sbin/dhclient/options.c

   1 /*      $OpenBSD: options.c,v 1.15 2004/12/26 03:17:07 deraadt Exp $    */
   2
   3 /* DHCP options parsing and reassembly. */
   4
   5 /*-
   6  * SPDX-License-Identifier: BSD-3-Clause
   7  *
   8  * Copyright (c) 1995, 1996, 1997, 1998 The Internet Software Consortium.
   9  * All rights reserved.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  *
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer.
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  * 3. Neither the name of The Internet Software Consortium nor the names
  21  *    of its contributors may be used to endorse or promote products derived
  22  *    from this software without specific prior written permission.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
  25  * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
  26  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  27  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  28  * DISCLAIMED.  IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
  29  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  30  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  31  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
  32  * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  33  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  34  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  35  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  36  * SUCH DAMAGE.
  37  *
  38  * This software has been written for the Internet Software Consortium
  39  * by Ted Lemon <mellon@fugue.com> in cooperation with Vixie
  40  * Enterprises.  To learn more about the Internet Software Consortium,
  41  * see ``http://www.vix.com/isc''.  To learn more about Vixie
  42  * Enterprises, see ``http://www.vix.com''.
  43  */
  44
  45 #include <sys/cdefs.h>
  46 __FBSDID("$FreeBSD$");
  47
  48 #include <ctype.h>
  49
  50 #define DHCP_OPTION_DATA
  51 #include "dhcpd.h"
  52
  53 static int bad_options = 0;
  54 static int bad_options_max = 5;
  55
  56 void    parse_options(struct packet *);
  57 void    parse_option_buffer(struct packet *, unsigned char *, int);
  58 unsigned store_options(unsigned char *, int, struct tree_cache **,
  59             unsigned char *, int, int, int, int);
  60 void    expand_domain_search(struct packet *packet);
  61 int     find_search_domain_name_len(struct option_data *option, size_t *offset);
  62 void    expand_search_domain_name(struct option_data *option, size_t *offset,
  63             unsigned char **domain_search);
  64
  65
  66 /*
  67  * Parse all available options out of the specified packet.
  68  */
  69 void
  70 parse_options(struct packet *packet)
  71 {
  72         /* Initially, zero all option pointers. */
  73         memset(packet->options, 0, sizeof(packet->options));
  74
  75         /* If we don't see the magic cookie, there's nothing to parse. */
  76         if (memcmp(packet->raw->options, DHCP_OPTIONS_COOKIE, 4)) {
  77                 packet->options_valid = 0;
  78                 return;
  79         }
  80
  81         /*
  82          * Go through the options field, up to the end of the packet or
  83          * the End field.
  84          */
  85         parse_option_buffer(packet, &packet->raw->options[4],
  86             packet->packet_length - DHCP_FIXED_NON_UDP - 4);
  87
  88         /*
  89          * If we parsed a DHCP Option Overload option, parse more
  90          * options out of the buffer(s) containing them.
  91          */
  92         if (packet->options_valid &&
  93             packet->options[DHO_DHCP_OPTION_OVERLOAD].data) {
  94                 if (packet->options[DHO_DHCP_OPTION_OVERLOAD].data[0] & 1)
  95                         parse_option_buffer(packet,
  96                             (unsigned char *)packet->raw->file,
  97                             sizeof(packet->raw->file));
  98                 if (packet->options[DHO_DHCP_OPTION_OVERLOAD].data[0] & 2)
  99                         parse_option_buffer(packet,
 100                             (unsigned char *)packet->raw->sname,
 101                             sizeof(packet->raw->sname));
 102         }
 103
 104         /* Expand DHCP Domain Search option. */
 105         if (packet->options_valid) {
 106                 expand_domain_search(packet);
 107         }
 108 }
 109
 110 /*
 111  * Parse options out of the specified buffer, storing addresses of
 112  * option values in packet->options and setting packet->options_valid if
 113  * no errors are encountered.
