Handle a relay forward message with an unspecified address in the

link address field.  Previously such a message would cause the
server to crash.  [ISC-Bugs #21992]

diff --git a/RELNOTES b/RELNOTES
index 2404375a6d1358f9e4b7ead820017a4732f97ebb..2a862e2c55731b6693725dcc948ba7f8d2e4c611 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -128,6 +128,11 @@ work on other platforms. Please report any problems and suggested fixes to
   line to nroff, escape them if we actually want a quote.
   [ISC-Bugs #18916] sync the pointer to web pages amongst the different docs
 
+! Handle a relay forward message with an unspecified address in the
+  link address field.  Previously such a message would cause the
+  server to crash.  [ISC-Bugs #21992]
+  CERT: TBA CVE: TBA
+
                        Changes since 4.2.0b2
 
 - Add declaration for variable in debug code in alloc.c.  [ISC-Bugs #21472]

diff --git a/server/dhcpv6.c b/server/dhcpv6.c
index 24118052528a76db783e3130500ac1ec04f9829b..7158d06dfa695e94ca88250174c58f5c6dd088d7 100644 (file)
--- a/server/dhcpv6.c
+++ b/server/dhcpv6.c
@@ -4207,10 +4207,25 @@ shared_network_from_packet6(struct shared_network **shared,
         * If there is no link address, we will use the interface
         * that this packet came in on to pick the shared_network.
         */
-       } else {
+       } else if (packet->interface != NULL) {
                status = shared_network_reference(shared,
                                         packet->interface->shared_network,
                                         MDL);
+                if (packet->dhcpv6_container_packet != NULL) {
+                       log_info("[L2 Relay] No link address in relay packet "
+                                "assuming L2 relay and using receiving "
+                                "interface");
+                }
+
+       } else {
+               /*
+                * We shouldn't be able to get here but if there is no link
+                * address and no interface we don't know where to get the
+                * pool from log an error and return an error.
+                */
+               log_error("No interface and no link address " 
+                         "can't determine pool");
+               status = DHCP_R_INVALIDARG;
        }
 
        return status;
@@ -5508,6 +5523,7 @@ dhcpv6_relay_forw(struct data_string *reply_ret, struct packet *packet) {
 
        enc_packet->client_port = packet->client_port;
        enc_packet->client_addr = packet->client_addr;
+       interface_reference(&enc_packet->interface, packet->interface, MDL);
        enc_packet->dhcpv6_container_packet = packet;
 
        msg_type = enc_opt_data.data[0];