bin/163431: dhclient regression after r228259: leases rejected due to domain search option

[Fabian Keil]

>Number:         163431
>Category:       bin
>Synopsis:       dhclient regression after r228259: leases rejected due to domain search option
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Dec 18 14:30:15 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Fabian Keil
>Release:        HEAD
>Organization:
>Environment:
FreeBSD r500.local 10.0-CURRENT FreeBSD 10.0-CURRENT #384 r+8098cd1-dirty: Sat Dec 10 19:11:01 CET 2011     fk at r500.local:/usr/obj/usr/src/sys/ZOEY  amd64
>Description:
There's a DHCP server on a public WLAN whose responses
dhclient rejects after r228259, apparently because the
responses are deemed invalid:

wlan0: no link ........ got link
DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 6
DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 15
Invalid forward pointer in DHCP Domain Search option compression.

Earlier dhclient versions didn't request the domain search
option and thus had no complaints.
>How-To-Repeat:
dhclient wlan0 with a DHCP server that triggers the problem.
>Fix:
The attached patch turns a couple of hard errors into
warnings and lets dhclient skip the "Domain Search" related
part of the response.

This seems to be sufficient to get a lease:

wlan0: no link ...... got link
DHCPREQUEST on wlan0 to 255.255.255.255 port 67
DHCPNAK from 192.168.10.1
DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 4
Invalid forward pointer in DHCP Domain Search option compression.
DHCPOFFER from 192.168.10.1
Bogus domain search list 119: \015bruesselerplatz\002de (\015bruesselerplatz\002de)
DHCPREQUEST on wlan0 to 255.255.255.255 port 67
Invalid forward pointer in DHCP Domain Search option compression.
DHCPACK from 192.168.10.1
Bogus domain search list 119: \015bruesselerplatz\002de (\015bruesselerplatz\002de)
bound to 192.168.10.218 -- renewal in 3000 seconds.

I suppose configuring dhclient to not request the domain search
option would be a viable workaround, but I'd prefer dhclient to
get a lease without user interaction.

Note that the patch does not adjust the regression tests.

Patch attached with submission follows:

>From 87fb896aa21badb55200c1d6e7b7abc5ca3dfea6 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk at fabiankeil.de>
Date: Sat, 10 Dec 2011 10:46:53 +0100
Subject: [PATCH] Deal with find_search_domain_name_len() failures gracefully

---
 sbin/dhclient/options.c |   17 +++++++++++------
 1 files changed, 11 insertions(+), 6 deletions(-)

diff --git sbin/dhclient/options.c sbin/dhclient/options.c
index b9122c7..033f8de 100644
--- sbin/dhclient/options.c
+++ sbin/dhclient/options.c
@@ -224,9 +224,11 @@ expand_domain_search(struct packet *packet)
 	expanded_len = 0;
 	offset = 0;
 	while (offset < option->len) {
+		expanded_len = find_search_domain_name_len(option, &offset);
+		if (expanded_len == 0)
+		    return;
 		/* We add 1 for the space between domain names. */
-		expanded_len +=
-		    find_search_domain_name_len(option, &offset) + 1;
+		expanded_len++;
 	}
 	if (expanded_len > 0)
 		/* Remove 1 for the superfluous trailing space. */
@@ -271,8 +273,9 @@ find_search_domain_name_len(struct option_data *option, int *offset)
 			/* This is a pointer to another list of labels. */
 			if (i + 1 >= option->len) {
 				/* The pointer is truncated. */
-				error("Truncated pointer in DHCP Domain "
+				warning("Truncated pointer in DHCP Domain "
 				    "Search option.");
+				return (0);
 			}
 
 			pointer = ((label_len & ~(0xC0)) << 8) +
@@ -282,8 +285,9 @@ find_search_domain_name_len(struct option_data *option, int *offset)
 				 * The pointer must indicates a prior
 				 * occurance.
 				 */
-				error("Invalid forward pointer in DHCP Domain "
+				warning("Invalid forward pointer in DHCP Domain "
 				    "Search option compression.");
+				return (0);
 			}
 
 			pointed_len = find_search_domain_name_len(option,
@@ -295,7 +299,8 @@ find_search_domain_name_len(struct option_data *option, int *offset)
 		}
 
 		if (i + label_len >= option->len) {
-			error("Truncated label in DHCP Domain Search option.");
+			warning("Truncated label in DHCP Domain Search option.");
+			return (0);
 		}
 
 		/*
@@ -308,7 +313,7 @@ find_search_domain_name_len(struct option_data *option, int *offset)
 		i += label_len + 1;
 	}
 
-	error("Truncated DHCP Domain Search option.");
+	warning("Truncated DHCP Domain Search option.");
 
 	return (0);
 }
-- 
1.7.8



>Release-Note:
>Audit-Trail:
>Unformatted: