- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 20 Jun '18

20 Jun '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1470113: (TAINTED_SCALAR) /zebra/zebra_netns_notify.c: 215 in zebra_ns_notify_read() /zebra/zebra_netns_notify.c: 219 in zebra_ns_notify_read() /zebra/zebra_netns_notify.c: 215 in zebra_ns_notify_read() /zebra/zebra_netns_notify.c: 219 in zebra_ns_notify_read() /zebra/zebra_netns_notify.c: 215 in zebra_ns_notify_read() /zebra/zebra_netns_notify.c: 219 in zebra_ns_notify_read() /zebra/zebra_netns_notify.c: 215 in zebra_ns_notify_read() /zebra/zebra_netns_notify.c: 219 in zebra_ns_notify_read() ________________________________________________________________________________________________________ *** CID 1470113: (TAINTED_SCALAR) /zebra/zebra_netns_notify.c: 215 in zebra_ns_notify_read() 209 struct zebra_netns_info *netnsinfo; 210 211 if (!(event->mask & (IN_CREATE | IN_DELETE))) 212 continue; 213 if (event->mask & IN_DELETE) 214 return zebra_ns_delete(event->name); >>> CID 1470113: (TAINTED_SCALAR) >>> Using tainted variable "event->len" as an index into an array "event->name". 215 if (&event->name[event->len] >= &buf[sizeof(buf)]) { 216 zlog_err("NS notify read: buffer underflow"); 217 break; 218 } 219 event->name[event->len] = 0; 220 netnspath = ns_netns_pathname(NULL, event->name); /zebra/zebra_netns_notify.c: 219 in zebra_ns_notify_read() 213 if (event->mask & IN_DELETE) 214 return zebra_ns_delete(event->name); 215 if (&event->name[event->len] >= &buf[sizeof(buf)]) { 216 zlog_err("NS notify read: buffer underflow"); 217 break; 218 } >>> CID 1470113: (TAINTED_SCALAR) >>> Using tainted variable "event->len" as an index into an array "event->name". 219 event->name[event->len] = 0; 220 netnspath = ns_netns_pathname(NULL, event->name); 221 if (!netnspath) 222 continue; 223 netnspath = XSTRDUP(MTYPE_NETNS_MISC, netnspath); 224 netnsinfo = XCALLOC(MTYPE_NETNS_MISC, /zebra/zebra_netns_notify.c: 215 in zebra_ns_notify_read() 209 struct zebra_netns_info *netnsinfo; 210 211 if (!(event->mask & (IN_CREATE | IN_DELETE))) 212 continue; 213 if (event->mask & IN_DELETE) 214 return zebra_ns_delete(event->name); >>> CID 1470113: (TAINTED_SCALAR) >>> Using tainted variable "event->len" as an index into an array "event->name". 215 if (&event->name[event->len] >= &buf[sizeof(buf)]) { 216 zlog_err("NS notify read: buffer underflow"); 217 break; 218 } 219 event->name[event->len] = 0; 220 netnspath = ns_netns_pathname(NULL, event->name); /zebra/zebra_netns_notify.c: 219 in zebra_ns_notify_read() 213 if (event->mask & IN_DELETE) 214 return zebra_ns_delete(event->name); 215 if (&event->name[event->len] >= &buf[sizeof(buf)]) { 216 zlog_err("NS notify read: buffer underflow"); 217 break; 218 } >>> CID 1470113: (TAINTED_SCALAR) >>> Using tainted variable "event->len" as an index into an array "event->name". 219 event->name[event->len] = 0; 220 netnspath = ns_netns_pathname(NULL, event->name); 221 if (!netnspath) 222 continue; 223 netnspath = XSTRDUP(MTYPE_NETNS_MISC, netnspath); 224 netnsinfo = XCALLOC(MTYPE_NETNS_MISC, /zebra/zebra_netns_notify.c: 215 in zebra_ns_notify_read() 209 struct zebra_netns_info *netnsinfo; 210 211 if (!(event->mask & (IN_CREATE | IN_DELETE))) 212 continue; 213 if (event->mask & IN_DELETE) 214 return zebra_ns_delete(event->name); >>> CID 1470113: (TAINTED_SCALAR) >>> Using tainted variable "event->len" as an index into an array "event->name". 215 if (&event->name[event->len] >= &buf[sizeof(buf)]) { 216 zlog_err("NS notify read: buffer underflow"); 217 break; 218 } 219 event->name[event->len] = 0; 220 netnspath = ns_netns_pathname(NULL, event->name); /zebra/zebra_netns_notify.c: 219 in zebra_ns_notify_read() 213 if (event->mask & IN_DELETE) 214 return zebra_ns_delete(event->name); 215 if (&event->name[event->len] >= &buf[sizeof(buf)]) { 216 zlog_err("NS notify read: buffer underflow"); 217 break; 218 } >>> CID 1470113: (TAINTED_SCALAR) >>> Using tainted variable "event->len" as an index into an array "event->name". 219 event->name[event->len] = 0; 220 netnspath = ns_netns_pathname(NULL, event->name); 221 if (!netnspath) 222 continue; 223 netnspath = XSTRDUP(MTYPE_NETNS_MISC, netnspath); 224 netnsinfo = XCALLOC(MTYPE_NETNS_MISC, /zebra/zebra_netns_notify.c: 215 in zebra_ns_notify_read() 209 struct zebra_netns_info *netnsinfo; 210 211 if (!(event->mask & (IN_CREATE | IN_DELETE))) 212 continue; 213 if (event->mask & IN_DELETE) 214 return zebra_ns_delete(event->name); >>> CID 1470113: (TAINTED_SCALAR) >>> Using tainted variable "event->len" as an index into an array "event->name". 215 if (&event->name[event->len] >= &buf[sizeof(buf)]) { 216 zlog_err("NS notify read: buffer underflow"); 217 break; 218 } 219 event->name[event->len] = 0; 220 netnspath = ns_netns_pathname(NULL, event->name); /zebra/zebra_netns_notify.c: 219 in zebra_ns_notify_read() 213 if (event->mask & IN_DELETE) 214 return zebra_ns_delete(event->name); 215 if (&event->name[event->len] >= &buf[sizeof(buf)]) { 216 zlog_err("NS notify read: buffer underflow"); 217 break; 218 } >>> CID 1470113: (TAINTED_SCALAR) >>> Using tainted variable "event->len" as an index into an array "event->name". 219 event->name[event->len] = 0; 220 netnspath = ns_netns_pathname(NULL, event->name); 221 if (!netnspath) 222 continue; 223 netnspath = XSTRDUP(MTYPE_NETNS_MISC, netnspath); 224 netnsinfo = XCALLOC(MTYPE_NETNS_MISC, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Adding SQLite as a new optional dependency
by Renato Westphal 20 Jun '18

