xref: /freebsd/stand/libsa/bootp.c (revision a259b98fa211ed87bfee58c575de4e2de94ee0fa)
1 /*	$NetBSD: bootp.c,v 1.14 1998/02/16 11:10:54 drochner Exp $	*/
2 
3 /*
4  * Copyright (c) 1992 Regents of the University of California.
5  * All rights reserved.
6  *
7  * This software was developed by the Computer Systems Engineering group
8  * at Lawrence Berkeley Laboratory under DARPA contract BG 91-66 and
9  * contributed to Berkeley.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. Neither the name of the University nor the names of its contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  */
35 
36 #include <stddef.h>
37 #include <sys/types.h>
38 #include <sys/limits.h>
39 #include <sys/endian.h>
40 #include <netinet/in.h>
41 #include <netinet/in_systm.h>
42 
43 #include <string.h>
44 
45 #define SUPPORT_DHCP
46 
47 #define	DHCP_ENV_NOVENDOR	1	/* do not parse vendor options */
48 #define	DHCP_ENV_PXE		10	/* assume pxe vendor options */
49 #define	DHCP_ENV_FREEBSD	11	/* assume freebsd vendor options */
50 /* set DHCP_ENV to one of the values above to export dhcp options to kenv */
51 #define DHCP_ENV		DHCP_ENV_NO_VENDOR
52 
53 #include "stand.h"
54 #include "net.h"
55 #include "netif.h"
56 #include "bootp.h"
57 
58 
59 struct in_addr servip;
60 
61 static time_t	bot;
62 
63 static	char vm_rfc1048[4] = VM_RFC1048;
64 #ifdef BOOTP_VEND_CMU
65 static	char vm_cmu[4] = VM_CMU;
66 #endif
67 
68 /* Local forwards */
69 static	ssize_t bootpsend(struct iodesc *, void *, size_t);
70 static	ssize_t bootprecv(struct iodesc *, void **, void **, time_t, void *);
71 static	int vend_rfc1048(u_char *, u_int);
72 static	void vend_vivso(const u_char *, size_t);
73 #ifdef BOOTP_VEND_CMU
74 static	void vend_cmu(u_char *);
75 #endif
76 
77 #ifdef DHCP_ENV		/* export the dhcp response to kenv */
78 struct dhcp_opt;
79 static void setenv_(u_char *cp,  u_char *ep, struct dhcp_opt *opts);
80 #else
81 #define setenv_(a, b, c)
82 #endif
83 
84 #ifdef SUPPORT_DHCP
85 static char expected_dhcpmsgtype = -1, dhcp_ok;
86 struct in_addr dhcp_serverip;
87 #endif
88 struct bootp *bootp_response;
89 size_t bootp_response_size;
90 
91 /*
92  * DHCP Client-System Architecture per RFC 4578 (option 93).  Each netif
93  * driver that has a spec-defined value for what it is sets this from
94  * its own init path (e.g. efinet_dev_init on UEFI, pxe_init on legacy
95  * BIOS PXE).  BOOTP_ARCH_UNSET means the loader has no honest value to
96  * report (e.g. U-Boot or OpenFirmware, for which RFC 4578 has no
97  * assignment), and the option is omitted from the DHCP request rather
98  * than misrepresenting the client.
99  */
100 #define	BOOTP_ARCH_UNSET	0xFFFF
101 uint16_t bootp_client_arch = BOOTP_ARCH_UNSET;
102 
103 static void
104 bootp_fill_request(unsigned char *bp_vend)
105 {
106 	int off = 0;
107 
108 	/*
109 	 * We are booting from PXE, we want to send the string
110 	 * 'PXEClient' to the DHCP server so you have the option of
111 	 * only responding to PXE aware dhcp requests.
112 	 */
113 	bp_vend[off++] = TAG_CLASSID;
114 	bp_vend[off++] = 9;
115 	bcopy("PXEClient", &bp_vend[off], 9);
116 	off += 9;
117 
118 	bp_vend[off++] = TAG_USER_CLASS;
119 	/* len of each user class + number of user class */
120 	bp_vend[off++] = 8;
121 	/* len of the first user class */
122 	bp_vend[off++] = 7;
123 	bcopy("FreeBSD", &bp_vend[off], 7);
124 	off += 7;
125 
126 	/* Vendor-Identifying Vendor Class, RFC 3925. */
127 	bp_vend[off++] = TAG_VI_VENDOR_CLASS;
128 	bp_vend[off++] = 12;
129 	be32enc(&bp_vend[off], FREEBSD_ENTERPRISE_NUMBER);
130 	off += 4;
131 	bp_vend[off++] = 7;
132 	bcopy("FreeBSD", &bp_vend[off], 7);
133 	off += 7;
134 
135 	/*
136 	 * Client architecture (RFC 4578).  Value is 2 bytes big-endian.
