Requires: libyang >= 2.1.148
 Requires(post): systemd
 Requires(post): /sbin/install-info
 Requires(post): hostname
@@ -73,12 +72,6 @@ Patch0003: 0003-disable-eigrp-crypto.patch
 Patch0004: 0004-fips-mode.patch
 # Turn off one fuzz test that fails with the new glibc
 Patch0014: 0014-isisd-fuzz-test.patch
-# https://github.com/FRRouting/frr/commit/0e6882bc
-Patch0015: 0015-fix-CVE-2026-37457.patch
-# https://github.com/FRRouting/frr/commit/693a2e02
-Patch0016: 0016-fix-CVE-2026-37459.patch
-# https://github.com/FRRouting/frr/commit/7676cad65114aa23adde58
-Patch0017: 0017-fix-CVE-2026-37460.patch
 
 %description
 FRRouting is free software that manages TCP/IP based routing protocols. It takes
@@ -153,7 +146,8 @@ bzip2 -9 selinux/%{build_name}.pp
 
 %install
 mkdir -p %{buildroot}/etc/{frr,rc.d/init.d,sysconfig,logrotate.d,pam.d,default} \
-         %{buildroot}%{_infodir} %{buildroot}%{_unitdir}
+         %{buildroot}/var/log/frr %{buildroot}%{_infodir} \
+         %{buildroot}%{_unitdir}
 
 mkdir -p -m 0755 %{buildroot}%{_libdir}/frr
 mkdir -p %{buildroot}%{_tmpfilesdir}
@@ -260,6 +254,7 @@ make check PYTHON=%{__python3}
 %license COPYING
 %doc doc/mpls
 %dir %attr(750,frr,frr) %{_sysconfdir}/frr
+%dir %attr(755,frr,frr) /var/log/frr
 %dir %attr(755,frr,frr) /run/frr
 %{_infodir}/*info*
 %{_mandir}/man*/*
@@ -287,25 +282,6 @@ make check PYTHON=%{__python3}
 %endif
 
 %changelog
-* Tue Jul 21 2026 Michal Ruprich <mruprich@redhat.com> - 10.4.3-4
-- Fix CVE-2026-37460: improve packet parsing for EVPN and ENCAP/VNC
-- Resolves: RHEL-193237
-
-* Thu May 21 2026 Michal Ruprich <mruprich@redhat.com> - 10.4.3-3
-- Resolves: RHEL-174696 - denial of service via crafted BGP UPDATE message
-
-* Thu May 21 2026 Michal Ruprich <mruprich@redhat.com> - 10.4.3-2
-- Resolves: RHEL-174678 - denial of service via crafted FlowSpec component
-
-* Thu Apr 09 2026 Michal Ruprich <mruprich@redhat.com> - 10.4.3-1
-- Resolves: RHEL-157859 - Bump FRR to 10.4.3 to fix EVPN problems
-
-* Wed Apr 08 2026 Michal Ruprich <mruprich@redhat.com> - 10.4.1-5
-- Resolves: RHEL-155911 - Files under /var are not properly created in image-mode
-
-* Wed Apr 08 2026 Michal Ruprich <mruprich@redhat.com> - 10.4.1-4
-- Resolves: RHEL-158428 - fix Requires for libyang to pull in rebased version
-
 * Fri Feb 06 2026 Michal Ruprich <mruprich@redhat.com> - 10.4.1-3
 - Resolves: RHEL-147189 - AVC failures when running frr10
 

ci.fmf

@@ -1 +0,0 @@
-resultsdb-testcase: separate

frr-tmpfiles.conf

@@ -1,2 +0,0 @@
-d /run/frr 0755 frr frr -
-d /var/log/frr 0755 frr frr -

gating.yaml

@@ -1,25 +0,0 @@
---- !Policy
-product_versions:
-  - fedora-*
-decision_context: bodhi_update_push_testing
-subject_type: koji_build
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
- 
-#Rawhide
---- !Policy
-product_versions:
-  - fedora-*
-decision_context: bodhi_update_push_stable
-subject_type: koji_build
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
- 
-#gating rhel
---- !Policy
-product_versions:
-  - rhel-*
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-public.functional}
-  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional}

plans.fmf

@@ -1,38 +0,0 @@
-environment+:
-  PACKAGE: frr10
-
-/tier1-internal:
-  plan:
-    import:
-      url: https://gitlab.com/redhat/centos-stream/tests/frr.git
-      name: /plans/frr10/tier1/internal
-
-/tier1-public:
-  plan:
-    import:
-      url: https://gitlab.com/redhat/centos-stream/tests/frr.git
-      name: /plans/frr10/tier1/public
-
-/tier2-tier3-internal:
-  plan:
-    import:
-      url: https://gitlab.com/redhat/centos-stream/tests/frr.git
-      name: /plans/frr10/tier2-tier3/internal
-
-/tier2-tier3-public:
-  plan:
-    import:
-      url: https://gitlab.com/redhat/centos-stream/tests/frr.git
-      name: /plans/frr10/tier2-tier3/public
-
-/others-internal:
-  plan:
-    import:
-      url: https://gitlab.com/redhat/centos-stream/tests/frr.git
-      name: /plans/frr10/others/internal
-
-/others-public:
-  plan:
-    import:
-      url: https://gitlab.com/redhat/centos-stream/tests/frr.git
-      name: /plans/frr10/others/public

rpminspect.yaml

@@ -1,7 +0,0 @@
----
-runpath:
-    allowed_paths:
-        - /usr/lib64/frr
-        - /usr/lib/frr
-inspections:
-    badfuncs: off

sources

@@ -1 +0,0 @@
-SHA512 (frr-10.4.3.tar.gz) = 680227d34c8f55e1336e9c08e14831361128cb5ffdfb20adcf9c0ddcd7b9bb510d5bb9cb4ec16f004faa63c7cb4404367711d7971f7b17037f4f3b1a1f4b53e3