- dev - lists.frrouting.org

BGP-LS Design
by Abhijit Chaudhary 18 Aug '20

18 Aug '20

Dear Olivier, Thanks Olivier for sharing the BGP-LS source code. The team at Niral had reviewed the code, RFC and came up with a high level design. Dear All, Kindly find the BGP-LS design - https://github.com/Niral-Networks/docs/blob/master/FRR-BGP-LS-Design.pdf. We can discuss it during the Telco call tomorrow. Best, - Abhijit +91-9886179612 <http://www.niralnetworks.com/> Building Curated, Open, Disaggregated Networking for 5G and Beyond According to DSCI report, A NASSCOM Initiative, Niral Networks is a key 5G technology player from India <https://www.nasscom.in/sites/default/files/TechSagar_Wireless_and_Networkin…> ---------------------------------------------------------------------- >> >> Message: 1 >> Date: Fri, 24 Jul 2020 18:19:14 +0200 >> From: <olivier.dugeon(a)orange.com> >> To: dev <dev(a)lists.frrouting.org> >> Cc: CRISTIAN ALVARO ALBA ARRIETA <cristian.alba.a(a)uni.pe> >> Subject: [dev] Telco meeting status >> Message-ID: <cf9a4877-20ee-fda0-217f-b291615176a5(a)orange.com> >> Content-Type: text/plain; charset="utf-8" >> >> Dear all, >> >> Following the last Telco meeting, I updated the Wiki page to reflect our >> new usage >> of GitHub Project management facilities: >> https://github.com/FRRouting/frr/wiki/FRR-Telco-SP-projects >> >> Regarding BGP-LS, there is already a #Telco channel on Slack with very >> few discussions. >> So, I propose to use this #Telco channel to discuss on-going development >> around BGP-LS. >> >> Cristain (in Cc:) started its internship within Orange one month ago. >> He'll join >> Slack soon. Cristian started to backport our old BGP-LS code to FRR. >> Please, interact >> with him through Slack to discuss how to organise the work and progress. >> >> As mentioned, I'll start 3 weeks vacations this evening. So, fill free to >> maintain or >> cancel the next Telco meeting in 2 weeks. Allistair will manage it. >> >> Finally, I'll push a preview of Link State PR as WIP. Look at the doxygen >> doc within >> link_state.h for details and usage. >> >> Enjoy your summer. >> >> Regards >> >> Olivier >> >>

