- dev - lists.frrouting.org

[frr] New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 21 Mar '17

21 Mar '17

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 4 of 4 defect(s) ** CID 1420265: Resource leaks (RESOURCE_LEAK) /zebra/label_manager.c: 229 in assign_label_chunk() ________________________________________________________________________________________________________ *** CID 1420265: Resource leaks (RESOURCE_LEAK) /zebra/label_manager.c: 229 in assign_label_chunk() 223 else 224 lmc->start = ((struct label_manager_chunk *) 225 listgetdata(listtail(lbl_mgr.lc_list)))->end + 1; 226 if (lmc->start > MPLS_MAX_UNRESERVED_LABEL - size + 1) { 227 zlog_err("Reached max labels. Start: %u, size: %u", lmc->start, 228 size); >>> CID 1420265: Resource leaks (RESOURCE_LEAK) >>> Variable "lmc" going out of scope leaks the storage it points to. 229 return NULL; 230 } 231 lmc->end = lmc->start + size - 1; 232 lmc->proto = proto; 233 lmc->instance = instance; 234 lmc->keep = keep; ** CID 1420264: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1420264: Null pointer dereferences (NULL_RETURNS) /pimd/pim_nht.c: 563 in pim_parse_nexthop_update() 557 case NEXTHOP_TYPE_IPV6: 558 stream_get (&nexthop->gate.ipv6, s, 16); 559 break; 560 case NEXTHOP_TYPE_IPV6_IFINDEX: 561 stream_get (&nexthop->gate.ipv6, s, 16); 562 nexthop->ifindex = stream_getl (s); >>> CID 1420264: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be null "if_lookup_by_index(nexthop->ifindex, 0)" when calling "pim_neighbor_find_if". 563 nbr = 564 pim_neighbor_find_if (if_lookup_by_index 565 (nexthop->ifindex, VRF_DEFAULT)); 566 /* Overwrite with Nbr address as NH addr */ 567 if (nbr) 568 nexthop->gate.ipv4 = nbr->source_addr; ** CID 1420263: Null pointer dereferences (NULL_RETURNS) /ldpd/lde.c: 1624 in on_get_label_chunk_response() ________________________________________________________________________________________________________ *** CID 1420263: Null pointer dereferences (NULL_RETURNS) /ldpd/lde.c: 1624 in on_get_label_chunk_response() 1618 struct label_chunk *new_label_chunk; 1619 1620 log_debug("Label Chunk assign: %u - %u", start, end); 1621 1622 new_label_chunk = calloc(1, sizeof(struct label_chunk)); 1623 >>> CID 1420263: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a null pointer "new_label_chunk". 1624 new_label_chunk->start = start; 1625 new_label_chunk->end = end; 1626 new_label_chunk->used_mask = 0; 1627 1628 listnode_add(label_chunk_list, (void *)new_label_chunk); 1629 ** CID 1420262: Null pointer dereferences (FORWARD_NULL) /pimd/pim_nht.c: 519 in pim_parse_nexthop_update() ________________________________________________________________________________________________________ *** CID 1420262: Null pointer dereferences (FORWARD_NULL) /pimd/pim_nht.c: 519 in pim_parse_nexthop_update() 513 __PRETTY_FUNCTION__, buf); 514 } 515 return; 516 } 517 } 518 >>> CID 1420262: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "pnc". 519 pnc->last_update = pim_time_monotonic_sec (); 520 distance = stream_getc (s); 521 metric = stream_getl (s); 522 nexthop_num = stream_getc (s); 523 524 if (PIM_DEBUG_TRACE) ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "frr(a)lists.nox.tf", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

[frr] New Label manager has been committed
by Donald Sharp 21 Mar '17

21 Mar '17

Bingen has implemented a label manager. This allows the sharing of Label space across the whole of FRR. Thanks Bingen and everyone who's spent time working on this! donald

2 1

[frr] Todays Technical Meeting 11 am EDT
by Donald Sharp 21 Mar '17

21 Mar '17

https://bluejeans.com/9192742159 1) Stable/2.0 Release 2) Issues 3) PR's 4) I am at IETF next week no meeting 5) Anything else? donald

