Handle a relay forward message with an unspecified address in the

link address field.  Previously such a message would cause the
server to crash.  [ISC-Bugs #21992]

diff --git a/RELNOTES b/RELNOTES
index e9e4d1da761af54f03ac531ad33ce11f4b0aec4b..043869c51240c99ac1f4c13888909db0e91de6d0 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -129,6 +129,11 @@ work on other platforms. Please report any problems and suggested fixes to
   backwards compatible with older lease files not finding a semi-colon
   is also accepted.  [ISC-Bugs #22303].
 
+! Handle a relay forward message with an unspecified address in the
+  link address field.  Previously such a message would cause the
+  server to crash.  [ISC-Bugs #21992]
+  CERT: TBA CVE: TBA
+
                        Changes since 4.2.0b2
 
 - Add declaration for variable in debug code in alloc.c.  [ISC-Bugs #21472]

diff --git a/server/dhcpv6.c b/server/dhcpv6.c
index 7d6129df7536c1a34292ec0ba81b9df8ba023e83..50376b1a8955e8b20a73bee9c3b424186fc1b8f8 100644 (file)
--- a/server/dhcpv6.c
+++ b/server/dhcpv6.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006-2009 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006-2010 by Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -4207,10 +4207,25 @@ shared_network_from_packet6(struct shared_network **shared,
         * If there is no link address, we will use the interface
         * that this packet came in on to pick the shared_network.
         */
-       } else {
+       } else if (packet->interface != NULL) {
                status = shared_network_reference(shared,
                                         packet->interface->shared_network,
                                         MDL);
+                if (packet->dhcpv6_container_packet != NULL) {
+                       log_info("[L2 Relay] No link address in relay packet "
+                                "assuming L2 relay and using receiving "
+                                "interface");
+                }
+
+       } else {
+               /*
+                * We shouldn't be able to get here but if there is no link
+                * address and no interface we don't know where to get the
+                * pool from log an error and return an error.
+                */
+               log_error("No interface and no link address " 
+                         "can't determine pool");
+               status = DHCP_R_INVALIDARG;
        }
 
        return status;
@@ -5508,6 +5523,7 @@ dhcpv6_relay_forw(struct data_string *reply_ret, struct packet *packet) {
 
        enc_packet->client_port = packet->client_port;
        enc_packet->client_addr = packet->client_addr;
+       interface_reference(&enc_packet->interface, packet->interface, MDL);
        enc_packet->dhcpv6_container_packet = packet;
 
        msg_type = enc_opt_data.data[0];