sbin/dhclient/options.c

   1 /*      $OpenBSD: options.c,v 1.15 2004/12/26 03:17:07 deraadt Exp $    */
   2
   3 /* DHCP options parsing and reassembly. */
   4
   5 /*-
   6  * SPDX-License-Identifier: BSD-3-Clause
   7  *
   8  * Copyright (c) 1995, 1996, 1997, 1998 The Internet Software Consortium.
   9  * All rights reserved.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  *
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer.
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  * 3. Neither the name of The Internet Software Consortium nor the names
  21  *    of its contributors may be used to endorse or promote products derived
  22  *    from this software without specific prior written permission.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
  25  * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
  26  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  27  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  28  * DISCLAIMED.  IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
  29  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  30  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  31  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
  32  * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  33  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  34  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  35  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  36  * SUCH DAMAGE.
  37  *
  38  * This software has been written for the Internet Software Consortium
  39  * by Ted Lemon <mellon@fugue.com> in cooperation with Vixie
  40  * Enterprises.  To learn more about the Internet Software Consortium,
  41  * see ``http://www.vix.com/isc''.  To learn more about Vixie
  42  * Enterprises, see ``http://www.vix.com''.
  43  */
  44
  45 #include <sys/cdefs.h>
  46 __FBSDID("$FreeBSD$");
  47
  48 #include <ctype.h>
  49
  50 #define DHCP_OPTION_DATA
  51 #include "dhcpd.h"
  52
  53 int bad_options = 0;
  54 int bad_options_max = 5;
  55
  56 void    parse_options(struct packet *);
  57 void    parse_option_buffer(struct packet *, unsigned char *, int);
  58 int     store_options(unsigned char *, int, struct tree_cache **,
  59             unsigned char *, int, int, int, int);
  60 void    expand_domain_search(struct packet *packet);
  61 int     find_search_domain_name_len(struct option_data *option, int *offset);
  62 void    expand_search_domain_name(struct option_data *option, int *offset,
  63             unsigned char **domain_search);
  64
  65
  66 /*
  67  * Parse all available options out of the specified packet.
  68  */
  69 void
  70 parse_options(struct packet *packet)
  71 {
  72         /* Initially, zero all option pointers. */
  73         memset(packet->options, 0, sizeof(packet->options));
  74
  75         /* If we don't see the magic cookie, there's nothing to parse. */
  76         if (memcmp(packet->raw->options, DHCP_OPTIONS_COOKIE, 4)) {
  77                 packet->options_valid = 0;
  78                 return;
  79         }
  80
  81         /*
  82          * Go through the options field, up to the end of the packet or
  83          * the End field.
  84          */
  85         parse_option_buffer(packet, &packet->raw->options[4],
  86             packet->packet_length - DHCP_FIXED_NON_UDP - 4);
  87
  88         /*
  89          * If we parsed a DHCP Option Overload option, parse more
  90          * options out of the buffer(s) containing them.
  91          */
  92         if (packet->options_valid &&
  93             packet->options[DHO_DHCP_OPTION_OVERLOAD].data) {
  94                 if (packet->options[DHO_DHCP_OPTION_OVERLOAD].data[0] & 1)
  95                         parse_option_buffer(packet,
  96                             (unsigned char *)packet->raw->file,
  97                             sizeof(packet->raw->file));
  98                 if (packet->options[DHO_DHCP_OPTION_OVERLOAD].data[0] & 2)
  99                         parse_option_buffer(packet,
 100                             (unsigned char *)packet->raw->sname,
 101                             sizeof(packet->raw->sname));
 102         }
 103
 104         /* Expand DHCP Domain Search option. */
 105         if (packet->options_valid) {
 106                 expand_domain_search(packet);
 107         }
 108 }
 109
 110 /*
 111  * Parse options out of the specified buffer, storing addresses of
 112  * option values in packet->options and setting packet->options_valid if
 113  * no errors are encountered.
