Further tidying of DHCPv6 packet dissection code.

Make things more logical, and put buffer overflow detection in one
new function, opt6_first().

man/dnsmasq.8

@@ -1515,7 +1515,7 @@ The normal default DNS server (the same address as the DHCP server)
 will not be appropriate when there is no route bewteen the
 two, so this will have to be explicitly configured. 
 .TP
-.B \-U, --dhcp-vendorclass=set:<tag>,[enterprise:<IANA-enterprise number>,]<vendor-class>
+.B \-U, --dhcp-vendorclass=set:<tag>,[enterprise:<IANA-enterprise number>,][<vendor-class>]
 Map from a vendor-class string to a tag. Most DHCP clients provide a 
 "vendor class" which represents, in some sense, the type of host. This option 
 maps vendor classes to tags, so that DHCP options may be selectively delivered
@@ -1529,9 +1529,11 @@ allow fuzzy matching. The set: prefix is optional but allowed for
 consistency. 
 
 Note that in IPv6 only, vendorclasses are namespaced with an 
-IANA-allocated enterprise number. This is given with enterprise:
+IANA-allocated enterprise number. This may be given with an enterprise:
 keyword and specifies that only vendorclasses matching the specified
-number should be searched.
+number should be searched. Similarly, an enterprise number may be given
+with no vendor-class string. This always matches vendorclasses with
+the given enterprise number.
 .TP
 .B \-j, --dhcp-userclass=set:<tag>,<user-class>
 Map from a user-class string to a tag (with substring

src/dnsmasq.h

@@ -1473,6 +1473,7 @@ int dnssec_validate_by_ds(time_t now, struct dns_header *header, size_t plen, ch
 			  char *keyname, int class, int *validate_count);
 int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char *name,
 		       char *keyname, int class, int *validate_count);
+int cache_neg_ds(char *name, int flags, int class, time_t now, int neg_ttl);
 int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int *class,
 			  int check_unsigned, int *neganswer, int *prim_ok, int *nons, int *nsec_ttl, int *validate_count);
 int dnskey_keytag(int alg, int flags, unsigned char *key, int keylen);

src/dnssec.c

@@ -1027,21 +1027,21 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
 		  (flags = in_arpa_name_2_addr(name, &a)) &&
 		  ((flags == F_IPV6 && private_net6(&a.addr6, 0)) || (flags == F_IPV4 && private_net(a.addr4, 0))))
 		{
-		  my_syslog(LOG_INFO, _("Insecure reply received for DS %s, assuming that's OK for a RFC-1918 address."), name);
+		  my_syslog(LOG_INFO, _("insecure reply received for DS %s, assuming that's OK for a RFC-1918 address"), name);
 		  neganswer = 1;
 		  nons = 0; /* If we're faking a DS, fake one with an NS. */
 		  neg_ttl = DNSSEC_ASSUMED_DS_TTL;
 		}
 	      else if (lookup_domain(name, F_DOMAINSRV, NULL, NULL))
 		{
-		  my_syslog(LOG_INFO, _("Insecure reply received for DS %s, assuming non-DNSSEC domain-specific server."), name);
+		  my_syslog(LOG_INFO, _("insecure reply received for DS %s, assuming non-DNSSEC domain-specific server"), name);
 		  neganswer = 1;
 		  nons = 0; /* If we're faking a DS, fake one with an NS. */
 		  neg_ttl = DNSSEC_ASSUMED_DS_TTL;
 		}
 	      else
 		{
-		  my_syslog(LOG_WARNING, _("Insecure DS reply received for %s, check domain configuration and upstream DNS server DNSSEC support"), name);
+		  my_syslog(LOG_WARNING, _("insecure DS reply received for %s, check domain configuration and upstream DNS server DNSSEC support"), name);
 		  log_query(F_NOEXTRA | F_UPSTREAM, name, NULL, "BOGUS DS - not secure", 0);
 		  return STAT_BOGUS | DNSSEC_FAIL_INDET; 
 		}
@@ -1147,38 +1147,41 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
       if (RCODE(header) == NXDOMAIN)
 	flags |= F_NXDOMAIN;
       
