/usr/src/usr.sbin/bgpd/rtr

Bug Summary

File:	src/usr.sbin/bgpd/rtr_proto.c
Warning:	line 788, column 2 Potential leak of memory pointed to by 'aspa'
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name rtr_proto.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/bgpd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/usr.sbin/bgpd -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/bgpd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/bgpd/rtr_proto.c
1/*	$OpenBSD: rtr_proto.c,v 1.28 2024/01/10 16:08:36 claudio Exp $ */

3/*
* Copyright (c) 2020 Claudio Jeker <claudio@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
18#include <sys/tree.h>
19#include <errno(*__errno()).h>
20#include <stdint.h>
21#include <poll.h>
22#include <stdio.h>
23#include <stdlib.h>
24#include <string.h>
25#include <unistd.h>

27#include "bgpd.h"
28#include "session.h"
29#include "log.h"

31struct rtr_header {
uint8_t		version;
uint8_t		type;
uint16_t	session_id; /* or error code */
uint32_t	length;
36} __packed__attribute__((__packed__));

38#define RTR_MAX_VERSION2		2
39#define RTR_MAX_LEN2048		2048
40#define RTR_DEFAULT_REFRESH3600	3600
41#define RTR_DEFAULT_RETRY600	600
42#define RTR_DEFAULT_EXPIRE7200	7200
43#define RTR_DEFAULT_ACTIVE60	60

45enum rtr_pdu_type {
SERIAL_NOTIFY = 0,
SERIAL_QUERY,
RESET_QUERY,
CACHE_RESPONSE,
IPV4_PREFIX,
IPV6_PREFIX = 6,
END_OF_DATA = 7,
CACHE_RESET = 8,
ROUTER_KEY = 9,
ERROR_REPORT = 10,
ASPA = 11,
57};

59struct rtr_notify {
struct rtr_header	hdr;
uint32_t		serial;
62} __packed__attribute__((__packed__));

64struct rtr_query {
struct rtr_header	hdr;
uint32_t		serial;
67} __packed__attribute__((__packed__));

69struct rtr_reset {
struct rtr_header	hdr;
71} __packed__attribute__((__packed__));

73struct rtr_response {
struct rtr_header	hdr;
75} __packed__attribute__((__packed__));

77#define FLAG_ANNOUNCE0x1	0x1
78#define FLAG_MASK0x1	FLAG_ANNOUNCE0x1
79struct rtr_ipv4 {
struct rtr_header	hdr;
uint8_t			flags;
uint8_t			prefixlen;
uint8_t			maxlen;
uint8_t			zero;
uint32_t		prefix;
uint32_t		asnum;
87} __packed__attribute__((__packed__));

89struct rtr_ipv6 {
struct rtr_header	hdr;
uint8_t			flags;
uint8_t			prefixlen;
uint8_t			maxlen;
uint8_t			zero;
uint32_t		prefix[4];
uint32_t		asnum;
97} __packed__attribute__((__packed__));

99struct rtr_routerkey {
struct rtr_header	hdr;
uint8_t			ski[20];
uint32_t		asnum;
/* followed by Subject Public Key Info */
104} __packed__attribute__((__packed__));

106#define FLAG_AFI_V60x1	0x1
107#define FLAG_AFI_MASK0x1	FLAG_AFI_V60x1
108struct rtr_aspa {
struct rtr_header	hdr;
uint8_t			flags;
uint8_t			afi_flags;
uint16_t		cnt;
uint32_t		cas;
/* array of spas with cnt elements follows */
115} __packed__attribute__((__packed__));

117struct rtr_endofdata {
struct rtr_header	hdr;
uint32_t		serial;
uint32_t		refresh;
uint32_t		retry;
uint32_t		expire;
123} __packed__attribute__((__packed__));

125struct rtr_endofdata_v0 {
struct rtr_header	hdr;
uint32_t		serial;
128} __packed__attribute__((__packed__));

130enum rtr_event {
RTR_EVNT_START,
RTR_EVNT_CON_OPEN,
RTR_EVNT_CON_CLOSE,
RTR_EVNT_TIMER_REFRESH,
RTR_EVNT_TIMER_RETRY,
RTR_EVNT_TIMER_EXPIRE,
RTR_EVNT_TIMER_ACTIVE,
RTR_EVNT_SEND_ERROR,
RTR_EVNT_SERIAL_NOTIFY,
RTR_EVNT_CACHE_RESPONSE,
RTR_EVNT_END_OF_DATA,
RTR_EVNT_CACHE_RESET,
RTR_EVNT_NO_DATA,
RTR_EVNT_RESET_AND_CLOSE,
RTR_EVNT_UNSUPP_PROTO_VERSION,
RTR_EVNT_NEGOTIATION_DONE,
147};

149static const char *rtr_eventnames[] = {
"start",
"connection open",
"connection closed",
"refresh timer expired",
"retry timer expired",
"expire timer expired",
"activity timer expired",
"sent error",
"serial notify received",
"cache response received",
"end of data received",
"cache reset received",
"no data",
"connection closed with reset",
"unsupported protocol version",
"negotiation done",
166};

168enum rtr_state {
RTR_STATE_CLOSED,
RTR_STATE_ERROR,
/* sessions with a state below this line will poll for incoming data */
RTR_STATE_ESTABLISHED,
RTR_STATE_EXCHANGE,
RTR_STATE_NEGOTIATION,
175};

177static const char *rtr_statenames[] = {
"closed",
"error",
"established",
"exchange",
"negotiation",
183};

185struct rtr_session {
TAILQ_ENTRY(rtr_session)struct { struct rtr_session *tqe_next; struct rtr_session **tqe_prev
; }	entry;
char				descr[PEER_DESCR_LEN32];
struct roa_tree			roa_set;
struct aspa_tree		aspa;
struct aspa_tree		aspa_oldv6;
struct ibuf_read		r;
struct msgbuf			w;
struct timer_head		timers;
uint32_t			id;		/* rtr_config id */
uint32_t			serial;
uint32_t			refresh;
uint32_t			retry;
uint32_t			expire;
uint32_t			active;
int				session_id;
int				fd;
int				active_lock;
enum rtr_state			state;
enum reconf_action		reconf_action;
enum rtr_error			last_sent_error;
enum rtr_error			last_recv_error;
char				last_sent_msg[REASON_LEN256];
char				last_recv_msg[REASON_LEN256];
uint8_t				version;
210};

212TAILQ_HEAD(, rtr_session)struct { struct rtr_session *tqh_first; struct rtr_session **
tqh_last; } rtrs = TAILQ_HEAD_INITIALIZER(rtrs){ ((void *)0), &(rtrs).tqh_first };

214static void	rtr_fsm(struct rtr_session *, enum rtr_event);

216static const char *
217log_rtr(struct rtr_session *rs)
218{
return rs->descr;
220}

222static const char *
223log_rtr_type(enum rtr_pdu_type type)
224{
static char buf[20];

switch (type) {
case SERIAL_NOTIFY:
return "serial notify";
case SERIAL_QUERY:
return "serial query";
case RESET_QUERY:
return "reset query";
case CACHE_RESPONSE:
return "cache response";
case IPV4_PREFIX:
return "IPv4 prefix";
case IPV6_PREFIX:
return "IPv6 prefix";
case END_OF_DATA:
return "end of data";
case CACHE_RESET:
return "cache reset";
case ROUTER_KEY:
return "router key";
case ERROR_REPORT:
return "error report";
case ASPA:
return "aspa";
default:
snprintf(buf, sizeof(buf), "unknown %u", type);
return buf;
}
254};

