Conversation
Every DHCP offer the router builds carries a DNS server, and its address is a
constant in the file:
#define OPENDNS (htonl(0xd043dede))
...
uint32_t dns_server = OPENDNS;
Nothing can change it. vder_dhcp.h has carried a DHCP_DNS bit for the settings
flags since the router was written, with no field to go with it and no code
that reads it.
A public resolver is the wrong default for what this router is for. A VDE
network usually has a resolver of its own, and the hosts on it need to be told
about it, because it is the only thing that knows the names that exist there.
A public resolver does not fail on those names either - it answers with
whatever the registered domain of the same name happens to hold - so a host
that was pointed at a name instead of an address quietly talks to a stranger.
And 208.67.222.222 only answers at all if the router has a working uplink,
which a router serving an isolated segment need not have.
Add dns_server to struct vder_dhcpd_settings and take it as an optional fourth
argument to "dhcpd start":
dhcpd start eth0 10.0.0.20 10.0.0.40 10.0.0.1
Left out, the offer carries 208.67.222.222 as before. The address is checked
the same way the pool bounds are, so a multicast or malformed one is refused
instead of ending up in an offer.
The manual page and the HOWTO mentioned the resolver only as a known
limitation ("advertises a fixed public resolver"). Both now document the
argument, and that line is dropped from their limitations.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Authored with Claude Code; I am submitting it. A small follow-up to #75, which
it builds on (it touches the HOWTO added there).
Why
Every DHCP offer
vde_routerbuilds carries a DNS server, and the address is aconstant in
vder_dhcp.c(OPENDNS, 208.67.222.222). Nothing can change it.That is the wrong default for most VDE networks. They usually have a resolver
of their own, which is the only thing that knows the names that exist there,
and 208.67.222.222 only answers at all if the router has a working uplink -
which a router serving an isolated segment need not have.
What it does
dhcpd starttakes an optional fourth argument:configurations are unaffected.
zero, broadcast or multicast address is refused (
EINVAL) instead of endingup in an offer.
public resolver" is dropped from their lists of known limitations.
Verification
On an isolated test segment, with an ASan/UBSan build, a DHCP client checked
the address actually carried in the offer:
dhcpd start→ offered as givenbogus,0.0.0.0,255.255.255.255,224.0.0.1→ refused; the router keeps runningNo AddressSanitizer or leak reports; the only UBSan output is the existing
misaligned-access notes in
vder_packet.c, unrelated to this change. Therouter's existing forwarding/ARP regression tests still pass, and I have been
running this on my own network to hand out a local resolver.
🤖 Generated with Claude Code