russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
40 lines
1.4 KiB
ReStructuredText
40 lines
1.4 KiB
ReStructuredText
BIRD — CWE-407 Analysis
|
|
========================
|
|
|
|
.. contents:: :local:
|
|
|
|
Overview
|
|
--------
|
|
|
|
BIRD is an open-source Internet routing daemon implementing BGP, OSPF, RIP, Babel, and other
|
|
protocols. It is widely used as a software router in cloud infrastructure, notably as the BGP
|
|
daemon underpinning many Kubernetes CNI plugins including Calico, Cilium, and Flannel.
|
|
|
|
Status: **CLEAN** (scanned 2026-03-23)
|
|
---------------------------------------
|
|
|
|
Scan returned 1 candidate, triaged as false positive. No CWE-407 defects found.
|
|
|
|
Triage Notes
|
|
------------
|
|
|
|
The single candidate was ``WALK_LIST(ifa, p->iface_list)`` in ``ospf_flood_lsa()``
|
|
(``proto/ospf/lsupd.c:243``). The ``WALK_LIST`` macro is BIRD's linked-list iterator::
|
|
|
|
#define WALK_LIST(n,list) for(n=HEAD(list); NODE_VALID(n); n=NODE_NEXT(n))
|
|
|
|
This is pure iteration — no membership test inside the loop body. The function floods an LSA
|
|
to all interfaces then all neighbors: a necessary O(V+E) traversal, not a quadratic membership
|
|
check.
|
|
|
|
BIRD's core data structures (``lib/``) use sorted lists, skip lists, and hash tables for
|
|
routing table storage and lookup. No list-backed visited-set pattern was found in SPF, BGP
|
|
path processing, IS-IS, Babel, or filter evaluation.
|
|
|
|
The use of BIRD as the CNI BGP daemon in Kubernetes clusters is **not a risk vector** for
|
|
this defect class.
|
|
|
|
References
|
|
----------
|
|
|
|
* Scan result: ``tools/scan-results/bird.txt``
|