Merge pull request #13100 from opensourcerouting/fix/bgp_cap_llgr_length_check

bgpd: Check 7 bytes for Long-lived Graceful-Restart capability
This commit is contained in:
Donald Sharp 2023-03-24 10:22:48 -04:00 committed by GitHub
commit 6c8ad437e7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -604,12 +604,24 @@ static int bgp_capability_restart(struct peer *peer,
static int bgp_capability_llgr(struct peer *peer, static int bgp_capability_llgr(struct peer *peer,
struct capability_header *caphdr) struct capability_header *caphdr)
{ {
/*
* +--------------------------------------------------+
* | Address Family Identifier (16 bits) |
* +--------------------------------------------------+
* | Subsequent Address Family Identifier (8 bits) |
* +--------------------------------------------------+
* | Flags for Address Family (8 bits) |
* +--------------------------------------------------+
* | Long-lived Stale Time (24 bits) |
* +--------------------------------------------------+
*/
#define BGP_CAP_LLGR_MIN_PACKET_LEN 7
struct stream *s = BGP_INPUT(peer); struct stream *s = BGP_INPUT(peer);
size_t end = stream_get_getp(s) + caphdr->length; size_t end = stream_get_getp(s) + caphdr->length;
SET_FLAG(peer->cap, PEER_CAP_LLGR_RCV); SET_FLAG(peer->cap, PEER_CAP_LLGR_RCV);
while (stream_get_getp(s) + 4 <= end) { while (stream_get_getp(s) + BGP_CAP_LLGR_MIN_PACKET_LEN <= end) {
afi_t afi; afi_t afi;
safi_t safi; safi_t safi;
iana_afi_t pkt_afi = stream_getw(s); iana_afi_t pkt_afi = stream_getw(s);