sbin/dhclient/options.c

   1 /*      $OpenBSD: options.c,v 1.36 2007/06/02 01:29:11 pvalchev Exp $   */
   2 /*      $DragonFly: src/sbin/dhclient/options.c,v 1.1 2008/08/30 16:07:58 hasso Exp $   */
   3
   4 /* DHCP options parsing and reassembly. */
   5
   6 /*
   7  * Copyright (c) 1995, 1996, 1997, 1998 The Internet Software Consortium.
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  *
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  * 3. Neither the name of The Internet Software Consortium nor the names
  20  *    of its contributors may be used to endorse or promote products derived
  21  *    from this software without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
  24  * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
  25  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  26  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  27  * DISCLAIMED.  IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
  28  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  29  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  30  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
  31  * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  32  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  33  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  34  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  35  * SUCH DAMAGE.
  36  *
  37  * This software has been written for the Internet Software Consortium
  38  * by Ted Lemon <mellon@fugue.com> in cooperation with Vixie
  39  * Enterprises.  To learn more about the Internet Software Consortium,
  40  * see ``http://www.vix.com/isc''.  To learn more about Vixie
  41  * Enterprises, see ``http://www.vix.com''.
  42  */
  43
  44 #include <ctype.h>
  45
  46 #include "dhcpd.h"
  47
  48 int parse_option_buffer(struct option_data *, unsigned char *, int);
  49
  50 /*
  51  * Parse options out of the specified buffer, storing addresses of
  52  * option values in options and setting client->options_valid if
  53  * no errors are encountered.
  54  */
  55 int
  56 parse_option_buffer(struct option_data *options, unsigned char *buffer,
  57     int length)
  58 {
  59         unsigned char *s, *t, *end = buffer + length;
  60         int len, code;
  61
  62         for (s = buffer; *s != DHO_END && s < end; ) {
  63                 code = s[0];
  64
  65                 /* Pad options don't have a length - just skip them. */
  66                 if (code == DHO_PAD) {
  67                         s++;
  68                         continue;
  69                 }
  70
  71                 /*
  72                  * All options other than DHO_PAD and DHO_END have a
  73                  * one-byte length field.
  74                  */
  75                 if (s + 2 > end)
  76                         len = 0;
  77                 else
  78                         len = s[1];
  79
  80                 /*
  81                  * If the option claims to extend beyond the end of the buffer
  82                  * then mark the options buffer bad.
  83                  */
  84                 if (s + len + 2 > end) {
  85                         warning("option %s (%d) larger than buffer.",
  86                             dhcp_options[code].name, len);
  87                         warning("rejecting bogus offer.");
  88                         return (0);
  89                 }
  90                 /*
  91                  * If we haven't seen this option before, just make
  92                  * space for it and copy it there.
  93                  */
  94                 if (!options[code].data) {
  95                         if (!(t = calloc(1, len + 1)))
  96                                 error("Can't allocate storage for option %s.",
  97                                     dhcp_options[code].name);
  98                         /*
  99                          * Copy and NUL-terminate the option (in case
 100                          * it's an ASCII string).
 101                          */
 102                         memcpy(t, &s[2], len);
 103                         t[len] = 0;
 104                         options[code].len = len;
 105                         options[code].data = t;
 106                 } else {
 107                         /*
 108                          * If it's a repeat, concatenate it to whatever
 109                          * we last saw.   This is really only required
 110                          * for clients, but what the heck...
 111                          */
 112                         t = calloc(1, len + options[code].len + 1);
 113                         if (!t)
 114                                 error("Can't expand storage for option %s.",
 115                                     dhcp_options[code].name);
 116                         memcpy(t, options[code].data, options[code].len);
 117                         memcpy(t + options[code].len, &s[2], len);
 118                         options[code].len += len;
 119                         t[options[code].len] = 0;
 120                         free(options[code].data);
 121                         options[code].data = t;
 122                 }
 123                 s += len + 2;
 124         }
 125
 126         return (1);
 127 }
 128
 129 /*
 130  * Copy as many options as fit in buflen bytes of buf. Return the
 131  * offset of the start of the last option copied. A caller can check
 132  * to see if it's DHO_END to decide if all the options were copied.
