- dev - lists.frrouting.org

Discussion on Flex-Algo library
by Pushpasis Sarkar 21 Sep '22

21 Sep '22

Hi all, Rescheduling it to next week as per Louis’ request. Thanks -Pushpasis ========================================= Hi all, Like discussed in this week FRR meeting, we need to meet and discuss to choose between the versions of lib/flex_algo component being added in both PRs 11667 (ISIS Flex-Algo) and 11849 (OSPFv2 Flex-Algo). Looking forward to your participation Thanks and regards -Pushpasis

1 0

Discussion on Flex-Algo library
by Pushpasis Sarkar 21 Sep '22

21 Sep '22

Hi all, Like discussed in this week FRR meeting, we need to meet and discuss to choose between the versions of lib/flex_algo component being added in both PRs 11667 (ISIS Flex-Algo) and 11849 (OSPFv2 Flex-Algo). Looking forward to your participation Thanks and regards -Pushpasis

1 0

Re: [dev] Building Images. Missing Architectures
by Quentin Young 03 Sep '22

03 Sep '22

Hi Michael, The `latest` tag is not maintained and doesn't represent anything (it's currently at some random spot in the development tree from 10 months ago). If you want to run FRR in a container please use one of the release tags. Thanks, Quentin ________________________________________ From: dev <dev-bounces+qlyoung=cumulusnetworks.com(a)lists.frrouting.org> on behalf of Michael Nehring via dev <dev(a)lists.frrouting.org> Sent: Thursday, August 18, 2022 8:44 AM To: dev(a)lists.frrouting.org Subject: [dev] Building Images. Missing Architectures External email: Use caution opening links or attachments _______________________________________________ dev mailing list dev(a)lists.frrouting.org https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.frr…

1 0

FRRouting 8.3.1 Release
by Donatas Abraitis 02 Sep '22

02 Sep '22

Dear FRR Community, We are pleased to announce FRR 8.3.1 release. Packages Debian Packages - https://deb.frrouting.org/ RPM Packages - https://rpm.frrouting.org/ Snaps - https://snapcraft.io/frr Docker - https://hub.docker.com Release Overview Handle CTRL+Z without exiting the VTY shell In the 8.3 release, the CTRL+Z combination exited the VTY shell, it's back again! Ignore end when parsing frr.conf If frr.conf has end inside the config, BGP peering starts only after 10 minutes. This is because parsing the end keyword stopped hooks from reaching the end of the configuration and BGP thoughts the configuration is not ready. Changelog bgpd Do not announce routes that are conditionally withdrawn (a gap between conditional advertisement interval) Fix crash for show bgp l2vpn evpn route rd Do not overwrite the Link-Local address with another interface for the next-hop cache Call a hook when the as-path filter is replaced Fix memory leak when cleaning up MPLS labels isisd Fix memory leak when deleting adjacency ldpd Fix crash when hold time is configured to 65535 ospfd Fix crash when the router is running in GR helper mode and receives a new LSA pimd Fix memory leak for show ip pim interface Allow the same group/source route to be configured on more than one interface vtysh Handle CTRL+Z without exiting the VTY shell Ignore end when parsing frr.conf zebra Avoid buffer overflow when parsing nested route attributes for SR-IPv6 Fix missing VNI transition, e.g.: show evpn vni detail Thanks to all contributors! Cheers, The FRR Development Team!

1 0

Building Images. Missing Architectures
by Michael Nehring 18 Aug '22

18 Aug '22

Dear frrouting devs, your frrounting/frr images gets buildet for multiple architectures, which is very good thank you <3 But is there a reason why the latest tag is only builded in amd64? It would be nice if the latest tag has also the different architectures. Best Regards Michael Nehring

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 17 Aug '22

17 Aug '22

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1519903: Uninitialized variables (UNINIT) ________________________________________________________________________________________________________ *** CID 1519903: Uninitialized variables (UNINIT) /zebra/tc_netlink.c: 317 in netlink_tclass_msg_encode() 311 sizeof(ceil)); 312 } 313 314 nl_attr_put(&req->n, datalen, TCA_HTB_PARMS, &htb_opt, sizeof(htb_opt)); 315 316 nl_attr_put(&req->n, datalen, TCA_HTB_RTAB, rtab, sizeof(rtab)); >>> CID 1519903: Uninitialized variables (UNINIT) >>> Using uninitialized element of array "ctab" when calling "nl_attr_put". 317 nl_attr_put(&req->n, datalen, TCA_HTB_CTAB, ctab, sizeof(ctab)); 318 nl_attr_nest_end(&req->n, nest); 319 320 return NLMSG_ALIGN(req->n.nlmsg_len); 321 } 322 ** CID 1519902: Possible Control flow issues (DEADCODE) /zebra/zebra_dplane.c: 2785 in dplane_ctx_tc_init() ________________________________________________________________________________________________________ *** CID 1519902: Possible Control flow issues (DEADCODE) /zebra/zebra_dplane.c: 2785 in dplane_ctx_tc_init() 2779 struct zebra_ns *zns = NULL; 2780 2781 ctx->zd_op = op; 2782 ctx->zd_status = ZEBRA_DPLANE_REQUEST_SUCCESS; 2783 2784 /* TODO: init traffic control qdisc */ >>> CID 1519902: Possible Control flow issues (DEADCODE) >>> Execution cannot reach the expression "zvrf->zns" inside this statement: "zns = (zvrf ? zvrf->zns : z...". 2785 zns = zvrf ? zvrf->zns : zebra_ns_lookup(NS_DEFAULT); 2786 2787 dplane_ctx_ns_init(ctx, zns, true); 2788 2789 ret = AOK; 2790 ** CID 1519901: Code maintainability issues (UNUSED_VALUE) /zebra/zebra_dplane.c: 3516 in dplane_tc_update_internal() ________________________________________________________________________________________________________ *** CID 1519901: Code maintainability issues (UNUSED_VALUE) /zebra/zebra_dplane.c: 3516 in dplane_tc_update_internal() 3510 return result; 3511 } 3512 3513 static enum zebra_dplane_result dplane_tc_update_internal(enum dplane_op_e op) 3514 { 3515 enum zebra_dplane_result result = ZEBRA_DPLANE_REQUEST_FAILURE; >>> CID 1519901: Code maintainability issues (UNUSED_VALUE) >>> Assigning value "22" to "ret" here, but that stored value is overwritten before it can be used. 3516 int ret = EINVAL; 3517 struct zebra_dplane_ctx *ctx = NULL; 3518 3519 /* Obtain context block */ 3520 ctx = dplane_ctx_alloc(); 3521 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 16 Aug '22

