Merge pull request #1983 from chipitsine/master

cleanup deprecated CI

.appveyor.yml

@@ -1,33 +0,0 @@
-version: '{build}'
-
-image: Ubuntu2004
-
-configuration: Release
-
-skip_branch_with_pr: true
-clone_depth: 1
-
-skip_commits:
-  files:
-    - .travis.yml
-    - .gitlab-ci.yml
-    - .azure-pipelines.yml
-    - .cirrus.yml
-
-init:
-  - ps: Update-AppveyorBuild -Version "build-$env:APPVEYOR_BUILD_NUMBER-$($env:APPVEYOR_REPO_COMMIT.substring(0,7))"
-
-install:
-  - sudo apt-get -y install libsodium-dev libcap-ng-dev
-before_build:
-  - git submodule update --init --recursive
-  - ./configure
-build_script:
-  - make package -C build -j $(nproc || sysctl -n hw.ncpu || echo 4)
-  - .ci/memory-leak-test.sh
-test_script:
-  - .ci/appveyor-deb-install-test.sh
-  - sudo apt-get update && sudo apt-get -y install autoconf libtool liblzo2-dev libpam-dev fping unzip liblz4-dev libnl-genl-3-dev # openvpn build deps
-  - sudo .ci/start-se-openvpn.sh
-  - sudo .ci/run-openvpn-tests.sh
-

.ci/azure-pipelines/linux_build.sh

@@ -1,15 +0,0 @@
-#!/bin/bash
-
-if [[ "${#SE_BUILD_NUMBER_TOKEN}" -eq 64 ]]; then
-	VERSION=$(python3 "version.py")
-	BUILD_NUMBER=$(curl "https://softether.network/get-build-number?commit=${BUILD_SOURCEVERSION}&version=${VERSION}&token=${SE_BUILD_NUMBER_TOKEN}")
-else
-	BUILD_NUMBER=0
-fi
-
-cd ${BUILD_BINARIESDIRECTORY}
-
-cmake -G "Ninja" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_NUMBER=${BUILD_NUMBER} ${BUILD_SOURCESDIRECTORY}
-cmake --build .
-
-cpack -C Release -G DEB 

.ci/azure-pipelines/macos_build.sh

@@ -1,13 +0,0 @@
-#!/bin/bash
-
-if [[ "${#SE_BUILD_NUMBER_TOKEN}" -eq 64 ]]; then
-	VERSION=$(python3 "version.py")
-	BUILD_NUMBER=$(curl "https://softether.network/get-build-number?commit=${BUILD_SOURCEVERSION}&version=${VERSION}&token=${SE_BUILD_NUMBER_TOKEN}")
-else
-	BUILD_NUMBER=0
-fi
-
-cd ${BUILD_BINARIESDIRECTORY}
-
-cmake -G "Ninja" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_NUMBER=${BUILD_NUMBER} -DOPENSSL_ROOT_DIR="/usr/local/opt/openssl" ${BUILD_SOURCESDIRECTORY}
-cmake --build .

