/usr/src/usr.sbin/eigrpd/eigrpd.c

Bug Summary

File:	src/usr.sbin/eigrpd/eigrpd.c
Warning:	line 571, column 7 Use of memory after it is freed

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name eigrpd.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/eigrpd/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.sbin/eigrpd -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/eigrpd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/eigrpd/eigrpd.c

1/*	$OpenBSD: eigrpd.c,v 1.28 2021/01/19 10:53:25 claudio Exp $ */

3/*
* Copyright (c) 2015 Renato Westphal <renato@openbsd.org>
* Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org>
* Copyright (c) 2004 Esben Norby <norby@openbsd.org>
* Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

22#include <sys/types.h>
23#include <sys/wait.h>
24#include <sys/sysctl.h>

26#include <err.h>
27#include <errno(*__errno()).h>
28#include <fcntl.h>
29#include <pwd.h>
30#include <signal.h>
31#include <stdio.h>
32#include <stdlib.h>
33#include <string.h>
34#include <unistd.h>

36#include "eigrpd.h"
37#include "eigrpe.h"
38#include "rde.h"
39#include "log.h"

41static void		 main_sig_handler(int, short, void *);
42static __dead__attribute__((__noreturn__)) void	 usage(void);
43static __dead__attribute__((__noreturn__)) void	 eigrpd_shutdown(void);
44static pid_t		 start_child(enum eigrpd_process, char *, int, int, int,
	    char *);
46static void		 main_dispatch_eigrpe(int, short, void *);
47static void		 main_dispatch_rde(int, short, void *);
48static int		 main_imsg_send_ipc_sockets(struct imsgbuf *,
	    struct imsgbuf *);
50static int		 main_imsg_send_config(struct eigrpd_conf *);
51static int		 eigrp_reload(void);
52static int		 eigrp_sendboth(enum imsg_type, void *, uint16_t);
53static void		 merge_instances(struct eigrpd_conf *, struct eigrp *,
	    struct eigrp *);

56struct eigrpd_conf	*eigrpd_conf;

58static char		*conffile;
59static struct imsgev	*iev_eigrpe;
60static struct imsgev	*iev_rde;
61static pid_t		 eigrpe_pid;
62static pid_t		 rde_pid;

64/* ARGSUSED */
65static void
66main_sig_handler(int sig, short event, void *arg)
67{
/* signal handler rules don't apply, libevent decouples for us */
switch (sig) {
case SIGTERM15:
case SIGINT2:
eigrpd_shutdown();
/* NOTREACHED */
case SIGHUP1:
if (eigrp_reload() == -1)
	log_warnx("configuration reload failed");
else
	log_debug("configuration reloaded");
break;
default:
fatalx("unexpected signal");
/* NOTREACHED */
}
84}

86static __dead__attribute__((__noreturn__)) void
87usage(void)
88{
extern char *__progname;

fprintf(stderr(&__sF[2]), "usage: %s [-dnv] [-D macro=value]"
   " [-f file] [-s socket]\n",
   __progname);
exit(1);
95}

97struct eigrpd_global global;

99int
100main(int argc, char *argv[])
101{
struct event		 ev_sigint, ev_sigterm, ev_sighup;
char			*saved_argv0;
int			 ch;
int			 debug = 0, rflag = 0, eflag = 0;
int			 ipforwarding;
int			 mib[4];
size_t			 len;
char			*sockname;
int			 pipe_parent2eigrpe[2];
int			 pipe_parent2rde[2];

conffile = CONF_FILE"/etc/eigrpd.conf";
log_procname = "parent";
sockname = EIGRPD_SOCKET"/var/run/eigrpd.sock";

log_init(1);	/* log to stderr until daemonized */
log_verbose(1);

saved_argv0 = argv[0];
if (saved_argv0 == NULL((void *)0))
saved_argv0 = "eigrpd";

