aboutgitcodebugslistschat
path: root/dhcpv6.c
diff options
context:
space:
mode:
Diffstat (limited to 'dhcpv6.c')
-rw-r--r--dhcpv6.c340
1 files changed, 229 insertions, 111 deletions
diff --git a/dhcpv6.c b/dhcpv6.c
index 7dcca2a..c1a27ab 100644
--- a/dhcpv6.c
+++ b/dhcpv6.c
@@ -48,16 +48,20 @@ struct opt_hdr {
# define STATUS_NOTONLINK htons_constant(4)
# define OPT_DNS_SERVERS htons_constant(23)
# define OPT_DNS_SEARCH htons_constant(24)
+# define OPT_CLIENT_FQDN htons_constant(39)
#define STR_NOTONLINK "Prefix not appropriate for link."
uint16_t l;
} __attribute__((packed));
+#define UDP_MSG_HDR_SIZE (sizeof(struct udphdr) + sizeof(struct msg_hdr))
# define OPT_SIZE_CONV(x) (htons_constant(x))
#define OPT_SIZE(x) OPT_SIZE_CONV(sizeof(struct opt_##x) - \
sizeof(struct opt_hdr))
#define OPT_VSIZE(x) (sizeof(struct opt_##x) - \
sizeof(struct opt_hdr))
+#define OPT_MAX_SIZE IPV6_MIN_MTU - (sizeof(struct ipv6hdr) + \
+ UDP_MSG_HDR_SIZE)
/**
* struct opt_client_id - DHCPv6 Client Identifier option
@@ -140,7 +144,9 @@ struct opt_ia_addr {
struct opt_status_code {
struct opt_hdr hdr;
uint16_t code;
- char status_msg[sizeof(STR_NOTONLINK) - 1];
+ /* "nonstring" is only supported since clang 23 */
+ /* NOLINTNEXTLINE(clang-diagnostic-unknown-attributes) */
+ __attribute__((nonstring)) char status_msg[sizeof(STR_NOTONLINK) - 1];
} __attribute__((packed));
/**
@@ -164,6 +170,18 @@ struct opt_dns_search {
} __attribute__((packed));
/**
+ * struct opt_client_fqdn - Client FQDN option (RFC 4704)
+ * @hdr: Option header
+ * @flags: Flags described by RFC 4704
+ * @domain_name: Client FQDN
+ */
+struct opt_client_fqdn {
+ struct opt_hdr hdr;
+ uint8_t flags;
+ char domain_name[PASST_MAXDNAME];
+} __attribute__((packed));
+
+/**
* struct msg_hdr - DHCPv6 client/server message header
* @type: DHCP message type
* @xid: Transaction ID for message exchange
@@ -193,6 +211,7 @@ struct msg_hdr {
* @client_id: Client Identifier, variable length
* @dns_servers: DNS Recursive Name Server, here just for storage size
* @dns_search: Domain Search List, here just for storage size
+ * @client_fqdn: Client FQDN, variable length
*/
static struct resp_t {
struct msg_hdr hdr;
@@ -203,6 +222,7 @@ static struct resp_t {
struct opt_client_id client_id;
struct opt_dns_servers dns_servers;
struct opt_dns_search dns_search;
+ struct opt_client_fqdn client_fqdn;
} __attribute__((__packed__)) resp = {
{ 0 },
SERVER_ID,
@@ -228,6 +248,10 @@ static struct resp_t {
{ { OPT_DNS_SEARCH, 0, },
{ 0 },
},
+
+ { { OPT_CLIENT_FQDN, 0, },
+ 0, { 0 },
+ },
};
static const struct opt_status_code sc_not_on_link = {
@@ -256,85 +280,132 @@ static struct resp_not_on_link_t {
/**
* dhcpv6_opt() - Get option from DHCPv6 message
- * @p: Packet pool, single packet with UDP header
- * @offset: Offset to look at, 0: end of header, set to option start
+ * @data: Buffer with options, set to matching option on return
* @type: Option type to look up, network order
*
- * Return: pointer to option header, or NULL on malformed or missing option
+ * Return: true if found and @data points to the option header,
+ * or false on malformed or missing option and @data is
+ * unmodified.
