diff options
| -rw-r--r-- | bgpd/bgp_attr.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c index 6700470612..fdaa529348 100644 --- a/bgpd/bgp_attr.c +++ b/bgpd/bgp_attr.c @@ -3406,10 +3406,13 @@ static int bgp_attr_check(struct peer *peer, struct attr *attr, uint8_t type = 0; /* BGP Graceful-Restart End-of-RIB for IPv4 unicast is signaled as an - * empty UPDATE. */ + * empty UPDATE. Treat-as-withdraw, otherwise if we just ignore it, + * we will pass it to be processed as a normal UPDATE without mandatory + * attributes, that could lead to harmful behavior. + */ if (CHECK_FLAG(peer->cap, PEER_CAP_RESTART_RCV) && !attr->flag && !length) - return BGP_ATTR_PARSE_PROCEED; + return BGP_ATTR_PARSE_WITHDRAW; /* "An UPDATE message that contains the MP_UNREACH_NLRI is not required to carry any other path attributes.", though if MP_REACH_NLRI or NLRI @@ -3839,7 +3842,13 @@ done: aspath_unintern(&as4_path); transit = bgp_attr_get_transit(attr); - if (ret != BGP_ATTR_PARSE_ERROR) { + /* If we received an UPDATE with mandatory attributes, then + * the unrecognized transitive optional attribute of that + * path MUST be passed. Otherwise, it's an error, and from + * security perspective it might be very harmful if we continue + * here with the unrecognized attributes. + */ + if (ret == BGP_ATTR_PARSE_PROCEED) { /* Finally intern unknown attribute. */ if (transit) bgp_attr_set_transit(attr, transit_intern(transit)); |