16 Aug '22

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 8 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 29 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 8 of 8 defect(s) ** CID 1519848: Null pointer dereferences (FORWARD_NULL) /pimd/pim6_mld.c: 2253 in gm_ifp_update() ________________________________________________________________________________________________________ *** CID 1519848: Null pointer dereferences (FORWARD_NULL) /pimd/pim6_mld.c: 2253 in gm_ifp_update() 2247 } 2248 2249 if (!pim_ifp->mld) 2250 gm_start(ifp); 2251 2252 gm_ifp = pim_ifp->mld; >>> CID 1519848: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "&gm_ifp->cur_ll_lowest" to "memcmp", which dereferences it. 2253 if (IPV6_ADDR_CMP(&pim_ifp->ll_lowest, &gm_ifp->cur_ll_lowest)) 2254 gm_update_ll(ifp); 2255 2256 unsigned int cfg_query_intv = pim_ifp->gm_default_query_interval * 1000; 2257 2258 if (gm_ifp->cur_query_intv != cfg_query_intv) { ** CID 1519847: Insecure data handling (TAINTED_SCALAR) /pimd/pim6_mld.c: 844 in gm_handle_v2_report() ________________________________________________________________________________________________________ *** CID 1519847: Insecure data handling (TAINTED_SCALAR) /pimd/pim6_mld.c: 844 in gm_handle_v2_report() 838 pkt->iface = gm_ifp; 839 pkt->subscriber = gm_subscriber_findref(gm_ifp, pkt_src->sin6_addr); 840 841 n_records = ntohs(hdr->n_records); 842 843 /* validate & remove state in v2_pass1() */ >>> CID 1519847: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "n_records" as a loop boundary. 844 for (i = 0; i < n_records; i++) { 845 struct mld_v2_rec_hdr *rechdr; 846 size_t n_src, record_size; 847 848 if (len < sizeof(*rechdr)) { 849 zlog_warn(log_pkt_src( ** CID 1519846: (TAINTED_SCALAR) /pimd/pim6_mld.c: 688 in gm_handle_v2_pass1() ________________________________________________________________________________________________________ *** CID 1519846: (TAINTED_SCALAR) /pimd/pim6_mld.c: 682 in gm_handle_v2_pass1() 676 * of blocked sources from full group state records 677 */ 678 return; 679 } 680 681 if (subscriber) >>> CID 1519846: (TAINTED_SCALAR) >>> Passing tainted expression "n_src" to "gm_packet_sg_remove_sources", which uses it as a loop boundary. 682 gm_packet_sg_remove_sources(pkt->iface, subscriber, 683 rechdr->grp, rechdr->srcs, 684 n_src, GM_SUB_POS); 685 return; 686 } 687 /pimd/pim6_mld.c: 688 in gm_handle_v2_pass1() 682 gm_packet_sg_remove_sources(pkt->iface, subscriber, 683 rechdr->grp, rechdr->srcs, 684 n_src, GM_SUB_POS); 685 return; 686 } 687 >>> CID 1519846: (TAINTED_SCALAR) >>> Using tainted variable "n_src" as a loop boundary. 688 for (j = 0; j < n_src; j++) { 689 struct gm_sg *sg; 690 691 sg = gm_sg_find(pkt->iface, rechdr->grp, rechdr->srcs[j]); 692 if (!sg) 693 sg = gm_sg_make(pkt->iface, rechdr->grp, /pimd/pim6_mld.c: 661 in gm_handle_v2_pass1() 655 } 656 break; 657 658 case MLD_RECTYPE_ALLOW_NEW_SOURCES: 659 if (old_grp) { 660 /* remove S,Gs from EXCLUDE, and then we're done */ >>> CID 1519846: (TAINTED_SCALAR) >>> Passing tainted expression "n_src" to "gm_packet_sg_remove_sources", which uses it as a loop boundary. 661 gm_packet_sg_remove_sources(pkt->iface, subscriber, 662 rechdr->grp, rechdr->srcs, 663 n_src, GM_SUB_NEG); 664 return; 665 } 666 /* in INCLUDE mode => ALLOW_NEW_SOURCES is functionally ** CID 1519845: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 188 in gm_gsq_pends_add() ________________________________________________________________________________________________________ *** CID 1519845: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 188 in gm_gsq_pends_add() 182 { 183 uint32_t seed = a->s_bit ? 0x68f0eb5e : 0x156b7f19; 184 185 return jhash(&a->grp, sizeof(a->grp), seed); 186 } 187 >>> CID 1519845: Integer handling issues (BAD_SHIFT) >>> In expression "hval >> 33 - h->hh.tabshift", right shifting by more than 31 bits has undefined behavior. The shift amount, "33 - h->hh.tabshift", is 33. 