contrib/bgp: clear the temporary NLRI bound after a failed parse - #5130
Open
KernelClint wants to merge 2 commits into
Open
contrib/bgp: clear the temporary NLRI bound after a failed parse#5130KernelClint wants to merge 2 commits into
KernelClint wants to merge 2 commits into
Conversation
AI-Assisted: yes (GPT-5.6-Cyber)
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #5130 +/- ##
=======================================
Coverage 80.63% 80.64%
=======================================
Files 390 390
Lines 96936 96937 +1
=======================================
+ Hits 78168 78172 +4
+ Misses 18768 18765 -3
🚀 New features to boost your workflow:
|
The test deliberately makes an over-limit update fail to dissect. With conf.debug_dissector on, as CI runs it, that failure is re-raised and the test never reaches its assertions. AI-Assisted: yes (GPT-5.6-Cyber)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A BGP update carries a list of advertised routes. To parse it, Scapy needs to know where the list
ends, so
scapy/contrib/bgp.py:288-304installs a temporary
length_fromon the field, calls the generic list parser, and clears thecallback after that call returns.
The field belongs to the class, not to the packet being parsed. If the list exceeds Scapy's
configured item limit,
scapy/fields.py:1850-1855raisesMaximumItemsCountand the clearing linenever runs. The stale bound stays installed, and the next BGP update — a separate, valid one — is
cut short at it. That update parses without error and comes back with routes missing and the
remainder as trailing
Raw.The change clears the callback whether the parse succeeded or not:
try: ret = super(BGPNLRIPacketListField, self).getfield(pkt, s) - BGPNLRIPacketListField.length_from = None - return ret + finally: + BGPNLRIPacketListField.length_from = None + return retThe added regression parses an over-limit update, then a valid one, and asserts the valid update
keeps all of its routes. Without the source change the BGP suite reports 157 passed and 1 failed;
with it, 158 passed and 0 failed.
Performance was measured on one computer, before and after the fix: parsing a valid NLRI field took
5,772.1 ns before and 5,741.4 ns after. Repeat runs of this test moved by about 8%, which is wide
enough that only a large change would show — this is not one.