From: Donatas Abraitis <donatas.abraitis@gmail.com>
Date: Mon, 15 Apr 2019 20:53:20 +0000 (+0300)
Subject: bgpd: Do not send UPDATE message with maximum-prefix
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=564a93923c72f5d40b0ab088b199c61fd12f2681;p=matthieu%2Ffrr.git

bgpd: Do not send UPDATE message with maximum-prefix

When using maximum-prefix and count is overflow BGP
sends UPDATE message:

Apr 15 20:45:06 exit1-debian-9 bgpd[9818]: 192.168.0.2 [Error] Error parsing NLRI
Apr 15 20:45:06 exit1-debian-9 bgpd[9818]: %NOTIFICATION: sent to neighbor 192.168.0.2 3/10 (UPDATE Message Error/Invalid Network Field) 0 bytes

Signed-off-by: Donatas Abraitis <donatas.abraitis@gmail.com>
---

diff --git a/bgpd/bgp_evpn.c b/bgpd/bgp_evpn.c
index 49808e7cdd..1b4a46cfd2 100644
--- a/bgpd/bgp_evpn.c
+++ b/bgpd/bgp_evpn.c
@@ -3783,7 +3783,7 @@ int bgp_nlri_parse_evpn(struct peer *peer, struct attr *attr,
 		if (addpath_encoded) {
 			/* When packet overflow occurs return immediately. */
 			if (pnt + BGP_ADDPATH_ID_LEN > lim)
-				return -1;
+				return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
 
 			addpath_id = ntohl(*((uint32_t *)pnt));
 			pnt += BGP_ADDPATH_ID_LEN;
@@ -3791,14 +3791,14 @@ int bgp_nlri_parse_evpn(struct peer *peer, struct attr *attr,
 
 		/* All EVPN NLRI types start with type and length. */
 		if (pnt + 2 > lim)
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_EVPN_MISSING_TYPE;
 
 		rtype = *pnt++;
 		psize = rlen = *pnt++;
 
 		/* When packet overflow occur return immediately. */
 		if (pnt + psize > lim)
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
 
 		switch (rtype) {
 		case BGP_EVPN_MAC_IP_ROUTE:
@@ -3808,7 +3808,7 @@ int bgp_nlri_parse_evpn(struct peer *peer, struct attr *attr,
 				zlog_err(
 					"%u:%s - Error in processing EVPN type-2 NLRI size %d",
 					peer->bgp->vrf_id, peer->host, psize);
-				return -1;
+				return BGP_NLRI_PARSE_ERROR_EVPN_TYPE2_SIZE;
 			}
 			break;
 
@@ -3819,7 +3819,7 @@ int bgp_nlri_parse_evpn(struct peer *peer, struct attr *attr,
 				zlog_err(
 					"%u:%s - Error in processing EVPN type-3 NLRI size %d",
 					peer->bgp->vrf_id, peer->host, psize);
-				return -1;
+				return BGP_NLRI_PARSE_ERROR_EVPN_TYPE3_SIZE;
 			}
 			break;
 
@@ -3829,7 +3829,7 @@ int bgp_nlri_parse_evpn(struct peer *peer, struct attr *attr,
 				zlog_err(
 					"%u:%s - Error in processing EVPN type-5 NLRI size %d",
 					peer->bgp->vrf_id, peer->host, psize);
-				return -1;
+				return BGP_NLRI_PARSE_ERROR_EVPN_TYPE5_SIZE;
 			}
 			break;
 
@@ -3840,9 +3840,9 @@ int bgp_nlri_parse_evpn(struct peer *peer, struct attr *attr,
 
 	/* Packet length consistency check. */
 	if (pnt != lim)
-		return -1;
+		return BGP_NLRI_PARSE_ERROR_PACKET_LENGTH;
 
