xref: /freebsd/sys/nfs/bootp_subr.c (revision 1323ec571215a77ddd21294f0871979d5ad6b992)
1 /*-
2  * SPDX-License-Identifier: BSD-4-Clause
3  *
4  * Copyright (c) 1995 Gordon Ross, Adam Glass
5  * Copyright (c) 1992 Regents of the University of California.
6  * All rights reserved.
7  *
8  * This software was developed by the Computer Systems Engineering group
9  * at Lawrence Berkeley Laboratory under DARPA contract BG 91-66 and
10  * contributed to Berkeley.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. All advertising materials mentioning features or use of this software
21  *    must display the following acknowledgement:
22  *	This product includes software developed by the University of
23  *	California, Lawrence Berkeley Laboratory and its contributors.
24  * 4. Neither the name of the University nor the names of its contributors
25  *    may be used to endorse or promote products derived from this software
26  *    without specific prior written permission.
27  *
28  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
29  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
32  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38  * SUCH DAMAGE.
39  *
40  * based on:
41  *      nfs/krpc_subr.c
42  *	$NetBSD: krpc_subr.c,v 1.10 1995/08/08 20:43:43 gwr Exp $
43  */
44 
45 #define IN_HISTORICAL_NETS		/* include class masks */
46 
47 #include <sys/cdefs.h>
48 __FBSDID("$FreeBSD$");
49 
50 #include "opt_bootp.h"
51 #include "opt_nfs.h"
52 #include "opt_rootdevname.h"
53 
54 #include <sys/param.h>
55 #include <sys/systm.h>
56 #include <sys/endian.h>
57 #include <sys/jail.h>
58 #include <sys/kernel.h>
59 #include <sys/sockio.h>
60 #include <sys/malloc.h>
61 #include <sys/mount.h>
62 #include <sys/mbuf.h>
63 #include <sys/proc.h>
64 #include <sys/reboot.h>
65 #include <sys/socket.h>
66 #include <sys/socketvar.h>
67 #include <sys/sysctl.h>
68 #include <sys/uio.h>
69 
70 #include <net/if.h>
71 #include <net/if_var.h>
72 #include <net/route.h>
73 #include <net/route/route_ctl.h>
74 
75 #include <netinet/in.h>
76 #include <netinet/in_var.h>
77 #include <net/if_types.h>
78 #include <net/if_dl.h>
79 #include <net/vnet.h>
80 
81 #include <nfs/nfsproto.h>
82 #include <nfsclient/nfs.h>
83 #include <nfs/nfsdiskless.h>
84 #include <nfs/krpc.h>
85 #include <nfs/xdr_subs.h>
86 
87 #define BOOTP_MIN_LEN		300	/* Minimum size of bootp udp packet */
88 
89 #ifndef BOOTP_SETTLE_DELAY
90 #define BOOTP_SETTLE_DELAY 3
91 #endif
92 
93 /*
94  * Wait 10 seconds for interface appearance
95  * USB ethernet adapters might require some time to pop up
96  */
97 #ifndef	BOOTP_IFACE_WAIT_TIMEOUT
98 #define	BOOTP_IFACE_WAIT_TIMEOUT	10
99 #endif
100 
101 /*
102  * What is the longest we will wait before re-sending a request?
103  * Note this is also the frequency of "RPC timeout" messages.
104  * The re-send loop count sup linearly to this maximum, so the
105  * first complaint will happen after (1+2+3+4+5)=15 seconds.
106  */
107 #define	MAX_RESEND_DELAY 5	/* seconds */
108 
109 /* Definitions from RFC951 */
110 struct bootp_packet {
111 	u_int8_t op;
112 	u_int8_t htype;
113 	u_int8_t hlen;
114 	u_int8_t hops;
115 	u_int32_t xid;
116 	u_int16_t secs;
117 	u_int16_t flags;
118 	struct in_addr ciaddr;
119 	struct in_addr yiaddr;
120 	struct in_addr siaddr;
121 	struct in_addr giaddr;
122 	unsigned char chaddr[16];
123 	char sname[64];
124 	char file[128];
125 	unsigned char vend[1222];
126 };
127 
128 struct bootpc_ifcontext {
129 	STAILQ_ENTRY(bootpc_ifcontext) next;
130 	struct bootp_packet call;
131 	struct bootp_packet reply;
132 	int replylen;
133 	int overload;
134 	union {
135 		struct ifreq _ifreq;
136 		struct in_aliasreq _in_alias_req;
137 	} _req;
138 #define	ireq	_req._ifreq
139 #define	iareq	_req._in_alias_req
140 	struct ifnet *ifp;
141 	struct sockaddr_dl *sdl;
142 	struct sockaddr_in myaddr;
143 	struct sockaddr_in netmask;
144 	struct sockaddr_in gw;
145 	int gotgw;
146 	int gotnetmask;
147 	int gotrootpath;
148 	int outstanding;
149 	int sentmsg;
150 	u_int32_t xid;
151 	enum {
152 		IF_BOOTP_UNRESOLVED,
153 		IF_BOOTP_RESOLVED,
154 		IF_BOOTP_FAILED,
155 		IF_DHCP_UNRESOLVED,
156 		IF_DHCP_OFFERED,
157 		IF_DHCP_RESOLVED,
158 		IF_DHCP_FAILED,
159 	} state;
160 	int dhcpquerytype;		/* dhcp type sent */
161 	struct in_addr dhcpserver;
162 	int gotdhcpserver;
163 	uint16_t mtu;
164 };
165 
166 #define TAG_MAXLEN 1024
167 struct bootpc_tagcontext {
168 	char buf[TAG_MAXLEN + 1];
169 	int overload;
170 	int badopt;
171 	int badtag;
172 	int foundopt;
173 	int taglen;
174 };
175 
176 struct bootpc_globalcontext {
177 	STAILQ_HEAD(, bootpc_ifcontext) interfaces;
178 	u_int32_t xid;
179 	int any_root_overrides;
180 	int gotrootpath;
181 	int gotgw;
182 	int ifnum;
183 	int secs;
184 	int starttime;
185 	struct bootp_packet reply;
186 	int replylen;
187 	struct bootpc_ifcontext *setrootfs;
188 	struct bootpc_ifcontext *sethostname;
189 	struct bootpc_tagcontext tmptag;
190 	struct bootpc_tagcontext tag;
191 };
192 
193 #define IPPORT_BOOTPC 68
194 #define IPPORT_BOOTPS 67
195 
196 #define BOOTP_REQUEST 1
197 #define BOOTP_REPLY 2
198 
199 /* Common tags */
200 #define TAG_PAD		  0  /* Pad option, implicit length 1 */
201 #define TAG_SUBNETMASK	  1  /* RFC 950 subnet mask */
202 #define TAG_ROUTERS	  3  /* Routers (in order of preference) */
203 #define TAG_HOSTNAME	 12  /* Client host name */
204 #define TAG_ROOT	 17  /* Root path */
205 #define TAG_INTF_MTU	 26  /* Interface MTU Size (RFC2132) */
206 
207 /* DHCP specific tags */
208 #define TAG_OVERLOAD	 52  /* Option Overload */
209 #define TAG_MAXMSGSIZE   57  /* Maximum DHCP Message Size */
210 
211 #define TAG_END		255  /* End Option (i.e. no more options) */
212 
213 /* Overload values */
214 #define OVERLOAD_FILE     1
215 #define OVERLOAD_SNAME    2
216 
217 /* Site specific tags: */
218 #define TAG_ROOTOPTS	130
219 #define TAG_COOKIE	134	/* ascii info for userland, via sysctl */
220 
221 #define TAG_DHCP_MSGTYPE 53
222 #define TAG_DHCP_REQ_ADDR 50
223 #define TAG_DHCP_SERVERID 54
224 #define TAG_DHCP_LEASETIME 51
225 
226 #define TAG_VENDOR_INDENTIFIER 60
227 
228 #define DHCP_NOMSG    0
229 #define DHCP_DISCOVER 1
230 #define DHCP_OFFER    2
231 #define DHCP_REQUEST  3
232 #define DHCP_ACK      5
233 
234 /* NFS read/write block size */
235 #ifndef BOOTP_BLOCKSIZE
236 #define	BOOTP_BLOCKSIZE	8192
237 #endif
238 
239 static char bootp_cookie[128];
240 static struct socket *bootp_so;
241 SYSCTL_STRING(_kern, OID_AUTO, bootp_cookie, CTLFLAG_RD,
242 	bootp_cookie, 0, "Cookie (T134) supplied by bootp server");
243 
244 /* mountd RPC */
245 static int	md_mount(struct sockaddr_in *mdsin, char *path, u_char *fhp,
246 		    int *fhsizep, struct nfs_args *args, struct thread *td);
247 static int	setfs(struct sockaddr_in *addr, char *path, char *p,
248 		    const struct in_addr *siaddr);
249 static int	getdec(char **ptr);
250 static int	getip(char **ptr, struct in_addr *ip);
251 static void	mountopts(struct nfs_args *args, char *p);
252 static int	xdr_opaque_decode(struct mbuf **ptr, u_char *buf, int len);
253 static int	xdr_int_decode(struct mbuf **ptr, int *iptr);
254 static void	print_in_addr(struct in_addr addr);
255 static void	print_sin_addr(struct sockaddr_in *addr);
256 static void	clear_sinaddr(struct sockaddr_in *sin);
257 static void	allocifctx(struct bootpc_globalcontext *gctx);
258 static void	bootpc_compose_query(struct bootpc_ifcontext *ifctx,
259 		    struct thread *td);
260 static unsigned char *bootpc_tag(struct bootpc_tagcontext *tctx,
261 		    struct bootp_packet *bp, int len, int tag);
262 static void bootpc_tag_helper(struct bootpc_tagcontext *tctx,
263 		    unsigned char *start, int len, int tag);
264 
265 #ifdef BOOTP_DEBUG
266 void bootpboot_p_if(struct ifnet *ifp, struct ifaddr *ifa);
267 void bootpboot_p_iflist(void);
268 #endif
269 
270 static int	bootpc_call(struct bootpc_globalcontext *gctx,
271 		    struct thread *td);
272 
273 static void	bootpc_fakeup_interface(struct bootpc_ifcontext *ifctx,
274 		    struct thread *td);
275 
276 static void	bootpc_adjust_interface(struct bootpc_ifcontext *ifctx,
277 		    struct bootpc_globalcontext *gctx, struct thread *td);
278 
279 static void	bootpc_decode_reply(struct nfsv3_diskless *nd,
280 		    struct bootpc_ifcontext *ifctx,
281 		    struct bootpc_globalcontext *gctx);
282 
283 static int	bootpc_received(struct bootpc_globalcontext *gctx,
284 		    struct bootpc_ifcontext *ifctx);
285 
286 static __inline int bootpc_ifctx_isresolved(struct bootpc_ifcontext *ifctx);
287 static __inline int bootpc_ifctx_isunresolved(struct bootpc_ifcontext *ifctx);
288 static __inline int bootpc_ifctx_isfailed(struct bootpc_ifcontext *ifctx);
289 
290 /*
291  * In order to have multiple active interfaces with address 0.0.0.0
292  * and be able to send data to a selected interface, we first set
293  * mask to /8 on all interfaces, and temporarily set it to /0 when
294  * doing sosend().