256static void
257rtr_reset_cache(struct rtr_session *rs)
258{
/* reset session */
rs->session_id = -1;
timer_stop(&rs->timers, Timer_Rtr_Expire);
free_roatree(&rs->roa_set);
free_aspatree(&rs->aspa);
free_aspatree(&rs->aspa_oldv6);
265}

267static struct ibuf *
268rtr_newmsg(struct rtr_session *rs, enum rtr_pdu_type type, uint32_t len,
  uint16_t session_id)
270{
struct ibuf *buf;
int saved_errno;

if (len > RTR_MAX_LEN2048) {
errno(*__errno()) = ERANGE34;
return NULL((void *)0);
}
len += sizeof(struct rtr_header);
if ((buf = ibuf_open(len)) == NULL((void *)0))
goto fail;
if (ibuf_add_n8(buf, rs->version) == -1)
goto fail;
if (ibuf_add_n8(buf, type) == -1)
goto fail;
if (ibuf_add_n16(buf, session_id) == -1)
goto fail;
if (ibuf_add_n32(buf, len) == -1)
goto fail;

return buf;

fail:
saved_errno = errno(*__errno());
ibuf_free(buf);
errno(*__errno()) = saved_errno;
return NULL((void *)0);
297}

299static void rtr_send_error(struct rtr_session *, struct ibuf *, enum rtr_error,
  const char *, ...) __attribute__((__format__ (printf, 4, 5)));

302/*
* Try to send an error PDU to cache, put connection into error
* state.
*/
306static void
307rtr_send_error(struct rtr_session *rs, struct ibuf *pdu, enum rtr_error err,
  const char *fmt, ...)
309{
struct ibuf *buf;
va_list ap;
size_t len = 0, mlen = 0;

rs->last_sent_error = err;
memset(rs->last_sent_msg, 0, sizeof(rs->last_sent_msg));
if (fmt != NULL((void *)0)) {
va_start(ap, fmt)__builtin_va_start((ap), fmt);
vsnprintf(rs->last_sent_msg, sizeof(rs->last_sent_msg),
    fmt, ap);
mlen = strlen(rs->last_sent_msg);
va_end(ap)__builtin_va_end((ap));
}

log_warnx("rtr %s: sending error: %s%s%s", log_rtr(rs),
   log_rtr_error(err), mlen > 0 ? ": " : "", rs->last_sent_msg); 

if (pdu != NULL((void *)0)) {
ibuf_rewind(pdu);
len = ibuf_size(pdu);
}

buf = rtr_newmsg(rs, ERROR_REPORT, 2 * sizeof(uint32_t) + len + mlen,
   err);
if (buf == NULL((void *)0))
goto fail;
if (ibuf_add_n32(buf, len) == -1)
goto fail;
if (pdu != NULL((void *)0)) {
if (ibuf_add_ibuf(buf, pdu) == -1)
	goto fail;
}
if (ibuf_add_n32(buf, mlen) == -1)
goto fail;
if (ibuf_add(buf, rs->last_sent_msg, mlen) == -1)
goto fail;
ibuf_close(&rs->w, buf);

rtr_fsm(rs, RTR_EVNT_SEND_ERROR);
return;

fail:
log_warn("rtr %s: send error report", log_rtr(rs));
ibuf_free(buf);
354}

356static void
357rtr_send_reset_query(struct rtr_session *rs)
358{
struct ibuf *buf;

buf = rtr_newmsg(rs, RESET_QUERY, 0, 0);
if (buf == NULL((void *)0))
goto fail;
ibuf_close(&rs->w, buf);
return;

fail:
rtr_send_error(rs, NULL((void *)0), INTERNAL_ERROR,
   "send %s: %s", log_rtr_type(RESET_QUERY), strerror(errno(*__errno())));
ibuf_free(buf);
371}

373static void
374rtr_send_serial_query(struct rtr_session *rs)
375{
struct ibuf *buf;

buf = rtr_newmsg(rs, SERIAL_QUERY, sizeof(uint32_t), rs->session_id);
if (buf == NULL((void *)0))
goto fail;
if (ibuf_add_n32(buf, rs->serial) == -1)
goto fail;
ibuf_close(&rs->w, buf);
return;

fail:
rtr_send_error(rs, NULL((void *)0), INTERNAL_ERROR,
   "send %s: %s", log_rtr_type(SERIAL_QUERY), strerror(errno(*__errno())));
ibuf_free(buf);
390}

392/*
* Check the session_id of the rtr_header to match the expected value.
* Returns -1 on failure and 0 on success.
*/
396static int
397rtr_check_session_id(struct rtr_session *rs, uint16_t session_id,
  struct rtr_header *rh, struct ibuf *pdu)
399{
if (session_id != ntohs(rh->session_id)(__uint16_t)(__builtin_constant_p(rh->session_id) ? (__uint16_t
)(((__uint16_t)(rh->session_id) & 0xffU) << 8 | (
(__uint16_t)(rh->session_id) & 0xff00U) >> 8) : __swap16md
(rh->session_id))) {
rtr_send_error(rs, pdu, CORRUPT_DATA,
    "%s: bad session_id %d (expected %d)",
    log_rtr_type(rh->type), ntohs(rh->session_id)(__uint16_t)(__builtin_constant_p(rh->session_id) ? (__uint16_t
)(((__uint16_t)(rh->session_id) & 0xffU) << 8 | (
(__uint16_t)(rh->session_id) & 0xff00U) >> 8) : __swap16md
(rh->session_id)), session_id);
return -1;
}
return 0;
407}

409/*
* Parse the common rtr header (first 8 bytes) including the
* included length field.
* Returns -1 on failure. On success msgtype and msglen are set
* and the function return 0.
*/
415static int
416rtr_parse_header(struct rtr_session *rs, struct ibuf *hdr,
  size_t *msglen, enum rtr_pdu_type *msgtype)
418{
struct rtr_header rh;
size_t len;

if (ibuf_get(hdr, &rh, sizeof(rh)) == -1)
fatal("%s: ibuf_get", __func__);

len = ntohl(rh.length)(__uint32_t)(__builtin_constant_p(rh.length) ? (__uint32_t)((
(__uint32_t)(rh.length) & 0xff) << 24 | ((__uint32_t
)(rh.length) & 0xff00) << 8 | ((__uint32_t)(rh.length
) & 0xff0000) >> 8 | ((__uint32_t)(rh.length) &
 0xff000000) >> 24) : __swap32md(rh.length));

if (len > RTR_MAX_LEN2048) {
rtr_send_error(rs, hdr, CORRUPT_DATA, "%s: too big: %zu bytes",
    log_rtr_type(rh.type), len);
return -1;
}

if (rs->state == RTR_STATE_NEGOTIATION) {
switch (rh.type) {
case CACHE_RESPONSE:
case CACHE_RESET:
case ERROR_REPORT:
	if (rh.version < rs->version)
		rs->version = rh.version;
	rtr_fsm(rs, RTR_EVNT_NEGOTIATION_DONE);
	break;
case SERIAL_NOTIFY:
	/* ignore SERIAL_NOTIFY */
	break;
default:
	rtr_send_error(rs, hdr, CORRUPT_DATA,
	    "%s: out of context", log_rtr_type(rh.type));
	return -1;
}
} else if (rh.version != rs->version && rh.type != ERROR_REPORT) {
goto badversion;
}

