From Ryan Hoffman via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6122

Malformed Packet in decode for BGP-AD (autodiscovery) update (RFC6074)

From me:
Add support of RFC6074 (BGP-AD) in BGP dissector.
Both BGP-AD and VPLS-BGP (RFC4761) use the same AFI/SAFI, The NLRI length must be used as a demultiplexer. (See RFC6074  Section 7 : BGP-AD and VPLS-BGP Interoperability)

svn path=/trunk/; revision=38601

1 files changed, 97 insertions, 50 deletions

diff --git a/epan/dissectors/packet-bgp.c b/epan/dissectors/packet-bgp.c
index eddcf42727..dcaa3ee740 100644
--- a/epan/dissectors/packet-bgp.c
+++ b/epan/dissectors/packet-bgp.c
@@ -1107,59 +1107,106 @@ decode_prefix_MP(proto_tree *tree, int hf_addr4, int hf_addr6,
             case SAFNUM_VPLS:
                 plen =  tvb_get_ntohs(tvb,offset);
                 rd_type=tvb_get_ntohs(tvb,offset+2);
-                ce_id=tvb_get_ntohs(tvb,offset+10);
-                labblk_off=tvb_get_ntohs(tvb,offset+12);
-                labblk_size=tvb_get_ntohs(tvb,offset+14);
-                stack_strbuf = ep_strbuf_new_label(NULL);
-                labnum = decode_MPLS_stack(tvb, offset + 16, stack_strbuf);
 
-                switch (rd_type) {
+                /* RFC6074 Section 7 BGP-AD and VPLS-BGP Interoperability 
+                   Both BGP-AD and VPLS-BGP [RFC4761] use the same AFI/SAFI.  In order
+                   for both BGP-AD and VPLS-BGP to co-exist, the NLRI length must be
+                   used as a demultiplexer.
+
+                   The BGP-AD NLRI has an NLRI length of 12 bytes, containing only an
+                   8-byte RD and a 4-byte VSI-ID. VPLS-BGP [RFC4761] uses a 17-byte
+                   NLRI length.  Therefore, implementations of BGP-AD must ignore NLRI
+                   that are greater than 12 bytes.
+                */
+                if(plen == 12) /* BGP-AD */
+                {
+                    switch (rd_type) {
 
-                    case FORMAT_AS2_LOC:
-                        tvb_memcpy(tvb, ip4addr.addr_bytes, offset + 6, 4);
-                        proto_tree_add_text(tree, tvb, start_offset,
-                                            (offset + plen + 1) - start_offset,
-                                            "RD: %u:%s, CE-ID: %u, Label-Block Offset: %u, "
-                                            "Label-Block Size: %u Label Base %s",
-                                            tvb_get_ntohs(tvb, offset + 4),
-                                            ip_to_str(ip4addr.addr_bytes),
-                                            ce_id,
-                                            labblk_off,
-                                            labblk_size,
-                                            stack_strbuf->str);
-                        break;
+                        case FORMAT_AS2_LOC:
+                            proto_tree_add_text(tree, tvb, start_offset,
+                                                (offset + plen + 2) - start_offset,
+                                                "RD: %u:%u, PE_addr: %s",
+                                                tvb_get_ntohs(tvb, offset + 4),
+                                                tvb_get_ntohl(tvb, offset + 6),
+                                                tvb_ip_to_str(tvb, offset + 10));
+                            break;
 
