Bug #16191
openEarly DNS registration can add invalid addreses
0%
Description
When running Kea for DHCPv6 on an interface set to track6 against an upstream PD static DHCP leases can be added to unbound before a prefix is available.
This means that leases defined as only the suffix are added to Unbound as only the suffix and hence invalid.
This only happens when Early DNS registration is enabled.
DNS registration should only happen once a prefix has been obtained.
Tested in 25.03-beta.
Updated by Christian McDonald about 1 year ago
- Assignee set to Christian McDonald
Updated by Patrik Stahlman about 1 year ago
In addition, static mappings are currently being added without the prefix, even when a prefix is available.
Details here: https://forum.netgate.com/topic/197470/kea-dhcpv6-bug-with-early-dns-registration-for-tracked-interfaces/
Updated by Jim Pingle about 1 year ago
- Plus Target Version changed from 25.07 to 25.11
Updated by Jim Pingle 8 months ago
- Plus Target Version changed from 25.11 to 26.03
Updated by Jim Pingle 5 months ago
- Plus Target Version changed from 26.03 to 26.07
Updated by Jim Pingle 25 days ago
- Plus Target Version changed from 26.07 to 26.11
Updated by Jim Pingle 15 days ago
- Plus Target Version changed from 26.11 to 26.10
Updated by Drew Saur 5 days ago
Seems like the bug could be around here in https://github.com/pfsense/pfsense/blob/master/src/etc/inc/system.inc
foreach ($dhcpifconf['staticmap'] as $host) {
$ipaddrv6 = $host['ipaddrv6'];
if (!$ipaddrv6 || !$host['hostname']) {
continue;
}
/*
- We are always in an "end-user" subnet
- here, which all are /64 for IPv6.
*/
$prefix6 = 64;
} else {
$prefix6 = get_interface_subnetv6($dhcpif);
}
$ipaddrv6 = merge_ipv6_delegated_prefix(get_interface_ipv6($dhcpif), $ipaddrv6, $prefix6);
There probably should be some sort of guard, like:
$ifaddrv6 = get_interface_ipv6($dhcpif);
if ($isdelegated && !is_ipaddrv6($ifaddrv6)) {
continue;
}
$ipaddrv6 = merge_ipv6_delegated_prefix($ifaddrv6, $ipaddrv6, 64);
if (!is_ipaddrv6($ipaddrv6) || Net_IPv6::isInNetmask($ipaddrv6, '::', 64)) {
continue;
}