From cfd04dcb3e689754a72507d086ba3b9709fc5ed8 Mon Sep 17 00:00:00 2001 From: Donald Sharp Date: Wed, 5 Apr 2023 14:57:05 -0400 Subject: [PATCH] bgpd: Limit flowspec to no attribute means a implicit withdrawal All other parsing functions done from bgp_nlri_parse() assume no attributes == an implicit withdrawal. Let's move bgp_nlri_parse_flowspec() into the same alignment. Reported-by: Matteo Memelli Signed-off-by: Donald Sharp --- bgpd/bgp_flowspec.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/bgpd/bgp_flowspec.c b/bgpd/bgp_flowspec.c index f9debe43cd45..5e1be21402dc 100644 --- a/bgpd/bgp_flowspec.c +++ b/bgpd/bgp_flowspec.c @@ -98,6 +98,13 @@ int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr, afi = packet->afi; safi = packet->safi; + /* + * All other AFI/SAFI's treat no attribute as a implicit + * withdraw. Flowspec should as well. + */ + if (!attr) + withdraw = 1; + if (packet->length >= FLOWSPEC_NLRI_SIZELIMIT_EXTENDED) { flog_err(EC_BGP_FLOWSPEC_PACKET, "BGP flowspec nlri length maximum reached (%u)",