summaryrefslogtreecommitdiff
path: root/usr.sbin/dhcpd/dhcp.c
blob: b0f0373aeacbf01fd95acb415a77ea6e4f881930 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
/*	$OpenBSD: dhcp.c,v 1.21 2006/03/13 19:57:42 otto Exp $ */

/*
 * Copyright (c) 1995, 1996, 1997, 1998, 1999
 * The Internet Software Consortium.   All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of The Internet Software Consortium nor the names
 *    of its contributors may be used to endorse or promote products derived
 *    from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
 * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED.  IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
 * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * This software has been written for the Internet Software Consortium
 * by Ted Lemon <mellon@fugue.com> in cooperation with Vixie
 * Enterprises.  To learn more about the Internet Software Consortium,
 * see ``http://www.vix.com/isc''.  To learn more about Vixie
 * Enterprises, see ``http://www.vix.com''.
 */

#include "dhcpd.h"

int outstanding_pings;

static char dhcp_message[256];

void
dhcp(struct packet *packet)
{
	if (!locate_network(packet) && packet->packet_type != DHCPREQUEST)
		return;

	switch (packet->packet_type) {
	case DHCPDISCOVER:
		dhcpdiscover(packet);
		break;

	case DHCPREQUEST:
		dhcprequest(packet);
		break;

	case DHCPRELEASE:
		dhcprelease(packet);
		break;

	case DHCPDECLINE:
		dhcpdecline(packet);
		break;

	case DHCPINFORM:
		dhcpinform(packet);
		break;

	default:
		break;
	}
}

void
dhcpdiscover(struct packet *packet)
{
	struct lease *lease = find_lease(packet, packet->shared_network, 0);
	struct host_decl *hp;

	note("DHCPDISCOVER from %s via %s",
	    print_hw_addr(packet->raw->htype, packet->raw->hlen,
	    packet->raw->chaddr),
	    packet->raw->giaddr.s_addr ? inet_ntoa(packet->raw->giaddr) :
	    packet->interface->name);

	/* Sourceless packets don't make sense here. */
	if (!packet->shared_network) {
		note("Packet from unknown subnet: %s",
		    inet_ntoa(packet->raw->giaddr));
		return;
	}

	/* If we didn't find a lease, try to allocate one... */
	if (!lease) {
		lease = packet->shared_network->last_lease;

		/*
		 * If there are no leases in that subnet that have
		 * expired, we have nothing to offer this client.
		 */
		if (!lease || lease->ends > cur_time) {
			note("no free leases on subnet %s",
			    packet->shared_network->name);
			return;
		}

		/*
		 * If we find an abandoned lease, take it, but print a
		 * warning message, so that if it continues to lose,
		 * the administrator will eventually investigate.
		 */
		if ((lease->flags & ABANDONED_LEASE)) {
			struct lease *lp;

			/* See if we can find an unabandoned lease first. */
			for (lp = lease; lp; lp = lp->prev) {
				if (lp->ends > cur_time)
					break;
				if (!(lp->flags & ABANDONED_LEASE)) {
					lease = lp;
					break;
				}
			}

			/*
			 * If we can't find an unabandoned lease,
			 * reclaim the abandoned lease.
			 */
			if ((lease->flags & ABANDONED_LEASE)) {
				warning("Reclaiming abandoned IP address %s.",
				    piaddr(lease->ip_addr));
				lease->flags &= ~ABANDONED_LEASE;
			}
		}

		/* Try to find a host_decl that matches the client
		   identifier or hardware address on the packet, and
		   has no fixed IP address.   If there is one, hang
		   it off the lease so that its option definitions
		   can be used. */
		if (((packet->options[DHO_DHCP_CLIENT_IDENTIFIER].len != 0) &&
		    ((hp = find_hosts_by_uid(
		    packet->options[DHO_DHCP_CLIENT_IDENTIFIER].data,
		    packet->options[DHO_DHCP_CLIENT_IDENTIFIER].len)) != NULL)) ||
		    ((hp = find_hosts_by_haddr(packet->raw->htype,
		    packet->raw->chaddr, packet->raw->hlen)) != NULL)) {
			for (; hp; hp = hp->n_ipaddr) {
				if (!hp->fixed_addr) {
					lease->host = hp;
					break;
				}
			}
		} else
			lease->host = NULL;
	}

	/* If this subnet won't boot unknown clients, ignore the
	   request. */
	if (!lease->host &&
	    !lease->subnet->group->boot_unknown_clients) {
		note("Ignoring unknown client %s",
		    print_hw_addr(packet->raw->htype, packet->raw->hlen,
		    packet->raw->chaddr));
	} else if (lease->host && !lease->host->group->allow_booting) {
		note("Declining to boot client %s",
		    lease->host->name ? lease->host->name :
		    print_hw_addr(packet->raw->htype, packet->raw->hlen,
		    packet->raw->chaddr));
	} else
		ack_lease(packet, lease, DHCPOFFER, cur_time + 120);
}

void
dhcprequest(struct packet *packet)
{
	struct lease *lease;
	struct iaddr cip;
	struct subnet *subnet;
	int ours = 0;

	cip.len = 4;
	if (packet->options[DHO_DHCP_REQUESTED_ADDRESS].len)
		memcpy(cip.iabuf,
		    packet->options[DHO_DHCP_REQUESTED_ADDRESS].data, 4);
	else
		memcpy(cip.iabuf, &packet->raw->ciaddr.s_addr, 4);
	subnet = find_subnet(cip);

	/* Find the lease that matches the address requested by the client. */

	if (subnet)
		lease = find_lease(packet, subnet->shared_network, &ours);
	else
		lease = NULL;

	note("DHCPREQUEST for %s from %s via %s", piaddr(cip),
	    print_hw_addr(packet->raw->htype, packet->raw->hlen,
	    packet->raw->chaddr),
	    packet->raw->giaddr.s_addr ? inet_ntoa(packet->raw->giaddr) :
	    packet->interface->name);

	/* If a client on a given network REQUESTs a lease on an
	 * address on a different network, NAK it.  If the Requested
	 * Address option was used, the protocol says that it must
	 * have been broadcast, so we can trust the source network
	 * information.
	 *
	 * If ciaddr was specified and Requested Address was not, then
	 * we really only know for sure what network a packet came from
	 * if it came through a BOOTP gateway - if it came through an
	 * IP router, we'll just have to assume that it's cool.
	 *
	 * If we don't think we know where the packet came from, it
	 * came through a gateway from an unknown network, so it's not
	 * from a RENEWING client.  If we recognize the network it
	 * *thinks* it's on, we can NAK it even though we don't
	 * recognize the network it's *actually* on; otherwise we just
	 * have to ignore it.
	 *
	 * We don't currently try to take advantage of access to the
	 * raw packet, because it's not available on all platforms.
	 * So a packet that was unicast to us through a router from a
	 * RENEWING client is going to look exactly like a packet that
	 * was broadcast to us from an INIT-REBOOT client.
	 *
	 * Since we can't tell the difference between these two kinds
	 * of packets, if the packet appears to have come in off the
	 * local wire, we have to treat it as if it's a RENEWING
	 * client.  This means that we can't NAK a RENEWING client on
	 * the local wire that has a bogus address.  The good news is
	 * that we won't ACK it either, so it should revert to INIT
	 * state and send us a DHCPDISCOVER, which we *can* work with.
	 *
	 * Because we can't detect that a RENEWING client is on the
	 * wrong wire, it's going to sit there trying to renew until
	 * it gets to the REBIND state, when we *can* NAK it because
	 * the packet will get to us through a BOOTP gateway.  We
	 * shouldn't actually see DHCPREQUEST packets from RENEWING
	 * clients on the wrong wire anyway, since their idea of their
	 * local router will be wrong.  In any case, the protocol
	 * doesn't really allow us to NAK a DHCPREQUEST from a
	 * RENEWING client, so we can punt on this issue.
	 */
	if (!packet->shared_network ||
	    (packet->raw->ciaddr.s_addr && packet->raw->giaddr.s_addr) ||
	    (packet->options[DHO_DHCP_REQUESTED_ADDRESS].len &&
	    !packet->raw->ciaddr.s_addr)) {