-      /* We only cache validated DS records, DNSSECOK flag hijacked 
-	 to store presence/absence of NS. */
       if (nons)
 	{
 	  if (lookup_domain(name, F_DOMAINSRV, NULL, NULL))
 	    {
-	      my_syslog(LOG_WARNING, _("Negative DS reply without NS record received for %s, assuming non-DNSSEC domain-specific server."), name);
+	      my_syslog(LOG_WARNING, _("negative DS reply without NS record received for %s, assuming non-DNSSEC domain-specific server"), name);
 	      nons = 0;
+	      neg_ttl = DNSSEC_ASSUMED_DS_TTL;
 	    }
 	  else
 	    /* We only cache validated DS records, DNSSECOK flag hijacked 
 	       to store presence/absence of NS. */
 	    flags &= ~F_DNSSECOK;
 	}
+      
+      log_query(F_NOEXTRA | F_UPSTREAM, name, NULL,
+		servfail ? "SERVFAIL" : (nons ? "no DS/cut" : "no DS"), 0);
     }
   
+  return cache_neg_ds(name, flags, class, now, neg_ttl);
+  
+}
+       
+int cache_neg_ds(char *name, int flags, int class, time_t now, int ttl)
+{
   cache_start_insert();
   
   /* Use TTL from NSEC for negative cache entries */
-  if (!cache_insert(name, NULL, class, now, neg_ttl, flags))
+  if (!cache_insert(name, NULL, class, now, ttl, flags))
     return STAT_ABANDONED;
   
   cache_end_insert();  
   
-  if (neganswer)
-    log_query(F_NOEXTRA | F_UPSTREAM, name, NULL,
-	      servfail ? "SERVFAIL" : (nons ? "no DS/cut" : "no DS"), 0);
-      
   return STAT_OK;
 }
 
-
 /* 4034 6.1 */
 static int hostname_cmp(const char *a, const char *b)
 {

src/forward.c

@@ -954,6 +954,7 @@ static void dnssec_validate(struct frec *forward, struct dns_header *header,
 	  /* As soon as anything returns BOGUS, we stop and unwind, to do otherwise
 	     would invite infinite loops, since the answers to DNSKEY and DS queries
 	     will not be cached, so they'll be repeated. */
+	ds_retry:
 	  if (forward->flags & FREC_DNSKEY_QUERY)
 	    status = dnssec_validate_by_ds(now, header, plen, daemon->namebuff, daemon->keyname, forward->class, &orig->validate_counter);
 	  else if (forward->flags & FREC_DS_QUERY)
@@ -1084,6 +1085,18 @@ static void dnssec_validate(struct frec *forward, struct dns_header *header,
 		  return;
 		}
 
+	      /* If there's no server for the parent of a domain-specific server's domain,
+		 assume that said server's contents it legitimately unsigned, as if the parent
+		 contained a negative DS record. This is part of the same logic that's found
+		 in dnssec_validate_ds() when it gets a negative DS repsonse. */
+	      if (STAT_ISEQUAL(status, STAT_NEED_DS) && serverind == -1 && lookup_domain(daemon->keyname, F_DOMAINSRV, NULL, NULL) &&
+		  cache_neg_ds(daemon->keyname, F_FORWARD | F_DS | F_NEG | F_DNSSECOK, forward->class, now, DNSSEC_ASSUMED_DS_TTL) == STAT_OK)
+		{
+		  my_syslog(LOG_WARNING, _("no server for parent domain of %s, assuming unsigned domain"), daemon->keyname);
+		  blockdata_free(stash);
+		  goto ds_retry;
+		}
+	      
 	      /* error unwind */
 	      free_rfds(&rfds);
 	      blockdata_free(newstash);

src/option.c

@@ -4580,20 +4580,16 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
 	    only allowed for agent-options. */
 	 
 	 arg = comma;
-	 if ((comma = split(arg)))
+	 if (option  == 'U' && strstr(arg, "enterprise:") == arg)
 	   {
-	     if (option  != 'U' || strstr(arg, "enterprise:") != arg)
+	     comma = split(arg);
-	       {
-	         free(new->netid.net);
-	         ret_err_free(gen_err, new);
-	       }
-	     else
 	     new->enterprise = atoi(arg+11);
+	     arg = comma;
 	   }
-	 else
-	   comma = arg;
 	 
