From 513afc985d020741736cc4ca5c0d91272be801c2 Mon Sep 17 00:00:00 2001 From: claudio Date: Mon, 11 Jul 2022 16:58:58 +0000 Subject: [PATCH] Properly roll back in the add-path send case in up_dump_prefix() When up_dump_prefix() runs out of space while filling out prefixes a possible path_id needs to be removed from the buf or else a corrupted UPDATE is sent out. OK tb@ --- usr.sbin/bgpd/rde_update.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/usr.sbin/bgpd/rde_update.c b/usr.sbin/bgpd/rde_update.c index 9332136f757..49253b30e18 100644 --- a/usr.sbin/bgpd/rde_update.c +++ b/usr.sbin/bgpd/rde_update.c @@ -1,4 +1,4 @@ -/* $OpenBSD: rde_update.c,v 1.143 2022/07/11 16:55:21 claudio Exp $ */ +/* $OpenBSD: rde_update.c,v 1.144 2022/07/11 16:58:58 claudio Exp $ */ /* * Copyright (c) 2004 Claudio Jeker @@ -675,8 +675,11 @@ up_dump_prefix(u_char *buf, int len, struct prefix_tree *prefix_head, } pt_getaddr(p->pt, &addr); if ((r = prefix_write(buf + wpos, len - wpos, - &addr, p->pt->prefixlen, withdraw)) == -1) + &addr, p->pt->prefixlen, withdraw)) == -1) { + if (peer_has_add_path(peer, p->pt->aid, CAPA_AP_SEND)) + wpos -= sizeof(pathid); break; + } wpos += r; /* make sure we only dump prefixes which belong together */ @@ -688,7 +691,6 @@ up_dump_prefix(u_char *buf, int len, struct prefix_tree *prefix_head, (np->flags & PREFIX_FLAG_EOR)) done = 1; - if (withdraw) { /* prefix no longer needed, remove it */ prefix_adjout_destroy(p); @@ -700,6 +702,7 @@ up_dump_prefix(u_char *buf, int len, struct prefix_tree *prefix_head, peer->up_nlricnt--; peer->prefix_sent_update++; } + if (done) break; } -- 2.20.1