while ((ch = getopt(argc, argv, "dD:f:ns:vRE")) != -1) {
switch (ch) {
case 'd':
	debug = 1;
	break;
case 'D':
	if (cmdline_symset(optarg) < 0)
		log_warnx("could not parse macro definition %s",
		    optarg);
	break;
case 'f':
	conffile = optarg;
	break;
case 'n':
	global.cmd_opts |= EIGRPD_OPT_NOACTION0x00000004;
	break;
case 's':
	sockname = optarg;
	break;
case 'v':
	if (global.cmd_opts & EIGRPD_OPT_VERBOSE0x00000001)
		global.cmd_opts |= EIGRPD_OPT_VERBOSE20x00000002;
	global.cmd_opts |= EIGRPD_OPT_VERBOSE0x00000001;
	break;
case 'R':
	rflag = 1;
	break;
case 'E':
	eflag = 1;
	break;
default:
	usage();
	/* NOTREACHED */
}
}

argc -= optind;
argv += optind;
if (argc > 0 || (rflag && eflag))
usage();

if (rflag)
rde(debug, global.cmd_opts & EIGRPD_OPT_VERBOSE0x00000001);
else if (eflag)
eigrpe(debug, global.cmd_opts & EIGRPD_OPT_VERBOSE0x00000001, sockname);

mib[0] = CTL_NET4;
mib[1] = PF_INET2;
mib[2] = IPPROTO_IP0;
mib[3] = IPCTL_FORWARDING1;
len = sizeof(ipforwarding);
if (sysctl(mib, 4, &ipforwarding, &len, NULL((void *)0), 0) == -1)
log_warn("sysctl");

if (ipforwarding != 1)
log_warnx("WARNING: IP forwarding NOT enabled");

/* fetch interfaces early */
kif_init();

/* parse config file */
if ((eigrpd_conf = parse_config(conffile)) == NULL((void *)0)) {
kif_clear();
exit(1);
}

if (global.cmd_opts & EIGRPD_OPT_NOACTION0x00000004) {
if (global.cmd_opts & EIGRPD_OPT_VERBOSE0x00000001)
	print_config(eigrpd_conf);
else
	fprintf(stderr(&__sF[2]), "configuration OK\n");
kif_clear();
exit(0);
}

/* check for root privileges  */
if (geteuid())
errx(1, "need root privileges");

/* check for eigrpd user */
if (getpwnam(EIGRPD_USER"_eigrpd") == NULL((void *)0))
errx(1, "unknown user %s", EIGRPD_USER"_eigrpd");

log_init(debug);
log_verbose(global.cmd_opts & EIGRPD_OPT_VERBOSE0x00000001);

if (!debug)
daemon(1, 0);

log_info("startup");

if (socketpair(AF_UNIX1, SOCK_STREAM1 | SOCK_CLOEXEC0x8000 | SOCK_NONBLOCK0x4000,
   PF_UNSPEC0, pipe_parent2eigrpe) == -1)
fatal("socketpair");
if (socketpair(AF_UNIX1, SOCK_STREAM1 | SOCK_CLOEXEC0x8000 | SOCK_NONBLOCK0x4000,
   PF_UNSPEC0, pipe_parent2rde) == -1)
fatal("socketpair");

/* start children */
rde_pid = start_child(PROC_RDE_ENGINE, saved_argv0, pipe_parent2rde[1],
   debug, global.cmd_opts & EIGRPD_OPT_VERBOSE0x00000001, NULL((void *)0));
eigrpe_pid = start_child(PROC_EIGRP_ENGINE, saved_argv0,
   pipe_parent2eigrpe[1], debug, global.cmd_opts & EIGRPD_OPT_VERBOSE0x00000001,
   sockname);

event_init();

/* setup signal handler */
signal_set(&ev_sigint, SIGINT, main_sig_handler, NULL)event_set(&ev_sigint, 2, 0x08|0x10, main_sig_handler, ((void
 *)0));
signal_set(&ev_sigterm, SIGTERM, main_sig_handler, NULL)event_set(&ev_sigterm, 15, 0x08|0x10, main_sig_handler, (
(void *)0));
signal_set(&ev_sighup, SIGHUP, main_sig_handler, NULL)event_set(&ev_sighup, 1, 0x08|0x10, main_sig_handler, ((void
 *)0));
signal_add(&ev_sigint, NULL)event_add(&ev_sigint, ((void *)0));
signal_add(&ev_sigterm, NULL)event_add(&ev_sigterm, ((void *)0));
signal_add(&ev_sighup, NULL)event_add(&ev_sighup, ((void *)0));
signal(SIGPIPE13, SIG_IGN(void (*)(int))1);

