sbin/dhclient/options.c

   1 /*      $OpenBSD: options.c,v 1.15 2004/12/26 03:17:07 deraadt Exp $    */
   2
   3 /* DHCP options parsing and reassembly. */
   4
   5 /*
   6  * Copyright (c) 1995, 1996, 1997, 1998 The Internet Software Consortium.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  *
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  * 3. Neither the name of The Internet Software Consortium nor the names
  19  *    of its contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
  23  * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
  24  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  25  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  26  * DISCLAIMED.  IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
  27  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  29  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
  30  * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  31  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  32  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  33  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  34  * SUCH DAMAGE.
  35  *
  36  * This software has been written for the Internet Software Consortium
  37  * by Ted Lemon <mellon@fugue.com> in cooperation with Vixie
  38  * Enterprises.  To learn more about the Internet Software Consortium,
  39  * see ``http://www.vix.com/isc''.  To learn more about Vixie
  40  * Enterprises, see ``http://www.vix.com''.
  41  */
  42
  43 #include <sys/cdefs.h>
  44 __FBSDID("$FreeBSD$");
  45
  46 #include <ctype.h>
  47
  48 #define DHCP_OPTION_DATA
  49 #include "dhcpd.h"
  50
  51 int bad_options = 0;
  52 int bad_options_max = 5;
  53
  54 void    parse_options(struct packet *);
  55 void    parse_option_buffer(struct packet *, unsigned char *, int);
  56 unsigned store_options(unsigned char *, int, struct tree_cache **,
  57             unsigned char *, int, int, int, int);
  58 void    expand_domain_search(struct packet *packet);
  59 int     find_search_domain_name_len(struct option_data *option, size_t *offset);
  60 void    expand_search_domain_name(struct option_data *option, size_t *offset,
  61             unsigned char **domain_search);
  62
  63
  64 /*
  65  * Parse all available options out of the specified packet.
  66  */
  67 void
  68 parse_options(struct packet *packet)
  69 {
  70         /* Initially, zero all option pointers. */
  71         memset(packet->options, 0, sizeof(packet->options));
  72
  73         /* If we don't see the magic cookie, there's nothing to parse. */
  74         if (memcmp(packet->raw->options, DHCP_OPTIONS_COOKIE, 4)) {
  75                 packet->options_valid = 0;
  76                 return;
  77         }
  78
  79         /*
  80          * Go through the options field, up to the end of the packet or
  81          * the End field.
  82          */
  83         parse_option_buffer(packet, &packet->raw->options[4],
  84             packet->packet_length - DHCP_FIXED_NON_UDP - 4);
  85
  86         /*
  87          * If we parsed a DHCP Option Overload option, parse more
  88          * options out of the buffer(s) containing them.
  89          */
  90         if (packet->options_valid &&
  91             packet->options[DHO_DHCP_OPTION_OVERLOAD].data) {
  92                 if (packet->options[DHO_DHCP_OPTION_OVERLOAD].data[0] & 1)
  93                         parse_option_buffer(packet,
  94                             (unsigned char *)packet->raw->file,
  95                             sizeof(packet->raw->file));
  96                 if (packet->options[DHO_DHCP_OPTION_OVERLOAD].data[0] & 2)
  97                         parse_option_buffer(packet,
  98                             (unsigned char *)packet->raw->sname,
  99                             sizeof(packet->raw->sname));
 100         }
 101
 102         /* Expand DHCP Domain Search option. */
 103         if (packet->options_valid) {
 104                 expand_domain_search(packet);
 105         }
 106 }
 107
 108 /*
 109  * Parse options out of the specified buffer, storing addresses of
 110  * option values in packet->options and setting packet->options_valid if
 111  * no errors are encountered.
 112  */
 113 void
 114 parse_option_buffer(struct packet *packet,
 115     unsigned char *buffer, int length)
 116 {
 117         unsigned char *s, *t, *end = buffer + length;
 118         int len, code;
 119
 120         for (s = buffer; *s != DHO_END && s < end; ) {
 121                 code = s[0];
 122
 123                 /* Pad options don't have a length - just skip them. */
 124                 if (code == DHO_PAD) {
 125                         s++;
 126                         continue;
 127                 }
 128                 if (s + 2 > end) {
 129                         len = 65536;
 130                         goto bogus;
 131                 }
 132
 133                 /*
 134                  * All other fields (except end, see above) have a
 135                  * one-byte length.
