bgpd: Regularise bgp_update_receive, add missing notifies and checks
* bgp_packet.c: (bgp_update_receive) Lots of repeated code, doing same
thing for each AFI/SAFI. Except when it doesn't, e.g. the IPv4/VPN
case was missing the EoR bgp_clear_stale_route call - the only action
really needed for EoR.
Make this function a lot more regular, using common, AFI/SAFI
independent blocks so far as possible.
Replace the 4 separate bgp_nlris with an array, indexed by an enum.
The distinct blocks that handle calling bgp_nlri_parse for each
different AFI/SAFI can now be replaced with a loop.
Transmogrify the nlri SAFI from the SAFI_MPLS_LABELED_VPN code-point
used on the wire, to the SAFI_MPLS_VPN safi_t enum we use internally
as early as possible.
The existing code was not necessarily sending a NOTIFY for NLRI
parsing errors, if they arose via bgp_nlri_sanity_check. Send the
correct NOTIFY - INVAL_NETWORK for the classic NLRIs and OPT_ATTR_ERR
for the MP ones.
EoR can now be handled in one block. The existing code seemed broken
for EoR recognition in a number of ways:
1. A v4/unicast EoR should be an empty UPDATE. However, it seemed
to be treating an UPDATE with attributes, inc. MP REACH/UNREACH,
but no classic NLRIs, as a v4/uni EoR.
2. For other AFI/SAFIs, it was treating UPDATEs with no classic
withraw and with a zero-length MP withdraw as EoRs. However, that
would mean an UPDATE packet _with_ update NLRIs and a 0-len MP
withdraw could be classed as an EoR.
This seems to be loose coding leading to ambiguous protocol
situations and likely incorrect behaviour, rather than simply being
liberal. Be more strict about checking that an UPDATE really is an
EoR and definitely is not trying to update any NLRIs.
This same loose EoR parsing was noted by Chris Hall previously on
list.
(bgp_nlri_parse) Front end NLRI parse function, to fan-out to the correct
parser for the AFI/SAFI.
* bgp_route.c: (bgp_nlri_sanity_check) We try convert NLRI safi to
internal code-point ASAP, adjust switch for that. Leave the wire
code point in for defensive coding.
(bgp_nlri_parse) rename to bgp_nlri_parse_ip.
* tests/bgp_mp_attr_test.c: Can just use bgp_nlri_parse frontend.
diff --git a/bgpd/bgp_mplsvpn.c b/bgpd/bgp_mplsvpn.c
index 900bc48..83bb6ca 100644
--- a/bgpd/bgp_mplsvpn.c
+++ b/bgpd/bgp_mplsvpn.c
@@ -30,6 +30,7 @@
#include "bgpd/bgpd.h"
#include "bgpd/bgp_table.h"
#include "bgpd/bgp_route.h"
+#include "bgpd/bgp_packet.h"
#include "bgpd/bgp_attr.h"
#include "bgpd/bgp_mplsvpn.h"
#include "bgpd/bgp_packet.h"
diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c
index d40c24c..628c333 100644
--- a/bgpd/bgp_packet.c
+++ b/bgpd/bgp_packet.c
@@ -1591,11 +1591,29 @@
return 0;
}
+/* Frontend for NLRI parsing, to fan-out to AFI/SAFI specific parsers */
+int
+bgp_nlri_parse (struct peer *peer, struct attr *attr, struct bgp_nlri *packet)
+{
+ switch (packet->safi)
+ {
+ case SAFI_UNICAST:
+ case SAFI_MULTICAST:
+ return bgp_nlri_parse_ip (peer, attr, packet);
+ case SAFI_MPLS_VPN:
+ case SAFI_MPLS_LABELED_VPN:
+ return bgp_nlri_parse_vpn (peer, attr, packet);
+ case SAFI_ENCAP:
+ return bgp_nlri_parse_encap (peer, attr, packet);
+ }
+ return -1;
+}
+
/* Parse BGP Update packet and make attribute object. */
static int
bgp_update_receive (struct peer *peer, bgp_size_t size)
{
- int ret;
+ int ret, nlri_ret;
u_char *end;
struct stream *s;
struct attr attr;
@@ -1603,10 +1621,16 @@
bgp_size_t attribute_len;
bgp_size_t update_len;
bgp_size_t withdraw_len;
- struct bgp_nlri update;
- struct bgp_nlri withdraw;
- struct bgp_nlri mp_update;
- struct bgp_nlri mp_withdraw;
+ int i;
+
+ enum NLRI_TYPES {
+ NLRI_UPDATE,
+ NLRI_WITHDRAW,
+ NLRI_MP_UPDATE,
+ NLRI_MP_WITHDRAW,
+ NLRI_TYPE_MAX,
+ };
+ struct bgp_nlri nlris[NLRI_TYPE_MAX];
/* Status must be Established. */
if (peer->status != Established)
@@ -1620,10 +1644,7 @@
/* Set initial values. */
memset (&attr, 0, sizeof (struct attr));
memset (&extra, 0, sizeof (struct attr_extra));
- memset (&update, 0, sizeof (struct bgp_nlri));
- memset (&withdraw, 0, sizeof (struct bgp_nlri));
- memset (&mp_update, 0, sizeof (struct bgp_nlri));
- memset (&mp_withdraw, 0, sizeof (struct bgp_nlri));
+ memset (&nlris, 0, sizeof nlris);
attr.extra = &extra;
s = peer->ibuf;
@@ -1660,14 +1681,18 @@
/* Unfeasible Route packet format check. */
if (withdraw_len > 0)
{
- withdraw.afi = AFI_IP;
- withdraw.safi = SAFI_UNICAST;
- withdraw.nlri = stream_pnt (s);
- withdraw.length = withdraw_len;
- ret = bgp_nlri_sanity_check (peer, &withdraw);
- if (ret < 0)
- return -1;
-
+ nlris[NLRI_WITHDRAW].afi = AFI_IP;
+ nlris[NLRI_WITHDRAW].safi = SAFI_UNICAST;
+ nlris[NLRI_WITHDRAW].nlri = stream_pnt (s);
+ nlris[NLRI_WITHDRAW].length = withdraw_len;
+
+ if (bgp_nlri_sanity_check (peer, &nlris[NLRI_WITHDRAW]) < 0)
+ {
+ bgp_notify_send (peer, BGP_NOTIFY_UPDATE_ERR,
+ BGP_NOTIFY_UPDATE_INVAL_NETWORK);
+ return -1;
+ }
+
if (BGP_DEBUG (packet, PACKET_RECV))
zlog_debug ("%s [Update:RECV] Unfeasible NLRI received", peer->host);
@@ -1716,7 +1741,7 @@
if (attribute_len)
{
attr_parse_ret = bgp_attr_parse (peer, &attr, attribute_len,
- &mp_update, &mp_withdraw);
+ &nlris[NLRI_MP_UPDATE], &nlris[NLRI_MP_WITHDRAW]);
if (attr_parse_ret == BGP_ATTR_PARSE_ERROR)
{
bgp_attr_unintern_sub (&attr);
@@ -1752,15 +1777,17 @@
if (update_len)
{
/* Set NLRI portion to structure. */
- update.afi = AFI_IP;
- update.safi = SAFI_UNICAST;
- update.nlri = stream_pnt (s);
- update.length = update_len;
+ nlris[NLRI_UPDATE].afi = AFI_IP;
+ nlris[NLRI_UPDATE].safi = SAFI_UNICAST;
+ nlris[NLRI_UPDATE].nlri = stream_pnt (s);
+ nlris[NLRI_UPDATE].length = update_len;
/* Check NLRI packet format and prefix length. */
- ret = bgp_nlri_sanity_check (peer, &update);
+ ret = bgp_nlri_sanity_check (peer, &nlris[NLRI_UPDATE]);
if (ret < 0)
{
+ bgp_notify_send (peer, BGP_NOTIFY_UPDATE_ERR,
+ BGP_NOTIFY_UPDATE_INVAL_NETWORK);
bgp_attr_unintern_sub (&attr);
bgp_attr_flush (&attr);
return -1;
@@ -1768,226 +1795,117 @@
stream_forward_getp (s, update_len);
}
-
- /* NLRI is processed only when the peer is configured specific
- Address Family and Subsequent Address Family. */
- if (peer->afc[AFI_IP][SAFI_UNICAST])
+
+ /* Parse any given NLRIs */
+ for (i = NLRI_UPDATE; i < NLRI_TYPE_MAX; i++)
{
- if (withdraw.length)
- bgp_nlri_parse (peer, NULL, &withdraw);
-
- if (update.length)
- bgp_nlri_parse (peer, NLRI_ATTR_ARG, &update);
-
- if (mp_update.length
- && mp_update.afi == AFI_IP
- && mp_update.safi == SAFI_UNICAST)
- bgp_nlri_parse (peer, NLRI_ATTR_ARG, &mp_update);
-
- if (mp_withdraw.length
- && mp_withdraw.afi == AFI_IP
- && mp_withdraw.safi == SAFI_UNICAST)
- bgp_nlri_parse (peer, NULL, &mp_withdraw);
-
- if (! attribute_len && ! withdraw_len)
- {
+ /* We use afi and safi as indices into tables and what not. It would
+ * be impossible, at this time, to support unknown afi/safis. And
+ * anyway, the peer needs to be configured to enable the afi/safi
+ * explicitly which requires UI support.