-	 for (dig = 0, colon = 0, p = (unsigned char *)comma; *p; p++)
+	 if (arg)
+	   {
+	     for (dig = 0, colon = 0, p = (unsigned char *)arg; *p; p++)
 	       if (isxdigit(*p))
 		 dig = 1;
 	       else if (*p == ':')
@@ -4601,18 +4597,24 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
 	       else
 		 break;
 	     
-	 unhide_metas(comma);
+	     unhide_metas(arg);
 	     if (option == 'U' || option == 'j' || *p || !dig || !colon)
 	       {
-	     new->len = strlen(comma);  
+		 new->len = strlen(arg);  
 		 new->data = opt_malloc(new->len);
-	     memcpy(new->data, comma, new->len);
+		 memcpy(new->data, arg, new->len);
 	       }
 	     else
 	       {
-	     new->len = parse_hex(comma, (unsigned char *)comma, strlen(comma), NULL, NULL);
+		 new->len = parse_hex(comma, (unsigned char *)arg, strlen(arg), NULL, NULL);
 		 new->data = opt_malloc(new->len);
-	     memcpy(new->data, comma, new->len);
+		 memcpy(new->data, arg, new->len);
+	       }
+	   }
+	 else if (option != 'U' || new->enterprise == 0)
+	   {
+	     free(new->netid.net);
+	     ret_err_free(gen_err, new);
 	   }
 	 
 	 switch (option)

src/rfc3315.c

@@ -39,9 +39,8 @@ static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbu
 static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts);
 static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string);
 static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string);
-static void *opt6_find (uint8_t *opts, uint8_t *end, unsigned int search, unsigned int minsize);
+static void *opt6_find (uint8_t *opts, uint8_t *end, unsigned int search, int minsize);
 static void *opt6_first(uint8_t *opt, uint8_t *end);
-static void *opt6_next(uint8_t *opts, uint8_t *end);
 static unsigned int opt6_uint(unsigned char *opt, int offset, int size);
 static void get_context_tag(struct state *state, struct dhcp_context *context);
 static int check_ia(struct state *state, void *opt, void **endp, void **ia_option);
@@ -63,6 +62,7 @@ static void calculate_times(struct dhcp_context *context, unsigned int *min_time
 #define opt6_len(opt) ((int)(opt6_uint(opt, -2, 2)))
 #define opt6_type(opt) (opt6_uint(opt, -4, 2))
 #define opt6_ptr(opt, i) ((void *)&(((uint8_t *)(opt))[4+(i)]))
+#define opt6_next(opt, end) (opt6_first(opt6_ptr((opt), opt6_len((opt))), (end)))
 
 #define opt6_user_vendor_ptr(opt, i) ((void *)&(((uint8_t *)(opt))[2+(i)]))
 #define opt6_user_vendor_len(opt) ((int)(opt6_uint(opt, -4, 2)))
@@ -392,10 +392,23 @@ static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbu
 	      if (opt6_len(opt) < 4)
 		continue;
 	      
-	      if (vendor->enterprise != opt6_uint(opt, 0, 4))
+	      if (vendor->enterprise != 0 && vendor->enterprise != opt6_uint(opt, 0, 4))
 		continue;
 
+	      /* matching enterprise, no string match. */
+	      if (vendor->enterprise != 0 && vendor->len == 0)
+		{
+		  vendor->netid.next = state->tags;
+		  state->tags = &vendor->netid;
+		  break;
+		}
+	      
 	      offset = 4;
+
+	      /* If we're going to search the strings below, there must be at least one empty string to search
+		 I think a vendor_class option with just the enterprise number is valid. */
+	      if (opt6_len(opt) < 6)
+		continue;
 	    }
 
        	  /* Note that format if user/vendor classes is different to DHCP options - no option types. */
@@ -662,7 +675,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbu
 	for (c = state->context; c; c = c->current)
 	  c->flags &= ~CONTEXT_CONF_USED;
 