 136                  */
 137                 len = s[1];
 138
 139                 /*
 140                  * If the length is outrageous, silently skip the rest,
 141                  * and mark the packet bad. Unfortunately some crappy
 142                  * dhcp servers always seem to give us garbage on the
 143                  * end of a packet. so rather than keep refusing, give
 144                  * up and try to take one after seeing a few without
 145                  * anything good.
 146                  */
 147                 if (s + len + 2 > end) {
 148                     bogus:
 149                         bad_options++;
 150                         warning("option %s (%d) %s.",
 151                             dhcp_options[code].name, len,
 152                             "larger than buffer");
 153                         if (bad_options == bad_options_max) {
 154                                 packet->options_valid = 1;
 155                                 bad_options = 0;
 156                                 warning("Many bogus options seen in offers. "
 157                                     "Taking this offer in spite of bogus "
 158                                     "options - hope for the best!");
 159                         } else {
 160                                 warning("rejecting bogus offer.");
 161                                 packet->options_valid = 0;
 162                         }
 163                         return;
 164                 }
 165                 /*
 166                  * If we haven't seen this option before, just make
 167                  * space for it and copy it there.
 168                  */
 169                 if (!packet->options[code].data) {
 170                         if (!(t = calloc(1, len + 1)))
 171                                 error("Can't allocate storage for option %s.",
 172                                     dhcp_options[code].name);
 173                         /*
 174                          * Copy and NUL-terminate the option (in case
 175                          * it's an ASCII string.
 176                          */
 177                         memcpy(t, &s[2], len);
 178                         t[len] = 0;
 179                         packet->options[code].len = len;
 180                         packet->options[code].data = t;
 181                 } else {
 182                         /*
 183                          * If it's a repeat, concatenate it to whatever
 184                          * we last saw.   This is really only required
 185                          * for clients, but what the heck...
 186                          */
 187                         t = calloc(1, len + packet->options[code].len + 1);
 188                         if (!t)
 189                                 error("Can't expand storage for option %s.",
 190                                     dhcp_options[code].name);
 191                         memcpy(t, packet->options[code].data,
 192                                 packet->options[code].len);
 193                         memcpy(t + packet->options[code].len,
 194                                 &s[2], len);
 195                         packet->options[code].len += len;
 196                         t[packet->options[code].len] = 0;
 197                         free(packet->options[code].data);
 198                         packet->options[code].data = t;
 199                 }
 200                 s += len + 2;
 201         }
 202         packet->options_valid = 1;
 203 }
 204
 205 /*
 206  * Expand DHCP Domain Search option. The value of this option is
 207  * encoded like DNS' list of labels. See:
 208  *   RFC 3397
 209  *   RFC 1035
 210  */
 211 void
 212 expand_domain_search(struct packet *packet)
 213 {
 214         size_t offset;
 215         int expanded_len, next_domain_len;
 216         struct option_data *option;
 217         unsigned char *domain_search, *cursor;
 218
 219         if (packet->options[DHO_DOMAIN_SEARCH].data == NULL)
 220                 return;
 221
 222         option = &packet->options[DHO_DOMAIN_SEARCH];
 223
 224         /* Compute final expanded length. */
 225         expanded_len = 0;
 226         offset = 0;
 227         while (offset < option->len) {
 228                 next_domain_len = find_search_domain_name_len(option, &offset);
 229                 if (next_domain_len < 0)
 230                         /* The Domain Search option value is invalid. */
 231                         return;
 232
 233                 /* We add 1 for the space between domain names. */
 234                 expanded_len += next_domain_len + 1;
 235         }
 236         if (expanded_len > 0)
 237                 /* Remove 1 for the superfluous trailing space. */
 238                 --expanded_len;
 239
 240         domain_search = malloc(expanded_len + 1);
 241         if (domain_search == NULL)
 242                 error("Can't allocate storage for expanded domain-search\n");
 243
 244         offset = 0;
 245         cursor = domain_search;
 246         while (offset < option->len) {
 247                 expand_search_domain_name(option, &offset, &cursor);
 248                 cursor[0] = ' ';
 249                 cursor++;
 250         }
 251         domain_search[expanded_len] = '\0';
 252
 253         free(option->data);
 254         option->len = expanded_len;
 255         option->data = domain_search;
 256 }
 257
 258 int
 259 find_search_domain_name_len(struct option_data *option, size_t *offset)
 260 {
 261         int domain_name_len, label_len, pointed_len;
 262         size_t i, pointer;
 263
 264         domain_name_len = 0;
 265
 266         i = *offset;
 267         while (i < option->len) {
 268                 label_len = option->data[i];
 269                 if (label_len == 0) {
 270                         /*
 271                          * A zero-length label marks the end of this
 272                          * domain name.