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 15 Aug '20

15 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 16 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 15 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 16 of 16 defect(s) ** CID 1496644: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_evpn_neigh.c: 722 in zebra_evpn_proc_sync_neigh_update() ________________________________________________________________________________________________________ *** CID 1496644: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_evpn_neigh.c: 722 in zebra_evpn_proc_sync_neigh_update() 716 if (old_bgp_ready) { 717 zebra_evpn_neigh_send_del_to_client( 718 zevpn->vni, &n->ip, &n->emac, n->flags, 719 n->state, false /*force*/); 720 old_bgp_ready = false; 721 } >>> CID 1496644: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "n->mac" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 722 if (n->mac) 723 zebra_evpn_local_neigh_deref_mac( 724 n, false /*send_mac_update*/); 725 } 726 /* clear old fwd info */ 727 n->rem_seq = 0; ** CID 1496643: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496643: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_evpn_mh.c: 362 in zebra_evpn_es_evi_show_vni() 356 vty_out(vty, "%-8s %-30s %-4s\n", "VNI", "ESI", "Type"); 357 } 358 } else { 359 if (!uj) 360 vty_out(vty, "VNI %d doesn't exist\n", vni); 361 } >>> CID 1496643: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "zevpn" to "zebra_evpn_es_evi_show_one_evpn", which dereferences it. 362 zebra_evpn_es_evi_show_one_evpn(zevpn, vty, json, detail); 363 } 364 365 /* Initialize the ES tables maintained per-L2_VNI */ 366 void zebra_evpn_evpn_es_init(zebra_evpn_t *zevpn) 367 { ** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 486 in seqnumber_mismatch() 480 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 481 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 482 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 483 484 ospf6_lsdb_remove_all(on->summary_list); 485 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 486 for (ALL_LSDB(on->retrans_list, lsa)) { 487 ospf6_decrement_retrans_count(lsa); 488 ospf6_lsdb_remove(lsa, on->retrans_list); 489 } 490 491 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2306 in ospf6_lsack_send_neighbor() 2300 2301 memset(sendbuf, 0, iobuflen); 2302 oh = (struct ospf6_header *)sendbuf; 2303 2304 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2305 >>> CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2306 for (ALL_LSDB(on->lsack_list, lsa)) { 2307 /* MTU check */ 2308 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2309 > ospf6_packet_max(on->ospf6_if)) { 2310 /* if we run out of packet size/space here, 2311 better to try again soon. */ ** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2223 in ospf6_lsupdate_send_interface() 2217 lsupdate = (struct ospf6_lsupdate *)((caddr_t)oh 2218 + sizeof(struct ospf6_header)); 2219 2220 p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); 2221 lsa_cnt = 0; 2222 >>> CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2223 for (ALL_LSDB(oi->lsupdate_list, lsa)) { 2224 /* MTU check */ 2225 if ((p - sendbuf + ((unsigned int)OSPF6_LSA_SIZE(lsa->header))) 2226 > ospf6_packet_max(oi)) { 2227 if (lsa_cnt) { 2228 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; ** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 306 in ospf6_lsdb_remove_all() 300 { 301 struct ospf6_lsa *lsa; 302 303 if (lsdb == NULL) 304 return; 305 >>> CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 306 for (ALL_LSDB(lsdb, lsa)) 307 ospf6_lsdb_remove(lsa, lsdb); 308 } 309 310 void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa) 311 { ** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 125 in ospf6_neighbor_delete() 119 void ospf6_neighbor_delete(struct ospf6_neighbor *on) 120 { 121 struct ospf6_lsa *lsa; 122 123 ospf6_lsdb_remove_all(on->summary_list); 124 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 125 for (ALL_LSDB(on->retrans_list, lsa)) { 126 ospf6_decrement_retrans_count(lsa); 127 ospf6_lsdb_remove(lsa, on->retrans_list); 128 } 129 130 ospf6_lsdb_remove_all(on->dbdesc_list); ** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1872 in ospf6_dbdesc_send_newone() 1866 ospf6_lsdb_remove_all(on->dbdesc_list); 1867 1868 /* move LSAs from summary_list to dbdesc_list (within neighbor 1869 structure) 1870 so that ospf6_send_dbdesc () can send those LSAs */ 1871 size = sizeof(struct ospf6_lsa_header) + sizeof(struct