-                    case FORMAT_IP_LOC:
-                        tvb_memcpy(tvb, ip4addr.addr_bytes, offset + 4, 4);
-                        proto_tree_add_text(tree, tvb, offset,
-                                            (offset + plen + 1) - start_offset,
-                                            "RD: %s:%u, CE-ID: %u, Label-Block Offset: %u, "
-                                            "Label-Block Size: %u, Label Base %s",
-                                            ip_to_str(ip4addr.addr_bytes),
-                                            tvb_get_ntohs(tvb, offset + 8),
-                                            ce_id,
-                                            labblk_off,
-                                            labblk_size,
-                                            stack_strbuf->str);
-                        break;
-                    case FORMAT_AS4_LOC:
-                        proto_tree_add_text(tree, tvb, offset,
-                                            (offset + plen + 1) - start_offset,
-                                            "RD: %u:%u, CE-ID: %u, Label-Block Offset: %u, "
-                                            "Label-Block Size: %u, Label Base %s",
-                                            tvb_get_ntohl(tvb, offset + 4),
-                                            tvb_get_ntohs(tvb, offset + 8),
-                                            ce_id,
-                                            labblk_off,
-                                            labblk_size,
-                                            stack_strbuf->str);
-                        break;
-                    default:
-                        proto_tree_add_text(tree, tvb, start_offset,
-                                            (offset - start_offset) + 2,
-                                            "Unknown labeled VPN address format %u", rd_type);
-                        return -1;
-                } /* switch (rd_type) */
+                        case FORMAT_IP_LOC:
+                            proto_tree_add_text(tree, tvb, offset,
+                                                (offset + plen + 2) - start_offset,
+                                                "RD: %s:%u, PE_addr: %s",
+                                                tvb_ip_to_str(tvb, offset + 10),
+                                                tvb_get_ntohs(tvb, offset + 8),
+                                                tvb_ip_to_str(tvb, offset + 10));
+                            break;
+                        case FORMAT_AS4_LOC:
+                            proto_tree_add_text(tree, tvb, start_offset,
+                                                (offset + plen + 2) - start_offset,
+                                                "RD: %u:%u, PE_addr: %s",
+                                                tvb_get_ntohl(tvb, offset + 4),
+                                                tvb_get_ntohs(tvb, offset + 8),
+                                                tvb_ip_to_str(tvb, offset + 10));
+                            break;
+                        default:
+                            proto_tree_add_text(tree, tvb, start_offset,
+                                                (offset - start_offset) + 2,
+                                                "Unknown labeled VPN address format %u", rd_type);
+                            return -1;
+                    } /* switch (rd_type) */
+                }else{ /* VPLS-BGP */
+                    ce_id=tvb_get_ntohs(tvb,offset+10);
+                    labblk_off=tvb_get_ntohs(tvb,offset+12);
+                    labblk_size=tvb_get_ntohs(tvb,offset+14);
+                    stack_strbuf = ep_strbuf_new_label(NULL);
+                    labnum = decode_MPLS_stack(tvb, offset + 16, stack_strbuf);
+                    switch (rd_type) {
+
+                        case FORMAT_AS2_LOC:
+                            tvb_memcpy(tvb, ip4addr.addr_bytes, offset + 6, 4);
+                            proto_tree_add_text(tree, tvb, start_offset,
+                                                (offset + plen + 1) - start_offset,
+                                                "RD: %u:%s, CE-ID: %u, Label-Block Offset: %u, "
+                                                "Label-Block Size: %u Label Base %s",
+                                                tvb_get_ntohs(tvb, offset + 4),
+                                                ip_to_str(ip4addr.addr_bytes),
+                                                ce_id,
+                                                labblk_off,
+                                                labblk_size,
+                                                stack_strbuf->str);
+                            break;
+
+                        case FORMAT_IP_LOC:
+                            tvb_memcpy(tvb, ip4addr.addr_bytes, offset + 4, 4);
+                            proto_tree_add_text(tree, tvb, offset,
+                                                (offset + plen + 1) - start_offset,
+                                                "RD: %s:%u, CE-ID: %u, Label-Block Offset: %u, "
+                                                "Label-Block Size: %u, Label Base %s",
+                                                ip_to_str(ip4addr.addr_bytes),
+                                                tvb_get_ntohs(tvb, offset + 8),
+                                                ce_id,
+                                                labblk_off,
+                                                labblk_size,
+                                                stack_strbuf->str);
+                            break;
+                        case FORMAT_AS4_LOC:
+                            proto_tree_add_text(tree, tvb, offset,
+                                                (offset + plen + 1) - start_offset,
+                                                "RD: %u:%u, CE-ID: %u, Label-Block Offset: %u, "
+                                                "Label-Block Size: %u, Label Base %s",
+                                                tvb_get_ntohl(tvb, offset + 4),
+                                                tvb_get_ntohs(tvb, offset + 8),
+                                                ce_id,
+                                                labblk_off,
+                                                labblk_size,
+                                                stack_strbuf->str);
+                            break;
+                        default:
+                            proto_tree_add_text(tree, tvb, start_offset,
+                                                (offset - start_offset) + 2,
+                                                "Unknown labeled VPN address format %u", rd_type);
+                            return -1;
+                    } /* switch (rd_type) */
+                }
                 /* FIXME there are subTLVs left to decode ... for now lets omit them */
                 total_length = plen+2;
                 break;