/usr/src/usr.sbin/ospf6d/interface.c

Bug Summary

File:	src/usr.sbin/ospf6d/interface.c
Warning:	line 516, column 26 Dereference of null pointer

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name interface.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/ospf6d/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.sbin/ospf6d -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/ospf6d/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/ospf6d/interface.c

1/*	$OpenBSD: interface.c,v 1.29 2020/05/27 09:03:56 denis Exp $ */

3/*
* Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org>
* Copyright (c) 2004, 2005, 2007 Esben Norby <norby@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

20#include <sys/types.h>
21#include <sys/ioctl.h>
22#include <sys/time.h>
23#include <sys/socket.h>
24#include <netinet/in.h>
25#include <arpa/inet.h>
26#include <net/if.h>
27#include <net/if_types.h>
28#include <ctype.h>
29#include <err.h>
30#include <stdio.h>
31#include <stdlib.h>
32#include <unistd.h>
33#include <string.h>
34#include <event.h>

36#include "ospf6d.h"
37#include "ospf6.h"
38#include "log.h"
39#include "ospfe.h"

41void		 if_hello_timer(int, short, void *);
42void		 if_start_hello_timer(struct iface *);
43void		 if_stop_hello_timer(struct iface *);
44void		 if_stop_wait_timer(struct iface *);
45void		 if_wait_timer(int, short, void *);
46void		 if_start_wait_timer(struct iface *);
47void		 if_stop_wait_timer(struct iface *);
48struct nbr	*if_elect(struct nbr *, struct nbr *);

50struct {
int			state;
enum iface_event	event;
enum iface_action	action;
int			new_state;
55} iface_fsm[] = {
  /* current state	event that happened	action to take	resulting state */
  {IF_STA_DOWN0x01,	IF_EVT_UP,		IF_ACT_STRT,	0},
  {IF_STA_WAITING0x04,	IF_EVT_BACKUP_SEEN,	IF_ACT_ELECT,	0},
  {IF_STA_WAITING0x04,	IF_EVT_WTIMER,		IF_ACT_ELECT,	0},
  {IF_STA_ANY0x7f,	IF_EVT_WTIMER,		IF_ACT_NOTHING,	0},
  {IF_STA_WAITING0x04,	IF_EVT_NBR_CHNG,	IF_ACT_NOTHING,	0},
  {IF_STA_MULTI(0x10 | 0x20 | 0x40),	IF_EVT_NBR_CHNG,	IF_ACT_ELECT,	0},
  {IF_STA_ANY0x7f,	IF_EVT_NBR_CHNG,	IF_ACT_NOTHING,	0},
  {IF_STA_ANY0x7f,	IF_EVT_DOWN,		IF_ACT_RST,	IF_STA_DOWN0x01},
  {IF_STA_ANY0x7f,	IF_EVT_LOOP,		IF_ACT_RST,	IF_STA_LOOPBACK0x02},
  {IF_STA_LOOPBACK0x02,	IF_EVT_UNLOOP,		IF_ACT_NOTHING,	IF_STA_DOWN0x01},
  {-1,		IF_EVT_NOTHING,		IF_ACT_NOTHING,	0},
68};

70#if 0
71/* TODO virtual links */
72static int vlink_cnt = 0;
73#endif

75TAILQ_HEAD(, iface)struct { struct iface *tqh_first; struct iface **tqh_last; }	iflist;

77const char * const if_event_names[] = {
"NOTHING",
"UP",
"WAITTIMER",
"BACKUPSEEN",
"NEIGHBORCHANGE",
"LOOP",
"UNLOOP",
"DOWN"
86};

88const char * const if_action_names[] = {
"NOTHING",
"START",
"ELECT",
"RESET"
93};

95int
96if_fsm(struct iface *iface, enum iface_event event)
97{
int	old_state;
int	new_state = 0;
int	i, ret = 0;

old_state = iface->state;

for (i = 0; iface_fsm[i].state != -1; i++)
2
←
Assuming the condition is true→
3
←
Loop condition is true.  Entering loop body→
if ((iface_fsm[i].state & old_state) &&
4
←
Assuming the condition is true→
6
←
Taking true branch→
    (iface_fsm[i].event == event)) {
5
←
Assuming 'event' is equal to field 'event'→
	new_state = iface_fsm[i].new_state;
	break;
7
←
 Execution continues on line 111→
}

if (iface_fsm[i].state == -1) {
8
←
Taking false branch→
/* event outside of the defined fsm, ignore it. */
log_debug("if_fsm: interface %s, "
    "event %s not expected in state %s", iface->name,
    if_event_names[event], if_state_name(old_state));
return (0);
}

