diff options
| author | Donald Sharp <donaldsharp72@gmail.com> | 2023-10-25 15:33:13 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-10-25 15:33:13 -0400 |
| commit | 010f8998d736f3420f6a6dd44af606b26dbe1108 (patch) | |
| tree | f3b67884fc4da63c6ff3f2f77e15b2a493010dbc | |
| parent | 42cae6e9bd5e779c4a62526cb744184e5fba8bb2 (diff) | |
| parent | 6cca03a52e047f1271807ac501b08b3a4f5ad344 (diff) | |
Merge pull request #14653 from FRRouting/mergify/bp/dev/9.1/pr-14645frr-9.1-rc
bgpd: A couple more bgpd crashes on malformed attributes (backport #14645)
| -rw-r--r-- | bgpd/bgp_attr.c | 16 | ||||
| -rw-r--r-- | bgpd/bgp_attr.h | 1 | ||||
| -rw-r--r-- | bgpd/bgp_packet.c | 6 |
3 files changed, 8 insertions, 15 deletions
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c index 7916233444..bf33e8e3ec 100644 --- a/bgpd/bgp_attr.c +++ b/bgpd/bgp_attr.c @@ -2422,7 +2422,7 @@ int bgp_mp_reach_parse(struct bgp_attr_parser_args *args, mp_update->afi = afi; mp_update->safi = safi; - return BGP_ATTR_PARSE_EOR; + return bgp_attr_malformed(args, BGP_NOTIFY_UPDATE_MAL_ATTR, 0); } mp_update->afi = afi; @@ -3385,13 +3385,15 @@ bgp_attr_unknown(struct bgp_attr_parser_args *args) } /* Well-known attribute check. */ -static int bgp_attr_check(struct peer *peer, struct attr *attr) +static int bgp_attr_check(struct peer *peer, struct attr *attr, + bgp_size_t length) { uint8_t type = 0; /* BGP Graceful-Restart End-of-RIB for IPv4 unicast is signaled as an * empty UPDATE. */ - if (CHECK_FLAG(peer->cap, PEER_CAP_RESTART_RCV) && !attr->flag) + if (CHECK_FLAG(peer->cap, PEER_CAP_RESTART_RCV) && !attr->flag && + !length) return BGP_ATTR_PARSE_PROCEED; /* "An UPDATE message that contains the MP_UNREACH_NLRI is not required @@ -3443,7 +3445,7 @@ enum bgp_attr_parse_ret bgp_attr_parse(struct peer *peer, struct attr *attr, enum bgp_attr_parse_ret ret; uint8_t flag = 0; uint8_t type = 0; - bgp_size_t length; + bgp_size_t length = 0; uint8_t *startp, *endp; uint8_t *attr_endp; uint8_t seen[BGP_ATTR_BITMAP_SIZE]; @@ -3759,10 +3761,6 @@ enum bgp_attr_parse_ret bgp_attr_parse(struct peer *peer, struct attr *attr, goto done; } - if (ret == BGP_ATTR_PARSE_EOR) { - goto done; - } - if (ret == BGP_ATTR_PARSE_ERROR) { flog_warn(EC_BGP_ATTRIBUTE_PARSE_ERROR, "%s: Attribute %s, parse error", peer->host, @@ -3835,7 +3833,7 @@ enum bgp_attr_parse_ret bgp_attr_parse(struct peer *peer, struct attr *attr, } /* Check all mandatory well-known attributes are present */ - ret = bgp_attr_check(peer, attr); + ret = bgp_attr_check(peer, attr, length); if (ret < 0) goto done; diff --git a/bgpd/bgp_attr.h b/bgpd/bgp_attr.h index 961e5f1224..fc347e7a1b 100644 --- a/bgpd/bgp_attr.h +++ b/bgpd/bgp_attr.h @@ -364,7 +364,6 @@ enum bgp_attr_parse_ret { /* only used internally, send notify + convert to BGP_ATTR_PARSE_ERROR */ BGP_ATTR_PARSE_ERROR_NOTIFYPLS = -3, - BGP_ATTR_PARSE_EOR = -4, }; struct bpacket_attr_vec_arr; diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c index 24df8864d3..8fbdce56a2 100644 --- a/bgpd/bgp_packet.c +++ b/bgpd/bgp_packet.c @@ -2242,8 +2242,7 @@ static int bgp_update_receive(struct peer_connection *connection, * Non-MP IPv4/Unicast EoR is a completely empty UPDATE * and MP EoR should have only an empty MP_UNREACH */ - if ((!update_len && !withdraw_len && nlris[NLRI_MP_UPDATE].length == 0) - || (attr_parse_ret == BGP_ATTR_PARSE_EOR)) { + if (!update_len && !withdraw_len && nlris[NLRI_MP_UPDATE].length == 0) { afi_t afi = 0; safi_t safi; struct graceful_restart_info *gr_info; @@ -2264,9 +2263,6 @@ static int bgp_update_receive(struct peer_connection *connection, && nlris[NLRI_MP_WITHDRAW].length == 0) { afi = nlris[NLRI_MP_WITHDRAW].afi; safi = nlris[NLRI_MP_WITHDRAW].safi; - } else if (attr_parse_ret == BGP_ATTR_PARSE_EOR) { - afi = nlris[NLRI_MP_UPDATE].afi; - safi = nlris[NLRI_MP_UPDATE].safi; } if (afi && peer->afc[afi][safi]) { |