 114  */
 115 void
 116 parse_option_buffer(struct packet *packet,
 117     unsigned char *buffer, int length)
 118 {
 119         unsigned char *s, *t, *end = buffer + length;
 120         int len, code;
 121
 122         for (s = buffer; *s != DHO_END && s < end; ) {
 123                 code = s[0];
 124
 125                 /* Pad options don't have a length - just skip them. */
 126                 if (code == DHO_PAD) {
 127                         s++;
 128                         continue;
 129                 }
 130                 if (s + 2 > end) {
 131                         len = 65536;
 132                         goto bogus;
 133                 }
 134
 135                 /*
 136                  * All other fields (except end, see above) have a
 137                  * one-byte length.
 138                  */
 139                 len = s[1];
 140
 141                 /*
 142                  * If the length is outrageous, silently skip the rest,
 143                  * and mark the packet bad. Unfortunately some crappy
 144                  * dhcp servers always seem to give us garbage on the
 145                  * end of a packet. so rather than keep refusing, give
 146                  * up and try to take one after seeing a few without
 147                  * anything good.
 148                  */
 149                 if (s + len + 2 > end) {
 150                     bogus:
 151                         bad_options++;
 152                         warning("option %s (%d) %s.",
 153                             dhcp_options[code].name, len,
 154                             "larger than buffer");
 155                         if (bad_options == bad_options_max) {
 156                                 packet->options_valid = 1;
 157                                 bad_options = 0;
 158                                 warning("Many bogus options seen in offers. "
 159                                     "Taking this offer in spite of bogus "
 160                                     "options - hope for the best!");
 161                         } else {
 162                                 warning("rejecting bogus offer.");
 163                                 packet->options_valid = 0;
 164                         }
 165                         return;
 166                 }
 167                 /*
 168                  * If we haven't seen this option before, just make
 169                  * space for it and copy it there.
 170                  */
 171                 if (!packet->options[code].data) {
 172                         if (!(t = calloc(1, len + 1)))
 173                                 error("Can't allocate storage for option %s.",
 174                                     dhcp_options[code].name);
 175                         /*
 176                          * Copy and NUL-terminate the option (in case
 177                          * it's an ASCII string.
 178                          */
 179                         memcpy(t, &s[2], len);
 180                         t[len] = 0;
 181                         packet->options[code].len = len;
 182                         packet->options[code].data = t;
 183                 } else {
 184                         /*
 185                          * If it's a repeat, concatenate it to whatever
 186                          * we last saw.   This is really only required
 187                          * for clients, but what the heck...
 188                          */
 189                         t = calloc(1, len + packet->options[code].len + 1);
 190                         if (!t)
 191                                 error("Can't expand storage for option %s.",
 192                                     dhcp_options[code].name);
 193                         memcpy(t, packet->options[code].data,
 194                                 packet->options[code].len);
 195                         memcpy(t + packet->options[code].len,
 196                                 &s[2], len);
 197                         packet->options[code].len += len;
 198                         t[packet->options[code].len] = 0;
 199                         free(packet->options[code].data);
 200                         packet->options[code].data = t;
 201                 }
 202                 s += len + 2;
 203         }
 204         packet->options_valid = 1;
 205 }
 206
 207 /*
 208  * Expand DHCP Domain Search option. The value of this option is
 209  * encoded like DNS' list of labels. See:
 210  *   RFC 3397
 211  *   RFC 1035
 212  */
 213 void
 214 expand_domain_search(struct packet *packet)
 215 {
 216         size_t offset;
 217         int expanded_len, next_domain_len;
 218         struct option_data *option;
 219         unsigned char *domain_search, *cursor;
 220
 221         if (packet->options[DHO_DOMAIN_SEARCH].data == NULL)
 222                 return;
 223
 224         option = &packet->options[DHO_DOMAIN_SEARCH];
 225
 226         /* Compute final expanded length. */
 227         expanded_len = 0;
 228         offset = 0;
 229         while (offset < option->len) {
 230                 next_domain_len = find_search_domain_name_len(option, &offset);
 231                 if (next_domain_len < 0)
 232                         /* The Domain Search option value is invalid. */
 233                         return;
 234
 235                 /* We add 1 for the space between domain names. */
 236                 expanded_len += next_domain_len + 1;
 237         }
 238         if (expanded_len > 0)
 239                 /* Remove 1 for the superfluous trailing space. */
 240                 --expanded_len;
 241
 242         domain_search = malloc(expanded_len + 1);
 243         if (domain_search == NULL)
 244                 error("Can't allocate storage for expanded domain-search\n");
 245
 246         offset = 0;
 247         cursor = domain_search;
 248         while (offset < option->len) {
 249                 expand_search_domain_name(option, &offset, &cursor);
 250                 cursor[0] = ' ';
 251                 cursor++;
 252         }
 253         domain_search[expanded_len] = '\0';
 254
 255         free(option->data);
 256         option->len = expanded_len;
 257         option->data = domain_search;
 258 }
 259
 260 int
 261 find_search_domain_name_len(struct option_data *option, size_t *offset)
 262 {
 263         int domain_name_len, label_len, pointed_len;
 264         size_t i, pointer;
 265
 266         domain_name_len = 0;
 267
 268         i = *offset;
 269         while (i < option->len) {
 270                 label_len = option->data[i];
 271                 if (label_len == 0) {
 272                         /*
 273                          * A zero-length label marks the end of this
 274                          * domain name.