.ci/azure-pipelines/windows_build.bat

@@ -1,33 +0,0 @@
-@echo on
-
-:: The method we use to store a command's output into a variable:
-:: https://stackoverflow.com/a/6362922
-for /f "tokens=* USEBACKQ" %%g in (`python "version.py"`) do (set "VERSION=%%g")
-
-:: https://stackoverflow.com/a/8566001
-echo %SE_BUILD_NUMBER_TOKEN%> "%tmp%\length.txt"
-for %%? in ("%tmp%\length.txt") do ( set /A SE_BUILD_NUMBER_TOKEN_LENGTH=%%~z? - 2 )
-
-if %SE_BUILD_NUMBER_TOKEN_LENGTH% equ 64 (
-	for /f "tokens=* USEBACKQ" %%g in (`curl "https://softether.network/get-build-number?commit=%BUILD_SOURCEVERSION%&version=%VERSION%&token=%SE_BUILD_NUMBER_TOKEN%"`) do (set "BUILD_NUMBER=%%g")
-) else (
-	set BUILD_NUMBER=0
-)
-
-
-if "%BUILD_BINARIESDIRECTORY%"=="" (set BUILD_BINARIESDIRECTORY=build)
-if "%BUILD_SOURCESDIRECTORY%"=="" (set BUILD_SOURCESDIRECTORY=%cd%)
-
-if not exist %BUILD_BINARIESDIRECTORY% mkdir %BUILD_BINARIESDIRECTORY%
-
-cd %BUILD_BINARIESDIRECTORY%
-
-call "%VCVARS_PATH%"
-
-cmake -G "Ninja" -DCMAKE_TOOLCHAIN_FILE="C:\vcpkg\scripts\buildsystems\vcpkg.cmake" -DVCPKG_TARGET_TRIPLET=%VCPKG_TRIPLET% -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_C_COMPILER="%COMPILER_PATH%" -DCMAKE_CXX_COMPILER="%COMPILER_PATH%" -DBUILD_NUMBER=%BUILD_NUMBER% "%BUILD_SOURCESDIRECTORY%"
-cmake --build .
-
-if "%BUILD_STAGINGDIRECTORY%"=="" (set BUILD_STAGINGDIRECTORY=%cd%)
-mkdir "%BUILD_STAGINGDIRECTORY%\installers"
-vpnsetup /SFXMODE:vpnclient /SFXOUT:"%BUILD_STAGINGDIRECTORY%\installers\softether-vpnclient-%VERSION%.%BUILD_NUMBER%.%ARCHITECTURE%.exe"
-vpnsetup /SFXMODE:vpnserver_vpnbridge /SFXOUT:"%BUILD_STAGINGDIRECTORY%\installers\softether-vpnserver_vpnbridge-%VERSION%.%BUILD_NUMBER%.%ARCHITECTURE%.exe"

.github/workflows/windows.yml

@@ -22,13 +22,28 @@ jobs:
       with:
         path: 'build/vcpkg_installed/'
         key: vcpkg-${{ matrix.platform.VCPKG_TRIPLET }}
+    - name: Set version variables
+      run: |
+        $v = python version.py
+        echo "VERSION=$v" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
+      shell: pwsh
     - name: Build
       env:
         ARCHITECTURE: ${{ matrix.platform.ARCHITECTURE }}
         COMPILER_PATH: ${{ matrix.platform.COMPILER_PATH }}
         VCPKG_TRIPLET: ${{ matrix.platform.VCPKG_TRIPLET }}
         VCVARS_PATH: ${{ matrix.platform.VCVARS_PATH }}
-      run: .ci/azure-pipelines/windows_build.bat
+      run: |
+        set BUILD_NUMBER=0
+        mkdir build
+        cd build
+        call "%VCVARS_PATH%"
+        cmake -G "Ninja" -DCMAKE_TOOLCHAIN_FILE="C:\vcpkg\scripts\buildsystems\vcpkg.cmake" -DVCPKG_TARGET_TRIPLET=%VCPKG_TRIPLET% -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_C_COMPILER="%COMPILER_PATH%" -DCMAKE_CXX_COMPILER="%COMPILER_PATH%" -DBUILD_NUMBER=%BUILD_NUMBER% ..
+        cmake --build .
+        mkdir installers
+        vpnsetup /SFXMODE:vpnclient /SFXOUT:"installers\softether-vpnclient-%VERSION%.%BUILD_NUMBER%.%ARCHITECTURE%.exe"
+        vpnsetup /SFXMODE:vpnserver_vpnbridge /SFXOUT:"installers\softether-vpnserver_vpnbridge-%VERSION%.%BUILD_NUMBER%.%ARCHITECTURE%.exe"
+      shell: cmd
     - name: Test
       shell: powershell
       run: |