		/*
		 * If we don't know where it came from but we do know
		 * where it claims to have come from, it didn't come
		 * from there.   Fry it.
		 */
		if (!packet->shared_network) {
			if (subnet &&
			    subnet->shared_network->group->authoritative) {
				nak_lease(packet, &cip);
				return;
			}
			/* Otherwise, ignore it. */
			return;
		}

		/*
		 * If we do know where it came from and it asked for an
		 * address that is not on that shared network, nak it.
		 */
		subnet = find_grouped_subnet(packet->shared_network, cip);
		if (!subnet) {
			if (packet->shared_network->group->authoritative)
				nak_lease(packet, &cip);
			return;
		}
	}

	/*
	 * If we found a lease for the client but it's not the one the
	 * client asked for, don't send it - some other server probably
	 * made the cut.
	 */
	if (lease && !addr_eq(lease->ip_addr, cip)) {
		/*
		 * If we found the address the client asked for, but
		 * it wasn't what got picked, the lease belongs to us,
		 * so we should NAK it.
		 */
		if (ours)
			nak_lease(packet, &cip);
		return;
	}

	/*
	 * If the address the client asked for is ours, but it wasn't
	 * available for the client, NAK it.
	 */
	if (!lease && ours) {
		nak_lease(packet, &cip);
		return;
	}

	/* If we're not allowed to serve this client anymore, don't. */
	if (lease && !lease->host &&
	    !lease->subnet->group->boot_unknown_clients) {
		note("Ignoring unknown client %s",
		    print_hw_addr(packet->raw->htype, packet->raw->hlen,
		    packet->raw->chaddr));
		return;
	} else if (lease && lease->host && !lease->host->group->allow_booting) {
		note("Declining to renew client %s",
		    lease->host->name ? lease->host->name :
		    print_hw_addr(packet->raw->htype, packet->raw->hlen,
		    packet->raw->chaddr));
		return;
	}

	/*
	 * If we own the lease that the client is asking for,
	 * and it's already been assigned to the client, ack it.
	 */
	if (lease &&
	    ((lease->uid_len && lease->uid_len ==
	    packet->options[DHO_DHCP_CLIENT_IDENTIFIER].len &&
	    !memcmp(packet->options[DHO_DHCP_CLIENT_IDENTIFIER].data,
	    lease->uid, lease->uid_len)) ||
	    (lease->hardware_addr.hlen == packet->raw->hlen &&
	    lease->hardware_addr.htype == packet->raw->htype &&
	    !memcmp(lease->hardware_addr.haddr, packet->raw->chaddr,
	    packet->raw->hlen)))) {
		ack_lease(packet, lease, DHCPACK, 0);
		return;
	}

	/*
	 * At this point, the client has requested a lease, and it's
	 * available, but it wasn't assigned to the client, which
	 * means that the client probably hasn't gone through the
	 * DHCPDISCOVER part of the protocol.  We are within our
	 * rights to send a DHCPNAK.   We can also send a DHCPACK.
	 * The thing we probably should not do is to remain silent.
	 * For now, we'll just assign the lease to the client anyway.
	 */
	if (lease)
		ack_lease(packet, lease, DHCPACK, 0);
}

void
dhcprelease(struct packet *packet)
{
	struct lease *lease;
	struct iaddr cip;
	int i;

	/*
	 * DHCPRELEASE must not specify address in requested-address
	 * option, but old protocol specs weren't explicit about this,
	 * so let it go.
	 */
	if (packet->options[DHO_DHCP_REQUESTED_ADDRESS].len) {
		note("DHCPRELEASE from %s specified requested-address.",
		    print_hw_addr(packet->raw->htype, packet->raw->hlen,
		    packet->raw->chaddr));
	}

	i = DHO_DHCP_CLIENT_IDENTIFIER;
	if (packet->options[i].len) {
		lease = find_lease_by_uid(packet->options[i].data,
		    packet->options[i].len);

		/*
		 * See if we can find a lease that matches the
		 * IP address the client is claiming.
		 */
		for (; lease; lease = lease->n_uid) {
			if (!memcmp(&packet->raw->ciaddr,
			    lease->ip_addr.iabuf, 4)) {
				break;
			}
		}
	} else {
		/*
		* The client is supposed to pass a valid client-identifier,
		 * but the spec on this has changed historically, so try the
		 * IP address in ciaddr if the client-identifier fails.
		 */
		cip.len = 4;
		memcpy(cip.iabuf, &packet->raw->ciaddr, 4);
		lease = find_lease_by_ip_addr(cip);
	}

	note("DHCPRELEASE of %s from %s via %s (%sfound)",
	    inet_ntoa(packet->raw->ciaddr),
	    print_hw_addr(packet->raw->htype, packet->raw->hlen,
	    packet->raw->chaddr),
	    packet->raw->giaddr.s_addr ? inet_ntoa(packet->raw->giaddr) :
	    packet->interface->name,
	    lease ? "" : "not ");

	/* If we're already acking this lease, don't do it again. */
	if (lease && lease->state) {
		note("DHCPRELEASE already acking lease %s",
		    piaddr(lease->ip_addr));
		return;
	}

	/* If we found a lease, release it. */
	if (lease && lease->ends > cur_time) {
		/*
		 * First, we ping this lease to see if it's still
		 * there. if it is, we don't release it. This avoids
		 * the problem of spoofed releases being used to liberate
		 * addresses from the server.
		 */
		if (!lease->releasing) {
			note("DHCPRELEASE of %s from %s via %s (found)",
			    inet_ntoa(packet->raw->ciaddr),
			    print_hw_addr(packet->raw->htype,
			    packet->raw->hlen, packet->raw->chaddr),
			    packet->raw->giaddr.s_addr ?
			    inet_ntoa(packet->raw->giaddr) :
			    packet->interface->name);

			lease->releasing = 1;
			add_timeout(cur_time + 1, lease_ping_timeout, lease);
			icmp_echorequest(&(lease->ip_addr));
			++outstanding_pings;
		} else {
			note("DHCPRELEASE of %s from %s via %s ignored "
			    "(release already pending)",
			    inet_ntoa(packet->raw->ciaddr),
			    print_hw_addr(packet->raw->htype,
			    packet->raw->hlen, packet->raw->chaddr),
			    packet->raw->giaddr.s_addr ?
			    inet_ntoa(packet->raw->giaddr) :
			    packet->interface->name);
		}
	} else {
		note("DHCPRELEASE of %s from %s via %s for nonexistent lease",
		    inet_ntoa(packet->raw->ciaddr),
		    print_hw_addr(packet->raw->htype, packet->raw->hlen,
		    packet->raw->chaddr),
		    packet->raw->giaddr.s_addr ?
		    inet_ntoa(packet->raw->giaddr) :
		    packet->interface->name);
	}
}

void
dhcpdecline(struct packet *packet)
{
	struct lease *lease;
	struct iaddr cip;