 275                          */
 276                         *offset = i + 1;
 277                         return (domain_name_len);
 278                 } else if (label_len & 0xC0) {
 279                         /* This is a pointer to another list of labels. */
 280                         if (i + 1 >= option->len) {
 281                                 /* The pointer is truncated. */
 282                                 warning("Truncated pointer in DHCP Domain "
 283                                     "Search option.");
 284                                 return (-1);
 285                         }
 286
 287                         pointer = ((label_len & ~(0xC0)) << 8) +
 288                             option->data[i + 1];
 289                         if (pointer >= *offset) {
 290                                 /*
 291                                  * The pointer must indicate a prior
 292                                  * occurrence.
 293                                  */
 294                                 warning("Invalid forward pointer in DHCP "
 295                                     "Domain Search option compression.");
 296                                 return (-1);
 297                         }
 298
 299                         pointed_len = find_search_domain_name_len(option,
 300                             &pointer);
 301                         if (pointed_len < 0)
 302                                 return (-1);
 303                         domain_name_len += pointed_len;
 304
 305                         *offset = i + 2;
 306                         return (domain_name_len);
 307                 }
 308
 309                 if (i + label_len >= option->len) {
 310                         warning("Truncated label in DHCP Domain Search "
 311                             "option.");
 312                         return (-1);
 313                 }
 314
 315                 /*
 316                  * Update the domain name length with the length of the
 317                  * current label, plus a trailing dot ('.').
 318                  */
 319                 domain_name_len += label_len + 1;
 320
 321                 /* Move cursor. */
 322                 i += label_len + 1;
 323         }
 324
 325         warning("Truncated DHCP Domain Search option.");
 326
 327         return (-1);
 328 }
 329
 330 void
 331 expand_search_domain_name(struct option_data *option, size_t *offset,
 332     unsigned char **domain_search)
 333 {
 334         int label_len;
 335         size_t i, pointer;
 336         unsigned char *cursor;
 337
 338         /*
 339          * This is the same loop than the function above
 340          * (find_search_domain_name_len). Therefore, we remove checks,
 341          * they're already done. Here, we just make the copy.
 342          */
 343         i = *offset;
 344         cursor = *domain_search;
 345         while (i < option->len) {
 346                 label_len = option->data[i];
 347                 if (label_len == 0) {
 348                         /*
 349                          * A zero-length label marks the end of this
 350                          * domain name.
 351                          */
 352                         *offset = i + 1;
 353                         *domain_search = cursor;
 354                         return;
 355                 } else if (label_len & 0xC0) {
 356                         /* This is a pointer to another list of labels. */
 357                         pointer = ((label_len & ~(0xC0)) << 8) +
 358                             option->data[i + 1];
 359
 360                         expand_search_domain_name(option, &pointer, &cursor);
 361
 362                         *offset = i + 2;
 363                         *domain_search = cursor;
 364                         return;
 365                 }
 366
 367                 /* Copy the label found. */
 368                 memcpy(cursor, option->data + i + 1, label_len);
 369                 cursor[label_len] = '.';
 370
 371                 /* Move cursor. */
 372                 i += label_len + 1;
 373                 cursor += label_len + 1;
 374         }
 375 }
 376
 377 /*
 378  * cons options into a big buffer, and then split them out into the
 379  * three separate buffers if needed.  This allows us to cons up a set of
 380  * vendor options using the same routine.
