September 2019 - dev - lists.frrouting.org

Regarding support for rsvp-te support in free routing
by Rhene Kavi 20 Feb '20

20 Feb '20

Hi All, Do we have any plans to support rsvp-te Thanks in advance KaviRhene

4 3

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 24 Sep '19

24 Sep '19

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 5 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 5 of 5 defect(s) ** CID 1486648: Incorrect expression (CONSTANT_EXPRESSION_RESULT) /pbrd/pbr_nht.c: 713 in pbr_nht_individual_nexthop_gw_update() ________________________________________________________________________________________________________ *** CID 1486648: Incorrect expression (CONSTANT_EXPRESSION_RESULT) /pbrd/pbr_nht.c: 713 in pbr_nht_individual_nexthop_gw_update() 707 708 if (!pnhi->nhr->nexthop_num) { 709 is_valid = false; 710 goto done; 711 } 712 >>> CID 1486648: Incorrect expression (CONSTANT_EXPRESSION_RESULT) >>> The expression "pnhc->nexthop->type == NEXTHOP_TYPE_IPV4_IFINDEX || pnhc->nexthop->type == NEXTHOP_TYPE_IPV4_IFINDEX" does not accomplish anything because it evaluates to either of its identical operands, "pnhc->nexthop->type == NEXTHOP_TYPE_IPV4_IFINDEX". 713 if (pnhc->nexthop->type == NEXTHOP_TYPE_IPV4_IFINDEX 714 || pnhc->nexthop->type == NEXTHOP_TYPE_IPV4_IFINDEX) { 715 716 /* GATEWAY_IFINDEX type shouldn't resolve to group */ 717 if (pnhi->nhr->nexthop_num > 1) { 718 is_valid = false; ** CID 1486647: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /bgpd/bgp_routemap.c: 280 in route_match_peer() ________________________________________________________________________________________________________ *** CID 1486647: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /bgpd/bgp_routemap.c: 280 in route_match_peer() 274 */ 275 if (sockunion_same(su, &su_def)) { 276 int ret; 277 if (CHECK_FLAG(peer->rmap_type, PEER_RMAP_TYPE_NETWORK) 278 || CHECK_FLAG(peer->rmap_type, 279 PEER_RMAP_TYPE_REDISTRIBUTE) >>> CID 1486647: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "peer->rmap_type & (256 /* 1 << 8 */)" is always 0 regardless of the values of its operands. This occurs as the logical second operand of "||". 280 || CHECK_FLAG(peer->rmap_type, 281 PEER_RMAP_TYPE_AGGREGATE) 282 || CHECK_FLAG(peer->rmap_type, 283 PEER_RMAP_TYPE_DEFAULT)) 284 ret = RMAP_MATCH; 285 else ** CID 1486646: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /bgpd/bgp_attr.c: 804 in bgp_attr_aggregate_intern() ________________________________________________________________________________________________________ *** CID 1486646: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /bgpd/bgp_attr.c: 804 in bgp_attr_aggregate_intern() 798 struct bgp_path_info rmap_path; 799 800 memset(&rmap_path, 0, sizeof(struct bgp_path_info)); 801 rmap_path.peer = bgp->peer_self; 802 rmap_path.attr = &attr_tmp; 803 >>> CID 1486646: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> In "bgp->peer_self->rmap_type |= 256 /* 1 << 8 */", wider "256 /* 1 << 8 */" has high-order bits (0x100) that don't affect the narrower left-hand side. 804 SET_FLAG(bgp->peer_self->rmap_type, PEER_RMAP_TYPE_AGGREGATE); 805 806 ret = route_map_apply(aggregate->rmap.map, p, RMAP_BGP, 807 &rmap_path); 808 809 bgp->peer_self->rmap_type = 0; ** CID 1486645: Null pointer dereferences (REVERSE_INULL) /isisd/isis_te.c: 84 in isis_link_params_update() ________________________________________________________________________________________________________ *** CID 1486645: Null pointer dereferences (REVERSE_INULL) /isisd/isis_te.c: 84 in isis_link_params_update() 78 79 /* Check if TE is enable or not */ 80 if (!circuit->area || !IS_MPLS_TE(circuit->area->mta)) 81 return; 82 83 /* Sanity Check */ >>> CID 1486645: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "circuit" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 84 if ((circuit == NULL) || (ifp == NULL) 85 || (circuit->state != C_STATE_UP)) 86 return; 87 88 zlog_debug("TE(%s): Update circuit parameters for interface %s", 89 circuit->area->area_tag, ifp->name); ** CID 1486644: Null pointer dereferences (NULL_RETURNS) /lib/if.c: 1511 in lib_interface_lookup_entry() ________________________________________________________________________________________________________ *** CID 1486644: Null pointer dereferences (NULL_RETURNS) /lib/if.c: 1511 in lib_interface_lookup_entry() 1505 const struct yang_list_keys *keys) 1506 { 1507 const char *ifname = keys->key[0]; 1508 const char *vrfname = keys->key[1]; 1509 struct vrf *vrf = vrf_lookup_by_name(vrfname); 1510 >>> CID 1486644: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "vrf", which is known to be "NULL". 1511 return if_lookup_by_name(ifname, vrf->vrf_id); 1512 } 1513 1514 /* 1515 * XPath: /frr-interface:lib/interface/description 1516 */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Meeting: Zebra Nexthop Group Sync Up
by Stephen Worley 17 Sep '19

