- dev - lists.frrouting.org

Technical Meeting Notes
by Donald Sharp 21 Mar '18

21 Mar '18

Technical meeting notes - 3/20/18 Donald, Emmanuel, Paul Z, Rafael, Quentin, Mark Stapp, Philippe, Martin, Christian, Daniel, Alistair, Jafar, Don New Issues: 1879 - Quentin looking at it - in progress 1887 - static route refactoring - Donald submitted to treat static routes as just another route type 1892 - frr install on ubuntu (particular version) crash - Martin taking it but next week for the work 1895 - Quentin has open pull request for this one 1899 - zebra socket problem (not reading all data). need to improve read data handling Possible known issue with loopback devices? Suggested by Renato? Asked Renato to respond. 1906 - request for feature - ospfv3 authentication trailer - added to feature request list 1907 - FRR not running on FreeBSD (ns init failure) - Martin Assigned to Philippe 1910 - ospfv3 lsa fragment - fixed by Chirag - waiting for response from submitter that fixed for them 1917 - show advertised in bgp with peer group fails after a while Need details on reproducing - fixed in 4.0 (according to submitter) fixed in master? Would like it fixed in 3.0 (if we can identify what fixed it) - git bisect Asked submitter for recreate steps and if receiver still has the routes 1923 - licenses on ldpd and babeld - Martin responding - assigned to him Leave open for another few days and then close if no response 1926 - interface netns not removed from zebra - Philippe - assigned to him as well Working on it and will discuss with Renato 1930 - Centos 7 chroot build failing - Martin fixed in master and will put also in 4.0 assigned to Martin 1934 - document api/abi versioning scheme - Quentin need a way for coders to know the api exposed by a version number Assigned to Quentin older - 1850 - Paul looking at changes made by Donald - didn't fix problem reported by Paul. Still in progress PRs: 1817 - flowspec client - Philippe Donald will look at it and asked others on reviewer list to review. Static analysis also had warning which Philippe will look at 1824 - table manager for zebra - Philippe Failure in CI system - asking Lou to take a look at the CI failures 1825 - Fron Chirag - ospfv3 intra prefix lsa after restart Jafar looking at it 1853 - bfd changes - Rafael Fixing warnings - getting closer 1854 - C99 fixed with integer types - Quentin Asking Lou to look at response to changes requested 1871 - zebra pbr rule added to fwmark tag Philippe asked questions about the approach Donald took Donald said need encode function in lib/zclient.c Unclear the end discussion - as Donald 1881 - ospf SR SRGB limits - Olivier - new topo tests next week by Olivier 1882 - Community.md document that we don't dismiss comments on a review (Lou) No real disagreement but look at it when Lou is back 1883 - Community.md needs more documentation on the style requirements (Paul) Checkpatch is useful but do we care about everything it complains about? Quentin's response - Linux style guide source of truth but can be reiterated here Checkpatch is a strong suggestion with specific exceptions. 95% of the time, it's right. Paul tweaking the language a bit to reflect this discussion 1894 - vtysh needs -u to avoid using enable mode Quentin tested and doesn't quite work - needs to be fixed 1903 - PBR by Donald Philippe will look but needs more eyes Also needs to rebase, fix conflicts and resubmit Philippe has questions about future match criteria 1904 - Documentation cleanup - Quentin - Still in progress Martin will review when done 1905 - ipset table for zebra - Philippe - Renato reviewing 1913 - vpn-policy cli - Paul He believes he has addressed all of the comments in the PR If reviewers agree, ready to push Donald will re-review 1915 - evpn ipv6 external routing - Philippe reviewing - could use other eyes on it 1916 - evpn bug fixes - looking for reviewer 1921 - pim stuff - cleanup of how vrf info is used to be more efficient (rather than iterating) Jafar reviewing 1927 - zebra delete interface that disappeared - work in progress by Philippe 1928 - bgp flowspec get vrf from RT - Philippe Adding an API to get this information from the RT Paul or Lou volunteer? Paul will discuss with Philippe offline 1931 - pimd mtrace fixes - Donald looking at it 1933 - move community.md to developer/workflow.rst - Quentin - Jafar reviewing 1935 - document code style tools - Quentin - Lou? Not there to respond. Martin will ask him 1937 - bgp vpn vrf leak cli documentation - Quentin will merge it 1938 - bgpd - fix peer withdrawal and route leaking for vpns and vrfs - Paul reviewing 1939 - redhat tarball - waiting for CI to finish Martin has rpki packages building and needs someone to do testing on it if someone is willing