 381  */
 382 int
 383 cons_options(struct packet *inpacket, struct dhcp_packet *outpacket,
 384     int mms, struct tree_cache **options,
 385     int overload, /* Overload flags that may be set. */
 386     int terminate, int bootpp, u_int8_t *prl, int prl_len)
 387 {
 388         unsigned char priority_list[300], buffer[4096];
 389         unsigned priority_len;
 390         size_t main_buffer_size;
 391         unsigned option_size, bufix, mainbufix;
 392         int length;
 393
 394         /*
 395          * If the client has provided a maximum DHCP message size, use
 396          * that; otherwise, if it's BOOTP, only 64 bytes; otherwise use
 397          * up to the minimum IP MTU size (576 bytes).
 398          *
 399          * XXX if a BOOTP client specifies a max message size, we will
 400          * honor it.
 401          */
 402         if (!mms &&
 403             inpacket &&
 404             inpacket->options[DHO_DHCP_MAX_MESSAGE_SIZE].data &&
 405             (inpacket->options[DHO_DHCP_MAX_MESSAGE_SIZE].len >=
 406             sizeof(u_int16_t)))
 407                 mms = getUShort(
 408                     inpacket->options[DHO_DHCP_MAX_MESSAGE_SIZE].data);
 409
 410         if (mms)
 411                 main_buffer_size = mms - DHCP_FIXED_LEN;
 412         else if (bootpp)
 413                 main_buffer_size = 64;
 414         else
 415                 main_buffer_size = 576 - DHCP_FIXED_LEN;
 416
 417         if (main_buffer_size > sizeof(buffer))
 418                 main_buffer_size = sizeof(buffer);
 419
 420         /* Preload the option priority list with mandatory options. */
 421         priority_len = 0;
 422         priority_list[priority_len++] = DHO_DHCP_MESSAGE_TYPE;
 423         priority_list[priority_len++] = DHO_DHCP_SERVER_IDENTIFIER;
 424         priority_list[priority_len++] = DHO_DHCP_LEASE_TIME;
 425         priority_list[priority_len++] = DHO_DHCP_MESSAGE;
 426
 427         /*
 428          * If the client has provided a list of options that it wishes
 429          * returned, use it to prioritize.  Otherwise, prioritize based
 430          * on the default priority list.
 431          */
 432         if (inpacket &&
 433             inpacket->options[DHO_DHCP_PARAMETER_REQUEST_LIST].data) {
 434                 unsigned prlen =
 435                     inpacket->options[DHO_DHCP_PARAMETER_REQUEST_LIST].len;
 436                 if (prlen + priority_len > sizeof(priority_list))
 437                         prlen = sizeof(priority_list) - priority_len;
 438
 439                 memcpy(&priority_list[priority_len],
 440                     inpacket->options[DHO_DHCP_PARAMETER_REQUEST_LIST].data,
 441                     prlen);
 442                 priority_len += prlen;
 443                 prl = priority_list;
 444         } else if (prl) {
 445                 if (prl_len + priority_len > sizeof(priority_list))
 446                         prl_len = sizeof(priority_list) - priority_len;
 447
 448                 memcpy(&priority_list[priority_len], prl, prl_len);
 449                 priority_len += prl_len;
 450                 prl = priority_list;
 451         } else {
 452                 memcpy(&priority_list[priority_len],
 453                     dhcp_option_default_priority_list,
 454                     sizeof_dhcp_option_default_priority_list);
 455                 priority_len += sizeof_dhcp_option_default_priority_list;
 456         }
 457
 458         /* Copy the options into the big buffer... */
 459         option_size = store_options(
 460             buffer,
 461             (main_buffer_size - 7 + ((overload & 1) ? DHCP_FILE_LEN : 0) +
 462                 ((overload & 2) ? DHCP_SNAME_LEN : 0)),
 463             options, priority_list, priority_len, main_buffer_size,
 464             (main_buffer_size + ((overload & 1) ? DHCP_FILE_LEN : 0)),
 465             terminate);
 466
 467         /* Put the cookie up front... */
 468         memcpy(outpacket->options, DHCP_OPTIONS_COOKIE, 4);
 469         mainbufix = 4;
 470
 471         /*
 472          * If we're going to have to overload, store the overload option
 473          * at the beginning.  If we can, though, just store the whole
 474          * thing in the packet's option buffer and leave it at that.