188 DECLARE_HASH(gm_gsq_pends, struct gm_gsq_pending, itm, gm_gsq_pending_cmp, 189 gm_gsq_pending_hash); 190 191 /* 192 * interface -> (S,G) 193 */ ** CID 1519844: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1519844: Insecure data handling (TAINTED_SCALAR) /pimd/pim6_mld.c: 1505 in gm_handle_query() 1499 gm_handle_q_general(gm_ifp, &timers); 1500 gm_ifp->stats.rx_query_new_general++; 1501 } else if (!ntohs(hdr->n_src)) { 1502 gm_handle_q_group(gm_ifp, &timers, hdr->grp); 1503 gm_ifp->stats.rx_query_new_group++; 1504 } else { >>> CID 1519844: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "ntohs(hdr->n_src)" to "gm_handle_q_groupsrc", which uses it as a loop boundary. 1505 gm_handle_q_groupsrc(gm_ifp, &timers, hdr->grp, hdr->srcs, 1506 ntohs(hdr->n_src)); 1507 gm_ifp->stats.rx_query_new_groupsrc++; 1508 } 1509 } 1510 ** CID 1519843: (UNINIT) ________________________________________________________________________________________________________ *** CID 1519843: (UNINIT) /pimd/pim6_mld.c: 1715 in gm_t_recv() 1709 if (pktlen < sizeof(struct icmp6_plain_hdr)) { 1710 zlog_warn(log_pkt_src("truncated packet")); 1711 gm_ifp->stats.rx_drop_malformed++; 1712 goto out_free; 1713 } 1714 >>> CID 1519843: (UNINIT) >>> Using uninitialized value "pkt_src->sin6_addr" when calling "gm_rx_process". 1715 gm_rx_process(gm_ifp, pkt_src, &pktinfo->ipi6_addr, iov->iov_base, 1716 pktlen); 1717 1718 out_free: 1719 if (iov->iov_base != rxbuf) 1720 XFREE(MTYPE_GM_PACKET, iov->iov_base); /pimd/pim6_mld.c: 1647 in gm_t_recv() 1641 pim->gm_rx_drop_sys++; 1642 goto out_free; 1643 } 1644 1645 struct interface *ifp; 1646 >>> CID 1519843: (UNINIT) >>> Using uninitialized value "pkt_src->sin6_scope_id" when calling "if_lookup_by_index". 1647 ifp = if_lookup_by_index(pkt_src->sin6_scope_id, pim->vrf->vrf_id); 1648 if (!ifp || !ifp->info) 1649 goto out_free; 1650 1651 struct pim_interface *pim_ifp = ifp->info; 1652 struct gm_if *gm_ifp = pim_ifp->mld; ** CID 1519842: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 261 in gm_subscribers_add() ________________________________________________________________________________________________________ *** CID 1519842: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 261 in gm_subscribers_add() 255 256 static uint32_t gm_subscriber_hash(const struct gm_subscriber *a) 257 { 258 return jhash(&a->addr, sizeof(a->addr), 0xd0e94ad4); 259 } 260 >>> CID 1519842: Integer handling issues (BAD_SHIFT) >>> In expression "hval >> 33 - h->hh.tabshift", right shifting by more than 31 bits has undefined behavior. The shift amount, "33 - h->hh.tabshift", is 33. 261 DECLARE_HASH(gm_subscribers, struct gm_subscriber, itm, gm_subscriber_cmp, 262 gm_subscriber_hash); 263 264 static struct gm_subscriber *gm_subscriber_findref(struct gm_if *gm_ifp, 265 pim_addr addr) 266 { ** CID 1519841: Error handling issues (CHECKED_RETURN) /vrrpd/vrrp.c: 1248 in vrrp_socket() ________________________________________________________________________________________________________ *** CID 1519841: Error handling issues (CHECKED_RETURN) /vrrpd/vrrp.c: 1248 in vrrp_socket() 1242 r->vr->vrid, family2str(r->family)); 1243 failed = true; 1244 goto done; 1245 } 1246 1247 /* Turn off multicast loop on Tx */ >>> CID 1519841: Error handling issues (CHECKED_RETURN) >>> Calling "setsockopt_ipv6_multicast_loop" without checking return value (as is done elsewhere 4 out of 5 times). 1248 setsockopt_ipv6_multicast_loop(r->sock_tx, 0); 1249 1250 /* Bind Rx socket to exact interface */ 1251 frr_with_privs(&vrrp_privs) { 1252 ret = setsockopt(r->sock_rx, SOL_SOCKET, 1253 SO_BINDTODEVICE, r->vr->ifp->name, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 15 Aug '22

