Fix 32-bit overflow in parallels image support
[qemu-kvm/fedora.git] / slirp / bootp.c
blob911ec712c5da2651ff985cfd61f7a4e25d3b452f
1 /*
2 * QEMU BOOTP/DHCP server
4 * Copyright (c) 2004 Fabrice Bellard
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
24 #include <slirp.h>
26 /* XXX: only DHCP is supported */
28 #define LEASE_TIME (24 * 3600)
30 static const uint8_t rfc1533_cookie[] = { RFC1533_COOKIE };
32 #ifdef DEBUG
33 #define dprintf(fmt, ...) \
34 do if (slirp_debug & DBG_CALL) { fprintf(dfd, fmt, ## __VA_ARGS__); fflush(dfd); } while (0)
35 #else
36 #define dprintf(fmt, ...)
37 #endif
39 static BOOTPClient *get_new_addr(Slirp *slirp, struct in_addr *paddr,
40 const uint8_t *macaddr)
42 BOOTPClient *bc;
43 int i;
45 for(i = 0; i < NB_BOOTP_CLIENTS; i++) {
46 bc = &slirp->bootp_clients[i];
47 if (!bc->allocated || !memcmp(macaddr, bc->macaddr, 6))
48 goto found;
50 return NULL;
51 found:
52 bc = &slirp->bootp_clients[i];
53 bc->allocated = 1;
54 paddr->s_addr = slirp->vdhcp_startaddr.s_addr + htonl(i);
55 return bc;
58 static BOOTPClient *request_addr(Slirp *slirp, const struct in_addr *paddr,
59 const uint8_t *macaddr)
61 uint32_t req_addr = ntohl(paddr->s_addr);
62 uint32_t dhcp_addr = ntohl(slirp->vdhcp_startaddr.s_addr);
63 BOOTPClient *bc;
65 if (req_addr >= dhcp_addr &&
66 req_addr < (dhcp_addr + NB_BOOTP_CLIENTS)) {
67 bc = &slirp->bootp_clients[req_addr - dhcp_addr];
68 if (!bc->allocated || !memcmp(macaddr, bc->macaddr, 6)) {
69 bc->allocated = 1;
70 return bc;
73 return NULL;
76 static BOOTPClient *find_addr(Slirp *slirp, struct in_addr *paddr,
77 const uint8_t *macaddr)
79 BOOTPClient *bc;
80 int i;
82 for(i = 0; i < NB_BOOTP_CLIENTS; i++) {
83 if (!memcmp(macaddr, slirp->bootp_clients[i].macaddr, 6))
84 goto found;
86 return NULL;
87 found:
88 bc = &slirp->bootp_clients[i];
89 bc->allocated = 1;
90 paddr->s_addr = slirp->vdhcp_startaddr.s_addr + htonl(i);
91 return bc;
94 static void dhcp_decode(const struct bootp_t *bp, int *pmsg_type,
95 const struct in_addr **preq_addr)
97 const uint8_t *p, *p_end;
98 int len, tag;
100 *pmsg_type = 0;
101 *preq_addr = NULL;
103 p = bp->bp_vend;
104 p_end = p + DHCP_OPT_LEN;
105 if (memcmp(p, rfc1533_cookie, 4) != 0)
106 return;
107 p += 4;
108 while (p < p_end) {
109 tag = p[0];
110 if (tag == RFC1533_PAD) {
111 p++;
112 } else if (tag == RFC1533_END) {
113 break;
114 } else {
115 p++;
116 if (p >= p_end)
117 break;
118 len = *p++;
119 dprintf("dhcp: tag=%d len=%d\n", tag, len);
121 switch(tag) {
122 case RFC2132_MSG_TYPE:
123 if (len >= 1)
124 *pmsg_type = p[0];
125 break;
126 case RFC2132_REQ_ADDR:
127 if (len >= 4)
128 *preq_addr = (struct in_addr *)p;
129 break;
130 default:
131 break;
133 p += len;
136 if (*pmsg_type == DHCPREQUEST && !*preq_addr && bp->bp_ciaddr.s_addr) {
137 *preq_addr = &bp->bp_ciaddr;
141 static void bootp_reply(Slirp *slirp, const struct bootp_t *bp)
143 BOOTPClient *bc = NULL;
144 struct mbuf *m;
145 struct bootp_t *rbp;
146 struct sockaddr_in saddr, daddr;
147 const struct in_addr *preq_addr;
148 int dhcp_msg_type, val;
149 uint8_t *q;
151 /* extract exact DHCP msg type */
152 dhcp_decode(bp, &dhcp_msg_type, &preq_addr);
153 dprintf("bootp packet op=%d msgtype=%d", bp->bp_op, dhcp_msg_type);
154 if (preq_addr)
155 dprintf(" req_addr=%08x\n", ntohl(preq_addr->s_addr));
156 else
157 dprintf("\n");
159 if (dhcp_msg_type == 0)
160 dhcp_msg_type = DHCPREQUEST; /* Force reply for old BOOTP clients */
162 if (dhcp_msg_type != DHCPDISCOVER &&
163 dhcp_msg_type != DHCPREQUEST)