 133  */
 134 int
 135 cons_options(unsigned char *buf, const int buflen, struct option_data *options)
 136 {
 137         int ix, incr, length, bufix, code, lastopt = -1;
 138
 139         bzero(buf, buflen);
 140
 141         if (buflen > 3)
 142                 memcpy(buf, DHCP_OPTIONS_COOKIE, 4);
 143         bufix = 4;
 144
 145         for (code = DHO_SUBNET_MASK; code < DHO_END; code++) {
 146                 if (!options[code].data)
 147                         continue;
 148
 149                 length = options[code].len;
 150                 if (bufix + length + 2*((length+254)/255) >= buflen)
 151                         return (lastopt);
 152
 153                 lastopt = bufix;
 154                 ix = 0;
 155
 156                 while (length) {
 157                         incr = length > 255 ? 255 : length;
 158
 159                         buf[bufix++] = code;
 160                         buf[bufix++] = incr;
 161                         memcpy(buf + bufix, options[code].data + ix, incr);
 162
 163                         length -= incr;
 164                         ix += incr;
 165                         bufix += incr;
 166                 }
 167         }
 168
 169         if (bufix < buflen) {
 170                 buf[bufix] = DHO_END;
 171                 lastopt = bufix;
 172         }
 173
 174         return (lastopt);
 175 }
 176
 177 /*
 178  * Format the specified option so that a human can easily read it.
 179  */
 180 char *
 181 pretty_print_option(unsigned int code, unsigned char *data, int len,
 182     int emit_commas, int emit_quotes)
 183 {
 184         static char optbuf[32768]; /* XXX */
 185         int hunksize = 0, numhunk = -1, numelem = 0;
 186         char fmtbuf[32], *op = optbuf;
 187         int i, j, k, opleft = sizeof(optbuf);
 188         unsigned char *dp = data;
 189         struct in_addr foo;
 190         char comma;
 191
 192         /* Code should be between 0 and 255. */
 193         if (code > 255)
 194                 error("pretty_print_option: bad code %d", code);
 195
 196         if (emit_commas)
 197                 comma = ',';
 198         else
 199                 comma = ' ';
 200
 201         /* Figure out the size of the data. */
 202         for (i = 0; dhcp_options[code].format[i]; i++) {
 203                 if (!numhunk) {
 204                         warning("%s: Excess information in format string: %s",
 205                             dhcp_options[code].name,
 206                             &(dhcp_options[code].format[i]));
 207                         break;
 208                 }
 209                 numelem++;
 210                 fmtbuf[i] = dhcp_options[code].format[i];
 211                 switch (dhcp_options[code].format[i]) {
 212                 case 'A':
 213                         --numelem;
 214                         fmtbuf[i] = 0;
 215                         numhunk = 0;
 216                         break;
 217                 case 'X':
 218                         for (k = 0; k < len; k++)
 219                                 if (!isascii(data[k]) ||
 220                                     !isprint(data[k]))
 221                                         break;
 222                         if (k == len) {
 223                                 fmtbuf[i] = 't';
 224                                 numhunk = -2;
 225                         } else {
 226                                 fmtbuf[i] = 'x';
 227                                 hunksize++;
 228                                 comma = ':';
 229                                 numhunk = 0;
 230                         }
 231                         fmtbuf[i + 1] = 0;
 232                         break;
 233                 case 't':
 234                         fmtbuf[i] = 't';
 235                         fmtbuf[i + 1] = 0;
 236                         numhunk = -2;
 237                         break;
 238                 case 'I':
 239                 case 'l':
 240                 case 'L':
 241                         hunksize += 4;
 242                         break;
 243                 case 's':
 244                 case 'S':
 245                         hunksize += 2;
 246                         break;
 247                 case 'b':
 248                 case 'B':
 249                 case 'f':
 250                         hunksize++;
 251                         break;
 252                 case 'e':
 253                         break;
 254                 default:
 255                         warning("%s: garbage in format string: %s",
 256                             dhcp_options[code].name,
 257                             &(dhcp_options[code].format[i]));
 258                         break;
 259                 }
 260         }
 261
 262         /* Check for too few bytes... */
 263         if (hunksize > len) {
 264                 warning("%s: expecting at least %d bytes; got %d",
 265                     dhcp_options[code].name, hunksize, len);
 266                 return ("<error>");
 267         }
 268         /* Check for too many bytes... */
 269         if (numhunk == -1 && hunksize < len)
 270                 warning("%s: %d extra bytes",
 271                     dhcp_options[code].name, len - hunksize);
 272
 273         /* If this is an array, compute its size. */
 274         if (!numhunk)
 275                 numhunk = len / hunksize;
 276         /* See if we got an exact number of hunks. */
 277         if (numhunk > 0 && numhunk * hunksize < len)
 278                 warning("%s: %d extra bytes at end of array",