*/
-static struct opt_hdr *dhcpv6_opt(const struct pool *p, size_t *offset,
- uint16_t type)
+static bool dhcpv6_opt(struct iov_tail *data, uint16_t type)
{
- struct opt_hdr *o;
- size_t left;
+ struct iov_tail head = *data;
+ struct opt_hdr o_storage;
+ const struct opt_hdr *o;
- if (!*offset)
- *offset = sizeof(struct udphdr) + sizeof(struct msg_hdr);
-
- while ((o = packet_get_try(p, 0, *offset, sizeof(*o), &left))) {
+ while ((o = IOV_PEEK_HEADER(data, o_storage))) {
unsigned int opt_len = ntohs(o->l) + sizeof(*o);
- if (ntohs(o->l) > left)
- return NULL;
+ if (opt_len > iov_tail_size(data))
+ break;
if (o->t == type)
- return o;
+ return true;
- *offset += opt_len;
+ iov_drop_header(data, opt_len);
}
- return NULL;
+ *data = head;
+ return false;
}
/**
* dhcpv6_ia_notonlink() - Check if any IA contains non-appropriate addresses
- * @p: Packet pool, single packet starting from UDP header
+ * @data: Data to look at, packet starting from UDP header (input/output)
* @la: Address we want to lease to the client
*
- * Return: pointer to non-appropriate IA_NA or IA_TA, if any, NULL otherwise
+ * Return: true and @data points to non-appropriate IA_NA or IA_TA, if any,
+ * false otherwise and @data is unmodified
*/
-static struct opt_hdr *dhcpv6_ia_notonlink(const struct pool *p,
- struct in6_addr *la)
+static bool dhcpv6_ia_notonlink(struct iov_tail *data,
+ struct in6_addr *la)
{
+ int ia_types[2] = { OPT_IA_NA, OPT_IA_TA }, *ia_type;
+ struct opt_ia_addr opt_addr_storage;
+ const struct opt_ia_addr *opt_addr;
+ struct iov_tail current, ia_base;
+ struct opt_ia_na ia_storage;
char buf[INET6_ADDRSTRLEN];
+ const struct opt_ia_na *ia;
struct in6_addr req_addr;
- struct opt_hdr *ia, *h;
- size_t offset;
- int ia_type;
-
- ia_type = OPT_IA_NA;
-ia_ta:
- offset = 0;
- while ((ia = dhcpv6_opt(p, &offset, ia_type))) {
- if (ntohs(ia->l) < OPT_VSIZE(ia_na))
- return NULL;
-
- offset += sizeof(struct opt_ia_na);
-
- while ((h = dhcpv6_opt(p, &offset, OPT_IAAADR))) {
- struct opt_ia_addr *opt_addr = (struct opt_ia_addr *)h;
-
- if (ntohs(h->l) != OPT_VSIZE(ia_addr))
- return NULL;
-
- memcpy(&req_addr, &opt_addr->addr, sizeof(req_addr));
- if (!IN6_ARE_ADDR_EQUAL(la, &req_addr)) {
- info("DHCPv6: requested address %s not on link",
- inet_ntop(AF_INET6, &req_addr,
- buf, sizeof(buf)));
- return ia;
+ struct opt_hdr h_storage;
+ const struct opt_hdr *h;
+
+ foreach(ia_type, ia_types) {
+ current = *data;
+ while (dhcpv6_opt(&current, *ia_type)) {
+ ia_base = current;
+ ia = IOV_REMOVE_HEADER(&current, ia_storage);
+ if (!ia || ntohs(ia->hdr.l) < OPT_VSIZE(ia_na))
+ goto notfound;
+
+ while (dhcpv6_opt(&current, OPT_IAAADR)) {
+ h = IOV_PEEK_HEADER(&current, h_storage);
+ if (!h || ntohs(h->l) != OPT_VSIZE(ia_addr))
+ goto notfound;
+
+ opt_addr = IOV_REMOVE_HEADER(&current,
+ opt_addr_storage);
+ if (!opt_addr)
+ goto notfound;
+
+ req_addr = opt_addr->addr;
+ if (!IN6_ARE_ADDR_EQUAL(la, &req_addr))
+ goto notonlink;
}
-
- offset += sizeof(struct opt_ia_addr);
}
}
- if (ia_type == OPT_IA_NA) {
- ia_type = OPT_IA_TA;
- goto ia_ta;
- }
+notfound:
+ return false;
- return NULL;
+notonlink:
+ info("DHCPv6: requested address %s not on link",
+ inet_ntop(AF_INET6, &req_addr, buf, sizeof(buf)));
+ *data = ia_base;
+ return true;
+}
+
+/**
+ * dhcpv6_send_ia_notonlink() - Send NotOnLink status
+ * @c: Execution context
+ * @ia_base: Non-appropriate IA_NA or IA_TA base
+ * @client_id_base: Client ID message option base
+ * @len: Client ID length
+ * @xid: Transaction ID for message exchange
+ */
+static void dhcpv6_send_ia_notonlink(struct ctx *c,
+ const struct iov_tail *ia_base,
+ const struct iov_tail *client_id_base,
+ int len, uint32_t xid)
+{
+ const struct in6_addr *src = &c->ip6.our_tap_ll;
+ struct opt_hdr *ia = (struct opt_hdr *)resp_not_on_link.var;
+ size_t n;
+
+ info("DHCPv6: received CONFIRM with inappropriate IA,"
+ " sending NotOnLink status in REPLY");
+
+ n = sizeof(struct opt_ia_na);
+ iov_to_buf(&ia_base->iov[0], ia_base->cnt, ia_base->off,
+ resp_not_on_link.var, n);
+ ia->l = htons(OPT_VSIZE(ia_na) + sizeof(sc_not_on_link));
+ memcpy(resp_not_on_link.var + n, &sc_not_on_link,
+ sizeof(sc_not_on_link));
+
+ n += sizeof(sc_not_on_link);
+ iov_to_buf(&client_id_base->iov[0], client_id_base->cnt,
+ client_id_base->off, resp_not_on_link.var + n,
+ sizeof(struct opt_hdr) + len);
+
+ n += sizeof(struct opt_hdr) + len;
+
+ n = offsetof(struct resp_not_on_link_t, var) + n;
+
+ resp_not_on_link.hdr.xid = xid;
+
+ tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546,
+ xid, &resp_not_on_link, n);
}
/**
@@ -349,7 +420,6 @@ static size_t dhcpv6_dns_fill(const struct ctx *c, char *buf, int offset)
{
struct opt_dns_servers *srv = NULL;
struct opt_dns_search *srch = NULL;
- char *p = NULL;
int i;
if (c->no_dhcp_dns)
@@ -363,7 +433,7 @@ static size_t dhcpv6_dns_fill(const struct ctx *c, char *buf, int offset)
srv->hdr.l = 0;
}
- memcpy(&srv->addr[i], &c->ip6.dns[i], sizeof(srv->addr[i]));
+ srv->addr[i] = c->ip6.dns[i];
srv->hdr.l += sizeof(srv->addr[i]);
offset += sizeof(srv->addr[i]);
}
@@ -386,54 +456,113 @@ search:
if (!name_len)
continue;
+ name_len += 2; /* Length byte for first label, and terminator */
+ if (name_len >
+ NS_MAXDNAME + 1 /* Length byte for first label */ ||
+ name_len > 255) {
+ debug("DHCP: DNS search name '%s' too long, skipping",
+ c->dns_search[i].n);
+ continue;
+ }
+
if (!srch) {
srch = (struct opt_dns_search *)(buf + offset);
offset += sizeof(struct opt_hdr);
srch->hdr.t = OPT_DNS_SEARCH;
srch->hdr.l = 0;
- p = srch->list;
}
- *p = '.';
- p = stpncpy(p + 1, c->dns_search[i].n, name_len);
- p++;
- srch->hdr.l += name_len + 2;
- offset += name_len + 2;
+ encode_domain_name(buf + offset, c->dns_search[i].n);
+
+ srch->hdr.l += name_len;
+ offset += name_len;
+
}
- if (srch) {
- for (i = 0; i < srch->hdr.l; i++) {
- if (srch->list[i] == '.') {
- srch->list[i] = strcspn(srch->list + i + 1,
- ".");
- }
- }
+ if (srch)
srch->hdr.l = htons(srch->hdr.l);
- }
return offset;
}
/**
+ * dhcpv6_client_fqdn_fill() - Fill in client FQDN option
+ * @data: Data to look at
+ * @c: Execution context
+ * @buf: Response message buffer where options will be appended
+ * @offset: Offset in message buffer for new options
+ *
+ * Return: updated length of response message buffer.