137 	 * Omit entirely for loaders that don't have a spec-defined value.
138 	 */
139 	if (bootp_client_arch != BOOTP_ARCH_UNSET) {
140 		bp_vend[off++] = TAG_CLIENT_ARCH;
141 		bp_vend[off++] = 2;
142 		bp_vend[off++] = (bootp_client_arch >> 8) & 0xff;
143 		bp_vend[off++] = bootp_client_arch & 0xff;
144 	}
145 
146 	/*
147 	 * Maximum DHCP message size we can accept (RFC 2132).  The loader's
148 	 * UDP read path allocates dynamically per packet up to the interface
149 	 * MTU, so advertise ~MTU to unlock large option payloads that some
150 	 * servers would otherwise trim to the RFC 2131 § 4.4.1 576-byte
151 	 * default.
152 	 */
153 	bp_vend[off++] = TAG_MAXSIZE;
154 	bp_vend[off++] = 2;
155 	bp_vend[off++] = (1472 >> 8) & 0xff;
156 	bp_vend[off++] = 1472 & 0xff;
157 
158 	bp_vend[off++] = TAG_PARAM_REQ;
159 	bp_vend[off++] = 8;
160 	bp_vend[off++] = TAG_ROOTPATH;
161 	bp_vend[off++] = TAG_HOSTNAME;
162 	bp_vend[off++] = TAG_SWAPSERVER;
163 	bp_vend[off++] = TAG_GATEWAY;
164 	bp_vend[off++] = TAG_SUBNET_MASK;
165 	bp_vend[off++] = TAG_INTF_MTU;
166 	bp_vend[off++] = TAG_SERVERID;
167 	bp_vend[off++] = TAG_VI_VENDOR_OPTS;
168 	bp_vend[off] = TAG_END;
169 }
170 
171 /* Fetch required bootp infomation */
172 void
173 bootp(int sock)
174 {
175 	void *pkt = NULL;
176 	struct iodesc *d;
177 	struct bootp *bp;
178 	struct {
179 		u_char header[HEADER_SIZE];
180 		struct bootp wbootp;
181 	} wbuf;
182 	struct bootp *rbootp;
183 	bool init_reboot = false;
184 
185 	DEBUG_PRINTF(1, ("bootp: socket=%d\n", sock));
186 	if (!bot)
187 		bot = getsecs();
188 
189 	if (!(d = socktodesc(sock))) {
190 		printf("bootp: bad socket. %d\n", sock);
191 		return;
192 	}
193 	DEBUG_PRINTF(1, ("bootp: socktodesc=%lx\n", (long)d));
194 
195 restart:
196 	bp = &wbuf.wbootp;
197 	bzero(bp, sizeof(*bp));
198 
199 	bp->bp_op = BOOTREQUEST;
200 	bp->bp_htype = 1;		/* 10Mb Ethernet (48 bits) */
201 	bp->bp_hlen = 6;
202 	MACPY(d->myea, bp->bp_chaddr);
203 	strncpy(bp->bp_file, bootfile, sizeof(bp->bp_file));
204 	bcopy(vm_rfc1048, bp->bp_vend, sizeof(vm_rfc1048));
205 
206 	d->myip.s_addr = INADDR_ANY;
207 	d->myport = htons(IPPORT_BOOTPC);
208 	d->destip.s_addr = INADDR_BROADCAST;
209 	d->destport = htons(IPPORT_BOOTPS);
210 
211 #ifdef SUPPORT_DHCP
212 	/*
213 	 * If a DHCP reply is already cached (populated by a lower layer
214 	 * that captured it from firmware, e.g. UEFI PXE Base Code), enter
215 	 * RFC 2131 § 4.3.2 INIT-REBOOT: skip DISCOVER/OFFER and go
216 	 * straight to REQUEST with option 50 = cached IP.  The DHCP
217 	 * server confirms the lease with an ACK containing whatever
218 	 * options this client asks for, which may be a superset of what
219 	 * the firmware asked for (e.g. option 26 interface-MTU, option 16
220 	 * swap-server).  On NAK or timeout, fall back to a full
221 	 * DISCOVER/OFFER/REQUEST/ACK cycle.
222 	 */
223 	if (bootp_response != NULL &&
224 	    bootp_response->bp_yiaddr.s_addr != INADDR_ANY) {
225 		init_reboot = true;
226 		rbootp = bootp_response;
227 		/*
228 		 * INIT-REBOOT is a new DHCP transaction, distinct from
229 		 * the firmware's cached DISCOVER/OFFER/REQUEST/ACK.
230 		 * Use the firmware's xid just as an entropy source.