-	return 0;
+	return BGP_NLRI_PARSE_OK;
 }
 
 /*
diff --git a/bgpd/bgp_flowspec.c b/bgpd/bgp_flowspec.c
index 5f13e6a9dc..31d72ed113 100644
--- a/bgpd/bgp_flowspec.c
+++ b/bgpd/bgp_flowspec.c
@@ -104,13 +104,13 @@ int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
 
 	if (afi == AFI_IP6) {
 		zlog_err("BGP flowspec IPv6 not supported");
-		return -1;
+		return BGP_NLRI_PARSE_ERROR_FLOWSPEC_IPV6_NOT_SUPPORTED;
 	}
 
 	if (packet->length >= FLOWSPEC_NLRI_SIZELIMIT) {
 		zlog_err("BGP flowspec nlri length maximum reached (%u)",
 			 packet->length);
-		return -1;
+		return BGP_NLRI_PARSE_ERROR_FLOWSPEC_NLRI_SIZELIMIT;
 	}
 
 	for (; pnt < lim; pnt += psize) {
@@ -119,7 +119,7 @@ int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
 
 		/* All FlowSpec NLRI begin with length. */
 		if (pnt + 1 > lim)
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
 
 		psize = rlen = *pnt++;
 
@@ -127,11 +127,11 @@ int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
 		if (pnt + psize > lim) {
 			zlog_err("Flowspec NLRI length inconsistent ( size %u seen)",
 				 psize);
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
 		}
 		if (bgp_fs_nlri_validate(pnt, psize) < 0) {
 			zlog_err("Bad flowspec format or NLRI options not supported");
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_FLOWSPEC_BAD_FORMAT;
 		}
 		p.family = AF_FLOWSPEC;
 		p.prefixlen = 0;
@@ -183,8 +183,8 @@ int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
 		if (ret) {
 			zlog_err("Flowspec NLRI failed to be %s.",
 				 attr ? "added" : "withdrawn");
-			return -1;
+			return BGP_NLRI_PARSE_ERROR;
 		}
 	}
-	return 0;
+	return BGP_NLRI_PARSE_OK;
 }
diff --git a/bgpd/bgp_label.c b/bgpd/bgp_label.c
index ceca644de2..8f8dbf4965 100644
--- a/bgpd/bgp_label.c
+++ b/bgpd/bgp_label.c
@@ -231,7 +231,7 @@ int bgp_nlri_parse_label(struct peer *peer, struct attr *attr,
 
 			/* When packet overflow occurs return immediately. */
 			if (pnt + BGP_ADDPATH_ID_LEN > lim)
-				return -1;
+				return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
 
 			addpath_id = ntohl(*((uint32_t *)pnt));
 			pnt += BGP_ADDPATH_ID_LEN;
@@ -247,7 +247,7 @@ int bgp_nlri_parse_label(struct peer *peer, struct attr *attr,
 			zlog_err(
 				"%s [Error] Update packet error / L-U (prefix length %d exceeds packet size %u)",
 				peer->host, prefixlen, (uint)(lim - pnt));
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
 		}
 
 		/* Fill in the labels */
@@ -262,12 +262,12 @@ int bgp_nlri_parse_label(struct peer *peer, struct attr *attr,
 				peer->host, prefixlen);
 			bgp_notify_send(peer, BGP_NOTIFY_UPDATE_ERR,
 					BGP_NOTIFY_UPDATE_INVAL_NETWORK);
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_LABEL_LENGTH;
 		}
 
 		if ((afi == AFI_IP && p.prefixlen > 32)
 		    || (afi == AFI_IP6 && p.prefixlen > 128))
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_PREFIX_LENGTH;
 
 		/* Fetch prefix from NLRI packet */
 		memcpy(&p.u.prefix, pnt + llen, psize - llen);
@@ -334,8 +334,8 @@ int bgp_nlri_parse_label(struct peer *peer, struct attr *attr,
 		zlog_err(
 			"%s [Error] Update packet error / L-U (%zu data remaining after parsing)",
 			peer->host, lim - pnt);
-		return -1;
+		return BGP_NLRI_PARSE_ERROR_PACKET_LENGTH;
 	}
 
-	return 0;
+	return BGP_NLRI_PARSE_OK;
 }
diff --git a/bgpd/bgp_mplsvpn.c b/bgpd/bgp_mplsvpn.c
index 710807156a..bdc883a1aa 100644
--- a/bgpd/bgp_mplsvpn.c
+++ b/bgpd/bgp_mplsvpn.c
@@ -138,7 +138,7 @@ int bgp_nlri_parse_vpn(struct peer *peer, struct attr *attr,
 