.github/workflows/windows_release.yml

@@ -0,0 +1,94 @@
+name: "Release"
+
+on:
+  push:
+    tags:
+      - '*'
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: windows-latest
+    outputs:
+      upload_url: "${{ steps.create_release.outputs.upload_url }}"
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@v4
+
+      - name: "Create GitHub release"
+        id: create_release
+        uses: softprops/action-gh-release@v1
+  build-windows:
+    name: ${{ matrix.platform.ARCHITECTURE }}
+    runs-on: windows-latest
+    needs: ["release"]
+    strategy:
+      matrix:
+        platform: [
+          { ARCHITECTURE: x86, COMPILER_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/bin/clang-cl.exe",     VCPKG_TRIPLET: "x86-windows-static", VCVARS_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvars32.bat"},
+          { ARCHITECTURE: x64, COMPILER_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/x64/bin/clang-cl.exe", VCPKG_TRIPLET: "x64-windows-static", VCVARS_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvars64.bat"}
+        ]
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Cache vcpkg
+        uses: actions/cache@v4
+        with:
+          path: 'build/vcpkg_installed/'
+          key: vcpkg-release-${{ matrix.platform.VCPKG_TRIPLET }}
+      - name: Set version variables
+        run: |
+          $b=(Get-Content CMakeSettings.json | Out-String | ConvertFrom-Json).environments.BuildNumber		
+          echo "BUILD_NUMBER=$b" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
+          $v = python version.py
+          echo "VERSION=$v" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
+        shell: pwsh
+      - name: Build
+        env:
+          ARCHITECTURE: ${{ matrix.platform.ARCHITECTURE }}
+          COMPILER_PATH: ${{ matrix.platform.COMPILER_PATH }}
+          VCPKG_TRIPLET: ${{ matrix.platform.VCPKG_TRIPLET }}
+          VCVARS_PATH: ${{ matrix.platform.VCVARS_PATH }}
+        run: |
+          mkdir build
+          cd build
+          call "%VCVARS_PATH%"
+          cmake -G "Ninja" -DCMAKE_TOOLCHAIN_FILE="C:\vcpkg\scripts\buildsystems\vcpkg.cmake" -DVCPKG_TARGET_TRIPLET=%VCPKG_TRIPLET% -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_C_COMPILER="%COMPILER_PATH%" -DCMAKE_CXX_COMPILER="%COMPILER_PATH%" -DBUILD_NUMBER=%BUILD_NUMBER% ..
+          cmake --build .
+          mkdir installers
+          vpnsetup /SFXMODE:vpnclient /SFXOUT:"installers\softether-vpnclient-%VERSION%.%BUILD_NUMBER%.%ARCHITECTURE%.exe"
+          vpnsetup /SFXMODE:vpnserver_vpnbridge /SFXOUT:"installers\softether-vpnserver_vpnbridge-%VERSION%.%BUILD_NUMBER%.%ARCHITECTURE%.exe"
+        shell: cmd
+
+      - name: dir
+        run: |
+          Get-ChildItem -Recurse build/installers
+        shell: pwsh
+
+      - name: "Upload softether-vpnclient"
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: "${{ github.token }}"
+        with:
+          upload_url: "${{ needs.release.outputs.upload_url }}"
+          asset_path: "build/installers/softether-vpnclient-${{ env.VERSION }}.${{ env.BUILD_NUMBER }}.${{ matrix.platform.ARCHITECTURE }}.exe"
+          asset_name: "softether-vpnclient-${{ env.VERSION }}.${{ env.BUILD_NUMBER }}.${{ matrix.platform.ARCHITECTURE }}.exe"
+          asset_content_type: "application/octet-stream"
+      - name: "Upload softether-vpnserver_vpnbridge"
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: "${{ github.token }}"
+        with:
+          upload_url: "${{ needs.release.outputs.upload_url }}"
+          asset_path: "build/installers/softether-vpnserver_vpnbridge-${{ env.VERSION }}.${{ env.BUILD_NUMBER }}.${{ matrix.platform.ARCHITECTURE }}.exe"
+          asset_name: "softether-vpnserver_vpnbridge-${{ env.VERSION }}.${{ env.BUILD_NUMBER }}.${{ matrix.platform.ARCHITECTURE }}.exe"
+          asset_content_type: "application/octet-stream"
+

