From 50c18cbe119bf8a21c8ef7e9c93438088d86c62d Mon Sep 17 00:00:00 2001 From: Carmine Scarpitta Date: Sat, 17 Oct 2026 17:29:43 +0200 Subject: [PATCH 1/2] bgpd: Ignore repeated SRv6 SID Information Sub-TLVs RFC 9252 says that when multiple SID Information Sub-TLVs are present, the ingress PE SHOULD use the SID from the first instance and ignore subsequent ones. The parser currently treats a subsequent SID Information Sub-TLV as a malformed Prefix-SID attribute, contrary to RFC 9252. Fix this by ignoring subsequent SID Information Sub-TLVs after the first SID has been processed, aligning the parser with RFC 9252. Signed-off-by: Carmine Scarpitta --- bgpd/bgp_attr.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c index 72dfbd390759..a69ab6fde9aa 100644 --- a/bgpd/bgp_attr.c +++ b/bgpd/bgp_attr.c @@ -3757,6 +3757,15 @@ static enum bgp_attr_parse_ret bgp_attr_srv6_service(struct bgp_attr_parser_args size_t start; size_t consumed; + /* We already processed an SID Information Sub-TLV. RFC 9252 says + * that when multiple instances are present, the ingress PE SHOULD use + * the SID from the first, so ignore this subsequent instance. + */ + if (bgp_attr_get_srv6_l3service(attr)) { + stream_forward_getp(connection->curr, length); + return BGP_ATTR_PARSE_PROCEED; + } + if (length < BGP_PREFIX_SID_SRV6_L3_SERVICE_SID_INFO_LENGTH) { flog_err(EC_BGP_ATTR_LEN, "Malformed SRv6 Service Sub-TLV attribute - declared length %u is less than minimum %d", @@ -3779,13 +3788,6 @@ static enum bgp_attr_parse_ret bgp_attr_srv6_service(struct bgp_attr_parser_args __func__, &ipv6_sid, sid_flags, endpoint_behavior); /* Configure from Info */ - if (bgp_attr_get_srv6_l3service(attr)) { - flog_err(EC_BGP_ATTRIBUTE_REPEATED, - "Prefix SID SRv6 L3 Service field repeated"); - return bgp_attr_malformed( - args, BGP_NOTIFY_UPDATE_MAL_ATTR, args->total); - } - struct bgp_attr_srv6_l3service *srv6_l3service = XCALLOC(MTYPE_BGP_SRV6_L3SERVICE, sizeof(struct bgp_attr_srv6_l3service)); From 51c50dededb687d47fb4b0f639bbb54a1298b2d2 Mon Sep 17 00:00:00 2001 From: Carmine Scarpitta Date: Sat, 17 Oct 2026 17:29:51 +0200 Subject: [PATCH 2/2] tests: Cover repeated SRv6 SID Information Sub-TLVs Add a Prefix-SID test with repeated SRv6 SID Information Sub-TLVs and verify that the parser accepts the first instance and ignores all others. Signed-off-by: Carmine Scarpitta --- tests/bgpd/test_mp_attr.c | 31 +++++++++++++++++++++++++++++++ tests/bgpd/test_mp_attr.py | 3 +++ 2 files changed, 34 insertions(+) diff --git a/tests/bgpd/test_mp_attr.c b/tests/bgpd/test_mp_attr.c index b01b5acc4f48..a335acc6029e 100644 --- a/tests/bgpd/test_mp_attr.c +++ b/tests/bgpd/test_mp_attr.c @@ -1083,6 +1083,37 @@ static struct test_segment mp_prefix_sid[] = { .len = 37, .parses = SHOULD_WITHDRAW, }, + { + .name = "PREFIX-SID-SRv6-L3-Service-repeated-sid-info", + .desc = "PREFIX-SID accepts repeated SRv6 SID Information Sub-TLVs", + .data = { + 0x05, /* Type 0x05: SRv6 L3 Service */ + 0x00, 0x31, /* Length */ + 0x00, /* Reserved */ + 0x01, /* Sub-TLV type: SID Information */ + 0x00, 0x15, /* Sub-TLV length */ + 0x00, /* Reserved */ + 0xfc, 0xbb, 0xbb, 0xbb, /* First SID: fcbb:bbbb:1:e000:: */ + 0x00, 0x01, 0xe0, 0x00, + 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, + 0x00, /* SID flags */ + 0x00, 0x40, /* Endpoint behavior */ + 0x00, /* Reserved */ + 0x01, /* Repeated Sub-TLV type: SID Information */ + 0x00, 0x15, /* Sub-TLV length */ + 0x00, /* Reserved */ + 0xfc, 0xbb, 0xbb, 0xbb, /* Second SID: fcbb:bbbb:1:e001:: */ + 0x00, 0x01, 0xe0, 0x01, + 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, + 0x00, /* SID flags */ + 0x00, 0x3e, /* Endpoint behavior */ + 0x00, /* Reserved */ + }, + .len = 52, + .parses = SHOULD_PARSE, + }, {NULL, NULL, { 0 }, 0, 0}, }; diff --git a/tests/bgpd/test_mp_attr.py b/tests/bgpd/test_mp_attr.py index e77220c0ed50..ae311be6aa3e 100644 --- a/tests/bgpd/test_mp_attr.py +++ b/tests/bgpd/test_mp_attr.py @@ -67,3 +67,6 @@ class TestMpAttr(frrtest.TestMultiOut): TestMpAttr.okfail( "PREFIX-SID-SRv6-L3-Service-sid-structure-bad-transposition: PREFIX-SID rejects an SRv6 SID Structure Sub-Sub-TLV with bad transposition" ) +TestMpAttr.okfail( + "PREFIX-SID-SRv6-L3-Service-repeated-sid-info: PREFIX-SID accepts repeated SRv6 SID Information Sub-TLVs" +)