🔴 Live TV: FRRouting/frr/pull/

Jafaral · 2026-04-22T18:48:55Z

Cap learned Auto-RP RPs and groups per RP per message (fixed upper bounds).
Validate Auto-RP multicast group prefixes; drop bad data and avoid leaking half-built prefix-lists on parse failure.
When candidate RPs are configured, accept announcements only from the RP address or a matching configured candidate; otherwise drop.
Delete superseded AUTORP*_ prefix-lists when an RP refresh uses a new group-list name.

greptile-apps · 2026-04-22T18:54:36Z

Greptile Summary

This PR hardens the Auto-RP announcement and discovery paths against malformed or malicious traffic by adding a two-pass prescan for announcements, enforcing per-RP group-count and prefix-validity bounds, adding source-authorization gating, and cleaning up orphaned __AUTORP_*__ prefix-lists when a discovery RP's group-list name changes.

Announcement path: A new autorp_announcement_prescan_ok function validates source authorization, group-count caps, multicast-prefix validity, and capacity before any state mutations; per-RP state is built into a staging list (new_grps) and committed atomically, so parse failures never leave a partial mapping entry or an armed hold-timer.
Discovery path: Adds PIM_AUTORP_MAX_GROUPS_PER_RP and pim_autorp_group_prefix_valid checks that use continue/success=false rather than return false, preserving already-installed RPs; orphaned prefix-lists from superseded group-list names are now deleted inside pim_autorp_add_rp.
Capacity check ordering: The PIM_AUTORP_MAX_LEARNED_RPS guard in pim_autorp_add_rp is now placed before pim_rp_new, preventing a zombie RP from being registered in PIM's routing table when the discovery-list slot cap is reached.

Confidence Score: 4/5

The announcement hardening is structurally sound; the discovery-path changes are more manually managed and carry residual risk around prefix-list ownership across the caller/callee boundary.

The prescan-then-apply architecture for announcements cleanly solves the partial-state problem and source-auth bypass. The capacity check in pim_autorp_add_rp is now correctly placed before pim_rp_new. The discovery path grp_parse_ok flag and caller-side prefix_list_delete on failure properly close the orphaned-prefix-list gaps. The interaction between the caller-managed prefix-list lifecycle and the superseded-list deletion inside pim_autorp_add_rp is correct but non-obvious; a regression there would silently install an RP against a stale or double-freed prefix-list object.

pimd/pim_autorp.c — specifically the multi-group discovery path's prefix-list ownership handoff between autorp_recv_discovery and pim_autorp_add_rp, and the superseded-list deletion logic for RP group-list name transitions.

Important Files Changed

Filename	Overview
pimd/pim_autorp.c	Core announcement/discovery hardening: new prescan, per-RP abort helper, source-auth gating, capacity checks, and old-prefix-list cleanup; intricate parallel-pass logic between prescan and apply loop is correct but warrants careful testing
pimd/pim_autorp.h	Adds PIM_AUTORP_MAX_LEARNED_RPS (1024) and PIM_AUTORP_MAX_GROUPS_PER_RP (128) constants with explanatory comment; no issues found

Sequence Diagram

sequenceDiagram
    participant Net as Network
    participant Recv as autorp_recv_msg
    participant Pre as autorp_announcement_prescan_ok
    participant Apply as autorp_announcement_apply_mapping_rp
    participant List as mapping_rp_list

    Net->>Recv: PIMv2 Auto-RP Announcement packet
    Recv->>Pre: rpcnt, buf, src
    loop For each RP in packet (prescan)
        Pre->>Pre: Skip PIMv1/unknown RPs (advance offset)
        Pre->>Pre: pim_autorp_allowed_announce_src(src, rp_addr)
        alt Source unauthorized
            Pre-->>Recv: return false (drop entire packet)
        end
        Pre->>Pre: "grpcnt == 0 continue"
        Pre->>Pre: "grpcnt > MAX_GROUPS_PER_RP return false"
        Pre->>Pre: Validate each group prefix
        Pre->>Pre: Check capacity (pending_new tracking)
    end
    Pre-->>Recv: return true
    loop For each RP in packet (apply)
        Recv->>Recv: Skip PIMv1/unknown RPs
        alt "grpcnt == 0"
            Recv->>List: Find existing RP
            List-->>Recv: ma_rp (if exists)
            Recv->>Recv: autorp_mapping_rp_restart_holdtimer
        else "grpcnt > 0"
            Recv->>Apply: holdtime, rp, rp_addr, buf, offset
            Apply->>List: autorp_mapping_rp_get_or_create(rp_addr)
            Apply->>Apply: Build groups into new_grps (staging list)
            alt Parse error or invalid prefix
                Apply->>List: Remove RP if newly created (abort)
                Apply-->>Recv: return false
            end
            Apply->>List: Swap new_grps into ma_rp.grp_pfix_list
            Apply->>List: autorp_mapping_rp_restart_holdtimer
            Apply-->>Recv: return true
        end
    end

_{Reviews (13): Last reviewed commit: "pimd: tighten Auto-RP announcement accep..." | Re-trigger Greptile}

Jafaral · 2026-04-22T21:56:26Z

@greptile review

Jafaral · 2026-04-22T22:24:58Z

@greptile review

Jafaral · 2026-04-23T01:04:11Z

@greptile review

Jafaral · 2026-04-23T02:34:32Z

@greptile review

Jafaral · 2026-04-23T02:42:57Z

@Mergifyio backport stable/10.6 stable/10.5 stable/10.4

mergify · 2026-04-23T02:43:05Z

backport stable/10.6 stable/10.6 stable/10.4

✅ Backports have been created

Details

#21923 pimd: Auto-RP hardening for discovery and announcements (backport #21745) has been created for branch stable/10.6
#21923 pimd: Auto-RP hardening for discovery and announcements (backport #21745) has been created for branch stable/10.6
#21924 pimd: Auto-RP hardening for discovery and announcements (backport #21745) has been created for branch stable/10.4

donaldsharp · 2026-04-23T14:49:57Z

-			ma_rp = trp;
-			/* Free the existing group prefix list, in case the advertised groups changed */
-			pim_autorp_grppfix_free(&ma_rp->grp_pfix_list);
+		{


why do we need this open bracket? Seems odd and gives us more lines of code changes

donaldsharp · 2026-04-23T14:53:11Z


+static bool pim_autorp_group_prefix_valid(const struct prefix *grp)
+{
+	return grp->family == AF_INET && grp->prefixlen <= IPV4_MAX_BITLEN &&


pim_autorp.c is only compiled for v4. Why do we need this test to check it's v4 ?

We still need to guards against a corrupted struct prefix built from packets received on the wire.

donaldsharp · 2026-04-23T14:53:47Z

+	 * announced from an unauthorized source — avoids applying a prefix of RPs
+	 * before failing mid-packet.
+	 */
+	{


why do we need an open paranthesis here?

nabahr · 2026-04-23T19:46:49Z

+	 * announced from an unauthorized source — avoids applying a prefix of RPs
+	 * before failing mid-packet.
+	 */
+	{


I'd like to see this moved to a new announcement validation function

nabahr · 2026-04-23T19:52:54Z

-			/* Free the existing group prefix list, in case the advertised groups changed */
-			pim_autorp_grppfix_free(&ma_rp->grp_pfix_list);
-		}
+		{


This can probably be made a bit cleaner as well if the storing of the announced RP is split out into it's own function as well.

Jafaral · 2026-05-04T18:36:41Z

@greptile review

Jafaral · 2026-05-04T19:01:59Z

@greptile review

Jafaral · 2026-05-09T15:43:50Z

@greptile review

Define fixed upper bounds for mapping-agent learned RPs and for how many group ranges can be advertised per RP in one message. Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com>

Jafaral · 2026-05-12T03:01:55Z

@greptile review

Jafaral · 2026-05-12T03:33:16Z

@greptile review

Jafaral · 2026-05-12T03:56:50Z

@greptile review

Reject bogus mask/address combinations early and discard prefix-list builds when validation fails mid-parse so temporary lists are not leaked. Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com>

Jafaral · 2026-05-12T04:07:39Z

@greptile review

When local candidate-RP configuration exists, require announcements to come from the RP address or a configured candidate address; otherwise drop. Drop superseded Auto-RP-generated prefix lists when discovery refreshes an RP with a new group-list name. Apply source authentication in the announcement prescan before skipping RPs with grpcnt zero. Parse advertised groups into a temporary sorted list and only replace the mapping RP prefix list after a full successful parse; discard a newly inserted mapping RP entry if parsing fails. Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com>

Jafaral · 2026-05-12T04:49:26Z

@greptile review

pimd: Auto-RP hardening for discovery and announcements (backport #21745)

Jafaral requested a review from nabahr April 22, 2026 18:48

frrbot Bot added the pim label Apr 22, 2026

github-actions Bot added size/L master labels Apr 22, 2026

greptile-apps Bot reviewed Apr 22, 2026

View reviewed changes

Comment thread pimd/pim_autorp.c Outdated

Comment thread pimd/pim_autorp.c Outdated

Jafaral force-pushed the autorp-grp-bound branch from ea0eef2 to 363ffd9 Compare April 22, 2026 21:55

greptile-apps Bot reviewed Apr 22, 2026

View reviewed changes

Comment thread pimd/pim_autorp.c Outdated

Jafaral force-pushed the autorp-grp-bound branch from 363ffd9 to bf8afa1 Compare April 22, 2026 22:19