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 20 Mar '18

20 Mar '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 5 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 5 of 5 defect(s) ** CID 1465852: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1465852: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_vty_clippy.c: 356 in af_route_map_vpn_imexport() 350 } 351 #if 0 /* anything that can fail? */ 352 if (_failcnt) 353 return CMD_WARNING; 354 #endif 355 #endif >>> CID 1465852: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "direction_str" to "af_route_map_vpn_imexport_magic", which dereferences it. 356 return af_route_map_vpn_imexport_magic(self, vty, argc, argv, no, direction_str, rmap_str); 357 } 358 359 /* bgp_imexport_vpn => "[no] <import|export>$direction_str vpn" */ 360 DEFUN_CMD_FUNC_DECL(bgp_imexport_vpn) 361 #define funcdecl_bgp_imexport_vpn static int bgp_imexport_vpn_magic(\ ** CID 1465851: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1465851: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_vty_clippy.c: 404 in bgp_imexport_vpn() 398 } 399 #if 0 /* anything that can fail? */ 400 if (_failcnt) 401 return CMD_WARNING; 402 #endif 403 #endif >>> CID 1465851: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "direction_str" to "bgp_imexport_vpn_magic", which dereferences it. 404 return bgp_imexport_vpn_magic(self, vty, argc, argv, no, direction_str); 405 } 406 407 /* show_ip_bgp_instance_updgrps_adj_s => "show [ip]$ip bgp [<view|vrf> VIEWVRFNAME$vrf] [<ipv4|ipv6>$afi <unicast|multicast|vpn>$safi] update-groups [SUBGROUP-ID]$sgid <advertise-queue|advertised-routes|packet-queue>$rtq" */ 408 DEFUN_CMD_FUNC_DECL(show_ip_bgp_instance_updgrps_adj_s) 409 #define funcdecl_show_ip_bgp_instance_updgrps_adj_s static int show_ip_bgp_instance_updgrps_adj_s_magic(\ ** CID 1465850: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1465850: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_vty_clippy.c: 250 in af_nexthop_vpn_export() 244 } 245 #if 1 /* anything that can fail? */ 246 if (_failcnt) 247 return CMD_WARNING; 248 #endif 249 #endif >>> CID 1465850: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "nexthop_str" to "af_nexthop_vpn_export_magic", which dereferences it. 250 return af_nexthop_vpn_export_magic(self, vty, argc, argv, no, nexthop_str, nexthop_str_str); 251 } 252 253 /* af_rt_vpn_imexport => "[no] <rt|route-target> vpn <import|export|both>$direction_str RTLIST..." */ 254 DEFUN_CMD_FUNC_DECL(af_rt_vpn_imexport) 255 #define funcdecl_af_rt_vpn_imexport static int af_rt_vpn_imexport_magic(\ ** CID 1465849: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1465849: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_vty_clippy.c: 138 in af_rd_vpn_export() 132 } 133 #if 0 /* anything that can fail? */ 134 if (_failcnt) 135 return CMD_WARNING; 136 #endif 137 #endif >>> CID 1465849: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "rd_str" to "af_rd_vpn_export_magic", which dereferences it. 138 return af_rd_vpn_export_magic(self, vty, argc, argv, no, rd_str); 139 } 140 141 /* af_label_vpn_export => "[no] label vpn export (0-1048575)$label_val" */ 142 DEFUN_CMD_FUNC_DECL(af_label_vpn_export) 143 #define funcdecl_af_label_vpn_export static int af_label_vpn_export_magic(\ ** CID 1465848: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1465848: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_vty_clippy.c: 303 in af_rt_vpn_imexport() 297 } 298 #if 0 /* anything that can fail? */ 299 if (_failcnt) 300 return CMD_WARNING; 301 #endif 302 #endif >>> CID 1465848: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "direction_str" to "af_rt_vpn_imexport_magic", which dereferences it. 303 return af_rt_vpn_imexport_magic(self, vty, argc, argv, no, direction_str, rtlist); 304 } 305 306 /* af_route_map_vpn_imexport => "[no] route-map vpn <import|export>$direction_str RMAP$rmap_str" */ 307 DEFUN_CMD_FUNC_DECL(af_route_map_vpn_imexport) 308 #define funcdecl_af_route_map_vpn_imexport static int af_route_map_vpn_imexport_magic(\ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 19 Mar '18

