Possible bug in parse_option_buffer

[sthaug at nethelp.no]

I have several cases of the following error message in my dhcpd 3.1.0
server logs:

Mar 29 00:40:42 dhcp2 dhcpd: parse_option_buffer: option <unknown> (808464433:51) larger than buffer.
Mar 29 09:51:39 dhcp2 dhcpd: parse_option_buffer: option <unknown> (808464433:51) larger than buffer.
Mar 29 12:40:42 dhcp2 dhcpd: parse_option_buffer: option <unknown> (808464433:51) larger than buffer.

It is always the same code (808464433) and length (51). It turns out that
this (ASCII 0001 followed by ASCII 3) is part of an option 125 field in
the packet, containing 000138 (looks like the OUI field of a secondary
MAC address for the client in question - 000138 is Xavi Technologies).

I have tcpdump logs and have located the packets in question - however,
as far as I can see these packets are well formed. An example is given
below. In the dhcpd log I find the following lines:

Mar 29 00:40:42 dhcp2 dhcpd: parse_option_buffer: option <unknown> (808464433:51) larger than buffer.
Mar 29 00:40:42 dhcp2 dhcpd: DHCPREQUEST for 81.191.86.105 from 00:01:38:af:04:69 via 81.191.80.1
Mar 29 00:40:42 dhcp2 dhcpd: DHCPACK on 81.191.86.105 to 00:01:38:af:04:69 via 81.191.80.1

I have several more examples - they are all from different clients from
the same vendor, Xavi Technologies, and all appear to be well formed.

Any idea of what might be happening here?

Steinar Haug, Nethelp consulting, sthaug at nethelp.no
----------------------------------------------------------------------

00:40:42.214485 IP (tos 0x0, ttl 62, id 0, offset 0, flags [none], proto UDP (17), length 379) 193.75.2.22.67 > 193.75.4.2.67: BOOTP/DHCP, Request from 00:01:38:af:04:69, length 351, hops 1, xid 0x12af5482, Flags [none]
          Client-IP 81.191.86.105
          Gateway-IP 81.191.80.1
          Client-Ethernet-Address 00:01:38:af:04:69
          Vendor-rfc1048 Extensions
            Magic Cookie 0x63825363
            DHCP-Message Option 53, length 1: Request
            Vendor-Class Option 60, length 14: "wlan_xavi_6546"
            T125 Option 125, length 37: 0.0.17.61.1.6.48.48.48.49.51.56.2.12.48.48.48.49.51.56.97.102.48.52.54.54.3.9.57.54.51.53.56.86.87.50.70
            Agent-Information Option 82, length 49:
              Circuit-ID SubOption 1, length 47: ar5.oea19:GigabitEthernet 1/4.31430330:3143-330
        0x0000:  4500 017b 0000 0000 3e11 f2c3 c14b 0216  E..{....>....K..
        0x0010:  c14b 0402 0043 0043 0167 0000 0101 0601  .K...C.C.g......
        0x0020:  12af 5482 0000 0000 51bf 5669 0000 0000  ..T.....Q.Vi....
        0x0030:  0000 0000 51bf 5001 0001 38af 0469 0000  ....Q.P...8..i..
        0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0050:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0060:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0070:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0080:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0090:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00a0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00b0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00c0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00d0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00e0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00f0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0100:  0000 0000 0000 0000 6382 5363 3501 033c  ........c.Sc5..<
        0x0110:  0e77 6c61 6e5f 7861 7669 5f36 3534 367d  .wlan_xavi_6546}
        0x0120:  2500 0011 3d01 0630 3030 3133 3802 0c30  %...=..000138..0
        0x0130:  3030 3133 3861 6630 3436 3603 0939 3633  00138af0466..963
        0x0140:  3538 5657 3246 5231 012f 6172 352e 6f65  58VW2FR1./ar5.oe
        0x0150:  6131 393a 4769 6761 6269 7445 7468 6572  a19:GigabitEther
        0x0160:  6e65 7420 312f 342e 3331 3433 3033 3330  net.1/4.31430330
        0x0170:  3a33 3134 332d 3333 30ff 00              :3143-330..