4 5

[frr] New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 21 Mar '17

21 Mar '17

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1420253: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1420253: Null pointer dereferences (NULL_RETURNS) /pimd/pim_zlookup.c: 256 in zclient_read_nexthop() 250 ++num_ifindex; 251 break; 252 case NEXTHOP_TYPE_IPV6_IFINDEX: 253 nexthop_tab[num_ifindex].nexthop_addr.family = AF_INET6; 254 stream_get (&nexthop_tab[num_ifindex].nexthop_addr.u.prefix6, s, 16); 255 nexthop_tab[num_ifindex].ifindex = stream_getl (s); >>> CID 1420253: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be null "if_lookup_by_index((nexthop_tab + num_ifindex).ifindex, 0)" when calling "pim_neighbor_find_if". 256 nbr = pim_neighbor_find_if (if_lookup_by_index (nexthop_tab[num_ifindex].ifindex, VRF_DEFAULT)); 257 if (nbr) 258 { 259 nexthop_tab[num_ifindex].nexthop_addr.family = AF_INET; 260 nexthop_tab[num_ifindex].nexthop_addr.u.prefix4 = nbr->source_addr; 261 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "frr(a)lists.nox.tf", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Re: [frr] Quagga Segment Routing implementation progress
by Jeff Tantsura 16 Mar '17

16 Mar '17

Hi, Besides what you could do in the fast path, take a look at control plane and efficient path computation. I’m preparing a talk for MPLS/SDN/whatever in Paris that talks about that, please find attached, it is not final and animations are a bit off because of pptx-<pdf. Enjoy Cheers, Jeff > -wip.patch>

1 0

[frr] Technical Meeting 3/14 11 am EDT
by Donald Sharp 14 Mar '17

14 Mar '17

https://bluejeans.com/9192742159 1) Issues 2) 2.0 Release Status 3) PR 4) MPLS Status 5) EIGRP Status Anything Else? donald

2 2

[frr] IETF 98 in late March
by Donald Sharp 09 Mar '17

09 Mar '17

All - I will be attending IETF in Chicago in a few weeks. Is anyone else attending and does anyone want to meet up face-to-face? donald

4 3

[frr] New Features in LDP
by Donald Sharp 09 Mar '17

09 Mar '17

I'd like to thanks Renato Westphal for adding these RFC's to LDP: 5918 - Typed Wildcard FEC 6667 - Typed Wildcard FEC for PWid 5919 - LDP End-of-LIB Now available in master. thanks! donald