switch (iface_fsm[i].action) {
9
←
Control jumps to 'case IF_ACT_ELECT:'  at line 123→
case IF_ACT_STRT:
ret = if_act_start(iface);
break;
case IF_ACT_ELECT:
ret = if_act_elect(iface);
10
←
Calling 'if_act_elect'→
break;
case IF_ACT_RST:
ret = if_act_reset(iface);
break;
case IF_ACT_NOTHING:
/* do nothing */
break;
}

if (ret) {
log_debug("if_fsm: error changing state for interface %s, "
    "event %s, state %s", iface->name, if_event_names[event],
    if_state_name(old_state));
return (-1);
}

if (new_state != 0)
iface->state = new_state;

if (iface->state != old_state) {
area_track(iface->area);
orig_rtr_lsa(iface->area);
orig_link_lsa(iface);

/* state change inform RDE */
ospfe_imsg_compose_rde(IMSG_IFINFO, iface->self->peerid, 0,
    &iface->state, sizeof(iface->state));
}

if (old_state & (IF_STA_MULTI(0x10 | 0x20 | 0x40) | IF_STA_POINTTOPOINT0x08) &&
   (iface->state & (IF_STA_MULTI(0x10 | 0x20 | 0x40) | IF_STA_POINTTOPOINT0x08)) == 0)
ospfe_demote_iface(iface, 0);
if ((old_state & (IF_STA_MULTI(0x10 | 0x20 | 0x40) | IF_STA_POINTTOPOINT0x08)) == 0 &&
   iface->state & (IF_STA_MULTI(0x10 | 0x20 | 0x40) | IF_STA_POINTTOPOINT0x08))
ospfe_demote_iface(iface, 1);

log_debug("if_fsm: event %s resulted in action %s and changing "
   "state for interface %s from %s to %s",
   if_event_names[event], if_action_names[iface_fsm[i].action],
   iface->name, if_state_name(old_state), if_state_name(iface->state));

return (ret);
167}

169int
170if_init(void)
171{
TAILQ_INIT(&iflist)do { (&iflist)->tqh_first = ((void*)0); (&iflist)->
tqh_last = &(&iflist)->tqh_first; } while (0);

return (fetchifs(0));
175}

177/* XXX using a linked list should be OK for now */
178struct iface *
179if_find(unsigned int ifindex)
180{
struct iface	*iface;

TAILQ_FOREACH(iface, &iflist, list)for((iface) = ((&iflist)->tqh_first); (iface) != ((void
*)0); (iface) = ((iface)->list.tqe_next)) {
if (ifindex == iface->ifindex)
	return (iface);
}
return (NULL((void*)0));
188}

190struct iface *
191if_findname(char *name)
192{
struct iface	*iface;

TAILQ_FOREACH(iface, &iflist, list)for((iface) = ((&iflist)->tqh_first); (iface) != ((void
*)0); (iface) = ((iface)->list.tqe_next)) {
if (!strcmp(name, iface->name))
	return (iface);
}
return (NULL((void*)0));
200}

202struct iface *
203if_new(u_short ifindex, char *ifname)
204{
struct iface		*iface;

if ((iface = calloc(1, sizeof(*iface))) == NULL((void*)0))
err(1, "if_new: calloc");

iface->state = IF_STA_DOWN0x01;

LIST_INIT(&iface->nbr_list)do { ((&iface->nbr_list)->lh_first) = ((void*)0); }
 while (0);
TAILQ_INIT(&iface->ifa_list)do { (&iface->ifa_list)->tqh_first = ((void*)0); (&
iface->ifa_list)->tqh_last = &(&iface->ifa_list
)->tqh_first; } while (0);
TAILQ_INIT(&iface->ls_ack_list)do { (&iface->ls_ack_list)->tqh_first = ((void*)0);
 (&iface->ls_ack_list)->tqh_last = &(&iface
->ls_ack_list)->tqh_first; } while (0);
RB_INIT(&iface->lsa_tree)do { (&iface->lsa_tree)->rbh_root = ((void*)0); } while
 (0);

217#if 0
/* TODO */
if (virtual) {
iface->type = IF_TYPE_VIRTUALLINK;
snprintf(iface->name, sizeof(iface->name), "vlink%d",
    vlink_cnt++);
iface->flags |= IFF_UP0x1;
iface->mtu = IP_MSS576;
return (iface);
}
227#endif
strlcpy(iface->name, ifname, sizeof(iface->name));
iface->ifindex = ifindex;

