From 3ced8ba769ed9b363c934d4b46389d6cda9e1c18 Mon Sep 17 00:00:00 2001 From: Claudio Jeker Date: Wed, 4 Sep 2024 15:06:37 +0000 Subject: Qualifying nexthops via BGP does not properly work since nexthops need to be rechecked when a BGP route is added (or changed). We need to revalidate nexthops on inserts (kroute_insert) and on change (krX_change but only for AID_INET and AID_INET6 -- no nexthops in the other tables) the nexthop needs to be updated. Only validate nexthops if 'nexthop qualify via bgp' is enabled. For route changes the code can depend on the F_NEXTHOP flag. Fix for: https://github.com/openbgpd-portable/openbgpd-portable/issues/81 OK tb@ --- usr.sbin/bgpd/kroute.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) (limited to 'usr.sbin/bgpd/kroute.c') diff --git a/usr.sbin/bgpd/kroute.c b/usr.sbin/bgpd/kroute.c index 6da5986faec..a806ae8a094 100644 --- a/usr.sbin/bgpd/kroute.c +++ b/usr.sbin/bgpd/kroute.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kroute.c,v 1.309 2024/01/09 13:41:32 claudio Exp $ */ +/* $OpenBSD: kroute.c,v 1.310 2024/09/04 15:06:36 claudio Exp $ */ /* * Copyright (c) 2003, 2004 Henning Brauer @@ -511,6 +511,9 @@ kr4_change(struct ktable *kt, struct kroute_full *kf) else kr->flags &= ~F_REJECT; + if (kr->flags & F_NEXTHOP) + knexthop_update(kt, kf); + if (send_rtmsg(RTM_CHANGE, kt, kf)) kr->flags |= F_BGPD_INSERTED; } @@ -549,6 +552,9 @@ kr6_change(struct ktable *kt, struct kroute_full *kf) else kr6->flags &= ~F_REJECT; + if (kr6->flags & F_NEXTHOP) + knexthop_update(kt, kf); + if (send_rtmsg(RTM_CHANGE, kt, kf)) kr6->flags |= F_BGPD_INSERTED; } @@ -1719,13 +1725,14 @@ kroute_insert(struct ktable *kt, struct kroute_full *kf) break; } - /* XXX this is wrong for nexthop validated via BGP */ - if (!(kf->flags & F_BGPD)) { + if (bgpd_has_bgpnh() || !(kf->flags & F_BGPD)) { RB_FOREACH(n, knexthop_tree, KT2KNT(kt)) if (prefix_compare(&kf->prefix, &n->nexthop, kf->prefixlen) == 0) knexthop_validate(kt, n); + } + if (!(kf->flags & F_BGPD)) { /* redistribute multipath routes only once */ if (!multipath) kr_redistribute(IMSG_NETWORK_ADD, kt, kf); -- cgit v1.2.3