pimd: harden BSM group/RP parsing paths

[Jafaral]

Bound BSR-derived (G,RP) state growth and tighten AFI/mask validation so malformed or flooded BSM input cannot drive unbounded allocations.

[greptile-apps]

Greptile Summary

This PR hardens pim_bsm.c against malformed/flooded Bootstrap Messages by introducing a per-scope bsrp_rp_count counter, a PIM_BSM_MAX_RP_ENTRIES (1024) cap, proper decrement-on-free in pim_bsm_rpinfo_free, a skip-ahead mechanism so groups beyond the limit don't abort the entire BSM, and tightened AFI/mask validation via pim_group_mask_maxlen. Both prior P1 findings are addressed: pim_bs_timer_restart is now unconditionally called before parsing, and the mid-group RP-limit path now uses break (not return false) so bsgrp->pend_rp_cnt -= ins_count is always reached.

Confidence Score: 5/5

Safe to merge; both prior P1 findings are correctly resolved and no new P0/P1 issues were found.

The two previous P1 findings — unconditional BS timer restart and pend_rp_cnt not being decremented on limit-hit — are directly addressed (timer restart moved before parsing; break instead of return false). Counter accounting across all paths (free, swap, clear-on-new-tag, holdtime-zero removal) is correct. The AFI/mask tightening and skip-ahead logic are well-implemented. Remaining considerations (temporary peak up to 2×MAX during group refresh, pend_rp_cnt staying > 0 when skipped RPs never return in the same epoch) are documented design trade-offs, not bugs.

No files require special attention; pimd/pim_bsm.c deserves a second read on the bsrp_rp_count accounting across pim_instate_pend_list and pim_update_pending_rp_cnt, but all paths appear correct.

Important Files Changed

Filename	Overview
pimd/pim_bsm.c	Core parsing hardening: adds bsrp_rp_count tracking with decrement-on-free, pim_bsm_scope_cannot_add_rp() with old-epoch slack, skip-ahead logic for limit-hit groups, break instead of return false for mid-RP limit, and moves pim_bs_timer_restart before parse; counter accounting across all code paths (instate, update, free) appears correct.
pimd/pim_bsm.h	Adds PIM_BSM_MAX_RP_ENTRIES constant and bsrp_rp_count field to bsm_scope; adds in_scope_count flag to bsm_rpinfo; all additions are well-placed and correctly typed.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[pim_bsm_process: receive BSM] --> B{is_preferred_bsr?}
    B -- No --> Z[drop BSM]
    B -- Yes --> C[pim_bs_timer_restart\nnow unconditional]
    C --> D[pim_bsm_parse_install_g2rp]

    D --> E{for each Group TLV\nin buffer}
    E --> F{AFI/mask\nvalid?\nnew check}
    F -- No --> Z2[return false]
    F -- Yes --> G{bsgrp node\nexists?}

    G -- No, new group --> H{bsrp_rp_count\n>= MAX_RP_ENTRIES?}
    H -- Yes --> I[skip frag_rp_count\nRP bytes, continue]
    H -- No --> J[create bsgrp node]
    G -- Yes --> K[use existing node]
    J --> K

    K --> L{for each RP TLV\nin fragment}
    L --> M[pim_install_bsm_grp_rp]
    M --> N{scope_cannot_add_rp?\nwith old-epoch slack}
    N -- Yes --> O[return false]
    N -- No --> P{bsm_rpinfos_add\nsuccess?}
    P -- Yes --> Q[in_scope_count=true\nbsrp_rp_count++\nreturn true]
    P -- No dup --> R[free, return false]

    O --> S{caller: still\ncannot add?}
    R --> S
    S -- Yes --> T[skip remaining RP bytes\nbreak]
    S -- No --> U[continue]
    Q --> V[ins_count++]
    V --> L

    T --> W[pend_rp_cnt -= ins_count]
    L -- exhausted --> W
    W --> X{pend_rp_cnt == 0?}
    X -- Yes --> Y[pim_instate_pend_list\nswap lists, free old\ndecrement bsrp_rp_count]
    X -- No --> E
    Y --> E

Loading

_{Reviews (3): Last reviewed commit: "pimd: harden BSM group/RP parsing paths" | Re-trigger Greptile}

[Jafaral]

@greptile review

[Jafaral]

@greptile review

[Jafaral]

@Mergifyio backport stable/10.6 stable/10.5 stable/10.4

[mergify]

backport stable/10.6 stable/10.5 stable/10.4

❌ No backport have been created

Details

• #21765 pimd: harden BSM group/RP parsing paths (backport #21734) has been created for branch stable/10.6
• Backport to branch stable/10.5 failed

Git reported the following error:

To https://github.com/FRRouting/frr
 ! [rejected]              mergify/bp/stable/10.5/pr-21734 -> mergify/bp/stable/10.5/pr-21734 (non-fast-forward)
error: failed to push some refs to 'https://github.com/FRRouting/frr'
hint: Updates were rejected because the tip of your current branch is behind
hint: its remote counterpart. Integrate the remote changes (e.g.
hint: 'git pull ...') before pushing again.
hint: See the 'Note about fast-forwards' in 'git push --help' for details.

• #21768 pimd: harden BSM group/RP parsing paths (backport #21734) has been created for branch stable/10.4