diff options
Diffstat (limited to 'packet/bgp.go')
| -rw-r--r-- | packet/bgp.go | 74 |
1 files changed, 67 insertions, 7 deletions
diff --git a/packet/bgp.go b/packet/bgp.go index 252a9296..9df7812d 100644 --- a/packet/bgp.go +++ b/packet/bgp.go @@ -1855,11 +1855,19 @@ func (p *PathAttributeMpReachNLRI) DecodeFromBytes(data []byte) error { if err != nil { return err } + eCode := uint8(BGP_ERROR_UPDATE_MESSAGE_ERROR) + eSubCode := uint8(BGP_ERROR_SUB_ATTRIBUTE_LENGTH_ERROR) value := p.PathAttribute.Value + if len(value) < 3 { + return NewMessageError(eCode, eSubCode, value, "mpreach header length is short") + } afi := binary.BigEndian.Uint16(value[0:2]) safi := value[2] nexthopLen := value[3] + if len(value) < int(4+nexthopLen) { + return NewMessageError(eCode, eSubCode, value, "mpreach nexthop length is short") + } nexthopbin := value[4 : 4+nexthopLen] value = value[4+nexthopLen:] if nexthopLen > 0 { @@ -1871,13 +1879,25 @@ func (p *PathAttributeMpReachNLRI) DecodeFromBytes(data []byte) error { if afi == AFI_IP6 { addrlen = 16 } + if len(nexthopbin) != offset+addrlen { + return NewMessageError(eCode, eSubCode, value, "mpreach nexthop length is incorrect") + } p.Nexthop = nexthopbin[offset : +offset+addrlen] } // skip reserved + if len(value) == 0 { + return NewMessageError(eCode, eSubCode, value, "no skip byte") + } value = value[1:] for len(value) > 0 { prefix := routeFamilyPrefix(afi, safi) - prefix.DecodeFromBytes(value) + err := prefix.DecodeFromBytes(value) + if err != nil { + return err + } + if prefix.Len() > len(value) { + return NewMessageError(eCode, eSubCode, value, "prefix length is incorrect") + } value = value[prefix.Len():] p.Value = append(p.Value, prefix) } @@ -1943,15 +1963,26 @@ type PathAttributeMpUnreachNLRI struct { } func (p *PathAttributeMpUnreachNLRI) DecodeFromBytes(data []byte) error { - p.PathAttribute.DecodeFromBytes(data) + err := p.PathAttribute.DecodeFromBytes(data) + if err != nil { + return nil + } + eCode := uint8(BGP_ERROR_UPDATE_MESSAGE_ERROR) + eSubCode := uint8(BGP_ERROR_SUB_ATTRIBUTE_LENGTH_ERROR) value := p.PathAttribute.Value + if len(value) < 3 { + return NewMessageError(eCode, eSubCode, value, "unreach header length is incorrect") + } afi := binary.BigEndian.Uint16(value[0:2]) safi := value[2] value = value[3:] for len(value) > 0 { prefix := routeFamilyPrefix(afi, safi) prefix.DecodeFromBytes(value) + if prefix.Len() > len(value) { + return NewMessageError(eCode, eSubCode, value, "prefix length is incorrect") + } value = value[prefix.Len():] p.Value = append(p.Value, prefix) } @@ -2097,8 +2128,15 @@ func parseExtended(data []byte) ExtendedCommunityInterface { } func (p *PathAttributeExtendedCommunities) DecodeFromBytes(data []byte) error { - p.PathAttribute.DecodeFromBytes(data) - + err := p.PathAttribute.DecodeFromBytes(data) + if err != nil { + return err + } + if len(p.PathAttribute.Value)%8 != 0 { + eCode := uint8(BGP_ERROR_UPDATE_MESSAGE_ERROR) + eSubCode := uint8(BGP_ERROR_SUB_ATTRIBUTE_LENGTH_ERROR) + return NewMessageError(eCode, eSubCode, nil, "extendedcommunities length isn't correct") + } value := p.PathAttribute.Value for len(value) >= 8 { e := parseExtended(value) @@ -2139,12 +2177,27 @@ type PathAttributeAs4Path struct { } func (p *PathAttributeAs4Path) DecodeFromBytes(data []byte) error { - p.PathAttribute.DecodeFromBytes(data) + err := p.PathAttribute.DecodeFromBytes(data) + if err != nil { + return err + } + eCode := uint8(BGP_ERROR_UPDATE_MESSAGE_ERROR) + eSubCode := uint8(BGP_ERROR_SUB_MALFORMED_ATTRIBUTE_LIST) v := p.PathAttribute.Value + as4Bytes, err := p.DefaultAsPath.isValidAspath(p.PathAttribute.Value) + if err != nil { + return err + } + if as4Bytes == false { + return NewMessageError(eCode, eSubCode, nil, "AS4 PATH param is malformed") + } for len(v) > 0 { tuple := &As4PathParam{} tuple.DecodeFromBytes(v) p.Value = append(p.Value, tuple) + if len(v) < tuple.Len() { + return NewMessageError(eCode, eSubCode, nil, "AS4 PATH param is malformed") + } v = v[tuple.Len():] } return nil @@ -2194,8 +2247,15 @@ type PathAttributeAs4Aggregator struct { } func (p *PathAttributeAs4Aggregator) DecodeFromBytes(data []byte) error { - p.PathAttribute.DecodeFromBytes(data) - + err := p.PathAttribute.DecodeFromBytes(data) + if err != nil { + return err + } + if len(p.PathAttribute.Value) != 8 { + eCode := uint8(BGP_ERROR_UPDATE_MESSAGE_ERROR) + eSubCode := uint8(BGP_ERROR_SUB_MALFORMED_ATTRIBUTE_LIST) + return NewMessageError(eCode, eSubCode, nil, "AS4 Aggregator length is incorrect") + } p.Value.AS = binary.BigEndian.Uint32(p.PathAttribute.Value[0:4]) p.Value.Address = p.PathAttribute.Value[4:] return nil |