19 Mar '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1465679: (RESOURCE_LEAK) /zebra/zebra_vty.c: 256 in zebra_static_route_holdem() /zebra/zebra_vty.c: 256 in zebra_static_route_holdem() ________________________________________________________________________________________________________ *** CID 1465679: (RESOURCE_LEAK) /zebra/zebra_vty.c: 256 in zebra_static_route_holdem() 250 } 251 252 /* 253 * If a person enters the same line again 254 * we need to silently accept it 255 */ >>> CID 1465679: (RESOURCE_LEAK) >>> Variable "shr" going out of scope leaks the storage it points to. 256 return CMD_SUCCESS; 257 } 258 259 listnode_add_sort(static_list, shr); 260 261 return CMD_SUCCESS; /zebra/zebra_vty.c: 256 in zebra_static_route_holdem() 250 } 251 252 /* 253 * If a person enters the same line again 254 * we need to silently accept it 255 */ >>> CID 1465679: (RESOURCE_LEAK) >>> Variable "shr" going out of scope leaks the storage it points to. 256 return CMD_SUCCESS; 257 } 258 259 listnode_add_sort(static_list, shr); 260 261 return CMD_SUCCESS; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 18 Mar '18

18 Mar '18

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 27 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 27 defect(s) ** CID 1465497: Control flow issues (DEADCODE) /zebra/zebra_netns_id.c: 253 in zebra_ns_id_get() ________________________________________________________________________________________________________ *** CID 1465497: Control flow issues (DEADCODE) /zebra/zebra_netns_id.c: 253 in zebra_ns_id_get() 247 break; 248 } 249 } 250 len = len - NETLINK_ALIGN(nlh->nlmsg_len); 251 nlh = (struct nlmsghdr *)((char *)nlh 252 + NETLINK_ALIGN(nlh->nlmsg_len)); >>> CID 1465497: Control flow issues (DEADCODE) >>> Execution cannot reach the expression "ret == 0" inside this statement: "do { if (nlh->nlmsg_type...". 253 } while (len != 0 && return_nsid != NS_UNKNOWN && ret == 0); 254 255 if (ret <= 0) { 256 if (errno != EEXIST && ret != 0) { 257 zlog_err( 258 "netlink( %u) recvfrom() error 2 when reading: %s", ** CID 1465496: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1465496: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_vty.c: 6969 in clear_bgp_instance_ipv6_safi_prefix() 6963 /* [<view|vrf> VIEWVRFNAME] */ 6964 char *vrfview = argv_find(argv, argc, "VIEWVRFNAME", &idx_word) ? 6965 argv[idx_word]->arg : NULL; 6966 6967 argv_find_and_parse_safi(argv, argc, &idx_safi, &safi); 6968 >>> CID 1465496: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "prefix" to "bgp_clear_prefix", which dereferences it. 6969 return bgp_clear_prefix( 6970 vty, vrfview, prefix, 6971 AFI_IP6, safi, NULL); 6972 } 6973 6974 DEFUN (show_bgp_views, ** CID 1465495: Memory - illegal accesses (OVERRUN) /zebra/zserv.c: 2617 in zserv_handle_commands() ________________________________________________________________________________________________________ *** CID 1465495: Memory - illegal accesses (OVERRUN) /zebra/zserv.c: 2617 in zserv_handle_commands() 2611 2612 static inline void zserv_handle_commands(struct zserv *client, 2613 struct zmsghdr *hdr, 2614 struct stream *msg, 2615 struct zebra_vrf *zvrf) 2616 { >>> CID 1465495: Memory - illegal accesses (OVERRUN) >>> Overrunning array "zserv_handlers" of 79 8-byte elements at element index 632 (byte offset 5056) using index "hdr->command" (which evaluates to 632). 2617 if (hdr->command > sizeof(zserv_handlers) 2618 || zserv_handlers[hdr->command] == NULL) 2619 zlog_info("Zebra received unknown command %d", hdr->command); 2620 else 2621 zserv_handlers[hdr->command](client, hdr, msg, zvrf); 2622 ** CID 1465494: (STRING_NULL) /zebra/zebra_netns_notify.c: 169 in zebra_ns_notify_read() /zebra/zebra_netns_notify.c: 169 in zebra_ns_notify_read() /zebra/zebra_netns_notify.c: 169 in zebra_ns_notify_read() ________________________________________________________________________________________________________ *** CID 1465494: (STRING_NULL) /zebra/zebra_netns_notify.c: 169 in zebra_ns_notify_read() 163 struct inotify_event *event; 164 char buf[BUFSIZ]; 165 ssize_t len; 166 167 zebra_netns_notify_current = thread_add_read( 168 zebrad.master, zebra_ns_notify_read, NULL, fd_monitor, NULL); >>> CID 1465494: (STRING_NULL) >>> Function "read" does not terminate string "*buf". 