[PATCH v2] busybox: udhcpc, allow zero length dhcp options

[Russell Senior]

This patch skips zero length DHCP options instead of failing.

v2 changelog:
* fix off-by-one
* add a warning message
* move commit message into patch sent upstream

Signed-off-by: Russell Senior <russell at personaltelco.net>
---
 ...205-udhcpc_allow_zero_length_options.patch | 49 +++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 package/utils/busybox/patches/205-udhcpc_allow_zero_length_options.patch

diff --git a/package/utils/busybox/patches/205-udhcpc_allow_zero_length_options.patch b/package/utils/busybox/patches/205-udhcpc_allow_zero_length_options.patch
new file mode 100644
index 0000000000..abe8baf54f
--- /dev/null
+++ b/package/utils/busybox/patches/205-udhcpc_allow_zero_length_options.patch
@@ -0,0 +1,49 @@
+From 7eed119b84b0f7efb7ef351940dd895dc2379eb3 Mon Sep 17 00:00:00 2001
+From: Russell Senior <russell at personaltelco.net>
+Date: Mon, 15 Mar 2021 23:27:58 -0700
+Subject: [PATCH v2] udhcpc: ignore zero-length DHCP options
+
+Discovered that the DHCP server on a TrendNet router (unknown model)
+provides a zero-length option 12 (Host Name) in the DHCP ACK message. This
+has the effect of causing udhcpc to drop the rest of the options, including
+option 51 (IP Address Lease Time), 3 (Router), and 6 (Domain Name Server),
+most importantly leaving the OpenWrt device with no default gateway.
+
+The TrendNet behavior violates RFC 2132, which in Section 3.14 declares that
+option 12 has a miniumum length of 1 octet. It is perhaps not a cosmic coincidence
+that I found this behavior on Pi Day.
+
+This patch allows zero length options without bailing out, by simply skipping them.
+
+v2 changelog:
+* advance the optionptr by two bytes, not one;
+* add a message to warn about the rfc violation;
+
+Signed-off-by: Russell Senior <russell at personaltelco.net>
+---
+ networking/udhcp/common.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c
+index 4bc719001..a16fd85d0 100644
+--- a/networking/udhcp/common.c
++++ b/networking/udhcp/common.c
+@@ -277,8 +277,13 @@ uint8_t* FAST_FUNC udhcp_scan_options(struct dhcp_packet *packet, struct dhcp_sc
+ 			goto complain; /* complain and return NULL */
+ 		len = 2 + scan_state->optionptr[OPT_LEN];
+ 		scan_state->rem -= len;
+-		/* So far no valid option with length 0 known. */
+-		if (scan_state->rem < 0 || scan_state->optionptr[OPT_LEN] == 0)
++		/* skip any options with zero length */
++		if (scan_state->optionptr[OPT_LEN] == 0) {
++			scan_state->optionptr += 2;
++			bb_simple_error_msg("warning: zero length DHCP option violates rfc2132, skipping");
++			continue;
++		}
++		if (scan_state->rem < 0)
+ 			goto complain; /* complain and return NULL */
+ 
+ 		if (scan_state->optionptr[OPT_CODE] == DHCP_OPTION_OVERLOAD) {
+-- 
+2.30.1
+
-- 
2.30.1



-- 
Russell Senior, President
russell at personaltelco.net