Skip to content

sys/net/dhcpv6: reject truncated option headers #23018

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
miri64 merged 1 commit into from
Oct 29, 2026
Merged

sys/net/dhcpv6: reject truncated option headers #23018

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions sys/net/application_layer/dhcpv6/client.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,12 +110,12 @@
static void _request(event_t *event);
static void _renew(event_t *event);
static void _rebind(event_t *event);

static void _set_event_timeout_ms(event_timeout_t *timeout, event_t *event,
uint32_t delay_ms);
static void _set_event_timeout_sec(event_timeout_t *timeout, event_t *event,
uint32_t delay_sec);
static void _clear_event_timeout(event_timeout_t *timeout);

Check warning on line 118 in sys/net/application_layer/dhcpv6/client.c

View workflow job for this annotation

GitHub Actions / static-tests

clang-format proposes the following patch 

@@ -113,6 +111,4 @@
 
-static void _set_event_timeout_ms(event_timeout_t *timeout, event_t *event,
-                                  uint32_t delay_ms);
-static void _set_event_timeout_sec(event_timeout_t *timeout, event_t *event,
-                                   uint32_t delay_sec);
+static void _set_event_timeout_ms(event_timeout_t *timeout, event_t *event, uint32_t delay_ms);
+static void _set_event_timeout_sec(event_timeout_t *timeout, event_t *event, uint32_t delay_sec);
 static void _clear_event_timeout(event_timeout_t *timeout);

static event_t refresh_information = { .handler = _refresh_information };
static event_t solicit_servers = { .handler = _solicit_servers };
Expand Down Expand Up @@ -668,6 +668,10 @@
len -= sizeof(dhcpv6_msg_t);
for (dhcpv6_opt_t *opt = (dhcpv6_opt_t *)(&adv[sizeof(dhcpv6_msg_t)]);
len > 0; len -= _opt_len(opt), opt = _opt_next(opt)) {
if (len < sizeof(dhcpv6_opt_t)) {
DEBUG("DHCPv6 client: ADVERTISE options truncated\n");
return -1;
}
if (len > orig_len) {
DEBUG("DHCPv6 client: ADVERTISE options overflow packet boundaries\n");
return -1;
Expand Down Expand Up @@ -1007,35 +1011,35 @@
if (lease->parent.ia_id.id != ia_id) {
continue;
}
/* check for status */
for (dhcpv6_opt_t *ia_na_opt = (dhcpv6_opt_t *)(ia_na + 1);
ia_na_len > 0;
ia_na_len -= _opt_len(ia_na_opt),
ia_na_opt = _opt_next(ia_na_opt)) {
if (ia_na_len > ia_na_orig_len) {
DEBUG("DHCPv6 client: IA_NA options overflow option "
"boundaries\n");
return false;

Check warning on line 1022 in sys/net/application_layer/dhcpv6/client.c

View workflow job for this annotation

GitHub Actions / static-tests

clang-format proposes the following patch 

@@ -1014,9 +977,6 @@
         /* check for status */
-        for (dhcpv6_opt_t *ia_na_opt = (dhcpv6_opt_t *)(ia_na + 1);
-             ia_na_len > 0;
-             ia_na_len -= _opt_len(ia_na_opt),
-             ia_na_opt = _opt_next(ia_na_opt)) {
+        for (dhcpv6_opt_t *ia_na_opt = (dhcpv6_opt_t *)(ia_na + 1); ia_na_len > 0;
+             ia_na_len -= _opt_len(ia_na_opt), ia_na_opt = _opt_next(ia_na_opt)) {
             if (ia_na_len > ia_na_orig_len) {
-                DEBUG("DHCPv6 client: IA_NA options overflow option "
-                      "boundaries\n");
+                DEBUG("DHCPv6 client: IA_NA options overflow option " "boundaries\n");
                 return false;
}
switch (byteorder_ntohs(ia_na_opt->type)) {
case DHCPV6_OPT_STATUS: {
if (!_check_status_opt((dhcpv6_opt_status_t *)ia_na_opt)) {
continue;
}
break;
}
case DHCPV6_OPT_IAADDR: {
dhcpv6_opt_iaaddr_t *this_iaaddr = (dhcpv6_opt_iaaddr_t *)ia_na_opt;
if ((!lease->leased) ||
(iaaddr == NULL)) {
/* only take first address for now */
iaaddr = this_iaaddr;
}
break;
}
default:
break;
}

