From 289d7769047d730de68397f4c6ccd1ea4ec76950 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 19 Jun 2026 17:00:53 +0200 Subject: [PATCH] dhcp: Make sure to only modify transactions after receiving an expected DHCP OFFER The `transaction` variable was previously still set to the one that was enumerated last even if the received DHCP OFFER did not match it. So the transaction was incorrectly modified. Once the real DHCP OFFER would arrive, it would get modified again, but it could allow adding unintended DNS servers. --- src/libcharon/plugins/dhcp/dhcp_socket.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/libcharon/plugins/dhcp/dhcp_socket.c b/src/libcharon/plugins/dhcp/dhcp_socket.c index f7e7ba1e1..c09145cc6 100644 --- a/src/libcharon/plugins/dhcp/dhcp_socket.c +++ b/src/libcharon/plugins/dhcp/dhcp_socket.c @@ -528,7 +528,7 @@ METHOD(dhcp_socket_t, release, void, */ static void handle_offer(private_dhcp_socket_t *this, dhcp_t *dhcp, size_t optlen) { - dhcp_transaction_t *transaction = NULL; + dhcp_transaction_t *discover, *transaction = NULL; enumerator_t *enumerator; host_t *offer, *server = NULL; @@ -547,12 +547,13 @@ static void handle_offer(private_dhcp_socket_t *this, dhcp_t *dhcp, size_t optle this->mutex->lock(this->mutex); enumerator = this->discover->create_enumerator(this->discover); - while (enumerator->enumerate(enumerator, &transaction)) + while (enumerator->enumerate(enumerator, &discover)) { - if (transaction->get_id(transaction) == dhcp->transaction_id) + if (discover->get_id(discover) == dhcp->transaction_id) { this->discover->remove_at(this->discover, enumerator); - this->request->insert_last(this->request, transaction); + this->request->insert_last(this->request, discover); + transaction = discover; break; } }