+ */
+static size_t dhcpv6_client_fqdn_fill(const struct iov_tail *data,
+ const struct ctx *c,
+ char *buf, int offset)
+
+{
+ struct iov_tail current = *data;
+ struct opt_client_fqdn *o;
+ size_t opt_len;
+
+ opt_len = strlen(c->fqdn);
+ if (opt_len == 0) {
+ return offset;
+ }
+
+ opt_len += 2; /* Length byte for first label, and terminator */
+ if (opt_len > OPT_MAX_SIZE - (offset +
+ sizeof(struct opt_hdr) +
+ 1 /* flags */ )) {
+ debug("DHCPv6: client FQDN option doesn't fit, skipping");
+ return offset;
+ }
+
+ o = (struct opt_client_fqdn *)(buf + offset);
+ o->flags = 0x00;
+ encode_domain_name(o->domain_name, c->fqdn);
+ if (dhcpv6_opt(&current, OPT_CLIENT_FQDN)) {
+ struct opt_client_fqdn req_opt_storage;
+ struct opt_client_fqdn const *req_opt;
+
+ req_opt = IOV_PEEK_HEADER(&current, req_opt_storage);
+ if (req_opt && req_opt->flags & 0x01 /* S flag */)
+ o->flags = 0x02 /* O flag */;
+ }
+
+ opt_len++;
+
+ o->hdr.t = OPT_CLIENT_FQDN;
+ o->hdr.l = htons(opt_len);
+
+ return offset + sizeof(struct opt_hdr) + opt_len;
+}
+
+/**
* dhcpv6() - Check if this is a DHCPv6 message, reply as needed
* @c: Execution context
- * @p: Packet pool, single packet starting from UDP header
+ * @data: Single packet starting from UDP header
* @saddr: Source IPv6 address of original message
* @daddr: Destination IPv6 address of original message
*
* Return: 0 if it's not a DHCPv6 message, 1 if handled, -1 on failure
*/
-int dhcpv6(struct ctx *c, const struct pool *p,
+int dhcpv6(struct ctx *c, struct iov_tail *data,
const struct in6_addr *saddr, const struct in6_addr *daddr)
{
- struct opt_hdr *ia, *bad_ia, *client_id;
- const struct opt_hdr *server_id;
+ const struct opt_server_id *server_id = NULL;
+ const struct opt_hdr *client_id = NULL;
+ struct opt_server_id server_id_storage;
+ struct iov_tail opt, client_id_base;
+ const struct opt_ia_na *ia = NULL;
+ struct opt_hdr client_id_storage;
+ struct opt_ia_na ia_storage;
const struct in6_addr *src;
+ struct msg_hdr mh_storage;
const struct msg_hdr *mh;
+ struct udphdr uh_storage;
const struct udphdr *uh;
size_t mlen, n;
- uh = packet_get(p, 0, 0, sizeof(*uh), &mlen);
+ uh = IOV_REMOVE_HEADER(data, uh_storage);
if (!uh)
return -1;
@@ -446,30 +575,34 @@ int dhcpv6(struct ctx *c, const struct pool *p,
if (!IN6_IS_ADDR_MULTICAST(daddr))
return -1;
+ mlen = iov_tail_size(data);
if (mlen + sizeof(*uh) != ntohs(uh->len) || mlen < sizeof(*mh))
return -1;
c->ip6.addr_ll_seen = *saddr;
- if (IN6_IS_ADDR_LINKLOCAL(&c->ip6.gw))
- src = &c->ip6.gw;
- else
- src = &c->ip6.addr_ll;
+ src = &c->ip6.our_tap_ll;
- mh = packet_get(p, 0, sizeof(*uh), sizeof(*mh), NULL);
+ mh = IOV_REMOVE_HEADER(data, mh_storage);
if (!mh)
return -1;
- client_id = dhcpv6_opt(p, &(size_t){ 0 }, OPT_CLIENTID);
+ client_id_base = *data;
+ if (dhcpv6_opt(&client_id_base, OPT_CLIENTID))
+ client_id = IOV_PEEK_HEADER(&client_id_base, client_id_storage);
if (!client_id || ntohs(client_id->l) > OPT_VSIZE(client_id))
return -1;
- server_id = dhcpv6_opt(p, &(size_t){ 0 }, OPT_SERVERID);
