From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202606 header.b=oyRi+EUL; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 34D405A0262 for ; Thu, 09 Jul 2026 05:02:14 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202606; t=1783566130; bh=zTtUNQpY6/PgpZBkocbdVQXNil7euE8lS3JHOq/op94=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=oyRi+EUL6vsJCmdHbxkBTeWdojXtS/S7DXzgDychcqce07es7tzUWQeclLsM+s4S4 WAAeRCIUys8yXh/VIT4zu9i0D6RxE5GuHeN8Ib3KEC/OBAvNUUdAe6qb2jecwmKcqS aD6ioc6RGwAH1nDR9iLzpZ0+fcMHnt+vs4uDhnEflwDDILswMAoHWb192Pb+UpT2tY lghfkT90oDBuAFSrQJDeHm1/Yt60to7O1uQUWinqu5KOpuN2yDfBGp8G6qzT0Mh2rX 0e5dv7O8pPw7DraRUEQGnLv/969Q6EqGBP/rVt25BdW9hPYJcff5qnOG8tMZwrYFDH uodTtwmYZiD2A== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4gwfrf5pyXz4xSV; Thu, 09 Jul 2026 13:02:10 +1000 (AEST) Date: Thu, 9 Jul 2026 13:01:47 +1000 From: David Gibson To: Jon Maloy Subject: Re: [PATCH v8 01/14] dhcpv6: Fix reply destination to match client's source address Message-ID: References: <20260626024519.3701556-1-jmaloy@redhat.com> <20260626024519.3701556-2-jmaloy@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="YzfhXj1koRt54GNp" Content-Disposition: inline In-Reply-To: <20260626024519.3701556-2-jmaloy@redhat.com> Message-ID-Hash: SLLX3FKSCV5SJWMJNSGHEOSYTE6Q2MAN X-Message-ID-Hash: SLLX3FKSCV5SJWMJNSGHEOSYTE6Q2MAN X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --YzfhXj1koRt54GNp Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jun 25, 2026 at 10:45:06PM -0400, Jon Maloy wrote: > tap_ip6_daddr() selects the reply destination based on our source > address type (link-local), so it always returns addr_ll_seen. But if > the client sent from a global address, we would reply to an address > different from what the client is expecting. Since RFC 9915 (section > 18.3.10) allows clients to use global addresses for DHCPv6, we now > correct this, and always respond to the address the client was using. >=20 > We also remove a redundant addr_ll_seen assignment, since this is > already done by tap.c when processing IPv6 packets. >=20 > Note: if the client uses a global source address, our reply will > still have a link-local source, creating a scope mismatch. Fixing > this properly would require a mechanism to allocate a global address > for the DHCPv6 server, which we currently don't have. Responding to > the client's actual source address is still a net improvement over the > previous behavior of replying to an unrelated cached address. Right. This is a bit messy - mixing scopes can work in some circumstances, but exactly when is pretty tricky to figure out. Nonetheless I agree that this approach makes more sense than the existing one - and also gets us a step closer to allowing our DHCP server to answer queries from multiple clients. > Note 2: This commit isn't actually a fix to an observed problem, but > rather an answer to a theoretical issue, adding completeness to the > mechanism and simplifying subsequent changes in this series. >=20 > Signed-off-by: Jon Maloy Reviewed-by: David Gibson >=20 > --- > v8: -Updated commit log, acknowledging concerns expressed by David and > Stefano. > -Some minor changes also addressing feedback from the same persons. > --- > dhcpv6.c | 16 ++++++++-------- > dhcpv6.h | 2 +- > tap.c | 15 --------------- > tap.h | 2 -- > 4 files changed, 9 insertions(+), 26 deletions(-) >=20 > diff --git a/dhcpv6.c b/dhcpv6.c > index 97c04e2c..29c7e320 100644 > --- a/dhcpv6.c > +++ b/dhcpv6.c > @@ -370,12 +370,14 @@ notonlink: > /** > * dhcpv6_send_ia_notonlink() - Send NotOnLink status > * @c: Execution context > + * @caddr: Source address of client message (reply destination) > * @ia_base: Non-appropriate IA_NA or IA_TA base > * @client_id_base: Client ID message option base > * @len: Client ID length > * @xid: Transaction ID for message exchange > */ > static void dhcpv6_send_ia_notonlink(struct ctx *c, > + const struct in6_addr *caddr, > const struct iov_tail *ia_base, > const struct iov_tail *client_id_base, > int len, uint32_t xid) > @@ -405,8 +407,7 @@ static void dhcpv6_send_ia_notonlink(struct ctx *c, > =20 > resp_not_on_link.hdr.xid =3D xid; > =20 > - tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, > - xid, &resp_not_on_link, n); > + tap_udp6_send(c, src, 547, caddr, 546, xid, &resp_not_on_link, n); > } > =20 > /** > @@ -590,8 +591,6 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, > if (mlen + sizeof(*uh) !