 114  */
 115 void
 116 parse_option_buffer(struct packet *packet,
 117     unsigned char *buffer, int length)
 118 {
 119         unsigned char *s, *t, *end = buffer + length;
 120         int len, code;
 121
 122         for (s = buffer; *s != DHO_END && s < end; ) {
 123                 code = s[0];
 124
 125                 /* Pad options don't have a length - just skip them. */
 126                 if (code == DHO_PAD) {
 127                         s++;
 128                         continue;
 129                 }
 130                 if (s + 2 > end) {
 131                         len = 65536;
 132                         goto bogus;
 133                 }
 134
 135                 /*
 136                  * All other fields (except end, see above) have a
 137                  * one-byte length.
 138                  */
 139                 len = s[1];
 140
 141                 /*
 142                  * If the length is outrageous, silently skip the rest,
 143                  * and mark the packet bad. Unfortunately some crappy
 144                  * dhcp servers always seem to give us garbage on the
 145                  * end of a packet. so rather than keep refusing, give
 146                  * up and try to take one after seeing a few without
 147                  * anything good.
 148                  */
 149                 if (s + len + 2 > end) {
 150                     bogus:
 151                         bad_options++;
 152                         warning("option %s (%d) %s.",
 153                             dhcp_options[code].name, len,
 154                             "larger than buffer");
 155                         if (bad_options == bad_options_max) {
 156                                 packet->options_valid = 1;
 157                                 bad_options = 0;
 158                                 warning("Many bogus options seen in offers. "
 159                                     "Taking this offer in spite of bogus "
 160                                     "options - hope for the best!");
 161                         } else {
 162                                 warning("rejecting bogus offer.");
 163                                 packet->options_valid = 0;
 164                         }
 165                         return;
 166                 }
 167                 /*
 168                  * If we haven't seen this option before, just make
 169                  * space for it and copy it there.
 170                  */
 171                 if (!packet->options[code].data) {
 172                         if (!(t = calloc(1, len + 1)))
 173                                 error("Can't allocate storage for option %s.",
 174                                     dhcp_options[code].name);
 175                         /*
 176                          * Copy and NUL-terminate the option (in case
 177                          * it's an ASCII string.
 178                          */
 179                         memcpy(t, &s[2], len);
 180                         t[len] = 0;
 181                         packet->options[code].len = len;
 182                         packet->options[code].data = t;
 183                 } else {
 184                         /*
 185                          * If it's a repeat, concatenate it to whatever
 186                          * we last saw.   This is really only required
 187                          * for clients, but what the heck...
 188                          */
 189                         t = calloc(1, len + packet->options[code].len + 1);
 190                         if (!t)
 191                                 error("Can't expand storage for option %s.",
 192                                     dhcp_options[code].name);
 193                         memcpy(t, packet->options[code].data,
 194                                 packet->options[code].len);
 195                         memcpy(t + packet->options[code].len,
 196                                 &s[2], len);
 197                         packet->options[code].len += len;
 198                         t[packet->options[code].len] = 0;
 199                         free(packet->options[code].data);
 200                         packet->options[code].data = t;
 201                 }
 202                 s += len + 2;
 203         }
 204         packet->options_valid = 1;
 205 }
 206
 207 /*
 208  * Expand DHCP Domain Search option. The value of this option is
 209  * encoded like DNS' list of labels. See:
 210  *   RFC 3397
 211  *   RFC 1035
 212  */
 213 void
 214 expand_domain_search(struct packet *packet)
 215 {
 216         int offset, expanded_len, next_domain_len;
 217         struct option_data *option;
 218         unsigned char *domain_search, *cursor;
 219
 220         if (packet->options[DHO_DOMAIN_SEARCH].data == NULL)
 221                 return;
 222
 223         option = &packet->options[DHO_DOMAIN_SEARCH];
 224
 225         /* Compute final expanded length. */
 226         expanded_len = 0;
 227         offset = 0;
 228         while (offset < option->len) {
 229                 next_domain_len = find_search_domain_name_len(option, &offset);
 230                 if (next_domain_len < 0)
 231                         /* The Domain Search option value is invalid. */
 232                         return;
 233
 234                 /* We add 1 for the space between domain names. */
 235                 expanded_len += next_domain_len + 1;
 236         }
 237         if (expanded_len > 0)
 238                 /* Remove 1 for the superfluous trailing space. */
 239                 --expanded_len;
 240
 241         domain_search = malloc(expanded_len + 1);
 242         if (domain_search == NULL)
 243                 error("Can't allocate storage for expanded domain-search\n");
 244
 245         offset = 0;
 246         cursor = domain_search;
 247         while (offset < option->len) {
 248                 expand_search_domain_name(option, &offset, &cursor);
 249                 cursor[0] = ' ';
 250                 cursor++;
 251         }
 252         domain_search[expanded_len] = '\0';
 253
 254         free(option->data);
 255         option->len = expanded_len;
 256         option->data = domain_search;
 257 }
 258
 259 int
 260 find_search_domain_name_len(struct option_data *option, int *offset)
 261 {
 262         int domain_name_len, i, label_len, pointer, pointed_len;
 263
 264         domain_name_len = 0;
 265
 266         i = *offset;
 267         while (i < option->len) {
 268                 label_len = option->data[i];
 269                 if (label_len == 0) {
 270                         /*
 271                          * A zero-length label marks the end of this
 272                          * domain name.
