Version in base suite: 2.17.5-0+deb13u1 Base version: bird2_2.17.5-0+deb13u1 Target version: bird2_2.17.6-0+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/b/bird2/bird2_2.17.5-0+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/b/bird2/bird2_2.17.6-0+deb13u1.dsc .gitlab-ci.yml | 182 -------------------------- NEWS | 8 + README | 4 VERSION | 2 conf/flowspec.Y | 4 debian/changelog | 6 debian/watch | 2 doc/bird.sgml | 2 filter/filter.c | 2 gitlab/data.yml.j2 | 16 +- gitlab/docker/debian-12-amd64/Dockerfile | 4 gitlab/docker/debian-13-amd64/Dockerfile | 4 gitlab/docker/debian-testing-amd64/Dockerfile | 4 gitlab/docker/ubuntu-24.04-amd64/Dockerfile | 6 gitlab/docker/ubuntu-25.04-amd64/Dockerfile | 6 gitlab/docker/ubuntu-25.10-amd64/Dockerfile | 6 gitlab/docker/ubuntu-26.04-amd64/Dockerfile | 6 lib/flowspec.c | 32 +--- lib/string.h | 8 + nest/password.h | 4 proto/bfd/packets.c | 7 - proto/bgp/bgp.c | 3 proto/bgp/packets.c | 10 - proto/ospf/packet.c | 7 - proto/rip/packets.c | 6 25 files changed, 78 insertions(+), 263 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmps7c_w_dd/bird2_2.17.5-0+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmps7c_w_dd/bird2_2.17.6-0+deb13u1.dsc: no acceptable signature found diff -Nru bird2-2.17.5/.gitlab-ci.yml bird2-2.17.6/.gitlab-ci.yml --- bird2-2.17.5/.gitlab-ci.yml 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/.gitlab-ci.yml 2026-07-30 15:27:42.000000000 +0000 @@ -1129,15 +1129,6 @@ variables: CROSSBUILD_ARCH: mips64el -crossbuild-s390x-debian-12-amd64: - <<: *build-docker-linux-amd64 - needs: - - job: docker-debian-12-amd64 - optional: true - image: registry.nic.cz/labs/bird:debian-12-amd64 - variables: - CROSSBUILD_ARCH: s390x - build-debian-12-i386: <<: *build-docker-linux-amd64 @@ -1189,15 +1180,6 @@ variables: CROSSBUILD_ARCH: riscv64 -crossbuild-s390x-debian-13-amd64: - <<: *build-docker-linux-amd64 - needs: - - job: docker-debian-13-amd64 - optional: true - image: registry.nic.cz/labs/bird:debian-13-amd64 - variables: - CROSSBUILD_ARCH: s390x - build-debian-13-i386: <<: *build-docker-linux-amd64 @@ -1240,15 +1222,6 @@ variables: CROSSBUILD_ARCH: riscv64 -crossbuild-s390x-debian-testing-amd64: - <<: *build-docker-linux-amd64 - needs: - - job: docker-debian-testing-amd64 - optional: true - image: registry.nic.cz/labs/bird:debian-testing-amd64 - variables: - CROSSBUILD_ARCH: s390x - build-debian-testing-i386: <<: *build-docker-linux-amd64 @@ -1324,15 +1297,6 @@ variables: CROSSBUILD_ARCH: riscv64 -crossbuild-s390x-ubuntu-24.04-amd64: - <<: *build-docker-linux-amd64 - needs: - - job: docker-ubuntu-24.04-amd64 - optional: true - image: registry.nic.cz/labs/bird:ubuntu-24.04-amd64 - variables: - CROSSBUILD_ARCH: s390x - build-ubuntu-25.04-amd64: <<: *build-docker-linux-amd64 @@ -1368,15 +1332,6 @@ variables: CROSSBUILD_ARCH: riscv64 -crossbuild-s390x-ubuntu-25.04-amd64: - <<: *build-docker-linux-amd64 - needs: - - job: docker-ubuntu-25.04-amd64 - optional: true - image: registry.nic.cz/labs/bird:ubuntu-25.04-amd64 - variables: - CROSSBUILD_ARCH: s390x - build-ubuntu-25.10-amd64: <<: *build-docker-linux-amd64 @@ -1421,15 +1376,6 @@ variables: CROSSBUILD_ARCH: riscv64 -crossbuild-s390x-ubuntu-25.10-amd64: - <<: *build-docker-linux-amd64 - needs: - - job: docker-ubuntu-25.10-amd64 - optional: true - image: registry.nic.cz/labs/bird:ubuntu-25.10-amd64 - variables: - CROSSBUILD_ARCH: s390x - build-ubuntu-26.04-amd64: <<: *build-docker-linux-amd64 @@ -1474,15 +1420,6 @@ variables: CROSSBUILD_ARCH: riscv64 -crossbuild-s390x-ubuntu-26.04-amd64: - <<: *build-docker-linux-amd64 - needs: - - job: docker-ubuntu-26.04-amd64 - optional: true - image: registry.nic.cz/labs/bird:ubuntu-26.04-amd64 - variables: - CROSSBUILD_ARCH: s390x - ####################################################### @@ -1800,16 +1737,6 @@ variables: CROSSBUILD_ARCH: mips64el -crosspkg-s390x-debian-12-amd64: - <<: *pkg-deb - needs: - - job: crossbuild-s390x-debian-12-amd64 - artifacts: false - - job: build-release - image: registry.nic.cz/labs/bird:debian-12-amd64 - variables: - CROSSBUILD_ARCH: s390x - pkg-debian-12-i386: <<: *pkg-deb @@ -1867,16 +1794,6 @@ variables: CROSSBUILD_ARCH: riscv64 -crosspkg-s390x-debian-13-amd64: - <<: *pkg-deb - needs: - - job: crossbuild-s390x-debian-13-amd64 - artifacts: false - - job: build-release - image: registry.nic.cz/labs/bird:debian-13-amd64 - variables: - CROSSBUILD_ARCH: s390x - pkg-debian-13-i386: <<: *pkg-deb @@ -1924,16 +1841,6 @@ variables: CROSSBUILD_ARCH: riscv64 -crosspkg-s390x-debian-testing-amd64: - <<: *pkg-deb - needs: - - job: crossbuild-s390x-debian-testing-amd64 - artifacts: false - - job: build-release - image: registry.nic.cz/labs/bird:debian-testing-amd64 - variables: - CROSSBUILD_ARCH: s390x - pkg-debian-testing-i386: <<: *pkg-deb @@ -2018,16 +1925,6 @@ variables: CROSSBUILD_ARCH: riscv64 -crosspkg-s390x-ubuntu-24.04-amd64: - <<: *pkg-deb - needs: - - job: crossbuild-s390x-ubuntu-24.04-amd64 - artifacts: false - - job: build-release - image: registry.nic.cz/labs/bird:ubuntu-24.04-amd64 - variables: - CROSSBUILD_ARCH: s390x - pkg-ubuntu-25.04-amd64: <<: *pkg-deb @@ -2067,16 +1964,6 @@ variables: CROSSBUILD_ARCH: riscv64 -crosspkg-s390x-ubuntu-25.04-amd64: - <<: *pkg-deb - needs: - - job: crossbuild-s390x-ubuntu-25.04-amd64 - artifacts: false - - job: build-release - image: registry.nic.cz/labs/bird:ubuntu-25.04-amd64 - variables: - CROSSBUILD_ARCH: s390x - pkg-ubuntu-25.10-amd64: <<: *pkg-deb @@ -2126,16 +2013,6 @@ variables: CROSSBUILD_ARCH: riscv64 -crosspkg-s390x-ubuntu-25.10-amd64: - <<: *pkg-deb - needs: - - job: crossbuild-s390x-ubuntu-25.10-amd64 - artifacts: false - - job: build-release - image: registry.nic.cz/labs/bird:ubuntu-25.10-amd64 - variables: - CROSSBUILD_ARCH: s390x - pkg-ubuntu-26.04-amd64: <<: *pkg-deb @@ -2185,16 +2062,6 @@ variables: CROSSBUILD_ARCH: riscv64 -crosspkg-s390x-ubuntu-26.04-amd64: - <<: *pkg-deb - needs: - - job: crossbuild-s390x-ubuntu-26.04-amd64 - artifacts: false - - job: build-release - image: registry.nic.cz/labs/bird:ubuntu-26.04-amd64 - variables: - CROSSBUILD_ARCH: s390x - ## Package installability checks @@ -2488,13 +2355,6 @@ image: registry.nic.cz/labs/bird:debian-12-amd64 variables: CROSSBUILD_ARCH: mips64el -crossinstall-s390x-debian-12-amd64: - <<: *install-deb - needs: - - job: crosspkg-s390x-debian-12-amd64 - image: registry.nic.cz/labs/bird:debian-12-amd64 - variables: - CROSSBUILD_ARCH: s390x install-debian-12-i386: <<: *install-deb @@ -2537,13 +2397,6 @@ image: registry.nic.cz/labs/bird:debian-13-amd64 variables: CROSSBUILD_ARCH: riscv64 -crossinstall-s390x-debian-13-amd64: - <<: *install-deb - needs: - - job: crosspkg-s390x-debian-13-amd64 - image: registry.nic.cz/labs/bird:debian-13-amd64 - variables: - CROSSBUILD_ARCH: s390x install-debian-13-i386: <<: *install-deb @@ -2579,13 +2432,6 @@ image: registry.nic.cz/labs/bird:debian-testing-amd64 variables: CROSSBUILD_ARCH: riscv64 -crossinstall-s390x-debian-testing-amd64: - <<: *install-deb - needs: - - job: crosspkg-s390x-debian-testing-amd64 - image: registry.nic.cz/labs/bird:debian-testing-amd64 - variables: - CROSSBUILD_ARCH: s390x install-debian-testing-i386: <<: *install-deb @@ -2649,13 +2495,6 @@ image: registry.nic.cz/labs/bird:ubuntu-24.04-amd64 variables: CROSSBUILD_ARCH: riscv64 -crossinstall-s390x-ubuntu-24.04-amd64: - <<: *install-deb - needs: - - job: crosspkg-s390x-ubuntu-24.04-amd64 - image: registry.nic.cz/labs/bird:ubuntu-24.04-amd64 - variables: - CROSSBUILD_ARCH: s390x install-ubuntu-25.04-amd64: <<: *install-deb @@ -2684,13 +2523,6 @@ image: registry.nic.cz/labs/bird:ubuntu-25.04-amd64 variables: CROSSBUILD_ARCH: riscv64 -crossinstall-s390x-ubuntu-25.04-amd64: - <<: *install-deb - needs: - - job: crosspkg-s390x-ubuntu-25.04-amd64 - image: registry.nic.cz/labs/bird:ubuntu-25.04-amd64 - variables: - CROSSBUILD_ARCH: s390x install-ubuntu-25.10-amd64: <<: *install-deb @@ -2726,13 +2558,6 @@ image: registry.nic.cz/labs/bird:ubuntu-25.10-amd64 variables: CROSSBUILD_ARCH: riscv64 -crossinstall-s390x-ubuntu-25.10-amd64: - <<: *install-deb - needs: - - job: crosspkg-s390x-ubuntu-25.10-amd64 - image: registry.nic.cz/labs/bird:ubuntu-25.10-amd64 - variables: - CROSSBUILD_ARCH: s390x install-ubuntu-26.04-amd64: <<: *install-deb @@ -2768,13 +2593,6 @@ image: registry.nic.cz/labs/bird:ubuntu-26.04-amd64 variables: CROSSBUILD_ARCH: riscv64 -crossinstall-s390x-ubuntu-26.04-amd64: - <<: *install-deb - needs: - - job: crosspkg-s390x-ubuntu-26.04-amd64 - image: registry.nic.cz/labs/bird:ubuntu-26.04-amd64 - variables: - CROSSBUILD_ARCH: s390x ################################### diff -Nru bird2-2.17.5/NEWS bird2-2.17.6/NEWS --- bird2-2.17.5/NEWS 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/NEWS 2026-07-30 15:27:42.000000000 +0000 @@ -1,3 +1,11 @@ +Version 2.17.6 (2026-07-30) + o BGP: Fix stack buffer overflow in Flowspec NLRI decoder + o BGP: Minor improvements in Flowspec parsing + o BGP: Fix minor issues with send hold timer + o Fix null byte handling in authentication keys + o Filter: Fix zero arg handling + o Update bird-users mailing list links + Version 2.17.5 (2026-06-09) o BGP: Fix several issues in Flowspec handling o BMP: Fix off-by-one buffer overflow diff -Nru bird2-2.17.5/README bird2-2.17.6/README --- bird2-2.17.5/README 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/README 2026-07-30 15:27:42.000000000 +0000 @@ -71,8 +71,8 @@ users mailing list bird-users@network.cz, just send `subscribe' to bird-request@network.cz. -Subscribe: http://bird.network.cz/mailman/listinfo/bird-users/ -Archive: http://bird.network.cz/pipermail/bird-users/ +Subscribe: https://bird.nic.cz/lists/bird-users/ +Archive: https://bird.nic.cz/lists/bird-users/archive/ Please don't send security issues to the mailing-list, contact us instead at bird-support@network.cz which is a private e-mail address where you also can diff -Nru bird2-2.17.5/VERSION bird2-2.17.6/VERSION --- bird2-2.17.5/VERSION 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/VERSION 2026-07-30 15:27:42.000000000 +0000 @@ -1 +1 @@ -2.17.5 +2.17.6 diff -Nru bird2-2.17.5/conf/flowspec.Y bird2-2.17.6/conf/flowspec.Y --- bird2-2.17.5/conf/flowspec.Y 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/conf/flowspec.Y 2026-07-30 15:27:42.000000000 +0000 @@ -59,7 +59,7 @@ | ICMP CODE { $$ = FLOW_TYPE_ICMP_CODE; } | LENGTH { $$ = FLOW_TYPE_PACKET_LENGTH; } | DSCP { $$ = FLOW_TYPE_DSCP; } - | LABEL { $$ = FLOW_TYPE_LABEL; } + | LABEL { $$ = FLOW_TYPE_LABEL; if (!this_flow->ipv6) cf_error("Flow label not valid in flow4"); } ; flow_num_type: flow_num_type_{ flow_builder_set_type(this_flow, $1); }; @@ -123,7 +123,7 @@ ; flow_frag_val: - DONT_FRAGMENT { $$ = 1; } + DONT_FRAGMENT { $$ = 1; if (this_flow->ipv6) cf_error("Flag dont_fragment not valid in flow6"); } | IS_FRAGMENT { $$ = 2; } | FIRST_FRAGMENT { $$ = 4; } | LAST_FRAGMENT { $$ = 8; } diff -Nru bird2-2.17.5/debian/changelog bird2-2.17.6/debian/changelog --- bird2-2.17.5/debian/changelog 2026-06-14 18:44:10.000000000 +0000 +++ bird2-2.17.6/debian/changelog 2026-08-02 03:32:37.000000000 +0000 @@ -1,3 +1,9 @@ +bird2 (2.17.6-0+deb13u1) stable; urgency=medium + + * New upstream release. + + -- Marco d'Itri Sun, 02 Aug 2026 05:32:37 +0200 + bird2 (2.17.5-0+deb13u1) trixie-security; urgency=medium * New upstream release. diff -Nru bird2-2.17.5/debian/watch bird2-2.17.6/debian/watch --- bird2-2.17.5/debian/watch 2026-06-14 18:44:10.000000000 +0000 +++ bird2-2.17.6/debian/watch 2026-08-02 03:32:37.000000000 +0000 @@ -1,2 +1,2 @@ version=4 -https://bird.network.cz/download/bird-(2\.