bgpd: Add some defences for AS4/ENCAP handling

[ton31337]

No description provided.

[greptile-apps]

Greptile Summary

This PR adds two defensive hardening changes to BGP attribute parsing: it replaces a crash-inducing assert with graceful bounds-checking in peek_for_as4_capability, and it introduces a sub-TLV count cap (BGP_ENCAP_SUBTLV_MAX = 64) to prevent unbounded XCALLOC churn from crafted Tunnel Encap attributes. Both changes follow the existing error-handling pattern in the file.

Confidence Score: 5/5

Safe to merge — both changes are strictly defensive and follow existing error-handling patterns.

No logic errors, no regressions. The assert-to-bounds-check conversion in bgp_open.c correctly handles the already-guarded case gracefully. The sub-TLV counter in bgp_attr.c uses post-increment correctly, allowing exactly 64 sub-TLVs before rejecting. Both changes are minimal and targeted.

No files require special attention.

Important Files Changed

Filename	Overview
bgpd/bgp_attr.c	Adds a per-parse sub-TLV counter that rejects attributes exceeding BGP_ENCAP_SUBTLV_MAX (64); follows the existing bgp_attr_malformed() pattern correctly.
bgpd/bgp_attr.h	Introduces BGP_ENCAP_SUBTLV_MAX = 64 macro with an explanatory comment; straightforward header-only addition.
bgpd/bgp_open.c	Replaces assert(capd_end <= end) with a bounds-check + goto end, converting a potential assert-crash on malformed OPEN messages into graceful recovery.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Receive BGP UPDATE / OPEN message] --> B{Message type}

    B -->|OPEN: peek_for_as4_capability| C[Read opt_type + opt_length]
    C --> D{opt_length overflows\ncapd_end > end?}
    D -->|Yes — was assert crash| E[goto end: restore getp, return as4=0]
    D -->|No| F[Parse capabilities\nlooking for AS4]
    F --> G[Return AS4 value]

    B -->|UPDATE: bgp_attr_encap| H[Read Tunnel Encap outer T/L]
    H --> I{length valid?}
    I -->|No| J[bgp_attr_malformed → NOTIFY]
    I -->|Yes| K[Enter sub-TLV loop]
    K --> L{subtlv_count++ >= 64?}
    L -->|Yes — NEW guard| M[flog_err + bgp_attr_malformed → NOTIFY]
    L -->|No| N[Read subtype + sublength]
    N --> O{length checks OK?}
    O -->|No| J
    O -->|Yes| P[XCALLOC sub-TLV\nattach to attr chain]
    P --> Q{more data?}
    Q -->|Yes| K
    Q -->|No| R[Set encap_tunneltype\nreturn success]

Loading

_{Reviews (1): Last reviewed commit: "bgpd: Define a maximum number of TLVs fo..." | Re-trigger Greptile}

[mjstapp]

Thanks

[mjstapp]

@Mergifyio backport stable/10.6 stable/10.5 stable/10.4

[mergify]

backport stable/10.6 stable/10.5 stable/10.4

✅ Backports have been created

Details

• #21779 bgpd: Add some defences for AS4/ENCAP handling (backport #21777) has been created for branch stable/10.6 but encountered conflicts

Cherry-pick of 44f3385 has failed:

On branch mergify/bp/stable/10.6/pr-21777
Your branch is ahead of 'origin/stable/10.6' by 1 commit.
  (use "git push" to publish your local commits)

You are currently cherry-picking commit 44f338574.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   bgpd/bgp_attr.c

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   bgpd/bgp_attr.h

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

• #21780 bgpd: Add some defences for AS4/ENCAP handling (backport #21777) has been created for branch stable/10.5 but encountered conflicts

Cherry-pick of 44f3385 has failed:

On branch mergify/bp/stable/10.5/pr-21777
Your branch is ahead of 'origin/stable/10.5' by 1 commit.
  (use "git push" to publish your local commits)

You are currently cherry-picking commit 44f338574.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   bgpd/bgp_attr.c
	both modified:   bgpd/bgp_attr.h

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

• #21781 bgpd: Add some defences for AS4/ENCAP handling (backport #21777) has been created for branch stable/10.4 but encountered conflicts

Cherry-pick of 44f3385 has failed:

On branch mergify/bp/stable/10.4/pr-21777
Your branch is ahead of 'origin/stable/10.4' by 1 commit.
  (use "git push" to publish your local commits)

You are currently cherry-picking commit 44f338574.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   bgpd/bgp_attr.c
	both modified:   bgpd/bgp_attr.h

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally