From ad9208358eadcf747619511ec8b98134bf85a5f3 Mon Sep 17 00:00:00 2001 From: David Nichols Date: Wed, 2 Sep 2026 22:24:54 +0100 Subject: [PATCH] fix --no-dhcpv4-interface also disables RA/DHCPv6 on constructed (constructor:) ranges MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --no-dhcpv4-interface=IFACE is documented to disable only DHCPv4 on an interface, leaving DHCPv6/RA untouched. That's exactly how it's implemented in the option parser (option.c, LOPT_NO_DHCP4 case): the exclusion entry is tagged INAME_4 only, with INAME_6 explicitly cleared. The two general-purpose exclusion checks that consult this list also respect the split correctly: - dhcp6.c:184-186 (regular DHCPv6 request handling) - radv.c:187-189 and radv.c:836-839 (RA sending) All three do: if (tmp->name && (tmp->flags & INAME_6) && wildcard_match(tmp->name, iface)) But construct_worker() in dhcp6.c — the callback used to build a context from a "constructor:IFACE" template range (dhcp-range=::,constructor:IFACE,ra-only,64,...) — checks the same list without the flag test: src/dhcp6.c, lines 700-702 (2.93; same in 2.90): for (tmp = daemon->dhcp_except; tmp; tmp = tmp->next) if (tmp->name && wildcard_match(tmp->name, ifrn_name)) return 1; Because this only tests tmp->name and ignores tmp->flags, an interface added to dhcp_except via --no-dhcpv4-interface (INAME_4 only, INAME_6 cleared) is excluded here regardless — silently killing RA/DHCPv6 on that interface too, contradicting both the documentation and the behaviour of every other exclusion check in the codebase. --- CHANGELOG | 6 ++++++ src/dhcp6.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/CHANGELOG b/CHANGELOG index 8e5e209..ec3b69f 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -3,6 +3,12 @@ version 2.94 buffer OOB read in find_soa() which is fixed in git commit 14094e88beca519c53151184cc4553656672b54f, released at 2.93. Thanks to do litli for spotting this. + + Fix erroneous behaviour of --no-dhcpv4-interface with + constructed DHCPv6/RA - DHCPv6 and RA are inhibited by + --no-dhcpv4-interface when using constructed address ranges. + Thanks to David Nichols for discovery, diagnosis and patch. + version 2.93 Fix a corner-case in DNSSEC validation with wildcards. If we have diff --git a/src/dhcp6.c b/src/dhcp6.c index 9072884..b5350bd 100644 --- a/src/dhcp6.c +++ b/src/dhcp6.c @@ -720,7 +720,7 @@ static int construct_worker(struct in6_addr *local, int prefix, return 1; for (tmp = daemon->dhcp_except; tmp; tmp = tmp->next) - if (tmp->name && wildcard_match(tmp->name, ifrn_name)) + if (tmp->name && (tmp->flags & INAME_6) && wildcard_match(tmp->name, ifrn_name)) return 1; for (template = daemon->dhcp6; template; template = template->next)