295  */
296 
297 #ifdef BOOTP_DEBUG
298 void
299 bootpboot_p_if(struct ifnet *ifp, struct ifaddr *ifa)
300 {
301 
302 	printf("%s flags %x, addr ",
303 	       ifp->if_xname, ifp->if_flags);
304 	print_sin_addr((struct sockaddr_in *) ifa->ifa_addr);
305 	printf(", broadcast ");
306 	print_sin_addr((struct sockaddr_in *) ifa->ifa_dstaddr);
307 	printf(", netmask ");
308 	print_sin_addr((struct sockaddr_in *) ifa->ifa_netmask);
309 	printf("\n");
310 }
311 
312 void
313 bootpboot_p_iflist(void)
314 {
315 	struct ifnet *ifp;
316 	struct ifaddr *ifa;
317 
318 	printf("Interface list:\n");
319 	IFNET_RLOCK();
320 	for (ifp = CK_STAILQ_FIRST(&V_ifnet);
321 	     ifp != NULL;
322 	     ifp = CK_STAILQ_NEXT(ifp, if_link)) {
323 		for (ifa = CK_STAILQ_FIRST(&ifp->if_addrhead);
324 		     ifa != NULL;
325 		     ifa = CK_STAILQ_NEXT(ifa, ifa_link))
326 			if (ifa->ifa_addr->sa_family == AF_INET)
327 				bootpboot_p_if(ifp, ifa);
328 	}
329 	IFNET_RUNLOCK();
330 }
331 #endif /* defined(BOOTP_DEBUG) */
332 
333 static void
334 clear_sinaddr(struct sockaddr_in *sin)
335 {
336 
337 	bzero(sin, sizeof(*sin));
338 	sin->sin_len = sizeof(*sin);
339 	sin->sin_family = AF_INET;
340 	sin->sin_addr.s_addr = INADDR_ANY; /* XXX: htonl(INAADDR_ANY) ? */
341 	sin->sin_port = 0;
342 }
343 
344 static void
345 allocifctx(struct bootpc_globalcontext *gctx)
346 {
347 	struct bootpc_ifcontext *ifctx;
348 
349 	ifctx = malloc(sizeof(*ifctx), M_TEMP, M_WAITOK | M_ZERO);
350 	ifctx->xid = gctx->xid;
351 #ifdef BOOTP_NO_DHCP
352 	ifctx->state = IF_BOOTP_UNRESOLVED;
353 #else
354 	ifctx->state = IF_DHCP_UNRESOLVED;
355 #endif
356 	gctx->xid += 0x100;
357 	STAILQ_INSERT_TAIL(&gctx->interfaces, ifctx, next);
358 }
359 
360 static __inline int
361 bootpc_ifctx_isresolved(struct bootpc_ifcontext *ifctx)
362 {
363 
364 	if (ifctx->state == IF_BOOTP_RESOLVED ||
365 	    ifctx->state == IF_DHCP_RESOLVED)
366 		return 1;
367 	return 0;
368 }
369 
370 static __inline int
371 bootpc_ifctx_isunresolved(struct bootpc_ifcontext *ifctx)
372 {
373 
374 	if (ifctx->state == IF_BOOTP_UNRESOLVED ||
375 	    ifctx->state == IF_DHCP_UNRESOLVED)
376 		return 1;
377 	return 0;
378 }
379 
380 static __inline int
381 bootpc_ifctx_isfailed(struct bootpc_ifcontext *ifctx)
382 {
383 
384 	if (ifctx->state == IF_BOOTP_FAILED ||
385 	    ifctx->state == IF_DHCP_FAILED)
386 		return 1;
387 	return 0;
388 }
389 
390 static int
391 bootpc_received(struct bootpc_globalcontext *gctx,
392     struct bootpc_ifcontext *ifctx)
393 {
394 	unsigned char dhcpreplytype;
395 	char *p;
396 
397 	/*
398 	 * Need timeout for fallback to less
399 	 * desirable alternative.
400 	 */
401 
402 	/* This call used for the side effect (badopt flag) */
403 	(void) bootpc_tag(&gctx->tmptag, &gctx->reply,
404 			  gctx->replylen,
405 			  TAG_END);
406 
407 	/* If packet is invalid, ignore it */
408 	if (gctx->tmptag.badopt != 0)
409 		return 0;
410 
411 	p = bootpc_tag(&gctx->tmptag, &gctx->reply,
412 		       gctx->replylen, TAG_DHCP_MSGTYPE);
413 	if (p != NULL)
414 		dhcpreplytype = *p;
415 	else
416 		dhcpreplytype = DHCP_NOMSG;
417 
418 	switch (ifctx->dhcpquerytype) {
419 	case DHCP_DISCOVER:
420 		if (dhcpreplytype != DHCP_OFFER 	/* Normal DHCP offer */
421 #ifndef BOOTP_FORCE_DHCP
422 		    && dhcpreplytype != DHCP_NOMSG	/* Fallback to BOOTP */
423 #endif
424 			)
425 			return 0;
426 		break;
427 	case DHCP_REQUEST:
428 		if (dhcpreplytype != DHCP_ACK)
429 			return 0;
430 	case DHCP_NOMSG:
431 		break;
432 	}
433 
434 	/* Ignore packet unless it gives us a root tag we didn't have */
435 
436 	if ((ifctx->state == IF_BOOTP_RESOLVED ||
437 	     (ifctx->dhcpquerytype == DHCP_DISCOVER &&
438 	      (ifctx->state == IF_DHCP_OFFERED ||
439 	       ifctx->state == IF_DHCP_RESOLVED))) &&
440 	    (bootpc_tag(&gctx->tmptag, &ifctx->reply,
441 			ifctx->replylen,
442 			TAG_ROOT) != NULL ||
443 	     bootpc_tag(&gctx->tmptag, &gctx->reply,
444 			gctx->replylen,
445 			TAG_ROOT) == NULL))
446 		return 0;
447 
448 	bcopy(&gctx->reply, &ifctx->reply, gctx->replylen);
449 	ifctx->replylen = gctx->replylen;
450 
451 	/* XXX: Only reset if 'perfect' response */
452 	if (ifctx->state == IF_BOOTP_UNRESOLVED)
453 		ifctx->state = IF_BOOTP_RESOLVED;
454 	else if (ifctx->state == IF_DHCP_UNRESOLVED &&
455 		 ifctx->dhcpquerytype == DHCP_DISCOVER) {
456 		if (dhcpreplytype == DHCP_OFFER)
457 			ifctx->state = IF_DHCP_OFFERED;
458 		else
459 			ifctx->state = IF_BOOTP_RESOLVED;	/* Fallback */
460 	} else if (ifctx->state == IF_DHCP_OFFERED &&
461 		   ifctx->dhcpquerytype == DHCP_REQUEST)
462 		ifctx->state = IF_DHCP_RESOLVED;
463 
464 	if (ifctx->dhcpquerytype == DHCP_DISCOVER &&
465 	    ifctx->state != IF_BOOTP_RESOLVED) {
466 		p = bootpc_tag(&gctx->tmptag, &ifctx->reply,
467 			       ifctx->replylen, TAG_DHCP_SERVERID);
468 		if (p != NULL && gctx->tmptag.taglen == 4) {
469 			memcpy(&ifctx->dhcpserver, p, 4);
470 			ifctx->gotdhcpserver = 1;
471 		} else
472 			ifctx->gotdhcpserver = 0;
473 		return 1;
474 	}
475 
476 	ifctx->gotrootpath = (bootpc_tag(&gctx->tmptag, &ifctx->reply,
477 					 ifctx->replylen,
478 					 TAG_ROOT) != NULL);
479 	ifctx->gotgw = (bootpc_tag(&gctx->tmptag, &ifctx->reply,
480 				   ifctx->replylen,
481 				   TAG_ROUTERS) != NULL);
482 	ifctx->gotnetmask = (bootpc_tag(&gctx->tmptag, &ifctx->reply,
483 					ifctx->replylen,
484 					TAG_SUBNETMASK) != NULL);
485 	return 1;
486 }
487 
488 static int
489 bootpc_call(struct bootpc_globalcontext *gctx, struct thread *td)
490 {
491 	struct sockaddr_in *sin, dst;
492 	struct uio auio;
493 	struct sockopt sopt;
494 	struct iovec aio;
495 	int error, on, rcvflg, timo, len;
496 	time_t atimo;
497 	time_t rtimo;
498 	struct timeval tv;
499 	struct bootpc_ifcontext *ifctx;
500 	int outstanding;
501 	int gotrootpath;
502 	int retry;
503 	const char *s;
504 
505 	tv.tv_sec = 1;
506 	tv.tv_usec = 0;
507 	bzero(&sopt, sizeof(sopt));
508 	sopt.sopt_dir = SOPT_SET;
509 	sopt.sopt_level = SOL_SOCKET;
510 	sopt.sopt_name = SO_RCVTIMEO;
511 	sopt.sopt_val = &tv;
512 	sopt.sopt_valsize = sizeof tv;
513 
514 	error = sosetopt(bootp_so, &sopt);
515 	if (error != 0)
516 		goto out;
517 
518 	/*
519 	 * Enable broadcast.