- if (server_id && ntohs(server_id->l) != OPT_VSIZE(server_id))
+ opt = *data;
+ if (dhcpv6_opt(&opt, OPT_SERVERID))
+ server_id = IOV_PEEK_HEADER(&opt, server_id_storage);
+ if (server_id && ntohs(server_id->hdr.l) != OPT_VSIZE(server_id))
return -1;
- ia = dhcpv6_opt(p, &(size_t){ 0 }, OPT_IA_NA);
- if (ia && ntohs(ia->l) < MIN(OPT_VSIZE(ia_na), OPT_VSIZE(ia_ta)))
+ opt = *data;
+ if (dhcpv6_opt(&opt, OPT_IA_NA))
+ ia = IOV_PEEK_HEADER(&opt, ia_storage);
+ if (ia && ntohs(ia->hdr.l) < MIN(OPT_VSIZE(ia_na), OPT_VSIZE(ia_ta)))
return -1;
resp.hdr.type = TYPE_REPLY;
@@ -484,29 +617,10 @@ int dhcpv6(struct ctx *c, const struct pool *p,
if (mh->type == TYPE_CONFIRM && server_id)
return -1;
- if ((bad_ia = dhcpv6_ia_notonlink(p, &c->ip6.addr))) {
- info("DHCPv6: received CONFIRM with inappropriate IA,"
- " sending NotOnLink status in REPLY");
-
- bad_ia->l = htons(OPT_VSIZE(ia_na) +
- sizeof(sc_not_on_link));
- n = sizeof(struct opt_ia_na);
- memcpy(resp_not_on_link.var, bad_ia, n);
-
- memcpy(resp_not_on_link.var + n,
- &sc_not_on_link, sizeof(sc_not_on_link));
- n += sizeof(sc_not_on_link);
-
- memcpy(resp_not_on_link.var + n, client_id,
- sizeof(struct opt_hdr) + ntohs(client_id->l));
- n += sizeof(struct opt_hdr) + ntohs(client_id->l);
-
- n = offsetof(struct resp_not_on_link_t, var) + n;
-
- resp_not_on_link.hdr.xid = mh->xid;
+ if (dhcpv6_ia_notonlink(data, &c->ip6.addr)) {
- tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546,
- mh->xid, &resp_not_on_link, n);
+ dhcpv6_send_ia_notonlink(c, data, &client_id_base,
+ ntohs(client_id->l), mh->xid);
return 1;
}
@@ -518,7 +632,7 @@ int dhcpv6(struct ctx *c, const struct pool *p,
memcmp(&resp.server_id, server_id, sizeof(resp.server_id)))
return -1;
- if (ia || dhcpv6_opt(p, &(size_t){ 0 }, OPT_IA_TA))
+ if (ia || dhcpv6_opt(data, OPT_IA_TA))
return -1;
info("DHCPv6: received INFORMATION_REQUEST, sending REPLY");
@@ -544,12 +658,14 @@ int dhcpv6(struct ctx *c, const struct pool *p,
if (ia)
resp.ia_na.iaid = ((struct opt_ia_na *)ia)->iaid;
- memcpy(&resp.client_id, client_id,
- ntohs(client_id->l) + sizeof(struct opt_hdr));
+ iov_to_buf(&client_id_base.iov[0], client_id_base.cnt,
+ client_id_base.off, &resp.client_id,
+ ntohs(client_id->l) + sizeof(struct opt_hdr));
n = offsetof(struct resp_t, client_id) +
sizeof(struct opt_hdr) + ntohs(client_id->l);
n = dhcpv6_dns_fill(c, (char *)&resp, n);
+ n = dhcpv6_client_fqdn_fill(data, c, (char *)&resp, n);
resp.hdr.xid = mh->xid;
@@ -574,8 +690,10 @@ void dhcpv6_init(const struct ctx *c)
resp.server_id.duid_time = duid_time;
resp_not_on_link.server_id.duid_time = duid_time;
- memcpy(resp.server_id.duid_lladdr, c->mac, sizeof(c->mac));
- memcpy(resp_not_on_link.server_id.duid_lladdr, c->mac, sizeof(c->mac));
+ memcpy(resp.server_id.duid_lladdr,
+ c->our_tap_mac, sizeof(c->our_tap_mac));
+ memcpy(resp_not_on_link.server_id.duid_lladdr,
+ c->our_tap_mac, sizeof(c->our_tap_mac));
resp.ia_addr.addr = c->ip6.addr;
}
generated by cgit v1.2.3 (git 2.25.1) at 2025-09-16 17:44:42 +0000