20 Jun '18

Hi all, As part of the work in the new northbound architecture, I implemented support for configuration rollbacks in FRR. Here's a short demo: https://gist.github.com/rwestphal/caedd9f3e4888cab2d631cc21967e93d To make this work, FRR needs to keep track of all committed configuration transactions in non-volatile memory (so they persist across reboots). One possibility to implement this would be to store the transactions using text files in the filesystem. The problem with this approach is that it would be necessary to write a lot of code to do things correctly, handling all possible errors (lots of things can go wrong). Using SQLite we have database transactions, which make things much easier (either all operations succeed or none do). SQLite in general provides a much better interface to store and retrieve transactions, not to mention its high-performance properties. I consider it to be the right tool for the job. But if anyone has an objection against using SQLite in FRR please speak up. Initially SQLite should be added as an optional dependency tied to the --enable-config-rollbacks configuration option. This way users not interested on configuration rollbacks won't need to install the new dependency. We might revisit this in the future if we find other use cases for SQLite in FRR. When FRR is built with --enable-config-rollbacks, all daemons will have a new option to specify the path of the daemon-specific database file: --db-file (the default is ${localstatedir}/<daemon-name>.db). The special :memory: filename can be used to open a new in-memory database (which doesn't persist across reboots or daemon restarts). I should say that configuration rollbacks will only work for daemons converted to the new northbound model. Speaking of which, the Northbound API is almost ready to be submitted as a PR. I'm finishing to polish the code and writing documentation, my estimation is that everything should be ready within the following two weeks. Regards, -- Renato Westphal

