Fixes serious bug in BGP add-path

Temporary rta is reused in BGP, while rta_lookup() breaks it.

Thanks to Alexander Chernikov for analysing the problem.

diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 69646c7dd18494d03a240462ab01e3297a7ddd92..d34e7c56afcf523310b82e4ce93e2966a70728ca 100644 (file)
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -999,7 +999,11 @@ bgp_rte_update(struct bgp_proto *p, ip_addr prefix, int pxlen,
   if (!*a)
     {
       a0->src = *src;
+
+      /* Workaround for rta_lookup() breaking eattrs */
+      ea_list *ea = a0->eattrs;
       *a = rta_lookup(a0);
+      a0->eattrs = ea;
     }
 
   net *n = net_get(p->p.table, prefix, pxlen);