README.md

@@ -2,10 +2,8 @@
 
 ||Badges|
 |---|---|
-|AppVeyor|[![AppVeyor build status](https://ci.appveyor.com/api/projects/status/github/softethervpn/softethervpn?branch=master&svg=true)](https://ci.appveyor.com/project/softethervpn/softethervpn) |
 |GitLab CI|[![GitLab CI build status](https://gitlab.com/SoftEther/SoftEtherVPN/badges/master/pipeline.svg)](https://gitlab.com/SoftEther/SoftEtherVPN/pipelines)|
 |Coverity Scan|[![Coverity Scan build status](https://scan.coverity.com/projects/16304/badge.svg)](https://scan.coverity.com/projects/softethervpn-softethervpn)|
-|Azure Pipelines|[![Azure Pipelines build status for Nightly](https://dev.azure.com/SoftEther-VPN/SoftEther%20VPN/_apis/build/status/6?api-version=6.0-preview.1)](https://dev.azure.com/SoftEther-VPN/SoftEther%20VPN/_build?definitionId=6)|
 |Cirrus CI|[![Cirrus CI build status](https://api.cirrus-ci.com/github/SoftEtherVPN/SoftEtherVPN.svg)](https://cirrus-ci.com/github/SoftEtherVPN/SoftEtherVPN)|
 
 - [SoftEther VPN](#softether-vpn)

developer_tools/vpnserver-jsonrpc-clients/README.html

@@ -30,7 +30,6 @@
 <ul>
 <li>Older versions of SoftEther VPN before June 2019 don't support JSON-RPC APIs.</li>
 <li>If you want to completely disable the JSON-RPC on your VPN Server, set the <code>DisableJsonRpcWebApi</code> variable to <code>true</code> on the <code>vpn_server.config</code>.</li>
-<li>You may also restrict access to JSON-RPC API to a specific subnet, e.g. your internal network, by setting the <code>JsonRpcWebApiAllowedSubnet</code> variable to, for example, <code>192.168.0.0/16</code>.</li>
 </ul>
 <h3 id="json-rpc-specification">JSON-RPC specification</h3>
 <p>You must use HTTPS 1.1 <code>POST</code> method to call each of JSON-RPC APIs.<br />

developer_tools/vpnserver-jsonrpc-clients/README.md

@@ -25,7 +25,6 @@ https://<vpn_server_hostname>:<port>/api/
 
   - Older versions of SoftEther VPN before June 2019 don't support JSON-RPC APIs.
   - If you want to completely disable the JSON-RPC on your VPN Server, set the `DisableJsonRpcWebApi` variable to `true` on the `vpn_server.config`.
-  - You may also restrict access to JSON-RPC API to a specific subnet, e.g. your internal network, by setting the `JsonRpcWebApiAllowedSubnet` variable to, for example, `192.168.0.0/16`.
 
 
 ### JSON-RPC specification

developer_tools/vpnserver-jsonrpc-codegen/Templates/doc.txt

@@ -25,7 +25,6 @@ https://<vpn_server_hostname>:<port>/api/
 
   - Older versions of SoftEther VPN before June 2019 don't support JSON-RPC APIs.
   - If you want to completely disable the JSON-RPC on your VPN Server, set the `DisableJsonRpcWebApi` variable to `true` on the `vpn_server.config`.
-  - You may also restrict access to JSON-RPC API to a specific subnet, e.g. your internal network, by setting the `JsonRpcWebApiAllowedSubnet` variable to, for example, `192.168.0.0/16`.
 
 
 ### JSON-RPC specification

src/Cedar/Protocol.c

@@ -5740,7 +5740,6 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 	UINT num = 0, max = 19;
 	SERVER *server;
 	char *vpn_http_target = HTTP_VPN_TARGET2;
-	bool disableJsonRpcWebApi;
 	// Validate arguments
 	if (c == NULL)
 	{
@@ -5751,15 +5750,6 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 
 	s = c->FirstSock;
 
