- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 09 Aug '23

09 Aug '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1566808: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1566808: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_mplsvpn.c: 1232 in leak_update() 1226 (struct bgp_dest *)parent->net); 1227 if (bgp_orig) 1228 new->extra->vrfleak->bgp_orig = bgp_lock(bgp_orig); 1229 if (nexthop_orig) 1230 new->extra->vrfleak->nexthop_orig = *nexthop_orig; 1231 >>> CID 1566808: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bgp_orig" to "leak_update_nexthop_valid", which dereferences it. 1232 if (leak_update_nexthop_valid(to_bgp, bn, new_attr, afi, safi, 1233 source_bpi, new, bgp_orig, p, debug)) 1234 bgp_path_info_set_flag(bn, new, BGP_PATH_VALID); 1235 else 1236 bgp_path_info_unset_flag(bn, new, BGP_PATH_VALID); 1237 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 20 Jul '23

20 Jul '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1566396: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1566396: Null pointer dereferences (FORWARD_NULL) /pbrd/pbr_vty_clippy.c: 163 in pbr_map_match_vlan_tag() 157 #if 0 /* anything that can fail? */ 158 if (_failcnt) 159 return CMD_WARNING; 160 #endif 161 #endif 162 >>> CID 1566396: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "tag_type" to "pbr_map_match_vlan_tag_magic", which dereferences it. 163 return pbr_map_match_vlan_tag_magic(self, vty, argc, argv, no, tag_type); 164 } 165 166 /* pbr_set_table_range => "pbr table range (10000-4294966272)$lb (10000-4294966272)$ub" */ 167 DEFUN_CMD_FUNC_DECL(pbr_set_table_range) 168 #define funcdecl_pbr_set_table_range static int pbr_set_table_range_magic(\ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 19 Jul '23

19 Jul '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1566378: (USE_AFTER_FREE) /bgpd/bgp_aspath.c: 1689 in aspath_filter_exclude_acl() /bgpd/bgp_aspath.c: 1689 in aspath_filter_exclude_acl() /bgpd/bgp_aspath.c: 1689 in aspath_filter_exclude_acl() /bgpd/bgp_aspath.c: 1689 in aspath_filter_exclude_acl() ________________________________________________________________________________________________________ *** CID 1566378: (USE_AFTER_FREE) /bgpd/bgp_aspath.c: 1689 in aspath_filter_exclude_acl() 1683 /* first segment */ 1684 source->segments = new_seg; 1685 else if (prev_seg) 1686 prev_seg->next = new_seg; 1687 assegment_free(cur_seg); 1688 } >>> CID 1566378: (USE_AFTER_FREE) >>> Using freed pointer "cur_seg". 1689 prev_seg = cur_seg; 1690 cur_seg = next_seg; 1691 } 1692 1693 1694 aspath_str_update(source, false); /bgpd/bgp_aspath.c: 1689 in aspath_filter_exclude_acl() 1683 /* first segment */ 1684 source->segments = new_seg; 1685 else if (prev_seg) 1686 prev_seg->next = new_seg; 1687 assegment_free(cur_seg); 1688 } >>> CID 1566378: (USE_AFTER_FREE) >>> Using freed pointer "cur_seg". 1689 prev_seg = cur_seg; 1690 cur_seg = next_seg; 1691 } 1692 1693 1694 aspath_str_update(source, false); /bgpd/bgp_aspath.c: 1689 in aspath_filter_exclude_acl() 1683 /* first segment */ 1684 source->segments = new_seg; 1685 else if (prev_seg) 1686 prev_seg->next = new_seg; 1687 assegment_free(cur_seg); 1688 } >>> CID 1566378: (USE_AFTER_FREE) >>> Using freed pointer "cur_seg". 1689 prev_seg = cur_seg; 1690 cur_seg = next_seg; 1691 } 1692 1693 1694 aspath_str_update(source, false); /bgpd/bgp_aspath.c: 1689 in aspath_filter_exclude_acl() 1683 /* first segment */ 1684 source->segments = new_seg; 1685 else if (prev_seg) 1686 prev_seg->next = new_seg; 1687 assegment_free(cur_seg); 1688 } >>> CID 1566378: (USE_AFTER_FREE) >>> Using freed pointer "cur_seg". 1689 prev_seg = cur_seg; 1690 cur_seg = next_seg; 1691 } 1692 1693 1694 aspath_str_update(source, false); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 06 Jul '23

