nfs_bootdhcp.c revision 1.30
1/*	$NetBSD: nfs_bootdhcp.c,v 1.30 2006/03/16 15:55:20 christos Exp $	*/
2
3/*-
4 * Copyright (c) 1995, 1997 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Adam Glass and Gordon W. Ross.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 * 3. All advertising materials mentioning features or use of this software
19 *    must display the following acknowledgement:
20 *	This product includes software developed by the NetBSD
21 *	Foundation, Inc. and its contributors.
22 * 4. Neither the name of The NetBSD Foundation nor the names of its
23 *    contributors may be used to endorse or promote products derived
24 *    from this software without specific prior written permission.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
27 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
28 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
29 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
30 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
31 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
32 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
33 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
34 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
35 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
36 * POSSIBILITY OF SUCH DAMAGE.
37 */
38
39/*
40 * Support for NFS diskless booting with BOOTP (RFC951, RFC1048)
41 *
42 * History:
43 *
44 * Tor Egge developed the initial version of this code based on
45 * the Sun RPC/bootparam sources nfs_boot.c and krpc_subr.c and
46 * submitted that work to NetBSD as bugreport "kern/2351" on
47 * 29 Apr 1996.
48 *
49 * Gordon Ross reorganized Tor's version into this form and
50 * integrated it into the NetBSD sources during Aug 1997.
51 */
52
53#include <sys/cdefs.h>
54__KERNEL_RCSID(0, "$NetBSD: nfs_bootdhcp.c,v 1.30 2006/03/16 15:55:20 christos Exp $");
55
56#include "opt_nfs_boot.h"
57
58#include <sys/param.h>
59#include <sys/systm.h>
60#include <sys/kernel.h>
61#include <sys/device.h>
62#include <sys/ioctl.h>
63#include <sys/proc.h>
64#include <sys/mount.h>
65#include <sys/mbuf.h>
66#include <sys/reboot.h>
67#include <sys/socket.h>
68#include <sys/socketvar.h>
69
70#include <net/if.h>
71#include <net/if_types.h>
72#include <net/if_arp.h> 	/* ARPHRD_ETHER, etc. */
73#include <net/if_dl.h>
74#include <net/if_ether.h>
75#include <net/route.h>
76
77#include <netinet/in.h>
78#include <netinet/if_inarp.h>
79
80#include <nfs/rpcv2.h>
81
82#include <nfs/nfsproto.h>
83#include <nfs/nfs.h>
84#include <nfs/nfsmount.h>
85#include <nfs/nfsdiskless.h>
86
87/*
88 * There are two implementations of NFS diskless boot.
89 * This implementation uses BOOTP (RFC951, RFC1048), and
90 * the other uses Sun RPC/bootparams (nfs_bootparam.c).
91 *
92 * This method gets everything it needs with one BOOTP
93 * request and reply.  Note that this actually uses only
94 * the old BOOTP functionality subset of DHCP.  It is not
95 * clear that DHCP provides any advantage over BOOTP for
96 * diskless boot.  DHCP allows the server to assign an IP
97 * address without any a-priori knowledge of the client,
98 * but we require that the server has a-priori knowledge
99 * of the client so it can export our (unique) NFS root.
100 * Given that the server needs a-priori knowledge about
101 * the client anyway, it might as well assign a fixed IP
102 * address for the client and support BOOTP.