15 Aug '22

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 102 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 24 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 102 defect(s) ** CID 1519830: (NULL_RETURNS) /bgpd/bgp_evpn_vty.c: 4059 in no_bgp_evpn_advertise_type5() /bgpd/bgp_evpn_vty.c: 4074 in no_bgp_evpn_advertise_type5() ________________________________________________________________________________________________________ *** CID 1519830: (NULL_RETURNS) /bgpd/bgp_evpn_vty.c: 4059 in no_bgp_evpn_advertise_type5() 4053 4054 if (afi == AFI_IP) { 4055 4056 /* if we are not advertising ipv4 prefix as type-5 4057 * nothing to do 4058 */ >>> CID 1519830: (NULL_RETURNS) >>> Dereferencing "bgp_vrf", which is known to be "NULL". 4059 if ((CHECK_FLAG(bgp_vrf->af_flags[AFI_L2VPN][SAFI_EVPN], 4060 BGP_L2VPN_EVPN_ADV_IPV4_UNICAST)) || 4061 (CHECK_FLAG(bgp_vrf->af_flags[AFI_L2VPN][SAFI_EVPN], 4062 BGP_L2VPN_EVPN_ADV_IPV4_UNICAST_GW_IP))) { 4063 bgp_evpn_withdraw_type5_routes(bgp_vrf, afi, safi); 4064 UNSET_FLAG(bgp_vrf->af_flags[AFI_L2VPN][SAFI_EVPN], /bgpd/bgp_evpn_vty.c: 4074 in no_bgp_evpn_advertise_type5() 4068 } 4069 } else { 4070 4071 /* if we are not advertising ipv6 prefix as type-5 4072 * nothing to do 4073 */ >>> CID 1519830: (NULL_RETURNS) >>> Dereferencing "bgp_vrf", which is known to be "NULL". 4074 if ((CHECK_FLAG(bgp_vrf->af_flags[AFI_L2VPN][SAFI_EVPN], 4075 BGP_L2VPN_EVPN_ADV_IPV6_UNICAST)) || 4076 (CHECK_FLAG(bgp_vrf->af_flags[AFI_L2VPN][SAFI_EVPN], 4077 BGP_L2VPN_EVPN_ADV_IPV6_UNICAST_GW_IP))){ 4078 bgp_evpn_withdraw_type5_routes(bgp_vrf, afi, safi); 4079 UNSET_FLAG(bgp_vrf->af_flags[AFI_L2VPN][SAFI_EVPN], ** CID 1519829: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 151 in plspid_map_add() ________________________________________________________________________________________________________ *** CID 1519829: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 151 in plspid_map_add() 145 static uint32_t nbkey_map_hash(const struct nbkey_map_data *e); 146 static int req_map_cmp(const struct req_map_data *a, 147 const struct req_map_data *b); 148 static uint32_t req_map_hash(const struct req_map_data *e); 149 150 /* Data Structure Declarations */ >>> CID 1519829: Integer handling issues (BAD_SHIFT) >>> In expression "hval >> 33 - h->hh.tabshift", right shifting by more than 31 bits has undefined behavior. The shift amount, "33 - h->hh.tabshift", is 33. 151 DECLARE_HASH(plspid_map, struct plspid_map_data, mi, plspid_map_cmp, 152 plspid_map_hash); 153 DECLARE_HASH(nbkey_map, struct nbkey_map_data, mi, nbkey_map_cmp, 154 nbkey_map_hash); 155 DECLARE_HASH(req_map, struct req_map_data, mi, req_map_cmp, req_map_hash); 156 ** CID 1519828: High impact quality (Y2K38_SAFETY) /pimd/mtracebis_netlink.c: 95 in rtnl_open_byproto() ________________________________________________________________________________________________________ *** CID 1519828: High impact quality (Y2K38_SAFETY) /pimd/mtracebis_netlink.c: 95 in rtnl_open_byproto() 89 } 90 if (rth->local.nl_family != AF_NETLINK) { 91 fprintf(stderr, "Wrong address family %d\n", 92 rth->local.nl_family); 93 return -1; 94 } >>> CID 1519828: High impact quality (Y2K38_SAFETY) >>> A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "time(NULL)" is cast to "__u32". 95 rth->seq = time(NULL); 96 return 0; 97 } 98 99 int rtnl_open(struct rtnl_handle *rth, unsigned subscriptions) 100 { ** CID 1519827: Security best practices violations (DC.WEAK_CRYPTO) /nhrpd/nhrp_peer.c: 337 in nhrp_peer_check() ________________________________________________________________________________________________________ *** CID 1519827: Security best practices violations (DC.WEAK_CRYPTO) /nhrpd/nhrp_peer.c: 337 in nhrp_peer_check() 331 thread_add_timer( 332 master, nhrp_peer_request_timeout, p, 333 (nifp->ipsec_fallback_profile && !p->prio) ? 15 : 30, 334 &p->t_fallback); 335 } else { 336 /* Maximum timeout is 1 second */ >>> CID 1519827: Security best practices violations (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 337 int r_time_ms = rand() % 1000; 338 339 debugf(NHRP_DEBUG_COMMON, 340 "Initiating IPsec connection request to %pSU after %d ms:", 341 &vc->remote.nbma, r_time_ms); 342 thread_add_timer_msec(master, nhrp_peer_defer_vici_request, ** CID 1519826: Integer handling issues (BAD_SHIFT) /lib/qobj.c: 45 in qobj_nodes_add() ________________________________________________________________________________________________________ *** CID 1519826: Integer handling issues (BAD_SHIFT) /lib/qobj.c: 45 in qobj_nodes_add() 39 return -1; 40 if (na->nid > nb->nid) 41 return 1; 42 return 0; 43 } 44 >>> CID 1519826: Integer handling issues (BAD_SHIFT) >>> In expression "hval >> 33 - h->hh.tabshift", right shifting by more than 31 bits has undefined behavior. The shift amount, "33 - h->hh.tabshift", is 33. 