ospfd: ospfd core if hello packet exceeds link MTU

ospfd/ospf_errors.c

@@ -169,6 +169,15 @@ static struct log_ref ferr_ospf_err[] = {
 		.description = "OSPF has attempted to change states when it should not be able to",
 		.suggestion = "Gather log files and open an issue",
 	},
+	{
+		.code = EC_OSPF_LARGE_HELLO,
+		.title = "OSPF Encountered a Large Hello",
+		.description = "OSPF attempted to send a Hello larger than MTU "
+					   "but did not",
+		.suggestion = "Too many neighbors configured on a single interface."
+					  " Suggestion is to decrease the number of neighbors on"
+					  " a single interface/subnet"
+	},
 	{
 		.code = END_FERR,
 	}

ospfd/ospf_errors.h

@@ -47,6 +47,7 @@ enum ospf_log_refs {
 	EC_OSPF_LSA_MISSING,
 	EC_OSPF_PTP_NEIGHBOR,
 	EC_OSPF_LSA_SIZE,
+	EC_OSPF_LARGE_HELLO,
 };
 
 extern void ospf_error_init(void);

ospfd/ospf_packet.c

@@ -3309,6 +3309,16 @@ static int ospf_make_hello(struct ospf_interface *oi, struct stream *s)
 										.prefix4))
 								flag = 1;
 
+							/* Hello packet overflows interface MTU. */
+							if (length + sizeof(uint32_t)
+								> ospf_packet_max(oi)) {
+								flog_err(
+									EC_OSPF_LARGE_HELLO,
+									"Oversized Hello packet!"
+									" Larger than MTU. Not sending it out");
+								return 0;
+							}
+
 							stream_put_ipv4(
 								s,
 								nbr->router_id
@@ -3578,6 +3588,11 @@ static void ospf_hello_send_sub(struct ospf_interface *oi, in_addr_t addr)
 
 	/* Prepare OSPF Hello body. */
 	length += ospf_make_hello(oi, op->s);
+	if (length == OSPF_HEADER_SIZE) {
+		/* Hello overshooting MTU */
+		ospf_packet_free(op);
+		return;
+	}
 
 	/* Fill OSPF header. */
 	ospf_fill_header(oi, op->s, length);