 279                     dhcp_options[code].name, len - numhunk * hunksize);
 280
 281         /* A one-hunk array prints the same as a single hunk. */
 282         if (numhunk < 0)
 283                 numhunk = 1;
 284
 285         /* Cycle through the array (or hunk) printing the data. */
 286         for (i = 0; i < numhunk; i++) {
 287                 for (j = 0; j < numelem; j++) {
 288                         int opcount;
 289                         size_t oplen;
 290                         switch (fmtbuf[j]) {
 291                         case 't':
 292                                 if (emit_quotes) {
 293                                         *op++ = '"';
 294                                         opleft--;
 295                                 }
 296                                 for (; dp < data + len; dp++) {
 297                                         if (!isascii(*dp) ||
 298                                             !isprint(*dp)) {
 299                                                 if (dp + 1 != data + len ||
 300                                                     *dp != 0) {
 301                                                         size_t oplen;
 302                                                         snprintf(op, opleft,
 303                                                             "\\%03o", *dp);
 304                                                         oplen = strlen(op);
 305                                                         op += oplen;
 306                                                         opleft -= oplen;
 307                                                 }
 308                                         } else if (*dp == '"' ||
 309                                             *dp == '\'' ||
 310                                             *dp == '$' ||
 311                                             *dp == '`' ||
 312                                             *dp == '\\') {
 313                                                 *op++ = '\\';
 314                                                 *op++ = *dp;
 315                                                 opleft -= 2;
 316                                         } else {
 317                                                 *op++ = *dp;
 318                                                 opleft--;
 319                                         }
 320                                 }
 321                                 if (emit_quotes) {
 322                                         *op++ = '"';
 323                                         opleft--;
 324                                 }
 325
 326                                 *op = 0;
 327                                 break;
 328                         case 'I':
 329                                 foo.s_addr = htonl(getULong(dp));
 330                                 opcount = strlcpy(op, inet_ntoa(foo), opleft);
 331                                 if (opcount >= opleft)
 332                                         goto toobig;
 333                                 opleft -= opcount;
 334                                 dp += 4;
 335                                 break;
 336                         case 'l':
 337                                 opcount = snprintf(op, opleft, "%ld",
 338                                     (long)getLong(dp));
 339                                 if (opcount >= opleft || opcount == -1)
 340                                         goto toobig;
 341                                 opleft -= opcount;
 342                                 dp += 4;
 343                                 break;
 344                         case 'L':
 345                                 opcount = snprintf(op, opleft, "%ld",
 346                                     (unsigned long)getULong(dp));
 347                                 if (opcount >= opleft || opcount == -1)
 348                                         goto toobig;
 349                                 opleft -= opcount;
 350                                 dp += 4;
 351                                 break;
 352                         case 's':
 353                                 opcount = snprintf(op, opleft, "%d",
 354                                     getShort(dp));
 355                                 if (opcount >= opleft || opcount == -1)
 356                                         goto toobig;
 357                                 opleft -= opcount;
 358                                 dp += 2;
 359                                 break;
 360                         case 'S':
 361                                 opcount = snprintf(op, opleft, "%d",
 362                                     getUShort(dp));
 363                                 if (opcount >= opleft || opcount == -1)
 364                                         goto toobig;
 365                                 opleft -= opcount;
 366                                 dp += 2;
 367                                 break;
 368                         case 'b':
 369                                 opcount = snprintf(op, opleft, "%d",
 370                                     *(char *)dp++);
 371                                 if (opcount >= opleft || opcount == -1)
 372                                         goto toobig;
 373                                 opleft -= opcount;
 374                                 break;
 375                         case 'B':
 376                                 opcount = snprintf(op, opleft, "%d", *dp++);
 377                                 if (opcount >= opleft || opcount == -1)
 378                                         goto toobig;