TAILQ_INSERT_TAIL(&iflist, iface, list)do { (iface)->list.tqe_next = ((void*)0); (iface)->list
.tqe_prev = (&iflist)->tqh_last; *(&iflist)->tqh_last
 = (iface); (&iflist)->tqh_last = &(iface)->list
.tqe_next; } while (0);

return (iface);
234}

236void
237if_update(struct iface *iface, int mtu, int flags, u_int8_t type,
  u_int8_t state, u_int64_t rate, u_int32_t rdomain)
239{
iface->mtu = mtu;
iface->flags = flags;
iface->if_type = type;
iface->linkstate = state;
iface->baudrate = rate;
iface->rdomain = rdomain;

/* set type */
if (flags & IFF_POINTOPOINT0x10)
iface->type = IF_TYPE_POINTOPOINT;
if (flags & IFF_BROADCAST0x2 && flags & IFF_MULTICAST0x8000)
iface->type = IF_TYPE_BROADCAST;
if (flags & IFF_LOOPBACK0x8) {
iface->type = IF_TYPE_POINTOPOINT;
iface->cflags |= F_IFACE_PASSIVE0x01;
}
256}

258void
259if_del(struct iface *iface)
260{
struct nbr	*nbr = NULL((void*)0);

log_debug("if_del: interface %s", iface->name);

/* revert the demotion when the interface is deleted */
if ((iface->state & (IF_STA_MULTI(0x10 | 0x20 | 0x40) | IF_STA_POINTTOPOINT0x08)) == 0)
ospfe_demote_iface(iface, 1);

/* clear lists etc */
while ((nbr = LIST_FIRST(&iface->nbr_list)((&iface->nbr_list)->lh_first)) != NULL((void*)0))
nbr_del(nbr);

if (evtimer_pending(&iface->hello_timer, NULL)event_pending(&iface->hello_timer, 0x01, ((void*)0)))
evtimer_del(&iface->hello_timer)event_del(&iface->hello_timer);
if (evtimer_pending(&iface->wait_timer, NULL)event_pending(&iface->wait_timer, 0x01, ((void*)0)))
evtimer_del(&iface->wait_timer)event_del(&iface->wait_timer);
if (evtimer_pending(&iface->lsack_tx_timer, NULL)event_pending(&iface->lsack_tx_timer, 0x01, ((void*)0)
))
evtimer_del(&iface->lsack_tx_timer)event_del(&iface->lsack_tx_timer);

ls_ack_list_clr(iface);
TAILQ_REMOVE(&iflist, iface, list)do { if (((iface)->list.tqe_next) != ((void*)0)) (iface)->
list.tqe_next->list.tqe_prev = (iface)->list.tqe_prev; else
 (&iflist)->tqh_last = (iface)->list.tqe_prev; *(iface
)->list.tqe_prev = (iface)->list.tqe_next; ; ; } while (
0);
free(iface);
283}

285void
286if_start(struct ospfd_conf *xconf, struct iface *iface)
287{
/* init the dummy local neighbor */
iface->self = nbr_new(ospfe_router_id(), iface, iface->ifindex, 1,
	NULL((void*)0));

/* set event handlers for interface */
evtimer_set(&iface->lsack_tx_timer, ls_ack_tx_timer, iface)event_set(&iface->lsack_tx_timer, -1, 0, ls_ack_tx_timer
, iface);
evtimer_set(&iface->hello_timer, if_hello_timer, iface)event_set(&iface->hello_timer, -1, 0, if_hello_timer, iface
);
evtimer_set(&iface->wait_timer, if_wait_timer, iface)event_set(&iface->wait_timer, -1, 0, if_wait_timer, iface
);

iface->fd = xconf->ospf_socket;

ospfe_demote_iface(iface, 0);

if (if_fsm(iface, IF_EVT_UP))
log_debug("error starting interface %s", iface->name);
303}

305/* timers */
306/* ARGSUSED */
307void
308if_hello_timer(int fd, short event, void *arg)
309{
struct iface *iface = arg;
struct timeval tv;

send_hello(iface);

/* reschedule hello_timer */
timerclear(&tv)(&tv)->tv_sec = (&tv)->tv_usec = 0;
tv.tv_sec = iface->hello_interval;
if (evtimer_add(&iface->hello_timer, &tv)event_add(&iface->hello_timer, &tv) == -1)
fatal("if_hello_timer");
320}

