Reject malformed DHCP subnet mask and router option lengths
before setup_adapter() consumes them.
This prevents attacker-controlled option lengths from expanding DHCP
option bytes into a fixed stack buffer while preserving valid
router address lists.
Validate the option lengths before use, keep router lists limited to
complete IPv4 addresses, and format registry IPv4 strings with
RtlIpv4AddressToStringA().
Booted amd64 QEMU image: no DHCP/client networking regression observed.
This fixes a bug noticed during ARM64 bringup where DHCP never completed. In dhcpoffer, `stop_selecting` is declared int (32-bit) but assigned two time_t operands of 64-bit.
The truncated value breaks the timeout, leaving DHCP stuck in S_SELECTING. This is masked on AMD64 because the RTC is implemented there and `time()` returns values that fit in 32 bits. On ARM64 the RTC isn't implemented yet, exposing the truncation.
CORE-18200
- Set the ip address, subnet mask and default gateway when an alternate configuration has been configured.
- Set registry values for the alternate configuration and APIPA.
C:/ReactOS/reactos/base/services/dhcpcsvc/dhcp/adapter.c: In function 'AdapterDiscoveryThread':
C:/ReactOS/reactos/base/services/dhcpcsvc/dhcp/adapter.c:326:28: error: 'AdapterFindByHardwareAddress' accessing 16 bytes in a region of size 8 [-Werror=stringop-overflow=]
326 | if ((Adapter = AdapterFindByHardwareAddress(Table->table[i].bPhysAddr, Table->table[i].dwPhysAddrLen)))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
C:/ReactOS/reactos/base/services/dhcpcsvc/dhcp/adapter.c:326:28: note: referencing argument 1 of type 'u_int8_t[16]' {aka 'unsigned char[16]'}
C:/ReactOS/reactos/base/services/dhcpcsvc/dhcp/adapter.c:544:15: note: in a call to function 'AdapterFindByHardwareAddress'
544 | PDHCP_ADAPTER AdapterFindByHardwareAddress( u_int8_t haddr[16], u_int8_t hlen ) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
This header is not to be used outside of dhcpcsvc because it contains the data structures for the communication between the client and the server part within dhcpcsvc. That is why it is moved inside of dhcpcsvc and renamed to rosdhcp_pipe.h.
- Make all threads (pipe thread, adapter discovery thread and dispatcher thread) wait on the stop event.
- Close shared resources in the main (dispatcher) thread after the pipe thread and the adapter discovery thread have shut down.
This enables us to stop and restart the DHCP client properly.
CORE-14390
According to RFC 3927, the pseudo-random number generation algorithm MUST be chosen
so that different hosts do not generate the same sequence of numbers, and that the
pseudo-random number generator SHOULD be seeded using a value derived from the
IEEE 802 MAC address, so that a host will usually select the same IPv4 Link-Local
address each time it is booted.
There is no need to compile our DLLs as shared libraries since we are
managing symbols exports and imports through spec files.
On my system, this reduces the configure-time by a factor of two.
- Use a stop event to terminate the dispatch loop.
- Report to the services manager that the service can be stopped or shut-down while it is running.
CORE-14390
Ahmed Arif