 			/* When packet overflow occurs return immediately. */
 			if (pnt + BGP_ADDPATH_ID_LEN > lim)
-				return -1;
+				return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
 
 			addpath_id = ntohl(*((uint32_t *)pnt));
 			pnt += BGP_ADDPATH_ID_LEN;
@@ -153,7 +153,7 @@ int bgp_nlri_parse_vpn(struct peer *peer, struct attr *attr,
 			zlog_err(
 				"%s [Error] Update packet error / VPN (prefix length %d less than VPN min length)",
 				peer->host, prefixlen);
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_PREFIX_LENGTH;
 		}
 
 		/* sanity check against packet data */
@@ -161,7 +161,7 @@ int bgp_nlri_parse_vpn(struct peer *peer, struct attr *attr,
 			zlog_err(
 				"%s [Error] Update packet error / VPN (prefix length %d exceeds packet size %u)",
 				peer->host, prefixlen, (uint)(lim - pnt));
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
 		}
 
 		/* sanity check against storage for the IP address portion */
@@ -171,7 +171,7 @@ int bgp_nlri_parse_vpn(struct peer *peer, struct attr *attr,
 				peer->host,
 				prefixlen - VPN_PREFIXLEN_MIN_BYTES * 8,
 				sizeof(p.u));
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_PACKET_LENGTH;
 		}
 
 		/* Sanity check against max bitlen of the address family */
@@ -181,7 +181,7 @@ int bgp_nlri_parse_vpn(struct peer *peer, struct attr *attr,
 				peer->host,
 				prefixlen - VPN_PREFIXLEN_MIN_BYTES * 8,
 				p.family, prefix_blen(&p));
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_PACKET_LENGTH;
 		}
 
 		/* Copy label to prefix. */
@@ -238,7 +238,7 @@ int bgp_nlri_parse_vpn(struct peer *peer, struct attr *attr,
 		zlog_err(
 			"%s [Error] Update packet error / VPN (%zu data remaining after parsing)",
 			peer->host, lim - pnt);
-		return -1;
+		return BGP_NLRI_PARSE_ERROR_PACKET_LENGTH;
 	}
 
 	return 0;
diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c
index 446dc5ac12..b146ce3f2d 100644
--- a/bgpd/bgp_packet.c
+++ b/bgpd/bgp_packet.c
@@ -306,7 +306,7 @@ int bgp_nlri_parse(struct peer *peer, struct attr *attr,
 	case SAFI_FLOWSPEC:
 		return bgp_nlri_parse_flowspec(peer, attr, packet, mp_withdraw);
 	}
-	return -1;
+	return BGP_NLRI_PARSE_ERROR;
 }
 
 /*
@@ -1558,10 +1558,11 @@ static int bgp_update_receive(struct peer *peer, bgp_size_t size)
 			nlri_ret = bgp_nlri_parse(peer, &attr, &nlris[i], 1);
 			break;
 		default:
-			nlri_ret = -1;
+			nlri_ret = BGP_NLRI_PARSE_ERROR;
 		}
 
-		if (nlri_ret < 0) {
+		if (nlri_ret < BGP_NLRI_PARSE_OK
+		    && nlri_ret != BGP_NLRI_PARSE_ERROR_PREFIX_OVERFLOW) {
 			zlog_err("%s [Error] Error parsing NLRI", peer->host);
 			if (peer->status == Established)
 				bgp_notify_send(
diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c
index ac688d72ab..b6b05434d4 100644
--- a/bgpd/bgp_route.c
+++ b/bgpd/bgp_route.c
@@ -4152,7 +4152,7 @@ int bgp_nlri_parse_ip(struct peer *peer, struct attr *attr,
 
 			/* When packet overflow occurs return immediately. */
 			if (pnt + BGP_ADDPATH_ID_LEN > lim)
-				return -1;
+				return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
 
 			addpath_id = ntohl(*((uint32_t *)pnt));
 			pnt += BGP_ADDPATH_ID_LEN;
@@ -4169,7 +4169,7 @@ int bgp_nlri_parse_ip(struct peer *peer, struct attr *attr,
 			zlog_err(
 				"%s [Error] Update packet error (wrong perfix length %d for afi %u)",
 				peer->host, p.prefixlen, packet->afi);
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_PREFIX_LENGTH;
 		}
 