322void
323if_start_hello_timer(struct iface *iface)
324{
struct timeval tv;

timerclear(&tv)(&tv)->tv_sec = (&tv)->tv_usec = 0;
if (evtimer_add(&iface->hello_timer, &tv)event_add(&iface->hello_timer, &tv) == -1)
fatal("if_start_hello_timer");
330}

332void
333if_stop_hello_timer(struct iface *iface)
334{
if (evtimer_del(&iface->hello_timer)event_del(&iface->hello_timer) == -1)
fatal("if_stop_hello_timer");
337}

339/* ARGSUSED */
340void
341if_wait_timer(int fd, short event, void *arg)
342{
struct iface *iface = arg;

if_fsm(iface, IF_EVT_WTIMER);
1
Calling 'if_fsm'→
346}

348void
349if_start_wait_timer(struct iface *iface)
350{
struct timeval	tv;

timerclear(&tv)(&tv)->tv_sec = (&tv)->tv_usec = 0;
tv.tv_sec = iface->dead_interval;
if (evtimer_add(&iface->wait_timer, &tv)event_add(&iface->wait_timer, &tv) == -1)
fatal("if_start_wait_timer");
357}

359void
360if_stop_wait_timer(struct iface *iface)
361{
if (evtimer_del(&iface->wait_timer)event_del(&iface->wait_timer) == -1)
fatal("if_stop_wait_timer");
364}

366/* actions */
367int
368if_act_start(struct iface *iface)
369{
struct in6_addr		 addr;
struct timeval		 now;

if (!((iface->flags & IFF_UP0x1) &&
   LINK_STATE_IS_UP(iface->linkstate)((iface->linkstate) >= 4 || (iface->linkstate) == 0))) {
log_debug("if_act_start: interface %s link down",
    iface->name);
return (0);
}

if (iface->if_type == IFT_CARP0xf7 &&
   !(iface->cflags & F_IFACE_PASSIVE0x01)) {
/* force passive mode on carp interfaces */
log_warnx("if_act_start: forcing interface %s to passive",
    iface->name);
iface->cflags |= F_IFACE_PASSIVE0x01;
}

gettimeofday(&now, NULL((void*)0));
iface->uptime = now.tv_sec;

/* loopback interfaces have a special state */
if (iface->flags & IFF_LOOPBACK0x8)
iface->state = IF_STA_LOOPBACK0x02;

if (iface->cflags & F_IFACE_PASSIVE0x01) {
/* for an update of stub network entries */
orig_rtr_lsa(iface->area);
return (0);
}

switch (iface->type) {
case IF_TYPE_POINTOPOINT:
inet_pton(AF_INET624, AllSPFRouters"ff02::5", &addr);

if (if_join_group(iface, &addr))
	return (-1);
iface->state = IF_STA_POINTTOPOINT0x08;
break;
case IF_TYPE_VIRTUALLINK:
iface->state = IF_STA_POINTTOPOINT0x08;
break;
case IF_TYPE_POINTOMULTIPOINT:
case IF_TYPE_NBMA:
log_debug("if_act_start: type %s not supported, interface %s",
    if_type_name(iface->type), iface->name);
return (-1);
case IF_TYPE_BROADCAST:
inet_pton(AF_INET624, AllSPFRouters"ff02::5", &addr);

if (if_join_group(iface, &addr))
	return (-1);
if (iface->priority == 0) {
	iface->state = IF_STA_DROTHER0x10;
} else {
	iface->state = IF_STA_WAITING0x04;
	if_start_wait_timer(iface);
}
break;
default:
fatalx("if_act_start: unknown interface type");
}

/* hello timer needs to be started in any case */
if_start_hello_timer(iface);
return (0);
436}

438struct nbr *
439if_elect(struct nbr *a, struct nbr *b)
440{
if (a->priority > b->priority)
return (a);
if (a->priority < b->priority)
return (b);
if (ntohl(a->id.s_addr)(__uint32_t)(__builtin_constant_p(a->id.s_addr) ? (__uint32_t
)(((__uint32_t)(a->id.s_addr) & 0xff) << 24 | ((
__uint32_t)(a->id.s_addr) & 0xff00) << 8 | ((__uint32_t
)(a->id.s_addr) & 0xff0000) >> 8 | ((__uint32_t)
(a->id.s_addr) & 0xff000000) >> 24) : __swap32md
(a->id.s_addr)) > ntohl(b->id.s_addr)(__uint32_t)(__builtin_constant_p(b->id.s_addr) ? (__uint32_t
)(((__uint32_t)(b->id.s_addr) & 0xff) << 24 | ((
__uint32_t)(b->id.s_addr) & 0xff00) << 8 | ((__uint32_t
)(b->id.s_addr) & 0xff0000) >> 8 | ((__uint32_t)
(b->id.s_addr) & 0xff000000) >> 24) : __swap32md
(b->id.s_addr)))
return (a);
return (b);
448}