3 2

[frr] New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 08 Mar '17

08 Mar '17

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 13 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 13 of 13 defect(s) ** CID 1416033: (STRING_OVERFLOW) /lib/libfrr.c: 53 in opt_extend() /lib/libfrr.c: 54 in opt_extend() ________________________________________________________________________________________________________ *** CID 1416033: (STRING_OVERFLOW) /lib/libfrr.c: 53 in opt_extend() 47 }; 48 49 static void opt_extend(const struct optspec *os) 50 { 51 const struct option *lo; 52 >>> CID 1416033: (STRING_OVERFLOW) >>> Note: This defect has an elevated risk because the source argument is a parameter of the current function. 53 strcat(comb_optstr, os->optstr); 54 strcat(comb_helpstr, os->helpstr); 55 for (lo = os->longopts; lo->name; lo++) 56 memcpy(comb_next_lo++, lo, sizeof(*lo)); 57 } 58 /lib/libfrr.c: 54 in opt_extend() 48 49 static void opt_extend(const struct optspec *os) 50 { 51 const struct option *lo; 52 53 strcat(comb_optstr, os->optstr); >>> CID 1416033: (STRING_OVERFLOW) >>> Note: This defect has an elevated risk because the source argument is a parameter of the current function. 54 strcat(comb_helpstr, os->helpstr); 55 for (lo = os->longopts; lo->name; lo++) 56 memcpy(comb_next_lo++, lo, sizeof(*lo)); 57 } 58 59 ** CID 1416032: Security best practices violations (STRING_OVERFLOW) /nhrpd/vici.c: 471 in sock_open_unix() ________________________________________________________________________________________________________ *** CID 1416032: Security best practices violations (STRING_OVERFLOW) /nhrpd/vici.c: 471 in sock_open_unix() 465 fd = socket(AF_UNIX, SOCK_STREAM, 0); 466 if (fd < 0) 467 return -1; 468 469 memset(&addr, 0, sizeof (struct sockaddr_un)); 470 addr.sun_family = AF_UNIX; >>> CID 1416032: Security best practices violations (STRING_OVERFLOW) >>> Note: This defect has an elevated risk because the source argument is a parameter of the current function. 471 strncpy(addr.sun_path, path, strlen (path)); 472 473 ret = connect(fd, (struct sockaddr *) &addr, sizeof(addr.sun_family) + strlen(addr.sun_path)); 474 if (ret < 0) { 475 close(fd); 476 return -1; ** CID 1416031: Memory - illegal accesses (OVERRUN) /nhrpd/nhrp_peer.c: 782 in nhrp_peer_recv() ________________________________________________________________________________________________________ *** CID 1416031: Memory - illegal accesses (OVERRUN) /nhrpd/nhrp_peer.c: 782 in nhrp_peer_recv() 776 pp.ifp = ifp; 777 pp.pkt = zb; 778 pp.hdr = hdr; 779 pp.peer = p; 780 781 afi = htons(hdr->afnum); >>> CID 1416031: Memory - illegal accesses (OVERRUN) >>> Overrunning array "packet_types" of 9 24-byte elements at element index 9 (byte offset 216) using index "hdr->type" (which evaluates to 9). 782 if (hdr->type > ZEBRA_NUM_OF(packet_types) || 783 hdr->version != NHRP_VERSION_RFC2332 || 784 afi >= AFI_MAX || 785 packet_types[hdr->type].type == PACKET_UNKNOWN || 786 htons(hdr->packet_size) > realsize) { 787 zlog_info("From %s: error: packet type %d, version %d, AFI %d, size %d (real size %d)", ** CID 1416030: Memory - illegal accesses (OVERRUN) /nhrpd/nhrp_vty.c: 77 in nhrp_vty_return() ________________________________________________________________________________________________________ *** CID 1416030: Memory - illegal accesses (OVERRUN) /nhrpd/nhrp_vty.c: 77 in nhrp_vty_return() 71 char buf[256]; 72 73 if (ret == NHRP_OK) 74 return CMD_SUCCESS; 75 76 if (ret > 0 && ret <= (int)ZEBRA_NUM_OF(errmsgs)) >>> CID 1416030: Memory - illegal accesses (OVERRUN) >>> Overrunning array "errmsgs" of 8 8-byte elements at element index 8 (byte offset 64) using index "ret" (which evaluates to 8). 77 if (errmsgs[ret]) 78 str = errmsgs[ret]; 79 80 if (!str) { 81 str = buf; 82 snprintf(buf, sizeof(buf), "Unknown error %d", ret); ** CID 1416029: Integer handling issues (NEGATIVE_RETURNS) /nhrpd/netlink_arp.c: 231 in netlink_set_nflog_group() ________________________________________________________________________________________________________ *** CID 1416029: Integer handling issues (NEGATIVE_RETURNS) /nhrpd/netlink_arp.c: 231 in netlink_set_nflog_group() 225 THREAD_OFF(netlink_log_thread); 226 close(netlink_log_fd); 227 netlink_log_fd = -1; 228 } 229 netlink_nflog_group = nlgroup; 230 if (nlgroup) { >>> CID 1416029: Integer handling issues (NEGATIVE_RETURNS) >>> Assigning: signed variable "netlink_log_fd" = "znl_open". 