November 2023 - dev - lists.frrouting.org

FRR 9.0.1 and 8.5.3 Releases
by Jafar Al-Gharaibeh 28 Nov '23

28 Nov '23

Dear FRR Community, We are pleased to announce FRR 9.0.1 and FRR 8.5.3 bug fix releases. For release notes please visit: https://frrouting.org/release/ https://github.com/FRRouting/frr/releases Security updates: https://frrouting.org/security Cheers, The FRR Development Team!

1 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 14 Nov '23

14 Nov '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1571038: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1571038: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_bmp.c: 351 in bmp_per_peer_hdr() 345 /* set router-id but for LOC-RIB INSTANCE (RFC 9069) put the instance 346 * router-id if available or 0 347 */ 348 struct in_addr *bgp_id = 349 !is_locrib ? &peer->remote_id : bgp ? &bgp->router_id : NULL; 350 >>> CID 1571038: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bgp_id" to "stream_put_in_addr", which dereferences it. 351 stream_put_in_addr(s, bgp_id); 352 353 /* Timestamp */ 354 if (tv) { 355 stream_putl(s, tv->tv_sec); 356 stream_putl(s, tv->tv_usec); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 11 Nov '23

11 Nov '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1570969: (OVERRUN) /bgpd/bgp_snmp_bgp4v2.c: 534 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 575 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 514 in bgp4v2PathAttrLookup() ________________________________________________________________________________________________________ *** CID 1570969: (OVERRUN) /bgpd/bgp_snmp_bgp4v2.c: 534 in bgp4v2PathAttrLookup() 528 /* Set OID offset for prefix type */ 529 offset = name + namelen; 530 offsetlen = *length - namelen; 531 len = offsetlen; 532 533 if (offsetlen == 0) { >>> CID 1570969: (OVERRUN) >>> Overrunning array "bgp->rib" of 4 64-byte elements at element index 4 (byte offset 319) using index "afi" (which evaluates to 4). 534 dest = bgp_table_top(bgp->rib[afi][SAFI_UNICAST]); 535 safi = SAFI_UNICAST; 536 } else { 537 538 /* bgp4V2NlriAfi is already get */ 539 /* it is comming from the name parameter */ /bgpd/bgp_snmp_bgp4v2.c: 575 in bgp4v2PathAttrLookup() 569 addr->prefixlen = afi_len * 8; 570 571 offset++; 572 offsetlen--; 573 574 /* get node */ >>> CID 1570969: (OVERRUN) >>> Overrunning array "bgp->rib" of 4 64-byte elements at element index 4 (byte offset 319) using index "afi" (which evaluates to 4). 575 dest = bgp_node_get(bgp->rib[afi][safi], addr); 576 } 577 578 if (!dest) 579 return NULL; 580 /bgpd/bgp_snmp_bgp4v2.c: 514 in bgp4v2PathAttrLookup() 508 else 509 oid2in6_addr(offset, &su.sin6.sin6_addr); 510 511 /* bgp4V2NlriIndex currently ignored */ 512 513 /* Lookup node */ >>> CID 1570969: (OVERRUN) >>> Overrunning array "bgp->rib" of 4 64-byte elements at element index 4 (byte offset 319) using index "afi" (which evaluates to 4). 514 dest = bgp_node_lookup(bgp->rib[afi][safi], addr); 515 if (dest) { 516 for (path = bgp_dest_get_bgp_path_info(dest); path; 517 path = path->next) 518 if (sockunion_same(&path->peer->connection->su, 519 &su)) ** CID 1570968: Memory - corruptions (OVERRUN) /bgpd/bgp_snmp_bgp4v2.c: 605 in bgp4v2PathAttrLookup() ________________________________________________________________________________________________________ *** CID 1570968: Memory - corruptions (OVERRUN) /bgpd/bgp_snmp_bgp4v2.c: 605 in bgp4v2PathAttrLookup() 599 } else { 600 /* default case start with ipv4*/ 601 if (afi == AFI_IP) 602 family = AF_INET; 603 else 604 family = AF_INET6; >>> CID 1570968: Memory - corruptions (OVERRUN) >>> Overrunning struct type in_addr of 4 bytes by passing it to a function which accesses it at byte offset 15 using argument "16UL". 605 memset(&paddr.ip._v4_addr, 0, sizeof(paddr.ip)); 606 } 607 608 do { 609 min = NULL; 610 min_family = 0; ** CID 1570967: (SIZEOF_MISMATCH) /bgpd/bgp_snmp_bgp4v2.c: 702 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 483 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 561 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 695 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 682 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 487 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 677 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 556 in bgp4v2PathAttrLookup() ________________________________________________________________________________________________________ *** CID 1570967: (SIZEOF_MISMATCH) /bgpd/bgp_snmp_bgp4v2.c: 702 in bgp4v2PathAttrLookup() 696 addr->u.prefix4 = rn_p->u.prefix4; 697 } else { 698 *offset = IANA_AFI_IPV6; 699 offset++; 700 oid_copy_in6_addr( 701 offset, &min->peer->connection->su.sin6.sin6_addr); >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (struct in6_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in6_addr)" is extraneous and should be replaced with 1. 