ospf6_dbdesc); >>> CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 1872 for (ALL_LSDB(on->summary_list, lsa)) { 1873 if (size + sizeof(struct ospf6_lsa_header) 1874 > ospf6_packet_max(on->ospf6_if)) { 1875 ospf6_lsdb_lsa_unlock(lsa); 1876 break; 1877 } ** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 523 in bad_lsreq() 517 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 518 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 519 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 520 521 ospf6_lsdb_remove_all(on->summary_list); 522 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 523 for (ALL_LSDB(on->retrans_list, lsa)) { 524 ospf6_decrement_retrans_count(lsa); 525 ospf6_lsdb_remove(lsa, on->retrans_list); 526 } 527 528 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 310 in negotiation_done() 304 if (IS_OSPF6_DEBUG_NEIGHBOR(EVENT)) 305 zlog_debug("Neighbor Event %s: *NegotiationDone*", on->name); 306 307 /* clear ls-list */ 308 ospf6_lsdb_remove_all(on->summary_list); 309 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 310 for (ALL_LSDB(on->retrans_list, lsa)) { 311 ospf6_decrement_retrans_count(lsa); 312 ospf6_lsdb_remove(lsa, on->retrans_list); 313 } 314 315 /* Interface scoped LSAs */ ** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 324 in ospf6_lsdb_maxage_remover() 318 319 int ospf6_lsdb_maxage_remover(struct ospf6_lsdb *lsdb) 320 { 321 int reschedule = 0; 322 struct ospf6_lsa *lsa; 323 >>> CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 324 for (ALL_LSDB(lsdb, lsa)) { 325 if (!OSPF6_LSA_IS_MAXAGE(lsa)) 326 continue; 327 if (lsa->retrans_count != 0) { 328 reschedule = 1; 329 continue; ** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2385 in ospf6_lsack_send_interface() 2379 2380 memset(sendbuf, 0, iobuflen); 2381 oh = (struct ospf6_header *)sendbuf; 2382 2383 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2384 >>> CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2385 for (ALL_LSDB(oi->lsack_list, lsa)) { 2386 /* MTU check */ 2387 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2388 > ospf6_packet_max(oi)) { 2389 /* if we run out of packet size/space here, 2390 better to try again soon. */ ** CID 1486256: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486256: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2040 in ospf6_lsupdate_send_neighbor() 2034 2035 p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); 2036 lsa_cnt = 0; 2037 2038 /* lsupdate_list lists those LSA which doesn't need to be 2039 retransmitted. remove those from the list */ >>> CID 1486256: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2040 for (ALL_LSDB(on->lsupdate_list, lsa)) { 2041 /* MTU check */ 2042 if ((p - sendbuf + (unsigned int)OSPF6_LSA_SIZE(lsa->header)) 2043 > ospf6_packet_max(on->ospf6_if)) { 2044 if (lsa_cnt) { 2045 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; ** CID 1486255: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486255: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 558 in oneway_received() 552 ospf6_neighbor_state_change(OSPF6_NEIGHBOR_INIT, on, 553 OSPF6_NEIGHBOR_EVENT_ONEWAY_RCVD); 554 thread_add_event(master, neighbor_change, on->ospf6_if, 0, NULL); 555 556 ospf6_lsdb_remove_all(on->summary_list); 557 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486255: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 558 for (ALL_LSDB(on->retrans_list, lsa)) { 559 ospf6_decrement_retrans_count(lsa); 560 ospf6_lsdb_remove(lsa, on->retrans_list); 561 } 562 563 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 455 in adj_ok() 449 450 } else if (on->state >= OSPF6_NEIGHBOR_EXSTART && !need_adjacency(on)) { 451 ospf6_neighbor_state_change(OSPF6_NEIGHBOR_TWOWAY, on, 452 OSPF6_NEIGHBOR_EVENT_ADJ_OK); 453 ospf6_lsdb_remove_all(on->summary_list); 454 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 455 for (ALL_LSDB(on->retrans_list, lsa)) { 456 ospf6_decrement_retrans_count(lsa); 457 ospf6_lsdb_remove(lsa, on->retrans_list); 458 } 459 } 460 ** CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1950 in ospf6_lsreq_send() 1944 } 1945 1946 if (last_req != NULL) { 1947 if (on->last_ls_req != NULL) 1948 on->last_ls_req = ospf6_lsa_unlock(on->last_ls_req); 1949 >>> CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 1950 ospf6_lsa_lock(last_req); 1951 on->last_ls_req = last_req; 1952 } 1953 1954 oh->type = OSPF6_MESSAGE_TYPE_LSREQ; 1955 oh->length = htons(p - sendbuf); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 12 Aug '20