103 *
104 * On the other hand, disk-FULL clients may use DHCP, but
105 * in that case the DHCP client should be user-mode code,
106 * and has no bearing on the code below. -gwr
107 */
108
109/* Begin stuff from bootp.h */
110/* Definitions from RFC951 */
111#define BP_CHADDR_LEN	 16
112#define BP_SNAME_LEN	 64
113#define BP_FILE_LEN	128
114#define BP_VEND_LEN	 64
115struct bootp {
116	u_int8_t	bp_op;		/* packet opcode type */
117	u_int8_t	bp_htype;	/* hardware addr type */
118	u_int8_t	bp_hlen;	/* hardware addr length */
119	u_int8_t	bp_hops;	/* gateway hops */
120	u_int32_t	bp_xid;		/* transaction ID */
121	u_int16_t	bp_secs;	/* seconds since boot began */
122	u_int16_t	bp_flags;	/* RFC1532 broadcast, etc. */
123	struct in_addr	bp_ciaddr;	/* client IP address */
124	struct in_addr	bp_yiaddr;	/* 'your' IP address */
125	struct in_addr	bp_siaddr;	/* server IP address */
126	struct in_addr	bp_giaddr;	/* gateway IP address */
127	u_int8_t bp_chaddr[BP_CHADDR_LEN]; /* client hardware address */
128	char	bp_sname[BP_SNAME_LEN]; /* server host name */
129	char	bp_file[BP_FILE_LEN];	/* boot file name */
130	u_int8_t bp_vend[BP_VEND_LEN];	/* RFC1048 options */
131	/*
132	 * Note that BOOTP packets are allowed to be longer
133	 * (see RFC 1532 sect. 2.1) and common practice is to
134	 * allow the option data in bp_vend to extend into the
135	 * additional space provided in longer packets.
136	 */
137};
138
139#define IPPORT_BOOTPS 67
140#define IPPORT_BOOTPC 68
141
142#define BOOTREQUEST		1
143#define BOOTREPLY		2
144
145/*
146 * Is this available from the sockaddr_dl somehow?
147 * Perhaps (struct arphdr)->ar_hrd = ARPHRD_ETHER?
148 * The interface has ->if_type but not the ARP fmt.
149 */
150#define HTYPE_ETHERNET		1
151#define HTYPE_IEEE802		6
152
153/*
154 * Vendor magic cookie (v_magic) for RFC1048
155 */
156static const u_int8_t vm_rfc1048[4] = { 99, 130, 83, 99 };
157
158/*
159 * Tag values used to specify what information is being supplied in
160 * the vendor (options) data area of the packet.
161 */
162/* RFC 1048 */
163#define TAG_END			((unsigned char) 255)
164#define TAG_PAD			((unsigned char)   0)
165#define TAG_SUBNET_MASK		((unsigned char)   1)
166#define TAG_TIME_OFFSET		((unsigned char)   2)
167#define TAG_GATEWAY		((unsigned char)   3)
168#define TAG_TIME_SERVER		((unsigned char)   4)
169#define TAG_NAME_SERVER		((unsigned char)   5)
170#define TAG_DOMAIN_SERVER	((unsigned char)   6)
171#define TAG_LOG_SERVER		((unsigned char)   7)
172#define TAG_COOKIE_SERVER	((unsigned char)   8)
173#define TAG_LPR_SERVER		((unsigned char)   9)
174#define TAG_IMPRESS_SERVER	((unsigned char)  10)
175#define TAG_RLP_SERVER		((unsigned char)  11)
176#define TAG_HOST_NAME		((unsigned char)  12)
177#define TAG_BOOT_SIZE		((unsigned char)  13)
178/* RFC 1395 */
179#define TAG_DUMP_FILE		((unsigned char)  14)
180#define TAG_DOMAIN_NAME		((unsigned char)  15)
181#define TAG_SWAP_SERVER		((unsigned char)  16)
182#define TAG_ROOT_PATH		((unsigned char)  17)
183/* End of stuff from bootp.h */
184
185#ifdef NFS_BOOT_DHCP
186#define TAG_REQ_ADDR		((unsigned char)  50)
187#define TAG_LEASETIME		((unsigned char)  51)
188#define TAG_OVERLOAD		((unsigned char)  52)
189#define TAG_DHCP_MSGTYPE	((unsigned char)  53)
190#define TAG_SERVERID		((unsigned char)  54)
191#define TAG_PARAM_REQ		((unsigned char)  55)
192#define TAG_MSG			((unsigned char)  56)
193#define TAG_MAXSIZE		((unsigned char)  57)
194#define TAG_T1			((unsigned char)  58)
195#define TAG_T2			((unsigned char)  59)
196#define TAG_CLASSID		((unsigned char)  60)
197#define TAG_CLIENTID		((unsigned char)  61)
198#endif
199
200#ifdef NFS_BOOT_DHCP
201#define DHCPDISCOVER 1
202#define DHCPOFFER 2
203#define DHCPREQUEST 3
204#define DHCPDECLINE 4
205#define DHCPACK 5
206#define DHCPNAK 6
207#define DHCPRELEASE 7
208#endif
209
210#ifdef NFS_BOOT_DHCP
211#define BOOTP_SIZE_MAX	(sizeof(struct bootp)+312-64)
212#else
213/*
214 * The "extended" size is somewhat arbitrary, but is
215 * constrained by the maximum message size specified
216 * by RFC1533 (567 total).  This value increases the
217 * space for options from 64 bytes to 256 bytes.