	/* DHCPDECLINE must specify address. */
	if (!packet->options[DHO_DHCP_REQUESTED_ADDRESS].len)
		return;

	cip.len = 4;
	memcpy(cip.iabuf,
	    packet->options[DHO_DHCP_REQUESTED_ADDRESS].data, 4);
	lease = find_lease_by_ip_addr(cip);

	note("DHCPDECLINE on %s from %s via %s",
	    piaddr(cip), print_hw_addr(packet->raw->htype,
	    packet->raw->hlen, packet->raw->chaddr),
	    packet->raw->giaddr.s_addr ? inet_ntoa(packet->raw->giaddr) :
	    packet->interface->name);

	/* If we're already acking this lease, don't do it again. */
	if (lease && lease->state) {
		note("DHCPDECLINE already acking lease %s",
		    piaddr(lease->ip_addr));
		return;
	}

	/* If we found a lease, mark it as unusable and complain. */
	if (lease)
		abandon_lease(lease, "declined.");
}

void
dhcpinform(struct packet *packet)
{
	note("DHCPINFORM from %s", inet_ntoa(packet->raw->ciaddr));
}

void
nak_lease(struct packet *packet, struct iaddr *cip)
{
	struct sockaddr_in to;
	struct in_addr from;
	int result, i;
	struct dhcp_packet raw;
	unsigned char nak = DHCPNAK;
	struct packet outgoing;
	struct tree_cache *options[256], dhcpnak_tree, dhcpmsg_tree;

	memset(options, 0, sizeof options);
	memset(&outgoing, 0, sizeof outgoing);
	memset(&raw, 0, sizeof raw);
	outgoing.raw = &raw;

	/* Set DHCP_MESSAGE_TYPE to DHCPNAK */
	options[DHO_DHCP_MESSAGE_TYPE] = &dhcpnak_tree;
	options[DHO_DHCP_MESSAGE_TYPE]->value = &nak;
	options[DHO_DHCP_MESSAGE_TYPE]->len = sizeof nak;
	options[DHO_DHCP_MESSAGE_TYPE]->buf_size = sizeof nak;
	options[DHO_DHCP_MESSAGE_TYPE]->timeout = -1;
	options[DHO_DHCP_MESSAGE_TYPE]->tree = NULL;

	/* Set DHCP_MESSAGE to whatever the message is */
	options[DHO_DHCP_MESSAGE] = &dhcpmsg_tree;
	options[DHO_DHCP_MESSAGE]->value = (unsigned char *)dhcp_message;
	options[DHO_DHCP_MESSAGE]->len = strlen(dhcp_message);
	options[DHO_DHCP_MESSAGE]->buf_size = strlen(dhcp_message);
	options[DHO_DHCP_MESSAGE]->timeout = -1;
	options[DHO_DHCP_MESSAGE]->tree = NULL;

	/* Do not use the client's requested parameter list. */
	i = DHO_DHCP_PARAMETER_REQUEST_LIST;
	if (packet->options[i].data) {
		packet->options[i].len = 0;
		dfree(packet->options[i].data, "nak_lease");
		packet->options[i].data = NULL;
	}

	/* Set up the option buffer... */
	outgoing.packet_length = cons_options(packet, outgoing.raw,
	    0, options, 0, 0, 0, NULL, 0);

/*	memset(&raw.ciaddr, 0, sizeof raw.ciaddr);*/
	raw.siaddr = packet->interface->primary_address;
	raw.giaddr = packet->raw->giaddr;
	memcpy(raw.chaddr, packet->raw->chaddr, sizeof raw.chaddr);
	raw.hlen = packet->raw->hlen;
	raw.htype = packet->raw->htype;
	raw.xid = packet->raw->xid;
	raw.secs = packet->raw->secs;
	raw.flags = packet->raw->flags | htons(BOOTP_BROADCAST);
	raw.hops = packet->raw->hops;
	raw.op = BOOTREPLY;

	/* Report what we're sending... */
	note("DHCPNAK on %s to %s via %s", piaddr(*cip),
	    print_hw_addr(packet->raw->htype, packet->raw->hlen,
	    packet->raw->chaddr), packet->raw->giaddr.s_addr ?
	    inet_ntoa(packet->raw->giaddr) : packet->interface->name);

	/* Set up the common stuff... */
	memset(&to, 0, sizeof to);
	to.sin_family = AF_INET;
	to.sin_len = sizeof to;

	from = packet->interface->primary_address;

	/* Make sure that the packet is at least as big as a BOOTP packet. */
	if (outgoing.packet_length < BOOTP_MIN_LEN)
		outgoing.packet_length = BOOTP_MIN_LEN;

	/*
	 * If this was gatewayed, send it back to the gateway.
	 * Otherwise, broadcast it on the local network.
	 */
	if (raw.giaddr.s_addr) {
		to.sin_addr = raw.giaddr;
		to.sin_port = server_port;

		result = send_packet(packet->interface, &raw,
		    outgoing.packet_length, from, &to, packet->haddr);
		if (result == -1)
			warning("send_fallback: %m");
		return;
	} else {
		to.sin_addr.s_addr = htonl(INADDR_BROADCAST);
		to.sin_port = client_port;
	}

	errno = 0;
	result = send_packet(packet->interface, &raw,
	    outgoing.packet_length, from, &to, NULL);
}

void
ack_lease(struct packet *packet, struct lease *lease, unsigned int offer,
    time_t when)
{
	struct lease lt;
	struct lease_state *state;
	time_t lease_time, offered_lease_time, max_lease_time, default_lease_time;
	struct class *vendor_class, *user_class;
	int ulafdr, i;

	/* If we're already acking this lease, don't do it again. */
	if (lease->state) {
		if ((lease->flags & STATIC_LEASE) ||
		    cur_time - lease->timestamp < 60) {
			note("already acking lease %s", piaddr(lease->ip_addr));
			return;
		}
		free_lease_state(lease->state, "ACK timed out");
		lease->state = NULL;
	}

	if (packet->options[DHO_DHCP_CLASS_IDENTIFIER].len) {
		vendor_class =find_class(0,
		    packet->options[DHO_DHCP_CLASS_IDENTIFIER].data,
		    packet->options[DHO_DHCP_CLASS_IDENTIFIER].len);
	} else
		vendor_class = NULL;

	if (packet->options[DHO_DHCP_USER_CLASS_ID].len) {
		user_class = find_class(1,
		    packet->options[DHO_DHCP_USER_CLASS_ID].data,
		    packet->options[DHO_DHCP_USER_CLASS_ID].len);
	} else
		user_class = NULL;

	/*
	 * If there is not a specific host entry, and either the
	 * vendor class or user class (if they exist) deny booting,
	 * then bug out.
	 */
	if (!lease->host) {
		if (vendor_class && !vendor_class->group->allow_booting) {
			debug("Booting denied by vendor class");
			return;
		}

		if (user_class && !user_class->group->allow_booting) {
			debug("Booting denied by user class");
			return;
		}
	}

	/* Allocate a lease state structure... */
	state = new_lease_state("ack_lease");
	if (!state)
		error("unable to allocate lease state!");
	memset(state, 0, sizeof *state);
	state->got_requested_address = packet->got_requested_address;
	state->shared_network = packet->interface->shared_network;

	/* Remember if we got a server identifier option. */
	if (packet->options[DHO_DHCP_SERVER_IDENTIFIER].len)
		state->got_server_identifier = 1;

	/* Replace the old lease hostname with the new one, if it's changed. */
	if (packet->options[DHO_HOST_NAME].len &&
	    lease->client_hostname &&
	    (strlen (lease->client_hostname) == packet->options[DHO_HOST_NAME].len) &&
	    !memcmp(lease->client_hostname, packet->options[DHO_HOST_NAME].data,
	    packet->options[DHO_HOST_NAME].len)) {
	} else if (packet->options[DHO_HOST_NAME].len) {
		if (lease->client_hostname)
			free(lease->client_hostname);
		lease->client_hostname = malloc(
		    packet->options[DHO_HOST_NAME].len + 1);
		if (!lease->client_hostname)
			error("no memory for client hostname.\n");
		memcpy(lease->client_hostname,
		    packet->options[DHO_HOST_NAME].data,
		    packet->options[DHO_HOST_NAME].len);
		lease->client_hostname[packet->options[DHO_HOST_NAME].len] = 0;
	} else if (lease->client_hostname) {
		free(lease->client_hostname);
		lease->client_hostname = 0;
	}

	/*
	 * Choose a filename; first from the host_decl, if any, then from
	 * the user class, then from the vendor class.
	 */
	if (lease->host && lease->host->group->filename)
		strlcpy(state->filename, lease->host->group->filename,
		    sizeof state->filename);
	else if (user_class && user_class->group->filename)
		strlcpy(state->filename, user_class->group->filename,
		    sizeof state->filename);
	else if (vendor_class && vendor_class->group->filename)
		strlcpy(state->filename, vendor_class->group->filename,
		    sizeof state->filename);
	else if (packet->raw->file[0])
		strlcpy(state->filename, packet->raw->file,
		    sizeof state->filename);
	else if (lease->subnet->group->filename)
		strlcpy(state->filename, lease->subnet->group->filename,
		    sizeof state->filename);
	else
		strlcpy(state->filename, "", sizeof state->filename);

	/* Choose a server name as above. */
	if (lease->host && lease->host->group->server_name)
		state->server_name = lease->host->group->server_name;
	else if (user_class && user_class->group->server_name)
		state->server_name = user_class->group->server_name;
	else if (vendor_class && vendor_class->group->server_name)
		state->server_name = vendor_class->group->server_name;
	else if (lease->subnet->group->server_name)
		state->server_name = lease->subnet->group->server_name;
	else state->server_name = NULL;

	/*
	 * At this point, we have a lease that we can offer the client.
	 * Now we construct a lease structure that contains what we want,
	 * and call supersede_lease to do the right thing with it.
	 */
	memset(&lt, 0, sizeof lt);

	/*
	 * Use the ip address of the lease that we finally found in
	 * the database.
	 */
	lt.ip_addr = lease->ip_addr;

	/* Start now. */
	lt.starts = cur_time;

	/* Figure out maximum lease time. */
	if (lease->host && lease->host->group->max_lease_time)
		max_lease_time = lease->host->group->max_lease_time;
	else
		max_lease_time = lease->subnet->group->max_lease_time;

	/* Figure out default lease time. */
	if (lease->host && lease->host->group->default_lease_time)
		default_lease_time = lease->host->group->default_lease_time;
	else
		default_lease_time = lease->subnet->group->default_lease_time;

	/*
	 * Figure out how long a lease to assign.    If this is a
	 * dynamic BOOTP lease, its duration must be infinite.
	 */
	if (offer) {
		if (packet->options[DHO_DHCP_LEASE_TIME].len == 4) {
			lease_time = getULong(
			    packet->options[DHO_DHCP_LEASE_TIME].data);

			/*
			 * Don't let the client ask for a longer lease than
			 * is supported for this subnet or host.
			 *
			 * time_t is signed, so really large numbers come
			 * back as negative.  Don't allow lease_time of 0,
			 * either.
			 */
			if (lease_time < 1 || lease_time > max_lease_time)
				lease_time = max_lease_time;
		} else
			lease_time = default_lease_time;

		state->offered_expiry = cur_time + lease_time;
		if (when)
			lt.ends = when;
		else
			lt.ends = state->offered_expiry;
	} else {
		if (lease->host &&
		    lease->host->group->bootp_lease_length)
			lt.ends = (cur_time +
			    lease->host->group->bootp_lease_length);
		else if (lease->subnet->group->bootp_lease_length)
			lt.ends = (cur_time +
			    lease->subnet->group->bootp_lease_length);
		else if (lease->host &&
		    lease->host->group->bootp_lease_cutoff)
			lt.ends = lease->host->group->bootp_lease_cutoff;
		else
			lt.ends = lease->subnet->group->bootp_lease_cutoff;
		state->offered_expiry = lt.ends;
		lt.flags = BOOTP_LEASE;
	}

	/* Record the uid, if given... */
	i = DHO_DHCP_CLIENT_IDENTIFIER;
	if (packet->options[i].len) {
		if (packet->options[i].len <= sizeof lt.uid_buf) {
			memcpy(lt.uid_buf, packet->options[i].data,
			    packet->options[i].len);
			lt.uid = lt.uid_buf;
			lt.uid_max = sizeof lt.uid_buf;
			lt.uid_len = packet->options[i].len;
		} else {
			lt.uid_max = lt.uid_len = packet->options[i].len;
			lt.uid = (unsigned char *)malloc(lt.uid_max);
			if (!lt.uid)
				error("can't allocate memory for large uid.");
			memcpy(lt.uid, packet->options[i].data, lt.uid_len);
		}
	}

	lt.host = lease->host;
	lt.subnet = lease->subnet;
	lt.shared_network = lease->shared_network;

	/* Don't call supersede_lease on a mocked-up lease. */
	if (lease->flags & STATIC_LEASE) {
		/* Copy the hardware address into the static lease
		   structure. */
		lease->hardware_addr.hlen = packet->raw->hlen;
		lease->hardware_addr.htype = packet->raw->htype;
		memcpy(lease->hardware_addr.haddr, packet->raw->chaddr,
		    sizeof packet->raw->chaddr); /* XXX */
	} else {
		/* Record the hardware address, if given... */
		lt.hardware_addr.hlen = packet->raw->hlen;
		lt.hardware_addr.htype = packet->raw->htype;
		memcpy(lt.hardware_addr.haddr, packet->raw->chaddr,
		    sizeof packet->raw->chaddr);

		/* Install the new information about this lease in the
		   database.  If this is a DHCPACK or a dynamic BOOTREPLY
		   and we can't write the lease, don't ACK it (or BOOTREPLY
		   it) either. */

		if (!(supersede_lease(lease, &lt, !offer || offer == DHCPACK) ||
		    (offer && offer != DHCPACK))) {
			free_lease_state(state, "ack_lease: !supersede_lease");
			return;
		}
	}