45 DECLARE_HASH(qobj_nodes, struct qobj_node, nodehash, 46 qobj_cmp, qobj_hash); 47 48 static pthread_rwlock_t nodes_lock; 49 static struct qobj_nodes_head nodes = { }; 50 ** CID 1519825: Null pointer dereferences (NULL_RETURNS) /ospfd/ospf_ti_lfa.c: 123 in ospf_ti_lfa_find_q_node() ________________________________________________________________________________________________________ *** CID 1519825: Null pointer dereferences (NULL_RETURNS) /ospfd/ospf_ti_lfa.c: 123 in ospf_ti_lfa_find_q_node() 117 { 118 struct listnode *curr_node, *next_node; 119 struct vertex *p_node, *q_node, *q_space_parent = NULL, *pc_node_parent; 120 struct vertex_parent *pc_vertex_parent; 121 122 curr_node = listnode_lookup(q_space->pc_path, pc_node); >>> CID 1519825: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "curr_node", which is known to be "NULL". 123 next_node = curr_node->next; 124 pc_node_parent = listgetdata(next_node); 125 pc_vertex_parent = 126 ospf_spf_vertex_parent_find(pc_node_parent->id, pc_node); 127 128 p_node = ospf_spf_vertex_find(pc_node->id, p_space->vertex_list); ** CID 1519824: Null pointer dereferences (REVERSE_INULL) /pimd/pim_ifchannel.c: 640 in ifjoin_to_noinfo() ________________________________________________________________________________________________________ *** CID 1519824: Null pointer dereferences (REVERSE_INULL) /pimd/pim_ifchannel.c: 640 in ifjoin_to_noinfo() 634 635 static void ifjoin_to_noinfo(struct pim_ifchannel *ch) 636 { 637 pim_ifchannel_ifjoin_switch(__func__, ch, PIM_IFJOIN_NOINFO); 638 pim_forward_stop(ch); 639 >>> CID 1519824: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "ch->upstream" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 640 if (ch->upstream) 641 PIM_UPSTREAM_FLAG_UNSET_SRC_PIM(ch->upstream->flags); 642 643 PIM_IF_FLAG_UNSET_PROTO_PIM(ch->flags); 644 645 delete_on_noinfo(ch); ** CID 1519823: Insecure data handling (TAINTED_SCALAR) /nhrpd/nhrp_peer.c: 1097 in nhrp_packet_debug() ________________________________________________________________________________________________________ *** CID 1519823: Insecure data handling (TAINTED_SCALAR) /nhrpd/nhrp_peer.c: 1097 in nhrp_packet_debug() 1091 if (likely(!(debug_flags & NHRP_DEBUG_COMMON))) 1092 return; 1093 1094 zbuf_init(&zhdr, zb->buf, zb->tail - zb->buf, zb->tail - zb->buf); 1095 hdr = nhrp_packet_pull(&zhdr, &src_nbma, &src_proto, &dst_proto); 1096 >>> CID 1519823: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "hdr->type" as an index into an array "packet_types". 1097 reply = packet_types[hdr->type].type == PACKET_REPLY; 1098 debugf(NHRP_DEBUG_COMMON, "%s %s(%d) %pSU -> %pSU", dir, 1099 (packet_types[hdr->type].name ? packet_types[hdr->type].name 1100 : "Unknown"), 1101 hdr->type, reply ? &dst_proto : &src_proto, 1102 reply ? &src_proto : &dst_proto); ** CID 1519822: High impact quality (Y2K38_SAFETY) /isisd/isis_lsp.c: 1414 in lsp_generate() ________________________________________________________________________________________________________ *** CID 1519822: High impact quality (Y2K38_SAFETY) /isisd/isis_lsp.c: 1414 in lsp_generate() 1408 "ISIS (%s): Built L%d LSP. Set triggered regenerate to non-pending.", 1409 area->area_tag, level); 1410 1411 #ifndef FABRICD 1412 /* send northbound notification */ 1413 isis_notif_lsp_gen(area, newlsp->hdr.lsp_id, newlsp->hdr.seqno, >>> CID 1519822: High impact quality (Y2K38_SAFETY) >>> A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "newlsp->last_generated" is cast to "uint32_t". 