Skip to content

Commit 66d1245

Browse files
committed
lua: Allow a truncated DHCP packet
It should be at least a BOOTP packet according to RFC's, but some clients just aren't fully RFC compliant. No biggie, we can allow this.
1 parent 71a5a7c commit 66d1245

1 file changed

Lines changed: 10 additions & 5 deletions

File tree

src/plugins/lua.c

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
#include <lualib.h>
4040
#include <netdb.h>
4141
#include <stdbool.h>
42+
#include <stddef.h>
4243
#include <stdint.h>
4344
#include <stdio.h>
4445
#include <stdlib.h>
@@ -318,13 +319,18 @@ lua_run_lookup_addr(struct plugin *p, struct srv_ctx *sctx, const void *data,
318319
} else
319320
hostname[0] = '\0';
320321

321-
if (len < sizeof(*l->l_req)) {
322-
errno = EINVAL;
323-
goto out;
324-
}
325322
/* Aligns bootp */
326323
memmove(UNCONST(data), datap, len);
327324

325+
if (len < sizeof(*l->l_req)) {
326+
/* Allow for a truncated vendor area if DHCP */
327+
if (len < offsetof(struct bootp, vend) + sizeof(uint32_t) ||
328+
dhcp_cookiecmp(l->l_req) != 0) {
329+
errno = EINVAL;
330+
goto out;
331+
}
332+
}
333+
328334
l->l_req = data;
329335
l->l_reqlen = len;
330336

@@ -941,7 +947,6 @@ lua_lookup_addr(struct plugin *p, struct sockaddr *sa, uint32_t *ltime,
941947

942948
err = srv_runv(p->p_ctx->ctx_unpriv, p, L_LOOKUPADDR, iov,
943949
ARRAYCOUNT(iov), &result, &data, &len);
944-
945950
if (err == -1 || result == -1)
946951
return -1;
947952
if (len < sizeof(*ltime) + sizeof(struct sockaddr_in)) {

0 commit comments

Comments
 (0)