[Dnsmasq-discuss] [PATCH] lease-tools: parse IA_NA suboptions after fixed fields

[Mikhail Dmitrichenko]

Just a follow-up on this patch.

One concrete valid case affected by this is a Release Reply. RFC 9915
section 18.3.7 requires a server with no binding for an IA to return
the IA containing a NoBinding Status Code and no other options.

An IA_NA has a 12-byte fixed part, and a Status Code with an empty
status message occupies 6 bytes including its option header, so such
an IA_NA can have option-len == 18. The current option_len < 24 check
rejects it before parsing the status code.

RFC 9915 section 21.4 specifies IA_NA option-len as 12 plus the length
of IA_NA-options. The value 24 instead corresponds to the fixed part
of the IA Address option data before its suboptions (section 21.6).

Would you consider applying the patch?

пн, 22 июн. 2026 г. в 13:54, Mikhail Dmitrichenko <
m.dmitrichenko222 at gmail.com>:

> The DHCPv6 IA_NA option has a 12 byte fixed header made up of IAID, T1
> and T2. dhcp_release6 currently treats the fixed part as 24 bytes,
> which is the size of an IAADDR payload instead.
>
> This makes the parser skip past the start of the IA_NA suboption area
> and reject valid IA_NA options shorter than 24 bytes. Parse IA_NA
> suboptions after the 12 byte fixed part and only require that minimum
> length before subtracting it from option_len.
>
> Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222 at gmail.com>
> ---
>  contrib/lease-tools/dhcp_release6.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/contrib/lease-tools/dhcp_release6.c
> b/contrib/lease-tools/dhcp_release6.c
> index bbdd412..a795a35 100644
> --- a/contrib/lease-tools/dhcp_release6.c
> +++ b/contrib/lease-tools/dhcp_release6.c
> @@ -339,10 +339,10 @@ int16_t parse_packet(char* buf, size_t len)
>
>        if (option_type == IA_NA )
>         {
> -         if (option_len < 24)
> +         if (option_len < 12)
>             return UNSPEC_FAIL;
>
> -         uint16_t result = parse_iana_suboption(buf + current_pos +24,
> option_len -24);
> +         uint16_t result = parse_iana_suboption(buf + current_pos + 12,
> option_len - 12);
>           if (result)
>             return result;
>         }
> --
> 2.54.0.windows.1
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/attachments/20260818/897ff4ab/attachment.htm>