169 len = read(fd_monitor, buf, sizeof(buf)); 170 if (len < 0) { 171 zlog_warn("NS notify read: failed to read (%s)", 172 safe_strerror(errno)); 173 return 0; 174 } /zebra/zebra_netns_notify.c: 169 in zebra_ns_notify_read() 163 struct inotify_event *event; 164 char buf[BUFSIZ]; 165 ssize_t len; 166 167 zebra_netns_notify_current = thread_add_read( 168 zebrad.master, zebra_ns_notify_read, NULL, fd_monitor, NULL); >>> CID 1465494: (STRING_NULL) >>> Function "read" does not terminate string "*buf". 169 len = read(fd_monitor, buf, sizeof(buf)); 170 if (len < 0) { 171 zlog_warn("NS notify read: failed to read (%s)", 172 safe_strerror(errno)); 173 return 0; 174 } /zebra/zebra_netns_notify.c: 169 in zebra_ns_notify_read() 163 struct inotify_event *event; 164 char buf[BUFSIZ]; 165 ssize_t len; 166 167 zebra_netns_notify_current = thread_add_read( 168 zebrad.master, zebra_ns_notify_read, NULL, fd_monitor, NULL); >>> CID 1465494: (STRING_NULL) >>> Function "read" does not terminate string "*buf". 169 len = read(fd_monitor, buf, sizeof(buf)); 170 if (len < 0) { 171 zlog_warn("NS notify read: failed to read (%s)", 172 safe_strerror(errno)); 173 return 0; 174 } ** CID 1465493: Memory - illegal accesses (UNINIT) /pimd/pim_igmp_mtrace.c: 269 in mtrace_un_forward_packet() ________________________________________________________________________________________________________ *** CID 1465493: Memory - illegal accesses (UNINIT) /pimd/pim_igmp_mtrace.c: 269 in mtrace_un_forward_packet() 263 zlog_warn( 264 "Dropping mtrace packet, " 265 "no route to destination"); 266 return -1; 267 } 268 >>> CID 1465493: Memory - illegal accesses (UNINIT) >>> Using uninitialized value "nexthop.interface". 269 if_out = nexthop.interface; 270 } else { 271 if_out = interface; 272 } 273 274 ret = pim_socket_bind(fd, if_out); ** CID 1465492: Resource leaks (RESOURCE_LEAK) /zebra/zserv.c: 599 in zsend_redistribute_route() ________________________________________________________________________________________________________ *** CID 1465492: Resource leaks (RESOURCE_LEAK) /zebra/zserv.c: 599 in zsend_redistribute_route() 593 api.mtu = re->mtu; 594 595 struct stream *s = stream_new(ZEBRA_MAX_PACKET_SIZ); 596 597 /* Encode route and send. */ 598 if (zapi_route_encode(cmd, s, &api) < 0) >>> CID 1465492: Resource leaks (RESOURCE_LEAK) >>> Variable "s" going out of scope leaks the storage it points to. 599 return -1; 600 601 if (IS_ZEBRA_DEBUG_SEND) { 602 char buf_prefix[PREFIX_STRLEN]; 603 prefix2str(&api.prefix, buf_prefix, sizeof(buf_prefix)); 604 ** CID 1465491: (TAINTED_SCALAR) /pimd/mtracebis.c: 281 in recv_response() /pimd/mtracebis.c: 311 in recv_response() ________________________________________________________________________________________________________ *** CID 1465491: (TAINTED_SCALAR) /pimd/mtracebis.c: 281 in recv_response() 275 sum = ip->ip_sum; 276 ip->ip_sum = 0; 277 278 if (sum != in_cksum(ip, ip->ip_hl * 4)) 279 return -1; 280 >>> CID 1465491: (TAINTED_SCALAR) >>> Using tainted variable "4 * ip->ip_hl" as an index into an array "mtrace_buf". 