vminit: bump insomniacslk/dhcp past the nclient4 ReadFrom panic fix - #269
vminit: bump insomniacslk/dhcp past the nclient4 ReadFrom panic fix#269thc1006 wants to merge 1 commit into
Conversation
93d1a2f to
750a2a3
Compare
thc1006
changed the title
nerdbox's VM init networking uses nclient4, whose BroadcastRawUDPConn.ReadFrom could compute a negative DHCP length and panic on a malformed reply. That was fixed in insomniacslk/dhcp#583; this bumps the module past that commit. Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
750a2a3 to
23290a1
Compare
|
Rebased onto main. The conflict was Sorry if the push dismissed your approvals. Is there anything else it needs? |
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Copilot reviewed 1 out of 8 changed files in this pull request and generated no new comments.
The guest side of nerdbox brings up networking with an nclient4 DHCPv4 client.
configureDHCPininternal/vminit/vmnetworking/dhcp.gocreates it withnclient4.New(line 50) and callsc.Request(ctx)(line 57);RenewLooplater callsc.Renew. That is the default broadcast client, so replies come back throughBroadcastRawUDPConn.ReadFrom.Before insomniacslk/dhcp#583,
ReadFromcomputed the DHCP length asipPayloadLen - 8without checking the IPv4 payload was at least 8 bytes, so a reply claiming a shorter payload gave a negative length and panicked on a bad slice bound. Since this runs in the VM's init process, a malformed reply on the segment can bring init down rather than just failing the lease. I'm not claiming more than a panic: it needs something that can put a crafted reply on that segment, like the DHCP server or a host injecting frames onto it.nerdbox pins the module at
v0.0.0-20250919081422-f80a1952f48e(2025-09), before the fix. This moves it to the #583 merge commit and re-vendors.go build ./...,go vet ./internal/vminit/vmnetworking/, andgo mod verifypass,go mod tidyleaves go.mod and go.sum unchanged, and the only vendored code touched is under insomniacslk/dhcp. I wrote #583 upstream.