fix --no-dhcpv4-interface also disables RA/DHCPv6 on constructed (constructor:) ranges

--no-dhcpv4-interface=IFACE is documented to disable only DHCPv4 on an interface,
leaving DHCPv6/RA untouched. That's exactly how it's implemented in the option parser
(option.c, LOPT_NO_DHCP4 case): the exclusion entry is tagged INAME_4 only, with INAME_6
explicitly cleared. The two general-purpose exclusion checks that consult this list also
respect the split correctly:

  - dhcp6.c:184-186 (regular DHCPv6 request handling)
  - radv.c:187-189 and radv.c:836-839 (RA sending)

All three do:

    if (tmp->name && (tmp->flags & INAME_6) && wildcard_match(tmp->name, iface))

But construct_worker() in dhcp6.c — the callback used to build a context from a
"constructor:IFACE" template range (dhcp-range=::,constructor:IFACE,ra-only,64,...) —
checks the same list without the flag test:

    src/dhcp6.c, lines 700-702 (2.93; same in 2.90):

        for (tmp = daemon->dhcp_except; tmp; tmp = tmp->next)
          if (tmp->name && wildcard_match(tmp->name, ifrn_name))
            return 1;

Because this only tests tmp->name and ignores tmp->flags, an interface added to
dhcp_except via --no-dhcpv4-interface (INAME_4 only, INAME_6 cleared) is excluded here
regardless — silently killing RA/DHCPv6 on that interface too, contradicting both the
documentation and the behaviour of every other exclusion check in the codebase.
This commit is contained in:
David Nichols authored and Simon Kelley committed 2026-09-02 22:24:54 +01:00
1 parent baf85a8f38
commit ad9208358e
2 files changed
+7 -1

No files matched your search

+6
View File
@@ -3,6 +3,12 @@ version 2.94
buffer OOB read in find_soa() which is fixed in git commit
14094e88beca519c53151184cc4553656672b54f, released at 2.93.
Thanks to do litli for spotting this.
Fix erroneous behaviour of --no-dhcpv4-interface with
constructed DHCPv6/RA - DHCPv6 and RA are inhibited by
--no-dhcpv4-interface when using constructed address ranges.
Thanks to David Nichols for discovery, diagnosis and patch.
version 2.93
Fix a corner-case in DNSSEC validation with wildcards. If we have
+1 -1
View File
@@ -720,7 +720,7 @@ static int construct_worker(struct in6_addr *local, int prefix,
return 1;
for (tmp = daemon->dhcp_except; tmp; tmp = tmp->next)
if (tmp->name && wildcard_match(tmp->name, ifrn_name))
if (tmp->name && (tmp->flags & INAME_6) && wildcard_match(tmp->name, ifrn_name))
return 1;
for (template = daemon->dhcp6; template; template = template->next)