	/* Remember the interface on which the packet arrived. */
	state->ip = packet->interface;

	/* Set a flag if this client is a lame Microsoft client that NUL
	   terminates string options and expects us to do likewise. */
	if (packet->options[DHO_HOST_NAME].data &&
	    packet->options[DHO_HOST_NAME].data[
	    packet->options[DHO_HOST_NAME].len - 1] == '\0')
		lease->flags |= MS_NULL_TERMINATION;
	else
		lease->flags &= ~MS_NULL_TERMINATION;

	/* Remember the giaddr, xid, secs, flags and hops. */
	state->giaddr = packet->raw->giaddr;
	state->ciaddr = packet->raw->ciaddr;
	state->xid = packet->raw->xid;
	state->secs = packet->raw->secs;
	state->bootp_flags = packet->raw->flags;
	state->hops = packet->raw->hops;
	state->offer = offer;
	memcpy(&state->haddr, packet->haddr, sizeof state->haddr);

	/* Figure out what options to send to the client: */

	/* Start out with the subnet options... */
	memcpy(state->options, lease->subnet->group->options,
	    sizeof state->options);

	/* Vendor and user classes are only supported for DHCP clients. */
	if (state->offer) {
		/* If we have a vendor class, install those options,
		   superseding any subnet options. */
		if (vendor_class) {
			for (i = 0; i < 256; i++)
				if (vendor_class->group->options[i])
					state->options[i] =
					    vendor_class->group->options[i];
		}

		/* If we have a user class, install those options,
		   superseding any subnet and vendor class options. */
		if (user_class) {
			for (i = 0; i < 256; i++)
				if (user_class->group->options[i])
					state->options[i] =
					    user_class->group->options[i];
		}

	}

	/* If we have a host_decl structure, install the associated
	   options, superseding anything that's in the way. */
	if (lease->host) {
		for (i = 0; i < 256; i++)
			if (lease->host->group->options[i])
				state->options[i] =
				    lease->host->group->options[i];
	}

	/* Get the Maximum Message Size option from the packet, if one
	   was sent. */
	i = DHO_DHCP_MAX_MESSAGE_SIZE;
	if (packet->options[i].data &&
	    packet->options[i].len == sizeof (u_int16_t))
		state->max_message_size = getUShort(packet->options[i].data);
	/* Otherwise, if a maximum message size was specified, use that. */
	else if (state->options[i] && state->options[i]->value)
		state->max_message_size = getUShort(state->options[i]->value);

	/* Save the parameter request list if there is one. */
	i = DHO_DHCP_PARAMETER_REQUEST_LIST;
	if (packet->options[i].data) {
		state->prl = dmalloc(packet->options[i].len, "ack_lease: prl");
		if (!state->prl)
			warning("no memory for parameter request list");
		else {
			memcpy(state->prl, packet->options[i].data,
			    packet->options[i].len);
			state->prl_len = packet->options[i].len;
		}
	}

	/* If we didn't get a hostname from an option somewhere, see if
	   we can get one from the lease. */
	i = DHO_HOST_NAME;
	if (!state->options[i] && lease->hostname) {
		state->options[i] = new_tree_cache("hostname");
		state->options[i]->flags = TC_TEMPORARY;
		state->options[i]->value = (unsigned char *)lease->hostname;
		state->options[i]->len = strlen (lease->hostname);
		state->options[i]->buf_size = state->options[i]->len;
		state->options[i]->timeout = -1;
		state->options[i]->tree = NULL;
	}

	/*
	 * Now, if appropriate, put in DHCP-specific options that
	 * override those.
	 */
	if (state->offer) {
		i = DHO_DHCP_MESSAGE_TYPE;
		state->options[i] = new_tree_cache("message-type");
		state->options[i]->flags = TC_TEMPORARY;
		state->options[i]->value = &state->offer;
		state->options[i]->len = sizeof state->offer;
		state->options[i]->buf_size = sizeof state->offer;
		state->options[i]->timeout = -1;
		state->options[i]->tree = NULL;

		i = DHO_DHCP_SERVER_IDENTIFIER;
		if (!state->options[i]) {
		 use_primary:
			state->options[i] = new_tree_cache("server-id");
			state->options[i]->value =
			    (unsigned char *)&state->ip->primary_address;
			state->options[i]->len =
			    sizeof state->ip->primary_address;
			state->options[i]->buf_size =
			    state->options[i]->len;
			state->options[i]->timeout = -1;
			state->options[i]->tree = NULL;
			state->from.len = sizeof state->ip->primary_address;
			memcpy(state->from.iabuf, &state->ip->primary_address,
			    state->from.len);
		} else {
			/* Find the value of the server identifier... */
			if (!tree_evaluate (state->options[i]))
				goto use_primary;
			if (!state->options[i]->value ||
			    (state->options[i]->len > sizeof state->from.iabuf))
				goto use_primary;

			state->from.len = state->options[i]->len;
			memcpy(state->from.iabuf, state->options[i]->value,
			    state->from.len);
		}

		/* Sanity check the lease time. */
		if ((state->offered_expiry - cur_time) < 15)
			offered_lease_time = default_lease_time;
		else if (state->offered_expiry - cur_time > max_lease_time)
			offered_lease_time = max_lease_time;
		else
			offered_lease_time =
			    state->offered_expiry - cur_time;

		putULong((unsigned char *)&state->expiry,
		    offered_lease_time);
		i = DHO_DHCP_LEASE_TIME;
		state->options[i] = new_tree_cache ("lease-expiry");
		state->options[i]->flags = TC_TEMPORARY;
		state->options[i]->value = (unsigned char *)&state->expiry;
		state->options[i]->len = sizeof state->expiry;
		state->options[i]->buf_size = sizeof state->expiry;
		state->options[i]->timeout = -1;
		state->options[i]->tree = NULL;

		/* Renewal time is lease time * 0.5. */
		offered_lease_time /= 2;
		putULong ((unsigned char *)&state->renewal,
			  offered_lease_time);
		i = DHO_DHCP_RENEWAL_TIME;
		state->options[i] = new_tree_cache ("renewal-time");
		state->options[i]->flags = TC_TEMPORARY;
		state->options[i]->value =
			(unsigned char *)&state->renewal;
		state->options[i]->len = sizeof state->renewal;
		state->options[i]->buf_size = sizeof state->renewal;
		state->options[i]->timeout = -1;
		state->options[i]->tree = NULL;


		/* Rebinding time is lease time * 0.875. */
		offered_lease_time += (offered_lease_time / 2 +
		    offered_lease_time / 4);
		putULong ((unsigned char *)&state->rebind,
		    offered_lease_time);
		i = DHO_DHCP_REBINDING_TIME;
		state->options[i] = new_tree_cache ("rebind-time");
		state->options[i]->flags = TC_TEMPORARY;
		state->options[i]->value =
			(unsigned char *)&state->rebind;
		state->options[i]->len = sizeof state->rebind;
		state->options[i]->buf_size = sizeof state->rebind;
		state->options[i]->timeout = -1;
		state->options[i]->tree = NULL;