-	for (opt = state->packet_options; opt; opt = opt6_next(opt, state->end))
+	for (opt = opt6_first(state->packet_options, state->end); opt; opt = opt6_next(opt, state->end))
 	  {   
 	    void *ia_option, *ia_end;
 	    unsigned int min_time = 0xffffffff;
@@ -826,7 +839,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbu
 	if (ignore)
 	  return 0;
 	
-	for (opt = state->packet_options; opt; opt = opt6_next(opt, state->end))
+	for (opt = opt6_first(state->packet_options, state->end); opt; opt = opt6_next(opt, state->end))
 	  {   
 	    void *ia_option, *ia_end;
 	    unsigned int min_time = 0xffffffff;
@@ -937,7 +950,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbu
 	
 	log6_quiet(state, msg_type == DHCP6RENEW ? "DHCPRENEW" : "DHCPREBIND", NULL, NULL);
 
-	for (opt = state->packet_options; opt; opt = opt6_next(opt, state->end))
+	for (opt = opt6_first(state->packet_options, state->end); opt; opt = opt6_next(opt, state->end))
 	  {
 	    void *ia_option, *ia_end;
 	    unsigned int min_time = 0xffffffff;
@@ -1072,7 +1085,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbu
 	
 	log6_quiet(state, "DHCPCONFIRM", NULL, NULL);
 	
-	for (opt = state->packet_options; opt; opt = opt6_next(opt, state->end))
+	for (opt = opt6_first(state->packet_options, state->end); opt; opt = opt6_next(opt, state->end))
 	  {
 	    void *ia_option, *ia_end;
 	    
@@ -1148,7 +1161,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbu
 
 	log6_quiet(state, "DHCPRELEASE", NULL, NULL);
 
-	for (opt = state->packet_options; opt; opt = opt6_next(opt, state->end))
+	for (opt = opt6_first(state->packet_options, state->end); opt; opt = opt6_next(opt, state->end))
 	  {
 	    void *ia_option, *ia_end;
 	    int made_ia = 0;
@@ -1213,7 +1226,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbu
 	
 	log6_quiet(state, "DHCPDECLINE", NULL, NULL);
 
-	for (opt = state->packet_options; opt; opt = opt6_next(opt, state->end))
+	for (opt = opt6_first(state->packet_options, state->end); opt; opt = opt6_next(opt, state->end))
 	  {
 	    void *ia_option, *ia_end;
 	    int made_ia = 0;
@@ -1585,10 +1598,7 @@ static int check_ia(struct state *state, void *opt, void **endp, void **ia_optio
 {
   *ia_option = NULL;
 
-  /* must be a minimal option to check without stepping outside received packet. */
+  /* callee ensures packet is long enough for opt6_len(opt) to be valid and believe-able. */
-  if (opt6_ptr(opt, 4) > state->end)
-    return 0;
-  
   state->ia_type = opt6_type(opt);
   
   if (state->ia_type != OPTION6_IA_NA && state->ia_type != OPTION6_IA_TA)
@@ -1600,10 +1610,7 @@ static int check_ia(struct state *state, void *opt, void **endp, void **ia_optio
   if (state->ia_type == OPTION6_IA_TA && opt6_len(opt) < 4)
     return 0;
   
-  /* Check we don't overflow the received packet. */
+  *endp = opt6_ptr(opt, opt6_len(opt));
-  if ((*endp = opt6_ptr(opt, opt6_len(opt))) > state->end)
-    return 0;
-  
   state->iaid = opt6_uint(opt, 0, 4);
   *ia_option = opt6_find(opt6_ptr(opt, state->ia_type == OPTION6_IA_NA ? 12 : 4), *endp, OPTION6_IAADDR, 24);
 