=3D ntohs(uh->len) || mlen < sizeof(*mh)) > return -1; > =20 > - c->ip6.addr_ll_seen =3D *saddr; > - > src =3D &c->ip6.our_tap_ll; > =20 > mh =3D IOV_REMOVE_HEADER(data, mh_storage); > @@ -630,8 +629,10 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, > =20 > if (dhcpv6_ia_notonlink(data, &c->ip6.addr)) { > =20 > - dhcpv6_send_ia_notonlink(c, data, &client_id_base, > - ntohs(client_id->l), mh->xid); > + dhcpv6_send_ia_notonlink(c, saddr, data, > + &client_id_base, > + ntohs(client_id->l), > + mh->xid); > =20 > return 1; > } > @@ -680,8 +681,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, > =20 > resp.hdr.xid =3D mh->xid; > =20 > - tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, > - mh->xid, &resp, n); > + tap_udp6_send(c, src, 547, saddr, 546, mh->xid, &resp, n); > c->ip6.addr_seen =3D c->ip6.addr; > =20 > return 1; > diff --git a/dhcpv6.h b/dhcpv6.h > index c706dfdb..1015a1a7 100644 > --- a/dhcpv6.h > +++ b/dhcpv6.h > @@ -7,7 +7,7 @@ > #define DHCPV6_H > =20 > int dhcpv6(struct ctx *c, struct iov_tail *data, > - struct in6_addr *saddr, struct in6_addr *daddr); > + const struct in6_addr *saddr, const struct in6_addr *daddr); > void dhcpv6_init(const struct ctx *c); > =20 > #endif /* DHCPV6_H */ > diff --git a/tap.c b/tap.c > index 6d93c7ce..d4189617 100644 > --- a/tap.c > +++ b/tap.c > @@ -160,21 +160,6 @@ void tap_send_single(const struct ctx *c, const void= *data, size_t l2len) > } > } > =20 > -/** > - * tap_ip6_daddr() - Normal IPv6 destination address for inbound packets > - * @c: Execution context > - * @src: Source address > - * > - * Return: pointer to IPv6 address > - */ > -const struct in6_addr *tap_ip6_daddr(const struct ctx *c, > - const struct in6_addr *src) > -{ > - if (IN6_IS_ADDR_LINKLOCAL(src)) > - return &c->ip6.addr_ll_seen; > - return &c->ip6.addr_seen; > -} > - > /** > * tap_push_l2h() - Build an L2 header for an inbound packet > * @c: Execution context > diff --git a/tap.h b/tap.h > index 07ca0965..b335933f 100644 > --- a/tap.h > +++ b/tap.h > @@ -96,8 +96,6 @@ void tap_udp4_send(const struct ctx *c, struct in_addr = src, in_port_t sport, > const void *in, size_t dlen); > void tap_icmp4_send(const struct ctx *c, struct in_addr src, struct in_a= ddr dst, > const void *in, const void *src_mac, size_t l4len); > -const struct in6_addr *tap_ip6_daddr(const struct ctx *c, > - const struct in6_addr *src); > void *tap_push_ip6h(struct ipv6hdr *ip6h, > const struct in6_addr *src, const struct in6_addr *dst, > size_t l4len, uint8_t proto, uint32_t flow); > --=20 > 2.52.0 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --YzfhXj1koRt54GNp Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmpPDwsACgkQzQJF27ox 2Gfk1w/+PTT6n7cNfD/Mk4EiGf7f+RQaOeI3nG9SDVcLNLi0hGj+zNg/+dkODnah oeilIYul9t6p7DgegZzjF8zs01Dqv0PI7zdIzb6wosPcUpu/sGnWV/JDFPPMKdSL m6jq+4+Msgl8q9EC64568gUQNH6U4RAYPNmSEXmuhf/TLv2QtIImlvSE0qCaym0C uueQVFX1K/9fZZ3AEyPfEgyAksh6J/hUOh8QVU3dGXjRx2New/U9Z74QuXOQXR0c +cDom/l9U/E+2HgdKfBWu76TdZhPERR3FVbBvwuV+rqD/K0JmOzf0mto03XXMkOU 7p1vpHLV+f+2vyjjHa0gqRt0ZjMSzZWBmoFl2MGDJ15nocwons6FlYy3TTKBvasj z8Uq6YcJwxjTQaf8E4FTpz3HrzkM2Nc8+iCo0lry76toHAZaxsikSj5Fj08K51S7 nb74LK426i78j8+pNotuM1Lu0RQsd4GAbb9OzW003dVmowtbJJTcVt40lgTfsoPu 2cWJUxCiZhkjNx4lyMuz6fp+77+yr6YdBSBMzrcKe+Fdyz3V3F9FvYeKUYb6de4u rTlrZn/u9NaG5l46fA847IZR05X3ygGv//3h4xlVjsChakn8R3XKQ23OLVzMRDPv hnqUhGK1W+x+gdPHDi9VwboeN+wnXE77mBqWG/AnQ6/r7OmKsIE= =GahQ -----END PGP SIGNATURE----- --YzfhXj1koRt54GNp--