From 6ad834fcb2fee14803e11fb83c41bbaaf8b2245f Mon Sep 17 00:00:00 2001
From: Dimitri Papadopoulos
 <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
Date: Sat, 9 May 2026 13:43:24 +0200
Subject: [PATCH] Use network address as IPv6 lease start

IPv6 address leases were starting at the network address + 1, following
the IPv4 convention where the network address is reserved. However,
IPv6 doesn't have such a restriction, and that behaviour is inconsistent
with IPv6 standards.

Use the IPv6 network address as the starting point for address leases
instead of network address + 1. This fix is particularly important for
point-to-point /127 networks with only 2 addresses.

Fixes #714.

Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
---
 NEWS                                 |   2 +
 src/ip-lease.c                       |   3 +-
 tests/data/p2p-iface.config          | 166 +++++++++++++++++++++++++++
 tests/meson.build                    |   3 +-
 tests/ns.sh                          |   6 +-
 tests/p2p-net                        | 147 ++++++++++++++++++++++++
 tests/radius-config                  |   2 +-
 tests/radius-group                   |   2 +-
 tests/radius-ipv6-prefix             |   2 +-
 tests/radius-multi-group             |   2 +-
 tests/radius-multi-group-comma       |   2 +-
 tests/radius-otp                     |   2 +-
 tests/random-net.sh                  |   2 +-
 tests/test-config-per-group-url-cert |   2 +-
 tests/test-config-per-group-url-pass |   2 +-
 tests/user-config-explicit/test4     |   2 +-
 16 files changed, 331 insertions(+), 16 deletions(-)
 create mode 100644 tests/data/p2p-iface.config
 create mode 100644 tests/p2p-net

diff --git a/NEWS b/NEWS
index 405104ad..ba83fcfa 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,8 @@
   affected session to be rejected rather than silently ignored. A configured
   default-user-conf or default-group-conf file that cannot be opened also
   now causes session rejection (previously silently ignored).
+- Fix point-to-point IPv6 networks by starting address leasing precisely
+  at network address instead of network address + 1 (#714)
 
 
 * Version 1.5.0 (released 2026-06-07)
diff --git a/src/ip-lease.c b/src/ip-lease.c
index e23a9657..7a4c3b0a 100644
--- a/src/ip-lease.c
+++ b/src/ip-lease.c
@@ -425,9 +425,8 @@ static int get_ipv6_lease(main_server_st *s, struct proc_st *proc)
 	if (proc->ipv6 == NULL)
 		return ERR_MEM;
 
-	/* LIP = network address + 1 */
+	/* LIP = network address */
 	memcpy(&proc->ipv6->lip, &network, sizeof(struct sockaddr_in6));
-	SA_IN6_U8_P(&proc->ipv6->lip)[15] |= 1;
 
 	proc->ipv6->lip_len = sizeof(struct sockaddr_in6);
 
