proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-07-25 22:01:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

bgpd: Validate both nexthop information (NEXTHOP and NLRI)

Browse Source 
If we receive an IPv6 prefix e.g.: 2001:db8:100::/64 with nextop: 0.0.0.0, and
mp_nexthop: fc00::2, we should not treat this with an invalid nexthop because
of 0.0.0.0. We MUST check for MP_REACH attribute also and decide later if we
have at least one a valid nexthop.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit a0d2734e87)
This commit is contained in:
Donatas Abraitis 2024-11-17 11:19:19 +02:00
parent a5755342e2
commit af4f6f4395
1 changed files with 22 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
bgpd/bgp_route.c
View File

@ -4354,7 +4354,7 @@ bool bgp_update_martian_nexthop(struct bgp *bgp, afi_t afi, safi_t safi,
uint8_t type, uint8_t stype, struct attr *attr, uint8_t type, uint8_t stype, struct attr *attr,
struct bgp_dest *dest) struct bgp_dest *dest)
{ {
bool ret = false; bool nh_invalid = false;
bool is_bgp_static_route = bool is_bgp_static_route =
(type == ZEBRA_ROUTE_BGP && stype == BGP_ROUTE_STATIC) ? true (type == ZEBRA_ROUTE_BGP && stype == BGP_ROUTE_STATIC) ? true
: false; : false;
@ -4376,13 +4376,15 @@ bool bgp_update_martian_nexthop(struct bgp *bgp, afi_t afi, safi_t safi,
(safi != SAFI_UNICAST && safi != SAFI_MULTICAST && safi != SAFI_EVPN)) (safi != SAFI_UNICAST && safi != SAFI_MULTICAST && safi != SAFI_EVPN))
return false; return false;
/* If NEXT_HOP is present, validate it. */ /* If NEXT_HOP is present, validate it:
if (attr->flag & ATTR_FLAG_BIT(BGP_ATTR_NEXT_HOP)) { * The route can have both nexthop + mp_nexthop encoded as multiple NLRIs,
if (attr->nexthop.s_addr == INADDR_ANY || * and we MUST check if at least one of them is valid.
!ipv4_unicast_valid(&attr->nexthop) || * E.g.: IPv6 prefix can be with nexthop: 0.0.0.0, and mp_nexthop: fc00::1.
bgp_nexthop_self(bgp, afi, type, stype, attr, dest)) */
return true; if (CHECK_FLAG(attr->flag, ATTR_FLAG_BIT(BGP_ATTR_NEXT_HOP)))
} nh_invalid = (attr->nexthop.s_addr == INADDR_ANY ||
!ipv4_unicast_valid(&attr->nexthop) ||
bgp_nexthop_self(bgp, afi, type, stype, attr, dest));
/* If MP_NEXTHOP is present, validate it. */ /* If MP_NEXTHOP is present, validate it. */
/* Note: For IPv6 nexthops, we only validate the global (1st) nexthop; /* Note: For IPv6 nexthops, we only validate the global (1st) nexthop;
@ -4397,39 +4399,31 @@ bool bgp_update_martian_nexthop(struct bgp *bgp, afi_t afi, safi_t safi,
switch (attr->mp_nexthop_len) { switch (attr->mp_nexthop_len) {
case BGP_ATTR_NHLEN_IPV4: case BGP_ATTR_NHLEN_IPV4:
case BGP_ATTR_NHLEN_VPNV4: case BGP_ATTR_NHLEN_VPNV4:
ret = (attr->mp_nexthop_global_in.s_addr == nh_invalid = (attr->mp_nexthop_global_in.s_addr == INADDR_ANY ||
INADDR_ANY || !ipv4_unicast_valid(&attr->mp_nexthop_global_in) ||
!ipv4_unicast_valid( bgp_nexthop_self(bgp, afi, type, stype, attr, dest));
&attr->mp_nexthop_global_in) ||
bgp_nexthop_self(bgp, afi, type, stype, attr,
dest));
break; break;
case BGP_ATTR_NHLEN_IPV6_GLOBAL: case BGP_ATTR_NHLEN_IPV6_GLOBAL:
case BGP_ATTR_NHLEN_VPNV6_GLOBAL: case BGP_ATTR_NHLEN_VPNV6_GLOBAL:
ret = (IN6_IS_ADDR_UNSPECIFIED( nh_invalid = (IN6_IS_ADDR_UNSPECIFIED(&attr->mp_nexthop_global) ||
&attr->mp_nexthop_global) IN6_IS_ADDR_LOOPBACK(&attr->mp_nexthop_global) ||
|| IN6_IS_ADDR_LOOPBACK(&attr->mp_nexthop_global) IN6_IS_ADDR_MULTICAST(&attr->mp_nexthop_global) ||
|| IN6_IS_ADDR_MULTICAST( bgp_nexthop_self(bgp, afi, type, stype, attr, dest));
&attr->mp_nexthop_global)
|| bgp_nexthop_self(bgp, afi, type, stype, attr,
dest));
break; break;
case BGP_ATTR_NHLEN_IPV6_GLOBAL_AND_LL: case BGP_ATTR_NHLEN_IPV6_GLOBAL_AND_LL:
ret = (IN6_IS_ADDR_LOOPBACK(&attr->mp_nexthop_global) nh_invalid = (IN6_IS_ADDR_LOOPBACK(&attr->mp_nexthop_global) ||
|| IN6_IS_ADDR_MULTICAST( IN6_IS_ADDR_MULTICAST(&attr->mp_nexthop_global) ||
&attr->mp_nexthop_global) bgp_nexthop_self(bgp, afi, type, stype, attr, dest));
|| bgp_nexthop_self(bgp, afi, type, stype, attr,
dest));
break; break;
default: default:
ret = true; nh_invalid = true;
break; break;
} }
} }
return ret; return nh_invalid;
} }
static void bgp_attr_add_no_export_community(struct attr *attr) static void bgp_attr_add_no_export_community(struct attr *attr)