/usr/src/usr.sbin/ripd/ripe.c

Bug Summary

File:	src/usr.sbin/ripd/ripe.c
Warning:	line 443, column 7 Potential leak of memory pointed to by 'rr'

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ripe.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/ripd/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.sbin/ripd -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/ripd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/ripd/ripe.c

1/*	$OpenBSD: ripe.c,v 1.30 2021/01/19 10:20:47 claudio Exp $ */

3/*
* Copyright (c) 2006 Michele Marchetto <mydecay@openbeer.it>
* Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org>
* Copyright (c) 2004 Esben Norby <norby@openbsd.org>
* Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

22#include <sys/types.h>
23#include <sys/socket.h>
24#include <sys/queue.h>
25#include <netinet/in.h>
26#include <arpa/inet.h>
27#include <net/if_types.h>
28#include <stdlib.h>
29#include <signal.h>
30#include <string.h>
31#include <fcntl.h>
32#include <pwd.h>
33#include <unistd.h>
34#include <event.h>
35#include <err.h>
36#include <errno(*__errno()).h>
37#include <stdio.h>

39#include "ripd.h"
40#include "rip.h"
41#include "ripe.h"
42#include "log.h"
43#include "control.h"

45void		 ripe_sig_handler(int, short, void *);
46__dead__attribute__((__noreturn__)) void	 ripe_shutdown(void);

48struct ripd_conf	*oeconf = NULL((void *)0);
49static struct imsgev	*iev_main;
50static struct imsgev	*iev_rde;

52/* ARGSUSED */
53void
54ripe_sig_handler(int sig, short event, void *bula)
55{
switch (sig) {
case SIGINT2:
case SIGTERM15:
ripe_shutdown();
/* NOTREACHED */
default:
fatalx("unexpected signal");
}
64}

66/* rip engine */
67pid_t
68ripe(struct ripd_conf *xconf, int pipe_parent2ripe[2], int pipe_ripe2rde[2],
  int pipe_parent2rde[2])
70{
struct event		 ev_sigint, ev_sigterm;
struct sockaddr_in	 addr;
struct iface		*iface = NULL((void *)0);
struct passwd		*pw;
struct redistribute	*r;
pid_t			 pid;

switch (pid = fork()) {
case -1:
fatal("cannot fork");
case 0:
break;
default:
return (pid);
}

/* create ripd control socket outside chroot */
if (control_init(xconf->csock) == -1)
fatalx("control socket setup failed");

addr.sin_family = AF_INET2;
addr.sin_port = htons(RIP_PORT)(__uint16_t)(__builtin_constant_p(520) ? (__uint16_t)(((__uint16_t
)(520) & 0xffU) << 8 | ((__uint16_t)(520) & 0xff00U
) >> 8) : __swap16md(520));
addr.sin_addr.s_addr = INADDR_ANY((u_int32_t)(0x00000000));

if ((xconf->rip_socket = socket(AF_INET2,
   SOCK_DGRAM2 | SOCK_CLOEXEC0x8000 | SOCK_NONBLOCK0x4000,
   IPPROTO_UDP17)) == -1)
fatalx("error creating socket");

if (bind(xconf->rip_socket, (struct sockaddr *)&addr,
   sizeof(addr)) == -1)
fatal("error binding socket");

/* set some defaults */
if (if_set_opt(xconf->rip_socket) == -1)
fatal("if_set_opt");

if (if_set_mcast_ttl(xconf->rip_socket, IP_DEFAULT_MULTICAST_TTL1) == -1)
fatal("if_set_mcast_ttl");

if (if_set_mcast_loop(xconf->rip_socket) == -1)
fatal("if_set_mcast_loop");

if (if_set_tos(xconf->rip_socket, IPTOS_PREC_INTERNETCONTROL0xc0) == -1)
fatal("if_set_tos");

if_set_recvbuf(xconf->rip_socket);

oeconf = xconf;

if ((pw = getpwnam(RIPD_USER"_ripd")) == NULL((void *)0))
fatal("getpwnam");

if (chroot(pw->pw_dir) == -1)
fatal("chroot");
if (chdir("/") == -1)
fatal("chdir(\"/\")");

setproctitle("rip engine");
log_procname = "ripe";

if (setgroups(1, &pw->pw_gid) ||
   setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
   setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
fatal("can't drop privileges");

event_init();
nbr_init(NBR_HASHSIZE128);

