- dev - lists.frrouting.org

CLI fuzzer
by Renato Westphal 08 Oct '18

08 Oct '18

Hi all, Just would like to share a small tool I wrote to test FRR. It's a CLI fuzzer, a program that tests all existing CLI commands over and over again and detects segfaults when they happen. Link: https://github.com/rwestphal/frr-cli-fuzzer The README.me contains installation and usage instructions. The CLI fuzzer is only capable of finding simple bugs, like NULL pointer dereferences, but it's useful as an additional testing tool in our toolbox. I left the CLI fuzzer running overnight and it found these segfaults in FRR: https://hastebin.com/qiyunedeja.txt Lots of the detected bugs refer to different variations of the same command (e.g. bgpd's "no neighbor [...] maximum-prefix"). Some bugs, like the ones found in nhrpd and isisd, only happen seconds after sending the commands that triggered them. When this happens, the command reported by the CLI fuzzer has no correspondence to the actual command that triggered the segfault. In these cases, it's necessary to look at the generated core dumps to understand why the daemon aborted. In the case of the nhrpd segfaults, for example, they all refer to the same problem (a dangling pointer in the nhrp_peer_check() function). I think the CLI fuzzer should be especially useful for everyone working on the northbound retrofitting process. Since all configuration commands will be modified, there's always the possibility of introducing bugs in the process. The CLI fuzzer should help us to catch some of these bugs early during development. Later on we should also be able to write a YANG-based configuration fuzzer, which would generate random configurations and feed them to FRR using configuration replace semantics. That would allow us to test FRR more extensively and find other kinds of problems. Regards, -- Renato Westphal

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 06 Oct '18

06 Oct '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1473939: Security best practices violations (DC.WEAK_CRYPTO) /watchfrr/watchfrr.c: 983 in watchfrr_init() ________________________________________________________________________________________________________ *** CID 1473939: Security best practices violations (DC.WEAK_CRYPTO) /watchfrr/watchfrr.c: 983 in watchfrr_init() 977 dmn->name = dmn->restart.name = argv[i]; 978 dmn->state = DAEMON_INIT; 979 gs.numdaemons++; 980 gs.numdown++; 981 dmn->fd = -1; 982 dmn->t_wakeup = NULL; >>> CID 1473939: Security best practices violations (DC.WEAK_CRYPTO) >>> "random" should not be used for security related applications, as linear congruential algorithms are too easy to break. 983 thread_add_timer_msec(master, wakeup_init, dmn, 984 100 + (random() % 900), 985 &dmn->t_wakeup); 986 dmn->restart.interval = gs.min_restart_interval; 987 *add = dmn; 988 add = &dmn->next; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Slack Invite and BFD questions
by Trae E Santiago 05 Oct '18

05 Oct '18

2 1

Any FreeBSD 9.x users still out there? Thinking about stopping support for it...
by Martin Winter 03 Oct '18

03 Oct '18

We seem to have issues getting libyang on FreeBSD 9.x working FreeBSD 9.x is EOL since End of December 2016 So here is a last call: —> If you are using FreeBSD 9.x with FRR, then please speak up. Otherwise FRR 6.0 might be the last version of FRR for it. Regards, Martin Winter (FreeBSD 10.x and 11.x are not affected - ONLY FreeBSD 9.x) Sidenote: CentOS 6 issue as mentioned before was resolved and we can continue to support it (for now). But it is one of the challenging OLD OLD platforms, so we have no idea on how much longer we can support it.

1 0

Any CentOS/RedHat 6 FRR users out there?
by Martin Winter 02 Oct '18

02 Oct '18

I’m trying to see how common the (old) CentOS 6 / RedHat 6 is as it becomes increasingly difficult to support. If you or anyone you know still uses CentOS 6 or RedHat 6 with FRR, then please speak up. Regards, Martin Winter PS: CentOS / RedHat 7 is not affected - Just version 6.x

6 10

Yearly TSC voting coming up
by Donald Sharp 01 Oct '18

01 Oct '18

All - It's that time of year again and we are fast approaching October which means it's time to vote for the TSC again. As per usual, I have asked Alistair to run the election. If you are interested in serving or nominating someone for the TSC now is the time to speak up! donald