 475          */
 476         if (option_size <= main_buffer_size - mainbufix) {
 477                 memcpy(&outpacket->options[mainbufix],
 478                     buffer, option_size);
 479                 mainbufix += option_size;
 480                 if (mainbufix < main_buffer_size)
 481                         outpacket->options[mainbufix++] = DHO_END;
 482                 length = DHCP_FIXED_NON_UDP + mainbufix;
 483         } else {
 484                 outpacket->options[mainbufix++] = DHO_DHCP_OPTION_OVERLOAD;
 485                 outpacket->options[mainbufix++] = 1;
 486                 if (option_size >
 487                     main_buffer_size - mainbufix + DHCP_FILE_LEN)
 488                         outpacket->options[mainbufix++] = 3;
 489                 else
 490                         outpacket->options[mainbufix++] = 1;
 491
 492                 memcpy(&outpacket->options[mainbufix],
 493                     buffer, main_buffer_size - mainbufix);
 494                 bufix = main_buffer_size - mainbufix;
 495                 length = DHCP_FIXED_NON_UDP + mainbufix;
 496                 if (overload & 1) {
 497                         if (option_size - bufix <= DHCP_FILE_LEN) {
 498                                 memcpy(outpacket->file,
 499                                     &buffer[bufix], option_size - bufix);
 500                                 mainbufix = option_size - bufix;
 501                                 if (mainbufix < DHCP_FILE_LEN)
 502                                         outpacket->file[mainbufix++] = (char)DHO_END;
 503                                 while (mainbufix < DHCP_FILE_LEN)
 504                                         outpacket->file[mainbufix++] = (char)DHO_PAD;
 505                         } else {
 506                                 memcpy(outpacket->file,
 507                                     &buffer[bufix], DHCP_FILE_LEN);
 508                                 bufix += DHCP_FILE_LEN;
 509                         }
 510                 }
 511                 if ((overload & 2) && option_size < bufix) {
 512                         memcpy(outpacket->sname,
 513                             &buffer[bufix], option_size - bufix);
 514
 515                         mainbufix = option_size - bufix;
 516                         if (mainbufix < DHCP_SNAME_LEN)
 517                                 outpacket->file[mainbufix++] = (char)DHO_END;
 518                         while (mainbufix < DHCP_SNAME_LEN)
 519                                 outpacket->file[mainbufix++] = (char)DHO_PAD;
 520                 }
 521         }
 522         return (length);
 523 }
 524
 525 /*
 526  * Store all the requested options into the requested buffer.
 527  */
 528 unsigned
 529 store_options(unsigned char *buffer, int buflen, struct tree_cache **options,
 530     unsigned char *priority_list, int priority_len, int first_cutoff,
 531     int second_cutoff, int terminate)
 532 {
 533         int bufix = 0, option_stored[256], i, ix, tto;
 534
 535         /* Zero out the stored-lengths array. */
 536         memset(option_stored, 0, sizeof(option_stored));
 537
 538         /*
 539          * Copy out the options in the order that they appear in the
 540          * priority list...
 541          */
 542         for (i = 0; i < priority_len; i++) {
 543                 /* Code for next option to try to store. */
 544                 int code = priority_list[i];
 545                 int optstart;
 546
 547                 /*
 548                  * Number of bytes left to store (some may already have
 549                  * been stored by a previous pass).