7 8

[19/06/2018] FRR Technical Meeting Notes
by Quentin Young 19 Jun '18

19 Jun '18

FRR Technical Meeting Notes - 06/19/2018 ========================================= Misc Issues ----------- - Chat software - We want to move off Slack due to message history loss, proprietary platform, etc. - Options considered thus far are Rocket.chat and MatterMost - Some discussion on importance of VOIP call support - Beyond VOIP they seem largely equivalent - Quentin to evaluate Matrix / Riot and report back - Aiming to have a decision within next 2 weeks - Maintainers - It's been roughly a year since the maintainers list was updated - Nominate yourself or others to become maintainers on the dev mailing list over the next couple weeks - Moving EVPN commands out of #ifdef ENABLE_CUMULUS - EVPN requires --enable-cumulus at present - This requires people to build FRR themselves if they want EVPN support - Many people have asked that EVPN be enabled without this flag - General agreement: this is a good idea - lberger: Need to evaluate collateral damage on affected other commands - sharpd: Will list out the affected commands for individual evaluation by all parties (see dev alias email) Github Issues & PR’s ——————————— See updates in the issues and PRs

2 1

evpn commands under --enable-cumulus
by Donald Sharp 19 Jun '18

19 Jun '18

As discussed in today's technical meeting: address-family l2vpn evpn (BGP_EVPN_NODE) [no] advertise-default-gw [no] advertise-all-vni [no] autort rfc8365-compatible [no] default-originate <ipv4|ipv6> [no] advertise AFI SAFI [route-map WORD] [no] rd ASN:NN_OR_IP-ADDRESS:NN [no] route-target <both|import|export> RT advertise es ESI withdraw es ESI [no] vni (1-1677721) (BGP_EVPN_VNI_NODE) [no] advertise-default-gw [no] advertise-subnet (This is hidden) [no] rd ASN:NN_OR_IP-ADDRESS:NN [no] route-target <both|import|export> RT exit-vni show bgp l2vpn evpn vni [(1-16777215)] [json] show bgp l2vpn evpn es [ESI] [json] show bgp [vrf VRFNAME] l2vpn evpn summary [json] show bgp l2vpn evpn route [type <macip|multicast|es|prefix>] [json] show bgp l2vpn evpn route rd ASN:NN_OR_IP-ADDRESS:NN [type <macip|multicast|es|prefix>] [json] show bgp l2vpn evpn route rd ASN:NN_OR_IP-ADDRESS:NN mac WORD [ip WORD] [json] show bgp l2vpn evpn route esi ESI [json] show bgp l2vpn evpn route vni (1-16777215) [<type <macip|multicast> | vtep A.B.C.D>] [json] show bgp l2vpn evpn route vni (1-16777215) mac WORD [ip WORD] [json] show bgp l2vpn evpn route vni (1-16777215) multicast A.B.C.D [json] show bgp l2vpn evpn route vni all [vtep A.B.C.D] [json] show bgp l2vpn evpn vrf-import-rt [json] show bgp l2vpn evpn import-rt [json] show bgp vrf VRFNAME vni [json] Hidden Show commands( To provide backwards compatability for anyone who may have used these ) show bgp evpn vni [(1-16777215)] show bgp evpn summary [json] show bgp evpn route [type <macip|multicast>] show bgp evpn route rd ASN:NN_OR_IP-ADDRESS:NN [type <macip|multicast>] show bgp evpn route rd ASN:NN_OR_IP-ADDRESS:NN mac WORD [ip WORD] show bgp evpn route vni (1-16777215) [<type <macip|multicast> | vtep A.B.C.D>] show bgp evpn route vni (1-16777215) mac WORD [ip WORD] show bgp evpn route vni (1-16777215) multicast A.B.C.D show bgp evpn route vni all [vtep A.B.C.D] show bgp evpn import-rt