switch (rh.type) {
case SERIAL_NOTIFY:
if (len != sizeof(struct rtr_notify))
	goto badlen;
break;
case CACHE_RESPONSE:
if (len != sizeof(struct rtr_response))
	goto badlen;
break;
case IPV4_PREFIX:
if (len != sizeof(struct rtr_ipv4))
	goto badlen;
break;
case IPV6_PREFIX:
if (len != sizeof(struct rtr_ipv6))
	goto badlen;
break;
case END_OF_DATA:
if (rs->version == 0) {
	if (len != sizeof(struct rtr_endofdata_v0))
		goto badlen;
} else {
	if (len != sizeof(struct rtr_endofdata))
		goto badlen;
}
break;
case CACHE_RESET:
if (len != sizeof(struct rtr_reset))
	goto badlen;
break;
case ROUTER_KEY:
if (rs->version < 1)
	goto badversion;
if (len < sizeof(struct rtr_routerkey))
	goto badlen;
break;
case ERROR_REPORT:
if (len < 16)
	goto badlen;
break;
case ASPA:
if (rs->version < 2)
	goto badversion;
if (len < sizeof(struct rtr_aspa) || (len % 4) != 0)
	goto badlen;
break;
default:
rtr_send_error(rs, hdr, UNSUPP_PDU_TYPE, "type %s",
    log_rtr_type(rh.type));
return -1;
}

*msglen = len;
*msgtype = rh.type;

return 0;

badlen:
rtr_send_error(rs, hdr, CORRUPT_DATA, "%s: bad length: %zu bytes",
   log_rtr_type(rh.type), len);
return -1;

badversion:
rtr_send_error(rs, hdr, UNEXP_PROTOCOL_VERS, "%s: version %d",
   log_rtr_type(rh.type), rh.version);
return -1;
520}

522static int
523rtr_parse_notify(struct rtr_session *rs, struct ibuf *pdu)
524{
struct rtr_notify notify;

/* ignore SERIAL_NOTIFY during startup */
if (rs->state == RTR_STATE_NEGOTIATION)
return 0;

if (ibuf_get(pdu, &notify, sizeof(notify)) == -1)
goto badlen;

if (rtr_check_session_id(rs, rs->session_id, &notify.hdr, pdu) == -1)
return -1;

if (rs->state != RTR_STATE_ESTABLISHED) {
log_warnx("rtr %s: received %s: while in state %s (ignored)",
    log_rtr(rs), log_rtr_type(SERIAL_NOTIFY),
    rtr_statenames[rs->state]);
return 0;
}

rtr_fsm(rs, RTR_EVNT_SERIAL_NOTIFY);
return 0;

badlen:
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: bad length",
   log_rtr_type(SERIAL_NOTIFY));
return -1;
551}

553static int
554rtr_parse_cache_response(struct rtr_session *rs, struct ibuf *pdu)
555{
struct rtr_response resp;

if (ibuf_get(pdu, &resp, sizeof(resp)) == -1)
goto badlen;

/* set session_id if not yet happened */
if (rs->session_id == -1)
rs->session_id = ntohs(resp.hdr.session_id)(__uint16_t)(__builtin_constant_p(resp.hdr.session_id) ? (__uint16_t
)(((__uint16_t)(resp.hdr.session_id) & 0xffU) << 8 |
 ((__uint16_t)(resp.hdr.session_id) & 0xff00U) >> 8
) : __swap16md(resp.hdr.session_id));

if (rtr_check_session_id(rs, rs->session_id, &resp.hdr, pdu) == -1)
return -1;

if (rs->state != RTR_STATE_ESTABLISHED) {
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: out of context",
    log_rtr_type(CACHE_RESPONSE));
return -1;
}

rtr_fsm(rs, RTR_EVNT_CACHE_RESPONSE);
return 0;

badlen:
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: bad length",
   log_rtr_type(CACHE_RESPONSE));
return -1;
581}

583static int
584rtr_parse_ipv4_prefix(struct rtr_session *rs, struct ibuf *pdu)
585{
struct rtr_ipv4 ip4;
struct roa *roa;

if (ibuf_get(pdu, &ip4, sizeof(ip4)) == -1)
goto badlen;

if (rtr_check_session_id(rs, 0, &ip4.hdr, pdu) == -1)
return -1;

if (rs->state != RTR_STATE_EXCHANGE) {
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: out of context",
    log_rtr_type(IPV4_PREFIX));
return -1;
}

if (ip4.prefixlen > 32 || ip4.maxlen > 32 ||
   ip4.prefixlen > ip4.maxlen) {
rtr_send_error(rs, pdu, CORRUPT_DATA,
    "%s: bad prefixlen / maxlen", log_rtr_type(IPV4_PREFIX));
return -1;
}

if ((roa = calloc(1, sizeof(*roa))) == NULL((void *)0)) {
rtr_send_error(rs, NULL((void *)0), INTERNAL_ERROR, "out of memory");
return -1;
}
roa->aid = AID_INET1;
roa->prefixlen = ip4.prefixlen;
roa->maxlen = ip4.maxlen;
roa->asnum = ntohl(ip4.asnum)(__uint32_t)(__builtin_constant_p(ip4.asnum) ? (__uint32_t)((
(__uint32_t)(ip4.asnum) & 0xff) << 24 | ((__uint32_t
)(ip4.asnum) & 0xff00) << 8 | ((__uint32_t)(ip4.asnum
) & 0xff0000) >> 8 | ((__uint32_t)(ip4.asnum) &
 0xff000000) >> 24) : __swap32md(ip4.asnum));
roa->prefix.inet.s_addr = ip4.prefix;

if (ip4.flags & FLAG_ANNOUNCE0x1) {
if (RB_INSERT(roa_tree, &rs->roa_set, roa)roa_tree_RB_INSERT(&rs->roa_set, roa) != NULL((void *)0)) {
	rtr_send_error(rs, pdu, DUP_REC_RECV, "%s %s",
	    log_rtr_type(IPV4_PREFIX), log_roa(roa));
	free(roa);
	return -1;
}
} else {
struct roa *r;

r = RB_FIND(roa_tree, &rs->roa_set, roa)roa_tree_RB_FIND(&rs->roa_set, roa);
if (r == NULL((void *)0)) {
	rtr_send_error(rs, pdu, UNK_REC_WDRAWL, "%s %s",
	    log_rtr_type(IPV4_PREFIX), log_roa(roa));
	free(roa);
	return -1;
}
RB_REMOVE(roa_tree, &rs->roa_set, r)roa_tree_RB_REMOVE(&rs->roa_set, r);
free(r);
free(roa);
}

return 0;

badlen:
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: bad length",
   log_rtr_type(IPV4_PREFIX));
return -1;
646}

