From: Claudio Jeker <cjeker@diehard.n-r-g.com>
Subject: bgpd: handle validation state updates better
To: tech@openbsd.org
Date: Thu, 24 Sep 2026 16:27:15 +0200

Right now prefix_update() handles validation state updates that don't
change anything as a nop. The problem is that because of this possible
outbound filters are not rerun. So filter rules like
	deny to ebgp ovs invalid
don't get rerun and the so routes may be sent out that should not.

Doing the same dance we do for the filtered flag is enough to trigger the
outbound filters.

PS: The Adj-RIB-Out does no longer track the validation state so the
bgpctl show rib out output will always show the validation states as N-?.

-- 
:wq Claudio

Index: rde_rib.c
===================================================================
RCS file: /cvs/src/usr.sbin/bgpd/rde_rib.c,v
diff -u -p -r1.305 rde_rib.c
--- rde_rib.c	21 Sep 2026 18:47:26 -0000	1.305
+++ rde_rib.c	24 Sep 2026 13:47:11 -0000
@@ -955,17 +955,23 @@ prefix_update(struct rib *rib, struct rd
 
 			/* no change, update last change */
 			p->lastchange = getmonotime();
-			p->validation_state = state->vstate;
 			p_filtered = (p->flags & PREFIX_FLAG_FILTERED) != 0;
-			/* check if filtered flag changed */
-			if (p_filtered != filtered) {
+			/* check if filtered flag or validation state changed */
+			if (p_filtered != filtered ||
+			    p->validation_state != state->vstate) {
 				struct rib_entry	*re;
 
 				re = rib_get_addr(rib, prefix, prefixlen);
 				/* remove prefix from rib */
 				prefix_evaluate(re, NULL, p);
-				/* toggle filtered flag */
-				p->flags ^= PREFIX_FLAG_FILTERED;
+
+				/* adjust filtered flag and vstate */
+				if (filtered)
+					p->flags |= PREFIX_FLAG_FILTERED;
+				else
+					p->flags &= ~PREFIX_FLAG_FILTERED;
+				p->validation_state = state->vstate;
+
 				/* redo route decision */
 				prefix_evaluate(re, p, NULL);
 			}