281 mtrace = (struct igmp_mtrace *)(mtrace_buf + (4 * ip->ip_hl)); 282 283 mtrace_len = ntohs(ip->ip_len) - ip->ip_hl * 4; 284 285 if (mtrace_len < (int)MTRACE_HDR_SIZE) 286 return -1; /pimd/mtracebis.c: 311 in recv_response() 305 } 306 307 if (hops) 308 *hops = responses; 309 310 if (mtracer) >>> CID 1465491: (TAINTED_SCALAR) >>> Passing tainted variable "mtrace_len" to a tainted sink. 311 memcpy(mtracer, mtrace, mtrace_len); 312 313 return 0; 314 } 315 316 static int wait_for_response(int fd, int *hops, struct igmp_mtrace *mtrace, ** CID 1465490: Error handling issues (CHECKED_RETURN) /pimd/pim_igmp_mtrace.c: 664 in igmp_mtrace_recv_qry_req() ________________________________________________________________________________________________________ *** CID 1465490: Error handling issues (CHECKED_RETURN) /pimd/pim_igmp_mtrace.c: 664 in igmp_mtrace_recv_qry_req() 658 if (pim_if_connected_to_source(out_ifp, mtracep->src_addr)) 659 return mtrace_send_response(pim, mtracep, mtrace_len); 660 /* 661 * 6.4 Forwarding Traceroute Requests: 662 * Previous-hop router not known 663 */ >>> CID 1465490: Error handling issues (CHECKED_RETURN) >>> Calling "inet_aton" without checking return value (as is done elsewhere 114 out of 116 times). 664 inet_aton(MCAST_ALL_ROUTERS, &nh_addr); 665 } 666 667 if (mtracep->hops <= (last_rsp_ind + 1)) 668 return mtrace_send_response(pim, mtracep, mtrace_len); 669 ** CID 1465489: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1465489: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_vty_clippy.c: 144 in vpn_policy_nexthop() 138 } 139 #if 1 /* anything that can fail? */ 140 if (_failcnt) 141 return CMD_WARNING; 142 #endif 143 #endif >>> CID 1465489: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "nexthop" to "vpn_policy_nexthop_magic", which dereferences it. 144 return vpn_policy_nexthop_magic(self, vty, argc, argv, nexthop, nexthop_str); 145 } 146 147 /* show_ip_bgp_instance_updgrps_adj_s => "show [ip]$ip bgp [<view|vrf> VIEWVRFNAME$vrf] [<ipv4|ipv6>$afi <unicast|multicast|vpn>$safi] update-groups [SUBGROUP-ID]$sgid <advertise-queue|advertised-routes|packet-queue>$rtq" */ 148 DEFUN_CMD_FUNC_DECL(show_ip_bgp_instance_updgrps_adj_s) 149 #define funcdecl_show_ip_bgp_instance_updgrps_adj_s static int show_ip_bgp_instance_updgrps_adj_s_magic(\ ** CID 1465488: Error handling issues (CHECKED_RETURN) /zebra/zserv.c: 1163 in zread_route_add() ________________________________________________________________________________________________________ *** CID 1465488: Error handling issues (CHECKED_RETURN) /zebra/zserv.c: 1163 in zread_route_add() 1157 struct nexthop *nexthop = NULL; 1158 int i, ret; 1159 vrf_id_t vrf_id = 0; 1160 struct ipaddr vtep_ip; 1161 1162 s = msg; >>> CID 1465488: Error handling issues (CHECKED_RETURN) >>> Calling "zapi_route_decode" without checking return value (as is done elsewhere 12 out of 13 times). 1163 zapi_route_decode(s, &api); 1164 1165 if (IS_ZEBRA_DEBUG_RECV) { 1166 char buf_prefix[PREFIX_STRLEN]; 1167 prefix2str(&api.prefix, buf_prefix, sizeof(buf_prefix)); 1168 zlog_debug("%s: p=%s, ZAPI_MESSAGE_LABEL: %sset, flags=0x%x", ** CID 1465487: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_network.c: 458 in bgp_get_bound_name() ________________________________________________________________________________________________________ *** CID 1465487: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_network.c: 458 in bgp_get_bound_name() 452 return NULL; 453 454 if (peer->su.sa.sa_family != AF_INET 455 && peer->su.sa.sa_family != AF_INET6) 456 return NULL; // unexpected 457 >>> CID 1465487: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "peer" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 458 if (!peer) 459 return name; 460 /* For IPv6 peering, interface (unnumbered or link-local with interface) 461 * takes precedence over VRF. For IPv4 peering, explicit interface or 462 * VRF are the situations to bind. 463 */ ** CID 1465486: Memory - illegal accesses (UNINIT) /pimd/pim_igmp_mtrace.c: 645 in igmp_mtrace_recv_qry_req() ________________________________________________________________________________________________________ *** CID 1465486: Memory - illegal accesses (UNINIT) /pimd/pim_igmp_mtrace.c: 645 in igmp_mtrace_recv_qry_req() 639 else 640 rspp->fwd_code = fwd_code; 641 /* 6.5 Sending Traceroute Responses */ 642 return mtrace_send_response(pim, mtracep, mtrace_len); 643 } 644 >>> CID 1465486: Memory - illegal accesses (UNINIT) >>> Using uninitialized value "nexthop.interface". 