		/* If we used the vendor class the client specified, we
		   have to return it. */
		if (vendor_class) {
			i = DHO_DHCP_CLASS_IDENTIFIER;
			state->options[i] =
				new_tree_cache ("class-identifier");
			state->options[i]->flags = TC_TEMPORARY;
			state->options[i]->value =
				(unsigned char *)vendor_class->name;
			state->options[i]->len =
				strlen (vendor_class->name);
			state->options[i]->buf_size =
				state->options[i]->len;
			state->options[i]->timeout = -1;
			state->options[i]->tree = NULL;
		}

		/* If we used the user class the client specified, we
		   have to return it. */
		if (user_class) {
			i = DHO_DHCP_USER_CLASS_ID;
			state->options[i] = new_tree_cache ("user-class");
			state->options[i]->flags = TC_TEMPORARY;
			state->options[i]->value =
				(unsigned char *)user_class->name;
			state->options[i]->len =
				strlen (user_class->name);
			state->options[i]->buf_size =
				state->options[i]->len;
			state->options[i]->timeout = -1;
			state->options[i]->tree = NULL;
		}
	}

	/* Use the subnet mask from the subnet declaration if no other
	   mask has been provided. */
	i = DHO_SUBNET_MASK;
	if (!state->options[i]) {
		state->options[i] = new_tree_cache ("subnet-mask");
		state->options[i]->flags = TC_TEMPORARY;
		state->options[i]->value =
			lease->subnet->netmask.iabuf;
		state->options[i]->len = lease->subnet->netmask.len;
		state->options[i]->buf_size =
			lease->subnet->netmask.len;
		state->options[i]->timeout = -1;
		state->options[i]->tree = NULL;
	}

	/* If so directed, use the leased IP address as the router address.
	   This supposedly makes Win95 machines ARP for all IP addresses,
	   so if the local router does proxy arp, you win. */

	ulafdr = 0;
	if (lease->host) {
		if (lease->host->group->use_lease_addr_for_default_route)
			ulafdr = 1;
	} else if (user_class) {
		if (user_class->group->use_lease_addr_for_default_route)
			ulafdr = 1;
	} else if (vendor_class) {
		if (vendor_class->group->use_lease_addr_for_default_route)
			ulafdr = 1;
	} else if (lease->subnet->group->use_lease_addr_for_default_route)
		ulafdr = 1;
	else
		ulafdr = 0;

	i = DHO_ROUTERS;
	if (ulafdr && !state->options[i]) {
		state->options[i] = new_tree_cache ("routers");
		state->options[i]->flags = TC_TEMPORARY;
		state->options[i]->value = lease->ip_addr.iabuf;
		state->options[i]->len = lease->ip_addr.len;
		state->options[i]->buf_size = lease->ip_addr.len;
		state->options[i]->timeout = -1;
		state->options[i]->tree = NULL;
	}

	lease->state = state;

	/* If this is a DHCPOFFER, ping the lease address before actually
	   sending the offer. */
	if (offer == DHCPOFFER && !(lease->flags & STATIC_LEASE) &&
	    cur_time - lease->timestamp > 60) {
		lease->timestamp = cur_time;
		icmp_echorequest (&lease->ip_addr);
		add_timeout (cur_time + 1, lease_ping_timeout, lease);
		++outstanding_pings;
	} else {
		lease->timestamp = cur_time;
		dhcp_reply (lease);
	}
}

void
dhcp_reply(struct lease *lease)
{
	int bufs = 0, packet_length, i;
	struct dhcp_packet raw;
	struct sockaddr_in to;
	struct in_addr from;
	struct lease_state *state = lease->state;
	int nulltp, bootpp;
	u_int8_t *prl;
	int prl_len;

	if (!state)
		error("dhcp_reply was supplied lease with no state!");

	/* Compose a response for the client... */
	memset(&raw, 0, sizeof raw);

	/* Copy in the filename if given; otherwise, flag the filename
	   buffer as available for options. */
	if (state->filename[0])
		strlcpy(raw.file, state->filename, sizeof raw.file);
	else
		bufs |= 1;

	/* Copy in the server name if given; otherwise, flag the
	   server_name buffer as available for options. */
	if (state->server_name)
		strlcpy(raw.sname, state->server_name, sizeof raw.sname);
	else
		bufs |= 2; /* XXX */

	memcpy(raw.chaddr, lease->hardware_addr.haddr, sizeof raw.chaddr);
	raw.hlen = lease->hardware_addr.hlen;
	raw.htype = lease->hardware_addr.htype;

	/* See if this is a Microsoft client that NUL-terminates its
	   strings and expects us to do likewise... */
	if (lease->flags & MS_NULL_TERMINATION)
		nulltp = 1;
	else
		nulltp = 0;

	/* See if this is a bootp client... */
	if (state->offer)
		bootpp = 0;
	else
		bootpp = 1;

	if (state->options[DHO_DHCP_PARAMETER_REQUEST_LIST] &&
	    state->options[DHO_DHCP_PARAMETER_REQUEST_LIST]->value) {
		prl = state->options[DHO_DHCP_PARAMETER_REQUEST_LIST]->value;
		prl_len = state->options[DHO_DHCP_PARAMETER_REQUEST_LIST]->len;
	} else if (state->prl) {
		prl = state->prl;
		prl_len = state->prl_len;
	} else {
		prl = NULL;
		prl_len = 0;
	}

	/* Insert such options as will fit into the buffer. */
	packet_length = cons_options(NULL, &raw, state->max_message_size,
	    state->options, bufs, nulltp, bootpp, prl, prl_len);

	/* Having done the cons_options(), we can release the tree_cache
	   entries. */
	for (i = 0; i < 256; i++) {
		if (state->options[i] &&
		    state->options[i]->flags & TC_TEMPORARY)
			free_tree_cache(state->options[i]);
	}

	memcpy(&raw.ciaddr, &state->ciaddr, sizeof raw.ciaddr);
	memcpy(&raw.yiaddr, lease->ip_addr.iabuf, 4);

	/* Figure out the address of the next server. */
	if (lease->host && lease->host->group->next_server.len)
		memcpy(&raw.siaddr, lease->host->group->next_server.iabuf, 4);
	else if (lease->subnet->group->next_server.len)
		memcpy(&raw.siaddr, lease->subnet->group->next_server.iabuf, 4);
	else if (lease->subnet->interface_address.len)
		memcpy(&raw.siaddr, lease->subnet->interface_address.iabuf, 4);
	else
		raw.siaddr = state->ip->primary_address;

	raw.giaddr = state->giaddr;

	raw.xid = state->xid;
	raw.secs = state->secs;
	raw.flags = state->bootp_flags;
	raw.hops = state->hops;
	raw.op = BOOTREPLY;

	/* Say what we're doing... */
	note("%s on %s to %s via %s",
	    (state->offer ? (state->offer == DHCPACK ? "DHCPACK" : "DHCPOFFER") :
	    "BOOTREPLY"),
	    piaddr(lease->ip_addr),
	    print_hw_addr(lease->hardware_addr.htype, lease->hardware_addr.hlen,
	    lease->hardware_addr.haddr),
	    state->giaddr.s_addr ? inet_ntoa(state->giaddr) : state->ip->name);

	memset(&to, 0, sizeof to);
	to.sin_family = AF_INET;
#ifdef HAVE_SA_LEN
	to.sin_len = sizeof to;
#endif

