Upstream bugs in FRR’s BFD daemon
Six bugs found while pointing an external dataplane at FRR, each written up from the issue and the fix. Buffer accounting, a transport that never worked, and two cases where the instrumentation agreed with the wrong answer.
- Two bytes of padding, and a transport that never worked
bfdd's UNIX socket dataplane transport failed every connect with EINVAL. The address was correct; the length was two bytes too long, and only AF_UNIX cares.
- How 8KB of buffer silently lost BFD sessions
A distributed-BFD dataplane registration burst overflowed an 8KB output buffer and stranded every session past the limit. Neither implementation owned them, and nothing logged it.
- Deleting sessions into a buffer nobody would flush
On shutdown bfdd enqueues a delete for every dataplane session, then closes the socket and frees the buffer with the messages still in it. Fixing an earlier bug turned a total loss into a partial one, which was worse.
- A read of zero bytes that looked like a closed socket
Running "show bfd peers counters" killed the dataplane connection on every other invocation. Two defects combined: consumed buffer space was never reclaimed, and a full buffer produced a zero-length read that was read as EOF.
- The RFC says negotiate, but nobody was listening
BFD echo packets must not be sent faster than the peer says it can receive them. For sessions handed to a dataplane, bfdd skipped that negotiation entirely and sent whatever was configured locally.
- Enabling echo mode took the session down
A hardening fix made IPv6 echo reflection conditional on knowing the session. The sending side never chose its source address, so the guard rejected legitimate echoes and the session failed.