648static int
649rtr_parse_ipv6_prefix(struct rtr_session *rs, struct ibuf *pdu)
650{
struct rtr_ipv6 ip6;
struct roa *roa;

if (ibuf_get(pdu, &ip6, sizeof(ip6)) == -1)
goto badlen;

if (rtr_check_session_id(rs, 0, &ip6.hdr, pdu) == -1)
return -1;

if (rs->state != RTR_STATE_EXCHANGE) {
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: out of context",
    log_rtr_type(IPV6_PREFIX));
return -1;
}

if (ip6.prefixlen > 128 || ip6.maxlen > 128 ||
   ip6.prefixlen > ip6.maxlen) {
rtr_send_error(rs, pdu, CORRUPT_DATA,
    "%s: bad prefixlen / maxlen", log_rtr_type(IPV6_PREFIX));
return -1;
}

if ((roa = calloc(1, sizeof(*roa))) == NULL((void *)0)) {
rtr_send_error(rs, NULL((void *)0), INTERNAL_ERROR, "out of memory");
return -1;
}
roa->aid = AID_INET62;
roa->prefixlen = ip6.prefixlen;
roa->maxlen = ip6.maxlen;
roa->asnum = ntohl(ip6.asnum)(__uint32_t)(__builtin_constant_p(ip6.asnum) ? (__uint32_t)((
(__uint32_t)(ip6.asnum) & 0xff) << 24 | ((__uint32_t
)(ip6.asnum) & 0xff00) << 8 | ((__uint32_t)(ip6.asnum
) & 0xff0000) >> 8 | ((__uint32_t)(ip6.asnum) &
 0xff000000) >> 24) : __swap32md(ip6.asnum));
memcpy(&roa->prefix.inet6, ip6.prefix, sizeof(roa->prefix.inet6));

if (ip6.flags & FLAG_ANNOUNCE0x1) {
if (RB_INSERT(roa_tree, &rs->roa_set, roa)roa_tree_RB_INSERT(&rs->roa_set, roa) != NULL((void *)0)) {
	rtr_send_error(rs, pdu, DUP_REC_RECV, "%s %s",
	    log_rtr_type(IPV6_PREFIX), log_roa(roa));
	free(roa);
	return -1;
}
} else {
struct roa *r;

r = RB_FIND(roa_tree, &rs->roa_set, roa)roa_tree_RB_FIND(&rs->roa_set, roa);
if (r == NULL((void *)0)) {
	rtr_send_error(rs, pdu, UNK_REC_WDRAWL, "%s %s",
	    log_rtr_type(IPV6_PREFIX), log_roa(roa));
	free(roa);
	return -1;
}
RB_REMOVE(roa_tree, &rs->roa_set, r)roa_tree_RB_REMOVE(&rs->roa_set, r);
free(r);
free(roa);
}
return 0;

badlen:
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: bad length",
   log_rtr_type(IPV6_PREFIX));
return -1;
710}

712static int
713rtr_parse_aspa(struct rtr_session *rs, struct ibuf *pdu)
714{
struct rtr_aspa rtr_aspa;
struct aspa_tree *aspatree;
struct aspa_set *aspa, *a;
uint16_t cnt, i;

if (ibuf_get(pdu, &rtr_aspa, sizeof(rtr_aspa)) == -1)
29
←
Assuming the condition is false→
goto badlen;

cnt = ntohs(rtr_aspa.cnt)(__uint16_t)(__builtin_constant_p(rtr_aspa.cnt) ? (__uint16_t
)(((__uint16_t)(rtr_aspa.cnt) & 0xffU) << 8 | ((__uint16_t
)(rtr_aspa.cnt) & 0xff00U) >> 8) : __swap16md(rtr_aspa
.cnt));
30
←
Taking false branch→
31
←
'?' condition is false→
if (ibuf_size(pdu) != cnt * sizeof(uint32_t))
32
←
Assuming the condition is false→
33
←
Taking false branch→
goto badlen;

if (rs->state != RTR_STATE_EXCHANGE) {
34
←
Assuming field 'state' is equal to RTR_STATE_EXCHANGE→
35
←
Taking false branch→
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: out of context",
    log_rtr_type(ASPA));
return -1;
}

if (rtr_aspa.afi_flags & FLAG_AFI_V60x1) {
36
←
Assuming the condition is false→
37
←
Taking false branch→
aspatree = &rs->aspa_oldv6;
} else {
aspatree = &rs->aspa;
}

/* create aspa_set entry from the rtr aspa pdu */
if ((aspa = calloc(1, sizeof(*aspa))) == NULL((void *)0)) {
38
←
Memory is allocated→
39
←
Assuming the condition is false→
rtr_send_error(rs, NULL((void *)0), INTERNAL_ERROR, "out of memory");
return -1;
}
aspa->as = ntohl(rtr_aspa.cas)(__uint32_t)(__builtin_constant_p(rtr_aspa.cas) ? (__uint32_t
)(((__uint32_t)(rtr_aspa.cas) & 0xff) << 24 | ((__uint32_t
)(rtr_aspa.cas) & 0xff00) << 8 | ((__uint32_t)(rtr_aspa
.cas) & 0xff0000) >> 8 | ((__uint32_t)(rtr_aspa.cas
) & 0xff000000) >> 24) : __swap32md(rtr_aspa.cas));
40
←
Taking false branch→
41
←
'?' condition is false→
aspa->num = cnt;
if (cnt > 0) {
42
←
Assuming 'cnt' is > 0→
43
←
Taking true branch→
if ((aspa->tas = calloc(cnt, sizeof(uint32_t))) == NULL((void *)0)) {
44
←
Assuming the condition is false→
45
←
Taking false branch→
	free_aspa(aspa);
	rtr_send_error(rs, NULL((void *)0), INTERNAL_ERROR,
	    "out of memory");
	return -1;
}
for (i = 0; i45.1
'i' is < 'cnt'
 < cnt; i++) {
46
←
Loop condition is true.  Entering loop body→
	if (ibuf_get_n32(pdu, &aspa->tas[i]) == -1)
47
←
Assuming the condition is true→
48
←
Taking true branch→
		goto badlen;
49
←
Control jumps to line 788→
}
}

if (rtr_aspa.flags & FLAG_ANNOUNCE0x1) {
a = RB_INSERT(aspa_tree, aspatree, aspa)aspa_tree_RB_INSERT(aspatree, aspa);
if (a != NULL((void *)0)) {
	RB_REMOVE(aspa_tree, aspatree, a)aspa_tree_RB_REMOVE(aspatree, a);
	free_aspa(a);

	if (RB_INSERT(aspa_tree, aspatree, aspa)aspa_tree_RB_INSERT(aspatree, aspa) != NULL((void *)0)) {
		rtr_send_error(rs, NULL((void *)0), INTERNAL_ERROR,
		    "corrupt aspa tree");
		free_aspa(aspa);
		return -1;
	}
}
} else {
a = RB_FIND(aspa_tree, aspatree, aspa)aspa_tree_RB_FIND(aspatree, aspa);
if (a == NULL((void *)0)) {
	rtr_send_error(rs, pdu, UNK_REC_WDRAWL, "%s %s",
	    log_rtr_type(ASPA), log_aspa(aspa));
	free_aspa(aspa);
	return -1;
}
RB_REMOVE(aspa_tree, aspatree, a)aspa_tree_RB_REMOVE(aspatree, a);
free_aspa(a);
free_aspa(aspa);
}

return 0;

badlen:
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: bad length",
50
←
Potential leak of memory pointed to by 'aspa'
   log_rtr_type(ASPA));
return -1;
791}