231 		 */
232 		d->xid = ntohl(rbootp->bp_xid) + 1;
233 		DEBUG_PRINTF(1, ("bootp: using cached DHCP reply "
234 		    "(INIT-REBOOT), yiaddr=%s xid=0x%08x\n",
235 		    inet_ntoa(rbootp->bp_yiaddr), (unsigned)d->xid));
236 	} else
237 #endif
238 	if (d->xid == 0) {
239 		/*
240 		 * RFC 951 / RFC 2131 § 4.1 recommend a random xid.
241 		 * Without a real RNG in the loader, seed from the
242 		 * interface MAC (host-unique) mixed with the current
243 		 * time (unique across reboots on the same host).  This
244 		 * avoids the pre-existing behavior of every fresh
245 		 * BOOTP/DHCP client sending xid=0, which risks
246 		 * broadcast-reply mis-correlation when several PXE
247 		 * clients boot concurrently — bootprecv() enforces
248 		 * xid matching.
249 		 */
250 		memcpy(&d->xid, &d->myea[2], sizeof(d->xid));
251 		d->xid ^= (uint32_t)getsecs();
252 	}
253 	bp->bp_xid = htonl(d->xid);
254 
255 	if (!init_reboot) {
256 #ifdef SUPPORT_DHCP
257 		bp->bp_vend[4] = TAG_DHCP_MSGTYPE;
258 		bp->bp_vend[5] = 1;
259 		bp->bp_vend[6] = DHCPDISCOVER;
260 		bootp_fill_request(&bp->bp_vend[7]);
261 		expected_dhcpmsgtype = DHCPOFFER;
262 		dhcp_ok = 0;
263 #else
264 		bp->bp_vend[4] = TAG_END;
265 #endif
266 
267 		if (sendrecv(d,
268 			    bootpsend, bp, sizeof(*bp),
269 			    bootprecv, &pkt, (void **)&rbootp, NULL) == -1) {
270 			printf("bootp: no reply\n");
271 			return;
272 		}
273 	}
274 
275 #ifdef SUPPORT_DHCP
276 	if (dhcp_ok || init_reboot) {
277 		uint32_t leasetime;
278 		int off;
279 
280 		bp->bp_vend[4] = TAG_DHCP_MSGTYPE;
281 		bp->bp_vend[5] = 1;
282 		bp->bp_vend[6] = DHCPREQUEST;
283 		bp->bp_vend[7] = TAG_REQ_ADDR;
284 		bp->bp_vend[8] = 4;
285 		bcopy(&rbootp->bp_yiaddr, &bp->bp_vend[9], 4);
286 		off = 13;
287 		if (!init_reboot) {
288 			/* SELECTING: server-id identifies the server whose
289 			 * OFFER we accepted.  INIT-REBOOT omits it (RFC 2131
290 			 * § 4.3.2). */
291 			bp->bp_vend[off++] = TAG_SERVERID;
292 			bp->bp_vend[off++] = 4;
293 			bcopy(&dhcp_serverip.s_addr, &bp->bp_vend[off], 4);
294 			off += 4;
295 		}
296 		bp->bp_vend[off++] = TAG_LEASETIME;
297 		bp->bp_vend[off++] = 4;
298 		leasetime = htonl(300);
299 		bcopy(&leasetime, &bp->bp_vend[off], 4);
300 		off += 4;
301 		bootp_fill_request(&bp->bp_vend[off]);
302 
303 		expected_dhcpmsgtype = DHCPACK;
304 
305 		if (pkt != NULL) {
306 			free(pkt);
307 			pkt = NULL;
308 		}
309 		if (sendrecv(d,
310 			    bootpsend, bp, sizeof(*bp),
311 			    bootprecv, &pkt, (void **)&rbootp, NULL) == -1) {
312 			if (init_reboot) {
313 				printf("bootp: INIT-REBOOT failed, "
314 				    "falling back to DISCOVER\n");
315 				free(bootp_response);
316 				bootp_response = NULL;
317 				bootp_response_size = 0;
318 				init_reboot = false;
319 				++d->xid;
320 				if (pkt != NULL) {
321 					free(pkt);
322 					pkt = NULL;
323 				}
324 				goto restart;
325 			}
326 			printf("DHCPREQUEST failed\n");
327 			return;
328 		}
329 		if (init_reboot)
330 			DEBUG_PRINTF(1, ("bootp: INIT-REBOOT ACK received\n"));
331 	}
332 #endif
333 
334 	myip = d->myip = rbootp->bp_yiaddr;
335 	servip = rbootp->bp_siaddr;
336 	if (rootip.s_addr == INADDR_ANY)
337 		rootip = servip;
338 	bcopy(rbootp->bp_file, bootfile, sizeof(bootfile));
339 	bootfile[sizeof(bootfile) - 1] = '\0';
340 
341 	if (!netmask) {