Jafaral force-pushed the autorp-grp-bound branch from bf8afa1 to 8ac8e23 Compare April 23, 2026 00:54

Jafaral force-pushed the autorp-grp-bound branch from 8ac8e23 to 7f68649 Compare April 23, 2026 02:12

github-actions Bot added the backport label Apr 23, 2026

donaldsharp reviewed Apr 23, 2026

View reviewed changes

nabahr requested changes Apr 23, 2026

View reviewed changes

Jafaral force-pushed the autorp-grp-bound branch from 7f68649 to f3ae01c Compare May 4, 2026 18:31

Jafaral force-pushed the autorp-grp-bound branch from f3ae01c to c2e8a14 Compare May 4, 2026 19:03

pimd: cap Auto-RP learned RP entries and groups per RP

253bd87

Define fixed upper bounds for mapping-agent learned RPs and for how many group ranges can be advertised per RP in one message. Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com>

Jafaral force-pushed the autorp-grp-bound branch from c2e8a14 to aed2532 Compare May 12, 2026 02:48

Jafaral force-pushed the autorp-grp-bound branch from aed2532 to 4c2204e Compare May 12, 2026 03:32

greptile-apps Bot reviewed May 12, 2026

View reviewed changes

Comment thread pimd/pim_autorp.c

Jafaral force-pushed the autorp-grp-bound branch from 4c2204e to eddb4d0 Compare May 12, 2026 03:56

greptile-apps Bot reviewed May 12, 2026

View reviewed changes

Comment thread pimd/pim_autorp.c

Jafaral force-pushed the autorp-grp-bound branch from eddb4d0 to 3182874 Compare May 12, 2026 04:05

pimd: validate multicast group prefixes in Auto-RP messages

ba3cfa0

Reject bogus mask/address combinations early and discard prefix-list builds when validation fails mid-parse so temporary lists are not leaked. Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com>

Jafaral force-pushed the autorp-grp-bound branch from 3182874 to e293e0f Compare May 12, 2026 04:07

greptile-apps Bot reviewed May 12, 2026

View reviewed changes

Comment thread pimd/pim_autorp.c

Jafaral force-pushed the autorp-grp-bound branch from e293e0f to 87c7d80 Compare May 12, 2026 04:48

github-actions Bot added size/XL and removed size/L labels May 12, 2026

Jafaral force-pushed the autorp-grp-bound branch from 87c7d80 to cd510f3 Compare May 12, 2026 04:49

nabahr approved these changes May 12, 2026

View reviewed changes

donaldsharp merged commit d3d1fd9 into FRRouting:master May 12, 2026
35 of 36 checks passed

This was referenced May 12, 2026

pimd: Auto-RP hardening for discovery and announcements (backport #21745) #21923

Merged

pimd: Auto-RP hardening for discovery and announcements (backport #21745) #21924

Closed

Jafaral deleted the autorp-grp-bound branch May 29, 2026 16:29

Jafaral added a commit that referenced this pull request Jun 3, 2026

Merge pull request #21923 from FRRouting/mergify/bp/stable/10.6/pr-21745

359b6f3

pimd: Auto-RP hardening for discovery and announcements (backport #21745)

Uh oh!

Conversation

Jafaral commented Apr 22, 2026

Uh oh!

greptile-apps Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Jafaral commented Apr 22, 2026

Uh oh!

Uh oh!

Jafaral commented Apr 22, 2026

Uh oh!

Jafaral commented Apr 23, 2026

Uh oh!

Jafaral commented Apr 23, 2026

Uh oh!

Jafaral commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mergify Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Backports have been created

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Jafaral commented May 4, 2026

Uh oh!

Jafaral commented May 4, 2026

Uh oh!

Jafaral commented May 9, 2026

Uh oh!

Jafaral commented May 12, 2026

Uh oh!

Jafaral commented May 12, 2026

Uh oh!

Uh oh!

Jafaral commented May 12, 2026

Uh oh!

Uh oh!

Jafaral commented May 12, 2026

Uh oh!

Uh oh!

Jafaral commented May 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

greptile-apps Bot commented Apr 22, 2026 •

edited

Loading

Jafaral commented Apr 23, 2026 •

edited

Loading

mergify Bot commented Apr 23, 2026 •

edited

Loading