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 19 Jun '18

19 Jun '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1470098: Control flow issues (DEADCODE) /bgpd/bgp_vpn.c: 232 in show_adj_route_vpn() ________________________________________________________________________________________________________ *** CID 1470098: Control flow issues (DEADCODE) /bgpd/bgp_vpn.c: 232 in show_adj_route_vpn() 226 route_vty_out_tmp(vty, &rm->p, attr, 227 SAFI_MPLS_VPN, 228 use_json, json_array); 229 } 230 } 231 if (use_json && rm) { >>> CID 1470098: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "char buf_a[8192];". 232 char buf_a[BUFSIZ]; 233 char buf_b[BUFSIZ]; 234 sprintf(buf_a, "%s/%d", 235 inet_ntop(rm->p.family, rm->p.u.val, 236 buf_b, BUFSIZ), 237 rm->p.prefixlen); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Invite to Slack channel?
by JP Senior 12 Jun '18

12 Jun '18

Hello, there! I wonder if I or our domain @apstra.com can get an invite or whitelist to the FRRouting slack channel? We've got a lot of cool stuff to talk about with regards to EVPN and EVPN inter-operability. -- JP Senior | Apstra, Inc c: +1.403.970.4965 e: jp(a)apstra.com www.apstra.com | Vendor-Agnostic Data Center Network Automation

7 9

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 11 Jun '18

11 Jun '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 6 of 6 defect(s) ** CID 1469898: Uninitialized variables (UNINIT) ________________________________________________________________________________________________________ *** CID 1469898: Uninitialized variables (UNINIT) /lib/command.c: 270 in argv_concat() 264 int cnt = argc - shift; 265 const char *argstr[cnt]; 266 267 for (int i = 0; i < cnt; i++) 268 argstr[i] = argv[i + shift]->arg; 269 >>> CID 1469898: Uninitialized variables (UNINIT) >>> Using uninitialized element of array "argstr" when calling "frrstr_join". 270 return frrstr_join(argstr, cnt, " "); 271 } 272 273 vector cmd_make_strvec(const char *string) 274 { 275 if (!string) ** CID 1469897: Memory - corruptions (OVERRUN) /bgpd/bgp_route.c: 6978 in route_vty_out_tag() ________________________________________________________________________________________________________ *** CID 1469897: Memory - corruptions (OVERRUN) /bgpd/bgp_route.c: 6978 in route_vty_out_tag() 6972 } else if (attr->mp_nexthop_len 6973 == BGP_ATTR_NHLEN_IPV6_GLOBAL_AND_LL) { 6974 if (json) { 6975 inet_ntop(AF_INET6, 6976 &attr->mp_nexthop_global, 6977 buf_a, BUFSIZ); >>> CID 1469897: Memory - corruptions (OVERRUN) >>> Overrunning array "buf_b" of 512 bytes by passing it to a function which accesses it at byte offset 8191 using argument "8192U". 6978 inet_ntop(AF_INET6, 6979 &attr->mp_nexthop_local, 6980 buf_b, BUFSIZ); 6981 sprintf(buf_c, "%s(%s)", buf_a, buf_b); 6982 json_object_string_add( 6983 json_out, ** CID 1469896: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1469896: Null pointer dereferences (FORWARD_NULL) /vtysh/vtysh.c: 556 in vtysh_execute_func() 550 551 if (vline == NULL && vty->is_paged) { 552 vty_close_pager(vty); 553 return CMD_SUCCESS; 554 } 555 >>> CID 1469896: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "vline" to "cmd_execute_command", which dereferences it. 556 ret = cmd_execute_command(vline, vty, &cmd, 1); 557 cmd_free_strvec(vline); 558 if (ret != CMD_SUCCESS_DAEMON) 559 break; 560 } else if (cmd->func) { 561 (*cmd->func)(cmd, vty, 0, NULL); ** CID 1469895: Null pointer dereferences (FORWARD_NULL) /lib/vty.c: 129 in vty_set_include() ________________________________________________________________________________________________________ *** CID 1469895: Null pointer dereferences (FORWARD_NULL) /lib/vty.c: 129 in vty_set_include() 123 if (!regexp && vty->filter) { 124 regfree(&vty->include); 125 vty->filter = false; 126 return true; 127 } 128 >>> CID 1469895: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "regexp" to "regcomp", which dereferences it. 129 errcode = regcomp(&vty->include, regexp, 130 REG_EXTENDED | REG_NEWLINE | REG_NOSUB); 131 if (errcode) { 132 ret = false; 133 regerror(ret, &vty->include, errbuf, sizeof(errbuf)); 134 vty_out(vty, "%% Regex compilation error: %s", errbuf); ** CID 1469894: Null pointer dereferences (NULL_RETURNS) /lib/command.c: 1216 in handle_pipe_action() ________________________________________________________________________________________________________ *** CID 1469894: Null pointer dereferences (NULL_RETURNS) /lib/command.c: 1216 in handle_pipe_action() 1210 1211 if (!succ) { 1212 vty_out(vty, "%% Bad regexp '%s'\n", regexp); 1213 goto fail; 1214 } 1215 *cmd_out = XSTRDUP(MTYPE_TMP, cmd_in); >>> CID 1469894: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a null pointer "strstr(*cmd_out, "|")". 1216 *(strstr(*cmd_out, "|")) = '\0'; 1217 } else { 1218 vty_out(vty, "%% Unknown action '%s'\n", token); 1219 goto fail; 1220 } 1221 ** CID 1469893: Memory - corruptions (OVERRUN) /bgpd/bgp_route.c: 6975 in route_vty_out_tag() ________________________________________________________________________________________________________ *** CID 1469893: Memory - corruptions (OVERRUN) /bgpd/bgp_route.c: 6975 in route_vty_out_tag() 6969 AF_INET6, 6970 &attr->mp_nexthop_global, 6971 buf_a, BUFSIZ)); 6972 } else if (attr->mp_nexthop_len 6973 == BGP_ATTR_NHLEN_IPV6_GLOBAL_AND_LL) { 6974 if (json) { >>> CID 1469893: Memory - corruptions (OVERRUN) >>> Overrunning array "buf_a" of 512 bytes by passing it to a function which accesses it at byte offset 8191 using argument "8192U". 6975 inet_ntop(AF_INET6, 6976 &attr->mp_nexthop_global, 6977 buf_a, BUFSIZ); 6978 inet_ntop(AF_INET6, 6979 &attr->mp_nexthop_local, 6980 buf_b, BUFSIZ); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Slack invite
by Paco Aragon 30 May '18