 273                          */
 274                         *offset = i + 1;
 275                         return (domain_name_len);
 276                 } else if (label_len & 0xC0) {
 277                         /* This is a pointer to another list of labels. */
 278                         if (i + 1 >= option->len) {
 279                                 /* The pointer is truncated. */
 280                                 warning("Truncated pointer in DHCP Domain "
 281                                     "Search option.");
 282                                 return (-1);
 283                         }
 284
 285                         pointer = ((label_len & ~(0xC0)) << 8) +
 286                             option->data[i + 1];
 287                         if (pointer >= *offset) {
 288                                 /*
 289                                  * The pointer must indicate a prior
 290                                  * occurrence.
 291                                  */
 292                                 warning("Invalid forward pointer in DHCP "
 293                                     "Domain Search option compression.");
 294                                 return (-1);
 295                         }
 296
 297                         pointed_len = find_search_domain_name_len(option,
 298                             &pointer);
 299                         domain_name_len += pointed_len;
 300
 301                         *offset = i + 2;
 302                         return (domain_name_len);
 303                 }
 304
 305                 if (i + label_len >= option->len) {
 306                         warning("Truncated label in DHCP Domain Search "
 307                             "option.");
 308                         return (-1);
 309                 }
 310
 311                 /*
 312                  * Update the domain name length with the length of the
 313                  * current label, plus a trailing dot ('.').
 314                  */
 315                 domain_name_len += label_len + 1;
 316
 317                 /* Move cursor. */
 318                 i += label_len + 1;
 319         }
 320
 321         warning("Truncated DHCP Domain Search option.");
 322
 323         return (-1);
 324 }
 325
 326 void
 327 expand_search_domain_name(struct option_data *option, int *offset,
 328     unsigned char **domain_search)
 329 {
 330         int i, label_len, pointer;
 331         unsigned char *cursor;
 332
 333         /*
 334          * This is the same loop than the function above
 335          * (find_search_domain_name_len). Therefore, we remove checks,
 336          * they're already done. Here, we just make the copy.
 337          */
 338         i = *offset;
 339         cursor = *domain_search;
 340         while (i < option->len) {
 341                 label_len = option->data[i];
 342                 if (label_len == 0) {
 343                         /*
 344                          * A zero-length label marks the end of this
 345                          * domain name.
 346                          */
 347                         *offset = i + 1;
 348                         *domain_search = cursor;
 349                         return;
 350                 } else if (label_len & 0xC0) {
 351                         /* This is a pointer to another list of labels. */
 352                         pointer = ((label_len & ~(0xC0)) << 8) +
 353                             option->data[i + 1];
 354
 355                         expand_search_domain_name(option, &pointer, &cursor);
 356
 357                         *offset = i + 2;
 358                         *domain_search = cursor;
 359                         return;
 360                 }
 361
 362                 /* Copy the label found. */
 363                 memcpy(cursor, option->data + i + 1, label_len);
 364                 cursor[label_len] = '.';
 365
 366                 /* Move cursor. */
 367                 i += label_len + 1;
 368                 cursor += label_len + 1;
 369         }
 370 }
 371
 372 /*
 373  * cons options into a big buffer, and then split them out into the
 374  * three separate buffers if needed.  This allows us to cons up a set of
 375  * vendor options using the same routine.