06 Jul '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1566150: Null pointer dereferences (NULL_RETURNS) /zebra/interface.c: 1527 in interface_vrf_change() ________________________________________________________________________________________________________ *** CID 1566150: Null pointer dereferences (NULL_RETURNS) /zebra/interface.c: 1527 in interface_vrf_change() 1521 vrf_id_t exist_id; 1522 1523 exist_id = zebra_vrf_lookup_by_table(tableid, ns_id); 1524 if (exist_id != VRF_DEFAULT) { 1525 vrf = vrf_lookup_by_id(exist_id); 1526 >>> CID 1566150: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "vrf", which is known to be "NULL". 1527 flog_err( 1528 EC_ZEBRA_VRF_MISCONFIGURED, 1529 "VRF %s id %u table id overlaps existing vrf %s(%d), misconfiguration exiting", 1530 name, ifindex, vrf->name, vrf->vrf_id); 1531 exit(-1); 1532 } ** CID 1566149: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1566149: Null pointer dereferences (NULL_RETURNS) /zebra/interface.c: 2288 in zebra_if_dplane_result() 2282 * that we need to handle( create/delete the 2283 * interface as needed ) 2284 */ 2285 if (dp_res == ZEBRA_DPLANE_REQUEST_QUEUED) 2286 zebra_if_dplane_ifp_handling(ctx); 2287 else >>> CID 1566149: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "ifp" when calling "zebra_if_update_ctx". 2288 zebra_if_update_ctx(ctx, ifp); 2289 break; 2290 2291 case DPLANE_OP_INTF_NETCONFIG: 2292 zebra_if_netconf_update_ctx(ctx, ifp, ifindex); 2293 break; ** CID 1566148: Control flow issues (DEADCODE) /zebra/interface.c: 1447 in zebra_if_netconf_update_ctx() ________________________________________________________________________________________________________ *** CID 1566148: Control flow issues (DEADCODE) /zebra/interface.c: 1447 in zebra_if_netconf_update_ctx() 1441 linkdown_set = &zrouter.default_linkdownv4; 1442 } else { 1443 mcast_set = &zrouter.default_mc_forwardingv6; 1444 linkdown_set = &zrouter.default_linkdownv6; 1445 } 1446 } else { >>> CID 1566148: Control flow issues (DEADCODE) >>> Execution cannot reach the expression "NULL" inside this statement: "zif = (ifp ? ifp->info : NU...". 1447 zif = ifp ? ifp->info : NULL; 1448 if (!zif) { 1449 if (IS_ZEBRA_DEBUG_KERNEL) 1450 zlog_debug( 1451 "%s: if %s(%u) zebra info pointer is NULL", 1452 __func__, ifp ? ifp->name : "(null)", ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

FRR 8.5.2 Release
by Jafar Al-Gharaibeh 26 Jun '23

26 Jun '23

Dear FRR Community, We are pleased to announce FRR 8.5.2 bug fix release. For release notes please visit: https://frrouting.org/release/8.5.2/ https://github.com/FRRouting/frr/releases/tag/frr-8.5.2 Cheers, The FRR Development Team!