645 out_ifp = nexthop.interface; 646 pim_out_ifp = out_ifp->info; 647 648 rspp->incoming = pim_out_ifp->primary_address; 649 rspp->prev_hop = nh_addr; 650 rspp->in_count = htonl(MTRACE_UNKNOWN_COUNT); ** CID 1465485: (RESOURCE_LEAK) /bgpd/bgp_mplsvpn.c: 474 in vpn_leak_from_vrf_update() /bgpd/bgp_mplsvpn.c: 533 in vpn_leak_from_vrf_update() /bgpd/bgp_mplsvpn.c: 566 in vpn_leak_from_vrf_update() /bgpd/bgp_mplsvpn.c: 638 in vpn_leak_from_vrf_update() ________________________________________________________________________________________________________ *** CID 1465485: (RESOURCE_LEAK) /bgpd/bgp_mplsvpn.c: 474 in vpn_leak_from_vrf_update() 468 s = ecommunity_ecom2str(info_vrf->attr->ecommunity, 469 ECOMMUNITY_FORMAT_ROUTE_MAP, 0); 470 } 471 472 zlog_debug("%s: info_vrf->type=%d, EC{%s}", __func__, 473 info_vrf->type, s); >>> CID 1465485: (RESOURCE_LEAK) >>> Variable "s" going out of scope leaks the storage it points to. 474 } 475 476 if (!bgp_vpn) 477 return; 478 479 if (!afi) { /bgpd/bgp_mplsvpn.c: 533 in vpn_leak_from_vrf_update() 527 if (static_attr.ecommunity) { 528 s = ecommunity_ecom2str(static_attr.ecommunity, 529 ECOMMUNITY_FORMAT_ROUTE_MAP, 0); 530 } 531 zlog_debug("%s: post route map static_attr.ecommunity{%s}", 532 __func__, s); >>> CID 1465485: (RESOURCE_LEAK) >>> Variable "s" going out of scope leaks the storage it points to. 533 } 534 535 /* 536 * Add the vpn-policy rt-list 537 */ 538 struct ecommunity *old_ecom; /bgpd/bgp_mplsvpn.c: 566 in vpn_leak_from_vrf_update() 560 if (static_attr.ecommunity) { 561 s = ecommunity_ecom2str(static_attr.ecommunity, 562 ECOMMUNITY_FORMAT_ROUTE_MAP, 0); 563 } 564 zlog_debug("%s: post merge static_attr.ecommunity{%s}", 565 __func__, s); >>> CID 1465485: (RESOURCE_LEAK) >>> Variable "s" going out of scope leaks the storage it points to. 566 } 567 568 /* Nexthop */ 569 /* if policy nexthop not set, use 0 */ 570 if (CHECK_FLAG(bgp_vrf->vpn_policy[afi].flags, 571 BGP_VPN_POLICY_TOVPN_NEXTHOP_SET)) { /bgpd/bgp_mplsvpn.c: 638 in vpn_leak_from_vrf_update() 632 633 if (new_attr->ecommunity) { 634 s = ecommunity_ecom2str(new_attr->ecommunity, 635 ECOMMUNITY_FORMAT_ROUTE_MAP, 0); 636 } 637 zlog_debug("%s: new_attr->ecommunity{%s}", __func__, s); >>> CID 1465485: (RESOURCE_LEAK) >>> Variable "s" going out of scope leaks the storage it points to. 638 } 639 640 /* Now new_attr is an allocated interned attr */ 641 642 bn = bgp_afi_node_get(bgp_vpn->rib[afi][safi], afi, safi, p, 643 &(bgp_vrf->vpn_policy[afi].tovpn_rd)); ** CID 1465484: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1465484: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_vty.c: 6940 in clear_bgp_ipv6_safi_prefix() 6934 int idx_ipv6_prefix = 0; 6935 safi_t safi = SAFI_UNICAST; 6936 char *prefix = argv_find(argv, argc, "X:X::X:X/M", &idx_ipv6_prefix) ? 6937 argv[idx_ipv6_prefix]->arg : NULL; 6938 6939 argv_find_and_parse_safi(argv, argc, &idx_safi, &safi); >>> CID 1465484: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "prefix" to "bgp_clear_prefix", which dereferences it. 6940 return bgp_clear_prefix( 6941 vty, NULL, prefix, AFI_IP6, 6942 safi, NULL); 6943 } 6944 6945 DEFUN (clear_bgp_instance_ipv6_safi_prefix, ** CID 1465483: Integer handling issues (NEGATIVE_RETURNS) ________________________________________________________________________________________________________ *** CID 1465483: Integer handling issues (NEGATIVE_RETURNS) /pimd/mtracebis_routeget.c: 87 in routeget() 81 82 ret = rtnl_open(&rth, 0); 83 84 if (ret < 0) 85 return ret; 86 >>> CID 1465483: Integer handling issues (NEGATIVE_RETURNS) >>> "rth.fd" is passed to a parameter that cannot be negative. 