793static int
794rtr_parse_end_of_data_v0(struct rtr_session *rs, struct ibuf *pdu)
795{
struct rtr_endofdata_v0 eod;

if (ibuf_get(pdu, &eod, sizeof(eod)) == -1)
goto badlen;

if (rtr_check_session_id(rs, rs->session_id, &eod.hdr, pdu) == -1)
return -1;

if (rs->state != RTR_STATE_EXCHANGE) {
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: out of context",
    log_rtr_type(END_OF_DATA));
return -1;
}

rs->serial = ntohl(eod.serial)(__uint32_t)(__builtin_constant_p(eod.serial) ? (__uint32_t)(
((__uint32_t)(eod.serial) & 0xff) << 24 | ((__uint32_t
)(eod.serial) & 0xff00) << 8 | ((__uint32_t)(eod.serial
) & 0xff0000) >> 8 | ((__uint32_t)(eod.serial) &
 0xff000000) >> 24) : __swap32md(eod.serial));

rtr_fsm(rs, RTR_EVNT_END_OF_DATA);
return 0;

badlen:
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: bad length",
   log_rtr_type(END_OF_DATA));
return -1;
819}

821static int
822rtr_parse_end_of_data(struct rtr_session *rs, struct ibuf *pdu)
823{
struct rtr_endofdata eod;
uint32_t t;

/* version 0 does not have the timing values */
if (rs->version == 0)
return rtr_parse_end_of_data_v0(rs, pdu);

if (ibuf_get(pdu, &eod, sizeof(eod)) == -1)
goto badlen;

if (rtr_check_session_id(rs, rs->session_id, &eod.hdr, pdu) == -1)
return -1;

if (rs->state != RTR_STATE_EXCHANGE) {
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: out of context",
    log_rtr_type(END_OF_DATA));
return -1;
}

rs->serial = ntohl(eod.serial)(__uint32_t)(__builtin_constant_p(eod.serial) ? (__uint32_t)(
((__uint32_t)(eod.serial) & 0xff) << 24 | ((__uint32_t
)(eod.serial) & 0xff00) << 8 | ((__uint32_t)(eod.serial
) & 0xff0000) >> 8 | ((__uint32_t)(eod.serial) &
 0xff000000) >> 24) : __swap32md(eod.serial));
/* validate timer values to be in the right range */
t = ntohl(eod.refresh)(__uint32_t)(__builtin_constant_p(eod.refresh) ? (__uint32_t)
(((__uint32_t)(eod.refresh) & 0xff) << 24 | ((__uint32_t
)(eod.refresh) & 0xff00) << 8 | ((__uint32_t)(eod.refresh
) & 0xff0000) >> 8 | ((__uint32_t)(eod.refresh) &
 0xff000000) >> 24) : __swap32md(eod.refresh));
if (t < 1 || t > 86400)
goto bad;
rs->refresh = t;
t = ntohl(eod.retry)(__uint32_t)(__builtin_constant_p(eod.retry) ? (__uint32_t)((
(__uint32_t)(eod.retry) & 0xff) << 24 | ((__uint32_t
)(eod.retry) & 0xff00) << 8 | ((__uint32_t)(eod.retry
) & 0xff0000) >> 8 | ((__uint32_t)(eod.retry) &
 0xff000000) >> 24) : __swap32md(eod.retry));
if (t < 1 || t > 7200)
goto bad;
rs->retry = t;
t = ntohl(eod.expire)(__uint32_t)(__builtin_constant_p(eod.expire) ? (__uint32_t)(
((__uint32_t)(eod.expire) & 0xff) << 24 | ((__uint32_t
)(eod.expire) & 0xff00) << 8 | ((__uint32_t)(eod.expire
) & 0xff0000) >> 8 | ((__uint32_t)(eod.expire) &
 0xff000000) >> 24) : __swap32md(eod.expire));
if (t < 600 || t > 172800)
goto bad;
if (t <= rs->retry || t <= rs->refresh)
goto bad;
rs->expire = t;

rtr_fsm(rs, RTR_EVNT_END_OF_DATA);
return 0;

863bad:
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: bad timeout values",
   log_rtr_type(END_OF_DATA));
return -1;

868badlen:
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: bad length",
   log_rtr_type(END_OF_DATA));
return -1;
872}

874static int
875rtr_parse_cache_reset(struct rtr_session *rs, struct ibuf *pdu)
876{
struct rtr_reset reset;

if (ibuf_get(pdu, &reset, sizeof(reset)) == -1)
goto badlen;

if (rtr_check_session_id(rs, 0, &reset.hdr, pdu) == -1)
return -1;

if (rs->state != RTR_STATE_ESTABLISHED) {
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: out of context",
    log_rtr_type(CACHE_RESET));
return -1;
}

rtr_fsm(rs, RTR_EVNT_CACHE_RESET);
return 0;

badlen:
rtr_send_error(rs, pdu, CORRUPT_DATA, "%s: bad length",
   log_rtr_type(CACHE_RESET));
return -1;
898}

900static char *
901ibuf_get_string(struct ibuf *buf, size_t len)
902{
char *str;

if (ibuf_size(buf) < len) {
errno(*__errno()) = EBADMSG92;
return (NULL((void *)0));
}
str = strndup(ibuf_data(buf), len);
if (str == NULL((void *)0))
return (NULL((void *)0));
ibuf_skip(buf, len);
return (str);
914}

916/*
* Parse an Error Response message. This function behaves a bit different
* from other parse functions since on error the connection needs to be
* dropped without sending an error response back.
*/
921static int
922rtr_parse_error(struct rtr_session *rs, struct ibuf *pdu)
923{
struct rtr_header rh;
struct ibuf err_pdu;
uint32_t pdu_len, msg_len;
char *str = NULL((void *)0);
uint16_t errcode;
int rv = -1;

if (ibuf_get(pdu, &rh, sizeof(rh)) == -1)
goto fail;
errcode = ntohs(rh.session_id)(__uint16_t)(__builtin_constant_p(rh.session_id) ? (__uint16_t
)(((__uint16_t)(rh.session_id) & 0xffU) << 8 | ((__uint16_t
)(rh.session_id) & 0xff00U) >> 8) : __swap16md(rh.session_id
));

if (ibuf_get_n32(pdu, &pdu_len) == -1)
goto fail;

/* for now just ignore the embedded pdu */
if (ibuf_get_ibuf(pdu, pdu_len, &err_pdu) == -1)
goto fail;

if (ibuf_get_n32(pdu, &msg_len) == -1)
goto fail;

/* optional error msg */
if (msg_len != 0)
if ((str = ibuf_get_string(pdu, msg_len)) == NULL((void *)0))
	goto fail;

log_warnx("rtr %s: received error: %s%s%s", log_rtr(rs),
   log_rtr_error(errcode), str ? ": " : "", str ? str : "");

if (errcode == NO_DATA_AVAILABLE) {
rtr_fsm(rs, RTR_EVNT_NO_DATA);
rv = 0;
} else if (errcode == UNSUPP_PROTOCOL_VERS)
rtr_fsm(rs, RTR_EVNT_UNSUPP_PROTO_VERSION);
else
rtr_fsm(rs, RTR_EVNT_RESET_AND_CLOSE);

rs->last_recv_error = errcode;
if (str)
strlcpy(rs->last_recv_msg, str, sizeof(rs->last_recv_msg));
else
memset(rs->last_recv_msg, 0, sizeof(rs->last_recv_msg));

free(str);
return rv;

fail:
log_warnx("rtr %s: received %s: bad encoding", log_rtr(rs),
   log_rtr_type(ERROR_REPORT));
rtr_fsm(rs, RTR_EVNT_RESET_AND_CLOSE);
return -1;
975}