 		/* Packet size overflow check. */
@@ -4180,7 +4180,7 @@ int bgp_nlri_parse_ip(struct peer *peer, struct attr *attr,
 			zlog_err(
 				"%s [Error] Update packet error (prefix length %d overflows packet)",
 				peer->host, p.prefixlen);
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
 		}
 
 		/* Defensive coding, double-check the psize fits in a struct
@@ -4189,7 +4189,7 @@ int bgp_nlri_parse_ip(struct peer *peer, struct attr *attr,
 			zlog_err(
 				"%s [Error] Update packet error (prefix length %d too large for prefix storage %zu)",
 				peer->host, p.prefixlen, sizeof(p.u));
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_PACKET_LENGTH;
 		}
 
 		/* Fetch prefix from NLRI packet. */
@@ -4251,10 +4251,14 @@ int bgp_nlri_parse_ip(struct peer *peer, struct attr *attr,
 					   BGP_ROUTE_NORMAL, NULL, NULL, 0,
 					   NULL);
 
-		/* Address family configuration mismatch or maximum-prefix count
-		   overflow. */
+		/* Do not send BGP notification twice when maximum-prefix count
+		 * overflow. */
+		if (CHECK_FLAG(peer->sflags, PEER_STATUS_PREFIX_OVERFLOW))
+			return BGP_NLRI_PARSE_ERROR_PREFIX_OVERFLOW;
+
+		/* Address family configuration mismatch. */
 		if (ret < 0)
-			return -1;
+			return BGP_NLRI_PARSE_ERROR_ADDRESS_FAMILY;
 	}
 
 	/* Packet length consistency check. */
@@ -4262,10 +4266,10 @@ int bgp_nlri_parse_ip(struct peer *peer, struct attr *attr,
 		zlog_err(
 			"%s [Error] Update packet error (prefix length mismatch with total length)",
 			peer->host);
-		return -1;
+		return BGP_NLRI_PARSE_ERROR_PACKET_LENGTH;
 	}
 
-	return 0;
+	return BGP_NLRI_PARSE_OK;
 }
 
 static struct bgp_static *bgp_static_new(void)
diff --git a/bgpd/bgp_route.h b/bgpd/bgp_route.h
index dfef9a8f79..534dd76215 100644
--- a/bgpd/bgp_route.h
+++ b/bgpd/bgp_route.h
@@ -72,6 +72,24 @@ enum bgp_show_adj_route_type {
  */
 #define BGP_MAX_LABELS 2
 
+/* Error codes for handling NLRI */
+#define BGP_NLRI_PARSE_OK 0
+#define BGP_NLRI_PARSE_ERROR_PREFIX_OVERFLOW -1
+#define BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW -2
+#define BGP_NLRI_PARSE_ERROR_PREFIX_LENGTH -3
+#define BGP_NLRI_PARSE_ERROR_PACKET_LENGTH -4
+#define BGP_NLRI_PARSE_ERROR_LABEL_LENGTH -5
+#define BGP_NLRI_PARSE_ERROR_EVPN_MISSING_TYPE -6
+#define BGP_NLRI_PARSE_ERROR_EVPN_TYPE2_SIZE -7
+#define BGP_NLRI_PARSE_ERROR_EVPN_TYPE3_SIZE -8
+#define BGP_NLRI_PARSE_ERROR_EVPN_TYPE4_SIZE -9
+#define BGP_NLRI_PARSE_ERROR_EVPN_TYPE5_SIZE -10
+#define BGP_NLRI_PARSE_ERROR_FLOWSPEC_IPV6_NOT_SUPPORTED -11
+#define BGP_NLRI_PARSE_ERROR_FLOWSPEC_NLRI_SIZELIMIT -12
+#define BGP_NLRI_PARSE_ERROR_FLOWSPEC_BAD_FORMAT -13
+#define BGP_NLRI_PARSE_ERROR_ADDRESS_FAMILY -14
+#define BGP_NLRI_PARSE_ERROR -32
+
 /* Ancillary information to struct bgp_info,
  * used for uncommonly used data (aggregation, MPLS, etc.)
  * and lazily allocated to save memory.