Check warning on line 1042 in sys/net/application_layer/dhcpv6/client.c

View workflow job for this annotation

GitHub Actions / static-tests

clang-format proposes the following patch 

@@ -1024,19 +984,18 @@
             switch (byteorder_ntohs(ia_na_opt->type)) {
-                case DHCPV6_OPT_STATUS: {
-                    if (!_check_status_opt((dhcpv6_opt_status_t *)ia_na_opt)) {
-                        continue;
-                    }
-                    break;
+            case DHCPV6_OPT_STATUS: {
+                if (!_check_status_opt((dhcpv6_opt_status_t *)ia_na_opt)) {
+                    continue;
                 }
-                case DHCPV6_OPT_IAADDR: {
-                    dhcpv6_opt_iaaddr_t *this_iaaddr = (dhcpv6_opt_iaaddr_t *)ia_na_opt;
-                    if ((!lease->leased) ||
-                        (iaaddr == NULL)) {
-                        /* only take first address for now */
-                        iaaddr = this_iaaddr;
-                    }
-                    break;
+                break;
+            }
+            case DHCPV6_OPT_IAADDR: {
+                dhcpv6_opt_iaaddr_t *this_iaaddr = (dhcpv6_opt_iaaddr_t *)ia_na_opt;
+                if ((!lease->leased) || (iaaddr == NULL)) {
+                    /* only take first address for now */
+                    iaaddr = this_iaaddr;
                 }
-                default:
-                    break;
+                break;
+            }
+            default:
+                break;
             }
}
na_t1 = byteorder_ntohl(ia_na->t1);
na_t2 = byteorder_ntohl(ia_na->t2);
Expand All @@ -1060,40 +1064,44 @@
DEBUG("DHCPv6 client: packet too small or transaction ID wrong\n");
return false;
}
len = orig_len - sizeof(dhcpv6_msg_t);
for (dhcpv6_opt_t *opt = (dhcpv6_opt_t *)(&rep[sizeof(dhcpv6_msg_t)]);
len > 0; len -= _opt_len(opt), opt = _opt_next(opt)) {
if (len < sizeof(dhcpv6_opt_t)) {

Check warning on line 1070 in sys/net/application_layer/dhcpv6/client.c

View workflow job for this annotation

GitHub Actions / static-tests

clang-format proposes the following patch 

@@ -1067,4 +1026,4 @@
     len = orig_len - sizeof(dhcpv6_msg_t);
-    for (dhcpv6_opt_t *opt = (dhcpv6_opt_t *)(&rep[sizeof(dhcpv6_msg_t)]);
-         len > 0; len -= _opt_len(opt), opt = _opt_next(opt)) {
+    for (dhcpv6_opt_t *opt = (dhcpv6_opt_t *)(&rep[sizeof(dhcpv6_msg_t)]); len > 0;
+         len -= _opt_len(opt), opt = _opt_next(opt)) {
         if (len < sizeof(dhcpv6_opt_t)) {
DEBUG("DHCPv6 client: REPLY options truncated\n");

@miri64 miri64 Oct 29, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The debug statement in the if branch below says "ADVERTISE". Could you maybe piggy-back a fix for that?

@AnnsAnns AnnsAnns Oct 29, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oop, i can do a followup maybe?

return false;
}
if (len > orig_len) {
DEBUG("DHCPv6 client: ADVERTISE options overflow packet boundaries\n");
return false;
}
switch (byteorder_ntohs(opt->type)) {
case DHCPV6_OPT_CID:
cid = (dhcpv6_opt_duid_t *)opt;
break;
case DHCPV6_OPT_SID:
sid = (dhcpv6_opt_duid_t *)opt;
break;
case DHCPV6_OPT_STATUS:
status = (dhcpv6_opt_status_t *)opt;
break;
case DHCPV6_OPT_SMR:
smr = (dhcpv6_opt_smr_t *)opt;
break;
case DHCPV6_OPT_IMR:
imr = (dhcpv6_opt_imr_t *)opt;
break;
case DHCPV6_OPT_IRT:
irt = (dhcpv6_opt_irt_t *)opt;
break;
default:
break;
}