977/*
* Try to process received rtr message, it is possible that not a full
* message is in the buffer. In that case stop, once new data is available
* a retry will be done.
*/
982static void
983rtr_process_msg(struct rtr_session *rs)
984{
struct ibuf rbuf, hdr, msg;
size_t msglen;
enum rtr_pdu_type msgtype;

ibuf_from_buffer(&rbuf, rs->r.buf, rs->r.wpos);

for (;;) {
21
←
Loop condition is true.  Entering loop body→
if (ibuf_size(&rbuf) < sizeof(struct rtr_header))
22
←
Assuming the condition is false→
23
←
Taking false branch→
	break;

/* parse header */
ibuf_from_buffer(&hdr, ibuf_data(&rbuf),
    sizeof(struct rtr_header));
if (rtr_parse_header(rs, &hdr, &msglen, &msgtype) == -1)
24
←
Taking false branch→
	return;

/* extract message */
if (ibuf_get_ibuf(&rbuf, msglen, &msg) == -1)
25
←
Assuming the condition is false→
26
←
Taking false branch→
	break;

switch (msgtype) {
27
←
Control jumps to 'case ASPA:'  at line 1039→
case SERIAL_NOTIFY:
	if (rtr_parse_notify(rs, &msg) == -1)
		return;
	break;
case CACHE_RESPONSE:
	if (rtr_parse_cache_response(rs, &msg) == -1)
		return;
	break;
case IPV4_PREFIX:
	if (rtr_parse_ipv4_prefix(rs, &msg) == -1)
		return;
	break;
case IPV6_PREFIX:
	if (rtr_parse_ipv6_prefix(rs, &msg) == -1)
		return;
	break;
case END_OF_DATA:
	if (rtr_parse_end_of_data(rs, &msg) == -1)
		return;
	break;
case CACHE_RESET:
	if (rtr_parse_cache_reset(rs, &msg) == -1)
		return;
	break;
case ROUTER_KEY:
	/* silently ignore router key */
	break;
case ERROR_REPORT:
	if (rtr_parse_error(rs, &msg) == -1) {
		/* no need to send back an error */
		return;
	}
	break;
case ASPA:
	if (rtr_parse_aspa(rs, &msg) == -1)
28
←
Calling 'rtr_parse_aspa'→
		return;
	break;
default:
	/* unreachable, checked in rtr_parse_header() */
	rtr_send_error(rs, &msg, UNSUPP_PDU_TYPE, "type %s",
	    log_rtr_type(msgtype));
	return;
}
}

memmove(&rs->r.buf, ibuf_data(&rbuf), ibuf_size(&rbuf));
rs->r.wpos = ibuf_size(&rbuf);
1053}

1055/*
* Simple FSM for RTR sessions
*/
1058static void
1059rtr_fsm(struct rtr_session *rs, enum rtr_event event)
1060{
enum rtr_state prev_state = rs->state;

switch (event) {
case RTR_EVNT_UNSUPP_PROTO_VERSION:
if (rs->state == RTR_STATE_NEGOTIATION) {
	if (rs->version > 0)
		rs->version--;
	else {
		/*
		 * can't downgrade anymore, fail connection
		 * RFC requires to send the error with our
		 * highest version number.
		 */
		rs->version = RTR_MAX_VERSION2;
		rtr_send_error(rs, NULL((void *)0), UNSUPP_PROTOCOL_VERS,
		    "negotiation failed");
		return;
	}

	if (rs->fd != -1) {
		/* flush buffers */
		msgbuf_clear(&rs->w);
		rs->r.wpos = 0;
		close(rs->fd);
		rs->fd = -1;
	}

	/* retry connection with lower version */
	timer_set(&rs->timers, Timer_Rtr_Retry, rs->retry);
	rtr_imsg_compose(IMSG_SOCKET_CONN, rs->id, 0, NULL((void *)0), 0);
	break;
}
/* FALLTHROUGH */
case RTR_EVNT_RESET_AND_CLOSE:
rtr_reset_cache(rs);
rtr_recalc();
/* FALLTHROUGH */
case RTR_EVNT_CON_CLOSE:
if (rs->state == RTR_STATE_NEGOTIATION) {
	/* consider any close event as a version failure. */
	rtr_fsm(rs, RTR_EVNT_UNSUPP_PROTO_VERSION);
	break;
}
if (rs->fd != -1) {
	/* flush buffers */
	msgbuf_clear(&rs->w);
	rs->r.wpos = 0;
	close(rs->fd);
	rs->fd = -1;
}
rs->state = RTR_STATE_CLOSED;
/* try to reopen session */
timer_set(&rs->timers, Timer_Rtr_Retry,
    arc4random_uniform(10));
break;
case RTR_EVNT_START:
case RTR_EVNT_TIMER_RETRY:
switch (rs->state) {
case RTR_STATE_ERROR:
	rtr_fsm(rs, RTR_EVNT_CON_CLOSE);
	return;
case RTR_STATE_CLOSED:
	timer_set(&rs->timers, Timer_Rtr_Retry, rs->retry);
	rtr_imsg_compose(IMSG_SOCKET_CONN, rs->id, 0, NULL((void *)0), 0);
	return;
default:
	break;
}
/* FALLTHROUGH */
case RTR_EVNT_CON_OPEN:
timer_stop(&rs->timers, Timer_Rtr_Retry);
if (rs->session_id == -1)
	rtr_send_reset_query(rs);
else
	rtr_send_serial_query(rs);
break;
case RTR_EVNT_SERIAL_NOTIFY:
/* schedule a refresh after a quick wait */
timer_set(&rs->timers, Timer_Rtr_Refresh,
    arc4random_uniform(10));
break;
case RTR_EVNT_TIMER_REFRESH:
/* send serial query */
rtr_send_serial_query(rs);
break;
case RTR_EVNT_TIMER_EXPIRE:
rtr_reset_cache(rs);
rtr_recalc();
break;
case RTR_EVNT_TIMER_ACTIVE:
log_warnx("rtr %s: activity timer fired", log_rtr(rs));
rtr_sem_release(rs->active_lock);
rtr_recalc();
rs->active_lock = 0;
break;
case RTR_EVNT_CACHE_RESPONSE:
rs->state = RTR_STATE_EXCHANGE;
timer_stop(&rs->timers, Timer_Rtr_Refresh);
timer_stop(&rs->timers, Timer_Rtr_Retry);
timer_set(&rs->timers, Timer_Rtr_Active, rs->active);
/* prevent rtr_recalc from running while active */
rs->active_lock = 1;
rtr_sem_acquire(rs->active_lock);
break;
case RTR_EVNT_END_OF_DATA:
/* start refresh and expire timers */
timer_set(&rs->timers, Timer_Rtr_Refresh, rs->refresh);
timer_set(&rs->timers, Timer_Rtr_Expire, rs->expire);
timer_stop(&rs->timers, Timer_Rtr_Active);
rs->state = RTR_STATE_ESTABLISHED;
rtr_sem_release(rs->active_lock);
rtr_recalc();
rs->active_lock = 0;
break;
case RTR_EVNT_CACHE_RESET:
rtr_reset_cache(rs);
rtr_recalc();
/* retry after a quick wait */
timer_set(&rs->timers, Timer_Rtr_Retry,
    arc4random_uniform(10));
break;
case RTR_EVNT_NO_DATA:
/* start retry timer */
timer_set(&rs->timers, Timer_Rtr_Retry, rs->retry);
/* stop refresh timer just to be sure */
timer_stop(&rs->timers, Timer_Rtr_Refresh);
rs->state = RTR_STATE_ESTABLISHED;
break;
case RTR_EVNT_SEND_ERROR:
rtr_reset_cache(rs);
rtr_recalc();
rs->state = RTR_STATE_ERROR;
/* flush receive buffer */
rs->r.wpos = 0;
break;
case RTR_EVNT_NEGOTIATION_DONE:
rs->state = RTR_STATE_ESTABLISHED;
break;
}

log_debug("rtr %s: state change %s -> %s, reason: %s",
   log_rtr(rs), rtr_statenames[prev_state], rtr_statenames[rs->state],
   rtr_eventnames[event]);
1204}