1414 newlsp->last_generated); 1415 #endif /* ifndef FABRICD */ 1416 1417 return ISIS_OK; 1418 } 1419 ** CID 1519821: Null pointer dereferences (REVERSE_INULL) /pimd/pim_cmd.c: 5532 in show_ip_msdp_mesh_group() ________________________________________________________________________________________________________ *** CID 1519821: Null pointer dereferences (REVERSE_INULL) /pimd/pim_cmd.c: 5532 in show_ip_msdp_mesh_group() 5526 int idx = 2; 5527 struct pim_msdp_mg *mg; 5528 struct vrf *vrf = pim_cmd_lookup_vrf(vty, argv, argc, &idx); 5529 struct pim_instance *pim = vrf->info; 5530 struct json_object *json = NULL; 5531 >>> CID 1519821: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "vrf" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 5532 if (!vrf) 5533 return CMD_WARNING; 5534 5535 /* Quick case: list is empty. */ 5536 if (SLIST_EMPTY(&pim->msdp.mglist)) { 5537 if (uj) ** CID 1519820: Memory - illegal accesses (USE_AFTER_FREE) /lib/link_state.c: 1805 in ls_msg2edge() ________________________________________________________________________________________________________ *** CID 1519820: Memory - illegal accesses (USE_AFTER_FREE) /lib/link_state.c: 1805 in ls_msg2edge() 1799 break; 1800 default: 1801 edge = NULL; 1802 break; 1803 } 1804 >>> CID 1519820: Memory - illegal accesses (USE_AFTER_FREE) >>> Using freed pointer "edge". 1805 return edge; 1806 } 1807 1808 struct ls_subnet *ls_msg2subnet(struct ls_ted *ted, struct ls_message *msg, 1809 bool delete) 1810 { ** CID 1519819: Memory - illegal accesses (USE_AFTER_FREE) /pathd/path_pcep_pcc.c: 1330 in handle_pcep_lsp_initiate() ________________________________________________________________________________________________________ *** CID 1519819: Memory - illegal accesses (USE_AFTER_FREE) /pathd/path_pcep_pcc.c: 1330 in handle_pcep_lsp_initiate() 1324 } else { 1325 /* FIXME: Monitor the amount of errors from the PCE and 1326 * possibly disconnect and blacklist */ 1327 flog_warn(EC_PATH_PCEP_UNSUPPORTED_PCEP_FEATURE, 1328 "Unsupported PCEP protocol feature: %s", err); 1329 pcep_free_path(path); >>> CID 1519819: Memory - illegal accesses (USE_AFTER_FREE) >>> Passing freed pointer "path" as an argument to "send_pcep_error". 1330 send_pcep_error(pcc_state, PCEP_ERRT_INVALID_OPERATION, 1331 PCEP_ERRV_LSP_NOT_PCE_INITIATED, path); 1332 } 1333 } 1334 1335 void handle_pcep_comp_reply(struct ctrl_state *ctrl_state, ** CID 1519818: Null pointer dereferences (NULL_RETURNS) /pbrd/pbr_vty.c: 173 in pbr_map_match_dst_magic() ________________________________________________________________________________________________________ *** CID 1519818: Null pointer dereferences (NULL_RETURNS) /pbrd/pbr_vty.c: 173 in pbr_map_match_dst_magic() 167 "Choose the dst ip or ipv6 prefix to use\n" 168 "v4 Prefix\n" 169 "v6 Prefix\n") 170 { 171 struct pbr_map_sequence *pbrms = VTY_GET_CONTEXT(pbr_map_sequence); 172 >>> CID 1519818: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "pbrms", which is known to be "NULL". 173 if (pbrms->src && pbrms->family && prefix->family != pbrms->family) { 174 vty_out(vty, "Cannot mismatch families within match src/dst\n"); 175 return CMD_WARNING_CONFIG_FAILED; 176 } 177 178 pbrms->family = prefix->family; ** CID 1519817: Code maintainability issues (UNUSED_VALUE) /zebra/zebra_dplane.c: 3425 in dplane_nexthop_update_internal() ________________________________________________________________________________________________________ *** CID 1519817: Code maintainability issues (UNUSED_VALUE) /zebra/zebra_dplane.c: 3425 in dplane_nexthop_update_internal() 3419 * Return: Result of the change 3420 */ 3421 static enum zebra_dplane_result 3422 dplane_nexthop_update_internal(struct nhg_hash_entry *nhe, enum dplane_op_e op) 3423 { 3424 enum zebra_dplane_result result = ZEBRA_DPLANE_REQUEST_FAILURE; >>> CID 1519817: Code maintainability issues (UNUSED_VALUE) >>> Assigning value "22" to "ret" here, but that stored value is overwritten before it can be used. 3425 int ret = EINVAL; 3426 struct zebra_dplane_ctx *ctx = NULL; 3427 3428 /* Obtain context block */ 3429 ctx = dplane_ctx_alloc(); 3430 if (!ctx) { ** CID 1519816: Error handling issues (CHECKED_RETURN) /pimd/pim_tib.c: 52 in tib_sg_oil_setup() ________________________________________________________________________________________________________ *** CID 1519816: Error handling issues (CHECKED_RETURN) /pimd/pim_tib.c: 52 in tib_sg_oil_setup() 46 pim_addr_to_prefix(&grp, sg.grp); 47 48 up = pim_upstream_find(pim, &sg); 49 if (up) { 50 memcpy(&nexthop, &up->rpf.source_nexthop, 51 sizeof(struct pim_nexthop)); >>> CID 1519816: Error handling issues (CHECKED_RETURN) >>> Calling "pim_ecmp_nexthop_lookup" without checking return value (as is done elsewhere 8 out of 9 times). 