-	disableJsonRpcWebApi = server->DisableJsonRpcWebApi;
-	if (!disableJsonRpcWebApi && !IsZeroIP(&server->JsonRpcWebApiAllowedSubnetAddr)
-				&& !IsZeroIP(&server->JsonRpcWebApiAllowedSubnetMask)) {
-		// restrict JSON-RPC Web API to specified subnet only
-		if (!IsInSameNetwork(&s->RemoteIP, &server->JsonRpcWebApiAllowedSubnetAddr, &server->JsonRpcWebApiAllowedSubnetMask)) {
-			disableJsonRpcWebApi = true;
-		}
-	}
-
 	while (true)
 	{
 		bool not_found_error = false;
@@ -5792,7 +5782,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 			// Receive the data since it's POST
 			data_size = GetContentLength(h);
 
-			if (disableJsonRpcWebApi == false)
+			if (server->DisableJsonRpcWebApi == false)
 			{
 				if (StrCmpi(h->Target, "/api") == 0 || StrCmpi(h->Target, "/api/") == 0)
 				{
@@ -5878,7 +5868,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 		}
 		else if (StrCmpi(h->Method, "OPTIONS") == 0)
 		{
-			if (disableJsonRpcWebApi == false)
+			if (server->DisableJsonRpcWebApi == false)
 			{
 				if (StrCmpi(h->Target, "/api") == 0 || StrCmpi(h->Target, "/api/") == 0 || StartWith(h->Target, "/admin"))
 				{
@@ -5949,7 +5939,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 					BUF *b = NULL;
 					*error_detail_str = "HTTP_ROOT";
 
-					if (disableJsonRpcWebApi == false)
+					if (server->DisableJsonRpcWebApi == false)
 					{
 						b = ReadDump("|wwwroot/index.html");
 					}
@@ -6029,7 +6019,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 
 					if (b == false)
 					{
-						if (disableJsonRpcWebApi == false)
+						if (server->DisableJsonRpcWebApi == false)
 						{
 							if (StartWith(h->Target, "/api?") || StartWith(h->Target, "/api/") || StrCmpi(h->Target, "/api") == 0)
 							{
@@ -6783,7 +6773,6 @@ PACK *PackLoginWithOpenVPNCertificate(char *hubname, char *username, X *x)
 
 	p = NewPack();
 	PackAddStr(p, "method", "login");
-	PackAddStr(p, "hubname", hubname);
 
 	if (IsEmptyStr(username))
 	{
@@ -6792,12 +6781,26 @@ PACK *PackLoginWithOpenVPNCertificate(char *hubname, char *username, X *x)
 			FreePack(p);
 			return NULL;
 		}
+
 		UniToStr(cn_username, sizeof(cn_username), x->subject_name->CommonName);
-		PackAddStr(p, "username", cn_username);
+
+		if (strchr(cn_username, '@') != NULL)
+
+		{
+			PackAddStr(p, "username", strtok(cn_username, "@"));
+			PackAddStr(p, "hubname", strtok(NULL, ""));
+		}
+		else
+		{
+			PackAddStr(p, "username", cn_username);
+			PackAddStr(p, "hubname", hubname);
+		}
+
 	}
 	else
 	{
 		PackAddStr(p, "username", username);
+		PackAddStr(p, "hubname", hubname);
 	}
 
 	PackAddInt(p, "authtype", AUTHTYPE_OPENVPN_CERT);

src/Cedar/Server.c

@@ -30,7 +30,6 @@
 #include "Mayaqua/Internat.h"
 #include "Mayaqua/Memory.h"
 #include "Mayaqua/Microsoft.h"
-#include "Mayaqua/Network.h"
 #include "Mayaqua/Object.h"
 #include "Mayaqua/OS.h"
 #include "Mayaqua/Pack.h"
@@ -6033,15 +6032,6 @@ void SiLoadServerCfg(SERVER *s, FOLDER *f)
 		// Disable JSON-RPC Web API
 		s->DisableJsonRpcWebApi = CfgGetBool(f, "DisableJsonRpcWebApi");
 