 376  */
 377 int
 378 cons_options(struct packet *inpacket, struct dhcp_packet *outpacket,
 379     int mms, struct tree_cache **options,
 380     int overload, /* Overload flags that may be set. */
 381     int terminate, int bootpp, u_int8_t *prl, int prl_len)
 382 {
 383         unsigned char priority_list[300], buffer[4096];
 384         int priority_len, main_buffer_size, mainbufix, bufix;
 385         int option_size, length;
 386
 387         /*
 388          * If the client has provided a maximum DHCP message size, use
 389          * that; otherwise, if it's BOOTP, only 64 bytes; otherwise use
 390          * up to the minimum IP MTU size (576 bytes).
 391          *
 392          * XXX if a BOOTP client specifies a max message size, we will
 393          * honor it.
 394          */
 395         if (!mms &&
 396             inpacket &&
 397             inpacket->options[DHO_DHCP_MAX_MESSAGE_SIZE].data &&
 398             (inpacket->options[DHO_DHCP_MAX_MESSAGE_SIZE].len >=
 399             sizeof(u_int16_t)))
 400                 mms = getUShort(
 401                     inpacket->options[DHO_DHCP_MAX_MESSAGE_SIZE].data);
 402
 403         if (mms)
 404                 main_buffer_size = mms - DHCP_FIXED_LEN;
 405         else if (bootpp)
 406                 main_buffer_size = 64;
 407         else
 408                 main_buffer_size = 576 - DHCP_FIXED_LEN;
 409
 410         if (main_buffer_size > sizeof(buffer))
 411                 main_buffer_size = sizeof(buffer);
 412
 413         /* Preload the option priority list with mandatory options. */
 414         priority_len = 0;
 415         priority_list[priority_len++] = DHO_DHCP_MESSAGE_TYPE;
 416         priority_list[priority_len++] = DHO_DHCP_SERVER_IDENTIFIER;
 417         priority_list[priority_len++] = DHO_DHCP_LEASE_TIME;
 418         priority_list[priority_len++] = DHO_DHCP_MESSAGE;
 419
 420         /*
 421          * If the client has provided a list of options that it wishes
 422          * returned, use it to prioritize.  Otherwise, prioritize based
 423          * on the default priority list.
 424          */
 425         if (inpacket &&
 426             inpacket->options[DHO_DHCP_PARAMETER_REQUEST_LIST].data) {
 427                 int prlen =
 428                     inpacket->options[DHO_DHCP_PARAMETER_REQUEST_LIST].len;
 429                 if (prlen + priority_len > sizeof(priority_list))
 430                         prlen = sizeof(priority_list) - priority_len;
 431
 432                 memcpy(&priority_list[priority_len],
 433                     inpacket->options[DHO_DHCP_PARAMETER_REQUEST_LIST].data,
 434                     prlen);
 435                 priority_len += prlen;
 436                 prl = priority_list;
 437         } else if (prl) {
 438                 if (prl_len + priority_len > sizeof(priority_list))
 439                         prl_len = sizeof(priority_list) - priority_len;
 440
 441                 memcpy(&priority_list[priority_len], prl, prl_len);
 442                 priority_len += prl_len;
 443                 prl = priority_list;
 444         } else {
 445                 memcpy(&priority_list[priority_len],
 446                     dhcp_option_default_priority_list,
 447                     sizeof_dhcp_option_default_priority_list);
 448                 priority_len += sizeof_dhcp_option_default_priority_list;
 449         }
 450
 451         /* Copy the options into the big buffer... */
 452         option_size = store_options(
 453             buffer,
 454             (main_buffer_size - 7 + ((overload & 1) ? DHCP_FILE_LEN : 0) +
 455                 ((overload & 2) ? DHCP_SNAME_LEN : 0)),
 456             options, priority_list, priority_len, main_buffer_size,
 457             (main_buffer_size + ((overload & 1) ? DHCP_FILE_LEN : 0)),
 458             terminate);
 459
 460         /* Put the cookie up front... */
 461         memcpy(outpacket->options, DHCP_OPTIONS_COOKIE, 4);
 462         mainbufix = 4;
 463
 464         /*
 465          * If we're going to have to overload, store the overload option
 466          * at the beginning.  If we can, though, just store the whole
 467          * thing in the packet's option buffer and leave it at that.