+ *
+ * Ignore unknown afi/safi NLRIs.
+ *
+ * Note: this means nlri[x].afi/safi still can not be trusted for
+ * indexing later in this function!
+ *
+ * Note2: This will also remap the wire code-point for VPN safi to the
+ * internal safi_t point, as needs be.
+ */
+ if (!bgp_afi_safi_valid_indices (nlris[i].afi, &nlris[i].safi))
+ {
+ plog_info (peer->log,
+ "%s [Info] UPDATE with unsupported AFI/SAFI %u/%u",
+ peer->host, nlris[i].afi, nlris[i].safi);
+ continue;
+ }
+
+ /* NLRI is processed only when the peer is configured specific
+ Address Family and Subsequent Address Family. */
+ if (!peer->afc[nlris[i].afi][nlris[i].safi])
+ {
+ plog_info (peer->log,
+ "%s [Info] UPDATE for non-enabled AFI/SAFI %u/%u",
+ peer->host, nlris[i].afi, nlris[i].safi);
+ continue;
+ }
+
+ /* EoR handled later */
+ if (nlris[i].length == 0)
+ continue;
+
+ switch (i)
+ {
+ case NLRI_UPDATE:
+ case NLRI_MP_UPDATE:
+ nlri_ret = bgp_nlri_parse (peer, NLRI_ATTR_ARG, &nlris[i]);
+ break;
+ case NLRI_WITHDRAW:
+ case NLRI_MP_WITHDRAW:
+ nlri_ret = bgp_nlri_parse (peer, NULL, &nlris[i]);
+ }
+
+ if (nlri_ret < 0)
+ {
+ plog_err (peer->log,
+ "%s [Error] Error parsing NLRI", peer->host);
+ if (peer->status == Established)
+ bgp_notify_send (peer, BGP_NOTIFY_UPDATE_ERR,
+ i <= NLRI_WITHDRAW
+ ? BGP_NOTIFY_UPDATE_INVAL_NETWORK
+ : BGP_NOTIFY_UPDATE_OPT_ATTR_ERR);
+ bgp_attr_unintern_sub (&attr);
+ return -1;
+ }
+ }
+
+ /* EoR checks.
+ *
+ * Non-MP IPv4/Unicast EoR is a completely empty UPDATE
+ * and MP EoR should have only an empty MP_UNREACH
+ */
+ if (!update_len && !withdraw_len
+ && nlris[NLRI_MP_UPDATE].length == 0)
+ {
+ afi_t afi = 0;
+ safi_t safi;
+
+ /* Non-MP IPv4/Unicast is a completely empty UPDATE - already
+ * checked update and withdraw NLRI lengths are 0.
+ */
+ if (!attribute_len)
+ {
+ afi = AFI_IP;
+ safi = SAFI_UNICAST;
+ }
+ /* otherwise MP AFI/SAFI is an empty update, other than an empty
+ * MP_UNREACH_NLRI attr (with an AFI/SAFI we recognise).
