- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 12 Oct '18

12 Oct '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 12 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 12 of 12 defect(s) ** CID 1474183: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1474183: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_routemap_clippy.c: 190 in ipv6_protocol() 184 } 185 #if 0 /* anything that can fail? */ 186 if (_failcnt) 187 return CMD_WARNING; 188 #endif 189 #endif >>> CID 1474183: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "rmap" to "ipv6_protocol_magic", which dereferences it. 190 return ipv6_protocol_magic(self, vty, argc, argv, proto, rmap); 191 } 192 193 /* no_ipv6_protocol => "no ipv6 protocol RR_IP6_PROTOCOL_MAP_STR_ZEBR $proto [route-map ROUTE-MAP$rmap]" */ 194 DEFUN_CMD_FUNC_DECL(no_ipv6_protocol) 195 #define funcdecl_no_ipv6_protocol static int no_ipv6_protocol_magic(\ ** CID 1474182: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1474182: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_routemap_clippy.c: 478 in ipv6_protocol_nht_rmap() 472 } 473 #if 0 /* anything that can fail? */ 474 if (_failcnt) 475 return CMD_WARNING; 476 #endif 477 #endif >>> CID 1474182: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "rmap" to "ipv6_protocol_nht_rmap_magic", which dereferences it. 478 return ipv6_protocol_nht_rmap_magic(self, vty, argc, argv, proto, rmap); 479 } 480 481 /* no_ipv6_protocol_nht_rmap => "no ipv6 nht RR_IP6_PROTOCOL_MAP_STR_ZEBR $proto [route-map ROUTE-MAP$rmap]" */ 482 DEFUN_CMD_FUNC_DECL(no_ipv6_protocol_nht_rmap) 483 #define funcdecl_no_ipv6_protocol_nht_rmap static int no_ipv6_protocol_nht_rmap_magic(\ ** CID 1474181: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1474181: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_routemap_clippy.c: 334 in ip_protocol_nht_rmap() 328 } 329 #if 0 /* anything that can fail? */ 330 if (_failcnt) 331 return CMD_WARNING; 332 #endif 333 #endif >>> CID 1474181: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "proto" to "ip_protocol_nht_rmap_magic", which dereferences it. 334 return ip_protocol_nht_rmap_magic(self, vty, argc, argv, proto, rmap); 335 } 336 337 /* no_ip_protocol_nht_rmap => "no ip nht RR_IP_PROTOCOL_MAP_STR_ZEBR $proto route-map [ROUTE-MAP$rmap]" */ 338 DEFUN_CMD_FUNC_DECL(no_ip_protocol_nht_rmap) 339 #define funcdecl_no_ip_protocol_nht_rmap static int no_ip_protocol_nht_rmap_magic(\ ** CID 1474180: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1474180: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_routemap_clippy.c: 46 in ip_protocol() 40 } 41 #if 0 /* anything that can fail? */ 42 if (_failcnt) 43 return CMD_WARNING; 44 #endif 45 #endif >>> CID 1474180: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "rmap" to "ip_protocol_magic", which dereferences it. 46 return ip_protocol_magic(self, vty, argc, argv, proto, rmap); 47 } 48 49 /* no_ip_protocol => "no ip protocol RR_IP_PROTOCOL_MAP_STR_ZEBR $proto [route-map ROUTE-MAP$rmap]" */ 50 DEFUN_CMD_FUNC_DECL(no_ip_protocol) 51 #define funcdecl_no_ip_protocol static int no_ip_protocol_magic(\ ** CID 1474179: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1474179: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_routemap_clippy.c: 94 in no_ip_protocol() 88 } 89 #if 0 /* anything that can fail? */ 90 if (_failcnt) 91 return CMD_WARNING; 92 #endif 93 #endif >>> CID 1474179: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "proto" to "no_ip_protocol_magic", which dereferences it. 94 return no_ip_protocol_magic(self, vty, argc, argv, proto, rmap); 95 } 96 97 /* show_ip_protocol => "show ip protocol [vrf <NAME$vrf_name|all$vrf_all>]" */ 98 DEFUN_CMD_FUNC_DECL(show_ip_protocol) 99 #define funcdecl_show_ip_protocol static int show_ip_protocol_magic(\ ** CID 1474178: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1474178: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_routemap_clippy.c: 334 in ip_protocol_nht_rmap() 328 } 329 #if 0 /* anything that can fail? */ 330 if (_failcnt) 331 return CMD_WARNING; 332 #endif 333 #endif >>> CID 1474178: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "rmap" to "ip_protocol_nht_rmap_magic", which dereferences it. 334 return ip_protocol_nht_rmap_magic(self, vty, argc, argv, proto, rmap); 335 } 336 337 /* no_ip_protocol_nht_rmap => "no ip nht RR_IP_PROTOCOL_MAP_STR_ZEBR $proto route-map [ROUTE-MAP$rmap]" */ 338 DEFUN_CMD_FUNC_DECL(no_ip_protocol_nht_rmap) 339 #define