bgpd: flowspec: remove sizelimit check applied to the wrong length field (issue 18557)

Section 4.1 of RFC8955 defines how the length field of flowspec NLRIs is encoded.
The method use implies a maximum length of 4095 for a single flowspec NLRI.
However, in bgp_flowspec.c, we check the length attribute of the bgp_nlri structure against this maximum value, which actually is the *total* length of all NLRI included in the considered MP_REACH_NLRI path attribute.
Due to this confusion, frr would reject valid announces that contain many flowspec NLRIs, when their cummulative length exceeds 4095, and close the session.
The proposed change removes that check entirely. Indeed, there is no need to check the length field of each invidual NLRI because the method employed make it impossible to encode a length greater than 4095.

Signed-off-by: Stephane Poignant <stephane.poignant@proton.ch>

diff --git a/bgpd/bgp_flowspec.c b/bgpd/bgp_flowspec.c
index bd04970fd58cdc533c5cd8bf55ba40ef14e22b7a..6f1780665d18eaa23e96da9e049c36f3de980d43 100644 (file)
--- a/bgpd/bgp_flowspec.c
+++ b/bgpd/bgp_flowspec.c
@@ -105,13 +105,6 @@ int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
        if (!attr)
                withdraw = true;
 
-       if (packet->length >= FLOWSPEC_NLRI_SIZELIMIT_EXTENDED) {
-               flog_err(EC_BGP_FLOWSPEC_PACKET,
-                        "BGP flowspec nlri length maximum reached (%u)",
-                        packet->length);
-               return BGP_NLRI_PARSE_ERROR_FLOWSPEC_NLRI_SIZELIMIT;
-       }
-
        for (; pnt < lim; pnt += psize) {
                /* Clear prefix structure. */
                memset(&p, 0, sizeof(p));

diff --git a/bgpd/bgp_flowspec_private.h b/bgpd/bgp_flowspec_private.h
index 049cb6df770a1d575c43b6a8242171c816721414..fa611bd37249c8d1ab55503af7d9c63d3a277f04 100644 (file)
--- a/bgpd/bgp_flowspec_private.h
+++ b/bgpd/bgp_flowspec_private.h
@@ -7,7 +7,6 @@
 #define _FRR_BGP_FLOWSPEC_PRIVATE_H
 
 #define FLOWSPEC_NLRI_SIZELIMIT                        240
-#define FLOWSPEC_NLRI_SIZELIMIT_EXTENDED               4095
 
 /* Flowspec raffic action bit*/
 #define FLOWSPEC_TRAFFIC_ACTION_TERMINAL       1

diff --git a/bgpd/bgp_route.h b/bgpd/bgp_route.h
index 5c10a865d1c545e157d78666fd7f90c9569aebd4..af8c1110433961624f749842525f0300149a7584 100644 (file)
--- a/bgpd/bgp_route.h
+++ b/bgpd/bgp_route.h
@@ -88,7 +88,6 @@ enum bgp_show_adj_route_type {
 #define BGP_NLRI_PARSE_ERROR_EVPN_TYPE4_SIZE -9
 #define BGP_NLRI_PARSE_ERROR_EVPN_TYPE5_SIZE -10
 #define BGP_NLRI_PARSE_ERROR_FLOWSPEC_IPV6_NOT_SUPPORTED -11
-#define BGP_NLRI_PARSE_ERROR_FLOWSPEC_NLRI_SIZELIMIT -12
 #define BGP_NLRI_PARSE_ERROR_FLOWSPEC_BAD_FORMAT -13
 #define BGP_NLRI_PARSE_ERROR_ADDRESS_FAMILY -14
 #define BGP_NLRI_PARSE_ERROR_EVPN_TYPE1_SIZE -15