1 0

Re: [dev] Updating internal crypto implementation
by Acee Lindem 03 Jun '23

03 Jun '23

Given that I’m very new to the FRR dev community, I was hesitant to respond. However, I agree completely with Jafar. I’d add that OpenSSL is heavily tested by a large user community and CERTS are fixed very quickly. Additionally, if we ever implement BGP security features such as RPKI, we’ll use additional OpenSSL functionality. Thanks, Acee > On Jun 2, 2023, at 11:12, Jafar Al-Gharaibeh via dev <dev(a)lists.frrouting.org> wrote: > > > From: Jafar Al-Gharaibeh <jafar(a)atcorp.com <mailto:jafar@atcorp.com>> > Subject: Re: [dev] Updating internal crypto implementation > Date: June 2, 2023 at 11:12:40 EDT > To: "Ward, David - 0665 - MITLL" <david.ward(a)ll.mit.edu <mailto:david.ward@ll.mit.edu>> > Cc: "dev(a)lists.frrouting.org <mailto:dev@lists.frrouting.org>" <dev(a)lists.frrouting.org <mailto:dev@lists.frrouting.org>>, Donald Sharp <donaldsharp72(a)gmail.com <mailto:donaldsharp72@gmail.com>>, Christian Hopps <chopps(a)chopps.org <mailto:chopps@chopps.org>> > > > With OpenSSL 3.0+, the license is no longer an issue. Of course we still support a wide of older platforms where OpenSSL 3.0 isn't available out of the box. > > I don't see a good reason why one would write/maintain their own crypto functions when libraries are available. > > I can't think of a better option than OpenSSL when it comes to wide availability on systems we care about. > > --Jafar > > > > On 6/1/23 08:27, Ward, David - 0665 - MITLL wrote: >> I was actually intentionally vague, because I was first trying to elicit history, opinions, etc. about the current state of things. >> >> In particular: >> Am I correct in understanding the background behind OpenSSL and Zebra/Quagga/FRR? Is it believed that licensing issues which prevented redistribution in the past are resolved now? >> Is there a common expectation as to whether FRR is generally built with, or without, OpenSSL linkage today? (Distribution packaging varies: for example in Fedora this build flag is enabled, but in Debian it is disabled.) >> Are there strong feelings for or against having cryptographic algorithms embedded in the FRR source code? (Faster execution by using a specific implementation; larger security footprint to be concerned with monitoring within this project; easier to build and port FRR to other platforms by reducing the number of external dependencies; trickier to avoid potential function name collisions between FRR and system libraries; etc.) >> Are there strong feelings for or against the use of OpenSSL specifically in FRR today? (It’s a widely installed dependency of other software; it’s overkill for the very limited degree to which FRR uses it; it is likely to be ported to platforms that other libraries are not; it has a more involved API that has changed over time; etc.) >> >> (So far it seems like – all other things being equal – there would generally be a preference against embedding and maintaining these algorithms in FRR.) >> >> Thanks, >> >> David >> >> From: Donald Sharp <donaldsharp72(a)gmail.com> <mailto:donaldsharp72@gmail.com> >> Sent: Thursday, June 1, 2023 7:20 AM >> To: Christian Hopps <chopps(a)chopps.org> <mailto:chopps@chopps.org> >> Cc: Ward, David - 0665 - MITLL <david.ward(a)ll.mit.edu> <mailto:david.ward@ll.mit.edu>; dev(a)lists.frrouting.org <mailto:dev@lists.frrouting.org> >> Subject: Re: [dev] Updating internal crypto implementation >> >> In theory, I am more than happy with having more security options in FRR, especially if some generic functions we are using can be taken out of FRR and the code maintenance can be taken care of by some other library. >> >> I guess where I have been hesitating to respond is the sentence `Can we update...`. I am not sure if I should read the sentence as either: >> >> a) David Ward is saying I will do the work to update this code >> b) The we implies that someone should just pick this up from the community and run with the idea. >> >> If (a) then I say go for it, David! For this work, though, I would want to see a plan of action for how this is going to be done in the code base. Mainly so that the 2-3 people within the FRR community who really really care about how this is done won't come back and say do it completely differently and your and our time is not wasted. >> >> if (b) then I say that's a great idea! Unfortunately due to how open source development is done, until some business has a use case for this expanded functionality, this idea is going to languish. >> >> Finally if you are going to do option (a), please feel free to privately send me email( or come talk to us on slack ) and we can get the ball rolling on helping you get the work done. >> >> thanks! >> >> donald >> >> >> >> On Thu, Jun 1, 2023 at 6:31 AM Christian Hopps <chopps(a)chopps.org <mailto:chopps@chopps.org>> wrote: >> >> Hi David, >> >> Add "Is there someone will to do the work and maintain the code?" to the non-library options. The answer to that q. very well could be "no" in which case the library is definitely the way to go. :) >> >> Thanks, >> Chris. >> >> "Ward, David - 0665 - MITLL" <david.ward(a)ll.mit.edu <mailto:david.ward@ll.mit.edu>> writes: >> >> > FRR has an "internal" implementation of the MD5 and SHA-256 algorithms, >> > including HMAC functions for both. [1] This code is under a BSD license, and >> > provides an alternative to linking FRR against OpenSSL, for which there were >> > historical (?) issues around GPL incompatibility. Several routing protocols use >> > one of these hash algorithms. >> > >> > ospf6d was extended last year to support the OSPFv3 Authentication Trailer (RFC 7166), which may use any of HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512. [2] The choice of algorithm is limited unless FRR has been compiled with OpenSSL support. >> > >> > Can we update FRR's internal crypto implementation in order to overcome this limitation? For example: >> > * Gnulib provides a drop-in version of each of the algorithms mentioned above for inclusion in open-source projects, available under LGPL 2.1. >> > * FreeBSD has adapted Colin Percival's SHA-256 implementation to support the other SHA-2 algorithms (but without the HMAC functions - which would seem straightforward to adapt). >> > * Or should FRR rely on an external library for these functions instead? Should it allow the use of something other than OpenSSL, such as Libgcrypt? >> > >> > Thanks in advance, >> > >> > David >> > >> > >> > [1] The SHA-256 implementation was written by Colin Percival, originally for FreeBSD. His current version seems to be here: >> > https://github.com/Tarsnap/libcperciva/blob/master/alg/sha256.c >> > >> > [2] ospf6d also supports the use of HMAC-MD5 here, despite this not being specified in RFC 7166. >> >> >> _______________________________________________ >> dev mailing list >> dev(a)lists.frrouting.org <mailto:dev@lists.frrouting.org> >> https://lists.frrouting.org/listinfo/dev > > > _______________________________________________ > dev mailing list > dev(a)lists.frrouting.org <mailto:dev@lists.frrouting.org> > https://lists.frrouting.org/listinfo/dev