218 */
219#define BOOTP_SIZE_MAX	(sizeof(struct bootp)+256-64)
220#endif
221#define BOOTP_SIZE_MIN	(sizeof(struct bootp))
222
223/* Convenience macro */
224#define INTOHL(ina) ((u_int32_t)ntohl((ina).s_addr))
225
226static int bootpc_call __P((struct nfs_diskless *, struct lwp *));
227static void bootp_extract __P((struct bootp *, int, struct nfs_diskless *));
228
229#ifdef	DEBUG_NFS_BOOT_DHCP
230#define DPRINTF(s)  printf s
231#else
232#define DPRINTF(s)
233#endif
234
235
236/*
237 * Get our boot parameters using BOOTP.
238 */
239int
240nfs_bootdhcp(nd, lwp)
241	struct nfs_diskless *nd;
242	struct lwp *lwp;
243{
244	struct ifnet *ifp = nd->nd_ifp;
245	int error;
246
247	/*
248	 * Do enough of ifconfig(8) so that the chosen interface
249	 * can talk to the servers.  Use address zero for now.
250	 */
251	error = nfs_boot_setaddress(ifp, lwp, INADDR_ANY, INADDR_ANY,
252				    INADDR_BROADCAST);
253	if (error) {
254		printf("nfs_boot: set ifaddr zero, error=%d\n", error);
255		return (error);
256	}
257
258	/* This function call does the real send/recv work. */
259	error = bootpc_call(nd, lwp);
260
261	/* Get rid of the temporary (zero) IP address. */
262	(void) nfs_boot_deladdress(ifp, lwp, INADDR_ANY);
263
264	/* NOW we can test the error from bootpc_call. */
265	if (error)
266		goto out;
267
268	/*
269	 * Do ifconfig with our real IP address and mask.
270	 */
271	error = nfs_boot_setaddress(ifp, lwp, nd->nd_myip.s_addr,
272				    nd->nd_mask.s_addr, INADDR_ANY);
273	if (error) {
274		printf("nfs_boot: set ifaddr real, error=%d\n", error);
275		goto out;
276	}
277
278out:
279	if (error) {
280		(void) nfs_boot_ifupdown(ifp, lwp, 0);
281		nfs_boot_flushrt(ifp);
282	}
283	return (error);
284}
285
286struct bootpcontext {
287	int xid;
288	u_char *haddr;
289	u_char halen;
290	struct bootp *replybuf;
291	int replylen;
292#ifdef NFS_BOOT_DHCP
293	char expected_dhcpmsgtype, dhcp_ok;
294	struct in_addr dhcp_serverip;
295#endif
296};
297
298static int bootpset __P((struct mbuf*, void*, int));
299static int bootpcheck __P((struct mbuf*, void*));
300
301static int
302bootpset(m, context, waited)
303	struct mbuf *m;
304	void *context;
305	int waited;
306{
307	struct bootp *bootp;
308
309	/* we know it's contigous (in 1 mbuf cluster) */
310	bootp = mtod(m, struct bootp*);
311
312	bootp->bp_secs = htons(waited);
313
314	return (0);
315}
316
317static int
318bootpcheck(m, context)
319	struct mbuf *m;
320	void *context;
321{
322	struct bootp *bootp;
323	struct bootpcontext *bpc = context;
324	u_int tag, len;
325	u_char *p, *limit;
326
327	/*
328	 * Is this a valid reply?
