On Mon, 2 Nov 2026 18:49:06 -0500
Jon Maloy
[...]
diff --git a/dhcpv6.c b/dhcpv6.c index 29c7e320..80b76dde 100644 --- a/dhcpv6.c +++ b/dhcpv6.c @@ -318,7 +318,7 @@ static bool dhcpv6_opt(struct iov_tail *data, uint16_t type) * false otherwise and @data is unmodified */ static bool dhcpv6_ia_notonlink(struct iov_tail *data, - struct in6_addr *la) + const struct in6_addr *la) { int ia_types[2] = { OPT_IA_NA, OPT_IA_TA }; struct opt_ia_addr opt_addr_storage; @@ -567,6 +567,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, struct opt_hdr client_id_storage; /* cppcheck-suppress [variableScope,unmatchedSuppression] */ struct opt_ia_na ia_storage; + const struct guest_addr *a; const struct in6_addr *src; struct msg_hdr mh_storage; const struct msg_hdr *mh; @@ -574,6 +575,8 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, const struct udphdr *uh; size_t mlen, n;
+ a = fwd_get_addr(c, AF_INET6, true, CONF_ADDR_ANY); + uh = IOV_REMOVE_HEADER(data, uh_storage); if (!uh) return -1; @@ -627,7 +630,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, if (mh->type == TYPE_CONFIRM && server_id) return -1;
- if (dhcpv6_ia_notonlink(data, &c->ip6.addr)) { + if (a && dhcpv6_ia_notonlink(data, &a->addr.a6)) {
dhcpv6_send_ia_notonlink(c, saddr, data, &client_id_base, @@ -667,6 +670,15 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, default: return -1; } + + /* If no address is available, drop all messages rather than sending a + * bogus address. Information-request messages could ideally still be + * answered, but since we unconditionally include an IA_NA option in all + * replies (RFC 9915, Appendix B.), dropping them is safer. + */ + if (!a) + return 1;
Simpler and safer, at least for the moment, yes. On the other hand, couldn't you just do this at the beginning (when you assign 'a' from fwd_get_addr()), so that you don't need to modify the condition for dhcpv6_ia_notonlink(), as well as all the ones below:
+ if (ia) resp.ia_na.iaid = ((struct opt_ia_na *)ia)->iaid;
@@ -681,8 +693,11 @@ int dhcpv6(struct ctx *c, struct iov_tail *data,
resp.hdr.xid = mh->xid;
+ if (a) + resp.ia_addr.addr = a->addr.a6; tap_udp6_send(c, src, 547, saddr, 546, mh->xid, &resp, n); - c->ip6.addr_seen = c->ip6.addr; + if (a) + c->ip6.addr_seen = a->addr.a6;
...that is, those? They are already redundant (and Cppcheck reports it, by the way), but with an early return on (!a) at the beginning of the function it would become obvious.
return 1; }
-- Stefano