1 0

Re: [dev] Updating internal crypto implementation
by William Herrin 03 Jun '23

03 Jun '23

On Fri, Jun 2, 2023 at 8:12 AM Jafar Al-Gharaibeh via dev <dev(a)lists.frrouting.org> wrote: > I don't see a good reason why one would write/maintain their own crypto functions when libraries are available. It's notoriously tricky to write correct crypto implementations, particularly if crypto isn't your specialty. In my view, using a broadly tested implementation, particularly one that has been FIPS certified, should be the first, second and third choices. Regards, Bill Herrin -- William Herrin bill(a)herrin.us https://bill.herrin.us/

1 0

Re: [dev] Updating internal crypto implementation
by Ward, David - 0665 - MITLL 02 Jun '23

02 Jun '23

I was actually intentionally vague, because I was first trying to elicit history, opinions, etc. about the current state of things. In particular: * Am I correct in understanding the background behind OpenSSL and Zebra/Quagga/FRR? Is it believed that licensing issues which prevented redistribution in the past are resolved now? * Is there a common expectation as to whether FRR is generally built with, or without, OpenSSL linkage today? (Distribution packaging varies: for example in Fedora this build flag is enabled, but in Debian it is disabled.) * Are there strong feelings for or against having cryptographic algorithms embedded in the FRR source code? (Faster execution by using a specific implementation; larger security footprint to be concerned with monitoring within this project; easier to build and port FRR to other platforms by reducing the number of external dependencies; trickier to avoid potential function name collisions between FRR and system libraries; etc.) * Are there strong feelings for or against the use of OpenSSL specifically in FRR today? (It’s a widely installed dependency of other software; it’s overkill for the very limited degree to which FRR uses it; it is likely to be ported to platforms that other libraries are not; it has a more involved API that has changed over time; etc.) (So far it seems like – all other things being equal – there would generally be a preference against embedding and maintaining these algorithms in FRR.) Thanks, David From: Donald Sharp <donaldsharp72(a)gmail.com> Sent: Thursday, June 1, 2023 7:20 AM To: Christian Hopps <chopps(a)chopps.org> Cc: Ward, David - 0665 - MITLL <david.ward(a)ll.mit.edu>; dev(a)lists.frrouting.org Subject: Re: [dev] Updating internal crypto implementation In theory, I am more than happy with having more security options in FRR, especially if some generic functions we are using can be taken out of FRR and the code maintenance can be taken care of by some other library. I guess where I have been hesitating to respond is the sentence `Can we update...`. I am not sure if I should read the sentence as either: a) David Ward is saying I will do the work to update this code b) The we implies that someone should just pick this up from the community and run with the idea. If (a) then I say go for it, David! For this work, though, I would want to see a plan of action for how this is going to be done in the code base. Mainly so that the 2-3 people within the FRR community who really really care about how this is done won't come back and say do it completely differently and your and our time is not wasted. if (b) then I say that's a great idea! Unfortunately due to how open source development is done, until some business has a use case for this expanded functionality, this idea is going to languish. Finally if you are going to do option (a), please feel free to privately send me email( or come talk to us on slack ) and we can get the ball rolling on helping you get the work done. thanks! donald On Thu, Jun 1, 2023 at 6:31 AM Christian Hopps <chopps(a)chopps.org<mailto:chopps@chopps.org>> wrote: Hi David, Add "Is there someone will to do the work and maintain the code?" to the non-library