funcdecl_no_ip_protocol_nht_rmap static int no_ip_protocol_nht_rmap_magic(\ ** CID 1474177: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1474177: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_routemap_clippy.c: 46 in ip_protocol() 40 } 41 #if 0 /* anything that can fail? */ 42 if (_failcnt) 43 return CMD_WARNING; 44 #endif 45 #endif >>> CID 1474177: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "proto" to "ip_protocol_magic", which dereferences it. 46 return ip_protocol_magic(self, vty, argc, argv, proto, rmap); 47 } 48 49 /* no_ip_protocol => "no ip protocol RR_IP_PROTOCOL_MAP_STR_ZEBR $proto [route-map ROUTE-MAP$rmap]" */ 50 DEFUN_CMD_FUNC_DECL(no_ip_protocol) 51 #define funcdecl_no_ip_protocol static int no_ip_protocol_magic(\ ** CID 1474176: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1474176: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_routemap_clippy.c: 526 in no_ipv6_protocol_nht_rmap() 520 } 521 #if 0 /* anything that can fail? */ 522 if (_failcnt) 523 return CMD_WARNING; 524 #endif 525 #endif >>> CID 1474176: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "proto" to "no_ipv6_protocol_nht_rmap_magic", which dereferences it. 526 return no_ipv6_protocol_nht_rmap_magic(self, vty, argc, argv, proto, rmap); 527 } 528 529 /* show_ipv6_protocol_nht => "show ipv6 nht route-map [vrf <NAME$vrf_name|all$vrf_all>]" */ 530 DEFUN_CMD_FUNC_DECL(show_ipv6_protocol_nht) 531 #define funcdecl_show_ipv6_protocol_nht static int show_ipv6_protocol_nht_magic(\ ** CID 1474175: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1474175: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_routemap_clippy.c: 478 in ipv6_protocol_nht_rmap() 472 } 473 #if 0 /* anything that can fail? */ 474 if (_failcnt) 475 return CMD_WARNING; 476 #endif 477 #endif >>> CID 1474175: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "proto" to "ipv6_protocol_nht_rmap_magic", which dereferences it. 478 return ipv6_protocol_nht_rmap_magic(self, vty, argc, argv, proto, rmap); 479 } 480 481 /* no_ipv6_protocol_nht_rmap => "no ipv6 nht RR_IP6_PROTOCOL_MAP_STR_ZEBR $proto [route-map ROUTE-MAP$rmap]" */ 482 DEFUN_CMD_FUNC_DECL(no_ipv6_protocol_nht_rmap) 483 #define funcdecl_no_ipv6_protocol_nht_rmap static int no_ipv6_protocol_nht_rmap_magic(\ ** CID 1474174: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1474174: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_routemap_clippy.c: 238 in no_ipv6_protocol() 232 } 233 #if 0 /* anything that can fail? */ 234 if (_failcnt) 235 return CMD_WARNING; 236 #endif 237 #endif >>> CID 1474174: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "proto" to "no_ipv6_protocol_magic", which dereferences it. 238 return no_ipv6_protocol_magic(self, vty, argc, argv, proto, rmap); 239 } 240 241 /* show_ipv6_protocol => "show ipv6 protocol [vrf <NAME$vrf_name|all$vrf_all>]" */ 242 DEFUN_CMD_FUNC_DECL(show_ipv6_protocol) 243 #define funcdecl_show_ipv6_protocol static int show_ipv6_protocol_magic(\ ** CID 1474173: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1474173: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_routemap_clippy.c: 382 in no_ip_protocol_nht_rmap() 376 } 377 #if 0 /* anything that can fail? */ 378 if (_failcnt) 379 return CMD_WARNING; 380 #endif 381 #endif >>> CID 1474173: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "proto" to "no_ip_protocol_nht_rmap_magic", which dereferences it. 382 return no_ip_protocol_nht_rmap_magic(self, vty, argc, argv, proto, rmap); 383 } 384 385 /* show_ip_protocol_nht => "show ip nht route-map [vrf <NAME$vrf_name|all$vrf_all>]" */ 386 DEFUN_CMD_FUNC_DECL(show_ip_protocol_nht) 387 #define funcdecl_show_ip_protocol_nht static int show_ip_protocol_nht_magic(\ ** CID 1474172: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1474172: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_routemap_clippy.c: 190 in ipv6_protocol() 184 } 185 #if 0 /* anything that can fail? */ 186 if (_failcnt) 187 return CMD_WARNING; 188 #endif 189 #endif >>> CID 1474172: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "proto" to "ipv6_protocol_magic", which dereferences it. 190 return ipv6_protocol_magic(self, vty, argc, argv, proto, rmap); 191 } 192 193 /* no_ipv6_protocol => "no ipv6 protocol RR_IP6_PROTOCOL_MAP_STR_ZEBR $proto [route-map ROUTE-MAP$rmap]" */ 194 DEFUN_CMD_FUNC_DECL(no_ipv6_protocol) 195 #define funcdecl_no_ipv6_protocol static int no_ipv6_protocol_magic(\ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 12 Oct '18