12 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1496642: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496642: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_route.c: 3072 in bgp_filtered_routes_count() 3066 3067 for (dest = bgp_table_top(table); dest; dest = bgp_route_next(dest)) { 3068 for (ain = dest->adj_in; ain; ain = ain->next) { 3069 const struct prefix *rn_p = bgp_dest_get_prefix(dest); 3070 struct attr attr = {}; 3071 >>> CID 1496642: Null pointer dereferences (FORWARD_NULL) >>> Passing "&attr" to "bgp_input_filter", which dereferences null "attr.aspath". 3072 if (bgp_input_filter(peer, rn_p, &attr, afi, safi) 3073 == FILTER_DENY) 3074 count++; 3075 } 3076 } 3077 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 07 Aug '20

07 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 6 of 6 defect(s) ** CID 1496619: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496619: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_evpn_mh.c: 360 in zebra_evpn_es_evi_show_vni() 354 vty_out(vty, "%-8s %-30s %-4s\n", "VNI", "ESI", "Type"); 355 } 356 } else { 357 if (!uj) 358 vty_out(vty, "VNI %d doesn't exist\n", vni); 359 } >>> CID 1496619: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "zvni" to "zebra_evpn_es_evi_show_one_vni", which dereferences it. 360 zebra_evpn_es_evi_show_one_vni(zvni, vty, json, detail); 361 } 362 363 /* Initialize the ES tables maintained per-L2_VNI */ 364 void zebra_evpn_vni_es_init(zebra_vni_t *zvni) 365 { ** CID 1496618: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496618: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_evpn_mh.c: 909 in bgp_evpn_type1_route_update() 903 attr_new = pi->attr; 904 905 /* Perform route selection; 906 * this is just to set the flags correctly as local route in 907 * the ES always wins. 908 */ >>> CID 1496618: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "vpn" to "evpn_route_select_install", which dereferences it. 909 evpn_route_select_install(bgp, vpn, rn); 910 bgp_dest_unlock_node(rn); 911 912 /* If this is a new route or some attribute has changed, export the 913 * route to the global table. The route will be advertised to peers 914 * from there. Note that this table is a 2-level tree (RD-level + ** CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) /zebra/zebra_evpn_mh.c: 1688 in zebra_evpn_es_cleanup() 1682 struct zebra_evpn_es *es; 1683 struct zebra_evpn_es *es_next; 1684 1685 RB_FOREACH_SAFE(es, zebra_es_rb_head, 1686 &zmh_info->es_rb_tree, es_next) { 1687 zebra_evpn_local_es_del(es); >>> CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "zebra_evpn_remote_es_flush" dereferences freed pointer "es". 1688 zebra_evpn_remote_es_flush(es); 1689 } 1690 } 1691 1692 /* Only certain types of access ports can be setup as an Ethernet Segment */ 1693 bool zebra_evpn_is_if_es_capable(struct zebra_if *zif) ** CID 1496616: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_vxlan.c: 6885 in zebra_vxlan_proc_sync_neigh_update() ________________________________________________________________________________________________________ *** CID 1496616: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_vxlan.c: 6885 in zebra_vxlan_proc_sync_neigh_update() 6879 if (old_bgp_ready) { 6880 zvni_neigh_send_del_to_client(zvni->vni, &n->ip, 6881 &n->emac, n->flags, n->state, 6882 false /*force*/); 6883 old_bgp_ready = false; 6884 } >>> CID 1496616: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "n->mac" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 6885 if (n->mac) 6886 zebra_vxlan_local_neigh_deref_mac(n, 6887 false /*send_mac_update*/); 6888 } 6889 /* clear old fwd info */ 6890 n->rem_seq = 0; ** CID 1496615: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /zebra/rt_netlink.c: 3206 in netlink_macfdb_update_ctx() ________________________________________________________________________________________________________ *** CID 1496615: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /zebra/rt_netlink.c: 3206 in netlink_macfdb_update_ctx() 3200 vid = dplane_ctx_mac_get_vlan(ctx); 3201 if (vid > 0) 3202 snprintf(vid_buf, sizeof(vid_buf), " VLAN %u", vid); 3203 else 3204 vid_buf[0] = '\0'; 3205 >>> CID 1496615: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "nfy & (8 /* 1 << 3 */)" is always 0 regardless of the values of its operands. This occurs as the logical first operand of "?:". 3206 zlog_debug("Tx %s family %s IF %s(%u)%s %sMAC %s dst %s nhg %u%s%s%s%s%s", 3207 nl_msg_type_to_str(cmd), nl_family_to_str(AF_BRIDGE), 3208 dplane_ctx_get_ifname(ctx), 3209 dplane_ctx_get_ifindex(ctx), vid_buf, 3210 dplane_ctx_mac_is_sticky(ctx) ? "sticky " : "", 3211 prefix_mac2str(mac, buf, sizeof(buf)), ** CID 1496614: Error handling issues (CHECKED_RETURN) /bgpd/bgp_evpn_mh.c: 1445 in bgp_evpn_local_es_up() ________________________________________________________________________________________________________ *** CID 1496614: Error handling issues (CHECKED_RETURN) /bgpd/bgp_evpn_mh.c: 1445 in bgp_evpn_local_es_up() 1439 /* generate EAD-EVI */ 1440 bgp_evpn_local_type1_evi_route_add(bgp, es); 1441 1442 /* generate EAD-ES */ 1443 build_evpn_type1_prefix(&p, BGP_EVPN_AD_ES_ETH_TAG, 1444 &es->esi, es->originator_ip); >>> CID 1496614: Error handling issues (CHECKED_RETURN) >>> Calling "bgp_evpn_type1_route_update" without checking return value (as is done elsewhere 4 out of 5 times). 1445 bgp_evpn_type1_route_update(bgp, es, NULL, &p); 1446 } 1447 1448 static void bgp_evpn_local_es_do_del(struct bgp *bgp, struct bgp_evpn_es *es) 1449 { 1450 struct bgp_evpn_es_evi *es_evi; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Notice: Telco call for 16:00 CET; 07:00 PT (tomorrow) Wednesday 5th is canceled
by Alistair Woodman 05 Aug '20

05 Aug '20

due to vacation time. (As discussed on the FRR weekly today) /a

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 05 Aug '20

05 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1496595: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1496595: Memory - illegal accesses (USE_AFTER_FREE) /zebra/zebra_rib.c: 2162 in rib_process_dplane_notify() 2156 2157 done: 2158 if (rn) 2159 route_unlock_node(rn); 2160 2161 /* Return context to dataplane module */ >>> CID 1496595: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "dplane_ctx_fini" dereferences freed pointer "ctx". 2162 dplane_ctx_fini(&ctx); 2163 } 2164 2165 static void process_subq_nhg(struct listnode *lnode) 2166 { 2167 struct nhg_ctx *ctx = NULL; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Pottential bugs RPKI States at FRR 7.3.1 (debian packages)
by Dewangga Alam 04 Aug '20