329	 */
330	if (m->m_pkthdr.len < BOOTP_SIZE_MIN) {
331		DPRINTF(("bootpcheck: short packet %d < %d\n", m->m_pkthdr.len,
332		    BOOTP_SIZE_MIN));
333		return (-1);
334	}
335	if (m->m_pkthdr.len > BOOTP_SIZE_MAX) {
336		DPRINTF(("bootpcheck: long packet %d > %d\n", m->m_pkthdr.len,
337		    BOOTP_SIZE_MAX));
338		return (-1);
339	}
340
341	/*
342	 * don't make first checks more expensive than necessary
343	 */
344	if (m->m_len < offsetof(struct bootp, bp_sname)) {
345		m = m_pullup(m, offsetof(struct bootp, bp_sname));
346		if (m == NULL) {
347			DPRINTF(("bootpcheck: m_pullup failed\n"));
348			return (-1);
349		}
350	}
351	bootp = mtod(m, struct bootp*);
352
353	if (bootp->bp_op != BOOTREPLY) {
354		DPRINTF(("bootpcheck: op %d is not reply\n", bootp->bp_op));
355		return (-1);
356	}
357	if (bootp->bp_hlen != bpc->halen) {
358		DPRINTF(("bootpcheck: hlen %d != %d\n", bootp->bp_hlen,
359		    bpc->halen));
360		return (-1);
361	}
362	if (memcmp(bootp->bp_chaddr, bpc->haddr, bpc->halen)) {
363#ifdef DEBUG_NFS_BOOT_DHCP
364		char bp_chaddr[3 * bpc->halen], haddr[3 * bpc->halen];
365#endif
366		DPRINTF(("bootpcheck: incorrect hwaddr %s != %s\n",
367		    ether_snprintf(bp_chaddr, sizeof(bp_chaddr),
368		    bootp->bp_chaddr),
369		    ether_snprintf(haddr, sizeof(haddr), bpc->haddr)));
370		return (-1);
371	}
372	if (bootp->bp_xid != bpc->xid) {
373		DPRINTF(("bootpcheck: xid %d != %d\n", bootp->bp_xid,
374		    bpc->xid));
375		return (-1);
376	}
377
378	/*
379	 * OK, it's worth to look deeper.
380	 * We copy the mbuf into a flat buffer here because
381	 * m_pullup() is a bit limited for this purpose
382	 * (doesn't allocate a cluster if necessary).
383	 */
384	bpc->replylen = m->m_pkthdr.len;
385	m_copydata(m, 0, bpc->replylen, (caddr_t)bpc->replybuf);
386	bootp = bpc->replybuf;
387
388	/*
389	 * Check if the IP address we get looks correct.
390	 * (DHCP servers can send junk to unknown clients.)
391	 * XXX more checks might be needed
392	 */
393	if (bootp->bp_yiaddr.s_addr == INADDR_ANY ||
394	    bootp->bp_yiaddr.s_addr == INADDR_BROADCAST) {
395		printf("nfs_boot: wrong IP addr %s",
396		       inet_ntoa(bootp->bp_yiaddr));
397		goto warn;
398	}
399
400	/*
401	 * Check the vendor data.