+ */
+ else if (attr.flag == BGP_ATTR_MP_UNREACH_NLRI
+ && nlris[NLRI_MP_WITHDRAW].length == 0
+ && bgp_afi_safi_valid_indices (nlris[NLRI_MP_WITHDRAW].afi,
+ &nlris[NLRI_MP_WITHDRAW].safi))
+ {
+ afi = nlris[NLRI_MP_WITHDRAW].afi;
+ safi = nlris[NLRI_MP_WITHDRAW].safi;
+ }
+
+ if (afi && peer->afc[afi][safi])
+ {
/* End-of-RIB received */
- SET_FLAG (peer->af_sflags[AFI_IP][SAFI_UNICAST],
+ SET_FLAG (peer->af_sflags[afi][safi],
PEER_STATUS_EOR_RECEIVED);
/* NSF delete stale route */
- if (peer->nsf[AFI_IP][SAFI_UNICAST])
- bgp_clear_stale_route (peer, AFI_IP, SAFI_UNICAST);
+ if (peer->nsf[afi][safi])
+ bgp_clear_stale_route (peer, afi, safi);
if (BGP_DEBUG (normal, NORMAL))
- zlog (peer->log, LOG_DEBUG, "rcvd End-of-RIB for IPv4 Unicast from %s",
- peer->host);
- }
+ zlog (peer->log, LOG_DEBUG, "rcvd End-of-RIB for %s from %s",
+ peer->host, afi_safi_print (afi, safi));
+ }
}
- if (peer->afc[AFI_IP][SAFI_MULTICAST])
- {
- if (mp_update.length
- && mp_update.afi == AFI_IP
- && mp_update.safi == SAFI_MULTICAST)
- bgp_nlri_parse (peer, NLRI_ATTR_ARG, &mp_update);
-
- if (mp_withdraw.length
- && mp_withdraw.afi == AFI_IP
- && mp_withdraw.safi == SAFI_MULTICAST)
- bgp_nlri_parse (peer, NULL, &mp_withdraw);
-
- if (! withdraw_len
- && mp_withdraw.afi == AFI_IP
- && mp_withdraw.safi == SAFI_MULTICAST
- && mp_withdraw.length == 0)
- {
- /* End-of-RIB received */
- SET_FLAG (peer->af_sflags[AFI_IP][SAFI_MULTICAST],
- PEER_STATUS_EOR_RECEIVED);
-
- /* NSF delete stale route */
- if (peer->nsf[AFI_IP][SAFI_MULTICAST])
- bgp_clear_stale_route (peer, AFI_IP, SAFI_MULTICAST);
-
- if (BGP_DEBUG (normal, NORMAL))
- zlog (peer->log, LOG_DEBUG, "rcvd End-of-RIB for IPv4 Multicast from %s",
- peer->host);
- }
- }
- if (peer->afc[AFI_IP6][SAFI_UNICAST])
- {
- if (mp_update.length
- && mp_update.afi == AFI_IP6
- && mp_update.safi == SAFI_UNICAST)
- bgp_nlri_parse (peer, NLRI_ATTR_ARG, &mp_update);
-
- if (mp_withdraw.length
- && mp_withdraw.afi == AFI_IP6
- && mp_withdraw.safi == SAFI_UNICAST)
- bgp_nlri_parse (peer, NULL, &mp_withdraw);
-
- if (! withdraw_len
- && mp_withdraw.afi == AFI_IP6
- && mp_withdraw.safi == SAFI_UNICAST
- && mp_withdraw.length == 0)
- {
- /* End-of-RIB received */
- SET_FLAG (peer->af_sflags[AFI_IP6][SAFI_UNICAST], PEER_STATUS_EOR_RECEIVED);
-
- /* NSF delete stale route */
- if (peer->nsf[AFI_IP6][SAFI_UNICAST])
- bgp_clear_stale_route (peer, AFI_IP6, SAFI_UNICAST);
-
- if (BGP_DEBUG (normal, NORMAL))
- zlog (peer->log, LOG_DEBUG, "rcvd End-of-RIB for IPv6 Unicast from %s",
- peer->host);
- }
- }
- if (peer->afc[AFI_IP6][SAFI_MULTICAST])
- {
- if (mp_update.length
- && mp_update.afi == AFI_IP6
- && mp_update.safi == SAFI_MULTICAST)
- bgp_nlri_parse (peer, NLRI_ATTR_ARG, &mp_update);
-
- if (mp_withdraw.length