@@ -1918,10 +1925,10 @@ static void update_leases(struct state *state, struct dhcp_context *context, str
 	      lease_add_extradata(lease, (unsigned char *)daemon->dhcp_buff2, strlen(daemon->dhcp_buff2), 0);
 	      
 	      if (opt6_len(opt) >= 6) 
-		for (enc_opt = opt6_ptr(opt, 4); enc_opt; enc_opt = opt6_next(enc_opt, enc_end))
+		for (enc_opt = opt6_ptr(opt, 4); enc_opt; enc_opt = opt6_user_vendor_next(enc_opt, enc_end))
 		  {
 		    lease->vendorclass_count++;
-		    lease_add_extradata(lease, opt6_ptr(enc_opt, 0), opt6_len(enc_opt), 0);
+		    lease_add_extradata(lease, opt6_user_vendor_ptr(enc_opt, 0), opt6_user_vendor_len(enc_opt), 0);
 		  }
 	    }
 	  
@@ -1978,8 +1985,8 @@ static void update_leases(struct state *state, struct dhcp_context *context, str
 	  if ((opt = opt6_find(state->packet_options, state->end, OPTION6_USER_CLASS, 2)))
 	    {
 	      void *enc_opt, *enc_end = opt6_ptr(opt, opt6_len(opt));
-	      for (enc_opt = opt6_ptr(opt, 0); enc_opt; enc_opt = opt6_next(enc_opt, enc_end))
+	      for (enc_opt = opt6_ptr(opt, 0); enc_opt; enc_opt = opt6_user_vendor_next(enc_opt, enc_end))
-		lease_add_extradata(lease, opt6_ptr(enc_opt, 0), opt6_len(enc_opt), 0);
+		lease_add_extradata(lease, opt6_user_vendor_ptr(enc_opt, 0), opt6_user_vendor_len(enc_opt), 0);
 	    }
 	}
 #endif	
@@ -1994,10 +2001,10 @@ static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_op
   void *opt;
   char *desc = nest ? "nest" : "sent";
   
-  if (!option_bool(OPT_LOG_OPTS) || start_opts == end_opts)
+  if (!option_bool(OPT_LOG_OPTS))
     return;
   
-  for (opt = start_opts; opt; opt = opt6_next(opt, end_opts))
+  for (opt = opt6_first(start_opts, end_opts); opt; opt = opt6_next(opt, end_opts))
     {
       int type = opt6_type(opt);
       void *ia_options = NULL;
@@ -2091,35 +2098,20 @@ static void log6_packet(struct state *state, char *type, struct in6_addr *addr,
 	      string ? string : "");
 }
 
-static void *opt6_find (uint8_t *opts, uint8_t *end, unsigned int search, unsigned int minsize)
+static void *opt6_find(uint8_t *opts, uint8_t *end, unsigned int search, int minsize)
 {
-  u16 opt, opt_len;
+  for (opts = opt6_first(opts, end); opts; opts = opt6_next(opts, end))
-  void *start;
+    if (opt6_type(opts) == search && opt6_len(opts) >= minsize)
+      return opts;
 
-  if (!opts)
   return NULL;
-    
-  while (1)
-    {
-      if (end - opts < 4) 
-	return NULL;
-      
-      start = opts;
-      GETSHORT(opt, opts);
-      GETSHORT(opt_len, opts);
-      
-      if (opt_len > (end - opts))
-	return NULL;
-      
-      if (opt == search && (opt_len >= minsize))
-	return start;
-      
-      opts += opt_len;
-    }
 }
 
 static void *opt6_first(uint8_t *opt, uint8_t *end)
 {
+  if (!opt)
+    return NULL;
+
   /* make sure we have option number and length. */
   if ((uint8_t *)opt6_ptr(opt, 0) > end)
     return NULL;
@@ -2131,22 +2123,6 @@ static void *opt6_first(uint8_t *opt, uint8_t *end)
   return opt;
 }
   
-static void *opt6_next(uint8_t *opts, uint8_t *end)
-{
-  u16 opt_len;
-  
-  if (end - opts < 4) 
-    return NULL;
-  
-  opts += 2;
-  GETSHORT(opt_len, opts);
-  
-  if (opt_len >= (end - opts))
-    return NULL;
-  
-  return opts + opt_len;
-}
-
 static unsigned int opt6_uint(unsigned char *opt, int offset, int size)
 {
   /* this worries about unaligned data and byte order */