12 Oct '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1474171: Incorrect expression (USELESS_CALL) ________________________________________________________________________________________________________ *** CID 1474171: Incorrect expression (USELESS_CALL) /bgpd/bgp_mpath.c: 613 in bgp_path_info_mpath_update() 607 assert(new_mpath); 608 assert(prev_mpath); 609 if ((mpath_count < maxpaths) && (new_mpath != new_best) 610 && bgp_path_info_nexthop_cmp(prev_mpath, 611 new_mpath)) { 612 if (new_mpath == next_mpath) >>> CID 1474171: Incorrect expression (USELESS_CALL) >>> Calling "bgp_path_info_mpath_next(new_mpath)" is only useful for its return value, which is ignored. 613 bgp_path_info_mpath_next(new_mpath); 614 bgp_path_info_mpath_dequeue(new_mpath); 615 616 bgp_path_info_mpath_enqueue(prev_mpath, 617 new_mpath); 618 prev_mpath = new_mpath; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Meeting Friday to discuss/review Northbound code
by Donald Sharp 10 Oct '18

10 Oct '18

All - This friday we will be having a meeting to discuss Renato's northbound code. It will be held at 11 am EDT. If you are interested in attending please let me know and I'll forward the usual bluejeans meeting id to you. thanks! donald

1 0

BFDD file not present in FRR
by Mayank Tiwari 09 Oct '18

09 Oct '18

Hi, I am using stable/5.0 branch of FRR. Also, I am referring to http://docs.frrouting.org/en/latest/bfd.html#starting-bfd link for BFD configuration. The instruction asks to start bfd from '/usr/lib/frr/bfdd' location but I am not able to find /usr/lib/frr/bfdd file in that location. However, in the code base I can see bfd related files: root@frr-ppod4-0:/frr/lib# ls -lrt bfd.* -rw-rw-r-- 1 root root 10987 Aug 22 21:41 bfd.c -rw-rw-r-- 1 root root 3399 Aug 22 21:55 bfd.h -rw-r--r-- 1 root root 81184 Aug 22 22:00 bfd.o -rw-r--r-- 1 root root 282 Aug 22 22:00 bfd.lo Can you please suggest on what I am missing here due to which bfdd file is not getting generated? Thanks and Regards, Mayank