1206/*
* IO handler for RTR sessions
*/
1209static void
1210rtr_dispatch_msg(struct pollfd *pfd, struct rtr_session *rs)
1211{
ssize_t n;
int error;

if (pfd->revents & POLLHUP0x0010) {
10
←
Assuming the condition is false→
11
←
Taking false branch→
log_warnx("rtr %s: Connection closed, hangup", log_rtr(rs));
rtr_fsm(rs, RTR_EVNT_CON_CLOSE);
return;
}
if (pfd->revents & (POLLERR0x0008|POLLNVAL0x0020)) {
12
←
Assuming the condition is false→
log_warnx("rtr %s: Connection closed, error", log_rtr(rs));
rtr_fsm(rs, RTR_EVNT_CON_CLOSE);
return;
}
if (pfd->revents & POLLOUT0x0004 && rs->w.queued) {
13
←
Assuming the condition is false→
if ((error = ibuf_write(&rs->w)) == -1) {
	if (errno(*__errno()) != EAGAIN35) {
		log_warn("rtr %s: write error", log_rtr(rs));
		rtr_fsm(rs, RTR_EVNT_CON_CLOSE);
	}
}
if (error == 0)
	rtr_fsm(rs, RTR_EVNT_CON_CLOSE);
if (rs->w.queued == 0 && rs->state == RTR_STATE_ERROR)
	rtr_fsm(rs, RTR_EVNT_CON_CLOSE);
}
if (pfd->revents & POLLIN0x0001) {
14
←
Assuming the condition is true→
15
←
Taking true branch→
if ((n = read(rs->fd, rs->r.buf + rs->r.wpos,
16
←
Assuming the condition is false→
17
←
Taking false branch→
    sizeof(rs->r.buf) - rs->r.wpos)) == -1) {
	if (errno(*__errno()) != EINTR4 && errno(*__errno()) != EAGAIN35) {
		log_warn("rtr %s: read error", log_rtr(rs));
		rtr_fsm(rs, RTR_EVNT_CON_CLOSE);
	}
	return;
}
if (n == 0) {
18
←
Assuming 'n' is not equal to 0→
19
←
Taking false branch→
	rtr_fsm(rs, RTR_EVNT_CON_CLOSE);
	return;
}
rs->r.wpos += n;

/* new data arrived, try to process it */
rtr_process_msg(rs);
20
←
Calling 'rtr_process_msg'→
}

1256}

1258void
1259rtr_check_events(struct pollfd *pfds, size_t npfds)
1260{
struct rtr_session *rs;
struct timer *t;
time_t now;
size_t i = 0;

for (i = 0; i < npfds; i++) {
1
Assuming 'i' is < 'npfds'→
2
←
Loop condition is true.  Entering loop body→
if (pfds[i].revents == 0)
3
←
Assuming field 'revents' is not equal to 0→
4
←
Taking false branch→
	continue;
TAILQ_FOREACH(rs, &rtrs, entry)for((rs) = ((&rtrs)->tqh_first); (rs) != ((void *)0); (
rs) = ((rs)->entry.tqe_next))
5
←
Assuming 'rs' is not equal to null→
6
←
Loop condition is true.  Entering loop body→
	if (rs->fd == pfds[i].fd) {
7
←
Assuming 'rs->fd' is equal to 'pfds[i].fd'→
8
←
Taking true branch→
		rtr_dispatch_msg(&pfds[i], rs);
9
←
Calling 'rtr_dispatch_msg'→
		break;
	}
if (rs == NULL((void *)0))
	log_warnx("%s: unknown fd in pollfds", __func__);
}

/* run all timers */
now = getmonotime();
TAILQ_FOREACH(rs, &rtrs, entry)for((rs) = ((&rtrs)->tqh_first); (rs) != ((void *)0); (
rs) = ((rs)->entry.tqe_next))
if ((t = timer_nextisdue(&rs->timers, now)) != NULL((void *)0)) {
	log_debug("rtr %s: %s triggered", log_rtr(rs),
	    timernames[t->type]);
	/* stop timer so it does not trigger again */
	timer_stop(&rs->timers, t->type);
	switch (t->type) {
	case Timer_Rtr_Refresh:
		rtr_fsm(rs, RTR_EVNT_TIMER_REFRESH);
		break;
	case Timer_Rtr_Retry:
		rtr_fsm(rs, RTR_EVNT_TIMER_RETRY);
		break;
	case Timer_Rtr_Expire:
		rtr_fsm(rs, RTR_EVNT_TIMER_EXPIRE);
		break;
	case Timer_Rtr_Active:
		rtr_fsm(rs, RTR_EVNT_TIMER_ACTIVE);
		break;
	default:
		fatalx("King Bula lost in time");
	}
}
1303}

1305size_t
1306rtr_count(void)
1307{
struct rtr_session *rs;
size_t count = 0;

TAILQ_FOREACH(rs, &rtrs, entry)for((rs) = ((&rtrs)->tqh_first); (rs) != ((void *)0); (
rs) = ((rs)->entry.tqe_next))
count++;
return count;
1314}

1316size_t
1317rtr_poll_events(struct pollfd *pfds, size_t npfds, time_t *timeout)
1318{
struct rtr_session *rs;
time_t now = getmonotime();
size_t i = 0;

TAILQ_FOREACH(rs, &rtrs, entry)for((rs) = ((&rtrs)->tqh_first); (rs) != ((void *)0); (
rs) = ((rs)->entry.tqe_next)) {
time_t nextaction;
struct pollfd *pfd = pfds + i++;

if (i > npfds)
	fatalx("%s: too many sessions for pollfd", __func__);

if ((nextaction = timer_nextduein(&rs->timers, now)) != -1 &&
    nextaction < *timeout)
	*timeout = nextaction;

if (rs->state == RTR_STATE_CLOSED) {
	pfd->fd = -1;
	continue;
}

pfd->fd = rs->fd;
pfd->events = 0;

if (rs->w.queued)
	pfd->events |= POLLOUT0x0004;
if (rs->state >= RTR_STATE_ESTABLISHED)
	pfd->events |= POLLIN0x0001;
}

return i;
1349}

1351struct rtr_session *
1352rtr_new(uint32_t id, char *descr)
1353{
struct rtr_session *rs;

if ((rs = calloc(1, sizeof(*rs))) == NULL((void *)0))
fatal("RTR session %s", descr);

