Hey all,

I recently stumbled across a bug in dhcrelay6 where a relayed DHCPv6 packet 
from a client was being ignored by my DHCPv6 server. A network trace indicated 
that the relayed packets had a IPv6 link-local address for the link-address 
field in the relayed packet. The analogous field in a DHCPv4 packet is used to 
inform the DHCPv4 server of the subnet the client is in.

I traced this down to a hard-coded setting of the link-address field to the 
client-interface's link-local address:
https://github.com/openbsd/src/blob/5990a1963d9d3a8702389a957caa067859ba104b/usr.sbin/dhcrelay6/dhcrelay6.c#L581

Per RFC8415 
19.1.1<https://datatracker.ietf.org/doc/html/rfc8415#section-19.1.1>  dhcrelay6 
should be placing the globally-scoped address assigned to the client interface 
in this field.

If the relay agent received the message to be relayed from a client,
   the relay agent places a globally scoped unicast address (i.e., GUA
   or ULA) from a prefix assigned to the link on which the client should
   be assigned leases into the link-address field.

Inverting the condition so it does NOT select link-local addresses, and 
eliminating the zero-ing of s6_addr[2] and s6_addr[3] fixes the bug and allows 
clients to get DHCPv6 assignments via dhcrelay6:
https://github.com/openbsd/src/blob/5990a1963d9d3a8702389a957caa067859ba104b/usr.sbin/dhcrelay6/dispatch.c#L191-L200

After implementing the change and running the patched version locally, I have 
confirmed that it properly relays dhcpv6 packets.


Thanks,

Asa Yeamans

Reply via email to