[\d.]+).tar.gz +https://bird.nic.cz/download/ bird-(2\.[\d.]+).tar.gz diff -Nru bird2-2.17.5/doc/bird.sgml bird2-2.17.6/doc/bird.sgml --- bird2-2.17.5/doc/bird.sgml 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/doc/bird.sgml 2026-07-30 15:27:42.000000000 +0000 @@ -6717,7 +6717,7 @@ () where you can share your experiences with the other users and consult your problems with the authors. To subscribe to the list, visit -. +. The home page of BIRD can be found at .

BIRD is a relatively young system and it probably contains some bugs. You can diff -Nru bird2-2.17.5/filter/filter.c bird2-2.17.6/filter/filter.c --- bird2-2.17.5/filter/filter.c 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/filter/filter.c 2026-07-30 15:27:42.000000000 +0000 @@ -170,7 +170,7 @@ /* Set the arguments and top-level variables */ fstk->vcnt = line->vars + line->args; - memcpy(fstk->vstk, argv, sizeof(struct f_val) * line->args); + bmemcpy(fstk->vstk, argv, sizeof(struct f_val) * line->args); memset(fstk->vstk + line->args, 0, sizeof(struct f_val) * line->vars); /* The same as with the value stack. Not resetting the stack completely for performance reasons. */ diff -Nru bird2-2.17.5/gitlab/data.yml.j2 bird2-2.17.6/gitlab/data.yml.j2 --- bird2-2.17.5/gitlab/data.yml.j2 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/gitlab/data.yml.j2 2026-07-30 15:27:42.000000000 +0000 @@ -104,9 +104,9 @@ # Debian from oldoldstable up to testing {% for num, codename, crossarch in ( (11, "bullseye", []), - (12, "bookworm", ["mips64el", "s390x"]), - (13, "trixie", ["arm64", "armel", "armhf", "riscv64", "s390x"]), - ("testing", "testing", ["arm64", "armhf", "riscv64", "s390x"]) + (12, "bookworm", ["mips64el"]), + (13, "trixie", ["arm64", "armel", "armhf", "riscv64"]), + ("testing", "testing", ["arm64", "armhf", "riscv64"]) ) -%} {% for arch in ('amd64', 'i386') -%} - name: debian-{{num}}-{{arch}} @@ -124,16 +124,17 @@ # These debian don't crossbuild. TODO fix that. # 12 -> ["arm64", "armel", "armhf"] -> Error 127 from `make check` probably because qemu-user is somehow botched +# 12, 13, testing -> s390x -> does not install, impossible to replicate locally # Last 7 years of Ubuntu LTS {% for num, crossarch in ( ('18.04', []), ('20.04', []), ('22.04', []), - ('24.04', ["arm64", "armhf", "ppc64el", "riscv64", "s390x"]), - ('25.04', ["armhf", "ppc64el", "riscv64", "s390x"]), - ('25.10', ["arm64", "armhf", "ppc64el", "riscv64", "s390x"]), - ('26.04', ["arm64", "armhf", "ppc64el", "riscv64", "s390x"]), + ('24.04', ["arm64", "armhf", "ppc64el", "riscv64"]), + ('25.04', ["armhf", "ppc64el", "riscv64"]), + ('25.10', ["arm64", "armhf", "ppc64el", "riscv64"]), + ('26.04', ["arm64", "armhf", "ppc64el", "riscv64"]), ) -%} - name: ubuntu-{{ num }}-amd64 type: deb @@ -150,6 +151,7 @@ # -> ["s390x"] doesn't pack -> debugedit --build-id --build-id-seed=bird2/2.18\+branch.mq.nightly.d0b6b85ebc17-cznic.1\~jammy debian/bird2/usr/sbin/birdc died with signal 11 # -> ["riscv64"] fails on dynamic linking libatomic.so.1 when running tests # '25.04' -> ["arm64"] fails in `make check` with Timeout expired on `rt-fib_test` +# 24.04 through 26.04 -> s390x -> does not install, impossible to replicate locally birdlab: - name: openbsd-76 diff -Nru bird2-2.17.5/gitlab/docker/debian-12-amd64/Dockerfile bird2-2.17.6/gitlab/docker/debian-12-amd64/Dockerfile --- bird2-2.17.5/gitlab/docker/debian-12-amd64/Dockerfile 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/gitlab/docker/debian-12-amd64/Dockerfile 2026-07-30 15:27:42.000000000 +0000 @@ -7,7 +7,6 @@ ENV DEBIAN_FRONTEND=noninteractive RUN find /etc/apt/sourc* -type f -exec grep -nH '.