-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
lib: prioritize VRF creation #6919
Conversation
Outdated results 💚Basic BGPD CI results: SUCCESS, 0 tests failed
For details, please contact louberger |
Continuous Integration Result: SUCCESSFULContinuous Integration Result: SUCCESSFULCongratulations, this patch passed basic tests Tested-by: NetDEF / OpenSourceRouting.org CI System CI System Testrun URL: https://ci1.netdef.org/browse/FRR-FRRPULLREQ-13626/ This is a comment from an automated CI system. Warnings Generated during build:Checkout code: Successful with additional warnings
Warnings Generated during build:Debian 10 amd64 build: Successful with additional warningsDebian Package lintian failed for Debian 10 amd64 build:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, except for one issue.
The other case to handle is when a VRF and all its associated interfaces are deleted in the same transaction. In that case, if we process the VRF deletion first (due to its better priority), we'll have a problem in the interface destroy()
callback since nb_running_get_entry()
will return a dangling pointer. To address that issue you might need to change that callback to check if the interface VRF still exists in the configuration. If not, then bail out earlier (assuming the interface was already deleted), otherwise proceed with the interface deletion. Long term we might need some enhancements in the NB layer to better deal with this kind of transaction ordering issues.
72c6601
to
0f62605
Compare
@rwestphal can you double check me? Pretty sure I handled the case you mentioned now in |
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDSee below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: FailedDebian 8 amd64 build: Failed (click for details)Debian 8 amd64 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI008BLD/config.log/config.log.gzMake failed for Debian 8 amd64 build:
Debian 8 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI008BLD/config.status/config.status FreeBSD 11 amd64 build: Failed (click for details)Make failed for FreeBSD 11 amd64 build:
FreeBSD 11 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI009BUILD/config.status/config.status Debian 10 amd64 build: Failed (click for details)Debian 10 amd64 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/DEB10BUILD/config.log/config.log.gzMake failed for Debian 10 amd64 build:
Debian 10 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/DEB10BUILD/config.status/config.status Ubuntu 18.04 arm8 build: Failed (click for details)Ubuntu 18.04 arm8 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/U18ARM8BUILD/config.status/config.status Ubuntu 18.04 arm8 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/U18ARM8BUILD/config.log/config.log.gzMake failed for Ubuntu 18.04 arm8 build:
OpenBSD 6 amd64 build: Failed (click for details)Make failed for OpenBSD 6 amd64 build:
OpenBSD 6 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI011BUILD/config.status/config.status Ubuntu 16.04 amd64 build: Failed (click for details)Make failed for Ubuntu 16.04 amd64 build:
Ubuntu 16.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI014BUILD/config.status/config.status FreeBSD 12 amd64 build: Failed (click for details)Make failed for FreeBSD 12 amd64 build:
FreeBSD 12 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/FBSD12AMD64/config.status/config.status Ubuntu 18.04 amd64 build: Failed (click for details)Make failed for Ubuntu 18.04 amd64 build:
Ubuntu 18.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/U1804AMD64/config.status/config.status CentOS 8 amd64 build: Failed (click for details)CentOS 8 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CENTOS8BUILD/config.status/config.statusMake failed for CentOS 8 amd64 build:
CentOS 8 amd64 build: Unknown Log <config.log.gz> Ubuntu 16.04 arm7 build: Failed (click for details)Ubuntu 16.04 arm7 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI101BUILD/config.status/config.status Ubuntu 16.04 arm7 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI101BUILD/config.log/config.log.gzMake failed for Ubuntu 16.04 arm7 build:
Ubuntu 18.04 ppc64le build: Failed (click for details)Make failed for Ubuntu 18.04 ppc64le build:
Ubuntu 18.04 ppc64le build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/U1804PPC64LEBUILD/config.status/config.status Ubuntu 20.04 amd64 build: Failed (click for details)Ubuntu 20.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/U2004AMD64BUILD/config.status/config.statusMake failed for Ubuntu 20.04 amd64 build:
Ubuntu 20.04 amd64 build: Unknown Log <config.log.gz> Ubuntu 18.04 arm7 build: Failed (click for details)Make failed for Ubuntu 18.04 arm7 build:
Ubuntu 18.04 arm7 build: Unknown Log <config.log.gz> NetBSD 8 amd64 build: Failed (click for details)NetBSD 8 amd64 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI012BUILD/config.log/config.log.gzMake failed for NetBSD 8 amd64 build:
NetBSD 8 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI012BUILD/config.status/config.status Debian 9 amd64 build: Failed (click for details)Make failed for Debian 9 amd64 build:
Debian 9 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI021BUILD/config.status/config.status Ubuntu 16.04 arm8 build: Failed (click for details)Make failed for Ubuntu 16.04 arm8 build:
Ubuntu 16.04 arm8 build: Unknown Log <config.log.gz> Fedora 29 amd64 build: Failed (click for details)Make failed for Fedora 29 amd64 build:
Fedora 29 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/F29BUILD/config.status/config.status Debian 11 amd64 build: Failed (click for details)Debian 11 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/DEB11AMD64/config.status/config.statusMake failed for Debian 11 amd64 build:
Debian 11 amd64 build: Unknown Log <config.log.gz> Ubuntu 16.04 i386 build: Failed (click for details)Make failed for Ubuntu 16.04 i386 build:
Ubuntu 16.04 i386 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/U1604I386/config.status/config.status Successful on other platforms/tests
Warnings Generated during build:Checkout code: Successful with additional warningsDebian 8 amd64 build: Failed (click for details)Debian 8 amd64 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI008BLD/config.log/config.log.gzMake failed for Debian 8 amd64 build:
Debian 8 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI008BLD/config.status/config.status FreeBSD 11 amd64 build: Failed (click for details)Make failed for FreeBSD 11 amd64 build:
FreeBSD 11 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI009BUILD/config.status/config.status Debian 10 amd64 build: Failed (click for details)Debian 10 amd64 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/DEB10BUILD/config.log/config.log.gzMake failed for Debian 10 amd64 build:
Debian 10 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/DEB10BUILD/config.status/config.status Ubuntu 18.04 arm8 build: Failed (click for details)Ubuntu 18.04 arm8 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/U18ARM8BUILD/config.status/config.status Ubuntu 18.04 arm8 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/U18ARM8BUILD/config.log/config.log.gzMake failed for Ubuntu 18.04 arm8 build:
OpenBSD 6 amd64 build: Failed (click for details)Make failed for OpenBSD 6 amd64 build:
OpenBSD 6 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI011BUILD/config.status/config.status Ubuntu 16.04 amd64 build: Failed (click for details)Make failed for Ubuntu 16.04 amd64 build:
Ubuntu 16.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI014BUILD/config.status/config.status FreeBSD 12 amd64 build: Failed (click for details)Make failed for FreeBSD 12 amd64 build:
FreeBSD 12 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/FBSD12AMD64/config.status/config.status Ubuntu 18.04 amd64 build: Failed (click for details)Make failed for Ubuntu 18.04 amd64 build:
Ubuntu 18.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/U1804AMD64/config.status/config.status CentOS 8 amd64 build: Failed (click for details)CentOS 8 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CENTOS8BUILD/config.status/config.statusMake failed for CentOS 8 amd64 build:
CentOS 8 amd64 build: Unknown Log <config.log.gz> Ubuntu 16.04 arm7 build: Failed (click for details)Ubuntu 16.04 arm7 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI101BUILD/config.status/config.status Ubuntu 16.04 arm7 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI101BUILD/config.log/config.log.gzMake failed for Ubuntu 16.04 arm7 build:
Ubuntu 18.04 ppc64le build: Failed (click for details)Make failed for Ubuntu 18.04 ppc64le build:
Ubuntu 18.04 ppc64le build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/U1804PPC64LEBUILD/config.status/config.status Ubuntu 20.04 amd64 build: Failed (click for details)Ubuntu 20.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/U2004AMD64BUILD/config.status/config.statusMake failed for Ubuntu 20.04 amd64 build:
Ubuntu 20.04 amd64 build: Unknown Log <config.log.gz> Ubuntu 18.04 arm7 build: Failed (click for details)Make failed for Ubuntu 18.04 arm7 build:
Ubuntu 18.04 arm7 build: Unknown Log <config.log.gz> NetBSD 8 amd64 build: Failed (click for details)NetBSD 8 amd64 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI012BUILD/config.log/config.log.gzMake failed for NetBSD 8 amd64 build:
NetBSD 8 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI012BUILD/config.status/config.status Debian 9 amd64 build: Failed (click for details)Make failed for Debian 9 amd64 build:
Debian 9 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/CI021BUILD/config.status/config.status Ubuntu 16.04 arm8 build: Failed (click for details)Make failed for Ubuntu 16.04 arm8 build:
Ubuntu 16.04 arm8 build: Unknown Log <config.log.gz> Fedora 29 amd64 build: Failed (click for details)Make failed for Fedora 29 amd64 build:
Fedora 29 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/F29BUILD/config.status/config.status Debian 11 amd64 build: Failed (click for details)Debian 11 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/DEB11AMD64/config.status/config.statusMake failed for Debian 11 amd64 build:
Debian 11 amd64 build: Unknown Log <config.log.gz> Ubuntu 16.04 i386 build: Failed (click for details)Make failed for Ubuntu 16.04 i386 build:
Ubuntu 16.04 i386 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18237/artifact/U1604I386/config.status/config.status
|
Bump the priority of VRF creation; this way VRF related config is applied before other things, specifically interfaces, which need VRFs to exist. Signed-off-by: Quentin Young <qlyoung@nvidia.com>
0f62605
to
3bd3426
Compare
Outdated results 💚Basic BGPD CI results: SUCCESS, 0 tests failed
For details, please contact louberger |
You didn't handle this case. Please, don't merge this PR. I'll look at it more deeply later this week. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Commented earlier.
Okay, so if this is true then we have a latent use after free. Right? Can you elaborate on the code path that creates that UAF? |
Continuous Integration Result: SUCCESSFULCongratulations, this patch passed basic tests Tested-by: NetDEF / OpenSourceRouting.org CI System CI System Testrun URL: https://ci1.netdef.org/browse/FRR-FRRPULLREQ-18238/ This is a comment from an automated CI system. Warnings Generated during build:Checkout code: Successful with additional warnings
|
💚 Basic BGPD CI results: SUCCESS, 0 tests failedResults table
For details, please contact louberger |
Steps to reproduce:
This is actually not related to this PR at all. I'll have a look at it tomorrow. |
Perhaps we need to check that interface is not |
@qlyoung I raised a PR to fix stale pointers - #8426. Please, take a look. Regarding this PR: The checks you added to For the priority change - could you, please, elaborate on the use-case that won't work without this change? |
I understood all this from your previous comment, like I said, this PR is wrong for that reason.
When applying a candidate config that contains both interface and vrf creations, with the interfaces being members of those vrfs, if we try to create the interfaces before the VRFs then the VRF object won't exist and the apply will fail. By prioritizing the VRFs so the get created first we sidestep this problem. I was seeing it applying candidate configs over gRPC. |
Bump the priority of VRF creation; this way VRF related config is
applied before other things, specifically interfaces, which need VRFs to
exist.
Signed-off-by: Quentin Young qlyoung@nvidia.com