 468          */
 469         if (option_size <= main_buffer_size - mainbufix) {
 470                 memcpy(&outpacket->options[mainbufix],
 471                     buffer, option_size);
 472                 mainbufix += option_size;
 473                 if (mainbufix < main_buffer_size)
 474                         outpacket->options[mainbufix++] = DHO_END;
 475                 length = DHCP_FIXED_NON_UDP + mainbufix;
 476         } else {
 477                 outpacket->options[mainbufix++] = DHO_DHCP_OPTION_OVERLOAD;
 478                 outpacket->options[mainbufix++] = 1;
 479                 if (option_size >
 480                     main_buffer_size - mainbufix + DHCP_FILE_LEN)
 481                         outpacket->options[mainbufix++] = 3;
 482                 else
 483                         outpacket->options[mainbufix++] = 1;
 484
 485                 memcpy(&outpacket->options[mainbufix],
 486                     buffer, main_buffer_size - mainbufix);
 487                 bufix = main_buffer_size - mainbufix;
 488                 length = DHCP_FIXED_NON_UDP + mainbufix;
 489                 if (overload & 1) {
 490                         if (option_size - bufix <= DHCP_FILE_LEN) {
 491                                 memcpy(outpacket->file,
 492                                     &buffer[bufix], option_size - bufix);
 493                                 mainbufix = option_size - bufix;
 494                                 if (mainbufix < DHCP_FILE_LEN)
 495                                         outpacket->file[mainbufix++] = (char)DHO_END;
 496                                 while (mainbufix < DHCP_FILE_LEN)
 497                                         outpacket->file[mainbufix++] = (char)DHO_PAD;
 498                         } else {
 499                                 memcpy(outpacket->file,
 500                                     &buffer[bufix], DHCP_FILE_LEN);
 501                                 bufix += DHCP_FILE_LEN;
 502                         }
 503                 }
 504                 if ((overload & 2) && option_size < bufix) {
 505                         memcpy(outpacket->sname,
 506                             &buffer[bufix], option_size - bufix);
 507
 508                         mainbufix = option_size - bufix;
 509                         if (mainbufix < DHCP_SNAME_LEN)
 510                                 outpacket->file[mainbufix++] = (char)DHO_END;
 511                         while (mainbufix < DHCP_SNAME_LEN)
 512                                 outpacket->file[mainbufix++] = (char)DHO_PAD;
 513                 }
 514         }
 515         return (length);
 516 }
 517
 518 /*
 519  * Store all the requested options into the requested buffer.
 520  */
 521 int
 522 store_options(unsigned char *buffer, int buflen, struct tree_cache **options,
 523     unsigned char *priority_list, int priority_len, int first_cutoff,
 524     int second_cutoff, int terminate)
 525 {
 526         int bufix = 0, option_stored[256], i, ix, tto;
 527
 528         /* Zero out the stored-lengths array. */
 529         memset(option_stored, 0, sizeof(option_stored));
 530
 531         /*
 532          * Copy out the options in the order that they appear in the
 533          * priority list...
 534          */
 535         for (i = 0; i < priority_len; i++) {
 536                 /* Code for next option to try to store. */
 537                 int code = priority_list[i];
 538                 int optstart;
 539
 540                 /*
 541                  * Number of bytes left to store (some may already have
 542                  * been stored by a previous pass).