- && mp_withdraw.afi == AFI_IP6
- && mp_withdraw.safi == SAFI_MULTICAST)
- bgp_nlri_parse (peer, NULL, &mp_withdraw);
-
- if (! withdraw_len
- && mp_withdraw.afi == AFI_IP6
- && mp_withdraw.safi == SAFI_MULTICAST
- && mp_withdraw.length == 0)
- {
- /* End-of-RIB received */
-
- /* NSF delete stale route */
- if (peer->nsf[AFI_IP6][SAFI_MULTICAST])
- bgp_clear_stale_route (peer, AFI_IP6, SAFI_MULTICAST);
-
- if (BGP_DEBUG (update, UPDATE_IN))
- zlog (peer->log, LOG_DEBUG, "rcvd End-of-RIB for IPv6 Multicast from %s",
- peer->host);
- }
- }
- if (peer->afc[AFI_IP][SAFI_MPLS_VPN])
- {
- if (mp_update.length
- && mp_update.afi == AFI_IP
- && mp_update.safi == SAFI_MPLS_LABELED_VPN)
- bgp_nlri_parse_vpn (peer, NLRI_ATTR_ARG, &mp_update);
-
- if (mp_withdraw.length
- && mp_withdraw.afi == AFI_IP
- && mp_withdraw.safi == SAFI_MPLS_LABELED_VPN)
- bgp_nlri_parse_vpn (peer, NULL, &mp_withdraw);
-
- if (! withdraw_len
- && mp_withdraw.afi == AFI_IP
- && mp_withdraw.safi == SAFI_MPLS_LABELED_VPN
- && mp_withdraw.length == 0)
- {
- /* End-of-RIB received */
-
- if (BGP_DEBUG (update, UPDATE_IN))
- zlog (peer->log, LOG_DEBUG, "rcvd End-of-RIB for VPNv4 Unicast from %s",
- peer->host);
- }
- }
- if (peer->afc[AFI_IP6][SAFI_MPLS_VPN])
- {
- if (mp_update.length
- && mp_update.afi == AFI_IP6
- && mp_update.safi == SAFI_MPLS_LABELED_VPN)
- bgp_nlri_parse_vpn (peer, NLRI_ATTR_ARG, &mp_update);
-
- if (mp_withdraw.length
- && mp_withdraw.afi == AFI_IP6
- && mp_withdraw.safi == SAFI_MPLS_LABELED_VPN)
- bgp_nlri_parse_vpn (peer, NULL, &mp_withdraw);
-
- if (! withdraw_len
- && mp_withdraw.afi == AFI_IP6
- && mp_withdraw.safi == SAFI_MPLS_LABELED_VPN
- && mp_withdraw.length == 0)
- {
- /* End-of-RIB received */
-
- if (BGP_DEBUG (update, UPDATE_IN))
- zlog (peer->log, LOG_DEBUG, "rcvd End-of-RIB for VPNv4 Unicast from %s",
- peer->host);
- }
- }
- if (peer->afc[AFI_IP][SAFI_ENCAP])
- {
- if (mp_update.length
- && mp_update.afi == AFI_IP
- && mp_update.safi == SAFI_ENCAP)
- bgp_nlri_parse_encap (peer, NLRI_ATTR_ARG, &mp_update);
-
- if (mp_withdraw.length
- && mp_withdraw.afi == AFI_IP
- && mp_withdraw.safi == SAFI_ENCAP)
- bgp_nlri_parse_encap (peer, NULL, &mp_withdraw);
-
- if (! withdraw_len
- && mp_withdraw.afi == AFI_IP
- && mp_withdraw.safi == SAFI_MPLS_LABELED_VPN
- && mp_withdraw.length == 0)
- {
- /* End-of-RIB received */
-
- if (BGP_DEBUG (update, UPDATE_IN))
- zlog (peer->log, LOG_DEBUG, "rcvd End-of-RIB for Encap Unicast from %s",
- peer->host);
- }
- }
- if (peer->afc[AFI_IP6][SAFI_ENCAP])
- {
- if (mp_update.length
- && mp_update.afi == AFI_IP6
- && mp_update.safi == SAFI_ENCAP)
- bgp_nlri_parse_encap (peer, NLRI_ATTR_ARG, &mp_update);
-
- if (mp_withdraw.length
- && mp_withdraw.afi == AFI_IP6
- && mp_withdraw.safi == SAFI_ENCAP)