52 pim_ecmp_nexthop_lookup(pim, &nexthop, vif_source, &grp, 0); 53 if (nexthop.interface) 54 input_iface_vif_index = pim_if_find_vifindex_by_ifindex( 55 pim, nexthop.interface->ifindex); 56 } else 57 input_iface_vif_index = ** CID 1519815: (TAINTED_SCALAR) /nhrpd/nhrp_peer.c: 976 in nhrp_peer_forward() /nhrpd/nhrp_peer.c: 1003 in nhrp_peer_forward() ________________________________________________________________________________________________________ *** CID 1519815: (TAINTED_SCALAR) /nhrpd/nhrp_peer.c: 976 in nhrp_peer_forward() 970 goto err; 971 972 switch (type) { 973 case NHRP_EXTENSION_FORWARD_TRANSIT_NHS: 974 case NHRP_EXTENSION_REVERSE_TRANSIT_NHS: 975 zbuf_put(zb, extpl.head, len); >>> CID 1519815: (TAINTED_SCALAR) >>> Using tainted variable "hdr->type" as an index into an array "packet_types". 976 if ((type == NHRP_EXTENSION_REVERSE_TRANSIT_NHS) 977 == (packet_types[hdr->type].type == PACKET_REPLY)) { 978 /* Check NHS list for forwarding loop */ 979 while (nhrp_cie_pull(&extpl, pp->hdr, 980 &cie_nbma, 981 &cie_protocol) != NULL) { /nhrpd/nhrp_peer.c: 1003 in nhrp_peer_forward() 997 proto = NULL; 998 999 /* If NAT extension is empty then attempt to populate 1000 * it with cached NBMA information 1001 */ 1002 if (len == 0) { >>> CID 1519815: (TAINTED_SCALAR) >>> Using tainted variable "hdr->type" as an index into an array "packet_types". 1003 if (packet_types[hdr->type].type 1004 == PACKET_REQUEST) { 1005 debugf(NHRP_DEBUG_COMMON, 1006 "Processing NHRP_EXTENSION_NAT_ADDRESS while forwarding the request packet"); 1007 proto = &pp->src_proto; 1008 } else if (packet_types[hdr->type].type ** CID 1519814: Null pointer dereferences (NULL_RETURNS) /pbrd/pbr_vty.c: 627 in pbr_map_nexthop_magic() ________________________________________________________________________________________________________ *** CID 1519814: Null pointer dereferences (NULL_RETURNS) /pbrd/pbr_vty.c: 627 in pbr_map_nexthop_magic() 621 nhop.type = NEXTHOP_TYPE_IPV6; 622 } 623 } 624 } else 625 nhop.type = NEXTHOP_TYPE_IFINDEX; 626 >>> CID 1519814: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "pbrms", which is known to be "NULL". 627 if (pbrms->nhg) 628 nh = nexthop_exists(pbrms->nhg, &nhop); 629 630 if (nh) /* Same config re-entered */ 631 goto done; 632 ** CID 1519813: (NULL_RETURNS) /pbrd/pbr_vty.c: 254 in pbr_map_match_dst_port_magic() /pbrd/pbr_vty.c: 259 in pbr_map_match_dst_port_magic() ________________________________________________________________________________________________________ *** CID 1519813: (NULL_RETURNS) /pbrd/pbr_vty.c: 254 in pbr_map_match_dst_port_magic() 248 "Choose the destination port to use\n" 249 "The Destination Port\n") 250 { 251 struct pbr_map_sequence *pbrms = VTY_GET_CONTEXT(pbr_map_sequence); 252 253 if (!no) { >>> CID 1519813: (NULL_RETURNS) >>> Dereferencing "pbrms", which is known to be "NULL". 254 if (pbrms->dst_prt == port) 255 return CMD_SUCCESS; 256 else 257 pbrms->dst_prt = port; 258 } else 259 pbrms->dst_prt = 0; /pbrd/pbr_vty.c: 259 in pbr_map_match_dst_port_magic() 253 if (!no) { 254 if (pbrms->dst_prt == port) 255 return CMD_SUCCESS; 256 else 257 pbrms->dst_prt = port; 258 } else >>> CID 1519813: (NULL_RETURNS) >>> Dereferencing "pbrms", which is known to be "NULL". 259 pbrms->dst_prt = 0; 260 261 pbr_map_check(pbrms, true); 262 263 return CMD_SUCCESS; 264 } ** CID 1519812: High impact quality (Y2K38_SAFETY) /zebra/zebra_netns_id.c: 76 in initiate_nlh() ________________________________________________________________________________________________________ *** CID 1519812: High impact quality (Y2K38_SAFETY) /zebra/zebra_netns_id.c: 76 in initiate_nlh() 70 nlh->nlmsg_len = NETLINK_ALIGN(sizeof(struct nlmsghdr)); 71 72 nlh->nlmsg_type = type; 73 nlh->nlmsg_flags = NLM_F_REQUEST; 74 if (type == RTM_NEWNSID) 75 nlh->nlmsg_flags |= NLM_F_ACK; >>> CID 1519812: High impact quality (Y2K38_SAFETY) >>> A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "time(NULL)" is cast to "unsigned int". 76 nlh->nlmsg_seq = *seq = time(NULL); 77 return nlh; 78 } 79 80 static int send_receive(int sock, struct nlmsghdr *nlh, unsigned int seq, 81 char *buf) ** CID 1519811: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1519811: Null pointer dereferences (NULL_RETURNS) /pbrd/pbr_vty.c: 725 in no_pbr_map_vrf_magic() 719 "Specify the VRF for this map\n" 720 "The VRF Name\n" 721 "Use the interface's VRF for lookup\n") 722 { 723 struct pbr_map_sequence *pbrms = VTY_GET_CONTEXT(pbr_map_sequence); 724 >>> CID 1519811: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "pbrms" when calling "pbrms_clear_set_config". 725 pbrms_clear_set_config(pbrms); 726 727 return CMD_SUCCESS; 728 } 729 730 DEFPY (pbr_policy, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

