--- a/networking/udhcp/common.c
+++ b/networking/udhcp/common.c
-@@ -54,6 +54,7 @@ const struct dhcp_optflag dhcp_optflags[
+@@ -54,6 +54,8 @@ const struct dhcp_optflag dhcp_optflags[
{ OPTION_SIP_SERVERS , 0x78 }, /* DHCP_SIP_SERVERS */
#endif
{ OPTION_STATIC_ROUTES , 0x79 }, /* DHCP_STATIC_ROUTES */
-+ { OPTION_6RD , 0xd4 }, /* DHCP_6RD */
++ { OPTION_6RD , 0xd4 }, /* DHCP_6RD (RFC) */
++ { OPTION_6RD , 0x96 }, /* DHCP_6RD (Comcast) */
{ OPTION_STRING , 0xfc }, /* DHCP_WPAD */
/* Options below have no match in dhcp_option_strings[],
-@@ -114,6 +115,7 @@ const char dhcp_option_strings[] ALIGN1
+@@ -114,6 +116,8 @@ const char dhcp_option_strings[] ALIGN1
// doesn't work in udhcpd.conf since OPTION_STATIC_ROUTES
// is not handled yet by "string->option" conversion code:
"staticroutes" "\0"/* DHCP_STATIC_ROUTES */
-+ "ip6rd" "\0" /* DHCP_6RD */
++ "ip6rd" "\0" /* DHCP_6RD (RFC) */
++ "ip6rd" "\0" /* DHCP_6RD (Comcast) */
"wpad" "\0" /* DHCP_WPAD */
;
-@@ -141,6 +143,7 @@ const uint8_t dhcp_option_lengths[] ALIG
+@@ -141,6 +145,7 @@ const uint8_t dhcp_option_lengths[] ALIG
[OPTION_S32] = 4,
/* Just like OPTION_STRING, we use minimum length here */
[OPTION_STATIC_ROUTES] = 5,
/* really simple implementation, just count the bits */
static int mton(uint32_t mask)
{
-@@ -177,6 +195,60 @@ static NOINLINE char *xmalloc_optname_op
+@@ -177,6 +195,70 @@ static NOINLINE char *xmalloc_optname_op
return ret;
}
+ * We convert it to a string "IPv4MaskLen 6rdPrefixLen 6rdPrefix 6rdBRIPv4Address"
+ */
+
-+ /* IPv4MaskLen */
-+ dest += sprintf(dest, "%u ", *option++);
-+ len--;
++ /* Sanity check: ensure that our length is at least 22 bytes, that
++ * IPv4MaskLen is <= 32, 6rdPrefixLen <= 128 and that the sum of
++ * (32 - IPv4MaskLen) + 6rdPrefixLen is less than or equal to 128.
++ * If any of these requirements is not fulfilled, return with empty
++ * value.
++ */
++ if ((len >= 22) && (*option <= 32) && (*(option+1) <= 128) &&
++ (((32 - *option) + *(option+1)) <= 128))
++ {
++ /* IPv4MaskLen */
++ dest += sprintf(dest, "%u ", *option++);
++ len--;
+
-+ /* 6rdPrefixLen */
-+ dest += sprintf(dest, "%u ", *option++);
-+ len--;
++ /* 6rdPrefixLen */
++ dest += sprintf(dest, "%u ", *option++);
++ len--;
+
-+ /* 6rdPrefix */
-+ dest += sprint_nip6(dest, "", option);
-+ option += 16;
-+ len -= 16;
++ /* 6rdPrefix */
++ dest += sprint_nip6(dest, "", option);
++ option += 16;
++ len -= 16;
+
-+ /* 6rdBRIPv4Addresses */
-+ while (len >= 4)
-+ {
-+ dest += sprint_nip(dest, " ", option);
-+ option += 4;
-+ len -= 4;
++ /* 6rdBRIPv4Addresses */
++ while (len >= 4)
++ {
++ dest += sprint_nip(dest, " ", option);
++ option += 4;
++ len -= 4;
+
-+ /* the code to determine the option size fails to work with
-+ * lengths that are not a multiple of the minimum length,
-+ * adding all advertised 6rdBRIPv4Addresses here would
-+ * overflow the destination buffer, therefore skip the rest
-+ * for now
-+ */
-+ break;
++ /* the code to determine the option size fails to work with
++ * lengths that are not a multiple of the minimum length,
++ * adding all advertised 6rdBRIPv4Addresses here would
++ * overflow the destination buffer, therefore skip the rest
++ * for now
++ */
++ break;
++ }
+ }
+
+ return ret;