bgpd: Fix error handling when receiving BGP Prefix SID attribute

Without this patch, we always set the BGP Prefix SID attribute flag without
checking if it's malformed or not. RFC8669 says that this attribute MUST be discarded.

Also, this fixes the bgpd crash when a malformed Prefix SID attribute is received,
with malformed transitive flags and/or TLVs.

Reported-by: Iggy Frankovic <iggyfran@amazon.com>
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit ba6a8f1a31e1a88df2de69ea46068e8bd9b97138)

diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index 3b8f8f0f4d6e6dbec3972aba12fe4a44ab2708b6..2120b1eb046e09abaff1e9881a25d5850d1bc530 100644 (file)
--- a/bgpd/bgp_attr.c
+++ b/bgpd/bgp_attr.c
@@ -1285,6 +1285,7 @@ bgp_attr_malformed(struct bgp_attr_parser_args *args, uint8_t subcode,
        case BGP_ATTR_AS4_AGGREGATOR:
        case BGP_ATTR_AGGREGATOR:
        case BGP_ATTR_ATOMIC_AGGREGATE:
+       case BGP_ATTR_PREFIX_SID:
                return BGP_ATTR_PARSE_PROCEED;
 
        /* Core attributes, particularly ones which may influence route
@@ -2918,8 +2919,6 @@ enum bgp_attr_parse_ret bgp_attr_prefix_sid(struct bgp_attr_parser_args *args)
        struct attr *const attr = args->attr;
        enum bgp_attr_parse_ret ret;
 
-       attr->flag |= ATTR_FLAG_BIT(BGP_ATTR_PREFIX_SID);
-
        uint8_t type;
        uint16_t length;
        size_t headersz = sizeof(type) + sizeof(length);
@@ -2969,6 +2968,8 @@ enum bgp_attr_parse_ret bgp_attr_prefix_sid(struct bgp_attr_parser_args *args)
                }
        }
 
+       SET_FLAG(attr->flag, ATTR_FLAG_BIT(BGP_ATTR_PREFIX_SID));
+
        return BGP_ATTR_PARSE_PROCEED;
 }