--- a/networking/udhcp/common.c
+++ b/networking/udhcp/common.c
-@@ -54,6 +54,7 @@ const struct dhcp_optflag dhcp_optflags[
- { OPTION_SIP_SERVERS , 0x78 }, /* DHCP_SIP_SERVERS */
+@@ -56,6 +56,8 @@ const struct dhcp_optflag dhcp_optflags[
#endif
{ OPTION_STATIC_ROUTES , 0x79 }, /* DHCP_STATIC_ROUTES */
-+ { OPTION_6RD , 0xd4 }, /* DHCP_6RD */
+ { OPTION_STATIC_ROUTES , 0xf9 }, /* DHCP_MS_STATIC_ROUTES */
++ { OPTION_6RD , 0xd4 }, /* DHCP_6RD (RFC) */
++ { OPTION_6RD , 0x96 }, /* DHCP_6RD (Comcast) */
{ OPTION_STRING , 0xfc }, /* DHCP_WPAD */
/* Options below have no match in dhcp_option_strings[],
-@@ -114,6 +115,7 @@ const char dhcp_option_strings[] ALIGN1
- // doesn't work in udhcpd.conf since OPTION_STATIC_ROUTES
+@@ -119,6 +121,8 @@ const char dhcp_option_strings[] ALIGN1
// is not handled yet by "string->option" conversion code:
"staticroutes" "\0"/* DHCP_STATIC_ROUTES */
-+ "ip6rd" "\0" /* DHCP_6RD */
+ "msstaticroutes""\0"/* DHCP_MS_STATIC_ROUTES */
++ "ip6rd" "\0" /* DHCP_6RD (RFC) */
++ "ip6rd" "\0" /* DHCP_6RD (Comcast) */
"wpad" "\0" /* DHCP_WPAD */
;
-@@ -141,6 +143,7 @@ const uint8_t dhcp_option_lengths[] ALIG
+@@ -146,6 +150,7 @@ const uint8_t dhcp_option_lengths[] ALIG
[OPTION_S32] = 4,
/* Just like OPTION_STRING, we use minimum length here */
[OPTION_STATIC_ROUTES] = 5,
};
+--- a/networking/udhcp/common.h
++++ b/networking/udhcp/common.h
+@@ -88,6 +88,7 @@ enum {
+ OPTION_S32,
+ OPTION_BIN,
+ OPTION_STATIC_ROUTES,
++ OPTION_6RD,
+ #if ENABLE_FEATURE_UDHCP_RFC3397
+ OPTION_DNS_STRING, /* RFC1035 compressed domain name list */
+ OPTION_SIP_SERVERS,
--- a/networking/udhcp/dhcpc.c
+++ b/networking/udhcp/dhcpc.c
@@ -45,6 +45,7 @@ static const uint8_t len_of_option_as_st
/* really simple implementation, just count the bits */
static int mton(uint32_t mask)
{
-@@ -177,6 +195,60 @@ static NOINLINE char *xmalloc_optname_op
+@@ -177,6 +195,70 @@ static NOINLINE char *xmalloc_optname_op
return ret;
}
+ * We convert it to a string "IPv4MaskLen 6rdPrefixLen 6rdPrefix 6rdBRIPv4Address"
+ */
+
-+ /* IPv4MaskLen */
-+ dest += sprintf(dest, "%u ", *option++);
-+ len--;
++ /* Sanity check: ensure that our length is at least 22 bytes, that
++ * IPv4MaskLen is <= 32, 6rdPrefixLen <= 128 and that the sum of
++ * (32 - IPv4MaskLen) + 6rdPrefixLen is less than or equal to 128.
++ * If any of these requirements is not fulfilled, return with empty
++ * value.
++ */
++ if ((len >= 22) && (*option <= 32) && (*(option+1) <= 128) &&
++ (((32 - *option) + *(option+1)) <= 128))
++ {
++ /* IPv4MaskLen */
++ dest += sprintf(dest, "%u ", *option++);
++ len--;
+
-+ /* 6rdPrefixLen */
-+ dest += sprintf(dest, "%u ", *option++);
-+ len--;
++ /* 6rdPrefixLen */
++ dest += sprintf(dest, "%u ", *option++);
++ len--;
+
-+ /* 6rdPrefix */
-+ dest += sprint_nip6(dest, "", option);
-+ option += 16;
-+ len -= 16;
++ /* 6rdPrefix */
++ dest += sprint_nip6(dest, "", option);
++ option += 16;
++ len -= 16;
+
-+ /* 6rdBRIPv4Addresses */
-+ while (len >= 4)
-+ {
-+ dest += sprint_nip(dest, " ", option);
-+ option += 4;
-+ len -= 4;
++ /* 6rdBRIPv4Addresses */
++ while (len >= 4)
++ {
++ dest += sprint_nip(dest, " ", option);
++ option += 4;
++ len -= 4;
+
-+ /* the code to determine the option size fails to work with
-+ * lengths that are not a multiple of the minimum length,
-+ * adding all advertised 6rdBRIPv4Addresses here would
-+ * overflow the destination buffer, therefore skip the rest
-+ * for now
-+ */
-+ break;
++ /* the code to determine the option size fails to work with
++ * lengths that are not a multiple of the minimum length,
++ * adding all advertised 6rdBRIPv4Addresses here would
++ * overflow the destination buffer, therefore skip the rest
++ * for now
++ */
++ break;
++ }
+ }
+
+ return ret;
#if ENABLE_FEATURE_UDHCP_RFC3397
case OPTION_DNS_STRING:
/* unpack option into dest; use ret for prefix (i.e., "optname=") */
---- a/networking/udhcp/common.h
-+++ b/networking/udhcp/common.h
-@@ -88,6 +88,7 @@ enum {
- OPTION_S32,
- OPTION_BIN,
- OPTION_STATIC_ROUTES,
-+ OPTION_6RD,
- #if ENABLE_FEATURE_UDHCP_RFC3397
- OPTION_DNS_STRING, /* RFC1035 compressed domain name list */
- OPTION_SIP_SERVERS,