From 67d8cd8193d874645b3b039c34547f14a9c745f1 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Thu, 24 Jun 2021 00:48:23 +0900 Subject: [PATCH 1/4] sd-dhcp-client: check error earlier and reduce indentation --- src/libsystemd-network/sd-dhcp-client.c | 128 ++++++++++++------------ 1 file changed, 64 insertions(+), 64 deletions(-) diff --git a/src/libsystemd-network/sd-dhcp-client.c b/src/libsystemd-network/sd-dhcp-client.c index ff021f4eae..7004ec3b04 100644 --- a/src/libsystemd-network/sd-dhcp-client.c +++ b/src/libsystemd-network/sd-dhcp-client.c @@ -1787,21 +1787,21 @@ static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, i case DHCP_STATE_SELECTING: r = client_handle_offer(client, message, len); - if (r >= 0) { + if (r == -ENOMSG) + return 0; /* invalid message, let's ignore it */ + if (r < 0) + goto error; - client->state = DHCP_STATE_REQUESTING; - client->attempt = 0; + client->state = DHCP_STATE_REQUESTING; + client->attempt = 0; - r = event_reset_time(client->event, &client->timeout_resend, - clock_boottime_or_monotonic(), - 0, 0, - client_timeout_resend, client, - client->event_priority, "dhcp4-resend-timer", true); - if (r < 0) - goto error; - } else if (r == -ENOMSG) - /* invalid message, let's ignore it */ - return 0; + r = event_reset_time(client->event, &client->timeout_resend, + clock_boottime_or_monotonic(), + 0, 0, + client_timeout_resend, client, + client->event_priority, "dhcp4-resend-timer", true); + if (r < 0) + goto error; break; @@ -1811,47 +1811,9 @@ static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, i case DHCP_STATE_REBINDING: r = client_handle_ack(client, message, len); - if (r >= 0) { - client->start_delay = 0; - (void) event_source_disable(client->timeout_resend); - client->receive_message = - sd_event_source_unref(client->receive_message); - client->fd = safe_close(client->fd); - - if (IN_SET(client->state, DHCP_STATE_REQUESTING, - DHCP_STATE_REBOOTING)) - notify_event = SD_DHCP_CLIENT_EVENT_IP_ACQUIRE; - else if (r != SD_DHCP_CLIENT_EVENT_IP_ACQUIRE) - notify_event = r; - - client->state = DHCP_STATE_BOUND; - client->attempt = 0; - - client->last_addr = client->lease->address; - - r = client_set_lease_timeouts(client); - if (r < 0) { - log_dhcp_client(client, "could not set lease timeouts"); - goto error; - } - - r = dhcp_network_bind_udp_socket(client->ifindex, client->lease->address, client->port, client->ip_service_type); - if (r < 0) { - log_dhcp_client(client, "could not bind UDP socket"); - goto error; - } - - client->fd = r; - - client_initialize_io_events(client, client_receive_message_udp); - - if (notify_event) { - client_notify(client, notify_event); - if (client->state == DHCP_STATE_STOPPED) - return 0; - } - - } else if (r == -EADDRNOTAVAIL) { + if (r == -ENOMSG) + return 0; /* invalid message, let's ignore it */ + if (r == -EADDRNOTAVAIL) { /* got a NAK, let's restart the client */ client_notify(client, SD_DHCP_CLIENT_EVENT_EXPIRED); @@ -1870,21 +1832,59 @@ static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, i RESTART_AFTER_NAK_MIN_USEC, RESTART_AFTER_NAK_MAX_USEC); return 0; - } else if (r == -ENOMSG) - /* invalid message, let's ignore it */ - return 0; + } + if (r < 0) + goto error; + + client->start_delay = 0; + (void) event_source_disable(client->timeout_resend); + client->receive_message = sd_event_source_unref(client->receive_message); + client->fd = safe_close(client->fd); + + if (IN_SET(client->state, DHCP_STATE_REQUESTING, DHCP_STATE_REBOOTING)) + notify_event = SD_DHCP_CLIENT_EVENT_IP_ACQUIRE; + else if (r != SD_DHCP_CLIENT_EVENT_IP_ACQUIRE) + notify_event = r; + + client->state = DHCP_STATE_BOUND; + client->attempt = 0; + + client->last_addr = client->lease->address; + + r = client_set_lease_timeouts(client); + if (r < 0) { + log_dhcp_client(client, "could not set lease timeouts"); + goto error; + } + + r = dhcp_network_bind_udp_socket(client->ifindex, client->lease->address, client->port, client->ip_service_type); + if (r < 0) { + log_dhcp_client(client, "could not bind UDP socket"); + goto error; + } + + client->fd = r; + + client_initialize_io_events(client, client_receive_message_udp); + + if (notify_event) { + client_notify(client, notify_event); + if (client->state == DHCP_STATE_STOPPED) + return 0; + } break; case DHCP_STATE_BOUND: r = client_handle_forcerenew(client, message, len); - if (r >= 0) { - r = client_timeout_t1(NULL, 0, client); - if (r < 0) - goto error; - } else if (r == -ENOMSG) - /* invalid message, let's ignore it */ - return 0; + if (r == -ENOMSG) + return 0; /* invalid message, let's ignore it */ + if (r < 0) + goto error; + + r = client_timeout_t1(NULL, 0, client); + if (r < 0) + goto error; break; From d57b62be0de3124bec7b6295c0e4eeba26507174 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Thu, 24 Jun 2021 00:51:52 +0900 Subject: [PATCH 2/4] sd-dhcp-client: shorten code a bit --- src/libsystemd-network/sd-dhcp-client.