/* setup pipes to children */
if ((iev_eigrpe = malloc(sizeof(struct imsgev))) == NULL((void *)0) ||
   (iev_rde = malloc(sizeof(struct imsgev))) == NULL((void *)0))
fatal(NULL((void *)0));
imsg_init(&iev_eigrpe->ibuf, pipe_parent2eigrpe[0]);
iev_eigrpe->handler = main_dispatch_eigrpe;
imsg_init(&iev_rde->ibuf, pipe_parent2rde[0]);
iev_rde->handler = main_dispatch_rde;

/* setup event handler */
iev_eigrpe->events = EV_READ0x02;
event_set(&iev_eigrpe->ev, iev_eigrpe->ibuf.fd, iev_eigrpe->events,
   iev_eigrpe->handler, iev_eigrpe);
event_add(&iev_eigrpe->ev, NULL((void *)0));

iev_rde->events = EV_READ0x02;
event_set(&iev_rde->ev, iev_rde->ibuf.fd, iev_rde->events,
   iev_rde->handler, iev_rde);
event_add(&iev_rde->ev, NULL((void *)0));

if (main_imsg_send_ipc_sockets(&iev_eigrpe->ibuf, &iev_rde->ibuf))
fatal("could not establish imsg links");
main_imsg_send_config(eigrpd_conf);

/* notify eigrpe about existing interfaces and addresses */
kif_redistribute();

if (kr_init(!(eigrpd_conf->flags & EIGRPD_FLAG_NO_FIB_UPDATE0x0001),
   eigrpd_conf->rdomain) == -1)
fatalx("kr_init failed");

if (pledge("stdio rpath inet sendfd", NULL((void *)0)) == -1)
fatal("pledge");

event_dispatch();

eigrpd_shutdown();
/* NOTREACHED */
return (0);
279}

281static __dead__attribute__((__noreturn__)) void
282eigrpd_shutdown(void)
283{
pid_t		 pid;
int		 status;

/* close pipes */
msgbuf_clear(&iev_eigrpe->ibuf.w);
close(iev_eigrpe->ibuf.fd);
msgbuf_clear(&iev_rde->ibuf.w);
close(iev_rde->ibuf.fd);

kr_shutdown();
config_clear(eigrpd_conf, PROC_MAIN);

log_debug("waiting for children to terminate");
do {
pid = wait(&status);
if (pid == -1) {
	if (errno(*__errno()) != EINTR4 && errno(*__errno()) != ECHILD10)
		fatal("wait");
} else if (WIFSIGNALED(status)(((status) & 0177) != 0177 && ((status) & 0177
) != 0))
	log_warnx("%s terminated; signal %d",
	    (pid == rde_pid) ? "route decision engine" :
	    "eigrp engine", WTERMSIG(status)(((status) & 0177)));
} while (pid != -1 || (pid == -1 && errno(*__errno()) == EINTR4));

free(iev_eigrpe);
free(iev_rde);

log_info("terminating");
exit(0);
313}

315static pid_t
316start_child(enum eigrpd_process p, char *argv0, int fd, int debug, int verbose,
  char *sockname)
318{
char	*argv[7];
int	 argc = 0;
pid_t	 pid;

switch (pid = fork()) {
case -1:
fatal("cannot fork");
case 0:
break;
default:
close(fd);
return (pid);
}

if (fd != 3) {
if (dup2(fd, 3) == -1)
	fatal("cannot setup imsg fd");
} else if (fcntl(fd, F_SETFD2, 0) == -1)
fatal("cannot setup imsg fd");

argv[argc++] = argv0;
switch (p) {
case PROC_MAIN:
fatalx("Can not start main process");
case PROC_RDE_ENGINE:
argv[argc++] = "-R";
break;
case PROC_EIGRP_ENGINE:
argv[argc++] = "-E";
break;
}
if (debug)
argv[argc++] = "-d";
if (verbose)
argv[argc++] = "-v";
if (sockname) {
argv[argc++] = "-s";
argv[argc++] = sockname;
}
argv[argc++] = NULL((void *)0);