702 offset += IN6_ADDR_SIZE; 703 addr->u.prefix6 = rn_p->u.prefix6; 704 } 705 706 /* Encode bgp4V2NlriIndex*/ 707 /bgpd/bgp_snmp_bgp4v2.c: 483 in bgp4v2PathAttrLookup() 477 offset++; 478 479 /* get bgp4V2NlriPrefix */ 480 if (prefix_type == IANA_AFI_IPV4) { 481 oid2in_addr(offset, IN_ADDR_SIZE, &addr->u.prefix4); 482 addr->family = AF_INET; >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "4UL /* sizeof (struct in_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in_addr)" is extraneous and should be replaced with 1. 483 offset += IN_ADDR_SIZE; 484 } else if (prefix_type == IANA_AFI_IPV6) { 485 oid2in6_addr(offset, &addr->u.prefix6); 486 addr->family = AF_INET6; 487 offset += IN6_ADDR_SIZE; 488 } /bgpd/bgp_snmp_bgp4v2.c: 561 in bgp4v2PathAttrLookup() 555 addr->family = AF_INET; 556 offset += IN_ADDR_SIZE; 557 offsetlen -= IN_ADDR_SIZE; 558 } else if (prefix_type == IANA_AFI_IPV6) { 559 oid2in6_addr(offset, &addr->u.prefix6); 560 addr->family = AF_INET6; >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (struct in6_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in6_addr)" is extraneous and should be replaced with 1. 561 offset += IN6_ADDR_SIZE; 562 offsetlen -= IN6_ADDR_SIZE; 563 } 564 565 /* get bgp4V2NlriPrefixLen */ 566 if (offsetlen > 0) /bgpd/bgp_snmp_bgp4v2.c: 695 in bgp4v2PathAttrLookup() 689 /* Encode bgp4V2PeerRemoteAddr */ 690 if (min_family == AF_INET) { 691 *offset = IANA_AFI_IPV4; 692 offset++; 693 oid_copy_in_addr(offset, 694 &min->peer->connection->su.sin.sin_addr); >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "4UL /* sizeof (struct in_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in_addr)" is extraneous and should be replaced with 1. 695 offset += IN_ADDR_SIZE; 696 addr->u.prefix4 = rn_p->u.prefix4; 697 } else { 698 *offset = IANA_AFI_IPV6; 699 offset++; 700 oid_copy_in6_addr( /bgpd/bgp_snmp_bgp4v2.c: 682 in bgp4v2PathAttrLookup() 676 oid_copy_in_addr(offset, &rn_p->u.prefix4); 677 offset += IN_ADDR_SIZE; 678 } else { 679 *offset = IANA_AFI_IPV6; 680 offset++; 681 oid_copy_in6_addr(offset, &rn_p->u.prefix6); >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (struct in6_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in6_addr)" is extraneous and should be replaced with 1. 682 offset += IN6_ADDR_SIZE; 683 } 684 /* encode bgp4V2NlriPrefixLen into index*/ 685 *offset = rn_p->prefixlen; 686 offset++; 687 /bgpd/bgp_snmp_bgp4v2.c: 487 in bgp4v2PathAttrLookup() 481 oid2in_addr(offset, IN_ADDR_SIZE, &addr->u.prefix4); 482 addr->family = AF_INET; 483 offset += IN_ADDR_SIZE; 484 } else if (prefix_type == IANA_AFI_IPV6) { 485 oid2in6_addr(offset, &addr->u.prefix6); 486 addr->family = AF_INET6; >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (struct in6_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in6_addr)" is extraneous and should be replaced with 1. 487 offset += IN6_ADDR_SIZE; 488 } 489 490 /* get bgp4V2NlriPrefixLen */ 491 addr->prefixlen = *offset; 492 offset++; /bgpd/bgp_snmp_bgp4v2.c: 677 in bgp4v2PathAttrLookup() 671 /* encode bgp4V2NlriPrefixType into index*/ 672 /* encode bgp4V2NlriPrefix into index */ 673 if (rn_p->family == AF_INET) { 674 *offset = IANA_AFI_IPV4; 675 offset++; 676 oid_copy_in_addr(offset, &rn_p->u.prefix4); >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "4UL /* sizeof (struct in_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in_addr)" is extraneous and should be replaced with 1. 677 offset += IN_ADDR_SIZE; 678 } else { 679 *offset = IANA_AFI_IPV6; 680 offset++; 681 oid_copy_in6_addr(offset, &rn_p->u.prefix6); 682 offset += IN6_ADDR_SIZE; /bgpd/bgp_snmp_bgp4v2.c: 556 in bgp4v2PathAttrLookup() 550 prefix_type = *offset; 551 offset++; 552 /* get bgp4V2NlriPrefix */ 553 if (prefix_type == IANA_AFI_IPV4) { 554 oid2in_addr(offset, IN_ADDR_SIZE, &addr->u.prefix4); 555 addr->family = AF_INET; >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "4UL /* sizeof (struct in_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in_addr)" is extraneous and should be replaced with 1. 556 offset += IN_ADDR_SIZE; 557 offsetlen -= IN_ADDR_SIZE; 558 } else if (prefix_type == IANA_AFI_IPV6) { 559 oid2in6_addr(offset, &addr->u.prefix6); 560 addr->family = AF_INET6; 561 offset += IN6_ADDR_SIZE; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 08 Nov '23