402	 */
403	if (memcmp(bootp->bp_vend, vm_rfc1048, 4)) {
404		printf("nfs_boot: reply missing options");
405		goto warn;
406	}
407	p = &bootp->bp_vend[4];
408	limit = ((char*)bootp) + bpc->replylen;
409	while (p < limit) {
410		tag = *p++;
411		if (tag == TAG_END)
412			break;
413		if (tag == TAG_PAD)
414			continue;
415		len = *p++;
416		if ((p + len) > limit) {
417			printf("nfs_boot: option %d too long", tag);
418			goto warn;
419		}
420		switch (tag) {
421#ifdef NFS_BOOT_DHCP
422		case TAG_DHCP_MSGTYPE:
423			if (*p != bpc->expected_dhcpmsgtype)
424				return (-1);
425			bpc->dhcp_ok = 1;
426			break;
427		case TAG_SERVERID:
428			memcpy(&bpc->dhcp_serverip.s_addr, p,
429			      sizeof(bpc->dhcp_serverip.s_addr));
430			break;
431#endif
432		default:
433			break;
434		}
435		p += len;
436	}
437	return (0);
438
439warn:
440	printf(" (bad reply from %s)\n", inet_ntoa(bootp->bp_siaddr));
441	return (-1);
442}
443
444static int
445bootpc_call(nd, lwp)
446	struct nfs_diskless *nd;
447	struct lwp *lwp;
448{
449	struct socket *so;
450	struct ifnet *ifp = nd->nd_ifp;
451	static u_int32_t xid = ~0xFF;
452	struct bootp *bootp;	/* request */
453	struct mbuf *m, *nam;
454	struct sockaddr_in *sin;
455	int error;
456	u_char *haddr;
457	u_char hafmt, halen;
458	struct bootpcontext bpc;
459#ifdef NFS_BOOT_DHCP
460	char vci[64];
461	int vcilen;
462#endif
463
464	error = socreate(AF_INET, &so, SOCK_DGRAM, 0, lwp);
465	if (error) {
466		printf("bootp: socreate, error=%d\n", error);
467		return (error);
468	}
469
470	/*
471	 * Initialize to NULL anything that will hold an allocation,
472	 * and free each at the end if not null.
473	 */
474	bpc.replybuf = NULL;
475	m = nam = NULL;
476
477	/* Record our H/W (Ethernet) address. */
478	{	struct sockaddr_dl *sdl = ifp->if_sadl;
479		switch (sdl->sdl_type) {
480		    case IFT_ISO88025:
481			hafmt = HTYPE_IEEE802;
482			break;
483		    case IFT_ETHER:
484		    case IFT_FDDI:
485			hafmt = HTYPE_ETHERNET;
486			break;
487		    default:
488			printf("bootp: unsupported interface type %d\n",
489			       sdl->sdl_type);
490			error = EINVAL;
491			goto out;
492		}
493		halen = sdl->sdl_alen;
494		haddr = (unsigned char *)LLADDR(sdl);
495	}
496
497	/*
498	 * Skip the route table when sending on this socket.
499	 * If this is not done, ip_output finds the loopback
500	 * interface (why?) and then fails because broadcast
501	 * is not supported on that interface...
502	 */
503	{	int32_t *opt;
504		m = m_get(M_WAIT, MT_SOOPTS);
505		opt = mtod(m, int32_t *);
506		m->m_len = sizeof(*opt);
507		*opt = 1;
508		error = sosetopt(so, SOL_SOCKET, SO_DONTROUTE, m);
509		m = NULL;	/* was consumed */
510	}
511	if (error) {
512		DPRINTF(("bootpc_call: SO_DONTROUTE failed %d\n", error));
513		goto out;
514	}
515
516	/* Enable broadcast. */
517	if ((error = nfs_boot_enbroadcast(so))) {
518		DPRINTF(("bootpc_call: SO_BROADCAST failed %d\n", error));
519		goto out;
520	}
521
522	/*
523	 * Set some TTL so we can boot through routers.
524	 * Real BOOTP forwarding agents don't need this; they obey "bp_hops"
525	 * and set "bp_giaddr", thus rewrite the packet anyway.
526	 * The "helper-address" feature of some popular router vendor seems
527	 * to do simple IP forwarding and drops packets with (ip_ttl == 1).