execvp(argv0, argv);
fatal("execvp");
362}

364/* imsg handling */
365/* ARGSUSED */
366static void
367main_dispatch_eigrpe(int fd, short event, void *bula)
368{
struct imsgev		*iev = bula;
struct imsgbuf		*ibuf;
struct imsg		 imsg;
ssize_t			 n;
int			 shut = 0, verbose;

ibuf = &iev->ibuf;

if (event & EV_READ0x02) {
1
Assuming the condition is false→
2
←
Taking false branch→
if ((n = imsg_read(ibuf)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("imsg_read error");
if (n == 0)	/* connection closed */
	shut = 1;
}
if (event & EV_WRITE0x04) {
3
←
Assuming the condition is false→
4
←
Taking false branch→
if ((n = msgbuf_write(&ibuf->w)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("msgbuf_write");
if (n == 0)	/* connection closed */
	shut = 1;
}

for (;;) {
5
←
Loop condition is true.  Entering loop body→
if ((n = imsg_get(ibuf, &imsg)) == -1)
6
←
Assuming the condition is false→
7
←
Taking false branch→
	fatal("imsg_get");

if (n == 0)
8
←
Assuming 'n' is not equal to 0→
9
←
Taking false branch→
	break;

switch (imsg.hdr.type) {
10
←
Control jumps to 'case IMSG_CTL_RELOAD:'  at line 398→
case IMSG_CTL_RELOAD:
	if (eigrp_reload() == -1)
11
←
Calling 'eigrp_reload'→
		log_warnx("configuration reload failed");
	else
		log_debug("configuration reloaded");
	break;
case IMSG_CTL_FIB_COUPLE:
	kr_fib_couple();
	break;
case IMSG_CTL_FIB_DECOUPLE:
	kr_fib_decouple();
	break;
case IMSG_CTL_KROUTE:
	kr_show_route(&imsg);
	break;
case IMSG_CTL_IFINFO:
	if (imsg.hdr.len == IMSG_HEADER_SIZEsizeof(struct imsg_hdr))
		kr_ifinfo(NULL((void *)0), imsg.hdr.pid);
	else if (imsg.hdr.len == IMSG_HEADER_SIZEsizeof(struct imsg_hdr) + IFNAMSIZ16)
		kr_ifinfo(imsg.data, imsg.hdr.pid);
	else
		log_warnx("IFINFO request with wrong len");
	break;
case IMSG_CTL_LOG_VERBOSE:
	/* already checked by eigrpe */
	memcpy(&verbose, imsg.data, sizeof(verbose));
	log_verbose(verbose);
	break;
default:
	log_debug("%s: error handling imsg %d", __func__,
	    imsg.hdr.type);
	break;
}
imsg_free(&imsg);
}
if (!shut)
imsg_event_add(iev);
else {
/* this pipe is dead, so remove the event handler */
event_del(&iev->ev);
event_loopexit(NULL((void *)0));
}
440}

442/* ARGSUSED */
443static void
444main_dispatch_rde(int fd, short event, void *bula)
445{
struct imsgev	*iev = bula;
struct imsgbuf  *ibuf;
struct imsg	 imsg;
ssize_t		 n;
int		 shut = 0;

ibuf = &iev->ibuf;

if (event & EV_READ0x02) {
if ((n = imsg_read(ibuf)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("imsg_read error");
if (n == 0)	/* connection closed */
	shut = 1;
}
if (event & EV_WRITE0x04) {
if ((n = msgbuf_write(&ibuf->w)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("msgbuf_write");
if (n == 0)	/* connection closed */
	shut = 1;
}

for (;;) {
if ((n = imsg_get(ibuf, &imsg)) == -1)
	fatal("imsg_get");

if (n == 0)
	break;

switch (imsg.hdr.type) {
case IMSG_KROUTE_CHANGE:
	if (imsg.hdr.len - IMSG_HEADER_SIZEsizeof(struct imsg_hdr) !=
	    sizeof(struct kroute))
		fatalx("invalid size of IMSG_KROUTE_CHANGE");
	if (kr_change(imsg.data))
		log_warnx("%s: error changing route", __func__);
	break;
case IMSG_KROUTE_DELETE:
	if (imsg.hdr.len - IMSG_HEADER_SIZEsizeof(struct imsg_hdr) !=
	    sizeof(struct kroute))
		fatalx("invalid size of IMSG_KROUTE_DELETE");
	if (kr_delete(imsg.data))
		log_warnx("%s: error deleting route", __func__);
	break;

default:
	log_debug("%s: error handling imsg %d", __func__,
	    imsg.hdr.type);
	break;
}
imsg_free(&imsg);
}
if (!shut)
imsg_event_add(iev);
else {
/* this pipe is dead, so remove the event handler */
event_del(&iev->ev);
event_loopexit(NULL((void *)0));
}
504}