520 	 */
521 	on = 1;
522 	sopt.sopt_name = SO_BROADCAST;
523 	sopt.sopt_val = &on;
524 	sopt.sopt_valsize = sizeof on;
525 
526 	error = sosetopt(bootp_so, &sopt);
527 	if (error != 0)
528 		goto out;
529 
530 	/*
531 	 * Disable routing.
532 	 */
533 
534 	on = 1;
535 	sopt.sopt_name = SO_DONTROUTE;
536 	sopt.sopt_val = &on;
537 	sopt.sopt_valsize = sizeof on;
538 
539 	error = sosetopt(bootp_so, &sopt);
540 	if (error != 0)
541 		goto out;
542 
543 	/*
544 	 * Bind the local endpoint to a bootp client port.
545 	 */
546 	sin = &dst;
547 	clear_sinaddr(sin);
548 	sin->sin_port = htons(IPPORT_BOOTPC);
549 	error = sobind(bootp_so, (struct sockaddr *)sin, td);
550 	if (error != 0) {
551 		printf("bind failed\n");
552 		goto out;
553 	}
554 
555 	/*
556 	 * Setup socket address for the server.
557 	 */
558 	sin = &dst;
559 	clear_sinaddr(sin);
560 	sin->sin_addr.s_addr = INADDR_BROADCAST;
561 	sin->sin_port = htons(IPPORT_BOOTPS);
562 
563 	/*
564 	 * Send it, repeatedly, until a reply is received,
565 	 * but delay each re-send by an increasing amount.
566 	 * If the delay hits the maximum, start complaining.
567 	 */
568 	timo = 0;
569 	rtimo = 0;
570 	for (;;) {
571 		outstanding = 0;
572 		gotrootpath = 0;
573 
574 		STAILQ_FOREACH(ifctx, &gctx->interfaces, next) {
575 			if (bootpc_ifctx_isresolved(ifctx) != 0 &&
576 			    bootpc_tag(&gctx->tmptag, &ifctx->reply,
577 				       ifctx->replylen,
578 				       TAG_ROOT) != NULL)
579 				gotrootpath = 1;
580 		}
581 
582 		STAILQ_FOREACH(ifctx, &gctx->interfaces, next) {
583 			struct in_aliasreq *ifra = &ifctx->iareq;
584 			sin = (struct sockaddr_in *)&ifra->ifra_mask;
585 
586 			ifctx->outstanding = 0;
587 			if (bootpc_ifctx_isresolved(ifctx)  != 0 &&
588 			    gotrootpath != 0) {
589 				continue;
590 			}
591 			if (bootpc_ifctx_isfailed(ifctx) != 0)
592 				continue;
593 
594 			outstanding++;
595 			ifctx->outstanding = 1;
596 
597 			/* Proceed to next step in DHCP negotiation */
598 			if ((ifctx->state == IF_DHCP_OFFERED &&
599 			     ifctx->dhcpquerytype != DHCP_REQUEST) ||
600 			    (ifctx->state == IF_DHCP_UNRESOLVED &&
601 			     ifctx->dhcpquerytype != DHCP_DISCOVER) ||
602 			    (ifctx->state == IF_BOOTP_UNRESOLVED &&
603 			     ifctx->dhcpquerytype != DHCP_NOMSG)) {
604 				ifctx->sentmsg = 0;
605 				bootpc_compose_query(ifctx, td);
606 			}
607 
608 			/* Send BOOTP request (or re-send). */
609 
610 			if (ifctx->sentmsg == 0) {
611 				switch(ifctx->dhcpquerytype) {
612 				case DHCP_DISCOVER:
613 					s = "DHCP Discover";
614 					break;
615 				case DHCP_REQUEST:
616 					s = "DHCP Request";
617 					break;
618 				case DHCP_NOMSG:
619 				default:
620 					s = "BOOTP Query";
621 					break;
622 				}
623 				printf("Sending %s packet from "
624 				       "interface %s (%*D)\n",
625 				       s,
626 				       ifctx->ireq.ifr_name,
627 				       ifctx->sdl->sdl_alen,
628 				       (unsigned char *) LLADDR(ifctx->sdl),
629 				       ":");
630 				ifctx->sentmsg = 1;
631 			}
632 
633 			aio.iov_base = (caddr_t) &ifctx->call;
634 			aio.iov_len = sizeof(ifctx->call);
635 
636 			auio.uio_iov = &aio;
637 			auio.uio_iovcnt = 1;
638 			auio.uio_segflg = UIO_SYSSPACE;
639 			auio.uio_rw = UIO_WRITE;
640 			auio.uio_offset = 0;
641 			auio.uio_resid = sizeof(ifctx->call);
642 			auio.uio_td = td;
643 
644 			/* Set netmask to 0.0.0.0 */
645 			clear_sinaddr(sin);
646 			error = ifioctl(bootp_so, SIOCAIFADDR, (caddr_t)ifra,
647 			    td);
648 			if (error != 0)
649 				panic("%s: SIOCAIFADDR, error=%d", __func__,
650 				    error);
651 
652 			error = sosend(bootp_so, (struct sockaddr *) &dst,
653 				       &auio, NULL, NULL, 0, td);
654 			if (error != 0)
655 				printf("%s: sosend: %d state %08x\n", __func__,
656 				    error, (int )bootp_so->so_state);
657 
658 			/* Set netmask to 255.0.0.0 */
659 			sin->sin_addr.s_addr = htonl(0xff000000);
660 			error = ifioctl(bootp_so, SIOCAIFADDR, (caddr_t)ifra,
661 			    td);
662 			if (error != 0)
663 				panic("%s: SIOCAIFADDR, error=%d", __func__,
664 				    error);
665 		}
666 
667 		if (outstanding == 0 &&
668 		    (rtimo == 0 || time_second >= rtimo)) {
669 			error = 0;
670 			goto out;
671 		}
672 
673 		/* Determine new timeout. */
674 		if (timo < MAX_RESEND_DELAY)
675 			timo++;
676 		else {
677 			printf("DHCP/BOOTP timeout for server ");
678 			print_sin_addr(&dst);
679 			printf("\n");
680 		}
681 
682 		/*
683 		 * Wait for up to timo seconds for a reply.
684 		 * The socket receive timeout was set to 1 second.
685 		 */
686 		atimo = timo + time_second;
687 		while (time_second < atimo) {
688 			aio.iov_base = (caddr_t) &gctx->reply;
689 			aio.iov_len = sizeof(gctx->reply);
690 
691 			auio.uio_iov = &aio;
692 			auio.uio_iovcnt = 1;
693 			auio.uio_segflg = UIO_SYSSPACE;
694 			auio.uio_rw = UIO_READ;
695 			auio.uio_offset = 0;
696 			auio.uio_resid = sizeof(gctx->reply);
697 			auio.uio_td = td;
698 
699 			rcvflg = 0;
700 			error = soreceive(bootp_so, NULL, &auio,
701 					  NULL, NULL, &rcvflg);
702 			gctx->secs = time_second - gctx->starttime;
703 			STAILQ_FOREACH(ifctx, &gctx->interfaces, next) {
704 				if (bootpc_ifctx_isresolved(ifctx) != 0 ||
705 				    bootpc_ifctx_isfailed(ifctx) != 0)
706 					continue;
707 
708 				ifctx->call.secs = htons(gctx->secs);
709 			}
710 			if (error == EWOULDBLOCK)
711 				continue;
712 			if (error != 0)
713 				goto out;
714 			len = sizeof(gctx->reply) - auio.uio_resid;
715 
716 			/* Do we have the required number of bytes ? */
717 			if (len < BOOTP_MIN_LEN)
718 				continue;
719 			gctx->replylen = len;
720 
721 			/* Is it a reply? */
722 			if (gctx->reply.op != BOOTP_REPLY)
723 				continue;
724 
725 			/* Is this an answer to our query */
726 			STAILQ_FOREACH(ifctx, &gctx->interfaces, next) {
727 				if (gctx->reply.xid != ifctx->call.xid)
728 					continue;
729 
730 				/* Same HW address size ? */
731 				if (gctx->reply.hlen != ifctx->call.hlen)
732 					continue;
733 
734 				/* Correct HW address ? */
735 				if (bcmp(gctx->reply.chaddr,
736 					 ifctx->call.chaddr,
737 					 ifctx->call.hlen) != 0)
738 					continue;
739 
740 				break;
741 			}
742 
743 			if (ifctx != NULL) {
744 				s =  bootpc_tag(&gctx->tmptag,
745 						&gctx->reply,
746 						gctx->replylen,
747 						TAG_DHCP_MSGTYPE);
748 				if (s != NULL) {
749 					switch (*s) {
750 					case DHCP_OFFER:
751 						s = "DHCP Offer";
752 						break;
753 					case DHCP_ACK:
754 						s = "DHCP Ack";
755 						break;
756 					default:
757 						s = "DHCP (unexpected)";
758 						break;
759 					}
760 				} else
761 					s = "BOOTP Reply";
762 
763 				printf("Received %s packet"
764 				       " on %s from ",
765 				       s,
766 				       ifctx->ireq.ifr_name);
767 				print_in_addr(gctx->reply.siaddr);
768 				if (gctx->reply.giaddr.s_addr !=
769 				    htonl(INADDR_ANY)) {
770 					printf(" via ");
771 					print_in_addr(gctx->reply.giaddr);
772 				}
773 				if (bootpc_received(gctx, ifctx) != 0) {
774 					printf(" (accepted)");
775 					if (ifctx->outstanding) {
776 						ifctx->outstanding = 0;
777 						outstanding--;
778 					}
779 					/* Network settle delay */
780 					if (outstanding == 0)
781 						atimo = time_second +
782 							BOOTP_SETTLE_DELAY;
783 				} else
784 					printf(" (ignored)");
785 				if (ifctx->gotrootpath ||
786 				    gctx->any_root_overrides) {
787 					gotrootpath = 1;
788 					rtimo = time_second +
789 						BOOTP_SETTLE_DELAY;
790 					if (ifctx->gotrootpath)
791 						printf(" (got root path)");
792 				}
793 				printf("\n");
794 			}
795 		} /* while secs */
796 #ifdef BOOTP_TIMEOUT
797 		if (gctx->secs > BOOTP_TIMEOUT && BOOTP_TIMEOUT > 0)
798 			break;
799 #endif
800 		/* Force a retry if halfway in DHCP negotiation */
801 		retry = 0;
802 		STAILQ_FOREACH(ifctx, &gctx->interfaces, next)
803 			if (ifctx->state == IF_DHCP_OFFERED) {
804 				if (ifctx->dhcpquerytype == DHCP_DISCOVER)
805 					retry = 1;
806 				else
807 					ifctx->state = IF_DHCP_UNRESOLVED;
808 			}
809 
810 		if (retry != 0)
811 			continue;
812 
813 		if (gotrootpath != 0) {
814 			gctx->gotrootpath = gotrootpath;
815 			if (rtimo != 0 && time_second >= rtimo)
816 				break;
817 		}
818 	} /* forever send/receive */
819 
820 	/*
821 	 * XXX: These are errors of varying seriousness being silently
822 	 * ignored
823 	 */
824 
825 	STAILQ_FOREACH(ifctx, &gctx->interfaces, next)
826 		if (bootpc_ifctx_isresolved(ifctx) == 0) {
827 			printf("%s timeout for interface %s\n",
828 			       ifctx->dhcpquerytype != DHCP_NOMSG ?
829 			       "DHCP" : "BOOTP",
830 			       ifctx->ireq.ifr_name);
831 		}
832 
833 	if (gctx->gotrootpath != 0) {
834 #if 0
835 		printf("Got a root path, ignoring remaining timeout\n");
836 #endif
837 		error = 0;
838 		goto out;
839 	}
840 #ifndef BOOTP_NFSROOT
841 	STAILQ_FOREACH(ifctx, &gctx->interfaces, next)
842 		if (bootpc_ifctx_isresolved(ifctx) != 0) {
843 			error = 0;
844 			goto out;
845 		}
846 #endif
847 	error = ETIMEDOUT;
848 
849 out:
850 	return (error);
851 }
852 
853 static void
854 bootpc_fakeup_interface(struct bootpc_ifcontext *ifctx, struct thread *td)
855 {
856 	struct ifreq *ifr;
857 	struct in_aliasreq *ifra;
858 	struct sockaddr_in *sin;
859 	int error;
860 
861 	ifr = &ifctx->ireq;
862 	ifra = &ifctx->iareq;
863 
864 	/*
865 	 * Bring up the interface.
866 	 *
867 	 * Get the old interface flags and or IFF_UP into them; if
868 	 * IFF_UP set blindly, interface selection can be clobbered.
869 	 */
870 	error = ifioctl(bootp_so, SIOCGIFFLAGS, (caddr_t)ifr, td);
871 	if (error != 0)
872 		panic("%s: SIOCGIFFLAGS, error=%d", __func__, error);
873 	ifr->ifr_flags |= IFF_UP;
874 	error = ifioctl(bootp_so, SIOCSIFFLAGS, (caddr_t)ifr, td);
875 	if (error != 0)
876 		panic("%s: SIOCSIFFLAGS, error=%d", __func__, error);
877 
878 	/*
879 	 * Do enough of ifconfig(8) so that the chosen interface
880 	 * can talk to the servers. Set address to 0.0.0.0/8 and
881 	 * broadcast address to local broadcast.
882 	 */
883 	sin = (struct sockaddr_in *)&ifra->ifra_addr;
884 	clear_sinaddr(sin);
885 	sin = (struct sockaddr_in *)&ifra->ifra_mask;
886 	clear_sinaddr(sin);
887 	sin->sin_addr.s_addr = htonl(0xff000000);
888 	sin = (struct sockaddr_in *)&ifra->ifra_broadaddr;
889 	clear_sinaddr(sin);
890 	sin->sin_addr.s_addr = htonl(INADDR_BROADCAST);
891 	error = ifioctl(bootp_so, SIOCAIFADDR, (caddr_t)ifra, td);
892 	if (error != 0)
893 		panic("%s: SIOCAIFADDR, error=%d", __func__, error);
894 }
895 
896 static void
897 bootpc_shutdown_interface(struct bootpc_ifcontext *ifctx, struct thread *td)
898 {
899 	struct ifreq *ifr;
900 	struct sockaddr_in *sin;
901 	int error;
902 
903 	ifr = &ifctx->ireq;
904 
905 	printf("Shutdown interface %s\n", ifctx->ireq.ifr_name);
906 	error = ifioctl(bootp_so, SIOCGIFFLAGS, (caddr_t)ifr, td);
907 	if (error != 0)
908 		panic("%s: SIOCGIFFLAGS, error=%d", __func__, error);
909 	ifr->ifr_flags &= ~IFF_UP;
910 	error = ifioctl(bootp_so, SIOCSIFFLAGS, (caddr_t)ifr, td);
911 	if (error != 0)
912 		panic("%s: SIOCSIFFLAGS, error=%d", __func__, error);
913 
914 	sin = (struct sockaddr_in *) &ifr->ifr_addr;
915 	clear_sinaddr(sin);
916 	error = ifioctl(bootp_so, SIOCDIFADDR, (caddr_t) ifr, td);
917 	if (error != 0)
918 		panic("%s: SIOCDIFADDR, error=%d", __func__, error);
