untrusted comment: verify with openbsd-71-base.pub
RWR2eHwZTOEiTSfgYxxQkgK3ygNXvoqXAblB1qJlG9cOGU7Ao1Z6+lUASLgYq5NycH8kgrAN5PMfn/MWPaftIcKQ5oHJO8afrQU=

OpenBSD 7.1 errata 008, August 2, 2022:

bgpd(8) could fail to invalidate nexthops and incorrectly leave them in
the FIB or Adj-RIB-Out.

Apply by doing:
   signify -Vep /etc/signify/openbsd-71-base.pub -x 008_bgpd.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install bgpd(8):
   cd /usr/src/usr.sbin/bgpd
   make obj
   make
   make install

Index: usr.sbin/bgpd/rde.c
===================================================================
RCS file: /cvs/src/usr.sbin/bgpd/rde.c,v
retrieving revision 1.544
diff -u -p -r1.544 rde.c
--- usr.sbin/bgpd/rde.c 22 Mar 2022 10:53:08 -0000      1.544
+++ usr.sbin/bgpd/rde.c 25 Jul 2022 12:57:14 -0000
@@ -4170,8 +4170,7 @@ network_dump_upcall(struct rib_entry *re

               bzero(&k, sizeof(k));
               memcpy(&k.prefix, &addr, sizeof(k.prefix));
-               if (prefix_nexthop(p) == NULL ||
-                   prefix_nexthop(p)->state != NEXTHOP_REACH)
+               if (prefix_nhvalid(p))
                       k.nexthop.aid = k.prefix.aid;
               else
                       memcpy(&k.nexthop, &prefix_nexthop(p)->true_nexthop,
Index: usr.sbin/bgpd/rde.h
===================================================================
RCS file: /cvs/src/usr.sbin/bgpd/rde.h,v
retrieving revision 1.251
diff -u -p -r1.251 rde.h
--- usr.sbin/bgpd/rde.h 22 Mar 2022 10:53:08 -0000      1.251
+++ usr.sbin/bgpd/rde.h 25 Jul 2022 12:44:00 -0000
@@ -352,6 +352,8 @@ struct prefix {
#define        NEXTHOP_REJECT          0x02
#define        NEXTHOP_BLACKHOLE       0x04
#define        NEXTHOP_NOMODIFY        0x08
+#define        NEXTHOP_MASK            0x0f
+#define        NEXTHOP_VALID           0x80

struct filterstate {
       struct rde_aspath        aspath;
@@ -504,6 +506,8 @@ int          prefix_eligible(struct prefix *);
struct prefix  *prefix_best(struct rib_entry *);
void            prefix_evaluate(struct rib_entry *, struct prefix *,
                    struct prefix *);
+void            prefix_evaluate_nexthop(struct prefix *, enum nexthop_state,
+                    enum nexthop_state);

/* rde_filter.c */
void   rde_apply_set(struct filter_set_head *, struct rde_peer *,
@@ -643,7 +647,13 @@ prefix_nexthop(struct prefix *p)
static inline uint8_t
prefix_nhflags(struct prefix *p)
{
-       return (p->nhflags);
+       return (p->nhflags & NEXTHOP_MASK);
+}
+
+static inline int
+prefix_nhvalid(struct prefix *p)
+{
+       return ((p->nhflags & NEXTHOP_VALID) != 0);
}

static inline uint8_t
Index: usr.sbin/bgpd/rde_decide.c
===================================================================
RCS file: /cvs/src/usr.sbin/bgpd/rde_decide.c,v
retrieving revision 1.91
diff -u -p -r1.91 rde_decide.c
--- usr.sbin/bgpd/rde_decide.c  22 Mar 2022 10:53:08 -0000      1.91
+++ usr.sbin/bgpd/rde_decide.c  25 Jul 2022 13:20:50 -0000
@@ -138,28 +138,10 @@ prefix_cmp(struct prefix *p1, struct pre
       peer1 = prefix_peer(p1);
       peer2 = prefix_peer(p2);