342 		if (IN_CLASSA(ntohl(myip.s_addr)))
343 			netmask = htonl(IN_CLASSA_NET);
344 		else if (IN_CLASSB(ntohl(myip.s_addr)))
345 			netmask = htonl(IN_CLASSB_NET);
346 		else
347 			netmask = htonl(IN_CLASSC_NET);
348 		DEBUG_PRINTF(1, ("'native netmask' is %s\n", intoa(netmask)));
349 	}
350 
351 	DEBUG_PRINTF(1,("rootip: %s\n", inet_ntoa(rootip)));
352 	DEBUG_PRINTF(1,("mask: %s\n", intoa(netmask)));
353 
354 	/* We need a gateway if root is on a different net */
355 	if (!SAMENET(myip, rootip, netmask)) {
356 		DEBUG_PRINTF(1,("need gateway for root ip\n"));
357 	}
358 
359 	/* Toss gateway if on a different net */
360 	if (!SAMENET(myip, gateip, netmask)) {
361 		DEBUG_PRINTF(1,("gateway ip (%s) bad\n", inet_ntoa(gateip)));
362 		gateip.s_addr = 0;
363 	}
364 
365 	/* Bump xid so next request will be unique. */
366 	++d->xid;
367 	free(pkt);
368 }
369 
370 /* Transmit a bootp request */
371 static ssize_t
372 bootpsend(struct iodesc *d, void *pkt, size_t len)
373 {
374 	struct bootp *bp;
375 
376 	DEBUG_PRINTF(1,("bootpsend: d=%lx called.\n", (long)d));
377 	bp = pkt;
378 	bp->bp_secs = htons((u_short)(getsecs() - bot));
379 
380 	DEBUG_PRINTF(1,("bootpsend: calling sendudp\n"));
381 
382 	return (sendudp(d, pkt, len));
383 }
384 
385 static ssize_t
386 bootprecv(struct iodesc *d, void **pkt, void **payload, time_t tleft,
387     void *extra)
388 {
389 	ssize_t n;
390 	struct bootp *bp;
391 	void *ptr;
392 
393 	DEBUG_PRINTF(1,("bootp_recvoffer: called\n"));
394 
395 	ptr = NULL;
396 	n = readudp(d, &ptr, (void **)&bp, tleft);
397 	if (n == -1 || n < sizeof(struct bootp) - BOOTP_VENDSIZE)
398 		goto bad;
399 
400 	DEBUG_PRINTF(1,("bootprecv: checked.  bp = %p, n = %zd\n", bp, n));
401 
402 	if (bp->bp_xid != htonl(d->xid)) {
403 		DEBUG_PRINTF(1,("bootprecv: expected xid 0x%lx, got 0x%x\n",
404 			d->xid, ntohl(bp->bp_xid)));
405 		goto bad;
406 	}
407 
408 	DEBUG_PRINTF(1,("bootprecv: got one!\n"));
409 
410 	/* Suck out vendor info */
411 	if (bcmp(vm_rfc1048, bp->bp_vend, sizeof(vm_rfc1048)) == 0) {
412 		int vsize = n - offsetof(struct bootp, bp_vend);
413 		if (vend_rfc1048(bp->bp_vend, vsize) != 0)
414 		    goto bad;
415 
416 		/* Save copy of bootp reply or DHCP ACK message */
417 		if (bp->bp_op == BOOTREPLY &&
418 		    ((dhcp_ok == 1 && expected_dhcpmsgtype == DHCPACK) ||
419 		    dhcp_ok == 0)) {
420 			free(bootp_response);
421 			bootp_response = malloc(n);
422 			if (bootp_response != NULL) {
423 				bootp_response_size = n;
424 				bcopy(bp, bootp_response, bootp_response_size);
425 			}
426 		}
427 	}
428 #ifdef BOOTP_VEND_CMU
429 	else if (bcmp(vm_cmu, bp->bp_vend, sizeof(vm_cmu)) == 0)
430 		vend_cmu(bp->bp_vend);
431 #endif
432 	else
433 		printf("bootprecv: unknown vendor 0x%lx\n", (long)bp->bp_vend);
434 
435 	*pkt = ptr;
436 	*payload = bp;
437 	return (n);
438 bad:
439 	free(ptr);
440 	errno = 0;
441 	return (-1);
442 }
443 
444 static int
445 vend_rfc1048(u_char *cp, u_int len)
446 {
447 	u_char *ep;
448 	int size;
449 	u_char tag;
450 	const char *val;
451 
452 	DEBUG_PRINTF(1,("vend_rfc1048 bootp info. len=%d\n", len));
453 	ep = cp + len;
454 
455 	/* Step over magic cookie */
456 	cp += sizeof(int);
457 
458 	setenv_(cp, ep, NULL);
459 
460 	while (cp < ep) {
461 		tag = *cp++;
462 		size = *cp++;
463 		if (tag == TAG_END)