 543                  */
 544                 int length;
 545
 546                 /* If no data is available for this option, skip it. */
 547                 if (!options[code]) {
 548                         continue;
 549                 }
 550
 551                 /*
 552                  * The client could ask for things that are mandatory,
 553                  * in which case we should avoid storing them twice...
 554                  */
 555                 if (option_stored[code])
 556                         continue;
 557                 option_stored[code] = 1;
 558
 559                 /* We should now have a constant length for the option. */
 560                 length = options[code]->len;
 561
 562                 /* Do we add a NUL? */
 563                 if (terminate && dhcp_options[code].format[0] == 't') {
 564                         length++;
 565                         tto = 1;
 566                 } else
 567                         tto = 0;
 568
 569                 /* Try to store the option. */
 570
 571                 /*
 572                  * If the option's length is more than 255, we must
 573                  * store it in multiple hunks.   Store 255-byte hunks
 574                  * first.  However, in any case, if the option data will
 575                  * cross a buffer boundary, split it across that
 576                  * boundary.
 577                  */
 578                 ix = 0;
 579
 580                 optstart = bufix;
 581                 while (length) {
 582                         unsigned char incr = length > 255 ? 255 : length;
 583
 584                         /*
 585                          * If this hunk of the buffer will cross a
 586                          * boundary, only go up to the boundary in this
 587                          * pass.
 588                          */
 589                         if (bufix < first_cutoff &&
 590                             bufix + incr > first_cutoff)
 591                                 incr = first_cutoff - bufix;
 592                         else if (bufix < second_cutoff &&
 593                             bufix + incr > second_cutoff)
 594                                 incr = second_cutoff - bufix;
 595
 596                         /*
 597                          * If this option is going to overflow the
 598                          * buffer, skip it.
 599                          */
 600                         if (bufix + 2 + incr > buflen) {
 601                                 bufix = optstart;
 602                                 break;
 603                         }
 604
 605                         /* Everything looks good - copy it in! */
 606                         buffer[bufix] = code;
 607                         buffer[bufix + 1] = incr;
 608                         if (tto && incr == length) {
 609                                 memcpy(buffer + bufix + 2,
 610                                     options[code]->value + ix, incr - 1);
 611                                 buffer[bufix + 2 + incr - 1] = 0;
 612                         } else
 613                                 memcpy(buffer + bufix + 2,
 614                                     options[code]->value + ix, incr);
 615                         length -= incr;
 616                         ix += incr;
 617                         bufix += 2 + incr;
 618                 }
 619         }
 620         return (bufix);
 621 }
 622
 623 /*
 624  * Format the specified option so that a human can easily read it.
 625  */
 626 char *
 627 pretty_print_option(unsigned int code, unsigned char *data, int len,
 628     int emit_commas, int emit_quotes)
 629 {
 630         static char optbuf[32768]; /* XXX */
 631         int hunksize = 0, numhunk = -1, numelem = 0;
 632         char fmtbuf[32], *op = optbuf;
 633         int i, j, k, opleft = sizeof(optbuf);
 634         unsigned char *dp = data;
 635         struct in_addr foo;
 636         char comma;
 637
 638         /* Code should be between 0 and 255. */
 639         if (code > 255)
 640                 error("pretty_print_option: bad code %d", code);
 641
 642         if (emit_commas)
 643                 comma = ',';
 644         else
 645                 comma = ' ';
 646
 647         /* Figure out the size of the data. */
 648         for (i = 0; dhcp_options[code].format[i]; i++) {
 649                 if (!numhunk) {
 650                         warning("%s: Excess information in format string: %s",
 651                             dhcp_options[code].name,
 652                             &(dhcp_options[code].format[i]));
 653                         break;
 654                 }
 655                 numelem++;
 656                 fmtbuf[i] = dhcp_options[code].format[i];
 657                 switch (dhcp_options[code].format[i]) {
 658                 case 'A':
 659                         --numelem;
 660                         fmtbuf[i] = 0;
 661                         numhunk = 0;
 662                         break;
 663                 case 'X':
 664                         for (k = 0; k < len; k++)
 665                                 if (!isascii(data[k]) ||
 666                                     !isprint(data[k]))
 667                                         break;
 668                         if (k == len) {
 669                                 fmtbuf[i] = 't';