30 May '18

Hi, I'm starting using the topotests for adding a test, and I would like to get a Slack invite for paco(a)voltanet.io , if possible (I saw invitation requests in the list, so I'm doing the same, please excuse the inconvenience) Thank you in advance :-) Paco

2 1

slack channel invite
by Yuriy Andamasov 29 May '18

29 May '18

Hello! Can we have invites to slack channel for yuriy(a)sentrium.io daniil(a)sentrium.io Thanks!

2 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 29 May '18

29 May '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1469463: Incorrect expression (CONSTANT_EXPRESSION_RESULT) /bgpd/bgp_pbr.c: 243 in bgp_pbr_validate_policy_route() ________________________________________________________________________________________________________ *** CID 1469463: Incorrect expression (CONSTANT_EXPRESSION_RESULT) /bgpd/bgp_pbr.c: 243 in bgp_pbr_validate_policy_route() 237 * for now, only match/set supported is 238 * - combination src/dst => redirect nexthop [ + rate] 239 * - combination src/dst => redirect VRF [ + rate] 240 * - combination src/dst => drop 241 * - combination srcport + @IP 242 */ >>> CID 1469463: Incorrect expression (CONSTANT_EXPRESSION_RESULT) >>> The expression "api->match_icmp_type_num || api->match_icmp_type_num" does not accomplish anything because it evaluates to either of its identical operands, "api->match_icmp_type_num". 243 if (api->match_icmp_type_num || api->match_icmp_type_num 244 || api->match_packet_length_num || api->match_dscp_num 245 || api->match_tcpflags_num) { 246 if (BGP_DEBUG(pbr, PBR)) { 247 bgp_pbr_print_policy_route(api); 248 zlog_debug("BGP: some SET actions not supported by Zebra. ignoring."); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0