Skip to content

Commit

Permalink
bgpd: Limit flowspec to no attribute means a implicit withdrawal
Browse files Browse the repository at this point in the history
All other parsing functions done from bgp_nlri_parse() assume
no attributes == an implicit withdrawal.  Let's move
bgp_nlri_parse_flowspec() into the same alignment.

Reported-by: Matteo Memelli <mmemelli@amazon.it>
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
  • Loading branch information
donaldsharp committed Apr 6, 2023
1 parent 78745b8 commit cfd04dc
Showing 1 changed file with 7 additions and 0 deletions.
7 changes: 7 additions & 0 deletions bgpd/bgp_flowspec.c
Expand Up @@ -98,6 +98,13 @@ int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
afi = packet->afi;
safi = packet->safi;

/*
* All other AFI/SAFI's treat no attribute as a implicit
* withdraw. Flowspec should as well.
*/
if (!attr)
withdraw = 1;

if (packet->length >= FLOWSPEC_NLRI_SIZELIMIT_EXTENDED) {
flog_err(EC_BGP_FLOWSPEC_PACKET,
"BGP flowspec nlri length maximum reached (%u)",
Expand Down

0 comments on commit cfd04dc

Please sign in to comment.