450int
451if_act_elect(struct iface *iface)
452{
struct in6_addr	 addr;
struct nbr	*nbr, *bdr = NULL((void*)0), *dr = NULL((void*)0);
int		 round = 0;
int		 changed = 0;
int		 old_state;
char		 b1[16], b2[16], b3[16], b4[16];

460start:
/* elect backup designated router */
LIST_FOREACH(nbr, &iface->nbr_list, entry)for((nbr) = ((&iface->nbr_list)->lh_first); (nbr)!=
 ((void*)0); (nbr) = ((nbr)->entry.le_next)) {
11
←
Assuming 'nbr' is not equal to null→
12
←
Loop condition is true.  Entering loop body→
18
←
Assuming 'nbr' is equal to null→
19
←
Loop condition is false. Execution continues on line 485→
if (nbr->priority == 0 || nbr13.1
'nbr' is not equal to 'dr'
 == dr ||	/* not electable */
13
←
Assuming field 'priority' is not equal to 0→
16
←
Taking true branch→
    nbr->state & NBR_STA_PRELIM(0x0001 | 0x0002 | 0x0004) ||	/* not available */
14
←
Assuming the condition is false→
    nbr->dr.s_addr == nbr->id.s_addr)	/* don't elect DR */
15
←
Assuming 'nbr->dr.s_addr' is equal to 'nbr->id.s_addr'→
	continue;
17
←
 Execution continues on line 462→
if (bdr != NULL((void*)0)) {
	/*
	 * routers announcing themselves as BDR have higher
	 * precedence over those routers announcing a
	 * different BDR.
	 */
	if (nbr->bdr.s_addr == nbr->id.s_addr) {
		if (bdr->bdr.s_addr == bdr->id.s_addr)
			bdr = if_elect(bdr, nbr);
		else
			bdr = nbr;
	} else if (bdr->bdr.s_addr != bdr->id.s_addr)
			bdr = if_elect(bdr, nbr);
} else
	bdr = nbr;
}

/* elect designated router */
LIST_FOREACH(nbr, &iface->nbr_list, entry)for((nbr) = ((&iface->nbr_list)->lh_first); (nbr)!=
 ((void*)0); (nbr) = ((nbr)->entry.le_next)) {
20
←
Loop condition is true.  Entering loop body→
23
←
Loop condition is false. Execution continues on line 496→
if (nbr->priority20.1
Field 'priority' is not equal to 0
 == 0 || nbr->state & NBR_STA_PRELIM(0x0001 | 0x0002 | 0x0004) ||
21
←
Taking false branch→
    (nbr20.2
'nbr' is not equal to 'dr'
 != dr && nbr->dr.s_addr20.3
'nbr->dr.s_addr' is equal to 'nbr->id.s_addr'
 != nbr->id.s_addr))
	/* only DR may be elected check priority too */
	continue;
if (dr21.1
'dr' is equal to NULL
 == NULL((void*)0))
22
←
Taking true branch→
	dr = nbr;
else
	dr = if_elect(dr, nbr);
}

if (dr23.1
'dr' is not equal to NULL
 == NULL((void*)0)) {
24
←
Taking false branch→
/* no designate router found use backup DR */
dr = bdr;
bdr = NULL((void*)0);
}

/*
* if we are involved in the election (e.g. new DR or no
* longer BDR) redo the election
*/
if (round24.1
'round' is equal to 0
 == 0 &&
   ((iface->self == dr && iface->self != iface->dr) ||
25
←
Assuming 'dr' is not equal to field 'self'→
   (iface->self != dr25.1
'dr' is not equal to field 'self'
 && iface->self == iface->dr) ||
26
←
Assuming field 'self' is not equal to field 'dr'→
   (iface->self == bdr && iface->self != iface->bdr) ||
27
←
Assuming 'bdr' is equal to field 'self'→
28
←
Assuming pointer value is null→
29
←
Assuming field 'self' is not equal to field 'bdr'→
   (iface->self != bdr && iface->self == iface->bdr))) {
/*
 * Reset announced DR/BDR to calculated one, so
 * that we may get elected in the second round.
 * This is needed to drop from a DR to a BDR.
 */
iface->self->dr.s_addr = dr->id.s_addr;
30
←
Dereference of null pointer
if (bdr)
	iface->self->bdr.s_addr = bdr->id.s_addr;
round = 1;
goto start;
}