 379                                 opleft -= opcount;
 380                                 break;
 381                         case 'x':
 382                                 opcount = snprintf(op, opleft, "%x", *dp++);
 383                                 if (opcount >= opleft || opcount == -1)
 384                                         goto toobig;
 385                                 opleft -= opcount;
 386                                 break;
 387                         case 'f':
 388                                 opcount = strlcpy(op,
 389                                     *dp++ ? "true" : "false", opleft);
 390                                 if (opcount >= opleft)
 391                                         goto toobig;
 392                                 opleft -= opcount;
 393                                 break;
 394                         default:
 395                                 warning("Unexpected format code %c", fmtbuf[j]);
 396                         }
 397                         oplen = strlen(op);
 398                         op += oplen;
 399                         opleft -= oplen;
 400                         if (opleft < 1)
 401                                 goto toobig;
 402                         if (j + 1 < numelem && comma != ':') {
 403                                 *op++ = ' ';
 404                                 opleft--;
 405                         }
 406                 }
 407                 if (i + 1 < numhunk) {
 408                         *op++ = comma;
 409                         opleft--;
 410                 }
 411                 if (opleft < 1)
 412                         goto toobig;
 413
 414         }
 415         return (optbuf);
 416  toobig:
 417         warning("dhcp option too large");
 418         return ("<error>");
 419 }
 420
 421 void
 422 do_packet(int len, unsigned int from_port, struct iaddr from,
 423     struct hardware *hfrom)
 424 {
 425         struct dhcp_packet *packet = &client->packet;
 426         struct option_data options[256];
 427         struct iaddrlist *ap;
 428         void (*handler)(struct iaddr, struct option_data *);
 429         char *type;
 430         int i, options_valid = 1;
 431
 432         if (packet->hlen > sizeof(packet->chaddr)) {
 433                 note("Discarding packet with invalid hlen.");
 434                 return;
 435         }
 436
 437         /*
 438          * Silently drop the packet if the client hardware address in the
 439          * packet is not the hardware address of the interface being managed.
 440          */
 441         if ((ifi->hw_address.hlen != packet->hlen) ||
 442             (memcmp(ifi->hw_address.haddr, packet->chaddr, packet->hlen)))
 443                 return;
 444
 445         memset(options, 0, sizeof(options));
 446
 447         if (memcmp(&packet->options, DHCP_OPTIONS_COOKIE, 4) == 0) {
 448                 /* Parse the BOOTP/DHCP options field. */
 449                 options_valid = parse_option_buffer(options,
 450                     &packet->options[4], sizeof(packet->options) - 4);
 451
 452                 /* Only DHCP packets have overload areas for options. */
 453                 if (options_valid &&
 454                     options[DHO_DHCP_MESSAGE_TYPE].data &&
 455                     options[DHO_DHCP_OPTION_OVERLOAD].data) {
 456                         if (options[DHO_DHCP_OPTION_OVERLOAD].data[0] & 1)
 457                                 options_valid = parse_option_buffer(options,
 458                                     (unsigned char *)packet->file,
 459                                     sizeof(packet->file));
 460                         if (options_valid &&
 461                             options[DHO_DHCP_OPTION_OVERLOAD].data[0] & 2)
 462                                 options_valid = parse_option_buffer(options,
 463                                     (unsigned char *)packet->sname,
 464                                     sizeof(packet->sname));
 465                 }
 466         }
 467
 468         type = "";
 469         handler = NULL;
 470
 471         if (options[DHO_DHCP_MESSAGE_TYPE].data) {
 472                 /* Always try a DHCP packet, even if a bad option was seen. */
 473                 switch (options[DHO_DHCP_MESSAGE_TYPE].data[0]) {
 474                 case DHCPOFFER:
 475                         handler = dhcpoffer;
 476                         type = "DHCPOFFER";
 477                         break;
 478                 case DHCPNAK:
 479                         handler = dhcpnak;
 480                         type = "DHCPNACK";
 481                         break;
 482                 case DHCPACK:
 483                         handler = dhcpack;
 484                         type = "DHCPACK";
 485                         break;
 486                 default:
 487                         break;
 488                 }
 489         } else if (options_valid && packet->op == BOOTREPLY) {
 490                 handler = dhcpoffer;
 491                 type = "BOOTREPLY";
 492         }
 493
 494         for (ap = config->reject_list; ap && handler; ap = ap->next)
 495                 if (addr_eq(from, ap->addr)) {
 496                         note("%s from %s rejected.", type, piaddr(from));
 497                         handler = NULL;
 498                 }
 499
 500         if (handler)
 501                 (*handler)(from, options);
 502
 503         for (i = 0; i < 256; i++)
 504                 if (options[i].len && options[i].data)
 505                         free(options[i].data);
 506 }