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/src/libsystemd-network/sd-dhcp-client.c b/src/libsystemd-network/sd-dhcp-client.c index 7004ec3b04..a16f7cc9ab 100644 --- a/src/libsystemd-network/sd-dhcp-client.c +++ b/src/libsystemd-network/sd-dhcp-client.c @@ -1777,7 +1777,7 @@ static int client_set_lease_timeouts(sd_dhcp_client *client) { static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, int len) { DHCP_CLIENT_DONT_DESTROY(client); char time_string[FORMAT_TIMESPAN_MAX]; - int r = 0, notify_event = 0; + int r, notify_event = 0; assert(client); assert(client->event); @@ -1800,9 +1800,6 @@ static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, i 0, 0, client_timeout_resend, client, client->event_priority, "dhcp4-resend-timer", true); - if (r < 0) - goto error; - break; case DHCP_STATE_REBOOTING: @@ -1830,7 +1827,6 @@ static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, i client->start_delay = CLAMP(client->start_delay * 2, RESTART_AFTER_NAK_MIN_USEC, RESTART_AFTER_NAK_MAX_USEC); - return 0; } if (r < 0) @@ -1883,19 +1879,18 @@ static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, i goto error; r = client_timeout_t1(NULL, 0, client); - if (r < 0) - goto error; - break; case DHCP_STATE_INIT: case DHCP_STATE_INIT_REBOOT: - + r = 0; break; case DHCP_STATE_STOPPED: r = -EINVAL; goto error; + default: + assert_not_reached("invalid state"); } error: From 551ad0b7de9ebc3a5fb1d84a06e21fc0c0ca3017 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Thu, 24 Jun 2021 01:14:12 +0900 Subject: [PATCH 3/4] sd-dhcp-client: logs when dhcp client unexpectedly gains a new lease Previously, such situation is handled silently. --- src/libsystemd-network/sd-dhcp-client.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/src/libsystemd-network/sd-dhcp-client.c b/src/libsystemd-network/sd-dhcp-client.c index a16f7cc9ab..67a5a03eba 100644 --- a/src/libsystemd-network/sd-dhcp-client.c +++ b/src/libsystemd-network/sd-dhcp-client.c @@ -1777,7 +1777,7 @@ static int client_set_lease_timeouts(sd_dhcp_client *client) { static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, int len) { DHCP_CLIENT_DONT_DESTROY(client); char time_string[FORMAT_TIMESPAN_MAX]; - int r, notify_event = 0; + int r, notify_event; assert(client); assert(client->event); @@ -1832,16 +1832,16 @@ static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, i if (r < 0) goto error; + if (IN_SET(client->state, DHCP_STATE_REQUESTING, DHCP_STATE_REBOOTING)) + notify_event = SD_DHCP_CLIENT_EVENT_IP_ACQUIRE; + else + notify_event = r; + client->start_delay = 0; (void) event_source_disable(client->timeout_resend); client->receive_message = sd_event_source_unref(client->receive_message); client->fd = safe_close(client->fd); - if (IN_SET(client->state, DHCP_STATE_REQUESTING, DHCP_STATE_REBOOTING)) - notify_event = SD_DHCP_CLIENT_EVENT_IP_ACQUIRE; - else if (r != SD_DHCP_CLIENT_EVENT_IP_ACQUIRE) - notify_event = r; - client->state = DHCP_STATE_BOUND; client->attempt = 0; @@ -1863,12 +1863,13 @@ static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, i client_initialize_io_events(client, client_receive_message_udp); - if (notify_event) { + if (IN_SET(client->state, DHCP_STATE_RENEWING, DHCP_STATE_REBINDING) && + notify_event == SD_DHCP_CLIENT_EVENT_IP_ACQUIRE) + /* FIXME: hmm, maybe this is a bug... */ + log_dhcp_client(client, "client_handle_ack() returned SD_DHCP_CLIENT_EVENT_IP_ACQUIRE while DHCP client is %s the address, skipping callback.", + client->state == DHCP_STATE_RENEWING ? "renewing" : "rebinding"); + else client_notify(client, notify_event); - if (client->state == DHCP_STATE_STOPPED) - return 0; - } - break; case DHCP_STATE_BOUND: From 38e980a6a5a3442c2f48b1f827284388096d8ca5 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Thu, 24 Jun 2021 01:22:07 +0900 Subject: [PATCH 4/4] sd-dhcp-client: tentatively ignore FORCERENEW command This makes DHCP client ignore FORCERENEW requests, as unauthenticated FORCERENEW requests causes a security issue (TALOS-2020-1142, CVE-2020-13529). Let's re-enable this after RFC3118 (Authentication for DHCP Messages) and/or RFC6704 (Forcerenew Nonce Authentication) are implemented. Fixes #16774. --- src/libsystemd-network/sd-dhcp-client.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/libsystemd-network/sd-dhcp-client.c b/src/libsystemd-network/sd-dhcp-client.c index 67a5a03eba..dc8ff19d1a 100644 --- a/src/libsystemd-network/sd-dhcp-client.c +++ b/src/libsystemd-network/sd-dhcp-client.c @@ -1587,9 +1587,17 @@ static int client_handle_forcerenew(sd_dhcp_client *client, DHCPMessage *force, if (r != DHCP_FORCERENEW) return -ENOMSG; +#if 0 log_dhcp_client(client, "FORCERENEW"); return 0; +#else + /* FIXME: Ignore FORCERENEW requests until we implement RFC3118 (Authentication for DHCP + * Messages) and/or RFC6704 (Forcerenew Nonce Authentication), as unauthenticated FORCERENEW + * requests causes a security issue (TALOS-2020-1142, CVE-2020-13529). */ + log_dhcp_client(client, "Received FORCERENEW, ignoring."); + return -ENOMSG; +#endif } static bool lease_equal(const sd_dhcp_lease *a, const sd_dhcp_lease *b) {