 550                  */
 551                 int length;
 552
 553                 /* If no data is available for this option, skip it. */
 554                 if (!options[code]) {
 555                         continue;
 556                 }
 557
 558                 /*
 559                  * The client could ask for things that are mandatory,
 560                  * in which case we should avoid storing them twice...
 561                  */
 562                 if (option_stored[code])
 563                         continue;
 564                 option_stored[code] = 1;
 565
 566                 /* We should now have a constant length for the option. */
 567                 length = options[code]->len;
 568
 569                 /* Do we add a NUL? */
 570                 if (terminate && dhcp_options[code].format[0] == 't') {
 571                         length++;
 572                         tto = 1;
 573                 } else
 574                         tto = 0;
 575
 576                 /* Try to store the option. */
 577
 578                 /*
 579                  * If the option's length is more than 255, we must
 580                  * store it in multiple hunks.   Store 255-byte hunks
 581                  * first.  However, in any case, if the option data will
 582                  * cross a buffer boundary, split it across that
 583                  * boundary.
 584                  */
 585                 ix = 0;
 586
 587                 optstart = bufix;
 588                 while (length) {
 589                         unsigned char incr = length > 255 ? 255 : length;
 590
 591                         /*
 592                          * If this hunk of the buffer will cross a
 593                          * boundary, only go up to the boundary in this
 594                          * pass.
 595                          */
 596                         if (bufix < first_cutoff &&
 597                             bufix + incr > first_cutoff)
 598                                 incr = first_cutoff - bufix;
 599                         else if (bufix < second_cutoff &&
 600                             bufix + incr > second_cutoff)
 601                                 incr = second_cutoff - bufix;
 602
 603                         /*
 604                          * If this option is going to overflow the
 605                          * buffer, skip it.
 606                          */
 607                         if (bufix + 2 + incr > buflen) {
 608                                 bufix = optstart;
 609                                 break;
 610                         }
 611
 612                         /* Everything looks good - copy it in! */
 613                         buffer[bufix] = code;
 614                         buffer[bufix + 1] = incr;
 615                         if (tto && incr == length) {
 616                                 memcpy(buffer + bufix + 2,
 617                                     options[code]->value + ix, incr - 1);
 618                                 buffer[bufix + 2 + incr - 1] = 0;
 619                         } else
 620                                 memcpy(buffer + bufix + 2,
 621                                     options[code]->value + ix, incr);
 622                         length -= incr;
 623                         ix += incr;
 624                         bufix += 2 + incr;
 625                 }
 626         }
 627         return (bufix);
 628 }
 629
 630 /*
 631  * Format the specified option so that a human can easily read it.
 632  */
 633 const char *
 634 pretty_print_option(unsigned int code, unsigned char *data, int len,
 635     int emit_commas, int emit_quotes)
 636 {
 637         static char optbuf[32768]; /* XXX */
 638         int hunksize = 0, numhunk = -1, numelem = 0;
 639         char fmtbuf[32], *op = optbuf;
 640         int i, j, k, opleft = sizeof(optbuf);
 641         unsigned char *dp = data;
 642         struct in_addr foo;
 643         char comma;
 644
 645         /* Code should be between 0 and 255. */
 646         if (code > 255)
 647                 error("pretty_print_option: bad code %d", code);
 648
 649         if (emit_commas)
 650                 comma = ',';
 651         else
 652                 comma = ' ';
 653
 654         /* Figure out the size of the data. */
 655         for (i = 0; dhcp_options[code].format[i]; i++) {
 656                 if (!numhunk) {
 657                         warning("%s: Excess information in format string: %s",
 658                             dhcp_options[code].name,
 659                             &(dhcp_options[code].format[i]));
 660                         break;
 661                 }
 662                 numelem++;
 663                 fmtbuf[i] = dhcp_options[code].format[i];
 664                 switch (dhcp_options[code].format[i]) {
 665                 case 'A':
 666                         --numelem;
 667                         fmtbuf[i] = 0;
 668                         numhunk = 0;
 669                         break;
 670                 case 'X':
 671                         for (k = 0; k < len; k++)
 672                                 if (!isascii(data[k]) ||
 673                                     !isprint(data[k]))
 674                                         break;
 675                         if (k == len) {