- bgp_nlri_parse_encap (peer, NULL, &mp_withdraw);
-
- if (! withdraw_len
- && mp_withdraw.afi == AFI_IP6
- && mp_withdraw.safi == SAFI_MPLS_LABELED_VPN
- && mp_withdraw.length == 0)
- {
- /* End-of-RIB received */
-
- if (BGP_DEBUG (update, UPDATE_IN))
- zlog (peer->log, LOG_DEBUG, "rcvd End-of-RIB for Encap Unicast from %s",
- peer->host);
- }
- }
-
+
/* Everything is done. We unintern temporary structures which
interned in bgp_attr_parse(). */
bgp_attr_unintern_sub (&attr);
diff --git a/bgpd/bgp_packet.h b/bgpd/bgp_packet.h
index 8f0ebe3..6b0b7f4 100644
--- a/bgpd/bgp_packet.h
+++ b/bgpd/bgp_packet.h
@@ -54,4 +54,6 @@
extern int bgp_capability_receive (struct peer *, bgp_size_t);
+extern int bgp_nlri_parse (struct peer *, struct attr *, struct bgp_nlri *);
+
#endif /* _QUAGGA_BGP_PACKET_H */
diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c
index c1e5e59..b581fd9 100644
--- a/bgpd/bgp_route.c
+++ b/bgpd/bgp_route.c
@@ -3226,7 +3226,8 @@
/* Parse NLRI stream. Withdraw NLRI is recognized by NULL attr
value. */
int
-bgp_nlri_parse (struct peer *peer, struct attr *attr, struct bgp_nlri *packet)
+bgp_nlri_parse_ip (struct peer *peer, struct attr *attr,
+ struct bgp_nlri *packet)
{
u_char *pnt;
u_char *lim;
@@ -3401,6 +3402,7 @@
switch (nlri->safi)
{
case SAFI_MPLS_LABELED_VPN:
+ case SAFI_MPLS_VPN:
return bgp_nlri_sanity_check_vpn (peer, nlri);
case SAFI_UNICAST:
case SAFI_MULTICAST:
diff --git a/bgpd/bgp_route.h b/bgpd/bgp_route.h
index c16eca7..8064598 100644
--- a/bgpd/bgp_route.h
+++ b/bgpd/bgp_route.h
@@ -197,7 +197,7 @@
extern void bgp_info_unset_flag (struct bgp_node *, struct bgp_info *, u_int32_t);
extern int bgp_nlri_sanity_check (struct peer *, struct bgp_nlri *);
-extern int bgp_nlri_parse (struct peer *, struct attr *, struct bgp_nlri *);
+extern int bgp_nlri_parse_ip (struct peer *, struct attr *, struct bgp_nlri *);
extern int bgp_maximum_prefix_overflow (struct peer *, afi_t, safi_t, int);
diff --git a/tests/bgp_mp_attr_test.c b/tests/bgp_mp_attr_test.c
index 39f3b0d..5400dd1 100644
--- a/tests/bgp_mp_attr_test.c
+++ b/tests/bgp_mp_attr_test.c
@@ -32,6 +32,7 @@
#include "bgpd/bgp_open.h"
#include "bgpd/bgp_debug.h"
#include "bgpd/bgp_route.h"
+#include "bgpd/bgp_packet.h"
#include "bgpd/bgp_mplsvpn.h"
#include "bgpd/bgp_nexthop.h"
@@ -723,16 +724,10 @@
if (!parse_ret)
{
- int (*f) (struct peer *, struct attr *, struct bgp_nlri *)
- = bgp_nlri_parse;
-
- if (t->safi == SAFI_MPLS_LABELED_VPN)
- f = bgp_nlri_parse_vpn;
-
if (type == BGP_ATTR_MP_REACH_NLRI)
- nlri_ret = f (peer, &attr, &nlri);
+ nlri_ret = bgp_nlri_parse (peer, &attr, &nlri);
else
- nlri_ret = f (peer, NULL, &nlri);
+ nlri_ret = bgp_nlri_parse (peer, NULL, &nlri);
}
handle_result (peer, t, parse_ret, nlri_ret);