FRR 8.3 Release
by Jafar Al-Gharaibeh 20 Jul '22

20 Jul '22

Dear FRR Community, We are pleased to announce FRR 8.3 release. This release brings a long list of enhancements and fixes with more than 1000 commits from 67 developers. Packages: * Debian Packages - https://deb.frrouting.org/ <https://deb.frrouting.org/> * RPM Packages - https://rpm.frrouting.org/ <https://rpm.frrouting.org/> * Snaps - https://snapcraft.io/frr <https://snapcraft.io/frr> * Docker - https://hub.docker.com/layers/frr/frrouting/frr/v8.3.0/images/sha256-4d1343… <https://hub.docker.com/layers/frr/frrouting/frr/v8.3.0/images/sha256-4d1343…> Major Highlights: * Notification Message support for BGP Graceful Restart (http://docs.frrouting.org/en/latest/bgp.html#clicmd-bgp-graceful-restart-no… <http://docs.frrouting.org/en/latest/bgp.html#clicmd-bgp-graceful-restart-no…>) * BGP Cease Notification Subcode For BFD * Send Hold Timer for BGP * RFC5424 syslog support (http://docs.frrouting.org/en/latest/extlog.html?#clicmd-destination-syslog-… <http://docs.frrouting.org/en/latest/extlog.html?#clicmd-destination-syslog-…>) * PIM passive command (http://docs.frrouting.org/en/latest/pim.html#clicmd-ip-pim-passive <http://docs.frrouting.org/en/latest/pim.html#clicmd-ip-pim-passive>) Breaking Change: * Require librtr >= 0.8.0 for BGP RPKI (available in FRR package repos above) Please see the release notes for the detailed changelog: * Github release: https://github.com/FRRouting/frr/releases/tag/frr-8.3 <https://github.com/FRRouting/frr/releases/tag/frr-8.3> * FRRouting website: https://frrouting.org/release/8.3 <https://frrouting.org/release/8.3> Thanks to all contributors! Cheers, The FRR Development Team!

1 0

Re: [dev] LDPD crashes when hold time configured 65535
by Donatas Abraitis 18 Jul '22

18 Jul '22

Hi, thanks for the report, should be fixed in https://github.com/FRRouting/frr/pull/11631. On Mon, Jul 18, 2022 at 9:35 AM Girish Patoliya via dev < dev(a)lists.frrouting.org> wrote: > > > > ---------- Forwarded message ---------- > From: Girish Patoliya <girishkumar.patoliya(a)mavenir.com> > To: "dev(a)lists.frrouting.org" <dev(a)lists.frrouting.org> > Cc: > Bcc: > Date: Mon, 18 Jul 2022 06:24:03 +0000 > Subject: LDPD crashes when hold time configured 65535 > > Hi > > > > I am running FRR from stable 8.1 HEAD. > > > > LDPD crashes when hold time is configured to 65535: > (gdb) bt > #0 0x00007f8c3fc224bb in raise () from /lib64/libpthread.so.0 > #1 0x00007f8c4138a3dd in core_handler () from /lib64/libfrr.so.0 > #2 <signal handler called> > #3 0x00007f8c3fc1ccc0 in pthread_mutex_lock () from /lib64/libpthread.so.0 > #4 0x00007f8c4139914b in thread_timer_remain_msec () from > /lib64/libfrr.so.0 > #5 0x00007f8c41399209 in thread_timer_remain_second () from > /lib64/libfrr.so.0 > #6 0x000000000040eb19 in adj_to_ctl () > #7 0x0000000000427b38 in ldpe_nbr_ctl () > #8 0x000000000042fd68 in control_dispatch_imsg () > #9 0x00007f8c4139a628 in thread_call () from /lib64/libfrr.so.0 > #10 0x00000000004265fc in ldpe () > #11 0x000000000040a68f in main () > > > > I tried to compile on latest to check if this issue is fixed, but > unfortunately my compilation is failing on master HEAD due to env > dependencies. > > Is anyone aware if this issue is fixed after 8.1 ? > Can someone share details on how to enable gdb option to get full bt, I > tried * --enable-dev-build* but I am getting same bt without local info. > > > > Regards, > > Girish > > > ------------------------------ > > This e-mail message may contain confidential or proprietary information of > Mavenir Systems, Inc. or its affiliates and is intended solely for the use > of the intended recipient(s). If you are not the intended recipient of this > message, you are hereby notified that any review, use or distribution of > this information is absolutely prohibited and we request that you delete > all copies in your control and contact us by e-mailing to > security(a)mavenir.com. This message contains the views of its author and > may not necessarily reflect the views of Mavenir Systems, Inc. or its > affiliates, who employ systems to monitor email messages, but make no > representation that such messages are authorized, secure, uncompromised, or > free from computer viruses, malware, or other defects. Thank You > > > > ---------- Forwarded message ---------- > From: Girish Patoliya via dev <dev(a)lists.frrouting.org> > To: "dev(a)lists.frrouting.org" <dev(a)lists.frrouting.org> > Cc: > Bcc: > Date: Mon, 18 Jul 2022 06:24:03 +0000 > Subject: [dev] LDPD crashes when hold time configured 65535 > _______________________________________________ > dev mailing list > dev(a)lists.frrouting.org > https://lists.frrouting.org/listinfo/dev > -- Donatas

1 0