From dee15bb1bd6845e181e3b7c2e7ebc8b69d3ef0bf Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Mon, 22 Dec 2025 22:09:23 +0100 Subject: [PATCH] rtsold: check RA lifetime before triggering the one-shot always script Historic context: rtsold is used by *sense to get a router address which wasn't originally the daemon's purpose. We only ever get the first address per interface lifetime so if the RA contains an invalid router with a zero lifetime and we catch it we cannot get a valid one ever again. This is suboptimal in a number of ways, but the obvious way to deal with this is to ignore all RA messages from routers that do not advertise a default route. PR: https://github.com/opnsense/core/issues/9551 --- usr.sbin/rtsold/rtsol.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/usr.sbin/rtsold/rtsol.c b/usr.sbin/rtsold/rtsol.c index a7d5a44a7d4..e193f9628ea 100644 --- a/usr.sbin/rtsold/rtsol.c +++ b/usr.sbin/rtsold/rtsol.c @@ -328,9 +328,11 @@ rtsol_input(int sock) } /* - * "Always" script. + * "Always" script. This extracts router information, but only + * once per interface "lifetime". To make it more effective check + * the lifetime of the RA in order to see if this router is viable. */ - if (!ifi->alwaysconfig) { + if (!ifi->alwaysconfig && ntohs(nd_ra->nd_ra_router_lifetime) != 0) { const char *rasender = inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf, sizeof(ntopbuf)); ifi->alwaysconfig = 1;