From ba6a8f1a31e1a88df2de69ea46068e8bd9b97138 Mon Sep 17 00:00:00 2001 From: Donatas Abraitis Date: Wed, 27 Mar 2024 18:42:56 +0200 Subject: [PATCH] bgpd: Fix error handling when receiving BGP Prefix SID attribute Without this patch, we always set the BGP Prefix SID attribute flag without checking if it's malformed or not. RFC8669 says that this attribute MUST be discarded. Also, this fixes the bgpd crash when a malformed Prefix SID attribute is received, with malformed transitive flags and/or TLVs. Reported-by: Iggy Frankovic Signed-off-by: Donatas Abraitis --- bgpd/bgp_attr.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c index 5320a5f57e7d..6c886b006131 100644 --- a/bgpd/bgp_attr.c +++ b/bgpd/bgp_attr.c @@ -1398,6 +1398,7 @@ bgp_attr_malformed(struct bgp_attr_parser_args *args, uint8_t subcode, case BGP_ATTR_AS4_AGGREGATOR: case BGP_ATTR_AGGREGATOR: case BGP_ATTR_ATOMIC_AGGREGATE: + case BGP_ATTR_PREFIX_SID: return BGP_ATTR_PARSE_PROCEED; /* Core attributes, particularly ones which may influence route @@ -3163,8 +3164,6 @@ enum bgp_attr_parse_ret bgp_attr_prefix_sid(struct bgp_attr_parser_args *args) struct attr *const attr = args->attr; enum bgp_attr_parse_ret ret; - attr->flag |= ATTR_FLAG_BIT(BGP_ATTR_PREFIX_SID); - uint8_t type; uint16_t length; size_t headersz = sizeof(type) + sizeof(length); @@ -3214,6 +3213,8 @@ enum bgp_attr_parse_ret bgp_attr_prefix_sid(struct bgp_attr_parser_args *args) } } + SET_FLAG(attr->flag, ATTR_FLAG_BIT(BGP_ATTR_PREFIX_SID)); + return BGP_ATTR_PARSE_PROCEED; }