bgpd: Fix error handling when receiving BGP Prefix SID attribute

Without this patch, we always set the BGP Prefix SID attribute flag without
checking if it's malformed or not. RFC8669 says that this attribute MUST be discarded.

Also, this fixes the bgpd crash when a malformed Prefix SID attribute is received,
with malformed transitive flags and/or TLVs.

Reported-by: Iggy Frankovic <iggyfran@amazon.com>
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit ba6a8f1a31e1a88df2de69ea46068e8bd9b97138)

diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index 7144c4bfa73d72c6a74d880c245d6b0bada9d8e5..2e2845b8fa7eefd987542d7f318ae27a714aa92a 100644 (file)
--- a/bgpd/bgp_attr.c
+++ b/bgpd/bgp_attr.c
@@ -1400,6 +1400,7 @@ bgp_attr_malformed(struct bgp_attr_parser_args *args, uint8_t subcode,
        case BGP_ATTR_AS4_AGGREGATOR:
        case BGP_ATTR_AGGREGATOR:
        case BGP_ATTR_ATOMIC_AGGREGATE:
+       case BGP_ATTR_PREFIX_SID:
                return BGP_ATTR_PARSE_PROCEED;
 
        /* Core attributes, particularly ones which may influence route
@@ -3146,8 +3147,6 @@ enum bgp_attr_parse_ret bgp_attr_prefix_sid(struct bgp_attr_parser_args *args)
        struct attr *const attr = args->attr;
        enum bgp_attr_parse_ret ret;
 
-       attr->flag |= ATTR_FLAG_BIT(BGP_ATTR_PREFIX_SID);
-
        uint8_t type;
        uint16_t length;
        size_t headersz = sizeof(type) + sizeof(length);
@@ -3197,6 +3196,8 @@ enum bgp_attr_parse_ret bgp_attr_prefix_sid(struct bgp_attr_parser_args *args)
                }
        }
 
+       SET_FLAG(attr->flag, ATTR_FLAG_BIT(BGP_ATTR_PREFIX_SID));
+
        return BGP_ATTR_PARSE_PROCEED;
 }