Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bgpd: Validate Addpath capability flags per AF #15037

Merged
merged 1 commit into from
Dec 18, 2023
Merged

bgpd: Validate Addpath capability flags per AF #15037

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions bgpd/bgp_open.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -680,6 +680,17 @@ static int bgp_capability_addpath(struct peer *peer,
iana_safi_t pkt_safi = stream_getc(s);
uint8_t send_receive = stream_getc(s);

/* If any other value (other than 1-3) is received, then
* the capability SHOULD be treated as not understood
* and ignored.
*/
if (!send_receive || send_receive > 3) {
flog_warn(EC_BGP_CAPABILITY_INVALID_DATA,
"Add Path: Received invalid send/receive value %u in Add Path capability",
send_receive);
continue;
}

if (bgp_debug_neighbor_events(peer))
zlog_debug("%s OPEN has %s capability for afi/safi: %s/%s%s%s",
peer->host,
Expand Down
16 changes: 14 additions & 2 deletions bgpd/bgp_packet.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3097,6 +3097,17 @@ static void bgp_dynamic_capability_addpath(uint8_t *pnt, int action,
pkt_afi = ntohs(bac.afi);
pkt_safi = safi_int2iana(bac.safi);

/* If any other value (other than 1-3) is received,
* then the capability SHOULD be treated as not
* understood and ignored.
*/
if (!bac.flags || bac.flags > 3) {
flog_warn(EC_BGP_CAPABILITY_INVALID_LENGTH,
"Add Path: Received invalid send/receive value %u in Add Path capability",
bac.flags);
goto ignore;
}

if (bgp_debug_neighbor_events(peer))
zlog_debug("%s OPEN has %s capability for afi/safi: %s/%s%s%s",
peer->host,
Expand All @@ -3118,14 +3129,14 @@ static void bgp_dynamic_capability_addpath(uint8_t *pnt, int action,
peer->host,
iana_afi2str(pkt_afi),
iana_safi2str(pkt_safi));
continue;
goto ignore;
} else if (!peer->afc[afi][safi]) {
if (bgp_debug_neighbor_events(peer))
zlog_debug("%s Addr-family %s/%s(afi/safi) not enabled. Ignore the AddPath capability for this AFI/SAFI",
peer->host,
iana_afi2str(pkt_afi),
iana_safi2str(pkt_safi));
continue;
goto ignore;
}

if (CHECK_FLAG(bac.flags, BGP_ADDPATH_RX))
Expand All @@ -3142,6 +3153,7 @@ static void bgp_dynamic_capability_addpath(uint8_t *pnt, int action,
UNSET_FLAG(peer->af_cap[afi][safi],
PEER_CAP_ADDPATH_AF_TX_RCV);

ignore:
data += CAPABILITY_CODE_ADDPATH_LEN;
}
} else {
Expand Down
Loading