87 if (rtnl_talk(&rth, &req.n, 0, 0, &req.n, NULL, NULL) < 0) { 88 ret = -1; 89 goto close_rth; 90 } 91 92 ret = find_dst(&req.n, src, gw); ** CID 1465482: (NULL_RETURNS) /zebra/zebra_vty.c: 549 in static_config_install_delayed_routes() /zebra/zebra_vty.c: 549 in static_config_install_delayed_routes() ________________________________________________________________________________________________________ *** CID 1465482: (NULL_RETURNS) /zebra/zebra_vty.c: 549 in static_config_install_delayed_routes() 543 ozvrf = zebra_vrf_lookup_by_name(shr->vrf_name); 544 nh_zvrf = zebra_vrf_lookup_by_name(shr->nhvrf_name); 545 546 if (ozvrf != zvrf && nh_zvrf != zvrf) 547 continue; 548 >>> CID 1465482: (NULL_RETURNS) >>> Dereferencing a null pointer "ozvrf". 549 if (ozvrf->vrf->vrf_id == VRF_UNKNOWN 550 || nh_zvrf->vrf->vrf_id == VRF_UNKNOWN) 551 continue; 552 553 installed = zebra_static_route_leak( 554 NULL, ozvrf, nh_zvrf, shr->afi, shr->safi, NULL, /zebra/zebra_vty.c: 549 in static_config_install_delayed_routes() 543 ozvrf = zebra_vrf_lookup_by_name(shr->vrf_name); 544 nh_zvrf = zebra_vrf_lookup_by_name(shr->nhvrf_name); 545 546 if (ozvrf != zvrf && nh_zvrf != zvrf) 547 continue; 548 >>> CID 1465482: (NULL_RETURNS) >>> Dereferencing a null pointer "nh_zvrf". 549 if (ozvrf->vrf->vrf_id == VRF_UNKNOWN 550 || nh_zvrf->vrf->vrf_id == VRF_UNKNOWN) 551 continue; 552 553 installed = zebra_static_route_leak( 554 NULL, ozvrf, nh_zvrf, shr->afi, shr->safi, NULL, ** CID 1465481: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1465481: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_fsm.c: 1389 in bgp_start() 1383 "%s [FSM] In a VRF that is not initialised yet", 1384 peer->host); 1385 return -1; 1386 } 1387 1388 /* Register to be notified on peer up */ >>> CID 1465481: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "peer->bgp" to "bgp_flag_check", which dereferences it. 1389 if (peer->sort == BGP_PEER_EBGP && peer->ttl == 1 1390 && !CHECK_FLAG(peer->flags, PEER_FLAG_DISABLE_CONNECTED_CHECK) 1391 && !bgp_flag_check(peer->bgp, BGP_FLAG_DISABLE_NH_CONNECTED_CHK)) 1392 connected = 1; 1393 else 1394 connected = 0; ** CID 1465480: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1465480: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_mplsvpn.c: 496 in vpn_leak_from_vrf_update() 490 if (!vpn_leak_to_vpn_active(bgp_vrf, afi, &debugmsg)) { 491 if (debug) 492 zlog_debug("%s: skipping: %s", __func__, debugmsg); 493 return; 494 } 495 >>> CID 1465480: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "info_vrf->attr" to "bgp_attr_dup", which dereferences it. 496 bgp_attr_dup(&static_attr, info_vrf->attr); /* shallow copy */ 497 498 /* 499 * route map handling 500 */ 501 if (bgp_vrf->vpn_policy[afi].rmap[BGP_VPN_POLICY_DIR_TOVPN]) { ** CID 1465479: Resource leaks (RESOURCE_LEAK) /ospf6d/ospf6_asbr.c: 619 in ospf6_asbr_lsa_remove() ________________________________________________________________________________________________________ *** CID 1465479: Resource leaks (RESOURCE_LEAK) /ospf6d/ospf6_asbr.c: 619 in ospf6_asbr_lsa_remove() 613 route = ospf6_route_lookup(&prefix, ospf6->route_table); 614 if (route == NULL) { 615 if (IS_OSPF6_DEBUG_EXAMIN(AS_EXTERNAL)) { 616 prefix2str(&prefix, buf, sizeof(buf)); 617 zlog_debug("AS-External route %s not found", buf); 618 } >>> CID 1465479: Resource leaks (RESOURCE_LEAK) >>> Variable "route_to_del" going out of scope leaks the storage it points to. 619 return; 620 } 621 622 if (IS_OSPF6_DEBUG_EXAMIN(AS_EXTERNAL)) { 623 prefix2str(&prefix, buf, sizeof(buf)); 624 zlog_debug( ** CID 1465478: Resource leaks (RESOURCE_LEAK) /pimd/pim_igmp_mtrace.c: 266 in mtrace_un_forward_packet() ________________________________________________________________________________________________________ *** CID 1465478: Resource leaks (RESOURCE_LEAK) /pimd/pim_igmp_mtrace.c: 266 in mtrace_un_forward_packet() 260 261 if (ret != 0) { 262 if (PIM_DEBUG_MTRACE) 263 zlog_warn( 264 "Dropping mtrace packet, " 265 "no route to destination"); >>> CID 1465478: Resource leaks (RESOURCE_LEAK) >>> Handle variable "fd" going out of scope leaks the handle. 266 return -1; 267 } 268 269 if_out = nexthop.interface; 270 } else { 271 if_out = interface; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