506int
507main_imsg_compose_eigrpe(int type, pid_t pid, void *data, uint16_t datalen)
508{
if (iev_eigrpe == NULL((void *)0))
return (-1);
return (imsg_compose_event(iev_eigrpe, type, 0, pid, -1, data, datalen));
512}

514int
515main_imsg_compose_rde(int type, pid_t pid, void *data, uint16_t datalen)
516{
if (iev_rde == NULL((void *)0))
return (-1);
return (imsg_compose_event(iev_rde, type, 0, pid, -1, data, datalen));
520}

522void
523imsg_event_add(struct imsgev *iev)
524{
iev->events = EV_READ0x02;
if (iev->ibuf.w.queued)
iev->events |= EV_WRITE0x04;

event_del(&iev->ev);
event_set(&iev->ev, iev->ibuf.fd, iev->events, iev->handler, iev);
event_add(&iev->ev, NULL((void *)0));
532}

534int
535imsg_compose_event(struct imsgev *iev, uint16_t type, uint32_t peerid,
  pid_t pid, int fd, void *data, uint16_t datalen)
537{
int	ret;

if ((ret = imsg_compose(&iev->ibuf, type, peerid,
   pid, fd, data, datalen)) != -1)
imsg_event_add(iev);
return (ret);
544}

546static int
547main_imsg_send_ipc_sockets(struct imsgbuf *eigrpe_buf, struct imsgbuf *rde_buf)
548{
int pipe_eigrpe2rde[2];

if (socketpair(AF_UNIX1, SOCK_STREAM1 | SOCK_CLOEXEC0x8000 | SOCK_NONBLOCK0x4000,
   PF_UNSPEC0, pipe_eigrpe2rde) == -1)
return (-1);

if (imsg_compose(eigrpe_buf, IMSG_SOCKET_IPC, 0, 0, pipe_eigrpe2rde[0],
   NULL((void *)0), 0) == -1)
return (-1);
if (imsg_compose(rde_buf, IMSG_SOCKET_IPC, 0, 0, pipe_eigrpe2rde[1],
   NULL((void *)0), 0) == -1)
return (-1);

return (0);
563}

565struct eigrp *
566eigrp_find(struct eigrpd_conf *xconf, int af, uint16_t as)
567{
struct eigrp	*eigrp;

TAILQ_FOREACH(eigrp, &xconf->instances, entry)for((eigrp) = ((&xconf->instances)->tqh_first); (eigrp
) != ((void *)0); (eigrp) = ((eigrp)->entry.tqe_next))
27
←
Loop condition is true.  Entering loop body→
if (eigrp->af == af && eigrp->as == as)
28
←
Use of memory after it is freed
	return (eigrp);

return (NULL((void *)0));
575}

577static int
578main_imsg_send_config(struct eigrpd_conf *xconf)
579{
struct eigrp		*eigrp;
struct eigrp_iface	*ei;

if (eigrp_sendboth(IMSG_RECONF_CONF, xconf, sizeof(*xconf)) == -1)
return (-1);

TAILQ_FOREACH(eigrp, &xconf->instances, entry)for((eigrp) = ((&xconf->instances)->tqh_first); (eigrp
) != ((void *)0); (eigrp) = ((eigrp)->entry.tqe_next)) {
if (eigrp_sendboth(IMSG_RECONF_INSTANCE, eigrp,
    sizeof(*eigrp)) == -1)
	return (-1);