 670                                 numhunk = -2;
 671                         } else {
 672                                 fmtbuf[i] = 'x';
 673                                 hunksize++;
 674                                 comma = ':';
 675                                 numhunk = 0;
 676                         }
 677                         fmtbuf[i + 1] = 0;
 678                         break;
 679                 case 't':
 680                         fmtbuf[i] = 't';
 681                         fmtbuf[i + 1] = 0;
 682                         numhunk = -2;
 683                         break;
 684                 case 'I':
 685                 case 'l':
 686                 case 'L':
 687                         hunksize += 4;
 688                         break;
 689                 case 's':
 690                 case 'S':
 691                         hunksize += 2;
 692                         break;
 693                 case 'b':
 694                 case 'B':
 695                 case 'f':
 696                         hunksize++;
 697                         break;
 698                 case 'e':
 699                         break;
 700                 default:
 701                         warning("%s: garbage in format string: %s",
 702                             dhcp_options[code].name,
 703                             &(dhcp_options[code].format[i]));
 704                         break;
 705                 }
 706         }
 707
 708         /* Check for too few bytes... */
 709         if (hunksize > len) {
 710                 warning("%s: expecting at least %d bytes; got %d",
 711                     dhcp_options[code].name, hunksize, len);
 712                 return ("<error>");
 713         }
 714         /* Check for too many bytes... */
 715         if (numhunk == -1 && hunksize < len)
 716                 warning("%s: %d extra bytes",
 717                     dhcp_options[code].name, len - hunksize);
 718
 719         /* If this is an array, compute its size. */
 720         if (!numhunk)
 721                 numhunk = len / hunksize;
 722         /* See if we got an exact number of hunks. */
 723         if (numhunk > 0 && numhunk * hunksize < len)
 724                 warning("%s: %d extra bytes at end of array",
 725                     dhcp_options[code].name, len - numhunk * hunksize);
 726
 727         /* A one-hunk array prints the same as a single hunk. */
 728         if (numhunk < 0)
 729                 numhunk = 1;
 730
 731         /* Cycle through the array (or hunk) printing the data. */
 732         for (i = 0; i < numhunk; i++) {
 733                 for (j = 0; j < numelem; j++) {
 734                         int opcount;
 735                         switch (fmtbuf[j]) {
 736                         case 't':
 737                                 if (emit_quotes) {
 738                                         *op++ = '"';
 739                                         opleft--;
 740                                 }
 741                                 for (; dp < data + len; dp++) {
 742                                         if (!isascii(*dp) ||
 743                                             !isprint(*dp)) {
 744                                                 if (dp + 1 != data + len ||
 745                                                     *dp != 0) {
 746                                                         snprintf(op, opleft,
 747                                                             "\\%03o", *dp);
 748                                                         op += 4;
 749                                                         opleft -= 4;
 750                                                 }
 751                                         } else if (*dp == '"' ||
 752                                             *dp == '\'' ||
 753                                             *dp == '$' ||
 754                                             *dp == '`' ||
 755                                             *dp == '\\') {
 756                                                 *op++ = '\\';
 757                                                 *op++ = *dp;
 758                                                 opleft -= 2;
 759                                         } else {
 760                                                 *op++ = *dp;
 761                                                 opleft--;
 762                                         }
 763                                 }
 764                                 if (emit_quotes) {
 765                                         *op++ = '"';
 766                                         opleft--;
 767                                 }
 768
 769                                 *op = 0;
 770                                 break;
 771                         case 'I':
 772                                 foo.s_addr = htonl(getULong(dp));
 773                                 opcount = strlcpy(op, inet_ntoa(foo), opleft);
 774                                 if (opcount >= opleft)
 775                                         goto toobig;
 776                                 opleft -= opcount;
 777                                 dp += 4;
 778                                 break;
 779                         case 'l':
 780                                 opcount = snprintf(op, opleft, "%ld",
