Commit 50c18cbe11 for frr

commit 50c18cbe119bf8a21c8ef7e9c93438088d86c62d
Author: Carmine Scarpitta <cscarpit@cisco.com>
Date:   Sat Oct 17 17:29:43 2026 +0200

    bgpd: Ignore repeated SRv6 SID Information Sub-TLVs

    RFC 9252 says that when multiple SID Information Sub-TLVs are
    present, the ingress PE SHOULD use the SID from the first instance
    and ignore subsequent ones.

    The parser currently treats a subsequent SID Information Sub-TLV as
    a malformed Prefix-SID attribute, contrary to RFC 9252.

    Fix this by ignoring subsequent SID Information Sub-TLVs after the
    first SID has been processed, aligning the parser with RFC 9252.

    Signed-off-by: Carmine Scarpitta <cscarpit@cisco.com>

diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index 72dfbd3907..a69ab6fde9 100644
--- a/bgpd/bgp_attr.c
+++ b/bgpd/bgp_attr.c
@@ -3757,6 +3757,15 @@ static enum bgp_attr_parse_ret bgp_attr_srv6_service(struct bgp_attr_parser_args
 		size_t start;
 		size_t consumed;

+		/* We already processed an SID Information Sub-TLV. RFC 9252 says
+		 * that when multiple instances are present, the ingress PE SHOULD use
+		 * the SID from the first, so ignore this subsequent instance.
+		 */
+		if (bgp_attr_get_srv6_l3service(attr)) {
+			stream_forward_getp(connection->curr, length);
+			return BGP_ATTR_PARSE_PROCEED;
+		}
+
 		if (length < BGP_PREFIX_SID_SRV6_L3_SERVICE_SID_INFO_LENGTH) {
 			flog_err(EC_BGP_ATTR_LEN,
 				 "Malformed SRv6 Service Sub-TLV attribute - declared length %u is less than minimum %d",
@@ -3779,13 +3788,6 @@ static enum bgp_attr_parse_ret bgp_attr_srv6_service(struct bgp_attr_parser_args
 				   __func__, &ipv6_sid, sid_flags, endpoint_behavior);

 		/* Configure from Info */
-		if (bgp_attr_get_srv6_l3service(attr)) {
-			flog_err(EC_BGP_ATTRIBUTE_REPEATED,
-				 "Prefix SID SRv6 L3 Service field repeated");
-			return bgp_attr_malformed(
-				args, BGP_NOTIFY_UPDATE_MAL_ATTR, args->total);
-		}
-
 		struct bgp_attr_srv6_l3service *srv6_l3service =
 			XCALLOC(MTYPE_BGP_SRV6_L3SERVICE, sizeof(struct bgp_attr_srv6_l3service));