TAILQ_FOREACH(ei, &eigrp->ei_list, e_entry)for((ei) = ((&eigrp->ei_list)->tqh_first); (ei) != (
(void *)0); (ei) = ((ei)->e_entry.tqe_next)) {
	if (eigrp_sendboth(IMSG_RECONF_IFACE, ei->iface,
	    sizeof(struct iface)) == -1)
		return (-1);

	if (eigrp_sendboth(IMSG_RECONF_EIGRP_IFACE, ei,
	    sizeof(*ei)) == -1)
		return (-1);
}
}

if (eigrp_sendboth(IMSG_RECONF_END, NULL((void *)0), 0) == -1)
return (-1);

return (0);
606}

608static int
609eigrp_reload(void)
610{
struct eigrpd_conf	*xconf;

if ((xconf = parse_config(conffile)) == NULL((void *)0))
12
←
Assuming the condition is false→
13
←
Taking false branch→
return (-1);

if (main_imsg_send_config(xconf) == -1)
14
←
Taking false branch→
return (-1);

merge_config(eigrpd_conf, xconf, PROC_MAIN);
15
←
Calling 'merge_config'→

return (0);
622}

624static int
625eigrp_sendboth(enum imsg_type type, void *buf, uint16_t len)
626{
if (main_imsg_compose_eigrpe(type, 0, buf, len) == -1)
return (-1);
if (main_imsg_compose_rde(type, 0, buf, len) == -1)
return (-1);
return (0);
632}

634void
635merge_config(struct eigrpd_conf *conf, struct eigrpd_conf *xconf,
  enum eigrpd_process proc)
637{
struct iface		*iface, *itmp, *xi;
struct eigrp		*eigrp, *etmp, *xe;

conf->rtr_id = xconf->rtr_id;
conf->flags = xconf->flags;
conf->rdomain= xconf->rdomain;
conf->fib_priority_internal = xconf->fib_priority_internal;
conf->fib_priority_external = xconf->fib_priority_external;
conf->fib_priority_summary = xconf->fib_priority_summary;

/* merge instances */
TAILQ_FOREACH_SAFE(eigrp, &conf->instances, entry, etmp)for ((eigrp) = ((&conf->instances)->tqh_first); (eigrp
) != ((void *)0) && ((etmp) = ((eigrp)->entry.tqe_next
), 1); (eigrp) = (etmp)) {
16
←
Assuming 'eigrp' is not equal to null→
17
←
Loop condition is true.  Entering loop body→
/* find deleted instances */
if ((xe = eigrp_find(xconf, eigrp->af, eigrp->as)) == NULL((void *)0)) {
18
←
Taking true branch→
	TAILQ_REMOVE(&conf->instances, eigrp, entry)do { if (((eigrp)->entry.tqe_next) != ((void *)0)) (eigrp)
->entry.tqe_next->entry.tqe_prev = (eigrp)->entry.tqe_prev
; else (&conf->instances)->tqh_last = (eigrp)->entry
.tqe_prev; *(eigrp)->entry.tqe_prev = (eigrp)->entry.tqe_next
; ; ; } while (0);
19
←
Assuming field 'tqe_next' is equal to null→
20
←
Taking false branch→
21
←
Loop condition is false.  Exiting loop→

	switch (proc) {
22
←
Control jumps to 'case PROC_MAIN:'  at line 661→
	case PROC_RDE_ENGINE:
		rde_instance_del(eigrp);
		break;
	case PROC_EIGRP_ENGINE:
		eigrpe_instance_del(eigrp);
		break;
	case PROC_MAIN:
		free(eigrp);
23
←
Memory is released→
		break;
24
←
 Execution continues on line 649→
	}
}
}
TAILQ_FOREACH_SAFE(xe, &xconf->instances, entry, etmp)for ((xe) = ((&xconf->instances)->tqh_first); (xe) !=
 ((void *)0) && ((etmp) = ((xe)->entry.tqe_next), 1
); (xe) = (etmp)) {
25
←
Loop condition is true.  Entering loop body→
/* find new instances */
if ((eigrp = eigrp_find(conf, xe->af, xe->as)) == NULL((void *)0)) {
26
←
Calling 'eigrp_find'→
	TAILQ_REMOVE(&xconf->instances, xe, entry)do { if (((xe)->entry.tqe_next) != ((void *)0)) (xe)->entry
.tqe_next->entry.tqe_prev = (xe)->entry.tqe_prev; else (
&xconf->instances)->tqh_last = (xe)->entry.tqe_prev
; *(xe)->entry.tqe_prev = (xe)->entry.tqe_next; ; ; } while
 (0);
	TAILQ_INSERT_TAIL(&conf->instances, xe, entry)do { (xe)->entry.tqe_next = ((void *)0); (xe)->entry.tqe_prev
 = (&conf->instances)->tqh_last; *(&conf->instances
)->tqh_last = (xe); (&conf->instances)->tqh_last
 = &(xe)->entry.tqe_next; } while (0);