*' '{}' + RUN dpkg --add-architecture mips64el -RUN dpkg --add-architecture s390x RUN find /etc/apt/sourc* -type f -exec grep -nH '.*' '{}' + RUN apt-get -y update RUN apt-get -y upgrade @@ -22,9 +21,6 @@ crossbuild-essential-mips64el \ libreadline-dev:mips64el \ ncurses-dev:mips64el \ - crossbuild-essential-s390x \ - libreadline-dev:s390x \ - ncurses-dev:s390x \ qemu-user \ qemu-user-binfmt \ binfmt-support \ diff -Nru bird2-2.17.5/gitlab/docker/debian-13-amd64/Dockerfile bird2-2.17.6/gitlab/docker/debian-13-amd64/Dockerfile --- bird2-2.17.5/gitlab/docker/debian-13-amd64/Dockerfile 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/gitlab/docker/debian-13-amd64/Dockerfile 2026-07-30 15:27:42.000000000 +0000 @@ -10,7 +10,6 @@ RUN dpkg --add-architecture armel RUN dpkg --add-architecture armhf RUN dpkg --add-architecture riscv64 -RUN dpkg --add-architecture s390x RUN find /etc/apt/sourc* -type f -exec grep -nH '.*' '{}' + RUN apt-get -y update RUN apt-get -y upgrade @@ -34,9 +33,6 @@ crossbuild-essential-riscv64 \ libreadline-dev:riscv64 \ ncurses-dev:riscv64 \ - crossbuild-essential-s390x \ - libreadline-dev:s390x \ - ncurses-dev:s390x \ qemu-user \ qemu-user-binfmt \ binfmt-support \ diff -Nru bird2-2.17.5/gitlab/docker/debian-testing-amd64/Dockerfile bird2-2.17.6/gitlab/docker/debian-testing-amd64/Dockerfile --- bird2-2.17.5/gitlab/docker/debian-testing-amd64/Dockerfile 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/gitlab/docker/debian-testing-amd64/Dockerfile 2026-07-30 15:27:42.000000000 +0000 @@ -9,7 +9,6 @@ RUN dpkg --add-architecture arm64 RUN dpkg --add-architecture armhf RUN dpkg --add-architecture riscv64 -RUN dpkg --add-architecture s390x RUN find /etc/apt/sourc* -type f -exec grep -nH '.*' '{}' + RUN apt-get -y update RUN apt-get -y upgrade @@ -30,9 +29,6 @@ crossbuild-essential-riscv64 \ libreadline-dev:riscv64 \ ncurses-dev:riscv64 \ - crossbuild-essential-s390x \ - libreadline-dev:s390x \ - ncurses-dev:s390x \ qemu-user \ qemu-user-binfmt \ binfmt-support \ diff -Nru bird2-2.17.5/gitlab/docker/ubuntu-24.04-amd64/Dockerfile bird2-2.17.6/gitlab/docker/ubuntu-24.04-amd64/Dockerfile --- bird2-2.17.5/gitlab/docker/ubuntu-24.04-amd64/Dockerfile 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/gitlab/docker/ubuntu-24.04-amd64/Dockerfile 2026-07-30 15:27:42.000000000 +0000 @@ -10,10 +10,9 @@ RUN dpkg --add-architecture armhf RUN dpkg --add-architecture ppc64el RUN dpkg --add-architecture riscv64 -RUN dpkg --add-architecture s390x RUN find /etc/apt/sourc* -type f -exec sed -i '/Components: /a\ Architectures: amd64' '{}' + -RUN find /etc/apt/sourc* -type f -exec sed 's#URIs: .*#URIs: http://ports.ubuntu.com/ubuntu-ports/#;s#Architectures: amd64#Architectures: arm64,armhf,ppc64el,riscv64,s390x#' '{}' + > /etc/apt/sources.list.d/crossbuild.sources +RUN find /etc/apt/sourc* -type f -exec sed 's#URIs: .*#URIs: http://ports.ubuntu.com/ubuntu-ports/#;s#Architectures: amd64#Architectures: arm64,armhf,ppc64el,riscv64#' '{}' + > /etc/apt/sources.list.d/crossbuild.sources RUN find /etc/apt/sourc* -type f -exec grep -nH '.*' '{}' + RUN apt-get -y update RUN apt-get -y upgrade @@ -38,9 +37,6 @@ crossbuild-essential-riscv64 \ libreadline-dev:riscv64 \ ncurses-dev:riscv64 \ - crossbuild-essential-s390x \ - libreadline-dev:s390x \ - ncurses-dev:s390x \ qemu-user \ qemu-user-binfmt \ binfmt-support \ diff -Nru bird2-2.17.5/gitlab/docker/ubuntu-25.04-amd64/Dockerfile bird2-2.17.6/gitlab/docker/ubuntu-25.04-amd64/Dockerfile --- bird2-2.17.5/gitlab/docker/ubuntu-25.04-amd64/Dockerfile 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/gitlab/docker/ubuntu-25.04-amd64/Dockerfile 2026-07-30 15:27:42.000000000 +0000 @@ -9,10 +9,9 @@ RUN dpkg --add-architecture armhf RUN dpkg --add-architecture ppc64el RUN dpkg --add-architecture riscv64 -RUN dpkg --add-architecture s390x RUN find /etc/apt/sourc* -type f -exec sed -i '/Components: /a\ Architectures: amd64' '{}' + -RUN find /etc/apt/sourc* -type f -exec sed 's#URIs: .