 273                          */
 274                         *offset = i + 1;
 275                         return (domain_name_len);
 276                 } else if (label_len & 0xC0) {
 277                         /* This is a pointer to another list of labels. */
 278                         if (i + 1 >= option->len) {
 279                                 /* The pointer is truncated. */
 280                                 warning("Truncated pointer in DHCP Domain "
 281                                     "Search option.");
 282                                 return (-1);
 283                         }
 284
 285                         pointer = ((label_len & ~(0xC0)) << 8) +
 286                             option->data[i + 1];
 287                         if (pointer >= *offset) {
 288                                 /*
 289                                  * The pointer must indicate a prior
 290                                  * occurrence.
 291                                  */
 292                                 warning("Invalid forward pointer in DHCP "
 293                                     "Domain Search option compression.");
 294                                 return (-1);
 295                         }
 296
 297                         pointed_len = find_search_domain_name_len(option,
 298                             &pointer);
 299                         if (pointed_len < 0)
 300                                 return (-1);
 301                         domain_name_len += pointed_len;
 302
 303                         *offset = i + 2;
 304                         return (domain_name_len);
 305                 }
 306
 307                 if (i + label_len >= option->len) {
 308                         warning("Truncated label in DHCP Domain Search "
 309                             "option.");
 310                         return (-1);
 311                 }
 312
 313                 /*
 314                  * Update the domain name length with the length of the
 315                  * current label, plus a trailing dot ('.').
 316                  */
 317                 domain_name_len += label_len + 1;
 318
 319                 /* Move cursor. */
 320                 i += label_len + 1;
 321         }
 322
 323         warning("Truncated DHCP Domain Search option.");
 324
 325         return (-1);
 326 }
 327
 328 void
 329 expand_search_domain_name(struct option_data *option, size_t *offset,
 330     unsigned char **domain_search)
 331 {
 332         int label_len;
 333         size_t i, pointer;
 334         unsigned char *cursor;
 335
 336         /*
 337          * This is the same loop than the function above
 338          * (find_search_domain_name_len). Therefore, we remove checks,
 339          * they're already done. Here, we just make the copy.
 340          */
 341         i = *offset;
 342         cursor = *domain_search;
 343         while (i < option->len) {
 344                 label_len = option->data[i];
 345                 if (label_len == 0) {
 346                         /*
 347                          * A zero-length label marks the end of this
 348                          * domain name.
 349                          */
 350                         *offset = i + 1;
 351                         *domain_search = cursor;
 352                         return;
 353                 } else if (label_len & 0xC0) {
 354                         /* This is a pointer to another list of labels. */
 355                         pointer = ((label_len & ~(0xC0)) << 8) +
 356                             option->data[i + 1];
 357
 358                         expand_search_domain_name(option, &pointer, &cursor);
 359
 360                         *offset = i + 2;
 361                         *domain_search = cursor;
 362                         return;
 363                 }
 364
 365                 /* Copy the label found. */
 366                 memcpy(cursor, option->data + i + 1, label_len);
 367                 cursor[label_len] = '.';
 368
 369                 /* Move cursor. */
 370                 i += label_len + 1;
 371                 cursor += label_len + 1;
 372         }
 373 }
 374
 375 /*
 376  * cons options into a big buffer, and then split them out into the
 377  * three separate buffers if needed.  This allows us to cons up a set of
 378  * vendor options using the same routine.