diff --git a/tests/data/p2p-iface.config b/tests/data/p2p-iface.config
new file mode 100644
index 00000000..70f74783
--- /dev/null
+++ b/tests/data/p2p-iface.config
@@ -0,0 +1,166 @@
+# User authentication method. Could be set multiple times and in that case
+# all should succeed.
+# Options: certificate, pam.
+#auth = "certificate"
+auth = "plain[@SRCDIR@/data/test1.passwd]"
+#auth = "pam"
+
+isolate-workers = @ISOLATE_WORKERS@
+
+max-ban-score = 0
+
+# A banner to be displayed on clients
+#banner = "Welcome"
+
+# Use listen-host to limit to a specific IP or to the IPs of a provided hostname.
+#listen-host = [IP|HOSTNAME]
+
+use-dbus = no
+
+# Limit the number of clients. Unset or set to zero for unlimited.
+#max-clients = 1024
+max-clients = 16
+
+# Limit the number of client connections to one every X milliseconds
+# (X is the provided value). Set to zero for no limit.
+#rate-limit-ms = 100
+
+# Limit the number of identical clients (i.e., users connecting multiple times)
+# Unset or set to zero for unlimited.
+max-same-clients = 2
+
+# TCP and UDP port number
+tcp-port = @PORT@
+udp-port = @PORT@
+
+# Keepalive in seconds
+keepalive = 32400
+
+# Dead peer detection in seconds
+dpd = 440
+
+# MTU discovery (DPD must be enabled)
+try-mtu-discovery = false
+
+# The key and the certificates of the server
+# The key may be a file, or any URL supported by GnuTLS (e.g.,
+# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user
+# or pkcs11:object=my-vpn-key;object-type=private)
+#
+# There may be multiple certificate and key pairs and each key
+# should correspond to the preceding certificate.
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
+
+# Diffie-Hellman parameters. Only needed if you require support
+# for the DHE ciphersuites (by default this server supports ECDHE).
+# Can be generated using:
+# certtool --generate-dh-params --outfile /path/to/dh.pem
+#dh-params = /path/to/dh.pem
+
+# If you have a certificate from a CA that provides an OCSP
+# service you may provide a fresh OCSP status response within
+# the TLS handshake. That will prevent the client from connecting
+# independently on the OCSP server.
+# You can update this response periodically using:
+# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response
+# Make sure that you replace the following file in an atomic way.
+#ocsp-response = /path/to/ocsp.der
+
+# In case PKCS #11 or TPM keys are used the PINs should be available
+# in files. The srk-pin-file is applicable to TPM keys only (It's the storage
+# root key).
+#pin-file = /path/to/pin.txt
+#srk-pin-file = /path/to/srkpin.txt
+
+# The Certificate Authority that will be used
+# to verify clients if certificate authentication
+# is set.
+#ca-cert = /path/to/ca.pem
+
+# The object identifier that will be used to read the user ID in the client certificate.
+# The object identifier should be part of the certificate's DN
+# Useful OIDs are:
+#  CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1
+#cert-user-oid = 0.9.2342.19200300.100.1.1
+
+# The object identifier that will be used to read the user group in the client
+# certificate. The object identifier should be part of the certificate's DN
+# Useful OIDs are:
+#  OU (organizational unit) = 2.5.4.11
+#cert-group-oid = 2.5.4.11
+
+# A revocation list of ca-cert is set
+#crl = /path/to/crl.pem
+
+# GnuTLS priority string
+tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE:%COMPAT"
+
+# To enforce perfect forward secrecy (PFS) on the main channel.
+#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA"
+
+# The time (in seconds) that a client is allowed to stay connected prior
+# to authentication
+auth-timeout = 40
+
+# Script to call when a client connects and obtains an IP
+# Parameters are passed on the environment.
+# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client),
+# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
+# in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON
+# may be "connect" or "disconnect".
+#connect-script = /usr/bin/myscript
+#disconnect-script = /usr/bin/myscript
+
+# PID file
+pid-file = ./ocserv.pid
+
+# The default server directory. Does not require any devices present.
+#chroot-dir = /path/to/chroot
+
+# socket file used for IPC, will be appended with .PID
+# It must be accessible within the chroot environment (if any)
+socket-file = ./ocserv-socket
+
+# The user the worker processes will be run as. It should be
+# unique (no other services run as this user).
+run-as-user = @USERNAME@
+run-as-group = @GROUP@
+
+# Network settings
+
+device = vpns
+
+# The default domain to be advertised
+default-domain = example.com
+
+# Point-to-point (P2P) network configurations
+# IPv4: /30 network (RFC 3021 - 2 usable hosts)
+ipv4-network = @VPNNET@
+
+# IPv6: /127 network (RFC 6164 - dedicated for P2P links)
+ipv6-network = @VPNNET6@
+
+# Prior to leasing any IP from the pool ping it to verify that
+# it is not in use by another (unrelated to this server) host.
+ping-leases = false
+
+# Leave empty to assign the default MTU of the device
+# mtu =
+
+#
+# The following options are for (experimental) AnyConnect client
+# compatibility. They are only available if the server is built
+# with --enable-anyconnect
+#
+
+# Client profile xml. A sample file exists in doc/profile.xml.
+# This file must be accessible from inside the worker's chroot.
+# The profile is ignored by the openconnect client.
