DHCP Server: ESP serves option 43 (vendor specific option) with no context

[mjcross]

Examining the DHCPOFFER packet served by the ESP, after the DHCP_OPTION_PERFORM_ROUTER_DISCOVERY option and its data, it adds a final option: 43, 6, 0x01, 4, 0x00, 0x00, 0x00, 0x02.

From RFC2132 this is a Vendor Specific Information option that contains an encapsulated option code '0x01' with data '00 00 00 02'.

AFAIK, vendor specific options only make sense if there's a preceding Option 60 (VCI) to identify the type of vendor device - so what's this option doing?

It's clear where this option is generated in the source code dhcpserver.c but there are no hints as to the intent.

[d-a-v]

When I ported lwip2, I saw all this but did not take time to verify everything.
This could be a trigger for some zero-day-exploit in windows network stack 😁
So we should remove it, should we ?

[mjcross]

Crikey - hopefully nothing so dramatic (!) But I'm struggling to understand what it's for. I've raised the question on the Espressif support BB so if I get a response then I'll update here.

The only thing I've found so far that seems vaguely possible is a PXE Boot option... PXE suboption 1 (PXE_MTFTP_IP) specifies the multicast IP address for the boot file - but just that on its own that wouldn't really make much sense. Also an IP address of 0.0.0.2 doesn't figure.

[dragondaud]

I do not see option 43 in my DHCP requests using latest lwip2.

07:55:42.013586 IP (tos 0x0, ttl 255, id 1, offset 0, flags [none], proto UDP (17), length 336)
0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, Request from 2c:3a:e8:06:a1:2b, length 308, xid 0x564b1d81, Flags [none] (0x0000)
Client-Ethernet-Address 2c:3a:e8:06:a1:2b
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Request
MSZ Option 57, length 2: 1500
Requested-IP Option 50, length 4: 10.10.10.183
Server-ID Option 54, length 4: 10.10.10.1
Parameter-Request Option 55, length 5:
Subnet-Mask, Default-Gateway, BR, Domain-Name-Server, NTP
Hostname Option 12, length 17: "LightGuard-06A12B"

[mjcross]

It’s in the responses not the requests (DHCPOFFER)

…

Sent from my iPhone

On 10 Feb 2018, at 14:54, daud ***@***.***> wrote: I do not see option 43 in my DHCP requests using latest lwip2. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[jasonharper]

+1 on removing this apparently useless option. Its presence triggers a known bug that prevents Windows XP systems from acquiring an IP address, unless they have a hotfix installed (KB953761) that is no longer available from Microsoft. (That's not a large number of potential users these days, but it's certainly nonzero.)

[mjcross]

Lord above how on Earth did you track that down! I googled half the Internet looking for info

…

Sent from my iPad

On 26 Mar 2018, at 16:29, jasonharper ***@***.***> wrote: +1 on removing this apparently useless option. Its presence triggers a known bug that prevents Windows XP systems from acquiring an IP address, unless they have a hotfix installed (KB953761) that is no longer available from Microsoft. (That's not a large number of potential users these days, but it's certainly nonzero.) — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[michaelradhuber]

Android seems to have problems with it too....

[d-a-v]

This dhcp answer option has been removed very recently (lwip2 only).