231 netlink_log_fd = znl_open(NETLINK_NETFILTER, 0); 232 netlink_log_register(netlink_log_fd, nlgroup); 233 THREAD_READ_ON(master, netlink_log_thread, netlink_log_recv, 0, netlink_log_fd); 234 } 235 } 236 ** CID 1416028: Control flow issues (MISSING_BREAK) /nhrpd/nhrp_packet.c: 247 in nhrp_ext_reply() ________________________________________________________________________________________________________ *** CID 1416028: Control flow issues (MISSING_BREAK) /nhrpd/nhrp_packet.c: 247 in nhrp_ext_reply() 241 if (!cie) goto err; 242 cie->holding_time = htons(ad->holdtime); 243 break; 244 default: 245 if (type & NHRP_EXTENSION_FLAG_COMPULSORY) 246 goto err; >>> CID 1416028: Control flow issues (MISSING_BREAK) >>> The above case falls through to this one. 247 case NHRP_EXTENSION_FORWARD_TRANSIT_NHS: 248 case NHRP_EXTENSION_REVERSE_TRANSIT_NHS: 249 /* Supported compulsory extensions, and any 250 * non-compulsory that is not explicitly handled, 251 * should be just copied. */ 252 zbuf_copy(zb, extpayload, zbuf_used(extpayload)); ** CID 1416027: Control flow issues (MISSING_BREAK) /nhrpd/nhrp_peer.c: 689 in nhrp_peer_forward() ________________________________________________________________________________________________________ *** CID 1416027: Control flow issues (MISSING_BREAK) /nhrpd/nhrp_peer.c: 689 in nhrp_peer_forward() 683 break; 684 default: 685 if (htons(ext->type) & NHRP_EXTENSION_FLAG_COMPULSORY) 686 /* FIXME: RFC says to just copy, but not 687 * append our selves to the transit NHS list */ 688 goto err; >>> CID 1416027: Control flow issues (MISSING_BREAK) >>> The above case falls through to this one. 689 case NHRP_EXTENSION_RESPONDER_ADDRESS: 690 /* Supported compulsory extensions, and any 691 * non-compulsory that is not explicitly handled, 692 * should be just copied. */ 693 zbuf_copy(zb, &extpl, len); 694 break; ** CID 1416026: Control flow issues (DEADCODE) /nhrpd/vici.c: 363 in vici_submit_request() ________________________________________________________________________________________________________ *** CID 1416026: Control flow issues (DEADCODE) /nhrpd/vici.c: 363 in vici_submit_request() 357 case VICI_KEY_VALUE: 358 vici_zbuf_puts(obuf, va_arg(va, const char *)); 359 len = va_arg(va, size_t); 360 zbuf_put_be16(obuf, len); 361 zbuf_put(obuf, va_arg(va, void *), len); 362 break; >>> CID 1416026: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "case VICI_END:". 363 case VICI_END: 364 break; 365 default: 366 break; 367 } 368 } ** CID 1416025: (CHECKED_RETURN) /nhrpd/znl.c: 144 in znl_open() /nhrpd/znl.c: 145 in znl_open() ________________________________________________________________________________________________________ *** CID 1416025: (CHECKED_RETURN) /nhrpd/znl.c: 144 in znl_open() 138 int fd, buf = 128 * 1024; 139 140 fd = socket(AF_NETLINK, SOCK_RAW, protocol); 141 if (fd < 0) 142 return -1; 143 >>> CID 1416025: (CHECKED_RETURN) >>> Calling "fcntl(fd, 4, fcntl(fd, 3, 0) | 0x800)" without checking return value. This library function may fail and return an error code. 144 fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) | O_NONBLOCK); 145 fcntl(fd, F_SETFD, FD_CLOEXEC); 146 if (setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &buf, sizeof(buf)) < 0) 147 goto error; 148 149 memset(&addr, 0, sizeof(addr)); /nhrpd/znl.c: 145 in znl_open() 139 140 fd = socket(AF_NETLINK, SOCK_RAW, protocol); 141 if (fd < 0) 142 return -1; 143 144 fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) | O_NONBLOCK); >>> CID 1416025: (CHECKED_RETURN) >>> Calling "fcntl(fd, 2, 1)" without checking return value. This library function may fail and return an error code. 145 fcntl(fd, F_SETFD, FD_CLOEXEC); 146 if (setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &buf, sizeof(buf)) < 0) 147 goto error; 148 149 memset(&addr, 0, sizeof(addr)); 150 addr.nl_family = AF_NETLINK; ** CID 1416024: (CHECKED_RETURN) /nhrpd/nhrp_event.c: 62 in evmgr_recv_message() /nhrpd/nhrp_event.c: 63 in evmgr_recv_message() ________________________________________________________________________________________________________ *** CID 1416024: (CHECKED_RETURN) /nhrpd/nhrp_event.c: 62 in evmgr_recv_message() 56 if (len >= sizeof(buf)-1) 57 continue; 58 memcpy(buf, zbuf_pulln(&zl, len), len); 59 buf[len] = 0; 60 61 debugf(NHRP_DEBUG_EVENT, "evmgr: msg: %s", buf); >>> CID 1416024: (CHECKED_RETURN) >>> Calling "sscanf" without checking return value (as is done elsewhere 30 out of 35 times). 