-       /* pathes with errors are not eligible */
-       if (asp1 == NULL || asp1->flags & F_ATTR_PARSE_ERR)
-               return -1;
-       if (asp2 == NULL || asp2->flags & F_ATTR_PARSE_ERR)
-               return 1;
-
-       /* only loop free pathes are eligible */
-       if (asp1->flags & F_ATTR_LOOP)
-               return -1;
-       if (asp2->flags & F_ATTR_LOOP)
-               return 1;
-
-       /*
-        * 1. check if prefix is eligible a.k.a reachable
-        *    A NULL nexthop is eligible since it is used for locally
-        *    announced networks.
-        */
-       if (prefix_nexthop(p2) != NULL &&
-           prefix_nexthop(p2)->state != NEXTHOP_REACH)
+       /* 1. check if prefix is eligible a.k.a reachable */
+       if (!prefix_eligible(p2))
               return 1;
-       if (prefix_nexthop(p1) != NULL &&
-           prefix_nexthop(p1)->state != NEXTHOP_REACH)
+       if (!prefix_eligible(p1))
               return -1;

       /* 2. local preference of prefix, bigger is better */
@@ -416,16 +398,13 @@ int
prefix_eligible(struct prefix *p)
{
       struct rde_aspath *asp = prefix_aspath(p);
-       struct nexthop *nh = prefix_nexthop(p);

       /* The aspath needs to be loop and error free */
       if (asp == NULL || asp->flags & (F_ATTR_LOOP|F_ATTR_PARSE_ERR))
               return 0;
-       /*
-        * If the nexthop exists it must be reachable.
-        * It is OK if the nexthop does not exist (local announcement).
-        */
-       if (nh != NULL && nh->state != NEXTHOP_REACH)
+
+       /* The nexthop must be valid. */
+       if (!prefix_nhvalid(p))
               return 0;

       return 1;
@@ -472,16 +451,11 @@ prefix_evaluate(struct rib_entry *re, st
       }

       active = prefix_best(re);
-
       if (old != NULL)
               prefix_remove(old, re);
-
       if (new != NULL)
               prefix_insert(new, NULL, re);
-
-       xp = TAILQ_FIRST(&re->prefix_h);
-       if (xp != NULL && !prefix_eligible(xp))
-               xp = NULL;
+       xp = prefix_best(re);

       /*
        * If the active prefix changed or the active prefix was removed
@@ -506,5 +480,76 @@ prefix_evaluate(struct rib_entry *re, st
        */
       if (rde_evaluate_all())
               if ((new != NULL && prefix_eligible(new)) || old != NULL)
-                       rde_generate_updates(rib, prefix_best(re), NULL, 1);
+                       rde_generate_updates(rib, xp, NULL, 1);
}
+
+void
+prefix_evaluate_nexthop(struct prefix *p, enum nexthop_state state,
+    enum nexthop_state oldstate)
+{
+       struct rib_entry *re = prefix_re(p);
+       struct prefix   *newbest, *oldbest;
+       struct rib      *rib;
+
+       /* Skip non local-RIBs or RIBs that are flagged as noeval. */
+       rib = re_rib(re);
+       if (rib->flags & F_RIB_NOEVALUATE) {
+               log_warnx("%s: prefix with F_RIB_NOEVALUATE hit", __func__);
+               return;
+       }
+
+       if (oldstate == state) {
+               /*
+                * The state of the nexthop did not change. The only
+                * thing that may have changed is the true_nexthop
+                * or other internal infos. This will not change
+                * the routing decision so shortcut here.
+                * XXX needs to be changed for ECMP
+                */
+               if (state == NEXTHOP_REACH) {
+                       if ((rib->flags & F_RIB_NOFIB) == 0 &&
+                           p == prefix_best(re))
+                               rde_send_kroute(rib, p, NULL);
+               }
+               return;
+       }
+
+       /*
+        * Re-evaluate the prefix by removing the prefix then updating the
+        * nexthop state and reinserting the prefix again.
+        */
+       oldbest = prefix_best(re);
+       prefix_remove(p, re);
+
+       if (state == NEXTHOP_REACH)
+               p->nhflags |= NEXTHOP_VALID;
+       else
+               p->nhflags &= ~NEXTHOP_VALID;
+
+       prefix_insert(p, NULL, re);
+       newbest = prefix_best(re);
+
+       /*
+        * If the active prefix changed or the active prefix was removed
+        * and added again then generate an update.
+        */
+       if (oldbest != newbest || newbest == p) {
+               /*
+                * Send update withdrawing oldbest and adding newbest
+                * but remember that newbest may be NULL aka ineligible.
+                * Additional decision may be made by the called functions.
+                */
+               rde_generate_updates(rib, newbest, oldbest, 0);
+               if ((rib->flags & F_RIB_NOFIB) == 0)
+                       rde_send_kroute(rib, newbest, oldbest);
+               return;
+       }
+
+       /*
+        * If there are peers with 'rde evaluate all' every update needs
+        * to be passed on (not only a change of the best prefix).
+        * rde_generate_updates() will then take care of distribution.
+        */
+       if (rde_evaluate_all())
+               rde_generate_updates(rib, newbest, NULL, 1);
+ }
Index: usr.sbin/bgpd/rde_rib.c
===================================================================
RCS file: /cvs/src/usr.sbin/bgpd/rde_rib.c,v
retrieving revision 1.237
diff -u -p -r1.237 rde_rib.c
--- usr.sbin/bgpd/rde_rib.c     22 Mar 2022 10:53:08 -0000      1.237
+++ usr.sbin/bgpd/rde_rib.c     25 Jul 2022 12:54:13 -0000
@@ -1502,37 +1502,6 @@ prefix_bypeer(struct rib_entry *re, stru
       return (NULL);
}

