Project

General

Profile

Actions

Bug #16191

open
SW CM

Early DNS registration can add invalid addreses

Bug #16191: Early DNS registration can add invalid addreses

Added by Steve Wheeler over 1 year ago. Updated about 1 month ago.

Status:
New
Priority:
Normal
Category:
DHCP (IPv6)
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Plus-Next
Release Notes:
Default
Affected Version:
2.8.0
Affected Architecture:
All

Description

When running Kea for DHCPv6 on an interface set to track6 against an upstream PD static DHCP leases can be added to unbound before a prefix is available.

This means that leases defined as only the suffix are added to Unbound as only the suffix and hence invalid.

This only happens when Early DNS registration is enabled.

DNS registration should only happen once a prefix has been obtained.

Tested in 25.03-beta.

CM Updated by Christian McDonald over 1 year ago Actions #1

  • Assignee set to Christian McDonald

PS Updated by Patrik Stahlman over 1 year ago Actions #2

In addition, static mappings are currently being added without the prefix, even when a prefix is available.

Details here: https://forum.netgate.com/topic/197470/kea-dhcpv6-bug-with-early-dns-registration-for-tracked-interfaces/

JP Updated by Jim Pingle about 1 year ago Actions #3

  • Plus Target Version changed from 25.07 to 25.11

JP Updated by Jim Pingle 10 months ago Actions #4

  • Plus Target Version changed from 25.11 to 26.03

JP Updated by Jim Pingle 7 months ago Actions #5

  • Plus Target Version changed from 26.03 to 26.07

JP Updated by Jim Pingle 3 months ago Actions #6

  • Plus Target Version changed from 26.07 to 26.11

JP Updated by Jim Pingle 3 months ago Actions #7

  • Plus Target Version changed from 26.11 to 26.10

DS Updated by Drew Saur 2 months ago Actions #8

Seems like the bug could be around here in https://github.com/pfsense/pfsense/blob/master/src/etc/inc/system.inc

foreach ($dhcpifconf['staticmap'] as $host) {
$ipaddrv6 = $host['ipaddrv6'];

if (!$ipaddrv6 || !$host['hostname']) {
continue;
}

if ($isdelegated) {
/*
  • We are always in an "end-user" subnet
  • here, which all are /64 for IPv6.
    */
    $prefix6 = 64;
    } else {
    $prefix6 = get_interface_subnetv6($dhcpif);
    }
    $ipaddrv6 = merge_ipv6_delegated_prefix(get_interface_ipv6($dhcpif), $ipaddrv6, $prefix6);

There probably should be some sort of guard, like:

$ifaddrv6 = get_interface_ipv6($dhcpif);

if ($isdelegated && !is_ipaddrv6($ifaddrv6)) {
continue;
}

$ipaddrv6 = merge_ipv6_delegated_prefix($ifaddrv6, $ipaddrv6, 64);

if (!is_ipaddrv6($ipaddrv6) || Net_IPv6::isInNetmask($ipaddrv6, '::', 64)) {
continue;
}

MM Updated by Marcos M about 1 month ago Actions #9

  • Target version changed from 2.9.0 to CE-Next
  • Plus Target Version changed from 26.10 to Plus-Next
Actions

Also available in: Atom