bin/47433: dhcpcd gets confused by two interfaces on the same LAN with IPv6 RAs

[Taylor R Campbell <campbell+netbsd%mumble.net@localhost>]

>Number:         47433
>Category:       bin
>Synopsis:       dhcpcd gets confused by two interfaces on the same LAN with 
>IPv6 RAs
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jan 11 18:20:00 +0000 2013
>Originator:     Taylor R Campbell <campbell+netbsd%mumble.net@localhost>
>Release:        NetBSD 6.0_STABLE
>Organization:
>Environment:
System: NetBSD ... 6.0_STABLE NetBSD 6.0_STABLE (RIAKERN) #0: Tue Jan 8 
06:19:52 UTC 2013 
root@...:/home/riastradh/netbsd/current/obj/sys/arch/amd64/compile/RIAMONOHACK 
amd64
Architecture: amd64
Machine: amd64
>Description:

        If you have two interfaces, say wm0 and wpi0, on the same LAN,
        and there is an IPv6 router sending router advertisements, then
        dhcpcd will assign both interfaces the same IPv6 address based
        on the MAC address of one of the interfaces.

# dhcpcd -B -d
...
dhcpcd[25745]: wm0: using hwaddr 00:ef:59:40:cb:49
...
dhcpcd[25745]: wm0: Sending IPv6 Router Solicitation
...
dhcpcd[25745]: wpi0: using hwaddr 00:20:96:9c:e9:c7
...
dhcpcd[25745]: wpi0: Sending IPv6 Router Solicitation
...
dhcpcd[25745]: wm0: Router Advertisement from fe80::298:84ff:fe2f:5f96
dhcpcd[25745]: wm0: adding address 2001:2785:b593:587f:220:96ff:fe9c:e9c7/64
...
dhcpcd[25745]: wpi0: Router Advertisement from fe80::298:84ff:fe2f:5f96
dhcpcd[25745]: wpi0: adding address 2001:2785:b593:587f:220:96ff:fe9c:e9c7/64
...

        (Addresses randomized to protect the innocent.)

        The problem is in both netbsd-6 and HEAD as of a few days ago.

>How-To-Repeat:

        Connect two interfaces to a common LAN with an IPv6 router.
        Run dhcpcd.  See one address on two different interfaces in
        `ifconfig -a' output.

>Fix:

        I believe the source of the problem is that ipv6rs_handledata
        in ipv6rs.c avoids allocating a new struct ra if it has already
        seen a router advertisement from the same source address, so it
        chooses an IPv6 address based on the MAC address of the
        interface that the first RA for that prefix came in on.
        Instead, ipv6rs_handledata should probably allocate a new
        struct ra if the packet came in on a different interface.