464 			break;
465 
466 		if (tag == TAG_SUBNET_MASK) {
467 			bcopy(cp, &netmask, sizeof(netmask));
468 		}
469 		if (tag == TAG_GATEWAY) {
470 			bcopy(cp, &gateip.s_addr, sizeof(gateip.s_addr));
471 		}
472 		if (tag == TAG_SWAPSERVER) {
473 			/* let it override bp_siaddr */
474 			bcopy(cp, &rootip.s_addr, sizeof(rootip.s_addr));
475 		}
476 		if (tag == TAG_ROOTPATH) {
477 			if ((val = getenv("dhcp.root-path")) == NULL)
478 				val = (const char *)cp;
479 			strlcpy(rootpath, val, sizeof(rootpath));
480 		}
481 		if (tag == TAG_HOSTNAME) {
482 			if ((val = getenv("dhcp.host-name")) == NULL)
483 				val = (const char *)cp;
484 			strlcpy(hostname, val, sizeof(hostname));
485 		}
486 		if (tag == TAG_INTF_MTU) {
487 			intf_mtu = 0;
488 			if ((val = getenv("dhcp.interface-mtu")) != NULL) {
489 				unsigned long tmp;
490 				char *end;
491 
492 				errno = 0;
493 				/*
494 				 * Do not allow MTU to exceed max IPv4 packet
495 				 * size, max value of 16-bit word.
496 				 */
497 				tmp = strtoul(val, &end, 0);
498 				if (errno != 0 ||
499 				    *val == '\0' || *end != '\0' ||
500 				    tmp > USHRT_MAX) {
501 					printf("%s: bad value: \"%s\", "
502 					    "ignoring\n",
503 					    "dhcp.interface-mtu", val);
504 				} else {
505 					intf_mtu = (u_int)tmp;
506 				}
507 			}
508 			if (intf_mtu <= 0)
509 				intf_mtu = be16dec(cp);
510 		}
511 		if (tag == TAG_VI_VENDOR_OPTS)
512 			vend_vivso(cp, size);
513 #ifdef SUPPORT_DHCP
514 		if (tag == TAG_DHCP_MSGTYPE) {
515 			if(*cp != expected_dhcpmsgtype)
516 			    return(-1);
517 			dhcp_ok = 1;
518 		}
519 		if (tag == TAG_SERVERID) {
520 			bcopy(cp, &dhcp_serverip.s_addr,
521 			      sizeof(dhcp_serverip.s_addr));
522 		}
523 #endif
524 		cp += size;
525 	}
526 	return(0);
527 }
528 
529 static void
530 vend_freebsd(const u_char *cp, size_t len)
531 {
532 	char value[256];
533 	size_t size;
534 	u_char tag;
535 
536 	while (len >= 2) {
537 		tag = *cp++;
538 		size = *cp++;
539 		len -= 2;
540 		if (size > len)
541 			return;
542 		if (tag == FREEBSD_VI_INITMD && size < sizeof(value)) {
543 			bcopy(cp, value, size);
544 			value[size] = '\0';
545 			setenv("dhcp.initmd", value, 0);
546 		}
547 		cp += size;
548 		len -= size;
549 	}
550 }
551 
552 static void
553 vend_vivso(const u_char *cp, size_t len)
554 {
555 	uint32_t enterprise;
556 	size_t size;
557 
558 	while (len >= 5) {
559 		enterprise = be32dec(cp);
560 		cp += 4;
561 		size = *cp++;
562 		len -= 5;
563 		if (size > len)
564 			return;
565 		if (enterprise == FREEBSD_ENTERPRISE_NUMBER)
566 			vend_freebsd(cp, size);
567 		cp += size;
568 		len -= size;
569 	}
570 }
571 
572 #ifdef BOOTP_VEND_CMU
573 static void
574 vend_cmu(u_char *cp)
575 {
576 	struct cmu_vend *vp;
577 
578 	DEBUG_PRINTF(1,("vend_cmu bootp info.\n"));
579 
580 	vp = (struct cmu_vend *)cp;
581 
582 	if (vp->v_smask.s_addr != 0) {
583 		netmask = vp->v_smask.s_addr;
584 	}
585 	if (vp->v_dgate.s_addr != 0) {
586 		gateip = vp->v_dgate;
587 	}
588 }
589 #endif
590 
591 #ifdef DHCP_ENV
592 /*
593  * Parse DHCP options and store them into kenv variables.
594  * Original code from Danny Braniss, modifications by Luigi Rizzo.
595  *
596  * The parser is driven by tables which specify the type and name of
597  * each dhcp option and how it appears in kenv.