 379  */
 380 int
 381 cons_options(struct packet *inpacket, struct dhcp_packet *outpacket,
 382     int mms, struct tree_cache **options,
 383     int overload, /* Overload flags that may be set. */
 384     int terminate, int bootpp, u_int8_t *prl, int prl_len)
 385 {
 386         unsigned char priority_list[300], buffer[4096];
 387         unsigned priority_len;
 388         size_t main_buffer_size;
 389         unsigned option_size, bufix, mainbufix;
 390         int length;
 391
 392         /*
 393          * If the client has provided a maximum DHCP message size, use
 394          * that; otherwise, if it's BOOTP, only 64 bytes; otherwise use
 395          * up to the minimum IP MTU size (576 bytes).
 396          *
 397          * XXX if a BOOTP client specifies a max message size, we will
 398          * honor it.
 399          */
 400         if (!mms &&
 401             inpacket &&
 402             inpacket->options[DHO_DHCP_MAX_MESSAGE_SIZE].data &&
 403             (inpacket->options[DHO_DHCP_MAX_MESSAGE_SIZE].len >=
 404             sizeof(u_int16_t)))
 405                 mms = getUShort(
 406                     inpacket->options[DHO_DHCP_MAX_MESSAGE_SIZE].data);
 407
 408         if (mms)
 409                 main_buffer_size = mms - DHCP_FIXED_LEN;
 410         else if (bootpp)
 411                 main_buffer_size = 64;
 412         else
 413                 main_buffer_size = 576 - DHCP_FIXED_LEN;
 414
 415         if (main_buffer_size > sizeof(buffer))
 416                 main_buffer_size = sizeof(buffer);
 417
 418         /* Preload the option priority list with mandatory options. */
 419         priority_len = 0;
 420         priority_list[priority_len++] = DHO_DHCP_MESSAGE_TYPE;
 421         priority_list[priority_len++] = DHO_DHCP_SERVER_IDENTIFIER;
 422         priority_list[priority_len++] = DHO_DHCP_LEASE_TIME;
 423         priority_list[priority_len++] = DHO_DHCP_MESSAGE;
 424
 425         /*
 426          * If the client has provided a list of options that it wishes
 427          * returned, use it to prioritize.  Otherwise, prioritize based
 428          * on the default priority list.
 429          */
 430         if (inpacket &&
 431             inpacket->options[DHO_DHCP_PARAMETER_REQUEST_LIST].data) {
 432                 unsigned prlen =
 433                     inpacket->options[DHO_DHCP_PARAMETER_REQUEST_LIST].len;
 434                 if (prlen + priority_len > sizeof(priority_list))
 435                         prlen = sizeof(priority_list) - priority_len;
 436
 437                 memcpy(&priority_list[priority_len],
 438                     inpacket->options[DHO_DHCP_PARAMETER_REQUEST_LIST].data,
 439                     prlen);
 440                 priority_len += prlen;
 441                 prl = priority_list;
 442         } else if (prl) {
 443                 if (prl_len + priority_len > sizeof(priority_list))
 444                         prl_len = sizeof(priority_list) - priority_len;
 445
 446                 memcpy(&priority_list[priority_len], prl, prl_len);
 447                 priority_len += prl_len;
 448                 prl = priority_list;
 449         } else {
 450                 memcpy(&priority_list[priority_len],
 451                     dhcp_option_default_priority_list,
 452                     sizeof_dhcp_option_default_priority_list);
 453                 priority_len += sizeof_dhcp_option_default_priority_list;
 454         }
 455
 456         /* Copy the options into the big buffer... */
 457         option_size = store_options(
 458             buffer,
 459             (main_buffer_size - 7 + ((overload & 1) ? DHCP_FILE_LEN : 0) +
 460                 ((overload & 2) ? DHCP_SNAME_LEN : 0)),
 461             options, priority_list, priority_len, main_buffer_size,
 462             (main_buffer_size + ((overload & 1) ? DHCP_FILE_LEN : 0)),
 463             terminate);
 464
 465         /* Put the cookie up front... */
 466         memcpy(outpacket->options, DHCP_OPTIONS_COOKIE, 4);
 467         mainbufix = 4;
 468
 469         /*
 470          * If we're going to have to overload, store the overload option
 471          * at the beginning.  If we can, though, just store the whole
 472          * thing in the packet's option buffer and leave it at that.