 781                                     (long)getLong(dp));
 782                                 if (opcount >= opleft || opcount == -1)
 783                                         goto toobig;
 784                                 opleft -= opcount;
 785                                 dp += 4;
 786                                 break;
 787                         case 'L':
 788                                 opcount = snprintf(op, opleft, "%lu",
 789                                     (unsigned long)getULong(dp));
 790                                 if (opcount >= opleft || opcount == -1)
 791                                         goto toobig;
 792                                 opleft -= opcount;
 793                                 dp += 4;
 794                                 break;
 795                         case 's':
 796                                 opcount = snprintf(op, opleft, "%d",
 797                                     getShort(dp));
 798                                 if (opcount >= opleft || opcount == -1)
 799                                         goto toobig;
 800                                 opleft -= opcount;
 801                                 dp += 2;
 802                                 break;
 803                         case 'S':
 804                                 opcount = snprintf(op, opleft, "%u",
 805                                     getUShort(dp));
 806                                 if (opcount >= opleft || opcount == -1)
 807                                         goto toobig;
 808                                 opleft -= opcount;
 809                                 dp += 2;
 810                                 break;
 811                         case 'b':
 812                                 opcount = snprintf(op, opleft, "%d",
 813                                     *(char *)dp++);
 814                                 if (opcount >= opleft || opcount == -1)
 815                                         goto toobig;
 816                                 opleft -= opcount;
 817                                 break;
 818                         case 'B':
 819                                 opcount = snprintf(op, opleft, "%d", *dp++);
 820                                 if (opcount >= opleft || opcount == -1)
 821                                         goto toobig;
 822                                 opleft -= opcount;
 823                                 break;
 824                         case 'x':
 825                                 opcount = snprintf(op, opleft, "%x", *dp++);
 826                                 if (opcount >= opleft || opcount == -1)
 827                                         goto toobig;
 828                                 opleft -= opcount;
 829                                 break;
 830                         case 'f':
 831                                 opcount = strlcpy(op,
 832                                     *dp++ ? "true" : "false", opleft);
 833                                 if (opcount >= opleft)
 834                                         goto toobig;
 835                                 opleft -= opcount;
 836                                 break;
 837                         default:
 838                                 warning("Unexpected format code %c", fmtbuf[j]);
 839                         }
 840                         op += strlen(op);
 841                         opleft -= strlen(op);
 842                         if (opleft < 1)
 843                                 goto toobig;
 844                         if (j + 1 < numelem && comma != ':') {
 845                                 *op++ = ' ';
 846                                 opleft--;
 847                         }
 848                 }
 849                 if (i + 1 < numhunk) {
 850                         *op++ = comma;
 851                         opleft--;
 852                 }
 853                 if (opleft < 1)
 854                         goto toobig;
 855
 856         }
 857         return (optbuf);
 858  toobig:
 859         warning("dhcp option too large");
 860         return ("<error>");
 861 }
 862
 863 void
 864 do_packet(struct interface_info *interface, struct dhcp_packet *packet,
 865     int len, unsigned int from_port, struct iaddr from, struct hardware *hfrom)
 866 {
 867         struct packet tp;
 868         int i;
 869
 870         if (packet->hlen > sizeof(packet->chaddr)) {
 871                 note("Discarding packet with invalid hlen.");
 872                 return;
 873         }
 874
 875         memset(&tp, 0, sizeof(tp));
 876         tp.raw = packet;
 877         tp.packet_length = len;
 878         tp.client_port = from_port;
 879         tp.client_addr = from;
 880         tp.interface = interface;
 881         tp.haddr = hfrom;
 882
 883         parse_options(&tp);
 884         if (tp.options_valid &&
 885             tp.options[DHO_DHCP_MESSAGE_TYPE].data)
 886                 tp.packet_type = tp.options[DHO_DHCP_MESSAGE_TYPE].data[0];
 887         if (tp.packet_type)
 888                 dhcp(&tp);
 889         else
 890                 bootp(&tp);
 891
 892         /* Free the data associated with the options. */
 893         for (i = 0; i < 256; i++)
 894                 if (tp.options[i].len && tp.options[i].data)
 895                         free(tp.options[i].data);
 896 }