log_debug("if_act_elect: interface %s old dr %s new dr %s, "
   "old bdr %s new bdr %s", iface->name,
   iface->dr ? inet_ntop(AF_INET2, &iface->dr->id, b1, sizeof(b1)) :
   "none", dr ? inet_ntop(AF_INET2, &dr->id, b2, sizeof(b2)) : "none",
   iface->bdr ? inet_ntop(AF_INET2, &iface->bdr->id, b3, sizeof(b3)) :
   "none", bdr ? inet_ntop(AF_INET2, &bdr->id, b4, sizeof(b4)) :
   "none");

/*
* After the second round still DR or BDR change state to DR or BDR,
* etc.
*/
old_state = iface->state;
if (dr == iface->self)
iface->state = IF_STA_DR0x40;
else if (bdr == iface->self)
iface->state = IF_STA_BACKUP0x20;
else
iface->state = IF_STA_DROTHER0x10;

/* TODO if iface is NBMA send all non eligible neighbors event Start */

/*
* if DR or BDR changed issue a AdjOK? event for all neighbors > 2-Way
*/
if (iface->dr != dr || iface->bdr != bdr)
changed = 1;

iface->dr = dr;
iface->bdr = bdr;

if (changed) {
inet_pton(AF_INET624, AllDRouters"ff02::6", &addr);
if (old_state & IF_STA_DRORBDR(0x40 | 0x20) &&
    (iface->state & IF_STA_DRORBDR(0x40 | 0x20)) == 0) {
	if (if_leave_group(iface, &addr))
		return (-1);
} else if ((old_state & IF_STA_DRORBDR(0x40 | 0x20)) == 0 &&
    iface->state & IF_STA_DRORBDR(0x40 | 0x20)) {
	if (if_join_group(iface, &addr))
		return (-1);
}

LIST_FOREACH(nbr, &iface->nbr_list, entry)for((nbr) = ((&iface->nbr_list)->lh_first); (nbr)!=
 ((void*)0); (nbr) = ((nbr)->entry.le_next)) {
	if (nbr->state & NBR_STA_BIDIR(0x0008 | (0x0010 | 0x0020 | (0x0040 | 0x0080 | 0x0100))))
		nbr_fsm(nbr, NBR_EVT_ADJ_OK);
}

orig_rtr_lsa(iface->area);
if (iface->state & IF_STA_DR0x40 || old_state & IF_STA_DR0x40)
	orig_net_lsa(iface);
}

if_start_hello_timer(iface);
return (0);
578}

580int
581if_act_reset(struct iface *iface)
582{
struct nbr		*nbr = NULL((void*)0);
struct in6_addr		 addr;

if (iface->cflags & F_IFACE_PASSIVE0x01) {
/* for an update of stub network entries */
orig_rtr_lsa(iface->area);
return (0);
}

switch (iface->type) {
case IF_TYPE_POINTOPOINT:
case IF_TYPE_BROADCAST:
inet_pton(AF_INET624, AllSPFRouters"ff02::5", &addr);
if (if_leave_group(iface, &addr)) {
	log_warnx("if_act_reset: error leaving group %s, "
	    "interface %s", log_in6addr(&addr), iface->name);
}
if (iface->state & IF_STA_DRORBDR(0x40 | 0x20)) {
	inet_pton(AF_INET624, AllDRouters"ff02::6", &addr);
	if (if_leave_group(iface, &addr)) {
		log_warnx("if_act_reset: "
		    "error leaving group %s, interface %s",
		    log_in6addr(&addr), iface->name);
	}
}
break;
case IF_TYPE_VIRTUALLINK:
/* nothing */
break;
case IF_TYPE_NBMA:
case IF_TYPE_POINTOMULTIPOINT:
log_debug("if_act_reset: type %s not supported, interface %s",
    if_type_name(iface->type), iface->name);
return (-1);
default:
fatalx("if_act_reset: unknown interface type");
}

LIST_FOREACH(nbr, &iface->nbr_list, entry)for((nbr) = ((&iface->nbr_list)->lh_first); (nbr)!=
 ((void*)0); (nbr) = ((nbr)->entry.le_next)) {
if (nbr_fsm(nbr, NBR_EVT_KILL_NBR)) {
	log_debug("if_act_reset: error killing neighbor %s",
	    inet_ntoa(nbr->id));
}
}

iface->dr = NULL((void*)0);
iface->bdr = NULL((void*)0);

ls_ack_list_clr(iface);
stop_ls_ack_tx_timer(iface);
if_stop_hello_timer(iface);
if_stop_wait_timer(iface);