919 }
920 
921 static void
922 bootpc_adjust_interface(struct bootpc_ifcontext *ifctx,
923     struct bootpc_globalcontext *gctx, struct thread *td)
924 {
925 	int error;
926 	struct sockaddr_in *sin;
927 	struct ifreq *ifr;
928 	struct in_aliasreq *ifra;
929 	struct sockaddr_in *myaddr;
930 	struct sockaddr_in *netmask;
931 
932 	ifr = &ifctx->ireq;
933 	ifra = &ifctx->iareq;
934 	myaddr = &ifctx->myaddr;
935 	netmask = &ifctx->netmask;
936 
937 	if (bootpc_ifctx_isresolved(ifctx) == 0) {
938 		/* Shutdown interfaces where BOOTP failed */
939 		bootpc_shutdown_interface(ifctx, td);
940 		return;
941 	}
942 
943 	printf("Adjusted interface %s", ifctx->ireq.ifr_name);
944 
945 	/* Do BOOTP interface options */
946 	if (ifctx->mtu != 0) {
947 		printf(" (MTU=%d%s)", ifctx->mtu,
948 		    (ifctx->mtu > 1514) ? "/JUMBO" : "");
949 		ifr->ifr_mtu = ifctx->mtu;
950 		error = ifioctl(bootp_so, SIOCSIFMTU, (caddr_t) ifr, td);
951 		if (error != 0)
952 			panic("%s: SIOCSIFMTU, error=%d", __func__, error);
953 	}
954 	printf("\n");
955 
956 	/*
957 	 * Do enough of ifconfig(8) so that the chosen interface
958 	 * can talk to the servers.  (just set the address)
959 	 */
960 	sin = (struct sockaddr_in *) &ifr->ifr_addr;
961 	clear_sinaddr(sin);
962 	error = ifioctl(bootp_so, SIOCDIFADDR, (caddr_t) ifr, td);
963 	if (error != 0)
964 		panic("%s: SIOCDIFADDR, error=%d", __func__, error);
965 
966 	bcopy(myaddr, &ifra->ifra_addr, sizeof(*myaddr));
967 	bcopy(netmask, &ifra->ifra_mask, sizeof(*netmask));
968 	clear_sinaddr(&ifra->ifra_broadaddr);
969 	ifra->ifra_broadaddr.sin_addr.s_addr = myaddr->sin_addr.s_addr |
970 	    ~netmask->sin_addr.s_addr;
971 
972 	error = ifioctl(bootp_so, SIOCAIFADDR, (caddr_t)ifra, td);
973 	if (error != 0)
974 		panic("%s: SIOCAIFADDR, error=%d", __func__, error);
975 }
976 
977 static void
978 bootpc_add_default_route(struct bootpc_ifcontext *ifctx)
979 {
980 	int error;
981 	struct sockaddr_in defdst;
982 	struct sockaddr_in defmask;
983 	struct rt_addrinfo info;
984 	struct rib_cmd_info rc;
985 
986 	if (ifctx->gw.sin_addr.s_addr == htonl(INADDR_ANY))
987 		return;
988 
989 	clear_sinaddr(&defdst);
990 	clear_sinaddr(&defmask);
991 
992 	bzero((caddr_t)&info, sizeof(info));
993 	info.rti_flags = RTF_UP | RTF_GATEWAY | RTF_STATIC;
994 	info.rti_info[RTAX_DST] = (struct sockaddr *)&defdst;
995 	info.rti_info[RTAX_NETMASK] = (struct sockaddr *)&defmask;
996 	info.rti_info[RTAX_GATEWAY] = (struct sockaddr *)&ifctx->gw;
997 
998 	error = rib_action(RT_DEFAULT_FIB, RTM_ADD, &info, &rc);
999 
1000 	if (error != 0) {
1001 		printf("%s: RTM_ADD, error=%d\n", __func__, error);
1002 	}
1003 }
1004 
1005 static void
1006 bootpc_remove_default_route(struct bootpc_ifcontext *ifctx)
1007 {
1008 	int error;
1009 	struct sockaddr_in defdst;
1010 	struct sockaddr_in defmask;
1011 	struct rt_addrinfo info;
1012 	struct rib_cmd_info rc;
1013 
1014 	if (ifctx->gw.sin_addr.s_addr == htonl(INADDR_ANY))
1015 		return;
1016 
1017 	clear_sinaddr(&defdst);
1018 	clear_sinaddr(&defmask);
1019 
1020 	bzero((caddr_t)&info, sizeof(info));
1021 	info.rti_flags = RTF_UP | RTF_GATEWAY | RTF_STATIC;
1022 	info.rti_info[RTAX_DST] = (struct sockaddr *)&defdst;
1023 	info.rti_info[RTAX_NETMASK] = (struct sockaddr *)&defmask;
1024 	info.rti_info[RTAX_GATEWAY] = (struct sockaddr *)&ifctx->gw;
1025 
1026 	error = rib_action(RT_DEFAULT_FIB, RTM_DELETE, &info, &rc);
1027 	if (error != 0) {
1028 		printf("%s: RTM_DELETE, error=%d\n", __func__, error);
1029 	}
1030 }
1031 
1032 static int
1033 setfs(struct sockaddr_in *addr, char *path, char *p,
1034     const struct in_addr *siaddr)
1035 {
1036 
1037 	if (getip(&p, &addr->sin_addr) == 0) {
1038 		if (siaddr != NULL && *p == '/')
1039 			bcopy(siaddr, &addr->sin_addr, sizeof(struct in_addr));
1040 		else
1041 			return 0;
1042 	} else {
1043 		if (*p != ':')
1044 			return 0;
1045 		p++;
1046 	}
1047 
1048 	addr->sin_len = sizeof(struct sockaddr_in);
1049 	addr->sin_family = AF_INET;
1050 
1051 	strlcpy(path, p, MNAMELEN);
1052 	return 1;
1053 }
1054 
1055 static int
1056 getip(char **ptr, struct in_addr *addr)
1057 {
1058 	char *p;
1059 	unsigned int ip;
1060 	int val;
1061 
1062 	p = *ptr;
1063 	ip = 0;
1064 	if (((val = getdec(&p)) < 0) || (val > 255))
1065 		return 0;
1066 	ip = val << 24;
1067 	if (*p != '.')
1068 		return 0;
1069 	p++;
1070 	if (((val = getdec(&p)) < 0) || (val > 255))
1071 		return 0;
1072 	ip |= (val << 16);
1073 	if (*p != '.')
1074 		return 0;
1075 	p++;
1076 	if (((val = getdec(&p)) < 0) || (val > 255))
1077 		return 0;
1078 	ip |= (val << 8);
1079 	if (*p != '.')
1080 		return 0;
1081 	p++;
1082 	if (((val = getdec(&p)) < 0) || (val > 255))
1083 		return 0;
1084 	ip |= val;
1085 
1086 	addr->s_addr = htonl(ip);
1087 	*ptr = p;
1088 	return 1;
1089 }
1090 
1091 static int
1092 getdec(char **ptr)
1093 {
1094 	char *p;
1095 	int ret;
1096 
1097 	p = *ptr;
1098 	ret = 0;
1099 	if ((*p < '0') || (*p > '9'))
1100 		return -1;
1101 	while ((*p >= '0') && (*p <= '9')) {
1102 		ret = ret * 10 + (*p - '0');
1103 		p++;
1104 	}
1105 	*ptr = p;
1106 	return ret;
1107 }
1108 
1109 static void
1110 mountopts(struct nfs_args *args, char *p)
1111 {
1112 	args->version = NFS_ARGSVERSION;
1113 	args->rsize = BOOTP_BLOCKSIZE;
1114 	args->wsize = BOOTP_BLOCKSIZE;
1115 	args->flags = NFSMNT_RSIZE | NFSMNT_WSIZE | NFSMNT_RESVPORT;
1116 	args->sotype = SOCK_DGRAM;
1117 	if (p != NULL)
1118 		nfs_parse_options(p, args);
1119 }
1120 
1121 static int
1122 xdr_opaque_decode(struct mbuf **mptr, u_char *buf, int len)
1123 {
1124 	struct mbuf *m;
1125 	int alignedlen;
1126 
1127 	m = *mptr;
1128 	alignedlen = ( len + 3 ) & ~3;
1129 
1130 	if (m->m_len < alignedlen) {
1131 		m = m_pullup(m, alignedlen);
1132 		if (m == NULL) {
1133 			*mptr = NULL;
1134 			return EBADRPC;
1135 		}
1136 	}
1137 	bcopy(mtod(m, u_char *), buf, len);
1138 	m_adj(m, alignedlen);
1139 	*mptr = m;
1140 	return 0;
1141 }
1142 
1143 static int
1144 xdr_int_decode(struct mbuf **mptr, int *iptr)
1145 {
1146 	u_int32_t i;
1147 
1148 	if (xdr_opaque_decode(mptr, (u_char *) &i, sizeof(u_int32_t)) != 0)
1149 		return EBADRPC;
1150 	*iptr = fxdr_unsigned(u_int32_t, i);
1151 	return 0;
1152 }
1153 
1154 static void
1155 print_sin_addr(struct sockaddr_in *sin)
1156 {
1157 
1158 	print_in_addr(sin->sin_addr);
1159 }
1160 
1161 static void
1162 print_in_addr(struct in_addr addr)
1163 {
1164 	unsigned int ip;
1165 
1166 	ip = ntohl(addr.s_addr);
1167 	printf("%d.%d.%d.%d",
1168 	       ip >> 24, (ip >> 16) & 255, (ip >> 8) & 255, ip & 255);
1169 }
1170 
1171 static void
1172 bootpc_compose_query(struct bootpc_ifcontext *ifctx, struct thread *td)
1173 {
1174 	unsigned char *vendp;
1175 	unsigned char vendor_client[64];
1176 	uint32_t leasetime;
1177 	uint8_t vendor_client_len;