	/* Make sure outgoing packets are at least as big
	   as a BOOTP packet. */
	if (packet_length < BOOTP_MIN_LEN)
		packet_length = BOOTP_MIN_LEN;

	/* If this was gatewayed, send it back to the gateway... */
	if (raw.giaddr.s_addr) {
		to.sin_addr = raw.giaddr;
		to.sin_port = server_port;

		memcpy(&from, state->from.iabuf, sizeof from);

		(void) send_packet(state->ip, &raw,
		    packet_length, from, &to, &state->haddr);

		free_lease_state(state, "dhcp_reply gateway");
		lease->state = NULL;
		return;

	/* If the client is RENEWING, unicast to the client using the
	   regular IP stack.  Some clients, particularly those that
	   follow RFC1541, are buggy, and send both ciaddr and
	   server-identifier.  We deal with this situation by assuming
	   that if we got both dhcp-server-identifier and ciaddr, and
	   giaddr was not set, then the client is on the local
	   network, and we can therefore unicast or broadcast to it
	   successfully.  A client in REQUESTING state on another
	   network that's making this mistake will have set giaddr,
	   and will therefore get a relayed response from the above
	   code. */
	} else if (raw.ciaddr.s_addr &&
	    !((state->got_server_identifier ||
	    (raw.flags & htons(BOOTP_BROADCAST))) &&
	    /* XXX This won't work if giaddr isn't zero, but it is: */
	    (state->shared_network == lease->shared_network)) &&
	    state->offer == DHCPACK) {
		to.sin_addr = raw.ciaddr;
		to.sin_port = client_port;

	/* If it comes from a client that already knows its address
	   and is not requesting a broadcast response, and we can
	   unicast to a client without using the ARP protocol, sent it
	   directly to that client. */
	} else if (!(raw.flags & htons (BOOTP_BROADCAST))) {
		to.sin_addr = raw.yiaddr;
		to.sin_port = client_port;

	/* Otherwise, broadcast it on the local network. */
	} else {
		to.sin_addr.s_addr = htonl(INADDR_BROADCAST);
		to.sin_port = client_port;
	}

	memcpy(&from, state->from.iabuf, sizeof from);

	(void) send_packet(state->ip, &raw, packet_length,
	    from, &to, &state->haddr);

	free_lease_state(state, "dhcp_reply");
	lease->state = NULL;
}

struct lease *
find_lease(struct packet *packet, struct shared_network *share,
    int *ours)
{
	struct lease *uid_lease, *ip_lease, *hw_lease;
	struct lease *lease = NULL;
	struct iaddr cip;
	struct host_decl *hp, *host = NULL;
	struct lease *fixed_lease;

	/* Figure out what IP address the client is requesting, if any. */
	if (packet->options[DHO_DHCP_REQUESTED_ADDRESS].len &&
	    packet->options[DHO_DHCP_REQUESTED_ADDRESS].len == 4) {
		packet->got_requested_address = 1;
		cip.len = 4;
		memcpy(cip.iabuf,
		    packet->options[DHO_DHCP_REQUESTED_ADDRESS].data,
		    cip.len);
	} else if (packet->raw->ciaddr.s_addr) {
		cip.len = 4;
		memcpy(cip.iabuf, &packet->raw->ciaddr, 4);
	} else
		cip.len = 0;

	/* Try to find a host or lease that's been assigned to the
	   specified unique client identifier. */
	if (packet->options[DHO_DHCP_CLIENT_IDENTIFIER].len) {
		/* First, try to find a fixed host entry for the specified
		   client identifier... */
		hp = find_hosts_by_uid(
		    packet->options[DHO_DHCP_CLIENT_IDENTIFIER].data,
		    packet->options[DHO_DHCP_CLIENT_IDENTIFIER].len);
		if (hp) {
			host = hp;
			fixed_lease = mockup_lease(packet, share, hp);
			uid_lease = NULL;
		} else {
			uid_lease = find_lease_by_uid(
			    packet->options[DHO_DHCP_CLIENT_IDENTIFIER].data,
			    packet->options[DHO_DHCP_CLIENT_IDENTIFIER].len);
			/* Find the lease matching this uid that's on the
			   network the packet came from (if any). */
			for (; uid_lease; uid_lease = uid_lease->n_uid)
				if (uid_lease->shared_network == share)
					break;
			fixed_lease = NULL;
			if (uid_lease && (uid_lease->flags & ABANDONED_LEASE))
				uid_lease = NULL;
		}
	} else {
		uid_lease = NULL;
		fixed_lease = NULL;
	}

	/* If we didn't find a fixed lease using the uid, try doing
	   it with the hardware address... */
	if (!fixed_lease) {
		hp = find_hosts_by_haddr(packet->raw->htype,
		    packet->raw->chaddr, packet->raw->hlen);
		if (hp) {
			host = hp; /* Save it for later. */
			fixed_lease = mockup_lease (packet, share, hp);
		}
	}

	/* If fixed_lease is present but does not match the requested
	   IP address, and this is a DHCPREQUEST, then we can't return
	   any other lease, so we might as well return now. */
	if (packet->packet_type == DHCPREQUEST && fixed_lease &&
	    (fixed_lease->ip_addr.len != cip.len ||
	    memcmp(fixed_lease->ip_addr.iabuf, cip.iabuf, cip.len))) {
		if (ours)
			*ours = 1;
		strlcpy(dhcp_message, "requested address is incorrect",
		    sizeof (dhcp_message));
		return NULL;
	}

	/* Try to find a lease that's been attached to the client's
	   hardware address... */
	hw_lease = find_lease_by_hw_addr(packet->raw->chaddr,
	    packet->raw->hlen);
	/* Find the lease that's on the network the packet came from
	   (if any). */
	for (; hw_lease; hw_lease = hw_lease->n_hw) {
		if (hw_lease->shared_network == share) {
			if ((hw_lease->flags & ABANDONED_LEASE))
				continue;
			if (packet->packet_type)
				break;
			if (hw_lease->flags &
			    (BOOTP_LEASE | DYNAMIC_BOOTP_OK))
				break;
		}
	}

	/* Try to find a lease that's been allocated to the client's
	   IP address. */
	if (cip.len)
		ip_lease = find_lease_by_ip_addr(cip);
	else
		ip_lease = NULL;

	/* If ip_lease is valid at this point, set ours to one, so that
	   even if we choose a different lease, we know that the address
	   the client was requesting was ours, and thus we can NAK it. */
	if (ip_lease && ours)
		*ours = 1;

	/* If the requested IP address isn't on the network the packet
	   came from, don't use it.  Allow abandoned leases to be matched
	   here - if the client is requesting it, there's a decent chance
	   that it's because the lease database got trashed and a client
	   that thought it had this lease answered an ARP or PING, causing the
	   lease to be abandoned.   If so, this request probably came from
	   that client. */
	if (ip_lease && (ip_lease->shared_network != share)) {
		ip_lease = NULL;
		strlcpy(dhcp_message, "requested address on bad subnet",
		    sizeof(dhcp_message));
	}

	/* Toss ip_lease if it hasn't yet expired and isn't owned by the
	   client. */
	if (ip_lease && ip_lease->ends >= cur_time && ip_lease != uid_lease) {
		int i = DHO_DHCP_CLIENT_IDENTIFIER;