 473          */
 474         if (option_size <= main_buffer_size - mainbufix) {
 475                 memcpy(&outpacket->options[mainbufix],
 476                     buffer, option_size);
 477                 mainbufix += option_size;
 478                 if (mainbufix < main_buffer_size)
 479                         outpacket->options[mainbufix++] = DHO_END;
 480                 length = DHCP_FIXED_NON_UDP + mainbufix;
 481         } else {
 482                 outpacket->options[mainbufix++] = DHO_DHCP_OPTION_OVERLOAD;
 483                 outpacket->options[mainbufix++] = 1;
 484                 if (option_size >
 485                     main_buffer_size - mainbufix + DHCP_FILE_LEN)
 486                         outpacket->options[mainbufix++] = 3;
 487                 else
 488                         outpacket->options[mainbufix++] = 1;
 489
 490                 memcpy(&outpacket->options[mainbufix],
 491                     buffer, main_buffer_size - mainbufix);
 492                 bufix = main_buffer_size - mainbufix;
 493                 length = DHCP_FIXED_NON_UDP + mainbufix;
 494                 if (overload & 1) {
 495                         if (option_size - bufix <= DHCP_FILE_LEN) {
 496                                 memcpy(outpacket->file,
 497                                     &buffer[bufix], option_size - bufix);
 498                                 mainbufix = option_size - bufix;
 499                                 if (mainbufix < DHCP_FILE_LEN)
 500                                         outpacket->file[mainbufix++] = (char)DHO_END;
 501                                 while (mainbufix < DHCP_FILE_LEN)
 502                                         outpacket->file[mainbufix++] = (char)DHO_PAD;
 503                         } else {
 504                                 memcpy(outpacket->file,
 505                                     &buffer[bufix], DHCP_FILE_LEN);
 506                                 bufix += DHCP_FILE_LEN;
 507                         }
 508                 }
 509                 if ((overload & 2) && option_size < bufix) {
 510                         memcpy(outpacket->sname,
 511                             &buffer[bufix], option_size - bufix);
 512
 513                         mainbufix = option_size - bufix;
 514                         if (mainbufix < DHCP_SNAME_LEN)
 515                                 outpacket->file[mainbufix++] = (char)DHO_END;
 516                         while (mainbufix < DHCP_SNAME_LEN)
 517                                 outpacket->file[mainbufix++] = (char)DHO_PAD;
 518                 }
 519         }
 520         return (length);
 521 }
 522
 523 /*
 524  * Store all the requested options into the requested buffer.
 525  */
 526 unsigned
 527 store_options(unsigned char *buffer, int buflen, struct tree_cache **options,
 528     unsigned char *priority_list, int priority_len, int first_cutoff,
 529     int second_cutoff, int terminate)
 530 {
 531         int bufix = 0, option_stored[256], i, ix, tto;
 532
 533         /* Zero out the stored-lengths array. */
 534         memset(option_stored, 0, sizeof(option_stored));
 535
 536         /*
 537          * Copy out the options in the order that they appear in the
 538          * priority list...
 539          */
 540         for (i = 0; i < priority_len; i++) {
 541                 /* Code for next option to try to store. */
 542                 int code = priority_list[i];
 543                 int optstart;
 544
 545                 /*
 546                  * Number of bytes left to store (some may already have
 547                  * been stored by a previous pass).