08 Nov '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 4 of 4 defect(s) ** CID 1570951: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 2344 in mgmt_txn_notify_be_adapter_conn() ________________________________________________________________________________________________________ *** CID 1570951: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 2344 in mgmt_txn_notify_be_adapter_conn() 2338 * completed */ 2339 if (txn->type == MGMTD_TXN_TYPE_CONFIG) { 2340 cmtcfg_req = txn->commit_cfg_req 2341 ? &txn->commit_cfg_req->req 2342 .commit_cfg 2343 : NULL; >>> CID 1570951: Integer handling issues (BAD_SHIFT) >>> In expression "1ULL << adapter->id", shifting by a negative amount has undefined behavior. The shift amount, "adapter->id", is as little as -1. 2344 if (cmtcfg_req && IS_IDBIT_SET(cmtcfg_req->clients, 2345 adapter->id)) { 2346 mgmt_txn_send_commit_cfg_reply( 2347 txn, MGMTD_INTERNAL_ERROR, 2348 "Backend daemon disconnected while processing commit!"); 2349 } ** CID 1570950: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 1344 in mgmt_txn_send_be_cfg_data() ________________________________________________________________________________________________________ *** CID 1570950: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 1344 in mgmt_txn_send_be_cfg_data() 1338 struct mgmt_be_cfgreq cfg_req = { 0 }; 1339 size_t num_batches, indx; 1340 1341 assert(txn->type == MGMTD_TXN_TYPE_CONFIG && txn->commit_cfg_req); 1342 1343 cmtcfg_req = &txn->commit_cfg_req->req.commit_cfg; >>> CID 1570950: Integer handling issues (BAD_SHIFT) >>> In expression "1ULL << adapter->id", shifting by a negative amount has undefined behavior. The shift amount, "adapter->id", is as little as -1. 1344 assert(IS_IDBIT_SET(cmtcfg_req->clients, adapter->id)); 1345 1346 indx = 0; 1347 num_batches = 1348 mgmt_txn_batches_count(&cmtcfg_req->curr_batches[adapter->id]); 1349 FOREACH_TXN_CFG_BATCH_IN_LIST (&cmtcfg_req->curr_batches[adapter->id], ** CID 1570949: (BAD_SHIFT) /mgmtd/mgmt_be_adapter.c: 168 in mgmt_register_client_xpath() /mgmtd/mgmt_be_adapter.c: 161 in mgmt_register_client_xpath() ________________________________________________________________________________________________________ *** CID 1570949: (BAD_SHIFT) /mgmtd/mgmt_be_adapter.c: 168 in mgmt_register_client_xpath() 162 return; 163 } 164 } 165 /* we didn't find a matching entry */ 166 map = darr_append(*maps); 167 map->xpath_prefix = XSTRDUP(MTYPE_MGMTD_XPATH, xpath); >>> CID 1570949: (BAD_SHIFT) >>> In expression "1UL << id", shifting by a negative amount has undefined behavior. The shift amount, "id", is as little as -1. 168 map->clients = (1ul << id); 169 } 170 171 /* 172 * initial the combined maps from per client maps 173 */ /mgmtd/mgmt_be_adapter.c: 161 in mgmt_register_client_xpath() 155 struct mgmt_be_xpath_map **maps, *map; 156 157 maps = config ? &be_cfg_xpath_map : &be_oper_xpath_map; 158 159 darr_foreach_p (*maps, map) { 160 if (!strcmp(xpath, map->xpath_prefix)) { >>> CID 1570949: (BAD_SHIFT) >>> In expression "1U << id", shifting by a negative amount has undefined behavior. The shift amount, "id", is as little as -1. 161 map->clients |= (1u << id); 162 return; 163 } 164 } 165 /* we didn't find a matching entry */ 166 map = darr_append(*maps); ** CID 1570948: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 1397 in mgmt_txn_send_be_txn_delete() ________________________________________________________________________________________________________ *** CID 1570948: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 1397 in mgmt_txn_send_be_txn_delete() 1391 struct mgmt_commit_cfg_req *cmtcfg_req = 1392 &txn->commit_cfg_req->req.commit_cfg; 1393 1394 assert(txn->type == MGMTD_TXN_TYPE_CONFIG); 1395 assert(!mgmt_txn_batches_count(&cmtcfg_req->curr_batches[adapter->id])); 1396 >>> CID 1570948: Integer handling issues (BAD_SHIFT) >>> In expression "1ULL << adapter->id", shifting by a negative amount has undefined behavior. The shift amount, "adapter->id", is as little as -1. 1397 if (IS_IDBIT_UNSET(cmtcfg_req->clients, adapter->id)) 1398 return 0; 1399 1400 return mgmt_be_send_txn_req(adapter, txn->txn_id, false); 1401 } 1402 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Results of the 2023 FRR TSC elections
by Alistair Woodman 07 Nov '23