1178 
1179 	ifctx->gotrootpath = 0;
1180 
1181 	bzero((caddr_t) &ifctx->call, sizeof(ifctx->call));
1182 
1183 	/* bootpc part */
1184 	ifctx->call.op = BOOTP_REQUEST; 	/* BOOTREQUEST */
1185 	ifctx->call.htype = 1;			/* 10mb ethernet */
1186 	ifctx->call.hlen = ifctx->sdl->sdl_alen;/* Hardware address length */
1187 	ifctx->call.hops = 0;
1188 	if (bootpc_ifctx_isunresolved(ifctx) != 0)
1189 		ifctx->xid++;
1190 	ifctx->call.xid = txdr_unsigned(ifctx->xid);
1191 	bcopy(LLADDR(ifctx->sdl), &ifctx->call.chaddr, ifctx->sdl->sdl_alen);
1192 
1193 	vendp = ifctx->call.vend;
1194 	*vendp++ = 99;		/* RFC1048 cookie */
1195 	*vendp++ = 130;
1196 	*vendp++ = 83;
1197 	*vendp++ = 99;
1198 	*vendp++ = TAG_MAXMSGSIZE;
1199 	*vendp++ = 2;
1200 	*vendp++ = (sizeof(struct bootp_packet) >> 8) & 255;
1201 	*vendp++ = sizeof(struct bootp_packet) & 255;
1202 
1203 	snprintf(vendor_client, sizeof(vendor_client), "%s:%s:%s",
1204 		ostype, MACHINE, osrelease);
1205 	vendor_client_len = strlen(vendor_client);
1206 	*vendp++ = TAG_VENDOR_INDENTIFIER;
1207 	*vendp++ = vendor_client_len;
1208 	memcpy(vendp, vendor_client, vendor_client_len);
1209 	vendp += vendor_client_len;
1210 	ifctx->dhcpquerytype = DHCP_NOMSG;
1211 	switch (ifctx->state) {
1212 	case IF_DHCP_UNRESOLVED:
1213 		*vendp++ = TAG_DHCP_MSGTYPE;
1214 		*vendp++ = 1;
1215 		*vendp++ = DHCP_DISCOVER;
1216 		ifctx->dhcpquerytype = DHCP_DISCOVER;
1217 		ifctx->gotdhcpserver = 0;
1218 		break;
1219 	case IF_DHCP_OFFERED:
1220 		*vendp++ = TAG_DHCP_MSGTYPE;
1221 		*vendp++ = 1;
1222 		*vendp++ = DHCP_REQUEST;
1223 		ifctx->dhcpquerytype = DHCP_REQUEST;
1224 		*vendp++ = TAG_DHCP_REQ_ADDR;
1225 		*vendp++ = 4;
1226 		memcpy(vendp, &ifctx->reply.yiaddr, 4);
1227 		vendp += 4;
1228 		if (ifctx->gotdhcpserver != 0) {
1229 			*vendp++ = TAG_DHCP_SERVERID;
1230 			*vendp++ = 4;
1231 			memcpy(vendp, &ifctx->dhcpserver, 4);
1232 			vendp += 4;
1233 		}
1234 		*vendp++ = TAG_DHCP_LEASETIME;
1235 		*vendp++ = 4;
1236 		leasetime = htonl(300);
1237 		memcpy(vendp, &leasetime, 4);
1238 		vendp += 4;
1239 		break;
1240 	default:
1241 		break;
1242 	}
1243 	*vendp = TAG_END;
1244 
1245 	ifctx->call.secs = 0;
1246 	ifctx->call.flags = htons(0x8000); /* We need a broadcast answer */
1247 }
1248 
1249 static int
1250 bootpc_hascookie(struct bootp_packet *bp)
1251 {
1252 
1253 	return (bp->vend[0] == 99 && bp->vend[1] == 130 &&
1254 		bp->vend[2] == 83 && bp->vend[3] == 99);
1255 }
1256 
1257 static void
1258 bootpc_tag_helper(struct bootpc_tagcontext *tctx,
1259     unsigned char *start, int len, int tag)
1260 {
1261 	unsigned char *j;
1262 	unsigned char *ej;
1263 	unsigned char code;
1264 
1265 	if (tctx->badtag != 0 || tctx->badopt != 0)
1266 		return;
1267 
1268 	j = start;
1269 	ej = j + len;
1270 
1271 	while (j < ej) {
1272 		code = *j++;
1273 		if (code == TAG_PAD)
1274 			continue;
1275 		if (code == TAG_END)
1276 			return;
1277 		if (j >= ej || j + *j + 1 > ej) {
1278 			tctx->badopt = 1;
1279 			return;
1280 		}
1281 		len = *j++;
1282 		if (code == tag) {
1283 			if (tctx->taglen + len > TAG_MAXLEN) {
1284 				tctx->badtag = 1;
1285 				return;
1286 			}
1287 			tctx->foundopt = 1;
1288 			if (len > 0)
1289 				memcpy(tctx->buf + tctx->taglen,
1290 				       j, len);
1291 			tctx->taglen += len;
1292 		}
1293 		if (code == TAG_OVERLOAD)
1294 			tctx->overload = *j;
1295 
1296 		j += len;
1297 	}
1298 }
1299 
1300 static unsigned char *
1301 bootpc_tag(struct bootpc_tagcontext *tctx,
1302     struct bootp_packet *bp, int len, int tag)
1303 {
1304 	tctx->overload = 0;
1305 	tctx->badopt = 0;
1306 	tctx->badtag = 0;
1307 	tctx->foundopt = 0;
1308 	tctx->taglen = 0;
1309 
1310 	if (bootpc_hascookie(bp) == 0)
1311 		return NULL;
1312 
1313 	bootpc_tag_helper(tctx, &bp->vend[4],
1314 			  (unsigned char *) bp + len - &bp->vend[4], tag);
1315 
1316 	if ((tctx->overload & OVERLOAD_FILE) != 0)
1317 		bootpc_tag_helper(tctx,
1318 				  (unsigned char *) bp->file,
1319 				  sizeof(bp->file),
1320 				  tag);
1321 	if ((tctx->overload & OVERLOAD_SNAME) != 0)
1322 		bootpc_tag_helper(tctx,
1323 				  (unsigned char *) bp->sname,
1324 				  sizeof(bp->sname),
1325 				  tag);
1326 
1327 	if (tctx->badopt != 0 || tctx->badtag != 0 || tctx->foundopt == 0)
1328 		return NULL;
1329 	tctx->buf[tctx->taglen] = '\0';
1330 	return tctx->buf;
1331 }
1332 
1333 static void
1334 bootpc_decode_reply(struct nfsv3_diskless *nd, struct bootpc_ifcontext *ifctx,
1335     struct bootpc_globalcontext *gctx)
1336 {
1337 	char *p, *s;
1338 
1339 	ifctx->gotgw = 0;
1340 	ifctx->gotnetmask = 0;
1341 
1342 	clear_sinaddr(&ifctx->myaddr);
1343 	clear_sinaddr(&ifctx->netmask);
1344 	clear_sinaddr(&ifctx->gw);
1345 
1346 	ifctx->myaddr.sin_addr = ifctx->reply.yiaddr;
1347 
1348 	printf("%s at ", ifctx->ireq.ifr_name);
1349 	print_sin_addr(&ifctx->myaddr);
1350 	printf(" server ");
1351 	print_in_addr(ifctx->reply.siaddr);
1352 
1353 	ifctx->gw.sin_addr = ifctx->reply.giaddr;
1354 	if (ifctx->reply.giaddr.s_addr != htonl(INADDR_ANY)) {
1355 		printf(" via gateway ");
1356 		print_in_addr(ifctx->reply.giaddr);
1357 	}
1358 
1359 	/* This call used for the side effect (overload flag) */
1360 	(void) bootpc_tag(&gctx->tmptag,
1361 			  &ifctx->reply, ifctx->replylen, TAG_END);
1362 
1363 	if ((gctx->tmptag.overload & OVERLOAD_SNAME) == 0)
1364 		if (ifctx->reply.sname[0] != '\0')
1365 			printf(" server name %s", ifctx->reply.sname);
1366 	if ((gctx->tmptag.overload & OVERLOAD_FILE) == 0)
1367 		if (ifctx->reply.file[0] != '\0')
1368 			printf(" boot file %s", ifctx->reply.file);
1369 
1370 	printf("\n");
1371 
1372 	p = bootpc_tag(&gctx->tag, &ifctx->reply, ifctx->replylen,
1373 		       TAG_SUBNETMASK);
1374 	if (p != NULL) {
1375 		if (gctx->tag.taglen != 4)
1376 			panic("bootpc: subnet mask len is %d",
1377 			      gctx->tag.taglen);
1378 		bcopy(p, &ifctx->netmask.sin_addr, 4);
1379 		ifctx->gotnetmask = 1;
1380 		printf("subnet mask ");
1381 		print_sin_addr(&ifctx->netmask);
1382 		printf(" ");
1383 	}
1384 
1385 	p = bootpc_tag(&gctx->tag, &ifctx->reply, ifctx->replylen,
1386 		       TAG_ROUTERS);
1387 	if (p != NULL) {
1388 		/* Routers */
1389 		if (gctx->tag.taglen % 4)
1390 			panic("bootpc: Router Len is %d", gctx->tag.taglen);
1391 		if (gctx->tag.taglen > 0) {
1392 			bcopy(p, &ifctx->gw.sin_addr, 4);
1393 			printf("router ");
1394 			print_sin_addr(&ifctx->gw);
1395 			printf(" ");
1396 			ifctx->gotgw = 1;
1397 			gctx->gotgw = 1;
1398 		}
1399 	}
1400 
1401 	/*
1402 	 * Choose a root filesystem.  If a value is forced in the environment
1403 	 * and it contains "nfs:", use it unconditionally.  Otherwise, if the
1404 	 * kernel is compiled with the ROOTDEVNAME option, then use it if:
1405 	 *  - The server doesn't provide a pathname.