 548                  */
 549                 int length;
 550
 551                 /* If no data is available for this option, skip it. */
 552                 if (!options[code]) {
 553                         continue;
 554                 }
 555
 556                 /*
 557                  * The client could ask for things that are mandatory,
 558                  * in which case we should avoid storing them twice...
 559                  */
 560                 if (option_stored[code])
 561                         continue;
 562                 option_stored[code] = 1;
 563
 564                 /* We should now have a constant length for the option. */
 565                 length = options[code]->len;
 566
 567                 /* Do we add a NUL? */
 568                 if (terminate && dhcp_options[code].format[0] == 't') {
 569                         length++;
 570                         tto = 1;
 571                 } else
 572                         tto = 0;
 573
 574                 /* Try to store the option. */
 575
 576                 /*
 577                  * If the option's length is more than 255, we must
 578                  * store it in multiple hunks.   Store 255-byte hunks
 579                  * first.  However, in any case, if the option data will
 580                  * cross a buffer boundary, split it across that
 581                  * boundary.
 582                  */
 583                 ix = 0;
 584
 585                 optstart = bufix;
 586                 while (length) {
 587                         unsigned char incr = length > 255 ? 255 : length;
 588
 589                         /*
 590                          * If this hunk of the buffer will cross a
 591                          * boundary, only go up to the boundary in this
 592                          * pass.
 593                          */
 594                         if (bufix < first_cutoff &&
 595                             bufix + incr > first_cutoff)
 596                                 incr = first_cutoff - bufix;
 597                         else if (bufix < second_cutoff &&
 598                             bufix + incr > second_cutoff)
 599                                 incr = second_cutoff - bufix;
 600
 601                         /*
 602                          * If this option is going to overflow the
 603                          * buffer, skip it.
 604                          */
 605                         if (bufix + 2 + incr > buflen) {
 606                                 bufix = optstart;
 607                                 break;
 608                         }
 609
 610                         /* Everything looks good - copy it in! */
 611                         buffer[bufix] = code;
 612                         buffer[bufix + 1] = incr;
 613                         if (tto && incr == length) {
 614                                 memcpy(buffer + bufix + 2,
 615                                     options[code]->value + ix, incr - 1);
 616                                 buffer[bufix + 2 + incr - 1] = 0;
 617                         } else
 618                                 memcpy(buffer + bufix + 2,
 619                                     options[code]->value + ix, incr);
 620                         length -= incr;
 621                         ix += incr;
 622                         bufix += 2 + incr;
 623                 }
 624         }
 625         return (bufix);
 626 }
 627
 628 /*
 629  * Format the specified option so that a human can easily read it.
 630  */
 631 const char *
 632 pretty_print_option(unsigned int code, unsigned char *data, int len,
 633     int emit_commas, int emit_quotes)
 634 {
 635         static char optbuf[32768]; /* XXX */
 636         int hunksize = 0, numhunk = -1, numelem = 0;
 637         char fmtbuf[32], *op = optbuf;
 638         int i, j, k, opleft = sizeof(optbuf);
 639         unsigned char *dp = data;
 640         struct in_addr foo;
 641         char comma;
 642
 643         /* Code should be between 0 and 255. */
 644         if (code > 255)
 645                 error("pretty_print_option: bad code %d", code);
 646
 647         if (emit_commas)
 648                 comma = ',';
 649         else
 650                 comma = ' ';
 651
 652         /* Figure out the size of the data. */
 653         for (i = 0; dhcp_options[code].format[i]; i++) {
 654                 if (!numhunk) {
 655                         warning("%s: Excess information in format string: %s",
 656                             dhcp_options[code].name,
 657                             &(dhcp_options[code].format[i]));
 658                         break;
 659                 }
 660                 numelem++;
 661                 fmtbuf[i] = dhcp_options[code].format[i];
 662                 switch (dhcp_options[code].format[i]) {
 663                 case 'A':
 664                         --numelem;
 665                         fmtbuf[i] = 0;
 666                         numhunk = 0;
 667                         break;
 668                 case 'X':
 669                         for (k = 0; k < len; k++)
 670                                 if (!isascii(data[k]) ||
 671                                     !isprint(data[k]))
 672                                         break;
 673                         if (k == len) {
 674                                 fmtbuf[i] = 't';
