[quagga-dev 4217] Re: possible ospfd bug: in state ExStart with routers that are neither DR nor BDR

[Paul Jakma]

On Wed, 5 Jul 2006, Andrew J. Schorr wrote:

> As far as I can tell, this is an actual problem.  We have in 
> ospf_nsm_event:
>
>  next_state = (*(NSM [nbr->state][event].func))(nbr);
>
> And note that the "func" could be nsm_kill_nbr (or another function that
> calls it).

Yep. But see immediately after that, it checks explicitely for events 
which result in nsm_kill_nbr and returns early ;), avoiding derefs of 
the deleted nbr.

The one problem is that it seems to have overlooked LLDown:

diff --git a/ospfd/ospf_nsm.c b/ospfd/ospf_nsm.c
index 11da503..fb736eb 100644
--- a/ospfd/ospf_nsm.c
+++ b/ospfd/ospf_nsm.c
@@ -857,7 +857,9 @@ ospf_nsm_event (struct thread *thread)

    /* When event is NSM_KillNbr or InactivityTimer, the neighbor is
       deleted. */
-  if (event == NSM_KillNbr || event == NSM_InactivityTimer)
+  if (event == NSM_KillNbr 
+      || event == NSM_InactivityTimer
+      || event == NSM_LLDown)
      {
        if (IS_DEBUG_OSPF (nsm, NSM_EVENTS))
  	zlog_debug ("NSM[%s:%s]: neighbor deleted",

It's a bit hacky though, I wonder could we add an additional 
NSM_Deleted dummy-state so that it'd be more obvious from the nsm 
table (or the result of an NSM_DependUpon action) when the 
early-return is required.

regards,
-- 
Paul Jakma	paul at clubi.ie	paul at jakma.org	Key ID: 64A2FF6A
Fortune:
QOTD:
 	Y'know how s'm people treat th'r body like a TEMPLE?
 	Well, I treat mine like 'n AMUSEMENT PARK...  S'great...