04 Aug '20

Hello! I am new at FRR, and trying to found a reference that indicated (bugs?) or miss configuration at version 7.3.1 using debian buster packages from deb.frrouting.org (http://deb.frrouting.org) Here’s our configuration: https://pastebin.com/xKE3AJij Already adjusted bgpd using rpki options, and when I restart frr service, the tagging was not working. > vtysh > sh bgp ipv4 103.241.24.0 BGP routing table entry for 103.241.24.0/24 Paths: (3 available, best #3, table default) Not advertised to any peer 38515 58820 103.28.75.36 from 103.28.75.0 (103.28.75.0) Origin IGP, localpref 5100, valid, internal Last update: Sat Aug 1 10:54:34 2020 38515 58820 103.28.75.36 from 103.28.74.255 (103.28.74.255) Origin IGP, localpref 5100, valid, internal Last update: Sat Aug 1 10:54:34 2020 38515 58820 103.28.75.36 from 103.28.74.129 (103.28.74.127) Origin IGP, localpref 5100, valid, internal, best (Router ID) Community: 38515:58820 Last update: Sat Aug 1 10:54:34 2020 The rpki states aren’t show, and when I paste the route-map configuration into vtysh, the loc-pref tag are valids and working. The full command pasted here: https://pastebin.com/n3VY4gNm Any hints to fix this issue ? Any helps are appreciated. Thanks in advance! Many thanks. -- Sent from Canary (https://canarymail.io)

2 1

zebra nexthop-tracking/reachability questions
by Mark Stapp 03 Aug '20

03 Aug '20

I've got a couple of questions about nexthop-tracking in zebra - these are a bit down in the details, but I thought I'd ask if any of the folks on the list have some insight... 1. the nht code makes a copy (mostly) of the route_entry that satisfies some client registration. the code copies all of the nexthops - even the recursive ones, even ones that are not ACTIVE. the code that sends nexthops to the nht client(s) has an rnh_nexthop_valid() function that is pretty strict about what will actually be sent. would it be reasonable to have the nht code capture only a list of the nexthops that are actually valid, that actually will be sent to the clients? 2. the show command for nht, ‘sho ip nht’, only shows the top-level nexthops - not the actual installed nexthops that, again, will be sent to the clients. would it be ok to change that, to try to have the show command show what will actually be sent to clients? 3. the route-map filtering in there also operates only on the top-level nexthops, not the exact ones that are "valid" and will be sent to clients. is that intentional, or should the route-map get a shot at the nexthops that the nht code would try to send? Thanks, Mark

1 0

Northbound meeting today is canceled
by Santosh P K 31 Jul '20

31 Jul '20

Hello All, I have a conflict today and hence will not be able to run northbound meeting today. Today’s meeting will be canceled. Thanks Santosh P K

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 28 Jul '20

28 Jul '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1496495: Error handling issues (CHECKED_RETURN) /zebra/zebra_dplane.c: 2539 in dplane_route_notif_update() ________________________________________________________________________________________________________ *** CID 1496495: Error handling issues (CHECKED_RETURN) /zebra/zebra_dplane.c: 2539 in dplane_route_notif_update() 2533 } 2534 2535 /* Capture info about the source of the notification, in 'ctx' */ 2536 dplane_ctx_set_notif_provider(new_ctx, 2537 dplane_ctx_get_notif_provider(ctx)); 2538 >>> CID 1496495: Error handling issues (CHECKED_RETURN) >>> Calling "dplane_update_enqueue" without checking return value (as is done elsewhere 9 out of 10 times). 2539 dplane_update_enqueue(new_ctx); 2540 2541 ret = ZEBRA_DPLANE_REQUEST_QUEUED; 2542 2543 done: 2544 return ret; ** CID 1496494: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_nb_config.c: 1221 in lib_vrf_zebra_l3vni_id_modify() ________________________________________________________________________________________________________ *** CID 1496494: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_nb_config.c: 1221 in lib_vrf_zebra_l3vni_id_modify() 1215 * if zebra vrf already mapped to different vni id. 1216 */ 1217 pn_dnode = yang_dnode_get_parent(args->dnode, "vrf"); 1218 if (pn_dnode) { 1219 vrfname = yang_dnode_get_string(pn_dnode, "./name"); 1220 vrf = vrf_lookup_by_name(vrfname); >>> CID 1496494: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "vrf", which is known to be "NULL". 1221 zvrf = zebra_vrf_lookup_by_id(vrf->vrf_id); 1222 if (zvrf->l3vni && zvrf->l3vni != vni) { 1223 zlog_debug( 1224 "vni %u cannot be configured as vni %u is already configured under the vrf", 1225 vni, zvrf->l3vni); 1226 return NB_ERR_VALIDATION; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0