1406 	 *  - The boothowto flags include RB_DFLTROOT (user said to override
1407 	 *    the server value).
1408 	 */
1409 	p = NULL;
1410 	if ((s = kern_getenv("vfs.root.mountfrom")) != NULL) {
1411 		if ((p = strstr(s, "nfs:")) != NULL)
1412 			p = strdup(p + 4, M_TEMP);
1413 		freeenv(s);
1414 	}
1415 	if (p == NULL) {
1416 		p = bootpc_tag(&gctx->tag, &ifctx->reply, ifctx->replylen,
1417 		       TAG_ROOT);
1418 		if (p != NULL)
1419 			ifctx->gotrootpath = 1;
1420 	}
1421 #ifdef ROOTDEVNAME
1422 	if ((p == NULL || (boothowto & RB_DFLTROOT) != 0) &&
1423 	    (p = strstr(ROOTDEVNAME, "nfs:")) != NULL) {
1424 		p += 4;
1425 	}
1426 #endif
1427 	if (p != NULL) {
1428 		if (gctx->setrootfs != NULL) {
1429 			printf("rootfs %s (ignored) ", p);
1430 		} else 	if (setfs(&nd->root_saddr,
1431 				  nd->root_hostnam, p, &ifctx->reply.siaddr)) {
1432 			if (*p == '/') {
1433 				printf("root_server ");
1434 				print_sin_addr(&nd->root_saddr);
1435 				printf(" ");
1436 			}
1437 			printf("rootfs %s ", p);
1438 			gctx->gotrootpath = 1;
1439 			gctx->setrootfs = ifctx;
1440 
1441 			p = bootpc_tag(&gctx->tag, &ifctx->reply,
1442 				       ifctx->replylen,
1443 				       TAG_ROOTOPTS);
1444 			if (p != NULL) {
1445 				mountopts(&nd->root_args, p);
1446 				printf("rootopts %s ", p);
1447 			}
1448 		} else
1449 			panic("Failed to set rootfs to %s", p);
1450 	}
1451 
1452 	p = bootpc_tag(&gctx->tag, &ifctx->reply, ifctx->replylen,
1453 		       TAG_HOSTNAME);
1454 	if (p != NULL) {
1455 		if (gctx->tag.taglen >= MAXHOSTNAMELEN)
1456 			panic("bootpc: hostname >= %d bytes",
1457 			      MAXHOSTNAMELEN);
1458 		if (gctx->sethostname != NULL) {
1459 			printf("hostname %s (ignored) ", p);
1460 		} else {
1461 			strcpy(nd->my_hostnam, p);
1462 			mtx_lock(&prison0.pr_mtx);
1463 			strcpy(prison0.pr_hostname, p);
1464 			mtx_unlock(&prison0.pr_mtx);
1465 			printf("hostname %s ", p);
1466 			gctx->sethostname = ifctx;
1467 		}
1468 	}
1469 	p = bootpc_tag(&gctx->tag, &ifctx->reply, ifctx->replylen,
1470 			TAG_COOKIE);
1471 	if (p != NULL) {        /* store in a sysctl variable */
1472 		int i, l = sizeof(bootp_cookie) - 1;
1473 		for (i = 0; i < l && p[i] != '\0'; i++)
1474 			bootp_cookie[i] = p[i];
1475 		p[i] = '\0';
1476 	}
1477 
1478 	p = bootpc_tag(&gctx->tag, &ifctx->reply, ifctx->replylen,
1479 		       TAG_INTF_MTU);
1480 	if (p != NULL) {
1481 		ifctx->mtu = be16dec(p);
1482 	}
1483 
1484 	printf("\n");
1485 
1486 	if (ifctx->gotnetmask == 0) {
1487 		/*
1488 		 * If there is no netmask, use historical default,
1489 		 * but we really need the right mask from the server.
1490 		 */
1491 		printf("%s: no netmask received!\n", ifctx->ireq.ifr_name);
1492 		if (IN_CLASSA(ntohl(ifctx->myaddr.sin_addr.s_addr)))
1493 			ifctx->netmask.sin_addr.s_addr = htonl(IN_CLASSA_NET);
1494 		else if (IN_CLASSB(ntohl(ifctx->myaddr.sin_addr.s_addr)))
1495 			ifctx->netmask.sin_addr.s_addr = htonl(IN_CLASSB_NET);
1496 		else
1497 			ifctx->netmask.sin_addr.s_addr = htonl(IN_CLASSC_NET);
1498 	}
1499 }
1500 
1501 void
1502 bootpc_init(void)
1503 {
1504 	struct bootpc_ifcontext *ifctx = NULL;	/* Interface BOOTP contexts */
1505 	struct bootpc_globalcontext *gctx; 	/* Global BOOTP context */
1506 	struct ifnet *ifp;
1507 	struct sockaddr_dl *sdl;
1508 	struct ifaddr *ifa;
1509 	int error;
1510 #ifndef BOOTP_WIRED_TO
1511 	int ifcnt;
1512 #endif
1513 	struct nfsv3_diskless *nd;
1514 	struct thread *td;
1515 	int timeout;
1516 	int delay;
1517 
1518 	timeout = BOOTP_IFACE_WAIT_TIMEOUT * hz;
1519 	delay = hz / 10;
1520 
1521 	nd = &nfsv3_diskless;
1522 	td = curthread;
1523 
1524 	/*
1525 	 * If already filled in, don't touch it here
1526 	 */
1527 	if (nfs_diskless_valid != 0)
1528 		return;
1529 
1530 	gctx = malloc(sizeof(*gctx), M_TEMP, M_WAITOK | M_ZERO);
1531 	STAILQ_INIT(&gctx->interfaces);
1532 	gctx->xid = ~0xFFFF;
1533 	gctx->starttime = time_second;
1534 
1535 	/*
1536 	 * If ROOTDEVNAME is defined or vfs.root.mountfrom is set then we have
1537 	 * root-path overrides that can potentially let us boot even if we don't
1538 	 * get a root path from the server, so we can treat that as a non-error.
1539 	 */
1540 #ifdef ROOTDEVNAME
1541 	gctx->any_root_overrides = 1;
1542 #else
1543 	gctx->any_root_overrides = testenv("vfs.root.mountfrom");
1544 #endif
1545 
1546 	/*
1547 	 * Find a network interface.
1548 	 */
1549 	CURVNET_SET(TD_TO_VNET(td));
1550 #ifdef BOOTP_WIRED_TO
1551 	printf("%s: wired to interface '%s'\n", __func__,
1552 	       __XSTRING(BOOTP_WIRED_TO));
1553 	allocifctx(gctx);
1554 #else
1555 	/*
1556 	 * Preallocate interface context storage, if another interface
1557 	 * attaches and wins the race, it won't be eligible for bootp.