*#URIs: http://ports.ubuntu.com/ubuntu-ports/#;s#Architectures: amd64#Architectures: armhf,ppc64el,riscv64,s390x#' '{}' + > /etc/apt/sources.list.d/crossbuild.sources +RUN find /etc/apt/sourc* -type f -exec sed 's#URIs: .*#URIs: http://ports.ubuntu.com/ubuntu-ports/#;s#Architectures: amd64#Architectures: armhf,ppc64el,riscv64#' '{}' + > /etc/apt/sources.list.d/crossbuild.sources RUN find /etc/apt/sourc* -type f -exec grep -nH '.*' '{}' + RUN apt-get -y update RUN apt-get -y upgrade @@ -34,9 +33,6 @@ crossbuild-essential-riscv64 \ libreadline-dev:riscv64 \ ncurses-dev:riscv64 \ - crossbuild-essential-s390x \ - libreadline-dev:s390x \ - ncurses-dev:s390x \ qemu-user \ qemu-user-binfmt \ binfmt-support \ diff -Nru bird2-2.17.5/gitlab/docker/ubuntu-25.10-amd64/Dockerfile bird2-2.17.6/gitlab/docker/ubuntu-25.10-amd64/Dockerfile --- bird2-2.17.5/gitlab/docker/ubuntu-25.10-amd64/Dockerfile 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/gitlab/docker/ubuntu-25.10-amd64/Dockerfile 2026-07-30 15:27:42.000000000 +0000 @@ -10,10 +10,9 @@ RUN dpkg --add-architecture armhf RUN dpkg --add-architecture ppc64el RUN dpkg --add-architecture riscv64 -RUN dpkg --add-architecture s390x RUN find /etc/apt/sourc* -type f -exec sed -i '/Components: /a\ Architectures: amd64' '{}' + -RUN find /etc/apt/sourc* -type f -exec sed 's#URIs: .*#URIs: http://ports.ubuntu.com/ubuntu-ports/#;s#Architectures: amd64#Architectures: arm64,armhf,ppc64el,riscv64,s390x#' '{}' + > /etc/apt/sources.list.d/crossbuild.sources +RUN find /etc/apt/sourc* -type f -exec sed 's#URIs: .*#URIs: http://ports.ubuntu.com/ubuntu-ports/#;s#Architectures: amd64#Architectures: arm64,armhf,ppc64el,riscv64#' '{}' + > /etc/apt/sources.list.d/crossbuild.sources RUN find /etc/apt/sourc* -type f -exec grep -nH '.*' '{}' + RUN apt-get -y update RUN apt-get -y upgrade @@ -38,9 +37,6 @@ crossbuild-essential-riscv64 \ libreadline-dev:riscv64 \ ncurses-dev:riscv64 \ - crossbuild-essential-s390x \ - libreadline-dev:s390x \ - ncurses-dev:s390x \ qemu-user \ qemu-user-binfmt \ binfmt-support \ diff -Nru bird2-2.17.5/gitlab/docker/ubuntu-26.04-amd64/Dockerfile bird2-2.17.6/gitlab/docker/ubuntu-26.04-amd64/Dockerfile --- bird2-2.17.5/gitlab/docker/ubuntu-26.04-amd64/Dockerfile 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/gitlab/docker/ubuntu-26.04-amd64/Dockerfile 2026-07-30 15:27:42.000000000 +0000 @@ -10,10 +10,9 @@ RUN dpkg --add-architecture armhf RUN dpkg --add-architecture ppc64el RUN dpkg --add-architecture riscv64 -RUN dpkg --add-architecture s390x RUN find /etc/apt/sourc* -type f -exec sed -i '/Components: /a\ Architectures: amd64' '{}' + -RUN find /etc/apt/sourc* -type f -exec sed 's#URIs: .*#URIs: http://ports.ubuntu.com/ubuntu-ports/#;s#Architectures: amd64#Architectures: arm64,armhf,ppc64el,riscv64,s390x#' '{}' + > /etc/apt/sources.list.d/crossbuild.sources +RUN find /etc/apt/sourc* -type f -exec sed 's#URIs: .*#URIs: http://ports.ubuntu.com/ubuntu-ports/#;s#Architectures: amd64#Architectures: arm64,armhf,ppc64el,riscv64#' '{}' + > /etc/apt/sources.list.d/crossbuild.sources RUN find /etc/apt/sourc* -type f -exec grep -nH '.*' '{}' + RUN apt-get -y update RUN apt-get -y upgrade @@ -38,9 +37,6 @@ crossbuild-essential-riscv64 \ libreadline-dev:riscv64 \ ncurses-dev:riscv64 \ - crossbuild-essential-s390x \ - libreadline-dev:s390x \ - ncurses-dev:s390x \ qemu-user \ qemu-user-binfmt \ binfmt-support \ diff -Nru bird2-2.17.5/lib/flowspec.c bird2-2.17.6/lib/flowspec.c --- bird2-2.17.5/lib/flowspec.c 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/lib/flowspec.c 2026-07-30 15:27:42.000000000 +0000 @@ -350,17 +350,17 @@ [FLOW_TYPE_FRAGMENT] = 1, }; -/* Maximum valid numeric values (in