 676                                 fmtbuf[i] = 't';
 677                                 numhunk = -2;
 678                         } else {
 679                                 fmtbuf[i] = 'x';
 680                                 hunksize++;
 681                                 comma = ':';
 682                                 numhunk = 0;
 683                         }
 684                         fmtbuf[i + 1] = 0;
 685                         break;
 686                 case 't':
 687                         fmtbuf[i] = 't';
 688                         fmtbuf[i + 1] = 0;
 689                         numhunk = -2;
 690                         break;
 691                 case 'I':
 692                 case 'l':
 693                 case 'L':
 694                         hunksize += 4;
 695                         break;
 696                 case 's':
 697                 case 'S':
 698                         hunksize += 2;
 699                         break;
 700                 case 'b':
 701                 case 'B':
 702                 case 'f':
 703                         hunksize++;
 704                         break;
 705                 case 'e':
 706                         break;
 707                 default:
 708                         warning("%s: garbage in format string: %s",
 709                             dhcp_options[code].name,
 710                             &(dhcp_options[code].format[i]));
 711                         break;
 712                 }
 713         }
 714
 715         /* Check for too few bytes... */
 716         if (hunksize > len) {
 717                 warning("%s: expecting at least %d bytes; got %d",
 718                     dhcp_options[code].name, hunksize, len);
 719                 return ("<error>");
 720         }
 721         /* Check for too many bytes... */
 722         if (numhunk == -1 && hunksize < len)
 723                 warning("%s: %d extra bytes",
 724                     dhcp_options[code].name, len - hunksize);
 725
 726         /* If this is an array, compute its size. */
 727         if (!numhunk)
 728                 numhunk = len / hunksize;
 729         /* See if we got an exact number of hunks. */
 730         if (numhunk > 0 && numhunk * hunksize < len)
 731                 warning("%s: %d extra bytes at end of array",
 732                     dhcp_options[code].name, len - numhunk * hunksize);
 733
 734         /* A one-hunk array prints the same as a single hunk. */
 735         if (numhunk < 0)
 736                 numhunk = 1;
 737
 738         /* Cycle through the array (or hunk) printing the data. */
 739         for (i = 0; i < numhunk; i++) {
 740                 for (j = 0; j < numelem; j++) {
 741                         int opcount;
 742                         switch (fmtbuf[j]) {
 743                         case 't':
 744                                 if (emit_quotes) {
 745                                         *op++ = '"';
 746                                         opleft--;
 747                                 }
 748                                 for (; dp < data + len; dp++) {
 749                                         if (!isascii(*dp) ||
 750                                             !isprint(*dp)) {
 751                                                 if (dp + 1 != data + len ||
 752                                                     *dp != 0) {
 753                                                         snprintf(op, opleft,
 754                                                             "\\%03o", *dp);
 755                                                         op += 4;
 756                                                         opleft -= 4;
 757                                                 }
 758                                         } else if (*dp == '"' ||
 759                                             *dp == '\'' ||
 760                                             *dp == '$' ||
 761                                             *dp == '`' ||
 762                                             *dp == '\\') {
 763                                                 *op++ = '\\';
 764                                                 *op++ = *dp;
 765                                                 opleft -= 2;
 766                                         } else {
 767                                                 *op++ = *dp;
 768                                                 opleft--;
 769                                         }
 770                                 }
 771                                 if (emit_quotes) {
 772                                         *op++ = '"';
 773                                         opleft--;
 774                                 }
 775
 776                                 *op = 0;
 777                                 break;
 778                         case 'I':
 779                                 foo.s_addr = htonl(getULong(dp));
 780                                 opcount = strlcpy(op, inet_ntoa(foo), opleft);
 781                                 if (opcount >= opleft)
 782                                         goto toobig;
 783                                 opleft -= opcount;
 784                                 dp += 4;
 785                                 break;
 786                         case 'l':