		/* Make sure that ip_lease actually belongs to the client,
		   and toss it if not. */
		if ((ip_lease->uid_len && packet->options[i].data &&
		    ip_lease->uid_len == packet->options[i].len &&
		    !memcmp(packet->options[i].data, ip_lease->uid,
		    ip_lease->uid_len)) ||
		    (!ip_lease->uid_len &&
		    ip_lease->hardware_addr.htype == packet->raw->htype &&
		    ip_lease->hardware_addr.hlen == packet->raw->hlen &&
		    !memcmp(ip_lease->hardware_addr.haddr, packet->raw->chaddr,
		    ip_lease->hardware_addr.hlen))) {
			if (uid_lease) {
				if (uid_lease->ends > cur_time) {
					warning("client %s has duplicate leases on %s",
					    print_hw_addr(packet->raw->htype,
					    packet->raw->hlen, packet->raw->chaddr),
					    ip_lease->shared_network->name);

					if (uid_lease && !packet->raw->ciaddr.s_addr)
						release_lease (uid_lease);
				}
				uid_lease = ip_lease;
			}
		} else {
			strlcpy(dhcp_message, "requested address is not available",
			    sizeof(dhcp_message));
			ip_lease = NULL;
		}

		/* If we get to here and fixed_lease is not null, that means
		   that there are both a dynamic lease and a fixed-address
		   declaration for the same IP address. */
		if (packet->packet_type == DHCPREQUEST && fixed_lease) {
			fixed_lease = NULL;
db_conflict:
			warning("Both dynamic and static leases present for %s.",
			    piaddr(cip));
			warning("Either remove host declaration %s or remove %s",
			    (fixed_lease && fixed_lease->host ?
			    (fixed_lease->host->name ? fixed_lease->host->name :
			    piaddr(cip)) : piaddr(cip)), piaddr(cip));
			warning("from the dynamic address pool for %s",
			    share->name);
			if (fixed_lease)
				ip_lease = NULL;
			strlcpy(dhcp_message, "database conflict - call for help!",
			    sizeof(dhcp_message));
		}
	}

	/* If we get to here with both fixed_lease and ip_lease not
	   null, then we have a configuration file bug. */
	if (packet->packet_type == DHCPREQUEST && fixed_lease && ip_lease)
		goto db_conflict;

	/* Toss hw_lease if it hasn't yet expired and the uid doesn't
	   match, except that if the hardware address matches and the
	   client is now doing dynamic BOOTP (and thus hasn't provided
	   a uid) we let the client get away with it. */
	if (hw_lease && hw_lease->ends >= cur_time && hw_lease->uid &&
	    packet->options[DHO_DHCP_CLIENT_IDENTIFIER].len &&
	    hw_lease != uid_lease)
		hw_lease = NULL;

	/* Toss extra pointers to the same lease... */
	if (hw_lease == uid_lease)
		hw_lease = NULL;
	if (ip_lease == hw_lease)
		hw_lease = NULL;
	if (ip_lease == uid_lease)
		uid_lease = NULL;

	/* If we've already eliminated the lease, it wasn't there to
	   begin with.   If we have come up with a matching lease,
	   set the message to bad network in case we have to throw it out. */
	if (!ip_lease) {
		strlcpy(dhcp_message, "requested address not available",
		    sizeof(dhcp_message));
	}

	/* Now eliminate leases that are on the wrong network... */
	if (ip_lease && share != ip_lease->shared_network) {
		if (packet->packet_type == DHCPREQUEST)
			release_lease(ip_lease);
		ip_lease = NULL;
	}
	if (uid_lease && share != uid_lease->shared_network) {
		if (packet->packet_type == DHCPREQUEST)
			release_lease(uid_lease);
		uid_lease = NULL;
	}
	if (hw_lease && share != hw_lease->shared_network) {
		if (packet->packet_type == DHCPREQUEST)
			release_lease(hw_lease);
		hw_lease = NULL;
	}

	/* If this is a DHCPREQUEST, make sure the lease we're going to return
	   matches the requested IP address.   If it doesn't, don't return a
	   lease at all. */
	if (packet->packet_type == DHCPREQUEST && !ip_lease && !fixed_lease)
		return NULL;

	/* At this point, if fixed_lease is nonzero, we can assign it to
	   this client. */
	if (fixed_lease)
		lease = fixed_lease;

	/* If we got a lease that matched the ip address and don't have
	   a better offer, use that; otherwise, release it. */
	if (ip_lease) {
		if (lease) {
			if (packet->packet_type == DHCPREQUEST)
				release_lease(ip_lease);
		} else {
			lease = ip_lease;
			lease->host = NULL;
		}
	}

	/* If we got a lease that matched the client identifier, we may want
	   to use it, but if we already have a lease we like, we must free
	   the lease that matched the client identifier. */
	if (uid_lease) {
		if (lease) {
			if (packet->packet_type == DHCPREQUEST)
				release_lease(uid_lease);
		} else {
			lease = uid_lease;
			lease->host = NULL;
		}
	}

	/* The lease that matched the hardware address is treated likewise. */
	if (hw_lease) {
		if (lease) {
			if (packet->packet_type == DHCPREQUEST)
				release_lease(hw_lease);
		} else {
			lease = hw_lease;
			lease->host = NULL;
		}
	}

	/* If we found a host_decl but no matching address, try to
	   find a host_decl that has no address, and if there is one,
	   hang it off the lease so that we can use the supplied
	   options. */
	if (lease && host && !lease->host) {
		for (; host; host = host->n_ipaddr) {
			if (!host->fixed_addr) {
				lease->host = host;
				break;
			}
		}
	}

	/* If we find an abandoned lease, take it, but print a
	   warning message, so that if it continues to lose,
	   the administrator will eventually investigate. */
	if (lease && (lease->flags & ABANDONED_LEASE)) {
		if (packet->packet_type == DHCPREQUEST) {
			warning("Reclaiming REQUESTed abandoned IP address %s.",
			    piaddr(lease->ip_addr));
			lease->flags &= ~ABANDONED_LEASE;
		} else
			lease = NULL;
	}
	return lease;
}

/*
 * Search the provided host_decl structure list for an address that's on
 * the specified shared network.  If one is found, mock up and return a
 * lease structure for it; otherwise return the null pointer.
 */
struct lease *
mockup_lease(struct packet *packet, struct shared_network *share,
    struct host_decl *hp)
{
	static struct lease mock;

	mock.subnet = find_host_for_network(&hp, &mock.ip_addr, share);
	if (!mock.subnet)
		return (NULL);
	mock.next = mock.prev = NULL;
	mock.shared_network = mock.subnet->shared_network;
	mock.host = hp;

	if (hp->group->options[DHO_DHCP_CLIENT_IDENTIFIER]) {
		mock.uid = hp->group->options[DHO_DHCP_CLIENT_IDENTIFIER]->value;
		mock.uid_len = hp->group->options[DHO_DHCP_CLIENT_IDENTIFIER]->len;
	} else {
		mock.uid = NULL;
		mock.uid_len = 0;
	}

	mock.hardware_addr = hp->interface;
	mock.starts = mock.timestamp = mock.ends = MIN_TIME;
	mock.flags = STATIC_LEASE;
	return &mock;
}