4 3

Trying meet.jit.si for FRR weekly meeting next week
by David Lamparter 26 Sep '18

26 Sep '18

Hi all, I've spent a little time looking at fully open-source videoconferencing services and it turns out jit.si is the most (actually: only) usable one. I'd like to try moving next week's meeting from BlueJeans to meet.jit.si (which is the free service they provide by just running their open source package somewhere.) The URL for the meeting will be: https://meet.jit.si/frr-weekly No registration or anything is required. There are Android and iOS apps, so if you use one of these devices please download the app. Other than that, maybe just try loading the URL above and see if it works :) The primary rationale for the change is that jit.si is fully open source which IMHO merits at least a try to see how FOSS is doing in the videoconferencing field. If we run into problems, we can just fall back to BlueJeans as usual. Cheers, David P.S.: the one major downside is that with the meet.jit.si service, we won't have a moderator for the room. Please make sure you're not sending noise into the conference and always mute your microphone when not speaking.

2 2

Reg. Frr-www gpg passphrase
by Roshan Nair 25 Sep '18

25 Sep '18

Hi, I am not sure if it's the right forum to ask queries on frr web server. If not, pls ignore. Apologies! While following steps in readme for source installation of frr web the following command asks for "pass phrase". Can some one provide pointers to what the pass phrase for the file is? Command: *Sudo gpg frrouting.ssl.tar.gpg*

3 2

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 23 Sep '18

23 Sep '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1473593: Control flow issues (DEADCODE) /zebra/rt_netlink.c: 2239 in netlink_macfdb_update() ________________________________________________________________________________________________________ *** CID 1473593: Control flow issues (DEADCODE) /zebra/rt_netlink.c: 2239 in netlink_macfdb_update() 2233 vid_present = 1; 2234 sprintf(vid_buf, " VLAN %u", vid); 2235 } 2236 addattr32(&req.n, sizeof(req), NDA_MASTER, br_if->ifindex); 2237 2238 if (IS_ZEBRA_DEBUG_KERNEL) >>> CID 1473593: Control flow issues (DEADCODE) >>> Execution cannot reach the expression """" inside this statement: "zlog_debug("Tx %s family %s...". 2239 zlog_debug("Tx %s family %s IF %s(%u)%s %sMAC %s%s", 2240 nl_msg_type_to_str(cmd), 2241 nl_family_to_str(req.ndm.ndm_family), ifp->name, 2242 ifp->ifindex, vid_present ? vid_buf : "", 2243 sticky ? "sticky " : "", 2244 prefix_mac2str(mac, buf, sizeof(buf)), ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 21 Sep '18

21 Sep '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1473285: Null pointer dereferences (FORWARD_NULL) /isisd/isis_lsp.c: 1909 in lsp_tick() ________________________________________________________________________________________________________ *** CID 1473285: Null pointer dereferences (FORWARD_NULL) /isisd/isis_lsp.c: 1909 in lsp_tick() 1903 lsp = NULL; 1904 dict_delete_free(area->lspdb[level], 1905 dnode); 1906 } 1907 1908 if (fabricd_init_c) { >>> CID 1473285: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "lsp". 1909 fabricd_sync_incomplete |= 1910 ISIS_CHECK_FLAG(lsp->SSNflags, 1911 fabricd_init_c); 1912 } 1913 } 1914 } ** CID 1399484: Null pointer dereferences (NULL_RETURNS) /tools/permutations.c: 43 in main() ________________________________________________________________________________________________________ *** CID 1399484: Null pointer dereferences (NULL_RETURNS) /tools/permutations.c: 43 in main() 37 { 38 if (argc < 2) { 39 fprintf(stdout, USAGE "\n"); 40 exit(EXIT_SUCCESS); 41 } 42 struct cmd_element *cmd = calloc(1, sizeof(struct cmd_element)); >>> CID 1399484: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a null pointer "cmd". 43 cmd->string = strdup(argv[1]); 44 45 struct graph *graph = graph_new(); 46 struct cmd_token *token = 47 cmd_token_new(START_TKN, cmd->attr, NULL, NULL); 48 graph_new_node(graph, token, NULL); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0