 787                                 opcount = snprintf(op, opleft, "%ld",
 788                                     (long)getLong(dp));
 789                                 if (opcount >= opleft || opcount == -1)
 790                                         goto toobig;
 791                                 opleft -= opcount;
 792                                 dp += 4;
 793                                 break;
 794                         case 'L':
 795                                 opcount = snprintf(op, opleft, "%lu",
 796                                     (unsigned long)getULong(dp));
 797                                 if (opcount >= opleft || opcount == -1)
 798                                         goto toobig;
 799                                 opleft -= opcount;
 800                                 dp += 4;
 801                                 break;
 802                         case 's':
 803                                 opcount = snprintf(op, opleft, "%d",
 804                                     getShort(dp));
 805                                 if (opcount >= opleft || opcount == -1)
 806                                         goto toobig;
 807                                 opleft -= opcount;
 808                                 dp += 2;
 809                                 break;
 810                         case 'S':
 811                                 opcount = snprintf(op, opleft, "%u",
 812                                     getUShort(dp));
 813                                 if (opcount >= opleft || opcount == -1)
 814                                         goto toobig;
 815                                 opleft -= opcount;
 816                                 dp += 2;
 817                                 break;
 818                         case 'b':
 819                                 opcount = snprintf(op, opleft, "%d",
 820                                     *(char *)dp++);
 821                                 if (opcount >= opleft || opcount == -1)
 822                                         goto toobig;
 823                                 opleft -= opcount;
 824                                 break;
 825                         case 'B':
 826                                 opcount = snprintf(op, opleft, "%d", *dp++);
 827                                 if (opcount >= opleft || opcount == -1)
 828                                         goto toobig;
 829                                 opleft -= opcount;
 830                                 break;
 831                         case 'x':
 832                                 opcount = snprintf(op, opleft, "%x", *dp++);
 833                                 if (opcount >= opleft || opcount == -1)
 834                                         goto toobig;
 835                                 opleft -= opcount;
 836                                 break;
 837                         case 'f':
 838                                 opcount = strlcpy(op,
 839                                     *dp++ ? "true" : "false", opleft);
 840                                 if (opcount >= opleft)
 841                                         goto toobig;
 842                                 opleft -= opcount;
 843                                 break;
 844                         default:
 845                                 warning("Unexpected format code %c", fmtbuf[j]);
 846                         }
 847                         op += strlen(op);
 848                         opleft -= strlen(op);
 849                         if (opleft < 1)
 850                                 goto toobig;
 851                         if (j + 1 < numelem && comma != ':') {
 852                                 *op++ = ' ';
 853                                 opleft--;
 854                         }
 855                 }
 856                 if (i + 1 < numhunk) {
 857                         *op++ = comma;
 858                         opleft--;
 859                 }
 860                 if (opleft < 1)
 861                         goto toobig;
 862
 863         }
 864         return (optbuf);
 865  toobig:
 866         warning("dhcp option too large");
 867         return ("<error>");
 868 }
 869
 870 void
 871 do_packet(struct interface_info *interface, struct dhcp_packet *packet,
 872     int len, unsigned int from_port, struct iaddr from, struct hardware *hfrom)
 873 {
 874         struct packet tp;
 875         int i;
 876
 877         if (packet->hlen > sizeof(packet->chaddr)) {
 878                 note("Discarding packet with invalid hlen.");
 879                 return;
 880         }
 881
 882         memset(&tp, 0, sizeof(tp));
 883         tp.raw = packet;
 884         tp.packet_length = len;
 885         tp.client_port = from_port;
 886         tp.client_addr = from;
 887         tp.interface = interface;
 888         tp.haddr = hfrom;
 889
 890         parse_options(&tp);
 891         if (tp.options_valid &&
 892             tp.options[DHO_DHCP_MESSAGE_TYPE].data)
 893                 tp.packet_type = tp.options[DHO_DHCP_MESSAGE_TYPE].data[0];
 894         if (tp.packet_type)
 895                 dhcp(&tp);
 896         else
 897                 bootp(&tp);
 898
 899         /* Free the data associated with the options. */
 900         for (i = 0; i < 256; i++)
 901                 free(tp.options[i].data);
 902 }