07 Nov '23

All, The TSC election was closed yesterday. 21 out of 25 eligible maintainers voted. Here are the results. In alphabetical order, the following nominees were elected by single transferable vote. Jafar Al-Gharaibeh Lou Berger Donald Sharp Mark Stapp Russ White Martin Winter I would like to thank all the nominees and maintainers that were involved in the process. /a (FRR elections officer) > On Oct 17, 2023, at 15:48, Alistair Woodman <awoodman(a)netdef.org> wrote: > > Dear FRR maintainers, > > This is the third and final call for nominees to the FRR TSC election. I will close the nominations window in 72 hours. > > At the moment I have only the existing 6 TSC members on the ballot. Should no new nominees come forward within 72 hours, the existing 6 TSC members will be reconfirmed without a formal election. > > Please unicast me with any questions. > > /a > >>> On Oct 2, 2023, at 23:34, Alistair Woodman <awoodman(a)netdef.org> wrote: >>> >> >> All, >> >> This is the first request for nominations for candidates for the 2023 TSC elections. >> >> Please contact me with nominations or questions. >> 1) Self-nominations are welcome. >> 2) All nominees must be active FRR maintainers in order to stand. >> 3) Present TSC members must opt-out of being auto-nominated. >> 4) If you plan to nominate someone else, please get their approval first. >> >> /a >> >> (your friendly FRR community elections officer)

1 0