diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-08-04 18:39:51 +0300 |
|---|---|---|
| committer | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-08-12 10:42:35 +0300 |
| commit | 58ef850d1705d88f006d761d32c55bde5205a27d (patch) | |
| tree | 901034d82cd545fb8974e580cbec325576b1c2a9 /.github/workflows | |
| parent | 4e36e08e90dbd3c27f566ca396f4284b77f1bf40 (diff) | |
| download | accel-ppp-58ef850d1705d88f006d761d32c55bde5205a27d.tar.gz accel-ppp-58ef850d1705d88f006d761d32c55bde5205a27d.zip | |
ipv6: assign DNS servers per session from RADIUS
The ipv6_nd and ipv6_dhcp modules could only advertise the DNS servers
configured in [ipv6-dns], the same set for every subscriber. RFC 6911
defines DNS-Server-IPv6-Address (attribute 169) for exactly this, and
the attribute was already in the shipped dictionary and in attr_defs.h;
nothing read it.
Give struct ap_session an ipv6_dns list, filled by the radius module
from that attribute, and have both modules advertise it when the session
has one: in the RDNSS option of the router advertisements, and in the
DNS_SERVERS option of DHCPv6 replies. Sessions without a list of their
own keep getting the configured servers, so nothing changes for anyone
not sending the attribute.
The selection is a single ipv6_dns_get() shared by both modules rather
than a copy in each: they already duplicate the whole [ipv6-dns] parser,
and two copies of a precedence rule are two chances to drift. It caps
what it returns, so neither the RDNSS option length (one byte, in units
of 8) nor the router advertisement buffer can be pushed around by what a
RADIUS server sends. The radius module caps at the same 3 servers as
[ipv6-dns] accepts and warns once when a reply carries more.
An Access-Accept which carries the attribute replaces the whole
previously assigned list rather than appending to it, so a re-authorized
session ends up with the servers of the latest reply and not with a
concatenation. One which does not carry it leaves the current list
alone, which is how the IPv4 MS-Primary-DNS-Server attribute already
behaves.
ipv6_dns_test.c covers the selection: assigned wins over configured,
empty list means "nothing assigned" rather than "no DNS", the cap holds
for both sources, and a caller with no room gets nothing rather than a
stomped buffer. Wired into the ASAN/UBSAN workflow.
Inspired by the per-session IPv6 DNS support in accel-ppp-ng (commit
2df6eb99), reimplemented against mainline's ap_session and ipdb types.
Diffstat (limited to '.github/workflows')
| -rw-r--r-- | .github/workflows/run-tests-asan-ubsan.yml | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/.github/workflows/run-tests-asan-ubsan.yml b/.github/workflows/run-tests-asan-ubsan.yml index 8b25701e..90074463 100644 --- a/.github/workflows/run-tests-asan-ubsan.yml +++ b/.github/workflows/run-tests-asan-ubsan.yml @@ -72,6 +72,11 @@ jobs: accel-pppd/ctrl/l2tp/packet_test.c accel-pppd/ctrl/l2tp/packet.c \ -lcrypto /tmp/l2tp_packet_test + gcc -O2 -Wall -D_GNU_SOURCE -DAP_SESSIONID_LEN=16 \ + -fsanitize=${{ matrix.sanitizer }} -fno-sanitize-recover=all \ + -I accel-pppd/include -I accel-pppd/triton -I build \ + -o /tmp/ipv6_dns_test accel-pppd/ipv6/ipv6_dns_test.c + /tmp/ipv6_dns_test gcc -O2 -Wall -o /tmp/bitpool_test accel-pppd/extra/bitpool_test.c /tmp/bitpool_test |