diff options
author | Stefano Brivio <sbrivio@redhat.com> | 2025-02-18 09:42:28 +0100 |
---|---|---|
committer | Stefano Brivio <sbrivio@redhat.com> | 2025-02-19 23:33:19 +0100 |
commit | 16553c82806e0a55508baf553cb79e902638c10f (patch) | |
tree | ba34d65863998b22da924025aa66f2ffb87e2ad0 | |
parent | 183bedf478e34079244fe4cfbb2c1a0f02a5a037 (diff) | |
download | passt-16553c82806e0a55508baf553cb79e902638c10f.tar passt-16553c82806e0a55508baf553cb79e902638c10f.tar.gz passt-16553c82806e0a55508baf553cb79e902638c10f.tar.bz2 passt-16553c82806e0a55508baf553cb79e902638c10f.tar.lz passt-16553c82806e0a55508baf553cb79e902638c10f.tar.xz passt-16553c82806e0a55508baf553cb79e902638c10f.tar.zst passt-16553c82806e0a55508baf553cb79e902638c10f.zip |
dhcp: Add option code byte in calculation for OPT_MAX boundary check
Otherwise we'll limit messages to 577 bytes, instead of 576 bytes as
intended:
$ fqdn="thirtytwocharactersforeachlabel.thirtytwocharactersforeachlabel.thirtytwocharactersforeachlabel.thirtytwocharactersforeachlabel.thirtytwocharactersforeachlabel.thirtytwocharactersforeachlabel.thirtytwocharactersforeachlabel.then_make_it_251_with_this"
$ hostname="__eighteen_bytes__"
$ ./pasta --fqdn ${fqdn} -H ${hostname} -p dhcp.pcap -- /sbin/dhclient -4
Saving packet capture to dhcp.pcap
$ tshark -r dhcp.pcap -V -Y 'dhcp.option.value == 5' | grep "Total Length"
Total Length: 577
This was hidden by the issue fixed by commit bcc4908c2b4a ("dhcp
Remove option 255 length byte") until now.
Fixes: 31e8109a86ee ("dhcp, dhcpv6: Add hostname and client fqdn ops")
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Enrique Llorente <ellorent@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
-rw-r--r-- | dhcp.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -143,7 +143,7 @@ static bool fill_one(struct msg *m, int o, int *offset) size_t slen = opts[o].slen; /* If we don't have space to write the option, then just skip */ - if (*offset + 1 /* length of option */ + slen > OPT_MAX) + if (*offset + 2 /* code and length of option */ + slen > OPT_MAX) return true; m->o[*offset] = o; |