/* setup signal handler */
signal_set(&ev_sigint, SIGINT, ripe_sig_handler, NULL)event_set(&ev_sigint, 2, 0x08|0x10, ripe_sig_handler, ((void
 *)0));
signal_set(&ev_sigterm, SIGTERM, ripe_sig_handler, NULL)event_set(&ev_sigterm, 15, 0x08|0x10, ripe_sig_handler, (
(void *)0));
signal_add(&ev_sigint, NULL)event_add(&ev_sigint, ((void *)0));
signal_add(&ev_sigterm, NULL)event_add(&ev_sigterm, ((void *)0));
signal(SIGPIPE13, SIG_IGN(void (*)(int))1);
signal(SIGHUP1, SIG_IGN(void (*)(int))1);

/* setup pipes */
close(pipe_parent2ripe[0]);
close(pipe_ripe2rde[1]);
close(pipe_parent2rde[0]);
close(pipe_parent2rde[1]);

if ((iev_rde = malloc(sizeof(struct imsgev))) == NULL((void *)0) ||
   (iev_main = malloc(sizeof(struct imsgev))) == NULL((void *)0))
fatal(NULL((void *)0));
imsg_init(&iev_rde->ibuf, pipe_ripe2rde[0]);
iev_rde->handler = ripe_dispatch_rde;
imsg_init(&iev_main->ibuf, pipe_parent2ripe[1]);
iev_main->handler = ripe_dispatch_main;

/* setup event handler */
iev_rde->events = EV_READ0x02;
event_set(&iev_rde->ev, iev_rde->ibuf.fd, iev_rde->events,
   iev_rde->handler, iev_rde);
event_add(&iev_rde->ev, NULL((void *)0));

iev_main->events = EV_READ0x02;
event_set(&iev_main->ev, iev_main->ibuf.fd, iev_main->events,
   iev_main->handler, iev_main);
event_add(&iev_main->ev, NULL((void *)0));

event_set(&oeconf->ev, oeconf->rip_socket, EV_READ0x02|EV_PERSIST0x10,
   recv_packet, oeconf);
event_add(&oeconf->ev, NULL((void *)0));

/* remove unneeded config stuff */
while ((r = SIMPLEQ_FIRST(&oeconf->redist_list)((&oeconf->redist_list)->sqh_first)) != NULL((void *)0)) {
SIMPLEQ_REMOVE_HEAD(&oeconf->redist_list, entry)do { if (((&oeconf->redist_list)->sqh_first = (&
oeconf->redist_list)->sqh_first->entry.sqe_next) == (
(void *)0)) (&oeconf->redist_list)->sqh_last = &
(&oeconf->redist_list)->sqh_first; } while (0);
free(r);
}

/* listen on ripd control socket */
control_listen();

/* start interfaces */
LIST_FOREACH(iface, &xconf->iface_list, entry)for((iface) = ((&xconf->iface_list)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entry.le_next)) {
if_init(xconf, iface);
if (if_fsm(iface, IF_EVT_UP))
	log_debug("ripe: error starting interface: %s",
	    iface->name);
}

if (pledge("stdio inet mcast", NULL((void *)0)) == -1)
fatal("pledge");

evtimer_set(&oeconf->report_timer, report_timer, oeconf)event_set(&oeconf->report_timer, -1, 0, report_timer, oeconf
);
start_report_timer();

ripe_imsg_compose_rde(IMSG_FULL_REQUEST, 0, 0, NULL((void *)0), 0);

event_dispatch();

ripe_shutdown();
/* NOTREACHED */
return (0);
207}

209int
210ripe_imsg_compose_parent(int type, pid_t pid, void *data, u_int16_t datalen)
211{
return (imsg_compose_event(iev_main, type, 0, pid, -1, data, datalen));
213}

215int
216ripe_imsg_compose_rde(int type, u_int32_t peerid, pid_t pid,
  void *data, u_int16_t datalen)
218{
return (imsg_compose_event(iev_rde, type, peerid, pid, -1,
   data, datalen));
221}