Check warning on line 1099 in sys/net/application_layer/dhcpv6/client.c

View workflow job for this annotation

GitHub Actions / static-tests

clang-format proposes the following patch 

@@ -1078,22 +1037,22 @@
         switch (byteorder_ntohs(opt->type)) {
-            case DHCPV6_OPT_CID:
-                cid = (dhcpv6_opt_duid_t *)opt;
-                break;
-            case DHCPV6_OPT_SID:
-                sid = (dhcpv6_opt_duid_t *)opt;
-                break;
-            case DHCPV6_OPT_STATUS:
-                status = (dhcpv6_opt_status_t *)opt;
-                break;
-            case DHCPV6_OPT_SMR:
-                smr = (dhcpv6_opt_smr_t *)opt;
-                break;
-            case DHCPV6_OPT_IMR:
-                imr = (dhcpv6_opt_imr_t *)opt;
-                break;
-            case DHCPV6_OPT_IRT:
-                irt = (dhcpv6_opt_irt_t *)opt;
-                break;
-            default:
-                break;
+        case DHCPV6_OPT_CID:
+            cid = (dhcpv6_opt_duid_t *)opt;
+            break;
+        case DHCPV6_OPT_SID:
+            sid = (dhcpv6_opt_duid_t *)opt;
+            break;
+        case DHCPV6_OPT_STATUS:
+            status = (dhcpv6_opt_status_t *)opt;
+            break;
+        case DHCPV6_OPT_SMR:
+            smr = (dhcpv6_opt_smr_t *)opt;
+            break;
+        case DHCPV6_OPT_IMR:
+            imr = (dhcpv6_opt_imr_t *)opt;
+            break;
+        case DHCPV6_OPT_IRT:
+            irt = (dhcpv6_opt_irt_t *)opt;
+            break;
+        default:
+            break;
         }
}
if ((cid == NULL) || (sid == NULL)) {
DEBUG("DHCPv6 client: ADVERTISE does not contain either server ID "
"or client ID\n");
return false;

Check warning on line 1104 in sys/net/application_layer/dhcpv6/client.c

View workflow job for this annotation

GitHub Actions / static-tests

clang-format proposes the following patch 

@@ -1101,4 +1060,3 @@
     if ((cid == NULL) || (sid == NULL)) {
-        DEBUG("DHCPv6 client: ADVERTISE does not contain either server ID "
-              "or client ID\n");
+        DEBUG("DHCPv6 client: ADVERTISE does not contain either server ID " "or client ID\n");
         return false;
}
if (!_check_cid_opt(cid) || !_check_sid_opt(sid)) {
return false;
Expand All @@ -1103,57 +1111,57 @@
}
if (imr != NULL) {
inf_max_rt = byteorder_ntohl(imr->value);
}
if (request_type == DHCPV6_INFO_REQUEST){
uint32_t refresh_time;

Check warning on line 1116 in sys/net/application_layer/dhcpv6/client.c

View workflow job for this annotation

GitHub Actions / static-tests

clang-format proposes the following patch 

@@ -1114,3 +1072,3 @@
     }
-    if (request_type == DHCPV6_INFO_REQUEST){
+    if (request_type == DHCPV6_INFO_REQUEST) {
         uint32_t refresh_time;
if (irt != NULL) {
refresh_time = byteorder_ntohl(irt->value);
if (refresh_time < DHCPV6_IRT_MINIMUM) {
refresh_time = DHCPV6_IRT_MINIMUM;
}
} else {
refresh_time = DHCPV6_IRT_DEFAULT;

Check warning on line 1123 in sys/net/application_layer/dhcpv6/client.c

View workflow job for this annotation

GitHub Actions / static-tests

clang-format proposes the following patch 

@@ -1121,3 +1079,4 @@
             }
-        } else {
+        }
+        else {
             refresh_time = DHCPV6_IRT_DEFAULT;
}
_set_event_timeout_sec(&information_refresh_timeout, &refresh_information, refresh_time);
}
if (!_check_status_opt(status)) {
return false;
}
len = orig_len - sizeof(dhcpv6_msg_t);
for (dhcpv6_opt_t *opt = (dhcpv6_opt_t *)(&rep[sizeof(dhcpv6_msg_t)]);
len > 0; len -= _opt_len(opt), opt = _opt_next(opt)) {
switch (byteorder_ntohs(opt->type)) {
#if IS_USED(MODULE_DHCPV6_CLIENT_DNS)
case DHCPV6_OPT_DNS_RNS:
dhcpv6_client_dns_rns_conf((dhcpv6_opt_dns_rns_t *)opt,
remote.netif);
break;
#endif /* IS_USED(MODULE_DHCPV6_CLIENT_DNS) */
case DHCPV6_OPT_IA_PD:
if (_opt_len(opt) < sizeof(dhcpv6_opt_ia_pd_t)) {
DEBUG("DHCPv6 client: IA_PD option underflow minimum size\n");
return false;
} else if (_parse_ia_pd_option((dhcpv6_opt_ia_pd_t *)opt)) {
/* No error occurred */
break;
} else {
/* Something went wrong */
return false;
}
case DHCPV6_OPT_IA_NA:
if (_opt_len(opt) < sizeof(dhcpv6_opt_ia_na_t)) {
DEBUG("DHCPv6 client: IA_NA option underflow minimum size\n");
return false;
} else if (_parse_ia_na_option((dhcpv6_opt_ia_na_t *)opt)) {
/* No error occurred */
break;
} else {
/* Something went wrong */
return false;
}
default:
break;
}