RB_INIT(&rs->roa_set)do { (&rs->roa_set)->rbh_root = ((void *)0); } while
 (0);
RB_INIT(&rs->aspa)do { (&rs->aspa)->rbh_root = ((void *)0); } while (
0);
RB_INIT(&rs->aspa_oldv6)do { (&rs->aspa_oldv6)->rbh_root = ((void *)0); } while
 (0);
TAILQ_INIT(&rs->timers)do { (&rs->timers)->tqh_first = ((void *)0); (&
rs->timers)->tqh_last = &(&rs->timers)->tqh_first
; } while (0);
msgbuf_init(&rs->w);

strlcpy(rs->descr, descr, sizeof(rs->descr));
rs->id = id;
rs->session_id = -1;
rs->version = RTR_MAX_VERSION2;
rs->refresh = RTR_DEFAULT_REFRESH3600;
rs->retry = RTR_DEFAULT_RETRY600;
rs->expire = RTR_DEFAULT_EXPIRE7200;
rs->active = RTR_DEFAULT_ACTIVE60;
rs->state = RTR_STATE_CLOSED;
rs->reconf_action = RECONF_REINIT;
rs->last_recv_error = NO_ERROR;
rs->last_sent_error = NO_ERROR;

/* make sure that some timer is running to abort bad sessions */
timer_set(&rs->timers, Timer_Rtr_Expire, rs->expire);

log_debug("rtr %s: new session, start", log_rtr(rs));
TAILQ_INSERT_TAIL(&rtrs, rs, entry)do { (rs)->entry.tqe_next = ((void *)0); (rs)->entry.tqe_prev
 = (&rtrs)->tqh_last; *(&rtrs)->tqh_last = (rs)
; (&rtrs)->tqh_last = &(rs)->entry.tqe_next; } while
 (0);
rtr_fsm(rs, RTR_EVNT_START);

return rs;
1386}

1388struct rtr_session *
1389rtr_get(uint32_t id)
1390{
struct rtr_session *rs;

TAILQ_FOREACH(rs, &rtrs, entry)for((rs) = ((&rtrs)->tqh_first); (rs) != ((void *)0); (
rs) = ((rs)->entry.tqe_next))
if (rs->id == id)
	return rs;
return NULL((void *)0);
1397}

1399void
1400rtr_free(struct rtr_session *rs)
1401{
if (rs == NULL((void *)0))
return;

rtr_reset_cache(rs);
rtr_fsm(rs, RTR_EVNT_CON_CLOSE);
timer_remove_all(&rs->timers);
free(rs);
1409}

1411void
1412rtr_open(struct rtr_session *rs, int fd)
1413{
if (rs->state != RTR_STATE_CLOSED &&
   rs->state != RTR_STATE_NEGOTIATION) {
log_warnx("rtr %s: bad session state", log_rtr(rs));
rtr_fsm(rs, RTR_EVNT_CON_CLOSE);
}

if (rs->state == RTR_STATE_CLOSED)
rs->version = RTR_MAX_VERSION2;

rs->fd = rs->w.fd = fd;
rs->state = RTR_STATE_NEGOTIATION;
rtr_fsm(rs, RTR_EVNT_CON_OPEN);
1426}

1428void
1429rtr_config_prep(void)
1430{
struct rtr_session *rs;

TAILQ_FOREACH(rs, &rtrs, entry)for((rs) = ((&rtrs)->tqh_first); (rs) != ((void *)0); (
rs) = ((rs)->entry.tqe_next))
rs->reconf_action = RECONF_DELETE;
1435}

1437void
1438rtr_config_merge(void)
1439{
struct rtr_session *rs, *nrs;

TAILQ_FOREACH_SAFE(rs, &rtrs, entry, nrs)for ((rs) = ((&rtrs)->tqh_first); (rs) != ((void *)0) &&
 ((nrs) = ((rs)->entry.tqe_next), 1); (rs) = (nrs))
if (rs->reconf_action == RECONF_DELETE) {
	TAILQ_REMOVE(&rtrs, rs, entry)do { if (((rs)->entry.tqe_next) != ((void *)0)) (rs)->entry
.tqe_next->entry.tqe_prev = (rs)->entry.tqe_prev; else (
&rtrs)->tqh_last = (rs)->entry.tqe_prev; *(rs)->
entry.tqe_prev = (rs)->entry.tqe_next; ; ; } while (0);
	rtr_free(rs);
}
1447}

1449void
1450rtr_config_keep(struct rtr_session *rs)
1451{
rs->reconf_action = RECONF_KEEP;
1453}

1455void
1456rtr_roa_merge(struct roa_tree *rt)
1457{
struct rtr_session *rs;
struct roa *roa;

TAILQ_FOREACH(rs, &rtrs, entry)for((rs) = ((&rtrs)->tqh_first); (rs) != ((void *)0); (
rs) = ((rs)->entry.tqe_next)) {
RB_FOREACH(roa, roa_tree, &rs->roa_set)for ((roa) = roa_tree_RB_MINMAX(&rs->roa_set, -1); (roa
) != ((void *)0); (roa) = roa_tree_RB_NEXT(roa))
	rtr_roa_insert(rt, roa);
}
1465}

1467void
1468rtr_aspa_merge(struct aspa_tree *at)
1469{
struct rtr_session *rs;
struct aspa_set *aspa;

TAILQ_FOREACH(rs, &rtrs, entry)for((rs) = ((&rtrs)->tqh_first); (rs) != ((void *)0); (
rs) = ((rs)->entry.tqe_next)) {
RB_FOREACH(aspa, aspa_tree, &rs->aspa)for ((aspa) = aspa_tree_RB_MINMAX(&rs->aspa, -1); (aspa
) != ((void *)0); (aspa) = aspa_tree_RB_NEXT(aspa))
	rtr_aspa_insert(at, aspa);
RB_FOREACH(aspa, aspa_tree, &rs->aspa_oldv6)for ((aspa) = aspa_tree_RB_MINMAX(&rs->aspa_oldv6, -1)
; (aspa) != ((void *)0); (aspa) = aspa_tree_RB_NEXT(aspa))
	rtr_aspa_insert(at, aspa);
}
1479}

1481void
1482rtr_shutdown(void)
1483{
struct rtr_session *rs, *nrs;

TAILQ_FOREACH_SAFE(rs, &rtrs, entry, nrs)for ((rs) = ((&rtrs)->tqh_first); (rs) != ((void *)0) &&
 ((nrs) = ((rs)->entry.tqe_next), 1); (rs) = (nrs))
rtr_free(rs);
1488}

1490void
1491rtr_show(struct rtr_session *rs, pid_t pid)
1492{
struct ctl_show_rtr msg;
struct ctl_timer ct;
u_int i;
time_t d;

memset(&msg, 0, sizeof(msg));

/* descr, remote_addr, local_addr and remote_port set by parent */
msg.version = rs->version;
msg.serial = rs->serial;
msg.refresh = rs->refresh;
msg.retry = rs->retry;
msg.expire = rs->expire;
msg.session_id = rs->session_id;
msg.last_sent_error = rs->last_sent_error;
msg.last_recv_error = rs->last_recv_error;
strlcpy(msg.last_sent_msg, rs->last_sent_msg,
   sizeof(msg.last_sent_msg));
strlcpy(msg.last_recv_msg, rs->last_recv_msg,
   sizeof(msg.last_recv_msg));

/* send back imsg */
rtr_imsg_compose(IMSG_CTL_SHOW_RTR, rs->id, pid, &msg, sizeof(msg));

/* send back timer imsgs */
for (i = 1; i < Timer_Max; i++) {
if (!timer_running(&rs->timers, i, &d))
	continue;
ct.type = i;
ct.val = d;
rtr_imsg_compose(IMSG_CTL_SHOW_TIMER, rs->id, pid,
    &ct, sizeof(ct));
}
1526}