223/* ARGSUSED */
224void
225ripe_dispatch_main(int fd, short event, void *bula)
226{
struct imsg	 imsg;
struct imsgev	*iev = bula;
struct imsgbuf	*ibuf = &iev->ibuf;
struct kif	*kif;
struct iface	*iface;
ssize_t		 n;
int		 link_ok, shut = 0;

if (event & EV_READ0x02) {
if ((n = imsg_read(ibuf)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("imsg_read error");
if (n == 0)	/* connection closed */
	shut = 1;
}
if (event & EV_WRITE0x04) {
if ((n = msgbuf_write(&ibuf->w)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("msgbuf_write");
if (n == 0)	/* connection closed */
	shut = 1;
}

for (;;) {
if ((n = imsg_get(ibuf, &imsg)) == -1)
	fatal("ripe_dispatch_main: imsg_get error");
if (n == 0)
	break;

switch (imsg.hdr.type) {
case IMSG_IFINFO:
	if (imsg.hdr.len - IMSG_HEADER_SIZEsizeof(struct imsg_hdr) !=
	    sizeof(struct kif))
		fatalx("IFINFO imsg with wrong len");
	kif = imsg.data;
	link_ok = (kif->flags & IFF_UP0x1) &&
	    LINK_STATE_IS_UP(kif->link_state)((kif->link_state) >= 4 || (kif->link_state) == 0);

	LIST_FOREACH(iface, &oeconf->iface_list, entry)for((iface) = ((&oeconf->iface_list)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entry.le_next)) {
		if (kif->ifindex == iface->ifindex) {
			iface->flags = kif->flags;
			iface->linkstate = kif->link_state;

			if (link_ok) {
				if_fsm(iface, IF_EVT_UP);
				log_warnx("interface %s up",
				    iface->name);
			} else {
				if_fsm(iface, IF_EVT_DOWN);
				log_warnx("interface %s down",
				    iface->name);
			}
		}
	}
	break;
case IMSG_CTL_IFINFO:
case IMSG_CTL_KROUTE:
case IMSG_CTL_KROUTE_ADDR:
case IMSG_CTL_END:
	control_imsg_relay(&imsg);
	break;
default:
	log_debug("ripe_dispatch_main: error handling imsg %d",
	    imsg.hdr.type);
	break;
}
imsg_free(&imsg);
}
if (!shut)
imsg_event_add(iev);
else {
/* this pipe is dead, so remove the event handler */  
event_del(&iev->ev);
event_loopexit(NULL((void *)0));
}
300}

302/* ARGSUSED */
303void
304ripe_dispatch_rde(int fd, short event, void *bula)
305{
struct rip_route	*rr;
struct imsg		 imsg;
struct imsgev		*iev = bula;
struct imsgbuf		*ibuf = &iev->ibuf;
struct iface		*iface;
struct nbr		*nbr;
ssize_t			 n;
int			 shut = 0;

if (event & EV_READ0x02) {
1
Assuming the condition is false→
2
←
Taking false branch→
if ((n = imsg_read(ibuf)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("imsg_read error");
if (n == 0)	/* connection closed */
	shut = 1;
}
if (event & EV_WRITE0x04) {
3
←
Assuming the condition is false→
4
←
Taking false branch→
if ((n = msgbuf_write(&ibuf->w)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("msgbuf_write");
if (n == 0)	/* connection closed */
	shut = 1;
}

for (;;) {
5
←
Loop condition is true.  Entering loop body→
21
←
Loop condition is true.  Entering loop body→
if ((n = imsg_get(ibuf, &imsg)) == -1)
6
←
Assuming the condition is false→
7
←
Taking false branch→
22
←
Assuming the condition is false→
23
←
Taking false branch→
	fatal("ripe_dispatch_rde: imsg_get error");
if (n == 0)
8
←
Assuming 'n' is not equal to 0→
9
←
Taking false branch→
24
←
Assuming 'n' is equal to 0→
25
←
Taking true branch→
	break;
26
←
 Execution continues on line 443→