17 Sep '19

To those interested, There will be a Zebra Nexthop Group Meeting this Friday, September 20th 10am EST. The purpose is to go through the code flow of this PR: https://github.com/FRRouting/frr/pull/4897 and sync up on future zebra dataplane work. We will host it on Donalds bluejeans link: https://bluejeans.com/9192742159 Thanks, sworley

1 0

ISIS SR discussion Friday, 6 Sept
by Mark Stapp 04 Sep '19

04 Sep '19

Hello all, During this week's regular dev meeting, we decided that it would be useful to have some dedicated discussion about the ISIS SR topic and initial PR (#4800). That discussion will be this Friday, the 6th, at 11am US East coast/4pm London. We'll use Donald's bluejeans session: https://bluejeans.com/9192742159/ Regards, Mark

2 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 03 Sep '19

03 Sep '19

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 16 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 21 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 16 of 16 defect(s) ** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 480 in seqnumber_mismatch() 474 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 475 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 476 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 477 478 ospf6_lsdb_remove_all(on->summary_list); 479 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 480 for (ALL_LSDB(on->retrans_list, lsa)) { 481 ospf6_decrement_retrans_count(lsa); 482 ospf6_lsdb_remove(lsa, on->retrans_list); 483 } 484 485 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2315 in ospf6_lsack_send_neighbor() 2309 2310 memset(sendbuf, 0, iobuflen); 2311 oh = (struct ospf6_header *)sendbuf; 2312 2313 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2314 >>> CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2315 for (ALL_LSDB(on->lsack_list, lsa)) { 2316 /* MTU check */ 2317 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2318 > ospf6_packet_max(on->ospf6_if)) { 2319 /* if we run out of packet size/space here, 2320 better to try again soon. */ ** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2231 in ospf6_lsupdate_send_interface() 2225 lsupdate = (struct ospf6_lsupdate *)((caddr_t)oh 2226 + sizeof(struct ospf6_header)); 2227 2228 p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); 2229 lsa_cnt = 0; 2230 >>> CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2231 for (ALL_LSDB(oi->lsupdate_list, lsa)) { 2232 /* MTU check */ 2233 if ((p - sendbuf + ((unsigned int)OSPF6_LSA_SIZE(lsa->header))) 2234 > ospf6_packet_max(oi)) { 2235 if (lsa_cnt) { 2236 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; ** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 306 in ospf6_lsdb_remove_all() 300 { 301 struct ospf6_lsa *lsa; 302 303 if (lsdb == NULL) 304 return; 305 >>> CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 306 for (ALL_LSDB(lsdb, lsa)) 307 ospf6_lsdb_remove(lsa, lsdb); 308 } 309 310 void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa) 311 { ** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 119 in ospf6_neighbor_delete() 113 void ospf6_neighbor_delete(struct ospf6_neighbor *on) 114 { 115 struct ospf6_lsa *lsa; 116 117 ospf6_lsdb_remove_all(on->summary_list); 118 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 119 for (ALL_LSDB(on->retrans_list, lsa)) { 120 ospf6_decrement_retrans_count(lsa); 121 ospf6_lsdb_remove(lsa, on->retrans_list); 122 } 123 124 ospf6_lsdb_remove_all(on->dbdesc_list); ** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1879 in ospf6_dbdesc_send_newone() 1873 ospf6_lsdb_remove_all(on->dbdesc_list); 1874 1875 /* move LSAs from summary_list to dbdesc_list (within neighbor 1876 structure) 1877 so that ospf6_send_dbdesc () can send those LSAs */ 1878 size = sizeof(struct ospf6_lsa_header) + sizeof(struct ospf6_dbdesc); >>> CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 1879 for (ALL_LSDB(on->summary_list, lsa)) { 1880 if (size + sizeof(struct ospf6_lsa_header) 1881 > ospf6_packet_max(on->ospf6_if)) { 1882 ospf6_lsdb_lsa_unlock(lsa); 1883 break; 1884 } ** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 517 in bad_lsreq() 511 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 512 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 513 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 514 515 ospf6_lsdb_remove_all(on->summary_list); 516 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 517 for (ALL_LSDB(on->retrans_list, lsa)) { 518 ospf6_decrement_retrans_count(lsa); 519 ospf6_lsdb_remove(lsa, on->retrans_list); 520 } 521 522 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 304 in negotiation_done() 298 if (IS_OSPF6_DEBUG_NEIGHBOR(EVENT)) 299 zlog_debug("Neighbor Event %s: *NegotiationDone*", on->name); 300 301 /* clear ls-list */ 302 ospf6_lsdb_remove_all(on->summary_list); 303 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 304 for (ALL_LSDB(on->retrans_list, lsa)) { 305 