598  * The first entry in the list contains the prefix used to set the kenv
599  * name (including the . if needed), the last entry must have a 0 tag.
600  * Entries do not need to be sorted though it helps for readability.
601  *
602  * Certain vendor-specific tables can be enabled according to DHCP_ENV.
603  * Set it to 0 if you don't want any.
604  */
605 enum opt_fmt { __NONE = 0,
606 	__8 = 1, __16 = 2, __32 = 4,	/* Unsigned fields, value=size	*/
607 	__IP,				/* IPv4 address			*/
608 	__TXT,				/* C string			*/
609 	__BYTES,			/* byte sequence, printed %02x	*/
610 	__INDIR,			/* name=value			*/
611 	__ILIST,			/* name=value;name=value ... */
612 	__VE,				/* vendor specific, recurse	*/
613 };
614 
615 struct dhcp_opt {
616 	uint8_t	tag;
617 	uint8_t	fmt;
618 	const char	*desc;
619 };
620 
621 static struct dhcp_opt vndr_opt[] = { /* Vendor Specific Options */
622 #if DHCP_ENV == DHCP_ENV_FREEBSD /* FreeBSD table in the original code */
623 	{0,	0,	"FreeBSD"},		/* prefix */
624 	{1,	__TXT,	"kernel"},
625 	{2,	__TXT,	"kernelname"},
626 	{3,	__TXT,	"kernel_options"},
627 	{4,	__IP,	"usr-ip"},
628 	{5,	__TXT,	"conf-path"},
629 	{6,	__TXT,	"rc.conf0"},
630 	{7,	__TXT,	"rc.conf1"},
631 	{8,	__TXT,	"rc.conf2"},
632 	{9,	__TXT,	"rc.conf3"},
633 	{10,	__TXT,	"rc.conf4"},
634 	{11,	__TXT,	"rc.conf5"},
635 	{12,	__TXT,	"rc.conf6"},
636 	{13,	__TXT,	"rc.conf7"},
637 	{14,	__TXT,	"rc.conf8"},
638 	{15,	__TXT,	"rc.conf9"},
639 
640 	{20,	__TXT,  "boot.nfsroot.options"},
641 
642 	{245,	__INDIR, ""},
643 	{246,	__INDIR, ""},
644 	{247,	__INDIR, ""},
645 	{248,	__INDIR, ""},
646 	{249,	__INDIR, ""},
647 	{250,	__INDIR, ""},
648 	{251,	__INDIR, ""},
649 	{252,	__INDIR, ""},
650 	{253,	__INDIR, ""},
651 	{254,	__INDIR, ""},
652 
653 #elif DHCP_ENV == DHCP_ENV_PXE		/* some pxe options, RFC4578 */
654 	{0,	0,	"pxe"},		/* prefix */
655 	{93,	__16,	"system-architecture"},
656 	{94,	__BYTES,	"network-interface"},
657 	{97,	__BYTES,	"machine-identifier"},
658 #else					/* default (empty) table */
659 	{0,	0,	"dhcp.vendor."},		/* prefix */
660 #endif
661 	{0,	__TXT,	"%soption-%d"}
662 };
663 
664 static struct dhcp_opt dhcp_opt[] = {
665 	/* DHCP Option names, formats and codes, from RFC2132. */
666 	{0,	0,	"dhcp."},	// prefix
667 	{1,	__IP,	"subnet-mask"},
668 	{2,	__32,	"time-offset"}, /* this is signed */
669 	{3,	__IP,	"routers"},
670 	{4,	__IP,	"time-servers"},
671 	{5,	__IP,	"ien116-name-servers"},
672 	{6,	__IP,	"domain-name-servers"},
673 	{7,	__IP,	"log-servers"},
674 	{8,	__IP,	"cookie-servers"},
675 	{9,	__IP,	"lpr-servers"},
676 	{10,	__IP,	"impress-servers"},
677 	{11,	__IP,	"resource-location-servers"},
678 	{12,	__TXT,	"host-name"},
679 	{13,	__16,	"boot-size"},
680 	{14,	__TXT,	"merit-dump"},
681 	{15,	__TXT,	"domain-name"},
682 	{16,	__IP,	"swap-server"},
683 	{17,	__TXT,	"root-path"},
684 	{18,	__TXT,	"extensions-path"},
685 	{19,	__8,	"ip-forwarding"},
686 	{20,	__8,	"non-local-source-routing"},
687 	{21,	__IP,	"policy-filter"},
688 	{22,	__16,	"max-dgram-reassembly"},
689 	{23,	__8,	"default-ip-ttl"},
690 	{24,	__32,	"path-mtu-aging-timeout"},
691 	{25,	__16,	"path-mtu-plateau-table"},
692 	{26,	__16,	"interface-mtu"},
693 	{27,	__8,	"all-subnets-local"},
694 	{28,	__IP,	"broadcast-address"},
695 	{29,	__8,	"perform-mask-discovery"},
696 	{30,	__8,	"mask-supplier"},
697 	{31,	__8,	"perform-router-discovery"},
698 	{32,	__IP,	"router-solicitation-address"},
699 	{33,	__IP,	"static-routes"},
700 	{34,	__8,	"trailer-encapsulation"},
701 	{35,	__32,	"arp-cache-timeout"},
702 	{36,	__8,	"ieee802-3-encapsulation"},
703 	{37,	__8,	"default-tcp-ttl"},