switch (imsg.hdr.type) {
10
←
Control jumps to 'case IMSG_RESPONSE_ADD:'  at line 376→
case IMSG_REQUEST_ADD:
	if (imsg.hdr.len - IMSG_HEADER_SIZEsizeof(struct imsg_hdr) != sizeof(*rr))
		fatalx("invalid size of RDE request");

	if ((rr = malloc(sizeof(*rr))) == NULL((void *)0))
		fatal("ripe_dispatch_rde");

	memcpy(rr, imsg.data, sizeof(*rr));

	if (imsg.hdr.peerid != 0) {
		if ((nbr = nbr_find_peerid(imsg.hdr.peerid)) ==
		    NULL((void *)0)) {
			log_debug("unknown neighbor id %u",
			    imsg.hdr.peerid);
			free(rr);
			break;
		}
		add_entry(&nbr->rq_list, rr);
		break;
	}

	LIST_FOREACH(iface, &oeconf->iface_list, entry)for((iface) = ((&oeconf->iface_list)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entry.le_next)) {
		add_entry(&iface->rq_list, rr);
	}
	break;
case IMSG_SEND_REQUEST:
	if (imsg.hdr.peerid != 0) {
		if ((nbr = nbr_find_peerid(imsg.hdr.peerid)) ==
		    NULL((void *)0)) {
			log_debug("unknown neighbor id %u",
			    imsg.hdr.peerid);
			break;
		}
		send_request(&nbr->rq_list, NULL((void *)0), nbr);
		break;
	}

	LIST_FOREACH(iface, &oeconf->iface_list, entry)for((iface) = ((&oeconf->iface_list)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entry.le_next)) {
		send_request(&iface->rq_list, iface, NULL((void *)0));
	}
	break;
case IMSG_RESPONSE_ADD:
	if (imsg.hdr.len - IMSG_HEADER_SIZEsizeof(struct imsg_hdr) != sizeof(*rr))
11
←
Assuming the condition is false→
12
←
Taking false branch→
		fatalx("invalid size of RDE request");

	if ((rr = malloc(sizeof(*rr))) == NULL((void *)0))
13
←
Memory is allocated→
14
←
Assuming the condition is false→
15
←
Taking false branch→
		fatal("ripe_dispatch_rde");

	memcpy(rr, imsg.data, sizeof(*rr));

	if (imsg.hdr.peerid == 0) {
16
←
Assuming field 'peerid' is equal to 0→
17
←
Taking true branch→
		LIST_FOREACH(iface, &oeconf->iface_list, entry)for((iface) = ((&oeconf->iface_list)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entry.le_next))
18
←
Assuming 'iface' is equal to null→
19
←
Loop condition is false. Execution continues on line 389→
			add_entry(&iface->rp_list, rr);

		break;
20
←
 Execution continues on line 441→
	}

	if ((nbr = nbr_find_peerid(imsg.hdr.peerid)) == NULL((void *)0)) {
		log_debug("unknown neighbor id %u",
		    imsg.hdr.peerid);
		free(rr);
		break;
	}
	add_entry(&nbr->rp_list, rr);

	break;
case IMSG_SEND_RESPONSE:
	if (imsg.hdr.peerid == 0) {
		LIST_FOREACH(iface, &oeconf->iface_list,for((iface) = ((&oeconf->iface_list)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entry.le_next))
		    entry)for((iface) = ((&oeconf->iface_list)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entry.le_next)) {
			send_response(&iface->rp_list,
			    iface, NULL((void *)0));
		}
		break;
	}

	if ((nbr = nbr_find_peerid(imsg.hdr.peerid)) == NULL((void *)0)) {
		log_debug("unknown neighbor id %u",
		    imsg.hdr.peerid);
		break;
	}
	send_response(&nbr->rp_list, NULL((void *)0), nbr);
	nbr_fsm(nbr, NBR_EVT_RESPONSE_SENT);
	break;
case IMSG_SEND_TRIGGERED_UPDATE:
	if (imsg.hdr.len - IMSG_HEADER_SIZEsizeof(struct imsg_hdr) != sizeof(struct
	    rip_route))
		fatalx("invalid size of RDE request");

	rr = imsg.data;