ospf6_decrement_retrans_count(lsa); 306 ospf6_lsdb_remove(lsa, on->retrans_list); 307 } 308 309 /* Interface scoped LSAs */ ** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 324 in ospf6_lsdb_maxage_remover() 318 319 int ospf6_lsdb_maxage_remover(struct ospf6_lsdb *lsdb) 320 { 321 int reschedule = 0; 322 struct ospf6_lsa *lsa; 323 >>> CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 324 for (ALL_LSDB(lsdb, lsa)) { 325 if (!OSPF6_LSA_IS_MAXAGE(lsa)) 326 continue; 327 if (lsa->retrans_count != 0) { 328 reschedule = 1; 329 continue; ** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2394 in ospf6_lsack_send_interface() 2388 2389 memset(sendbuf, 0, iobuflen); 2390 oh = (struct ospf6_header *)sendbuf; 2391 2392 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2393 >>> CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2394 for (ALL_LSDB(oi->lsack_list, lsa)) { 2395 /* MTU check */ 2396 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2397 > ospf6_packet_max(oi)) { 2398 /* if we run out of packet size/space here, 2399 better to try again soon. */ ** CID 1486257: Incorrect expression (MISSING_COMMA) /bgpd/bgp_fsm.c: 551 in () ________________________________________________________________________________________________________ *** CID 1486257: Incorrect expression (MISSING_COMMA) /bgpd/bgp_fsm.c: 551 in () 545 "Passive config change", 546 "Multihop config change", 547 "NSF peer closed the session", 548 "Intf peering v6only config change", 549 "BFD down received", 550 "Interface down", >>> CID 1486257: Incorrect expression (MISSING_COMMA) >>> In the initialization of "peer_down_str", a suspicious concatenated string ""Neighbor address lostWaiting for NHT"" is produced due to a missing comma between lines. 551 "Neighbor address lost" 552 "Waiting for NHT", 553 "Waiting for Peer IPv6 Addr", 554 "Waiting for VRF to be initialized"}; 555 556 static int bgp_graceful_restart_timer_expire(struct thread *thread) ** CID 1486256: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486256: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2047 in ospf6_lsupdate_send_neighbor() 2041 2042 p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); 2043 lsa_cnt = 0; 2044 2045 /* lsupdate_list lists those LSA which doesn't need to be 2046 retransmitted. remove those from the list */ >>> CID 1486256: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2047 for (ALL_LSDB(on->lsupdate_list, lsa)) { 2048 /* MTU check */ 2049 if ((p - sendbuf + (unsigned int)OSPF6_LSA_SIZE(lsa->header)) 2050 > ospf6_packet_max(on->ospf6_if)) { 2051 if (lsa_cnt) { 2052 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; ** CID 1486255: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486255: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 552 in oneway_received() 546 ospf6_neighbor_state_change(OSPF6_NEIGHBOR_INIT, on, 547 OSPF6_NEIGHBOR_EVENT_ONEWAY_RCVD); 548 thread_add_event(master, neighbor_change, on->ospf6_if, 0, NULL); 549 550 ospf6_lsdb_remove_all(on->summary_list); 551 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486255: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 552 for (ALL_LSDB(on->retrans_list, lsa)) { 553 ospf6_decrement_retrans_count(lsa); 554 ospf6_lsdb_remove(lsa, on->retrans_list); 555 } 556 557 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486254: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1486254: Null pointer dereferences (NULL_RETURNS) /eigrpd/eigrpd.c: 162 in eigrp_new() 156 157 /* init internal data structures */ 158 eigrp->eiflist = list_new(); 159 eigrp->passive_interface_default = EIGRP_IF_ACTIVE; 160 eigrp->networks = eigrp_topology_new(); 161 >>> CID 1486254: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "vrf_lookup_by_id(vrf_id)" when calling "eigrp_sock_init". 162 eigrp->fd = eigrp_sock_init(vrf_lookup_by_id(vrf_id)); 163 164 if (eigrp->fd < 0) { 165 flog_err_sys( 166 EC_LIB_SOCKET, 167 "eigrp_new: fatal error: eigrp_sock_init was unable to open a socket"); ** CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 449 in adj_ok() 443 444 } else if (on->state >= OSPF6_NEIGHBOR_EXSTART && !need_adjacency(on)) { 445 ospf6_neighbor_state_change(OSPF6_NEIGHBOR_TWOWAY, on, 446 OSPF6_NEIGHBOR_EVENT_ADJ_OK); 447 ospf6_lsdb_remove_all(on->summary_list); 448 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 449 for (ALL_LSDB(on->retrans_list, lsa)) { 450 ospf6_decrement_retrans_count(lsa); 451 ospf6_lsdb_remove(lsa, on->retrans_list); 452 } 453 } 454 ** CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1957 in ospf6_lsreq_send() 1951 } 1952 1953 if (last_req != NULL) { 1954 if (on->last_ls_req != NULL) { 1955 ospf6_lsa_unlock(on->last_ls_req); 1956 } >>> CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 1957 ospf6_lsa_lock(last_req); 1958 on->last_ls_req = last_req; 1959 } 1960 1961 oh->type = OSPF6_MESSAGE_TYPE_LSREQ; 1962 oh->length = htons(p - sendbuf); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0