From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202606 header.b=nYmgSVrv; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 20AB95A061A for ; Mon, 13 Jul 2026 07:39:15 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202606; t=1783921140; bh=fmvAN3k/LCXHRg2GUqUgbJVRT1+rLRJOwg1SwVdlJSM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=nYmgSVrvzl44goGdrNT5PzPhbB/cM46F9rP3SrzCbCHS7rJRS2zaxPcw+PRk5Vca5 jjgSvpQ82uE/+Rd/IkQHCmazZ9OEHYcn1dN+upu9ITNHDwhkYLAWv/1PaLhbYpxk5a XJOoh446ieB55vK50Ibv8ngrbOyeE874hZBEGKbnrbe7lGLnCE2ZlicSWrsXgMJtek N3reNkI/0JmvhvCoWQo8VnDNwjLGyrHgddjbSuQrChgTcst/T2g1KY/3k3/dadQmLK 3R7NlwrkMoje5HfpVJLDeE3zULlv+Ut2L1N0CH8oHnUsGFLgTjabFKbC1wz6PRhPrO XHVFZJQeys1gA== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4gzB7m20Ltz4wHw; Mon, 13 Jul 2026 15:39:00 +1000 (AEST) Date: Mon, 13 Jul 2026 14:18:07 +1000 From: David Gibson To: Jon Maloy Subject: Re: [PATCH v9] dhcpv6: Fix reply destination to match client's source address Message-ID: References: <20260710215833.1731937-1-jmaloy@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="HKOax/0CMsl3SpNz" Content-Disposition: inline In-Reply-To: <20260710215833.1731937-1-jmaloy@redhat.com> Message-ID-Hash: OYQ2CWHVN3LMXLTUGCJKI4M66NI5V2SJ X-Message-ID-Hash: OYQ2CWHVN3LMXLTUGCJKI4M66NI5V2SJ X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --HKOax/0CMsl3SpNz Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Jul 10, 2026 at 05:58:33PM -0400, Jon Maloy wrote: > tap_ip6_daddr() selects the reply destination based on our source > address type (link-local), so it always returns addr_ll_seen. But if > the client sent from a global address, we would reply to an address > different from what the client is expecting. Since RFC 9915 (section > 18.3.10) allows clients to use global addresses for DHCPv6, we now > correct this, and always respond to the address the client was using. >=20 > We also remove a redundant addr_ll_seen assignment, since this is > already done by tap.c when processing IPv6 packets. >=20 > Note: if the client uses a global source address, our reply will > still have a link-local source, creating a scope mismatch. Fixing > this properly would require a mechanism to allocate a global address > for the DHCPv6 server, which we currently don't have. Responding to > the client's actual source address is still a net improvement over the > previous behavior of replying to an unrelated cached address. >=20 > Note 2: This commit isn't actually a fix to an observed problem, but > rather an answer to a theoretical issue, adding completeness to the > mechanism and simplifying subsequent changes in this series. >=20 > Signed-off-by: Jon Maloy > Reviewed-by: David Gibson tap_ip6_daddr() was always a hack. It's nice to see it go away. >=20 > --- > v8: -Updated commit log, acknowledging concerns expressed by David and > Stefano. > -Some minor changes also addressing feedback from the same persons. > v9: -Broken out of multi-addr series and posted as standalone patch. > No code changes. > --- > dhcpv6.c | 16 ++++++++-------- > dhcpv6.h | 2 +- > tap.c | 15 --------------- > tap.h | 2 -- > 4 files changed, 9 insertions(+), 26 deletions(-) >=20 > diff --git a/dhcpv6.c b/dhcpv6.c > index 97c04e2c..29c7e320 100644 > --- a/dhcpv6.c > +++ b/dhcpv6.c > @@ -370,12 +370,14 @@ notonlink: > /** > * dhcpv6_send_ia_notonlink() - Send NotOnLink status > * @c: Execution context > + * @caddr: Source address of client message (reply destination) > * @ia_base: Non-appropriate IA_NA or IA_TA base > * @client_id_base: Client ID message option base > * @len: Client ID length > * @xid: Transaction ID for message exchange > */ > static void dhcpv6_send_ia_notonlink(struct ctx *c, > + const struct in6_addr *caddr, > const struct iov_tail *ia_base, > const struct iov_tail *client_id_base, > int len, uint32_t xid) > @@ -405,8 +407,7 @@ static void dhcpv6_send_ia_notonlink(struct ctx *c, > =20 > resp_not_on_link.hdr.xid =3D xid; > =20 > - tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, > - xid, &resp_not_on_link, n); > + tap_udp6_send(c, src, 547, caddr, 546, xid, &resp_not_on_link, n); > } > =20 > /** > @@ -590,8 +591,6 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, > if (mlen + sizeof(*uh) !