Skip to content

bgpd: Fix a couple of issues in BGP-LS NLRI encoding/decoding #21092

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
riw777 merged 8 commits into from
Mar 24, 2026
Merged

bgpd: Fix a couple of issues in BGP-LS NLRI encoding/decoding #21092

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
3098d5f
bgpd: Treat duplicate TLVs as malformed NLRI
cscarpitta Mar 11, 2026
f021737
bgpd: Check stream space before encoding BGP-LS TLV data
cscarpitta Mar 11, 2026
ff2ab26
bgpd: Bound Extended Admin Group TLV decode size
cscarpitta Mar 11, 2026
d57a9ed
bgpd: Fix Extended Admin Group decode byte order
cscarpitta Mar 11, 2026
fa0eebc
bgpd: Fix leak in BGP-LS NLRI parsing loop
cscarpitta Mar 11, 2026
a773e27
bgpd: Free descriptor MT-ID on BGP-LS parse errors
cscarpitta Mar 11, 2026
a8b23e3
bgpd: Use extended length for BGP-LS path attribute
cscarpitta Mar 11, 2026
2e533d3
bgpd: Guard BGP-LS NLRI parsing when `ls_info` is unavailable
cscarpitta Mar 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions bgpd/bgp_attr.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4922,10 +4922,10 @@ static void bgp_packet_ls_attribute(struct stream *s, struct bgp *bgp, struct at

/* Write BGP-LS attribute header (RFC 9552 Section 4) */
attr_start = stream_get_endp(s);
stream_putc(s, BGP_ATTR_FLAG_OPTIONAL);
stream_putc(s, BGP_ATTR_FLAG_OPTIONAL | BGP_ATTR_FLAG_EXTLEN);
stream_putc(s, BGP_ATTR_LINK_STATE);
len_pos = stream_get_endp(s);
stream_putc(s, 0); /* Placeholder for length */
stream_putw(s, 0); /* Placeholder for extended length */

ret = bgp_ls_encode_attr(s, ls_attr);

Expand All @@ -4936,9 +4936,13 @@ static void bgp_packet_ls_attribute(struct stream *s, struct bgp *bgp, struct at
}

/* Update the length field */
attr_len = stream_get_endp(s) - len_pos - 1;
attr_len = stream_get_endp(s) - len_pos - 2;
if (attr_len > UINT16_MAX) {
stream_set_endp(s, attr_start);
return;
}

stream_putc_at(s, len_pos, attr_len);
stream_putw_at(s, len_pos, attr_len);
}

void bgp_packet_mpattr_prefix(struct stream *s, afi_t afi, safi_t safi, const struct prefix *p,
Expand Down
20 changes: 15 additions & 5 deletions bgpd/bgp_ls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -653,28 +653,36 @@ int bgp_ls_withdraw(struct bgp *bgp, struct bgp_ls_nlri *nlri)
int bgp_nlri_parse_ls(struct peer *peer, struct attr *attr, struct bgp_nlri *packet)
{
struct stream *s;
struct bgp_ls_nlri nlri;
struct bgp_ls_nlri *nlri;
struct prefix p;
struct bgp_ls_nlri *ls_entry;
struct bgp_dest *dest;
int ret = BGP_NLRI_PARSE_OK;

if (!peer || !peer->bgp || !peer->bgp->ls_info || !packet)
return BGP_NLRI_PARSE_ERROR;

s = stream_new(packet->length);
stream_put(s, packet->nlri, packet->length);
stream_set_getp(s, 0);

while (STREAM_READABLE(s) > 0) {
memset(&nlri, 0, sizeof(nlri));
ret = bgp_ls_decode_nlri(s, &nlri);
nlri = bgp_ls_nlri_alloc();
if (!nlri) {
ret = BGP_NLRI_PARSE_ERROR;
goto done;
}

ret = bgp_ls_decode_nlri(s, nlri);
if (ret < 0) {
bgp_ls_nlri_free(nlri);
flog_warn(EC_BGP_LS_PACKET, "%s [Error] Failed to decode BGP-LS NLRI",
peer->host);
ret = BGP_NLRI_PARSE_ERROR;
goto done;
}

ls_entry = bgp_ls_nlri_get(&peer->bgp->ls_info->nlri_hash, peer->bgp, &nlri);
ls_entry = bgp_ls_nlri_get(&peer->bgp->ls_info->nlri_hash, peer->bgp, nlri);

memset(&p, 0, sizeof(p));
p.family = AF_UNSPEC;
Expand All @@ -696,7 +704,9 @@ int bgp_nlri_parse_ls(struct peer *peer, struct attr *attr, struct bgp_nlri *pac

if (BGP_DEBUG(linkstate, LINKSTATE))
zlog_debug("%s processed BGP-LS %s NLRI type=%u", peer->host,
attr ? "UPDATE" : "WITHDRAW", nlri.nlri_type);
attr ? "UPDATE" : "WITHDRAW", nlri->nlri_type);

bgp_ls_nlri_free(nlri);
}

done:
Expand Down
Loading
Loading