62 sscanf(buf, "eventid=%d", &eventid); 63 sscanf(buf, "result=%63s", result); 64 } 65 debugf(NHRP_DEBUG_EVENT, "evmgr: received: eventid=%d result=%s", eventid, result); 66 if (eventid && result[0]) { 67 struct nhrp_reqid *r = nhrp_reqid_lookup(&nhrp_event_reqid, eventid); /nhrpd/nhrp_event.c: 63 in evmgr_recv_message() 57 continue; 58 memcpy(buf, zbuf_pulln(&zl, len), len); 59 buf[len] = 0; 60 61 debugf(NHRP_DEBUG_EVENT, "evmgr: msg: %s", buf); 62 sscanf(buf, "eventid=%d", &eventid); >>> CID 1416024: (CHECKED_RETURN) >>> Calling "sscanf" without checking return value (as is done elsewhere 30 out of 35 times). 63 sscanf(buf, "result=%63s", result); 64 } 65 debugf(NHRP_DEBUG_EVENT, "evmgr: received: eventid=%d result=%s", eventid, result); 66 if (eventid && result[0]) { 67 struct nhrp_reqid *r = nhrp_reqid_lookup(&nhrp_event_reqid, eventid); 68 if (r) r->cb(r, result); ** CID 1416023: (CHECKED_RETURN) /nhrpd/vici.c: 185 in parse_sa_message() /nhrpd/vici.c: 195 in parse_sa_message() ________________________________________________________________________________________________________ *** CID 1416023: (CHECKED_RETURN) /nhrpd/vici.c: 185 in parse_sa_message() 179 break; 180 default: 181 switch (key->ptr[0]) { 182 case 'l': 183 if (blob_equal(key, "local-host") && ctx->nsections == 1) { 184 if (blob2buf(val, buf, sizeof(buf))) >>> CID 1416023: (CHECKED_RETURN) >>> Calling "str2sockunion" without checking return value (as is done elsewhere 29 out of 31 times). 185 str2sockunion(buf, &sactx->local.host); 186 } else if (blob_equal(key, "local-id") && ctx->nsections == 1) { 187 sactx->local.id = *val; 188 } else if (blob_equal(key, "local-cert-data") && ctx->nsections == 1) { 189 sactx->local.cert = *val; 190 } /nhrpd/vici.c: 195 in parse_sa_message() 189 sactx->local.cert = *val; 190 } 191 break; 192 case 'r': 193 if (blob_equal(key, "remote-host") && ctx->nsections == 1) { 194 if (blob2buf(val, buf, sizeof(buf))) >>> CID 1416023: (CHECKED_RETURN) >>> Calling "str2sockunion" without checking return value (as is done elsewhere 29 out of 31 times). 195 str2sockunion(buf, &sactx->remote.host); 196 } else if (blob_equal(key, "remote-id") && ctx->nsections == 1) { 197 sactx->remote.id = *val; 198 } else if (blob_equal(key, "remote-cert-data") && ctx->nsections == 1) { 199 sactx->remote.cert = *val; 200 } ** CID 1416022: Error handling issues (CHECKED_RETURN) /nhrpd/vici.c: 479 in sock_open_unix() ________________________________________________________________________________________________________ *** CID 1416022: Error handling issues (CHECKED_RETURN) /nhrpd/vici.c: 479 in sock_open_unix() 473 ret = connect(fd, (struct sockaddr *) &addr, sizeof(addr.sun_family) + strlen(addr.sun_path)); 474 if (ret < 0) { 475 close(fd); 476 return -1; 477 } 478 >>> CID 1416022: Error handling issues (CHECKED_RETURN) >>> Calling "fcntl(fd, 4, fcntl(fd, 3, 0) | 0x800)" without checking return value. This library function may fail and return an error code. 479 fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) | O_NONBLOCK); 480 481 return fd; ** CID 1416021: Memory - illegal accesses (BUFFER_SIZE_WARNING) /nhrpd/linux.c: 108 in linux_configure_arp() ________________________________________________________________________________________________________ *** CID 1416021: Memory - illegal accesses (BUFFER_SIZE_WARNING) /nhrpd/linux.c: 108 in linux_configure_arp() 102 } 103 104 static int linux_configure_arp(const char *iface, int on) 105 { 106 struct ifreq ifr; 107 >>> CID 1416021: Memory - illegal accesses (BUFFER_SIZE_WARNING) >>> Calling strncpy with a maximum size argument of 16 bytes on destination array "ifr.ifr_ifrn.ifrn_name" of size 16 bytes might leave the destination string unterminated. 108 strncpy(ifr.ifr_name, iface, IFNAMSIZ); 109 if (ioctl(nhrp_socket_fd, SIOCGIFFLAGS, &ifr)) 110 return -1; 111 112 if (on) 113 ifr.ifr_flags &= ~IFF_NOARP; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "frr(a)lists.nox.tf", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

[frr] NHRPD and FRR
by Donald Sharp 07 Mar '17

07 Mar '17

All - Thanks to Timo and David for working to get NHRPD into FRR. It is now available on the master branch. donald

1 0