=3D ntohs(uh->len) || mlen < sizeof(*mh)) > return -1; > =20 > - c->ip6.addr_ll_seen =3D *saddr; > - > src =3D &c->ip6.our_tap_ll; > =20 > mh =3D IOV_REMOVE_HEADER(data, mh_storage); > @@ -630,8 +629,10 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, > =20 > if (dhcpv6_ia_notonlink(data, &c->ip6.addr)) { > =20 > - dhcpv6_send_ia_notonlink(c, data, &client_id_base, > - ntohs(client_id->l), mh->xid); > + dhcpv6_send_ia_notonlink(c, saddr, data, > + &client_id_base, > + ntohs(client_id->l), > + mh->xid); > =20 > return 1; > } > @@ -680,8 +681,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, > =20 > resp.hdr.xid =3D mh->xid; > =20 > - tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, > - mh->xid, &resp, n); > + tap_udp6_send(c, src, 547, saddr, 546, mh->xid, &resp, n); > c->ip6.addr_seen =3D c->ip6.addr; > =20 > return 1; > diff --git a/dhcpv6.h b/dhcpv6.h > index c706dfdb..1015a1a7 100644 > --- a/dhcpv6.h > +++ b/dhcpv6.h > @@ -7,7 +7,7 @@ > #define DHCPV6_H > =20 > int dhcpv6(struct ctx *c, struct iov_tail *data, > - struct in6_addr *saddr, struct in6_addr *daddr); > + const struct in6_addr *saddr, const struct in6_addr *daddr); > void dhcpv6_init(const struct ctx *c); > =20 > #endif /* DHCPV6_H */ > diff --git a/tap.c b/tap.c > index 6d93c7ce..d4189617 100644 > --- a/tap.c > +++ b/tap.c > @@ -160,21 +160,6 @@ void tap_send_single(const struct ctx *c, const void= *data, size_t l2len) > } > } > =20 > -/** > - * tap_ip6_daddr() - Normal IPv6 destination address for inbound packets > - * @c: Execution context > - * @src: Source address > - * > - * Return: pointer to IPv6 address > - */ > -const struct in6_addr *tap_ip6_daddr(const struct ctx *c, > - const struct in6_addr *src) > -{ > - if (IN6_IS_ADDR_LINKLOCAL(src)) > - return &c->ip6.addr_ll_seen; > - return &c->ip6.addr_seen; > -} > - > /** > * tap_push_l2h() - Build an L2 header for an inbound packet > * @c: Execution context > diff --git a/tap.h b/tap.h > index 07ca0965..b335933f 100644 > --- a/tap.h > +++ b/tap.h > @@ -96,8 +96,6 @@ void tap_udp4_send(const struct ctx *c, struct in_addr = src, in_port_t sport, > const void *in, size_t dlen); > void tap_icmp4_send(const struct ctx *c, struct in_addr src, struct in_a= ddr dst, > const void *in, const void *src_mac, size_t l4len); > -const struct in6_addr *tap_ip6_daddr(const struct ctx *c, > - const struct in6_addr *src); > void *tap_push_ip6h(struct ipv6hdr *ip6h, > const struct in6_addr *src, const struct in6_addr *dst, > size_t l4len, uint8_t proto, uint32_t flow); > --=20 > 2.52.0 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --HKOax/0CMsl3SpNz Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmpUZvMACgkQzQJF27ox 2GekjhAAgGhbUoMU7wmtMYEH0ide+bQE7EmvQHDyyVlr6SH/nneVa+I3GZDWcY3t mskPwp+ow/x5YpoGm4HsmuhytKH3NwHxkQurA4dVRJ1uKYp75u6PIM73atlAA2NO VcZ/mhSGSjmGkA2zosyMYECgBwtMW0KkwouiF7Y2bi1uBP2FXbgQ6VkdjhlFEEM7 b9awFTf2+AiIW8LLptuHjk9ZQ1c+2y+8T/xLpZW9bNmZVpgYyRJYr+J2xrjdwtZ/ WEj+9pBZcbwBULKqgwXRb68Jrzhdue6pJseItkPeikTFPR1YM9PjzTFkzBDdT73+ 1NTJbpnvInTxl1F4g7u1z/416xZtl/aPOuq1UFMKoI/kHB2kb7hj6cxq8vaCw0bp 732OPwzWWH1fVMSUeEIaM0Sa0lhr30qdQNXp6l/Ewxu8mXfEvwKsXRi4NrcTrifL RpEH9jL6yowqQnLLsXeNOyBlO4K5nv4XopZ5yDY8rk0MITEINcquFsUYkvK/Hm6+ KJaj4dbzqK/Q8jeUuVIjyU9UORgAqw6mwM8vwSGdU1BIaqMRtxZAHm3gXPcSXBPg LlqmOWlSL0lIC9dcxbbfaDP7o9P67oyTMBQhx6cTNObRFp657Cw7ZPAEOSenIsxZ n2fW9EjP2aWfXya0NhTQN4ubde2NMm3gKh+ZwiBENAZx9nPi5KQ= =441g -----END PGP SIGNATURE----- --HKOax/0CMsl3SpNz--