528	 */
529	{	u_char *opt;
530		m = m_get(M_WAIT, MT_SOOPTS);
531		opt = mtod(m, u_char *);
532		m->m_len = sizeof(*opt);
533		*opt = 7;
534		error = sosetopt(so, IPPROTO_IP, IP_MULTICAST_TTL, m);
535		m = NULL;	/* was consumed */
536	}
537	if (error) {
538		DPRINTF(("bootpc_call: IP_MULTICAST_TTL failed %d\n", error));
539		goto out;
540	}
541
542	/* Set the receive timeout for the socket. */
543	if ((error = nfs_boot_setrecvtimo(so))) {
544		DPRINTF(("bootpc_call: SO_RCVTIMEO failed %d\n", error));
545		goto out;
546	}
547
548	/*
549	 * Bind the local endpoint to a bootp client port.
550	 */
551	if ((error = nfs_boot_sobind_ipport(so, IPPORT_BOOTPC, lwp))) {
552		DPRINTF(("bootpc_call: bind failed %d\n", error));
553		goto out;
554	}
555
556	/*
557	 * Setup socket address for the server.
558	 */
559	nam = m_get(M_WAIT, MT_SONAME);
560	sin = mtod(nam, struct sockaddr_in *);
561	sin->sin_len = nam->m_len = sizeof(*sin);
562	sin->sin_family = AF_INET;
563	sin->sin_addr.s_addr = INADDR_BROADCAST;
564	sin->sin_port = htons(IPPORT_BOOTPS);
565
566	/*
567	 * Allocate buffer used for request
568	 */
569	m = m_gethdr(M_WAIT, MT_DATA);
570	m_clget(m, M_WAIT);
571	bootp = mtod(m, struct bootp*);
572	m->m_pkthdr.len = m->m_len = BOOTP_SIZE_MAX;
573	m->m_pkthdr.rcvif = NULL;
574
575	/*
576	 * Build the BOOTP reqest message.
577	 * Note: xid is host order! (opaque to server)
578	 */
579	memset((caddr_t)bootp, 0, BOOTP_SIZE_MAX);
580	bootp->bp_op    = BOOTREQUEST;
581	bootp->bp_htype = hafmt;
582	bootp->bp_hlen  = halen;	/* Hardware address length */
583	bootp->bp_xid = ++xid;
584	memcpy(bootp->bp_chaddr, haddr, halen);
585#ifdef NFS_BOOT_BOOTP_REQFILE
586	strncpy(bootp->bp_file, NFS_BOOT_BOOTP_REQFILE, sizeof(bootp->bp_file));
587#endif
588	/* Fill-in the vendor data. */
589	memcpy(bootp->bp_vend, vm_rfc1048, 4);
590#ifdef NFS_BOOT_DHCP
591	bootp->bp_vend[4] = TAG_DHCP_MSGTYPE;
592	bootp->bp_vend[5] = 1;
593	bootp->bp_vend[6] = DHCPDISCOVER;
594	/*
595	 * Insert a NetBSD Vendor Class Identifier option.
596	 */
597	snprintf(vci, sizeof(vci), "%s:%s:kernel:%s", ostype, MACHINE,
598	    osrelease);
599	vcilen = strlen(vci);
600	bootp->bp_vend[7] = TAG_CLASSID;
601	bootp->bp_vend[8] = vcilen;
602	memcpy(&bootp->bp_vend[9], vci, vcilen);
603	bootp->bp_vend[9 + vcilen] = TAG_END;
604#else
605	bootp->bp_vend[4] = TAG_END;
606#endif
607
608	bpc.xid = xid;
609	bpc.haddr = haddr;
610	bpc.halen = halen;
611	bpc.replybuf = malloc(BOOTP_SIZE_MAX, M_DEVBUF, M_WAITOK);
612	if (bpc.replybuf == NULL)
613		panic("nfs_boot: malloc reply buf");
614#ifdef NFS_BOOT_DHCP
615	bpc.expected_dhcpmsgtype = DHCPOFFER;
616	bpc.dhcp_ok = 0;
617#endif
618
619	error = nfs_boot_sendrecv(so, nam, bootpset, m,
620				  bootpcheck, 0, 0, &bpc, lwp);
621	if (error)
622		goto out;
623
624#ifdef NFS_BOOT_DHCP
625	if (bpc.dhcp_ok) {
626		u_int32_t leasetime;
627		bootp->bp_vend[6] = DHCPREQUEST;
628		bootp->bp_vend[7] = TAG_REQ_ADDR;
629		bootp->bp_vend[8] = 4;
630		memcpy(&bootp->bp_vend[9], &bpc.replybuf->bp_yiaddr, 4);
631		bootp->bp_vend[13] = TAG_SERVERID;
632		bootp->bp_vend[14] = 4;
633		memcpy(&bootp->bp_vend[15], &bpc.dhcp_serverip.s_addr, 4);
634		bootp->bp_vend[19] = TAG_LEASETIME;
635		bootp->bp_vend[20] = 4;
636		leasetime = htonl(300);
637		memcpy(&bootp->bp_vend[21], &leasetime, 4);
638		bootp->bp_vend[25] = TAG_CLASSID;