3 4

CLI fuzzer
by Renato Westphal 08 Oct '18

08 Oct '18

Hi all, Just would like to share a small tool I wrote to test FRR. It's a CLI fuzzer, a program that tests all existing CLI commands over and over again and detects segfaults when they happen. Link: https://github.com/rwestphal/frr-cli-fuzzer The README.me contains installation and usage instructions. The CLI fuzzer is only capable of finding simple bugs, like NULL pointer dereferences, but it's useful as an additional testing tool in our toolbox. I left the CLI fuzzer running overnight and it found these segfaults in FRR: https://hastebin.com/qiyunedeja.txt Lots of the detected bugs refer to different variations of the same command (e.g. bgpd's "no neighbor [...] maximum-prefix"). Some bugs, like the ones found in nhrpd and isisd, only happen seconds after sending the commands that triggered them. When this happens, the command reported by the CLI fuzzer has no correspondence to the actual command that triggered the segfault. In these cases, it's necessary to look at the generated core dumps to understand why the daemon aborted. In the case of the nhrpd segfaults, for example, they all refer to the same problem (a dangling pointer in the nhrp_peer_check() function). I think the CLI fuzzer should be especially useful for everyone working on the northbound retrofitting process. Since all configuration commands will be modified, there's always the possibility of introducing bugs in the process. The CLI fuzzer should help us to catch some of these bugs early during development. Later on we should also be able to write a YANG-based configuration fuzzer, which would generate random configurations and feed them to FRR using configuration replace semantics. That would allow us to test FRR more extensively and find other kinds of problems. Regards, -- Renato Westphal

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 06 Oct '18

06 Oct '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1473939: Security best practices violations (DC.WEAK_CRYPTO) /watchfrr/watchfrr.c: 983 in watchfrr_init() ________________________________________________________________________________________________________ *** CID 1473939: Security best practices violations (DC.WEAK_CRYPTO) /watchfrr/watchfrr.c: 983 in watchfrr_init() 977 dmn->name = dmn->restart.name = argv[i]; 978 dmn->state = DAEMON_INIT; 979 gs.numdaemons++; 980 gs.numdown++; 981 dmn->fd = -1; 982 dmn->t_wakeup = NULL; >>> CID 1473939: Security best practices violations (DC.WEAK_CRYPTO) >>> "random" should not be used for security related applications, as linear congruential algorithms are too easy to break. 983 thread_add_timer_msec(master, wakeup_init, dmn, 984 100 + (random() % 900), 985 &dmn->t_wakeup); 986 dmn->restart.interval = gs.min_restart_interval; 987 *add = dmn; 988 add = &dmn->next; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Slack Invite and BFD questions
by Trae E Santiago 06 Oct '18

06 Oct '18

2 1

Any FreeBSD 9.x users still out there? Thinking about stopping support for it...
by Martin Winter 04 Oct '18

04 Oct '18

We seem to have issues getting libyang on FreeBSD 9.x working FreeBSD 9.x is EOL since End of December 2016 So here is a last call: —> If you are using FreeBSD 9.x with FRR, then please speak up. Otherwise FRR 6.0 might be the last version of FRR for it. Regards, Martin Winter (FreeBSD 10.x and 11.x are not affected - ONLY FreeBSD 9.x) Sidenote: CentOS 6 issue as mentioned before was resolved and we can continue to support it (for now). But it is one of the challenging OLD OLD platforms, so we have no idea on how much longer we can support it.

1 0

Any CentOS/RedHat 6 FRR users out there?
by Martin Winter 02 Oct '18

02 Oct '18

I’m trying to see how common the (old) CentOS 6 / RedHat 6 is as it becomes increasingly difficult to support. If you or anyone you know still uses CentOS 6 or RedHat 6 with FRR, then please speak up. Regards, Martin Winter PS: CentOS / RedHat 7 is not affected - Just version 6.x

6 10

Yearly TSC voting coming up
by Donald Sharp 01 Oct '18

01 Oct '18

All - It's that time of year again and we are fast approaching October which means it's time to vote for the TSC again. As per usual, I have asked Alistair to run the election. If you are interested in serving or nominating someone for the TSC now is the time to speak up! donald

4 3