From 2cee5567bc49c603de3a142a9cb5a4fab560cb6c Mon Sep 17 00:00:00 2001 From: Stephane Poignant Date: Tue, 1 Apr 2025 18:56:27 +0200 Subject: [PATCH] bgpd: flowspec: remove sizelimit check applied to the wrong length field (issue 18557) Section 4.1 of RFC8955 defines how the length field of flowspec NLRIs is encoded. The method use implies a maximum length of 4095 for a single flowspec NLRI. However, in bgp_flowspec.c, we check the length attribute of the bgp_nlri structure against this maximum value, which actually is the *total* length of all NLRI included in the considered MP_REACH_NLRI path attribute. Due to this confusion, frr would reject valid announces that contain many flowspec NLRIs, when their cummulative length exceeds 4095, and close the session. The proposed change removes that check entirely. Indeed, there is no need to check the length field of each invidual NLRI because the method employed make it impossible to encode a length greater than 4095. Signed-off-by: Stephane Poignant --- bgpd/bgp_flowspec.c | 7 ------- bgpd/bgp_flowspec_private.h | 1 - bgpd/bgp_route.h | 1 - 3 files changed, 9 deletions(-) diff --git a/bgpd/bgp_flowspec.c b/bgpd/bgp_flowspec.c index bd04970fd5..6f1780665d 100644 --- a/bgpd/bgp_flowspec.c +++ b/bgpd/bgp_flowspec.c @@ -105,13 +105,6 @@ int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr, if (!attr) withdraw = true; - if (packet->length >= FLOWSPEC_NLRI_SIZELIMIT_EXTENDED) { - flog_err(EC_BGP_FLOWSPEC_PACKET, - "BGP flowspec nlri length maximum reached (%u)", - packet->length); - return BGP_NLRI_PARSE_ERROR_FLOWSPEC_NLRI_SIZELIMIT; - } - for (; pnt < lim; pnt += psize) { /* Clear prefix structure. */ memset(&p, 0, sizeof(p)); diff --git a/bgpd/bgp_flowspec_private.h b/bgpd/bgp_flowspec_private.h index 049cb6df77..fa611bd372 100644 --- a/bgpd/bgp_flowspec_private.h +++ b/bgpd/bgp_flowspec_private.h @@ -7,7 +7,6 @@ #define _FRR_BGP_FLOWSPEC_PRIVATE_H #define FLOWSPEC_NLRI_SIZELIMIT 240 -#define FLOWSPEC_NLRI_SIZELIMIT_EXTENDED 4095 /* Flowspec raffic action bit*/ #define FLOWSPEC_TRAFFIC_ACTION_TERMINAL 1 diff --git a/bgpd/bgp_route.h b/bgpd/bgp_route.h index 5c10a865d1..af8c111043 100644 --- a/bgpd/bgp_route.h +++ b/bgpd/bgp_route.h @@ -88,7 +88,6 @@ enum bgp_show_adj_route_type { #define BGP_NLRI_PARSE_ERROR_EVPN_TYPE4_SIZE -9 #define BGP_NLRI_PARSE_ERROR_EVPN_TYPE5_SIZE -10 #define BGP_NLRI_PARSE_ERROR_FLOWSPEC_IPV6_NOT_SUPPORTED -11 -#define BGP_NLRI_PARSE_ERROR_FLOWSPEC_NLRI_SIZELIMIT -12 #define BGP_NLRI_PARSE_ERROR_FLOWSPEC_BAD_FORMAT -13 #define BGP_NLRI_PARSE_ERROR_ADDRESS_FAMILY -14 #define BGP_NLRI_PARSE_ERROR_EVPN_TYPE1_SIZE -15 -- 2.39.5