New build dependency for documentation
by Quentin Young 18 Mar '18

18 Mar '18

Hi folks, we have switched to using RST+Sphinx as our documentation system. To build FRR you will need a Sphinx package. Most distributions offer a sufficiently up to date package. Details on which package you need to install on your platform can be found in the developer documentation under "Building". https://github.com/FRRouting/frr/tree/master/doc/developer Thanks, Quentin

1 0

BGP Route Leaking for VRF-Lite and VPN's
by Donald Sharp 15 Mar '18

15 Mar '18

All - During discussions this morning w/ Lou we discovered that we are both working towards a BGP solution for Route Leaking. We have enough differences between our approaches that we need to spend some time consolidating our approach. The current plan is to have the meeting at 3:30 EDT this Friday Jan 19. If you would like to attend please let me know and I will put you on the invite for it. donald

4 15

Tuesday's Meeting Notes
by Donald Sharp 15 Mar '18

15 Mar '18

Issues 1836 - Still open. Assigned to Philippe 1845 - still open issue, need more work. Assigned to Philippe 1850 - Discussion on issue when during convergence a path doesn’t have labels and other path has labels and how to resolve this. Renato/Donald/Paul discussing solution offline. 1851 - RFC says we should add to IPv6’s to RA. Open issue to be addressed 1856 - Donald will look at it 1857 - He fails installing rtrlib - Martin going to reply with package link 1859 - Needs to look at it - Marti will look at it 1862 - Install issue. Patrick got followed up 1864 - Don Slice addressing it 1865 - ipinlnd will do a pull request 1874 - Philippe found root cause (or at least part of the issue) and has a fix. Might be another VRF issue on ending up as VRF unknown (Max ID) or -1 written to vrf ID. Might require another issue 1877 - Was removed some time back (complicated code), might be difficult to secure (filter passwords etc). Might be addressed in Northbound API in future 1878 - Donald asking Chirag to look into it 1879 - Quentin looking at it PRs 1704 - Martin doing the centos6 doc update and Quentin doing the make clean fix, ok to merge afterwards 1880 - Donald will review it Out of time to discuss more PR’s - Send email or ping on slack if anything needs to be discussed.

1 0

ISIS 3-way Handshake has been Implemented
by Donald Sharp 14 Mar '18

14 Mar '18

All - I would like to thank Christian Franke for implementing ISIS 3-way handshake as per RFC 5303. This code is currently available on master for using. To disable this option please use `no isis three-way-handshake` under an interface you would not like to use it on. thanks! donald

1 0

Integrating DLEP with FRR
by Susheela Francis 09 Mar '18

09 Mar '18

Hi, I am trying to integrate an open source DLEP stack with FRR/Quagga. I am trying to manipulate the linux kernel routing table to include the DLEP routes in its routing table and then redistribute it to Quagga. I am new to this and have not been successful in doing this so far. Can you suggest a way ahead? Is there a better approach to solve this problem? Thanks & Regards, Susheela Francis Larsen & Toubro ltd. Larsen and Toubro Limited; L&T Heavy Engineering | Strategic Electronics Center "Komarla Solitaire", 145/2, Old Madras Road, CV Raman Nagar, Bangalore 560093 Tele: +91-80-6693 6245, Mobile: +91-8105228297 Mail: SUSHEELA.FRANCIS(a)LARSENTOUBRO.COM<mailto:SUSHEELA.FRANCIS@LARSENTOUBRO.COM> Web: www.lthed.com<http://www.lthed.com/>; www.larsentoubro.com<http://www.larsentoubro.com/>; Larsen & Toubro Limited www.larsentoubro.com This Email may contain confidential or privileged information for the intended recipient (s). If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system.

4 8

Today's Technical Meeting Notes
by Donald Sharp 06 Mar '18

06 Mar '18

1803- waiting of feedback of PR fixes issue 1810 - waiting for PR merge, perhaps also bring over to 4.0 1835 - Cumulus has solution to syslog as solution. Command line option is also possible. Phillippe will take lead on proposing a solution. ??? Doc reformat - Donald to work with Lou PBR - discussion on architecture and if have need for iptable management in FRR (to support PBR and flowspec, and to deconflict with VRFs/other table uses) . Probably need a rules manager as well. donald

1 0