/* send empty hello to tell everybody that we are going down */
send_hello(iface);

return (0);
640}

642struct ctl_iface *
643if_to_ctl(struct iface *iface)
644{
static struct ctl_iface	 ictl;
struct timeval		 tv, now, res;
struct nbr		*nbr;

memcpy(ictl.name, iface->name, sizeof(ictl.name));
memcpy(&ictl.addr, &iface->addr, sizeof(ictl.addr));
ictl.rtr_id.s_addr = ospfe_router_id();
memcpy(&ictl.area, &iface->area->id, sizeof(ictl.area));
if (iface->dr) {
memcpy(&ictl.dr_id, &iface->dr->id, sizeof(ictl.dr_id));
memcpy(&ictl.dr_addr, &iface->dr->addr, sizeof(ictl.dr_addr));
} else {
bzero(&ictl.dr_id, sizeof(ictl.dr_id));
bzero(&ictl.dr_addr, sizeof(ictl.dr_addr));
}
if (iface->bdr) {
memcpy(&ictl.bdr_id, &iface->bdr->id, sizeof(ictl.bdr_id));
memcpy(&ictl.bdr_addr, &iface->bdr->addr,
    sizeof(ictl.bdr_addr));
} else {
bzero(&ictl.bdr_id, sizeof(ictl.bdr_id));
bzero(&ictl.bdr_addr, sizeof(ictl.bdr_addr));
}
ictl.ifindex = iface->ifindex;
ictl.state = iface->state;
ictl.mtu = iface->mtu;
ictl.nbr_cnt = 0;
ictl.adj_cnt = 0;
ictl.baudrate = iface->baudrate;
ictl.dead_interval = iface->dead_interval;
ictl.transmit_delay = iface->transmit_delay;
ictl.hello_interval = iface->hello_interval;
ictl.flags = iface->flags;
ictl.metric = iface->metric;
ictl.rxmt_interval = iface->rxmt_interval;
ictl.type = iface->type;
ictl.linkstate = iface->linkstate;
ictl.if_type = iface->if_type;
ictl.priority = iface->priority;
ictl.passive = (iface->cflags & F_IFACE_PASSIVE0x01) == F_IFACE_PASSIVE0x01;

gettimeofday(&now, NULL((void*)0));
if (evtimer_pending(&iface->hello_timer, &tv)event_pending(&iface->hello_timer, 0x01, &tv)) {
timersub(&tv, &now, &res)do { (&res)->tv_sec = (&tv)->tv_sec - (&now
)->tv_sec; (&res)->tv_usec = (&tv)->tv_usec -
 (&now)->tv_usec; if ((&res)->tv_usec < 0) {
 (&res)->tv_sec--; (&res)->tv_usec += 1000000; }
 } while (0);
ictl.hello_timer = res.tv_sec;
} else
ictl.hello_timer = -1;

if (iface->state != IF_STA_DOWN0x01) {
ictl.uptime = now.tv_sec - iface->uptime;
} else
ictl.uptime = 0;

LIST_FOREACH(nbr, &iface->nbr_list, entry)for((nbr) = ((&iface->nbr_list)->lh_first); (nbr)!=
 ((void*)0); (nbr) = ((nbr)->entry.le_next)) {
if (nbr == iface->self)
	continue;
ictl.nbr_cnt++;
if (nbr->state & NBR_STA_ADJFORM(0x0010 | 0x0020 | (0x0040 | 0x0080 | 0x0100)))
	ictl.adj_cnt++;
}

return (&ictl);
707}

709/* misc */
710void
711if_set_sockbuf(int fd)
712{
int	bsize;

bsize = 256 * 1024;
while (setsockopt(fd, SOL_SOCKET0xffff, SO_RCVBUF0x1002, &bsize,
   sizeof(bsize)) == -1)
bsize /= 2;

if (bsize != 256 * 1024)
log_warnx("if_set_sockbuf: recvbuf size only %d", bsize);

bsize = 64 * 1024;
while (setsockopt(fd, SOL_SOCKET0xffff, SO_SNDBUF0x1001, &bsize,
   sizeof(bsize)) == -1)
bsize /= 2;

if (bsize != 64 * 1024)
log_warnx("if_set_sockbuf: sendbuf size only %d", bsize);
730}

