summaryrefslogtreecommitdiff
path: root/bgpd
diff options
context:
space:
mode:
authorDenis Ovsienko <infrastation@yandex.ru>2011-09-22 12:48:14 +0400
committerDenis Ovsienko <infrastation@yandex.ru>2011-09-30 01:24:35 +0400
commitbc3443ebf032b5fcc9e0ccb94641e4e899cd17d8 (patch)
tree06d6c8b912958c989ba59e45349e17a3f8d973ac /bgpd
parent0a28130d35bbba47faf47bf9451ba0eb195fcbb7 (diff)
bgpd: improve NEXT_HOP attribute checks (BZ#680)
* lib/prefix.h * IPV4_CLASS_DE(): new helper macro * bgp_attr.c * bgp_attr_nexthop(): add check for "partial" bit, refresh flag error reporting, explain meaning of RFC4271 section 6.3 and implement it Conflicts: bgpd/bgp_attr.c
Diffstat (limited to 'bgpd')
-rw-r--r--bgpd/bgp_attr.c45
1 files changed, 39 insertions, 6 deletions
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index d1ba0dac..6905ab52 100644
--- a/bgpd/bgp_attr.c
+++ b/bgpd/bgp_attr.c
@@ -964,15 +964,31 @@ bgp_attr_nexthop (struct peer *peer, bgp_size_t length,
struct attr *attr, u_char flag, u_char *startp)
{
bgp_size_t total;
+ in_addr_t nexthop_h, nexthop_n;
total = length + (CHECK_FLAG (flag, BGP_ATTR_FLAG_EXTLEN) ? 4 : 3);
- /* Flag check. */
- if (CHECK_FLAG (flag, BGP_ATTR_FLAG_OPTIONAL)
- || ! CHECK_FLAG (flag, BGP_ATTR_FLAG_TRANS))
+ /* Flags check. */
+ if (CHECK_FLAG (flag, BGP_ATTR_FLAG_OPTIONAL))
{
- zlog (peer->log, LOG_ERR,
- "Origin attribute flag isn't transitive %d", flag);
+ zlog (peer->log, LOG_ERR,
+ "NEXT_HOP attribute must not be flagged as \"optional\" (%u)", flag);
+ return bgp_attr_malformed (peer, BGP_ATTR_NEXT_HOP, flag,
+ BGP_NOTIFY_UPDATE_ATTR_FLAG_ERR,
+ startp, total);
+ }
+ if (! CHECK_FLAG (flag, BGP_ATTR_FLAG_TRANS))
+ {
+ zlog (peer->log, LOG_ERR,
+ "NEXT_HOP attribute must be flagged as \"transitive\" (%u)", flag);
+ return bgp_attr_malformed (peer, BGP_ATTR_NEXT_HOP, flag,
+ BGP_NOTIFY_UPDATE_ATTR_FLAG_ERR,
+ startp, total);
+ }
+ if (CHECK_FLAG (flag, BGP_ATTR_FLAG_PARTIAL))
+ {
+ zlog (peer->log, LOG_ERR,
+ "NEXT_HOP attribute must not be flagged as \"partial\" (%u)", flag);
return bgp_attr_malformed (peer, BGP_ATTR_NEXT_HOP, flag,
BGP_NOTIFY_UPDATE_ATTR_FLAG_ERR,
startp, total);
@@ -989,7 +1005,24 @@ bgp_attr_nexthop (struct peer *peer, bgp_size_t length,
startp, total);
}
- attr->nexthop.s_addr = stream_get_ipv4 (peer->ibuf);
+ /* According to section 6.3 of RFC4271, syntactically incorrect NEXT_HOP
+ attribute must result in a NOTIFICATION message (this is implemented below).
+ At the same time, semantically incorrect NEXT_HOP is more likely to be just
+ logged locally (this is implemented somewhere else). The UPDATE message
+ gets ignored in any of these cases. */
+ nexthop_n = stream_get_ipv4 (peer->ibuf);
+ nexthop_h = ntohl (nexthop_n);
+ if (IPV4_NET0 (nexthop_h) || IPV4_NET127 (nexthop_h) || IPV4_CLASS_DE (nexthop_h))
+ {
+ char buf[INET_ADDRSTRLEN];
+ inet_ntop (AF_INET, &nexthop_h, buf, INET_ADDRSTRLEN);
+ zlog (peer->log, LOG_ERR, "Martian nexthop %s", buf);
+ return bgp_attr_malformed (peer, BGP_ATTR_NEXT_HOP, flag,
+ BGP_NOTIFY_UPDATE_INVAL_NEXT_HOP,
+ startp, total);
+ }
+
+ attr->nexthop.s_addr = nexthop_n;
attr->flag |= ATTR_FLAG_BIT (BGP_ATTR_NEXT_HOP);
return BGP_ATTR_PARSE_PROCEED;