From: Theo Buehler <tb@theobuehler.org>
Subject: Re: bgpd: handle validation state updates better
To: tech@openbsd.org
Date: Thu, 24 Sep 2026 16:35:40 +0200

On Thu, Sep 24, 2026 at 04:27:15PM +0200, Claudio Jeker wrote:
> Right now prefix_update() handles validation state updates that don't
> change anything as a nop. The problem is that because of this possible
> outbound filters are not rerun. So filter rules like
> 	deny to ebgp ovs invalid
> don't get rerun and the so routes may be sent out that should not.
> 
> Doing the same dance we do for the filtered flag is enough to trigger the
> outbound filters.

Makes sense and reads fine to me.

ok tb

> 
> PS: The Adj-RIB-Out does no longer track the validation state so the
> bgpctl show rib out output will always show the validation states as N-?.
> 
> -- 
> :wq Claudio
> 
> Index: rde_rib.c
> ===================================================================
> RCS file: /cvs/src/usr.sbin/bgpd/rde_rib.c,v
> diff -u -p -r1.305 rde_rib.c
> --- rde_rib.c	21 Sep 2026 18:47:26 -0000	1.305
> +++ rde_rib.c	24 Sep 2026 13:47:11 -0000
> @@ -955,17 +955,23 @@ prefix_update(struct rib *rib, struct rd
>  
>  			/* no change, update last change */
>  			p->lastchange = getmonotime();
> -			p->validation_state = state->vstate;
>  			p_filtered = (p->flags & PREFIX_FLAG_FILTERED) != 0;
> -			/* check if filtered flag changed */
> -			if (p_filtered != filtered) {
> +			/* check if filtered flag or validation state changed */
> +			if (p_filtered != filtered ||
> +			    p->validation_state != state->vstate) {
>  				struct rib_entry	*re;
>  
>  				re = rib_get_addr(rib, prefix, prefixlen);
>  				/* remove prefix from rib */
>  				prefix_evaluate(re, NULL, p);
> -				/* toggle filtered flag */
> -				p->flags ^= PREFIX_FLAG_FILTERED;
> +
> +				/* adjust filtered flag and vstate */
> +				if (filtered)
> +					p->flags |= PREFIX_FLAG_FILTERED;
> +				else
> +					p->flags &= ~PREFIX_FLAG_FILTERED;
> +				p->validation_state = state->vstate;
> +
>  				/* redo route decision */
>  				prefix_evaluate(re, p, NULL);
>  			}
>