 675                                 numhunk = -2;
 676                         } else {
 677                                 fmtbuf[i] = 'x';
 678                                 hunksize++;
 679                                 comma = ':';
 680                                 numhunk = 0;
 681                         }
 682                         fmtbuf[i + 1] = 0;
 683                         break;
 684                 case 't':
 685                         fmtbuf[i] = 't';
 686                         fmtbuf[i + 1] = 0;
 687                         numhunk = -2;
 688                         break;
 689                 case 'I':
 690                 case 'l':
 691                 case 'L':
 692                         hunksize += 4;
 693                         break;
 694                 case 's':
 695                 case 'S':
 696                         hunksize += 2;
 697                         break;
 698                 case 'b':
 699                 case 'B':
 700                 case 'f':
 701                         hunksize++;
 702                         break;
 703                 case 'e':
 704                         break;
 705                 default:
 706                         warning("%s: garbage in format string: %s",
 707                             dhcp_options[code].name,
 708                             &(dhcp_options[code].format[i]));
 709                         break;
 710                 }
 711         }
 712
 713         /* Check for too few bytes... */
 714         if (hunksize > len) {
 715                 warning("%s: expecting at least %d bytes; got %d",
 716                     dhcp_options[code].name, hunksize, len);
 717                 return ("<error>");
 718         }
 719         /* Check for too many bytes... */
 720         if (numhunk == -1 && hunksize < len)
 721                 warning("%s: %d extra bytes",
 722                     dhcp_options[code].name, len - hunksize);
 723
 724         /* If this is an array, compute its size. */
 725         if (!numhunk)
 726                 numhunk = len / hunksize;
 727         /* See if we got an exact number of hunks. */
 728         if (numhunk > 0 && numhunk * hunksize < len)
 729                 warning("%s: %d extra bytes at end of array",
 730                     dhcp_options[code].name, len - numhunk * hunksize);
 731
 732         /* A one-hunk array prints the same as a single hunk. */
 733         if (numhunk < 0)
 734                 numhunk = 1;
 735
 736         /* Cycle through the array (or hunk) printing the data. */
 737         for (i = 0; i < numhunk; i++) {
 738                 for (j = 0; j < numelem; j++) {
 739                         int opcount;
 740                         switch (fmtbuf[j]) {
 741                         case 't':
 742                                 if (emit_quotes) {
 743                                         *op++ = '"';
 744                                         opleft--;
 745                                 }
 746                                 for (; dp < data + len; dp++) {
 747                                         if (!isascii(*dp) ||
 748                                             !isprint(*dp)) {
 749                                                 if (dp + 1 != data + len ||
 750                                                     *dp != 0) {
 751                                                         snprintf(op, opleft,
 752                                                             "\\%03o", *dp);
 753                                                         op += 4;
 754                                                         opleft -= 4;
 755                                                 }
 756                                         } else if (*dp == '"' ||
 757                                             *dp == '\'' ||
 758                                             *dp == '$' ||
 759                                             *dp == '`' ||
 760                                             *dp == '\\') {
 761                                                 *op++ = '\\';
 762                                                 *op++ = *dp;
 763                                                 opleft -= 2;
 764                                         } else {
 765                                                 *op++ = *dp;
 766                                                 opleft--;
 767                                         }
 768                                 }
 769                                 if (emit_quotes) {
 770                                         *op++ = '"';
 771                                         opleft--;
 772                                 }
 773
 774                                 *op = 0;
 775                                 break;
 776                         case 'I':
 777                                 foo.s_addr = htonl(getULong(dp));
 778                                 opcount = strlcpy(op, inet_ntoa(foo), opleft);
 779                                 if (opcount >= opleft)
 780                                         goto toobig;
 781                                 opleft -= opcount;
 782                                 dp += 4;
 783                                 break;
 784                         case 'l':
 785                                 opcount = snprintf(op, opleft, "%ld",