Check warning on line 1164 in sys/net/application_layer/dhcpv6/client.c

View workflow job for this annotation

GitHub Actions / static-tests

clang-format proposes the following patch 

@@ -1130,35 +1089,38 @@
     len = orig_len - sizeof(dhcpv6_msg_t);
-    for (dhcpv6_opt_t *opt = (dhcpv6_opt_t *)(&rep[sizeof(dhcpv6_msg_t)]);
-         len > 0; len -= _opt_len(opt), opt = _opt_next(opt)) {
+    for (dhcpv6_opt_t *opt = (dhcpv6_opt_t *)(&rep[sizeof(dhcpv6_msg_t)]); len > 0;
+         len -= _opt_len(opt), opt = _opt_next(opt)) {
         switch (byteorder_ntohs(opt->type)) {
 #if IS_USED(MODULE_DHCPV6_CLIENT_DNS)
-            case DHCPV6_OPT_DNS_RNS:
-                dhcpv6_client_dns_rns_conf((dhcpv6_opt_dns_rns_t *)opt,
-                                           remote.netif);
+        case DHCPV6_OPT_DNS_RNS:
+            dhcpv6_client_dns_rns_conf((dhcpv6_opt_dns_rns_t *)opt, remote.netif);
+            break;
+#endif /* IS_USED(MODULE_DHCPV6_CLIENT_DNS) */
+        case DHCPV6_OPT_IA_PD:
+            if (_opt_len(opt) < sizeof(dhcpv6_opt_ia_pd_t)) {
+                DEBUG("DHCPv6 client: IA_PD option underflow minimum size\n");
+                return false;
+            }
+            else if (_parse_ia_pd_option((dhcpv6_opt_ia_pd_t *)opt)) {
+                /* No error occurred */
                 break;
-#endif  /* IS_USED(MODULE_DHCPV6_CLIENT_DNS) */
-            case DHCPV6_OPT_IA_PD:
-                if (_opt_len(opt) < sizeof(dhcpv6_opt_ia_pd_t)) {
-                    DEBUG("DHCPv6 client: IA_PD option underflow minimum size\n");
-                    return false;
-                } else if (_parse_ia_pd_option((dhcpv6_opt_ia_pd_t *)opt)) {
-                     /* No error occurred */
-                     break;
-                 } else {
-                     /* Something went wrong */
-                     return false;
-                 }
-            case DHCPV6_OPT_IA_NA:
-                 if (_opt_len(opt) < sizeof(dhcpv6_opt_ia_na_t)) {
-                    DEBUG("DHCPv6 client: IA_NA option underflow minimum size\n");
-                    return false;
-                 } else if (_parse_ia_na_option((dhcpv6_opt_ia_na_t *)opt)) {
-                     /* No error occurred */
-                     break;
-                 } else {
-                     /* Something went wrong */
-                     return false;
-                 }
-            default:
+            }
+            else {
+                /* Something went wrong */
+                return false;
+            }
+        case DHCPV6_OPT_IA_NA:
+            if (_opt_len(opt) < sizeof(dhcpv6_opt_ia_na_t)) {
+                DEBUG("DHCPv6 client: IA_NA option underflow minimum size\n");
+                return false;
+            }
+            else if (_parse_ia_na_option((dhcpv6_opt_ia_na_t *)opt)) {
+                /* No error occurred */
                 break;
+            }
+            else {
+                /* Something went wrong */
+                return false;
+            }
+        default:
+            break;
         }
}
return true;
}
Expand Down Expand Up @@ -1183,10 +1191,10 @@
DHCPV6_OPT_IMR,
};
msg_len += _compose_oro_opt((dhcpv6_opt_oro_t *)&send_buf[msg_len], info_req_oro_opts,
ARRAY_SIZE(info_req_oro_opts));
} else {
uint16_t general_oro_opts[] = {DHCPV6_OPT_SMR};
msg_len += _compose_oro_opt((dhcpv6_opt_oro_t *)&send_buf[msg_len], general_oro_opts,

Check warning on line 1197 in sys/net/application_layer/dhcpv6/client.c

View workflow job for this annotation

GitHub Actions / static-tests

clang-format proposes the following patch 

@@ -1194,4 +1156,5 @@
                                     ARRAY_SIZE(info_req_oro_opts));
-    } else {
-        uint16_t general_oro_opts[] = {DHCPV6_OPT_SMR};
+    }
+    else {
+        uint16_t general_oro_opts[] = { DHCPV6_OPT_SMR };
         msg_len += _compose_oro_opt((dhcpv6_opt_oro_t *)&send_buf[msg_len], general_oro_opts,
ARRAY_SIZE(general_oro_opts));
}

Expand Down
Loading