704 	{38,	__32,	"tcp-keepalive-interval"},
705 	{39,	__8,	"tcp-keepalive-garbage"},
706 	{40,	__TXT,	"nis-domain"},
707 	{41,	__IP,	"nis-servers"},
708 	{42,	__IP,	"ntp-servers"},
709 	{43,	__VE,	"vendor-encapsulated-options"},
710 	{44,	__IP,	"netbios-name-servers"},
711 	{45,	__IP,	"netbios-dd-server"},
712 	{46,	__8,	"netbios-node-type"},
713 	{47,	__TXT,	"netbios-scope"},
714 	{48,	__IP,	"x-font-servers"},
715 	{49,	__IP,	"x-display-managers"},
716 	{50,	__IP,	"dhcp-requested-address"},
717 	{51,	__32,	"dhcp-lease-time"},
718 	{52,	__8,	"dhcp-option-overload"},
719 	{53,	__8,	"dhcp-message-type"},
720 	{54,	__IP,	"dhcp-server-identifier"},
721 	{55,	__8,	"dhcp-parameter-request-list"},
722 	{56,	__TXT,	"dhcp-message"},
723 	{57,	__16,	"dhcp-max-message-size"},
724 	{58,	__32,	"dhcp-renewal-time"},
725 	{59,	__32,	"dhcp-rebinding-time"},
726 	{60,	__TXT,	"vendor-class-identifier"},
727 	{61,	__TXT,	"dhcp-client-identifier"},
728 	{64,	__TXT,	"nisplus-domain"},
729 	{65,	__IP,	"nisplus-servers"},
730 	{66,	__TXT,	"tftp-server-name"},
731 	{67,	__TXT,	"bootfile-name"},
732 	{68,	__IP,	"mobile-ip-home-agent"},
733 	{69,	__IP,	"smtp-server"},
734 	{70,	__IP,	"pop-server"},
735 	{71,	__IP,	"nntp-server"},
736 	{72,	__IP,	"www-server"},
737 	{73,	__IP,	"finger-server"},
738 	{74,	__IP,	"irc-server"},
739 	{75,	__IP,	"streettalk-server"},
740 	{76,	__IP,	"streettalk-directory-assistance-server"},
741 	{77,	__TXT,	"user-class"},
742 	{85,	__IP,	"nds-servers"},
743 	{86,	__TXT,	"nds-tree-name"},
744 	{87,	__TXT,	"nds-context"},
745 	{210,	__TXT,	"authenticate"},
746 	{125,	__NONE, "vendor-identifying-vendor-options"},
747 
748 	/* use the following entries for arbitrary variables */
749 	{246,	__ILIST, ""},
750 	{247,	__ILIST, ""},
751 	{248,	__ILIST, ""},
752 	{249,	__ILIST, ""},
753 	{250,	__INDIR, ""},
754 	{251,	__INDIR, ""},
755 	{252,	__INDIR, ""},
756 	{253,	__INDIR, ""},
757 	{254,	__INDIR, ""},
758 	{0,	__TXT,	"%soption-%d"}
759 };
760 
761 /*
762  * parse a dhcp response, set environment variables translating options
763  * names and values according to the tables above. Also set dhcp.tags
764  * to the list of selected tags.
765  */
766 static void
767 setenv_(u_char *cp,  u_char *ep, struct dhcp_opt *opts)
768 {
769     u_char	*ncp;
770     u_char	tag;
771     char	tags[512], *tp;	/* the list of tags */
772 
773 #define FLD_SEP	','	/* separator in list of elements */
774     ncp = cp;
775     tp = tags;
776     if (opts == NULL)
777 	opts = dhcp_opt;
778 
779     while (ncp < ep) {
780 	unsigned int	size;		/* option size */
781 	char *vp, *endv, buf[256];	/* the value buffer */
782 	struct dhcp_opt *op;
783 
784 	tag = *ncp++;			/* extract tag and size */
785 	size = *ncp++;
786 	cp = ncp;			/* current payload */
787 	ncp += size;			/* point to the next option */
788 
789 	if (tag == TAG_END)
790 	    break;
791 	if (tag == 0)
792 	    continue;
793 
794 	for (op = opts+1; op->tag && op->tag != tag; op++)
795 		;
796 	/* if not found we end up on the default entry */
797 
798 	/*
799 	 * Copy data into the buffer. While the code uses snprintf, it's also
800 	 * careful never to insert strings that would be truncated. inet_ntoa is
801 	 * tricky to know the size, so it assumes we can always insert it
802 	 * because we reserve 16 bytes at the end of the string for its worst
803 	 * case. Other cases are covered because they will write fewer than
804 	 * these reserved bytes at the end. Source strings can't overflow (as
805 	 * noted below) because buf is 256 bytes and all strings are limited by
806 	 * the protocol to be 256 bytes or smaller.