	LIST_FOREACH(iface, &oeconf->iface_list,for((iface) = ((&oeconf->iface_list)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entry.le_next))
	    entry)for((iface) = ((&oeconf->iface_list)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entry.le_next)) {
		if (rr->ifindex != iface->ifindex)
			send_triggered_update(iface, rr);
	}
	break;
case IMSG_CTL_END:
case IMSG_CTL_SHOW_RIB:
	control_imsg_relay(&imsg);
	break;
default:
	log_debug("ripe_dispatch_rde: error handling imsg %d",
	    imsg.hdr.type);
	break;
}
imsg_free(&imsg);
}
if (!shut)
27
←
Potential leak of memory pointed to by 'rr'
imsg_event_add(iev);
else {
/* this pipe is dead, so remove the event handler */  
event_del(&iev->ev);
event_loopexit(NULL((void *)0));
}
450}

452__dead__attribute__((__noreturn__)) void
453ripe_shutdown(void)
454{
struct iface	*iface;

/* close pipes */
msgbuf_write(&iev_rde->ibuf.w);
msgbuf_clear(&iev_rde->ibuf.w);
close(iev_rde->ibuf.fd);
msgbuf_write(&iev_main->ibuf.w);
msgbuf_clear(&iev_main->ibuf.w);
close(iev_main->ibuf.fd);

LIST_FOREACH(iface, &oeconf->iface_list, entry)for((iface) = ((&oeconf->iface_list)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entry.le_next)) {
if (if_fsm(iface, IF_EVT_DOWN)) {
	log_debug("error stopping interface %s",
	    iface->name);
}
}
while ((iface = LIST_FIRST(&oeconf->iface_list)((&oeconf->iface_list)->lh_first)) != NULL((void *)0)) {
LIST_REMOVE(iface, entry)do { if ((iface)->entry.le_next != ((void *)0)) (iface)->
entry.le_next->entry.le_prev = (iface)->entry.le_prev; *
(iface)->entry.le_prev = (iface)->entry.le_next; ; ; } while
 (0);

/* revert the demotion when the interface is deleted */
if (iface->state == IF_STA_DOWN0x01)
	ripe_demote_iface(iface, 1);

if_del(iface);
}

close(oeconf->rip_socket);

/* clean up */
free(iev_rde);
free(iev_main);
free(oeconf);

log_info("rip engine exiting");
_exit(0);
490}

492void
493ripe_iface_ctl(struct ctl_conn *c, unsigned int idx)
494{
struct iface		*iface;
struct ctl_iface	*ictl;

LIST_FOREACH(iface, &oeconf->iface_list, entry)for((iface) = ((&oeconf->iface_list)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entry.le_next)) {
if (idx == 0 || idx == iface->ifindex) {
	ictl = if_to_ctl(iface);
	imsg_compose_event(&c->iev, IMSG_CTL_SHOW_IFACE,
	    0, 0, -1, ictl, sizeof(struct ctl_iface));
}
}
505}

507void
508ripe_nbr_ctl(struct ctl_conn *c)
509{
struct iface	*iface;
struct nbr	*nbr;
struct ctl_nbr	*nctl;

LIST_FOREACH(iface, &oeconf->iface_list, entry)for((iface) = ((&oeconf->iface_list)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entry.le_next))
LIST_FOREACH(nbr, &iface->nbr_list, entry)for((nbr) = ((&iface->nbr_list)->lh_first); (nbr)!=
 ((void *)0); (nbr) = ((nbr)->entry.le_next)) {
		nctl = nbr_to_ctl(nbr);
		imsg_compose_event(&c->iev,
		    IMSG_CTL_SHOW_NBR, 0, 0, -1, nctl,
		    sizeof(struct ctl_nbr));
}

imsg_compose_event(&c->iev, IMSG_CTL_END, 0, 0, -1, NULL((void *)0), 0);
523}

525void
526ripe_demote_iface(struct iface *iface, int active)
527{
struct demote_msg	dmsg;

if (iface->demote_group[0] == '\0')
return;

bzero(&dmsg, sizeof(dmsg));
strlcpy(dmsg.demote_group, iface->demote_group,
   sizeof(dmsg.demote_group));
if (active)
dmsg.level = -1;
else
dmsg.level = 1;

ripe_imsg_compose_parent(IMSG_DEMOTE, 0, &dmsg, sizeof(dmsg));
542}