bgpd: Limit size of sent NLRIs to flowspec peers (issue 18557)

See issue 18557 for detailed description of the problem. When announcing flowspec routes, frr currently sends NLRIs up to max_packet_size.
However, flowspec NLRIs cannot exceed FLOWSPEC_NLRI_SIZELIMIT (or FLOWSPEC_NLRI_SIZELIMIT_EXTENDED).
The proposed change reduces the size of the stream in that particular case to ensure no invalid messages are sent.

Signed-off-by: Stephane Poignant <[email protected]>

Author: spoignant-proton

bgpd/bgp_updgrp.c

@@ -41,6 +41,7 @@
 #include "bgpd/bgp_route.h"
 #include "bgpd/bgp_filter.h"
 #include "bgpd/bgp_io.h"
+#include "bgpd/bgp_flowspec_private.h"
 
 /********************
  * PRIVATE FUNCTIONS
@@ -69,6 +70,8 @@ static void sync_init(struct update_subgroup *subgrp,
 		      struct update_group *updgrp)
 {
 	struct peer *peer = UPDGRP_PEER(updgrp);
+	safi_t safi = UPDGRP_SAFI(updgrp);
+	size_t nlri_max_length;
 
 	subgrp->sync =
 		XCALLOC(MTYPE_BGP_SYNCHRONISE, sizeof(struct bgp_synchronize));
@@ -95,7 +98,20 @@ static void sync_init(struct update_subgroup *subgrp,
 	 */
 	subgrp->work = stream_new(peer->max_packet_size
 				  + BGP_MAX_PACKET_SIZE_OVERFLOW);
-	subgrp->scratch = stream_new(peer->max_packet_size);
+	if (safi == SAFI_FLOWSPEC) {
+		/* Issue 18557: for flowspec, need to make sure we never send
+		 * SAFIs larger than FLOWSPEC_NLRI_SIZELIMIT_EXTENDED or
+		 * FLOWSPEC_NLRI_SIZELIMIT, as those would be rejected
+		 */
+		nlri_max_length = (CHECK_FLAG(peer->cap, PEER_CAP_EXTENDED_MESSAGE_RCV))
+					  ? FLOWSPEC_NLRI_SIZELIMIT_EXTENDED
+					  : FLOWSPEC_NLRI_SIZELIMIT;
+		subgrp->scratch = stream_new((peer->max_packet_size <= nlri_max_length)
+						     ? peer->max_packet_size
+						     : nlri_max_length);
+	} else {
+		subgrp->scratch = stream_new(peer->max_packet_size);
+	}
 }
 
 static void sync_delete(struct update_subgroup *subgrp)