 786                                     (long)getLong(dp));
 787                                 if (opcount >= opleft || opcount == -1)
 788                                         goto toobig;
 789                                 opleft -= opcount;
 790                                 dp += 4;
 791                                 break;
 792                         case 'L':
 793                                 opcount = snprintf(op, opleft, "%lu",
 794                                     (unsigned long)getULong(dp));
 795                                 if (opcount >= opleft || opcount == -1)
 796                                         goto toobig;
 797                                 opleft -= opcount;
 798                                 dp += 4;
 799                                 break;
 800                         case 's':
 801                                 opcount = snprintf(op, opleft, "%d",
 802                                     getShort(dp));
 803                                 if (opcount >= opleft || opcount == -1)
 804                                         goto toobig;
 805                                 opleft -= opcount;
 806                                 dp += 2;
 807                                 break;
 808                         case 'S':
 809                                 opcount = snprintf(op, opleft, "%u",
 810                                     getUShort(dp));
 811                                 if (opcount >= opleft || opcount == -1)
 812                                         goto toobig;
 813                                 opleft -= opcount;
 814                                 dp += 2;
 815                                 break;
 816                         case 'b':
 817                                 opcount = snprintf(op, opleft, "%d",
 818                                     *(char *)dp++);
 819                                 if (opcount >= opleft || opcount == -1)
 820                                         goto toobig;
 821                                 opleft -= opcount;
 822                                 break;
 823                         case 'B':
 824                                 opcount = snprintf(op, opleft, "%d", *dp++);
 825                                 if (opcount >= opleft || opcount == -1)
 826                                         goto toobig;
 827                                 opleft -= opcount;
 828                                 break;
 829                         case 'x':
 830                                 opcount = snprintf(op, opleft, "%x", *dp++);
 831                                 if (opcount >= opleft || opcount == -1)
 832                                         goto toobig;
 833                                 opleft -= opcount;
 834                                 break;
 835                         case 'f':
 836                                 opcount = strlcpy(op,
 837                                     *dp++ ? "true" : "false", opleft);
 838                                 if (opcount >= opleft)
 839                                         goto toobig;
 840                                 opleft -= opcount;
 841                                 break;
 842                         default:
 843                                 warning("Unexpected format code %c", fmtbuf[j]);
 844                         }
 845                         op += strlen(op);
 846                         opleft -= strlen(op);
 847                         if (opleft < 1)
 848                                 goto toobig;
 849                         if (j + 1 < numelem && comma != ':') {
 850                                 *op++ = ' ';
 851                                 opleft--;
 852                         }
 853                 }
 854                 if (i + 1 < numhunk) {
 855                         *op++ = comma;
 856                         opleft--;
 857                 }
 858                 if (opleft < 1)
 859                         goto toobig;
 860
 861         }
 862         return (optbuf);
 863  toobig:
 864         warning("dhcp option too large");
 865         return ("<error>");
 866 }
 867
 868 void
 869 do_packet(struct interface_info *interface, struct dhcp_packet *packet,
 870     int len, unsigned int from_port, struct iaddr from, struct hardware *hfrom)
 871 {
 872         struct packet tp;
 873         int i;
 874
 875         if (packet->hlen > sizeof(packet->chaddr)) {
 876                 note("Discarding packet with invalid hlen.");
 877                 return;
 878         }
 879
 880         memset(&tp, 0, sizeof(tp));
 881         tp.raw = packet;
 882         tp.packet_length = len;
 883         tp.client_port = from_port;
 884         tp.client_addr = from;
 885         tp.interface = interface;
 886         tp.haddr = hfrom;
 887
 888         parse_options(&tp);
 889         if (tp.options_valid &&
 890             tp.options[DHO_DHCP_MESSAGE_TYPE].data)
 891                 tp.packet_type = tp.options[DHO_DHCP_MESSAGE_TYPE].data[0];
 892         if (tp.packet_type)
 893                 dhcp(&tp);
 894         else
 895                 bootp(&tp);
 896
 897         /* Free the data associated with the options. */
 898         for (i = 0; i < 256; i++)
 899                 if (tp.options[i].len && tp.options[i].data)
 900                         free(tp.options[i].data);
 901 }