1558 	 */
1559 	ifcnt = 0;
1560 	IFNET_RLOCK();
1561 	CK_STAILQ_FOREACH(ifp, &V_ifnet, if_link) {
1562 		if ((ifp->if_flags &
1563 		     (IFF_LOOPBACK | IFF_POINTOPOINT | IFF_BROADCAST)) !=
1564 		    IFF_BROADCAST)
1565 			continue;
1566 		switch (ifp->if_alloctype) {
1567 			case IFT_ETHER:
1568 				break;
1569 			default:
1570 				continue;
1571 		}
1572 		ifcnt++;
1573 	}
1574 
1575 	IFNET_RUNLOCK();
1576 	if (ifcnt == 0) {
1577 		printf("WARNING: BOOTP found no eligible network interfaces, skipping!\n");
1578 		goto out;
1579 	}
1580 
1581 	for (; ifcnt > 0; ifcnt--)
1582 		allocifctx(gctx);
1583 #endif
1584 
1585 retry:
1586 	ifctx = STAILQ_FIRST(&gctx->interfaces);
1587 	IFNET_RLOCK();
1588 	CK_STAILQ_FOREACH(ifp, &V_ifnet, if_link) {
1589 		if (ifctx == NULL)
1590 			break;
1591 #ifdef BOOTP_WIRED_TO
1592 		if (strcmp(ifp->if_xname, __XSTRING(BOOTP_WIRED_TO)) != 0)
1593 			continue;
1594 #else
1595 		if ((ifp->if_flags &
1596 		     (IFF_LOOPBACK | IFF_POINTOPOINT | IFF_BROADCAST)) !=
1597 		    IFF_BROADCAST)
1598 			continue;
1599 		switch (ifp->if_alloctype) {
1600 			case IFT_ETHER:
1601 				break;
1602 			default:
1603 				continue;
1604 		}
1605 #endif
1606 		strlcpy(ifctx->ireq.ifr_name, ifp->if_xname,
1607 		    sizeof(ifctx->ireq.ifr_name));
1608 		ifctx->ifp = ifp;
1609 
1610 		/* Get HW address */
1611 		sdl = NULL;
1612 		CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link)
1613 			if (ifa->ifa_addr->sa_family == AF_LINK) {
1614 				sdl = (struct sockaddr_dl *)ifa->ifa_addr;
1615 				if (sdl->sdl_type == IFT_ETHER)
1616 					break;
1617 			}
1618 		if (sdl == NULL)
1619 			panic("bootpc: Unable to find HW address for %s",
1620 			    ifctx->ireq.ifr_name);
1621 		ifctx->sdl = sdl;
1622 
1623 		ifctx = STAILQ_NEXT(ifctx, next);
1624 	}
1625 	IFNET_RUNLOCK();
1626 	CURVNET_RESTORE();
1627 
1628 	if (STAILQ_EMPTY(&gctx->interfaces) ||
1629 	    STAILQ_FIRST(&gctx->interfaces)->ifp == NULL) {
1630 		if (timeout > 0) {
1631 			pause("bootpc", delay);
1632 			timeout -= delay;
1633 			goto retry;
1634 		}
1635 #ifdef BOOTP_WIRED_TO
1636 		panic("%s: Could not find interface specified "
1637 		      "by BOOTP_WIRED_TO: "
1638 		      __XSTRING(BOOTP_WIRED_TO), __func__);
1639 #else
1640 		panic("%s: no suitable interface", __func__);
1641 #endif
1642 	}
1643 
1644 	error = socreate(AF_INET, &bootp_so, SOCK_DGRAM, 0, td->td_ucred, td);
1645 	if (error != 0)
1646 		panic("%s: socreate, error=%d", __func__, error);
1647 
1648 	STAILQ_FOREACH(ifctx, &gctx->interfaces, next)
1649 		bootpc_fakeup_interface(ifctx, td);
1650 
1651 	STAILQ_FOREACH(ifctx, &gctx->interfaces, next)
1652 		bootpc_compose_query(ifctx, td);
1653 
1654 	error = bootpc_call(gctx, td);
1655 	if (error != 0) {
1656 		printf("BOOTP call failed\n");
1657 	}
1658 
1659 	mountopts(&nd->root_args, NULL);
1660 
1661 	STAILQ_FOREACH(ifctx, &gctx->interfaces, next)
1662 		if (bootpc_ifctx_isresolved(ifctx) != 0)
1663 			bootpc_decode_reply(nd, ifctx, gctx);
1664 
1665 #ifdef BOOTP_NFSROOT
1666 	if (gctx->gotrootpath == 0 && gctx->any_root_overrides == 0)
1667 		panic("bootpc: No root path offered");
1668 #endif
1669 
1670 	STAILQ_FOREACH(ifctx, &gctx->interfaces, next)
1671 		bootpc_adjust_interface(ifctx, gctx, td);
1672 
1673 	soclose(bootp_so);
1674 
1675 	STAILQ_FOREACH(ifctx, &gctx->interfaces, next)
1676 		if (ifctx->gotrootpath != 0)
1677 			break;
1678 	if (ifctx == NULL) {
1679 		STAILQ_FOREACH(ifctx, &gctx->interfaces, next)
1680 			if (bootpc_ifctx_isresolved(ifctx) != 0)
1681 				break;
1682 	}
1683 	if (ifctx == NULL)
1684 		goto out;
1685 
1686 	if (gctx->gotrootpath != 0) {
1687 		struct epoch_tracker et;
1688 
1689 		kern_setenv("boot.netif.name", ifctx->ifp->if_xname);
1690 
1691 		NET_EPOCH_ENTER(et);
1692 		bootpc_add_default_route(ifctx);
1693 		NET_EPOCH_EXIT(et);
1694 		error = md_mount(&nd->root_saddr, nd->root_hostnam,
1695 				 nd->root_fh, &nd->root_fhsize,
1696 				 &nd->root_args, td);
1697 		NET_EPOCH_ENTER(et);
1698 		bootpc_remove_default_route(ifctx);
1699 		NET_EPOCH_EXIT(et);
1700 		if (error != 0) {
1701 			if (gctx->any_root_overrides == 0)
1702 				panic("nfs_boot: mount root, error=%d", error);
1703 			else
1704 				goto out;
1705 		}
1706 		rootdevnames[0] = "nfs:";
1707 		nfs_diskless_valid = 3;
1708 	}
1709 
1710 	strcpy(nd->myif.ifra_name, ifctx->ireq.ifr_name);
1711 	bcopy(&ifctx->myaddr, &nd->myif.ifra_addr, sizeof(ifctx->myaddr));
1712 	bcopy(&ifctx->myaddr, &nd->myif.ifra_broadaddr, sizeof(ifctx->myaddr));
1713 	((struct sockaddr_in *) &nd->myif.ifra_broadaddr)->sin_addr.s_addr =
1714 		ifctx->myaddr.sin_addr.s_addr |
1715 		~ ifctx->netmask.sin_addr.s_addr;
1716 	bcopy(&ifctx->netmask, &nd->myif.ifra_mask, sizeof(ifctx->netmask));
1717 	bcopy(&ifctx->gw, &nd->mygateway, sizeof(ifctx->gw));
1718 
1719 out:
1720 	while((ifctx = STAILQ_FIRST(&gctx->interfaces)) != NULL) {
1721 		STAILQ_REMOVE_HEAD(&gctx->interfaces, next);
1722 		free(ifctx, M_TEMP);
1723 	}
1724 	free(gctx, M_TEMP);
1725 }
1726 
1727 /*
1728  * RPC: mountd/mount
1729  * Given a server pathname, get an NFS file handle.
1730  * Also, sets sin->sin_port to the NFS service port.
1731  */
1732 static int
1733 md_mount(struct sockaddr_in *mdsin, char *path, u_char *fhp, int *fhsizep,
1734     struct nfs_args *args, struct thread *td)
1735 {
1736 	struct mbuf *m;
1737 	int error;
1738 	int authunixok;
1739 	int authcount;
1740 	int authver;
1741 
1742 #define	RPCPROG_MNT	100005
1743 #define	RPCMNT_VER1	1
1744 #define RPCMNT_VER3	3
1745 #define	RPCMNT_MOUNT	1
1746 #define	AUTH_SYS	1		/* unix style (uid, gids) */
1747 #define AUTH_UNIX	AUTH_SYS
1748 
1749 	/* XXX honor v2/v3 flags in args->flags? */
1750 #ifdef BOOTP_NFSV3
1751 	/* First try NFS v3 */
1752 	/* Get port number for MOUNTD. */
1753 	error = krpc_portmap(mdsin, RPCPROG_MNT, RPCMNT_VER3,
1754 			     &mdsin->sin_port, td);
1755 	if (error == 0) {
1756 		m = xdr_string_encode(path, strlen(path));
1757 
1758 		/* Do RPC to mountd. */
1759 		error = krpc_call(mdsin, RPCPROG_MNT, RPCMNT_VER3,
1760 				  RPCMNT_MOUNT, &m, NULL, td);
1761 	}
1762 	if (error == 0) {
1763 		args->flags |= NFSMNT_NFSV3;
1764 	} else {
1765 #endif
1766 		/* Fallback to NFS v2 */
1767 
1768 		/* Get port number for MOUNTD. */
1769 		error = krpc_portmap(mdsin, RPCPROG_MNT, RPCMNT_VER1,
1770 				     &mdsin->sin_port, td);
1771 		if (error != 0)
1772 			return error;
1773 
1774 		m = xdr_string_encode(path, strlen(path));
1775 
1776 		/* Do RPC to mountd. */
1777 		error = krpc_call(mdsin, RPCPROG_MNT, RPCMNT_VER1,
1778 				  RPCMNT_MOUNT, &m, NULL, td);
1779 		if (error != 0)
1780 			return error;	/* message already freed */
1781 
1782 #ifdef BOOTP_NFSV3
1783 	}
1784 #endif
1785 
1786 	if (xdr_int_decode(&m, &error) != 0 || error != 0)
1787 		goto bad;
1788 
1789 	if ((args->flags & NFSMNT_NFSV3) != 0) {
1790 		if (xdr_int_decode(&m, fhsizep) != 0 ||
1791 		    *fhsizep > NFSX_V3FHMAX ||
1792 		    *fhsizep <= 0)
1793 			goto bad;
1794 	} else
1795 		*fhsizep = NFSX_V2FH;
1796 
1797 	if (xdr_opaque_decode(&m, fhp, *fhsizep) != 0)
1798 		goto bad;
1799 
1800 	if (args->flags & NFSMNT_NFSV3) {
1801 		if (xdr_int_decode(&m, &authcount) != 0)
1802 			goto bad;
1803 		authunixok = 0;
1804 		if (authcount < 0 || authcount > 100)
1805 			goto bad;
1806 		while (authcount > 0) {
1807 			if (xdr_int_decode(&m, &authver) != 0)
1808 				goto bad;
1809 			if (authver == AUTH_UNIX)
1810 				authunixok = 1;
1811 			authcount--;
1812 		}
1813 		if (authunixok == 0)
1814 			goto bad;
1815 	}
1816 
1817 	/* Set port number for NFS use. */
1818 	error = krpc_portmap(mdsin, NFS_PROG,
1819 			     (args->flags &
1820 			      NFSMNT_NFSV3) ? NFS_VER3 : NFS_VER2,
1821 			     &mdsin->sin_port, td);
1822 
1823 	goto out;
1824 
1825 bad:
1826 	error = EBADRPC;
1827 
1828 out:
1829 	m_freem(m);
1830 	return error;
1831 }
1832 
1833 SYSINIT(bootp_rootconf, SI_SUB_ROOT_CONF, SI_ORDER_FIRST, bootpc_init, NULL);
1834