bytes), semantically */ +/* Maximum valid numeric values (in bits), semantically */ static const u8 flow_max_valid_value[FLOW_TYPE_MAX] = { - [FLOW_TYPE_IP_PROTOCOL] = 1, - [FLOW_TYPE_PORT] = 2, - [FLOW_TYPE_DST_PORT] = 2, - [FLOW_TYPE_SRC_PORT] = 2, - [FLOW_TYPE_ICMP_TYPE] = 1, - [FLOW_TYPE_ICMP_CODE] = 1, - [FLOW_TYPE_PACKET_LENGTH] = 2, - [FLOW_TYPE_DSCP] = 1, - [FLOW_TYPE_LABEL] = 4, + [FLOW_TYPE_IP_PROTOCOL] = 8, + [FLOW_TYPE_PORT] = 16, + [FLOW_TYPE_DST_PORT] = 16, + [FLOW_TYPE_SRC_PORT] = 16, + [FLOW_TYPE_ICMP_TYPE] = 8, + [FLOW_TYPE_ICMP_CODE] = 8, + [FLOW_TYPE_PACKET_LENGTH] = 16, + [FLOW_TYPE_DSCP] = 6, + [FLOW_TYPE_LABEL] = 20, }; /** @@ -405,16 +405,10 @@ flow_check_cf_numeric_arg(struct flow_builder *fb, uint val) { enum flow_type t = fb->this_type; - uint max = flow_max_valid_value[t]; + u64 max = (U64(1) << flow_max_valid_value[t]) - 1; - if (t == FLOW_TYPE_DSCP && val > 0x3f) - cf_error("%s value %u out of range (0-63)", flow_type_str(t, fb->ipv6), val); - - if (max == 1 && (val > 0xff)) - cf_error("%s value %u out of range (0-255)", flow_type_str(t, fb->ipv6), val); - - if (max == 2 && (val > 0xffff)) - cf_error("%s value %u out of range (0-65535)", flow_type_str(t, fb->ipv6), val); + if (max && (val > max)) + cf_error("%s value %u out of range (0-%lu)", flow_type_str(t, fb->ipv6), val, max); } /* Bitmask of padding bits in last byte of prefix */ diff -Nru bird2-2.17.5/lib/string.h bird2-2.17.6/lib/string.h --- bird2-2.17.5/lib/string.h 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/lib/string.h 2026-07-30 15:27:42.000000000 +0000 @@ -94,6 +94,14 @@ return dest; } +static inline void * +memcpy0(void *dst, const void *src, size_t dst_len, size_t src_len) +{ + memset(dst, 0, dst_len); + memcpy(dst, src, MIN_(dst_len, src_len)); + return dst; +} + #define ROUTER_ID_64_LENGTH 23 #endif diff -Nru bird2-2.17.5/nest/password.h bird2-2.17.6/nest/password.h --- bird2-2.17.5/nest/password.h 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/nest/password.h 2026-07-30 15:27:42.000000000 +0000 @@ -26,10 +26,10 @@ struct password_item *password_find_by_value(list *l, char *pass, uint size); void password_validate_length(const struct password_item *p); -static inline int password_verify(struct password_item *p1, char *p2, uint size) +static inline int password_verify(const struct password_item *p1, const char *p2, uint size) { char buf[size]; - strncpy(buf, p1->password, size); + memcpy0(buf, p1->password, size, p1->length); return !memcmp(buf, p2, size); } diff -Nru bird2-2.17.5/proto/bfd/packets.c bird2-2.17.6/proto/bfd/packets.c --- bird2-2.17.5/proto/bfd/packets.c 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/proto/bfd/packets.c 2026-07-30 15:27:42.000000000 +0000 @@ -148,7 +148,7 @@ { struct bfd_crypto_auth *auth = (void *) (pkt + 1); uint hash_alg = bfd_auth_type_to_hash_alg[cf->auth_type]; - uint hash_len = mac_type_length(pass->alg); + uint hash_len = mac_type_length(hash_alg); /* Increase CSN about one time per second */ u32 new_time = (u64) current_time() >> 20; @@ -169,7 +169,8 @@ pkt->flags |= BFD_FLAG_AP; pkt->length += auth->length; - strncpy(auth->data, pass->password, hash_len); + memcpy0(auth->data, pass->password, hash_len, pass->length); + mac_fill(hash_alg, NULL, 0, (byte *) pkt, pkt->length, auth->data); return; } @@ -262,7 +263,7 @@ byte *auth_data = alloca(hash_len); memcpy(auth_data, auth->data, hash_len); - strncpy(auth->data, pass->password, hash_len); + memcpy0(auth->data, pass->password, hash_len, pass->length); if (!mac_verify(hash_alg, NULL, 0, (byte *) pkt, pkt->length, auth_data)) DROP("wrong authentication code", pass->id); diff -Nru bird2-2.17.5/proto/bgp/bgp.c bird2-2.17.6/proto/bgp/bgp.c --- bird2-2.17.5/proto/bgp/bgp.c 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/proto/bgp/bgp.c 2026-07-30 