Open-Mesh » batman-adv

Report from Sashiko which has to be checked (@Linus Lüssing ?):

while reviewing how VLANs are parsed here I noticed a bug with DHCP snooping in another file:

net/batman-adv/distributed-arp-table.c:batadv_dat_snoop_incoming_dhcp_ack() {
    ...
        ethhdr = (struct ethhdr *)(skb->data + hdr_size);
        skb_set_network_header(skb, hdr_size + ETH_HLEN);
        proto = ethhdr->h_proto;

        if (!batadv_dat_check_dhcp_ack(skb, proto, &ip_src, chaddr, &yiaddr))
                return;

        hw_src = ethhdr->h_source;
        vid = batadv_dat_get_vid(skb, &hdr_size);
    ...
}

Does this code break DHCP snooping for incoming VLAN-tagged traffic?

When an incoming DHCP ACK packet contains a VLAN tag, ethhdr->h_proto is ETH_P_8021Q. Because the protocol is checked before the VLAN header is properly extracted, batadv_dat_check_dhcp_ack() will immediately reject the packet since proto != htons(ETH_P_IP).

Additionally, skb_set_network_header() is hardcoded to hdr_size + ETH_HLEN, which points to the middle of the VLAN header rather than the IP header. This guarantees a parser failure even if the protocol check passed.

Could this result in a silent failure to populate the Distributed ARP Table (DAT) and force the mesh to fall back to broadcast ARP requests?

See https://sashiko.dev/#/patchset/20260630134430.85786-1-sw@simonwunderlich.de?part=2