bgpd: flowspec: remove sizelimit check applied to the wrong length field (issue 18557)

Section 4.1 of RFC8955 defines how the length field of flowspec NLRIs is encoded.
The method use implies a maximum length of 4095 for a single flowspec NLRI.
However, in bgp_flowspec.c, we check the length attribute of the bgp_nlri structure against this maximum value, which actually is the *total* length of all NLRI included in the considered MP_REACH_NLRI path attribute.
Due to this confusion, frr would reject valid announces that contain many flowspec NLRIs, when their cummulative length exceeds 4095, and close the session.
The proposed change removes that check entirely. Indeed, there is no need to check the length field of each invidual NLRI because the method employed make it impossible to encode a length greater than 4095.

Signed-off-by: Stephane Poignant <[email protected]>

Author: spoignant-proton

bgpd/bgp_flowspec.c

@@ -105,13 +105,6 @@ int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
 	if (!attr)
 		withdraw = true;
 
-	if (packet->length >= FLOWSPEC_NLRI_SIZELIMIT_EXTENDED) {
-		flog_err(EC_BGP_FLOWSPEC_PACKET,
-			 "BGP flowspec nlri length maximum reached (%u)",
-			 packet->length);
-		return BGP_NLRI_PARSE_ERROR_FLOWSPEC_NLRI_SIZELIMIT;
-	}
-
 	for (; pnt < lim; pnt += psize) {
 		/* Clear prefix structure. */
 		memset(&p, 0, sizeof(p));
@@ -126,6 +119,7 @@ int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
 			psize = psize << 8;
 			psize |= *pnt++;
 		}
+
 		/* When packet overflow occur return immediately. */
 		if (pnt + psize > lim) {
 			flog_err(

bgpd/bgp_flowspec_private.h

@@ -7,7 +7,6 @@
 #define _FRR_BGP_FLOWSPEC_PRIVATE_H
 
 #define FLOWSPEC_NLRI_SIZELIMIT			240
-#define FLOWSPEC_NLRI_SIZELIMIT_EXTENDED		4095
 
 /* Flowspec raffic action bit*/
 #define FLOWSPEC_TRAFFIC_ACTION_TERMINAL	1