-static void
-prefix_evaluate_all(struct prefix *p, enum nexthop_state state,
-    enum nexthop_state oldstate)
-{
-       struct rib_entry *re = prefix_re(p);
-
-       /* Skip non local-RIBs or RIBs that are flagged as noeval. */
-       if (re_rib(re)->flags & F_RIB_NOEVALUATE) {
-               log_warnx("%s: prefix with F_RIB_NOEVALUATE hit", __func__);
-               return;
-       }
-
-       if (oldstate == state) {
-               /*
-                * The state of the nexthop did not change. The only
-                * thing that may have changed is the true_nexthop
-                * or other internal infos. This will not change
-                * the routing decision so shortcut here.
-                */
-               if (state == NEXTHOP_REACH) {
-                       if ((re_rib(re)->flags & F_RIB_NOFIB) == 0 &&
-                           p == prefix_best(re))
-                               rde_send_kroute(re_rib(re), p, NULL);
-               }
-               return;
-       }
-
-       /* redo the route decision */
-       prefix_evaluate(prefix_re(p), p, p);
-}
-
/* kill a prefix. */
void
prefix_destroy(struct prefix *p)
@@ -1704,7 +1673,7 @@ nexthop_runner(void)

       p = nh->next_prefix;
       for (j = 0; p != NULL && j < RDE_RUNNER_ROUNDS; j++) {
-               prefix_evaluate_all(p, nh->state, nh->oldstate);
+               prefix_evaluate_nexthop(p, nh->state, nh->oldstate);
               p = LIST_NEXT(p, entry.list.nexthop);
       }

@@ -1806,15 +1775,24 @@ nexthop_modify(struct nexthop *setnh, en
void
nexthop_link(struct prefix *p)
{
-       if (p->nexthop == NULL)
-               return;
-       if (p->flags & PREFIX_FLAG_ADJOUT)
+       p->nhflags &= ~NEXTHOP_VALID;
+
+       if (p->flags & PREFIX_FLAG_ADJOUT) {
+               /* All nexthops are valid in Adj-RIB-Out */
+               p->nhflags |= NEXTHOP_VALID;
               return;
+       }

       /* no need to link prefixes in RIBs that have no decision process */
       if (re_rib(prefix_re(p))->flags & F_RIB_NOEVALUATE)
               return;

+       /* self-announce networks use nexthop NULL and are valid as well */
+       if (p->nexthop == NULL || p->nexthop->state == NEXTHOP_REACH)
+               p->nhflags |= NEXTHOP_VALID;
+
+       if (p->nexthop == NULL)
+               return;
       p->flags |= PREFIX_NEXTHOP_LINKED;
       LIST_INSERT_HEAD(&p->nexthop->prefix_h, p, entry.list.nexthop);
}
@@ -1822,6 +1800,8 @@ nexthop_link(struct prefix *p)
void
nexthop_unlink(struct prefix *p)
{
+       p->nhflags &= ~NEXTHOP_VALID;
+
       if (p->nexthop == NULL || (p->flags & PREFIX_NEXTHOP_LINKED) == 0)
               return;