807 	 */
808 	vp = buf;
809 	*vp = '\0';
810 	endv = buf + sizeof(buf) - 1 - 16;	/* last valid write position */
811 
812 	switch(op->fmt) {
813 	case __NONE:
814 	    break;	/* should not happen */
815 
816 	case __VE: /* recurse, vendor specific */
817 	    setenv_(cp, cp+size, vndr_opt);
818 	    break;
819 
820 	case __IP:	/* ip address */
821 	    for (; size > 0 && vp < endv; size -= 4, cp += 4) {
822 		struct	in_addr in_ip;		/* ip addresses */
823 		if (vp != buf)
824 		    *vp++ = FLD_SEP;
825 		bcopy(cp, &in_ip.s_addr, sizeof(in_ip.s_addr));
826 		snprintf(vp, endv - vp, "%s", inet_ntoa(in_ip));
827 		vp += strlen(vp);
828 	    }
829 	    break;
830 
831 	case __BYTES:	/* opaque byte string */
832 	    for (; size > 0 && vp < endv; size -= 1, cp += 1) {
833 		snprintf(vp, endv - vp, "%02x", *cp);
834 		vp += strlen(vp);
835 	    }
836 	    break;
837 
838 	case __TXT:
839 	    bcopy(cp, buf, size);	/* cannot overflow */
840 	    buf[size] = 0;
841 	    break;
842 
843 	case __32:
844 	case __16:
845 	case __8:	/* op->fmt is also the length of each field */
846 	    for (; size > 0 && vp < endv; size -= op->fmt, cp += op->fmt) {
847 		uint32_t v;
848 		if (op->fmt == __32)
849 			v = (cp[0]<<24) + (cp[1]<<16) + (cp[2]<<8) + cp[3];
850 		else if (op->fmt == __16)
851 			v = (cp[0]<<8) + cp[1];
852 		else
853 			v = cp[0];
854 		if (vp != buf)
855 		    *vp++ = FLD_SEP;
856 		snprintf(vp, endv - vp, "%u", v);
857 		vp += strlen(vp);
858 	    }
859 	    break;
860 
861 	case __INDIR:	/* name=value */
862 	case __ILIST:	/* name=value;name=value... */
863 	    bcopy(cp, buf, size);	/* cannot overflow */
864 	    buf[size] = '\0';
865 	    for (endv = buf; endv; endv = vp) {
866 		char *s = NULL;	/* semicolon ? */
867 
868 		/* skip leading whitespace */
869 		while (*endv && strchr(" \t\n\r", *endv))
870 		    endv++;
871 		vp = strchr(endv, '=');	/* find name=value separator */
872 		if (!vp)
873 		    break;
874 		*vp++ = 0;
875 		if (op->fmt == __ILIST && (s = strchr(vp, ';')))
876 		    *s++ = '\0';
877 		setenv(endv, vp, 1);
878 		vp = s;	/* prepare for next round */
879 	    }
880 	    buf[0] = '\0';	/* option already done */
881 	    break;
882 	}
883 
884 	if (tp - tags < sizeof(tags) - 5) {	/* add tag to the list */
885 	    if (tp != tags)
886 		*tp++ = FLD_SEP;
887 	    snprintf(tp, sizeof(tags) - (tp - tags), "%d", tag);
888 	    tp += strlen(tp);
889 	}
890 	if (buf[0]) {
891 	    char	env[128];	/* the string name */
892 
893 	    if (op->tag == 0)
894 		snprintf(env, sizeof(env), op->desc, opts[0].desc, tag);
895 	    else
896 		snprintf(env, sizeof(env), "%s%s", opts[0].desc, op->desc);
897 	    /*
898 	     * Do not replace existing values in the environment, so that
899 	     * locally-obtained values can override server-provided values.
900 	     */
901 	    setenv(env, buf, 0);
902 	}
903     }
904     if (tp != tags) {
905 	char	env[128];	/* the string name */
906 	snprintf(env, sizeof(env), "%stags", opts[0].desc);
907 	setenv(env, tags, 1);
908     }
909 }
910 #endif /* additional dhcp */
911