732int
733if_join_group(struct iface *iface, struct in6_addr *addr)
734{
struct ipv6_mreq	 mreq;

switch (iface->type) {
case IF_TYPE_POINTOPOINT:
case IF_TYPE_BROADCAST:
log_debug("if_join_group: interface %s addr %s",
    iface->name, log_in6addr(addr));
mreq.ipv6mr_multiaddr = *addr;
mreq.ipv6mr_interface = iface->ifindex;

if (setsockopt(iface->fd, IPPROTO_IPV641, IPV6_JOIN_GROUP12,
    &mreq, sizeof(mreq)) == -1) {
	log_warn("if_join_group: error IPV6_JOIN_GROUP, "
	    "interface %s address %s", iface->name,
	    log_in6addr(addr));
	return (-1);
}
break;
case IF_TYPE_POINTOMULTIPOINT:
case IF_TYPE_VIRTUALLINK:
case IF_TYPE_NBMA:
log_debug("if_join_group: type %s not supported, interface %s",
    if_type_name(iface->type), iface->name);
return (-1);
default:
fatalx("if_join_group: unknown interface type");
}

return (0);
764}

766int
767if_leave_group(struct iface *iface, struct in6_addr *addr)
768{
struct ipv6_mreq	 mreq;

switch (iface->type) {
case IF_TYPE_POINTOPOINT:
case IF_TYPE_BROADCAST:
log_debug("if_leave_group: interface %s addr %s",
    iface->name, log_in6addr(addr));
mreq.ipv6mr_multiaddr = *addr;
mreq.ipv6mr_interface = iface->ifindex;

if (setsockopt(iface->fd, IPPROTO_IPV641, IPV6_LEAVE_GROUP13,
    (void *)&mreq, sizeof(mreq)) == -1) {
	log_warn("if_leave_group: error IPV6_LEAVE_GROUP, "
	    "interface %s address %s", iface->name,
	    log_in6addr(addr));
	return (-1);
}
break;
case IF_TYPE_POINTOMULTIPOINT:
case IF_TYPE_VIRTUALLINK:
case IF_TYPE_NBMA:
log_debug("if_leave_group: type %s not supported, interface %s",
    if_type_name(iface->type), iface->name);
return (-1);
default:
fatalx("if_leave_group: unknown interface type");
}
return (0);
797}

799int
800if_set_mcast(struct iface *iface)
801{
switch (iface->type) {
case IF_TYPE_POINTOPOINT:
case IF_TYPE_BROADCAST:
if (setsockopt(iface->fd, IPPROTO_IPV641, IPV6_MULTICAST_IF9,
    &iface->ifindex, sizeof(iface->ifindex)) == -1) {
	log_debug("if_set_mcast: error setting "
	    "IP_MULTICAST_IF, interface %s", iface->name);
	return (-1);
}
break;
case IF_TYPE_POINTOMULTIPOINT:
case IF_TYPE_VIRTUALLINK:
case IF_TYPE_NBMA:
log_debug("if_set_mcast: type %s not supported, interface %s",
    if_type_name(iface->type), iface->name);
return (-1);
default:
fatalx("if_set_mcast: unknown interface type");
}

return (0);
823}

825int
826if_set_mcast_loop(int fd)
827{
u_int	loop = 0;

if (setsockopt(fd, IPPROTO_IPV641, IPV6_MULTICAST_LOOP11,
   (u_int *)&loop, sizeof(loop)) == -1) {
log_warn("if_set_mcast_loop: error setting "
    "IPV6_MULTICAST_LOOP");
return (-1);
}

return (0);
838}

840int
841if_set_ipv6_pktinfo(int fd, int enable)
842{
if (setsockopt(fd, IPPROTO_IPV641, IPV6_RECVPKTINFO36, &enable,
   sizeof(enable)) == -1) {
log_warn("if_set_ipv6_pktinfo: error setting IPV6_PKTINFO");
return (-1);
}

return (0);
850}

852int
853if_set_ipv6_checksum(int fd)
854{
int	offset = offsetof(struct ospf_hdr, chksum)__builtin_offsetof(struct ospf_hdr, chksum);

log_debug("if_set_ipv6_checksum setting cksum offset to %d", offset);
if (setsockopt(fd, IPPROTO_IPV641, IPV6_CHECKSUM26, &offset,
    sizeof(offset)) == -1) {
log_warn("if_set_ipv6_checksum: error setting IPV6_CHECKSUM");
return (-1);
}
return (0);
864}