+#user-profile = profile.xml
+
+# Unless set to false it is required for clients to present their
+# certificate even if they are authenticating via a previously granted
+# cookie. Legacy CISCO clients do not do that, and thus this option
+# should be set for them.
+#always-require-cert = false
diff --git a/tests/meson.build b/tests/meson.build
index 6c7a7f33..be3b903f 100644
--- a/tests/meson.build
+++ b/tests/meson.build
@@ -298,7 +298,8 @@ if get_option('root-tests')
     'test-cstp-send-hang', 'test-mtu-connect',
     'disconnect-user', 'disconnect-user2', 'terminate-commands',
     'ping-leases', 'test-ban-local', 'test-client-bypass-protocol',
-    'ipv6-small-net', 'test-camouflage', 'test-camouflage-norealm',
+    'ipv6-small-net', 'p2p-net',
+    'test-camouflage', 'test-camouflage-norealm',
     'vhost-traffic', 'defvhost-traffic',
     'test-occtl', 'test-occtl-commands', 'no-ipv6-ocv3',
     'test-config-per-group', 'test-config-per-group-url-pass',
diff --git a/tests/ns.sh b/tests/ns.sh
index cb6d0610..da41837e 100755
--- a/tests/ns.sh
+++ b/tests/ns.sh
@@ -27,9 +27,9 @@
 #  VPNADDR=192.168.1.1
 #
 # Provides:
-#  ${NSCMD1} - to run on NS1
-#  ${NSCMD2} - to run on NS2
-#  ${NSCMD3} - to run on NS3
+#  ${CMDNS1} - to run on NS1
+#  ${CMDNS2} - to run on NS2
+#  ${CMDNS3} - to run on NS3
 #
 # Cleanup is automatic via a trap
 #  Requires: finish() to be defined
diff --git a/tests/p2p-net b/tests/p2p-net
new file mode 100644
index 00000000..39966779
--- /dev/null
+++ b/tests/p2p-net
@@ -0,0 +1,147 @@
+#!/bin/bash
+#
+# Copyright (C) 2021 Nikos Mavrogiannopoulos
+#
+# This file is part of ocserv.
+#
+# ocserv is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 2 of the License, or (at
+# your option) any later version.
+#
+# ocserv is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+# Test peer-to-peer networks:
+# - IPv6: use a /127 network and make sure the server is assigned the
+#         network address.
+# - IPv4: use a /30 network for now, until we support /31 networks, and
+#         make sure the server is assigned the network address + 1.
+
+SERV="${SERV:-../src/ocserv}"
+srcdir=${srcdir:-.}
+PIDFILE=ocserv-pid.$$.tmp
+CLIPID=oc-pid.$$.tmp
+IP=$(command -v ip)
+
+. `dirname $0`/common.sh
+
+eval "${GETPORT}"
+
+if test -z "${IP}";then
+	echo "no IP tool is present"
+	exit 77
+fi
+
+if test "$(id -u)" != "0";then
+	echo "This test must be run as root"
+	exit 77
+fi
+
+
+echo "Testing ocserv with point-to-point networks (IPv4 /30, IPv6 /127)... "
+
+function finish {
+  echo " * Cleaning up..."
+  cleanup_client_server
+}
+trap finish EXIT
+
+OCCTL_SOCKET=./p2p-iface-$$.socket
+USERNAME=test
+
+IPCALC=$(command -v ipcalc-ng)
+if test -z "${IPCALC}"; then
+	IPCALC=$(command -v ipcalc)
+fi
+
+if test -z "${IPCALC}"; then
+	echo "ipcalc was not found"
+	exit 1
+fi
+
+# Generate random IPv4 P2P network (/30 - RFC 3021)
+# /30 provides 4 addresses: network, 2 usable hosts, broadcast
+ret=0
+while [ $ret = 0 ]
+do
+	eval $(${IPCALC} -r 30 -np --minaddr --maxaddr)
+	VPNNET="${NETWORK}/${PREFIX}"
+	VPNADDR=${MINADDR}           # Server address
+	VPNADDR_CLI=${MAXADDR}       # Client address
+	ping -W 1 -c 2 ${VPNADDR} >/dev/null 2>&1
+	ret=$?
+done
+
+# Generate random IPv6 P2P network (/127 - RFC 6164)
+# /127 provides exactly 2 addresses for point-to-point links
+ret=0
+while [ $ret = 0 ]
+do
+	eval $(${IPCALC} -r 127 -np --minaddr --maxaddr)
+	VPNNET6="${NETWORK}/${PREFIX}"
+	VPNADDR6=${MINADDR}          # Server address
+	VPNADDR6_CLI=${MAXADDR}      # Client address
+	ping -W 1 -c 2 ${VPNADDR6} >/dev/null 2>&1
+	ret=$?
+done
+
+echo "**************************"
+echo "VPN IPv4 network: $VPNNET"
+echo "VPN IPv4 server address: $VPNADDR"
+echo "VPN IPv6 network: $VPNNET6"
+echo "VPN IPv6 server address: $VPNADDR6"
+echo "Client IPv4 address: $VPNADDR_CLI"
+echo "Client IPv6 address: $VPNADDR6_CLI"
+echo "**************************"
+
+#####################. `dirname $0`/ns.sh
+
+update_config p2p-iface.config
+if test "$VERBOSE" = 1;then
+	DEBUG="-d 3"
+fi
+
+${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$!
+wait_server $PID
+
+echo -n "Connecting to P2P interface... "
+echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b
+if test $? != 0;then
+	echo "Could not connect to server"
+	exit 1
+fi
+
+echo ok
+
+set -e
+echo -n "Verifying assigned IPv4 address... "
+ASSIGNED_IPV4=$(${CMDNS2} ${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME} | grep "IPv4:" | awk '{print $2}')
+if [ "${ASSIGNED_IPV4}" != "${VPNADDR_CLI}" ];then
+	echo "FAILED"
+	echo "Expected IPv4: ${VPNADDR_CLI}, got: ${ASSIGNED_IPV4}"
+	exit 1
+fi
+echo "ok (${ASSIGNED_IPV4})"
+
+echo -n "Verifying assigned IPv6 address... "
+ASSIGNED_IPV6=$(${CMDNS2} ${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME} | grep "IPv6:" | awk '{print $2}')
+if [ "${ASSIGNED_IPV6}" != "${VPNADDR6_CLI}" ];then
+	echo "FAILED"
+	echo "Expected IPv6: ${VPNADDR6_CLI}, got: ${ASSIGNED_IPV6}"
+	exit 1
+fi
+echo "ok (${ASSIGNED_IPV6})"
+
+echo ok
+
+kill $PID
+wait
+
+exit 0
diff --git a/tests/radius-config b/tests/radius-config
index 4b71b2f1..2d3c01ae 100755
--- a/tests/radius-config
+++ b/tests/radius-config
@@ -74,7 +74,7 @@ VPNNET=192.168.66.0/24
 VPNADDR=192.168.66.1
 CLIVPNADDR=192.168.66.192
 VPNNET6=fd91:6d14:7241:dc6a::/112
-VPNADDR6=fd91:6d14:7241:dc6a::1
+VPNADDR6=fd91:6d14:7241:dc6a::0
 OCCTL_SOCKET=./occtl-radius-$$.socket
 