15:27:42.000000000 +0000 @@ -2587,6 +2587,9 @@ if (cf->keepalive_time > (cf->hold_time / 2)) log(L_WARN "Keepalive time should be at most 1/2 of hold time"); + if ((cf->send_hold_time > 0) && (cf->send_hold_time < cf->hold_time)) + cf_error("Send hold time must be zero or at least hold time"); + if (cf->min_hold_time > cf->hold_time) cf_error("Min hold time (%u) exceeds hold time (%u)", cf->min_hold_time, cf->hold_time); diff -Nru bird2-2.17.5/proto/bgp/packets.c bird2-2.17.6/proto/bgp/packets.c --- bird2-2.17.5/proto/bgp/packets.c 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/proto/bgp/packets.c 2026-07-30 15:27:42.000000000 +0000 @@ -922,12 +922,14 @@ /* Compute effective hold and keepalive times */ uint hold_time = MIN(hold, p->cf->hold_time); + uint base_hold_time = p->cf->hold_time ?: 1; + uint keepalive_time = p->cf->keepalive_time ? - (p->cf->keepalive_time * hold_time / p->cf->hold_time) : + (p->cf->keepalive_time * hold_time / base_hold_time) : hold_time / 3; uint send_hold_time = (p->cf->send_hold_time >= 0) ? - (p->cf->send_hold_time * hold_time / p->cf->hold_time) : + ((u64) p->cf->send_hold_time * hold_time / base_hold_time) : 2 * hold_time; /* Keepalive time might be rounded down to zero */ @@ -2104,7 +2106,7 @@ uint pxlen = 0; /* Decode dst prefix */ - if (data[0] == FLOW_TYPE_DST_PREFIX) + if (dlen && (data[0] == FLOW_TYPE_DST_PREFIX)) { px = flow_read_ip4_part(data); pxlen = flow_read_pxlen(data); @@ -2199,7 +2201,7 @@ uint pxlen = 0; /* Decode dst prefix */ - if (data[0] == FLOW_TYPE_DST_PREFIX) + if (dlen && (data[0] == FLOW_TYPE_DST_PREFIX)) { px = flow_read_ip6_part(data); pxlen = flow_read_pxlen(data); diff -Nru bird2-2.17.5/proto/ospf/packet.c bird2-2.17.6/proto/ospf/packet.c --- bird2-2.17.5/proto/ospf/packet.c 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/proto/ospf/packet.c 2026-07-30 15:27:42.000000000 +0000 @@ -64,7 +64,8 @@ log(L_ERR "No suitable password found for authentication"); return; } - strncpy(auth->password, pass->password, sizeof(auth->password)); + memcpy0(auth->password, pass->password, sizeof(auth->password), pass->length); + /* fallthrough */ case OSPF_AUTH_NONE: @@ -111,7 +112,7 @@ /* Append key for keyed hash, append padding for HMAC (RFC 5709 3.3) */ if (pass->alg < ALG_HMAC) - strncpy(auth_tail, pass->password, auth_len); + memcpy0(auth_tail, pass->password, auth_len, pass->length); else memset32(auth_tail, HMAC_MAGIC, auth_len / 4); @@ -235,7 +236,7 @@ /* Append key for keyed hash, append padding for HMAC (RFC 5709 3.3) */ if (pass->alg < ALG_HMAC) - strncpy(auth_tail, pass->password, auth_len); + memcpy0(auth_tail, pass->password, auth_len, pass->length); else memset32(auth_tail, HMAC_MAGIC, auth_len / 4); diff -Nru bird2-2.17.5/proto/rip/packets.c bird2-2.17.6/proto/rip/packets.c --- bird2-2.17.5/proto/rip/packets.c 2026-06-09 09:02:29.000000000 +0000 +++ bird2-2.17.6/proto/rip/packets.c 2026-07-30 15:27:42.000000000 +0000 @@ -274,7 +274,7 @@ case RIP_AUTH_PLAIN: auth->must_be_ffff = htons(0xffff); auth->auth_type = htons(RIP_AUTH_PLAIN); - strncpy(auth->password, pass->password, RIP_PASSWD_LENGTH); + memcpy0(auth->password, pass->password, sizeof(auth->password), pass->length); return; case RIP_AUTH_CRYPTO: @@ -313,7 +313,7 @@ /* Append key for keyed hash, append padding for HMAC (RFC 4822 2.5) */ if (pass->alg < ALG_HMAC) - strncpy(tail->auth_data, pass->password, auth_len); + memcpy0(tail->auth_data, pass->password, auth_len, pass->length); else memset32(tail->auth_data, HMAC_MAGIC, auth_len / 4); @@ -402,7 +402,7 @@ /* Append key for keyed hash, append padding for HMAC (RFC 4822 2.5) */ if (pass->alg < ALG_HMAC) - strncpy(tail->auth_data, pass->password, auth_len); + memcpy0(tail->auth_data, pass->password, auth_len, pass->length); else memset32(tail->auth_data, HMAC_MAGIC, auth_len / 4);