-		char tmpaddr[MAX_PATH];
-		if (CfgGetStr(f, "JsonRpcWebApiAllowedSubnet", tmpaddr, sizeof(tmpaddr))) {
-			IP _subnet, _mask;
-			if (ParseIpAndMask46(tmpaddr, &_subnet, &_mask)) {
-				s->JsonRpcWebApiAllowedSubnetAddr = _subnet;
-				s->JsonRpcWebApiAllowedSubnetMask = _mask;
-			}
-		}
-
 		// Bits of Diffie-Hellman parameters
 		c->DhParamBits = CfgGetInt(f, "DhParamBits");
 		if (c->DhParamBits == 0)
@@ -6375,11 +6365,6 @@ void SiWriteServerCfg(FOLDER *f, SERVER *s)
 
 		// Disable JSON-RPC Web API
 		CfgAddBool(f, "DisableJsonRpcWebApi", s->DisableJsonRpcWebApi);
-
-		char tmpaddr[MAX_PATH];
-		IPAndMaskToStr(tmpaddr, sizeof(tmpaddr),
-			&s->JsonRpcWebApiAllowedSubnetAddr, &s->JsonRpcWebApiAllowedSubnetMask);
-		CfgAddStr(f, "JsonRpcWebApiAllowedSubnet", tmpaddr);
 	}
 	Unlock(c->lock);
 }

src/Cedar/Server.h

@@ -276,9 +276,6 @@ struct SERVER
 	IP ListenIP;						// Listen IP
 	bool StrictSyslogDatetimeFormat;	// Make syslog datetime format strict RFC3164
 	bool DisableJsonRpcWebApi;					// Disable JSON-RPC Web API
-
-	IP JsonRpcWebApiAllowedSubnetAddr;  // If set, allow access to JSON-RPC Web API from
-	IP JsonRpcWebApiAllowedSubnetMask;  //   this subnet only
 };
 
 

src/Mayaqua/Network.c

@@ -6993,18 +6993,6 @@ void IPToStr6Inner(char *str, IP *ip)
 	}
 }
 
-// Format IP and subnet mask as "<ip>/<masksize>"
-void IPAndMaskToStr(char *str, UINT size, IP *ip, IP *subnet)
-{
-	int iplen;
-	UINT masksize;
-
-	IPToStr(str, size, ip);
-	iplen = StrLen(str);
-	masksize = SubnetMaskToInt(subnet);
-	Format(str + iplen, size - iplen, "/%d", masksize);
-}
-
 // Convert the string to an IP address
 bool StrToIP6(IP *ip, char *str)
 {

src/Mayaqua/Network.h

@@ -1289,7 +1289,6 @@ void IPToStr6(char *str, UINT size, IP *ip);
 void IP6AddrToStr(char *str, UINT size, IPV6_ADDR *addr);
 void IPToStr6Array(char *str, UINT size, UCHAR *bytes);
 void IPToStr6Inner(char *str, IP *ip);
-void IPAndMaskToStr(char *str, UINT size, IP *ip, IP *subnet);
 void IntToSubnetMask6(IP *ip, UINT i);
 void IPAnd6(IP *dst, IP *a, IP *b);
 void GetAllRouterMulticastAddress6(IP *ip);

src/Mayaqua/TcpIp.c

@@ -4168,6 +4168,7 @@ BUF *DhcpModify(DHCP_MODIFY_OPTION *m, void *data, UINT size)
 	LIST *opt_list2 = NULL;
 	UINT src_size = size;
 	UINT i;
+	UINT dhcp_min_size;
 	// Validate arguments
 	if (m == NULL || data == NULL || size == 0)
 	{
@@ -4270,11 +4271,13 @@ BUF *DhcpModify(DHCP_MODIFY_OPTION *m, void *data, UINT size)
 		// Rewrite if anything changes. Do not rewrite if there is no change
 		ret_ok = true;
 
-		if (ret->Size < DHCP_MIN_SIZE)
+		// If src_size is greater than DHCP_MIN_SIZE, then use the src_size as minimum size of DHCP.
+		dhcp_min_size = MAX(src_size, DHCP_MIN_SIZE);
+		if (ret->Size < dhcp_min_size)
 		{
 			// Padding
 			UCHAR *pad_buf;
-			UINT pad_size = DHCP_MIN_SIZE - ret->Size;
+			UINT pad_size = dhcp_min_size - ret->Size;
 
 			pad_buf = ZeroMalloc(pad_size);