From 87c237865b445906e3df7873b0fcd0a9f8483f13 Mon Sep 17 00:00:00 2001
From: Dan Williams <dcbw@redhat.com>
Date: Fri, 31 Oct 2014 12:20:21 -0500
Subject: [PATCH] sd-dhcp6-client: fix off-by-two error in DUID length

The duid data passed by the caller does not include the DUID type,
but sd_dhcp6_client_set_duid() was treating it like it did.

(cherry picked from commit 393b6f28ecec537f05567c4ec8af8c499d0ea226)
---
 src/libsystemd-network/sd-dhcp6-client.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/libsystemd-network/sd-dhcp6-client.c b/src/libsystemd-network/sd-dhcp6-client.c
index fa4f9b5dc2..dbec1a2a8b 100644
--- a/src/libsystemd-network/sd-dhcp6-client.c
+++ b/src/libsystemd-network/sd-dhcp6-client.c
@@ -200,19 +200,19 @@ int sd_dhcp6_client_set_duid(sd_dhcp6_client *client, uint16_t type, uint8_t *du
 
         switch (type) {
         case DHCP6_DUID_LLT:
-                if (duid_len <= sizeof(client->duid.llt))
+                if (duid_len <= sizeof(client->duid.llt) - 2)
                         return -EINVAL;
                 break;
         case DHCP6_DUID_EN:
-                if (duid_len != sizeof(client->duid.en))
+                if (duid_len != sizeof(client->duid.en) - 2)
                         return -EINVAL;
                 break;
         case DHCP6_DUID_LL:
-                if (duid_len <= sizeof(client->duid.ll))
+                if (duid_len <= sizeof(client->duid.ll) - 2)
                         return -EINVAL;
                 break;
         case DHCP6_DUID_UUID:
-                if (duid_len != sizeof(client->duid.uuid))
+                if (duid_len != sizeof(client->duid.uuid) - 2)
                         return -EINVAL;
                 break;
         default:
@@ -222,7 +222,7 @@ int sd_dhcp6_client_set_duid(sd_dhcp6_client *client, uint16_t type, uint8_t *du
 
         client->duid.raw.type = htobe16(type);
         memcpy(&client->duid.raw.data, duid, duid_len);
-        client->duid_len = duid_len;
+        client->duid_len = duid_len + 2;  /* +2 for sizeof(type) */
 
         return 0;
 }