BIRD — CWE-407 Analysis
========================

.. contents:: :local:

Overview
--------

BIRD is an open-source Internet routing daemon implementing BGP, OSPF, RIP, Babel, and other
protocols. It is widely used as a software router in cloud infrastructure, notably as the BGP
daemon underpinning many Kubernetes CNI plugins including Calico, Cilium, and Flannel.

Status: **CLEAN** (scanned 2026-03-23)
---------------------------------------

Scan returned 1 candidate, triaged as false positive. No CWE-407 defects found.

Triage Notes
------------

The single candidate was ``WALK_LIST(ifa, p->iface_list)`` in ``ospf_flood_lsa()``
(``proto/ospf/lsupd.c:243``). The ``WALK_LIST`` macro is BIRD's linked-list iterator::

   #define WALK_LIST(n,list) for(n=HEAD(list); NODE_VALID(n); n=NODE_NEXT(n))

This is pure iteration — no membership test inside the loop body. The function floods an LSA
to all interfaces then all neighbors: a necessary O(V+E) traversal, not a quadratic membership
check.

BIRD's core data structures (``lib/``) use sorted lists, skip lists, and hash tables for
routing table storage and lookup. No list-backed visited-set pattern was found in SPF, BGP
path processing, IS-IS, Babel, or filter evaluation.

The use of BIRD as the CNI BGP daemon in Kubernetes clusters is **not a risk vector** for
this defect class.

References
----------

* Scan result: ``tools/scan-results/bird.txt``