639		bootp->bp_vend[26] = vcilen;
640		memcpy(&bootp->bp_vend[27], vci, vcilen);
641		bootp->bp_vend[27 + vcilen] = TAG_END;
642
643		bpc.expected_dhcpmsgtype = DHCPACK;
644
645		error = nfs_boot_sendrecv(so, nam, bootpset, m,
646					  bootpcheck, 0, 0, &bpc, lwp);
647		if (error)
648			goto out;
649	}
650#endif
651
652	/*
653	 * bootpcheck() has copied the receive mbuf into
654	 * the buffer at bpc.replybuf.
655	 */
656#ifdef NFS_BOOT_DHCP
657	printf("nfs_boot: %s next-server: %s\n",
658	       (bpc.dhcp_ok ? "DHCP" : "BOOTP"),
659#else
660	printf("nfs_boot: BOOTP next-server: %s\n",
661#endif
662	       inet_ntoa(bpc.replybuf->bp_siaddr));
663
664	bootp_extract(bpc.replybuf, bpc.replylen, nd);
665
666out:
667	if (bpc.replybuf)
668		free(bpc.replybuf, M_DEVBUF);
669	if (m)
670		m_freem(m);
671	if (nam)
672		m_freem(nam);
673	soclose(so);
674	return (error);
675}
676
677static void
678bootp_extract(bootp, replylen, nd)
679	struct bootp *bootp;
680	int replylen;
681	struct nfs_diskless *nd;
682{
683	struct sockaddr_in *sin;
684	struct in_addr netmask;
685	struct in_addr gateway;
686	struct in_addr rootserver;
687	char *myname;	/* my hostname */
688	char *mydomain;	/* my domainname */
689	char *rootpath;
690	int mynamelen;
691	int mydomainlen;
692	int rootpathlen;
693	int overloaded;
694	u_int tag, len;
695	u_char *p, *limit;
696
697	/* Default these to "unspecified". */
698	netmask.s_addr = 0;
699	gateway.s_addr = 0;
700	mydomain    = myname    = rootpath = NULL;
701	mydomainlen = mynamelen = rootpathlen = 0;
702	/* default root server to bootp next-server */
703	rootserver = bootp->bp_siaddr;
704	/* assume that server name field is not overloaded by default */
705	overloaded = 0;
706
707	p = &bootp->bp_vend[4];
708	limit = ((char*)bootp) + replylen;
709	while (p < limit) {
710		tag = *p++;
711		if (tag == TAG_END)
712			break;
713		if (tag == TAG_PAD)
714			continue;
715		len = *p++;
716#if 0 /* already done in bootpcheck() */
717		if ((p + len) > limit) {
718			printf("nfs_boot: option %d too long\n", tag);
719			break;
720		}
721#endif
722		switch (tag) {
723		    case TAG_SUBNET_MASK:
724			memcpy(&netmask, p, 4);
725			break;
726		    case TAG_GATEWAY:
727			/* Routers */
728			memcpy(&gateway, p, 4);
729			break;
730		    case TAG_HOST_NAME:
731			if (len >= sizeof(hostname)) {
732				printf("nfs_boot: host name >= %lu bytes",
733				       (u_long)sizeof(hostname));
734				break;
735			}
736			myname = p;
737			mynamelen = len;
738			break;
739		    case TAG_DOMAIN_NAME:
740			if (len >= sizeof(domainname)) {
741				printf("nfs_boot: domain name >= %lu bytes",
742				       (u_long)sizeof(domainname));
743				break;
744			}
745			mydomain = p;
746			mydomainlen = len;
747			break;
748		    case TAG_ROOT_PATH:
749			/* Leave some room for the server name. */
750			if (len >= (MNAMELEN-10)) {
751				printf("nfs_boot: rootpath >=%d bytes",
752				       (MNAMELEN-10));
753				break;
754			}
755			rootpath = p;
756			rootpathlen = len;
757			break;
758		    case TAG_SWAP_SERVER:
759			/* override NFS server address */
760			memcpy(&rootserver, p, 4);
761			break;
762#ifdef NFS_BOOT_DHCP
763		    case TAG_OVERLOAD:
764			if (len > 0 && ((*p & 0x02) != 0))
765				/*
766				 * The server name field in the dhcp packet
767				 * is overloaded and we can't find server
768				 * name there.
