osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

From Olivier Benghozi via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7734 

BGP bad decoding for Graceful Restart Capability with only helper support

BGP Capability in OPEN message: Graceful restart capability (64).

So when the length of the capability value is smaller that 6 (6 meaning full
support of GR capa, with significants elements and at least one AFI/SAFI), the
code interprets it as erroneous.

However,as described in RFC4724: " When a sender of this capability does not
include any <AFI, SAFI> in the capability, it means that the sender is not
capable of preserving its forwarding state during BGP restart, but supports
procedures for the Receiving Speaker (as defined in Section 4.2 of this
document). In that case, the value of the Restart Time field advertised by the
sender is irrelevant".

So, length of exactly 2 is valid but has to be interpreted with a particular
meaning.

In the dissector code, a length of 2 should be a special case for this capa,
decoding as "Graceful Restart helper mode only" or something like that, and
maybe also displaying an expert message if the Restart flag is not 0 in this
case, since here it's not expected to be possible.

svn path=/trunk/; revision=45216
This commit is contained in:
Alexis La Goutte 2012-09-30 10:05:18 +00:00
parent 1b3fd6e7e1
commit cd519e450c
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
epan/dissectors/packet-bgp.c
View File

@ -33,6 +33,7 @@
* RFC2918 Route Refresh Capability for BGP-4
* RFC3107 Carrying Label Information in BGP-4
* RFC4486 Subcodes for BGP Cease Notification Message
* RFC4724 Graceful Restart Mechanism for BGP
* RFC5512 BGP Encapsulation SAFI and the BGP Tunnel Encapsulation Attribute
* RFC5640 Load-Balancing for Mesh Softwires
* RFC6608 Subcodes for BGP Finite State Machine Error
@ -2104,7 +2105,7 @@ dissect_bgp_capability_item(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo,
}
break;
case BGP_CAPABILITY_GRACEFUL_RESTART:
if (clen < 6) {
if ((clen < 6) && (clen != 2)) {
expert_add_info_format(pinfo, ti_len, PI_MALFORMED, PI_ERROR, "Capability length %u too short, must be greater than 6", clen);
proto_tree_add_item(cap_tree, hf_bgp_cap_unknown, tvb, offset, clen, ENC_NA);
offset += clen;
@ -2113,6 +2114,10 @@ dissect_bgp_capability_item(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo,
int eclen = offset + clen;
proto_tree *sub_tree;
if (clen == 2){
expert_add_info_format(pinfo, ti_len, PI_REQUEST_CODE, PI_CHAT, "Graceful Restart Capability supported in Helper mode only");
}
/* Timers */
ti = proto_tree_add_item(cap_tree, hf_bgp_cap_gr_timers, tvb, offset, 2, ENC_NA);
sub_tree = proto_item_add_subtree(ti, ett_bgp_cap);