 . `dirname $0`/ns.sh
diff --git a/tests/radius-group b/tests/radius-group
index 6b98d289..9e1242a4 100755
--- a/tests/radius-group
+++ b/tests/radius-group
@@ -73,7 +73,7 @@ trap finish EXIT
 VPNNET=192.168.93.0/24
 VPNADDR=192.168.93.1
 VPNNET6=fc7d:b139:f7ba:5f53:c634:e98e:b777:0/112
-VPNADDR6=fc7d:b139:f7ba:5f53:c634:e98e:b777:1
+VPNADDR6=fc7d:b139:f7ba:5f53:c634:e98e:b777:0
 OCCTL_SOCKET=./occtl-radius-group-$$.socket
 
 . `dirname $0`/ns.sh
diff --git a/tests/radius-ipv6-prefix b/tests/radius-ipv6-prefix
index 5df18384..2682657f 100755
--- a/tests/radius-ipv6-prefix
+++ b/tests/radius-ipv6-prefix
@@ -76,7 +76,7 @@ VPNNET=192.168.66.0/24
 VPNADDR=192.168.66.1
 CLIVPNADDR=192.168.66.194
 VPNNET6=fd91:6d14:7241:dc6a::/112
-VPNADDR6=fd91:6d14:7241:dc6a::1
+VPNADDR6=fd91:6d14:7241:dc6a::0
 OCCTL_SOCKET=./occtl-radius-ipv6-prefix-$$.socket
 
 . `dirname $0`/ns.sh
diff --git a/tests/radius-multi-group b/tests/radius-multi-group
index 179c2e4d..b9f6d1a3 100755
--- a/tests/radius-multi-group
+++ b/tests/radius-multi-group
@@ -73,7 +73,7 @@ trap finish EXIT
 VPNNET=192.168.94.0/24
 VPNADDR=192.168.94.192
 VPNNET6=fc7d:b139:f7ba:5f51:c634:e98e:b777:0/112
-VPNADDR6=fc7d:b139:f7ba:5f51:c634:e98e:b777:1
+VPNADDR6=fc7d:b139:f7ba:5f51:c634:e98e:b777:0
 OCCTL_SOCKET=./occtl-radius-group-$$.socket
 