769				 */
770				overloaded = 1;
771			break;
772#endif
773		    default:
774			break;
775		}
776		p += len;
777	}
778
779	/*
780	 * Store and print network config info.
781	 */
782	if (myname) {
783		myname[mynamelen] = '\0';
784		strncpy(hostname, myname, sizeof(hostname));
785		hostnamelen = mynamelen;
786		printf("nfs_boot: my_name=%s\n", hostname);
787	}
788	if (mydomain) {
789		mydomain[mydomainlen] = '\0';
790		strncpy(domainname, mydomain, sizeof(domainname));
791		domainnamelen = mydomainlen;
792		printf("nfs_boot: my_domain=%s\n", domainname);
793	}
794	nd->nd_myip = bootp->bp_yiaddr;
795	if (nd->nd_myip.s_addr)
796		printf("nfs_boot: my_addr=%s\n", inet_ntoa(nd->nd_myip));
797	nd->nd_mask = netmask;
798	if (nd->nd_mask.s_addr)
799		printf("nfs_boot: my_mask=%s\n", inet_ntoa(nd->nd_mask));
800	nd->nd_gwip = gateway;
801	if (nd->nd_gwip.s_addr)
802		printf("nfs_boot: gateway=%s\n", inet_ntoa(nd->nd_gwip));
803
804	/*
805	 * Store the information about our NFS root mount.
806	 * The caller will print it, so be silent here.
807	 */
808	{
809		struct nfs_dlmount *ndm = &nd->nd_root;
810
811		/* Server IP address. */
812		sin = (struct sockaddr_in *) &ndm->ndm_saddr;
813		memset((caddr_t)sin, 0, sizeof(*sin));
814		sin->sin_len = sizeof(*sin);
815		sin->sin_family = AF_INET;
816		sin->sin_addr = rootserver;
817		/* Server name. */
818		if (!overloaded && bootp->bp_sname[0] != 0 &&
819		    !memcmp(&rootserver, &bootp->bp_siaddr,
820			  sizeof(struct in_addr))) {
821			/* standard root server, we have the name */
822			strncpy(ndm->ndm_host, bootp->bp_sname, BP_SNAME_LEN-1);
823		} else {
824			/* Show the server IP address numerically. */
825			strncpy(ndm->ndm_host, inet_ntoa(rootserver),
826				BP_SNAME_LEN-1);
827		}
828		len = strlen(ndm->ndm_host);
829		if (rootpath &&
830		    len + 1 + rootpathlen + 1 <= sizeof(ndm->ndm_host)) {
831			ndm->ndm_host[len++] = ':';
832			strncpy(ndm->ndm_host + len,
833				rootpath, rootpathlen);
834			ndm->ndm_host[len + rootpathlen] = '\0';
835		} /* else: upper layer will handle error */
836	}
837}
838