164 return;
165 /* XXX: this is a hack to get the client mac address */
166 memcpy(slirp->client_ethaddr, bp->bp_hwaddr, 6);
168 m = m_get(slirp);
169 if (!m) {
170 return;
172 m->m_data += IF_MAXLINKHDR;
173 rbp = (struct bootp_t *)m->m_data;
174 m->m_data += sizeof(struct udpiphdr);
175 memset(rbp, 0, sizeof(struct bootp_t));
177 if (dhcp_msg_type == DHCPDISCOVER) {
178 if (preq_addr) {
179 bc = request_addr(slirp, preq_addr, slirp->client_ethaddr);
180 if (bc) {
181 daddr.sin_addr = *preq_addr;
184 if (!bc) {
185 new_addr:
186 bc = get_new_addr(slirp, &daddr.sin_addr, slirp->client_ethaddr);
187 if (!bc) {
188 dprintf("no address left\n");
189 return;
192 memcpy(bc->macaddr, slirp->client_ethaddr, 6);
193 } else if (preq_addr) {
194 bc = request_addr(slirp, preq_addr, slirp->client_ethaddr);
195 if (bc) {
196 daddr.sin_addr = *preq_addr;
197 memcpy(bc->macaddr, slirp->client_ethaddr, 6);
198 } else {
199 daddr.sin_addr.s_addr = 0;
201 } else {
202 bc = find_addr(slirp, &daddr.sin_addr, bp->bp_hwaddr);
203 if (!bc) {
204 /* if never assigned, behaves as if it was already
205 assigned (windows fix because it remembers its address) */
206 goto new_addr;
210 saddr.sin_addr = slirp->vhost_addr;
211 saddr.sin_port = htons(BOOTP_SERVER);
213 daddr.sin_port = htons(BOOTP_CLIENT);
215 rbp->bp_op = BOOTP_REPLY;
216 rbp->bp_xid = bp->bp_xid;
217 rbp->bp_htype = 1;
218 rbp->bp_hlen = 6;
219 memcpy(rbp->bp_hwaddr, bp->bp_hwaddr, 6);
221 rbp->bp_yiaddr = daddr.sin_addr; /* Client IP address */
222 rbp->bp_siaddr = saddr.sin_addr; /* Server IP address */
224 q = rbp->bp_vend;
225 memcpy(q, rfc1533_cookie, 4);
226 q += 4;
228 if (bc) {
229 dprintf("%s addr=%08x\n",
230 (dhcp_msg_type == DHCPDISCOVER) ? "offered" : "ack'ed",
231 ntohl(daddr.sin_addr.s_addr));
233 if (dhcp_msg_type == DHCPDISCOVER) {
234 *q++ = RFC2132_MSG_TYPE;
235 *q++ = 1;
236 *q++ = DHCPOFFER;
237 } else /* DHCPREQUEST */ {
238 *q++ = RFC2132_MSG_TYPE;
239 *q++ = 1;
240 *q++ = DHCPACK;
243 if (slirp->bootp_filename)
244 snprintf((char *)rbp->bp_file, sizeof(rbp->bp_file), "%s",
245 slirp->bootp_filename);
247 *q++ = RFC2132_SRV_ID;
248 *q++ = 4;
249 memcpy(q, &saddr.sin_addr, 4);
250 q += 4;
252 *q++ = RFC1533_NETMASK;
253 *q++ = 4;
254 memcpy(q, &slirp->vnetwork_mask, 4);
255 q += 4;
257 if (!slirp->restricted) {
258 *q++ = RFC1533_GATEWAY;
259 *q++ = 4;
260 memcpy(q, &saddr.sin_addr, 4);
261 q += 4;
263 *q++ = RFC1533_DNS;
264 *q++ = 4;
265 memcpy(q, &slirp->vnameserver_addr, 4);
266 q += 4;
269 *q++ = RFC2132_LEASE_TIME;
270 *q++ = 4;
271 val = htonl(LEASE_TIME);
272 memcpy(q, &val, 4);
273 q += 4;
275 if (*slirp->client_hostname) {
276 val = strlen(slirp->client_hostname);
277 *q++ = RFC1533_HOSTNAME;
278 *q++ = val;
279 memcpy(q, slirp->client_hostname, val);
280 q += val;
282 } else {
283 static const char nak_msg[] = "requested address not available";
285 dprintf("nak'ed addr=%08x\n", ntohl(preq_addr->s_addr));
287 *q++ = RFC2132_MSG_TYPE;
288 *q++ = 1;
289 *q++ = DHCPNAK;
291 *q++ = RFC2132_MESSAGE;
292 *q++ = sizeof(nak_msg) - 1;
293 memcpy(q, nak_msg, sizeof(nak_msg) - 1);
294 q += sizeof(nak_msg) - 1;
296 *q++ = RFC1533_END;
298 daddr.sin_addr.s_addr = 0xffffffffu;
300 m->m_len = sizeof(struct bootp_t) -
301 sizeof(struct ip) - sizeof(struct udphdr);
302 udp_output2(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY);
305 void bootp_input(struct mbuf *m)
307 struct bootp_t *bp = mtod(m, struct bootp_t *);
309 if (bp->bp_op == BOOTP_REQUEST) {
310 bootp_reply(m->slirp, bp);