 . `dirname $0`/ns.sh
diff --git a/tests/radius-multi-group-comma b/tests/radius-multi-group-comma
index 4dd8bd81..10748bcb 100755
--- a/tests/radius-multi-group-comma
+++ b/tests/radius-multi-group-comma
@@ -73,7 +73,7 @@ trap finish EXIT
 VPNNET=192.168.95.0/24
 VPNADDR=192.168.95.192
 VPNNET6=fc7d:b139:f7ba:5f50:c634:e98e:b777:0/112
-VPNADDR6=fc7d:b139:f7ba:5f50:c634:e98e:b777:1
+VPNADDR6=fc7d:b139:f7ba:5f50:c634:e98e:b777:0
 OCCTL_SOCKET=./occtl-radius-group-$$.socket
 
 . `dirname $0`/ns.sh
diff --git a/tests/radius-otp b/tests/radius-otp
index 158e50d9..9c034528 100755
--- a/tests/radius-otp
+++ b/tests/radius-otp
@@ -80,7 +80,7 @@ trap finish EXIT
 VPNNET=192.168.55.0/24
 VPNADDR=192.168.55.1
 VPNNET6=fc7d:b139:f7ba:5f53:c634:e98e:b777:0/112
-VPNADDR6=fc7d:b139:f7ba:5f53:c634:e98e:b777:1
+VPNADDR6=fc7d:b139:f7ba:5f53:c634:e98e:b777:0
 OCCTL_SOCKET=./occtl-radius-otp-$$.socket
 
 . `dirname $0`/ns.sh
diff --git a/tests/random-net.sh b/tests/random-net.sh
index 136ee6c9..ef43fa19 100755
--- a/tests/random-net.sh
+++ b/tests/random-net.sh
@@ -51,7 +51,7 @@ while [ $ret = 0 ]
 do
 	eval $(${IPCALC} -r 112 -np --minaddr)
 	VPNNET6="${NETWORK}/${PREFIX}"
-	VPNADDR6="${NETWORK}1"
+	VPNADDR6="${NETWORK}"
 	ping ${PINGOPS} ${VPNADDR6} >/dev/null 2>&1
 	ret=$?
 done
diff --git a/tests/test-config-per-group-url-cert b/tests/test-config-per-group-url-cert
index 61458895..50cb31eb 100755
--- a/tests/test-config-per-group-url-cert
+++ b/tests/test-config-per-group-url-cert
@@ -62,7 +62,7 @@ CLI_ADDRESS=10.204.4.1
 VPNNET=192.168.14.0/24
 VPNADDR=192.168.14.1
 VPNNET6=fd91:6d87:7344:dc6a:dc15::/112
-VPNADDR6=fd91:6d87:7344:dc6a:dc15::1
+VPNADDR6=fd91:6d87:7344:dc6a:dc15::0
 OCCTL_SOCKET=./occtl-cpg-$$.socket
 ROUTE1=192.168.14.0/24
 USERNAME=test
diff --git a/tests/test-config-per-group-url-pass b/tests/test-config-per-group-url-pass
index 588edfc9..e964ac7d 100755
--- a/tests/test-config-per-group-url-pass
+++ b/tests/test-config-per-group-url-pass
@@ -62,7 +62,7 @@ CLI_ADDRESS=10.204.6.1
 VPNNET=192.168.24.0/24
 VPNADDR=192.168.24.1
 VPNNET6=fd91:6d87:7344:dc6a:dc16::/112
-VPNADDR6=fd91:6d87:7344:dc6a:dc16::1
+VPNADDR6=fd91:6d87:7344:dc6a:dc16::0
 OCCTL_SOCKET=./occtl-cpg-$$.socket
 ROUTE1=192.168.24.0/24
 USERNAME=test
diff --git a/tests/user-config-explicit/test4 b/tests/user-config-explicit/test4
index 1f977531..34900592 100644
--- a/tests/user-config-explicit/test4
+++ b/tests/user-config-explicit/test4
@@ -1 +1 @@
-explicit-ipv6 = fda9:4efe:7e3b:03ea::01
+explicit-ipv6 = fda9:4efe:7e3b:03ea::0