nhrpd: gate source binding cache on S-bit and holding time per RFC2332

[pawademao]

Summary

nhrp_handle_resolution_req() unconditionally caches the source binding
from every Resolution Request CIE, ignoring two conditions mandated by
RFC 2332 Section 6.2.1:

1. The S-bit (NHRP_FLAG_RESOLUTION_SOURCE_STABLE) must be set - without
   it, the binding is temporary and MUST NOT be retained.

2. The CIE Holding Time must be greater than zero. A zero holding time
   means the binding should not be stored. The code also silently replaced
   zero with the interface default holdtime.

Impact

Transit/responder NHS nodes accumulate stale or unauthorized source
bindings, leading to incorrect shortcut paths, forwarding to wrong
NBMA addresses, or serving expired mappings.

Fix

Add an explicit gate before nhrp_cache_update_binding(): if the S-bit is
unset OR the original holding_time is zero, skip creating or updating the
cache entry for this CIE.

References

• RFC 2332 Section 6.2.1
• RFCAudit Bug 11 (RFCBin)

Signed-off-by: zhuxu 185172534zxxx@gmail.com

[greptile-apps]

Greptile Summary

This PR makes NHRP Resolution Request source-binding caching conditional on both the source-stable flag and a nonzero advertised holding time.

• Adds an RFC 2332 gate before source cache lookup and update.
• Continues constructing a successful Resolution Reply when the source binding is not cacheable.
• Prevents a zero holding time from being replaced with the interface default on this cache path.

Confidence Score: 5/5

The PR appears safe to merge, with the new guard limited to source-binding cache insertion and no identified regression in reply handling.

The flag and holding-time checks use the daemon’s established network-byte-order conventions, and the early continuation still reaches the common Resolution Reply construction after the CIE loop.

Important Files Changed

Filename	Overview
nhrpd/nhrp_peer.c	Adds a correctly scoped cache gate while preserving the existing Resolution Reply flow.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Receive Resolution Request CIE] --> B{S-bit set and holding time nonzero?}
    B -- Yes --> C[Create or update source binding cache]
    B -- No --> D[Skip source binding cache]
    C --> E[Construct Resolution Reply]
    D --> E

Loading

_{Reviews (1): Last reviewed commit: "nhrpd: gate source binding cache on S-bi..." | Re-trigger Greptile}

[riw777]

Looks like this line is throwing up an error :-( --

===============================================
< WARNING: quoted string split across lines
< #535: FILE: /tmp/f1-801609/nhrp_peer.c:535:\n
Details at [https://ci1.netdef.org/browse/FRR-PULLREQ3-CHECKOUT-20491](https://ci1.netdef.org/browse/FRR-PULLREQ3-CHECKOUT-20491)