options. The answer to that q. very well could be "no" in which case the library is definitely the way to go. :) Thanks, Chris. "Ward, David - 0665 - MITLL" <david.ward(a)ll.mit.edu<mailto:david.ward@ll.mit.edu>> writes: > FRR has an "internal" implementation of the MD5 and SHA-256 algorithms, > including HMAC functions for both. [1] This code is under a BSD license, and > provides an alternative to linking FRR against OpenSSL, for which there were > historical (?) issues around GPL incompatibility. Several routing protocols use > one of these hash algorithms. > > ospf6d was extended last year to support the OSPFv3 Authentication Trailer (RFC 7166), which may use any of HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512. [2] The choice of algorithm is limited unless FRR has been compiled with OpenSSL support. > > Can we update FRR's internal crypto implementation in order to overcome this limitation? For example: > * Gnulib provides a drop-in version of each of the algorithms mentioned above for inclusion in open-source projects, available under LGPL 2.1. > * FreeBSD has adapted Colin Percival's SHA-256 implementation to support the other SHA-2 algorithms (but without the HMAC functions - which would seem straightforward to adapt). > * Or should FRR rely on an external library for these functions instead? Should it allow the use of something other than OpenSSL, such as Libgcrypt? > > Thanks in advance, > > David > > > [1] The SHA-256 implementation was written by Colin Percival, originally for FreeBSD. His current version seems to be here: > https://github.com/Tarsnap/libcperciva/blob/master/alg/sha256.c > > [2] ospf6d also supports the use of HMAC-MD5 here, despite this not being specified in RFC 7166.

2 1

Updating internal crypto implementation
by Ward, David - 0665 - MITLL 01 Jun '23

01 Jun '23

FRR has an "internal" implementation of the MD5 and SHA-256 algorithms, including HMAC functions for both. [1] This code is under a BSD license, and provides an alternative to linking FRR against OpenSSL, for which there were historical (?) issues around GPL incompatibility. Several routing protocols use one of these hash algorithms. ospf6d was extended last year to support the OSPFv3 Authentication Trailer (RFC 7166), which may use any of HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512. [2] The choice of algorithm is limited unless FRR has been compiled with OpenSSL support. Can we update FRR's internal crypto implementation in order to overcome this limitation? For example: * Gnulib provides a drop-in version of each of the algorithms mentioned above for inclusion in open-source projects, available under LGPL 2.1. * FreeBSD has adapted Colin Percival's SHA-256 implementation to support the other SHA-2 algorithms (but without the HMAC functions - which would seem straightforward to adapt). * Or should FRR rely on an external library for these functions instead? Should it allow the use of something other than OpenSSL, such as Libgcrypt? Thanks in advance, David [1] The SHA-256 implementation was written by Colin Percival, originally for FreeBSD. His current version seems to be here: https://github.com/Tarsnap/libcperciva/blob/master/alg/sha256.c [2] ospf6d also supports the use of HMAC-MD5 here, despite this not being specified in RFC 7166.

3 2

Request: FRR Debian repository for Debian Bookworm
by Yeechan Lu 15 May '23

15 May '23

Hi there, I'm inquiring about packages of FRR Debian repository for the upcoming Debian Bookworm release scheduled next month [1]. I noticed that Bookworm may include FRR version 8.4.2-1; however, I am currently using version 8.5 from FRR Debian repository on Debian Bullseye already. I do not want to "downgrade". Could you please share details on their availability or any plans to support this version? Thanks for your great work on FRRouting. [1]: https://lists.debian.org/debian-devel-announce/2023/04/msg00007.html Best regards, Yeechan Lu

2 1