	switch (proc) {
	case PROC_RDE_ENGINE:
		rde_instance_init(xe);
		break;
	case PROC_EIGRP_ENGINE:
		eigrpe_instance_init(xe);
		break;
	case PROC_MAIN:
		break;
	}
	continue;
}

/* update existing instances */
merge_instances(conf, eigrp, xe);
}

/* merge interfaces */
TAILQ_FOREACH_SAFE(iface, &conf->iface_list, entry, itmp)for ((iface) = ((&conf->iface_list)->tqh_first); (iface
) != ((void *)0) && ((itmp) = ((iface)->entry.tqe_next
), 1); (iface) = (itmp)) {
/* find deleted ifaces */
if ((xi = if_lookup(xconf, iface->ifindex)) == NULL((void *)0)) {
	TAILQ_REMOVE(&conf->iface_list, iface, entry)do { if (((iface)->entry.tqe_next) != ((void *)0)) (iface)
->entry.tqe_next->entry.tqe_prev = (iface)->entry.tqe_prev
; else (&conf->iface_list)->tqh_last = (iface)->
entry.tqe_prev; *(iface)->entry.tqe_prev = (iface)->entry
.tqe_next; ; ; } while (0);
	free(iface);
}
}
TAILQ_FOREACH_SAFE(xi, &xconf->iface_list, entry, itmp)for ((xi) = ((&xconf->iface_list)->tqh_first); (xi)
 != ((void *)0) && ((itmp) = ((xi)->entry.tqe_next
), 1); (xi) = (itmp)) {
/* find new ifaces */
if ((iface = if_lookup(conf, xi->ifindex)) == NULL((void *)0)) {
	TAILQ_REMOVE(&xconf->iface_list, xi, entry)do { if (((xi)->entry.tqe_next) != ((void *)0)) (xi)->entry
.tqe_next->entry.tqe_prev = (xi)->entry.tqe_prev; else (
&xconf->iface_list)->tqh_last = (xi)->entry.tqe_prev
; *(xi)->entry.tqe_prev = (xi)->entry.tqe_next; ; ; } while
 (0);
	TAILQ_INSERT_TAIL(&conf->iface_list, xi, entry)do { (xi)->entry.tqe_next = ((void *)0); (xi)->entry.tqe_prev
 = (&conf->iface_list)->tqh_last; *(&conf->iface_list
)->tqh_last = (xi); (&conf->iface_list)->tqh_last
 = &(xi)->entry.tqe_next; } while (0);
	continue;
}

/* TODO update existing ifaces */
}	

/* resend addresses to activate new interfaces */
if (proc == PROC_MAIN)
kif_redistribute();

free(xconf);
714}

716static void
717merge_instances(struct eigrpd_conf *xconf, struct eigrp *eigrp, struct eigrp *xe)
718{
/* TODO */
720}

722struct eigrpd_conf *
723config_new_empty(void)
724{
struct eigrpd_conf	*xconf;

xconf = calloc(1, sizeof(*xconf));
if (xconf == NULL((void *)0))
fatal(NULL((void *)0));

TAILQ_INIT(&xconf->instances)do { (&xconf->instances)->tqh_first = ((void *)0); (
&xconf->instances)->tqh_last = &(&xconf->
instances)->tqh_first; } while (0);
TAILQ_INIT(&xconf->iface_list)do { (&xconf->iface_list)->tqh_first = ((void *)0);
 (&xconf->iface_list)->tqh_last = &(&xconf->
iface_list)->tqh_first; } while (0);

return (xconf);
735}

737void
738config_clear(struct eigrpd_conf *conf, enum eigrpd_process proc)
739{
struct eigrpd_conf	*xconf;

/* merge current config with an empty config */
xconf = config_new_empty();
merge_config(conf, xconf, proc);

free(conf);
747}