sbin/dhclient/options.c

   1 /*      $OpenBSD: src/sbin/dhclient/options.c,v 1.40 2012/06/26 14:36:11 krw Exp $      */
   2
   3 /* DHCP options parsing and reassembly. */
   4
   5 /*
   6  * Copyright (c) 1995, 1996, 1997, 1998 The Internet Software Consortium.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  *
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  * 3. Neither the name of The Internet Software Consortium nor the names
  19  *    of its contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
  23  * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
  24  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  25  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  26  * DISCLAIMED.  IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
  27  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  29  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
  30  * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  31  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  32  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  33  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  34  * SUCH DAMAGE.
  35  *
  36  * This software has been written for the Internet Software Consortium
  37  * by Ted Lemon <mellon@fugue.com> in cooperation with Vixie
  38  * Enterprises.  To learn more about the Internet Software Consortium,
  39  * see ``http://www.vix.com/isc''.  To learn more about Vixie
  40  * Enterprises, see ``http://www.vix.com''.
  41  */
  42
  43 #include <ctype.h>
  44
  45 #include "dhcpd.h"
  46
  47 int parse_option_buffer(struct option_data *, unsigned char *, int);
  48
  49 /*
  50  * Parse options out of the specified buffer, storing addresses of
  51  * option values in options and setting client->options_valid if
  52  * no errors are encountered.
  53  */
  54 int
  55 parse_option_buffer(struct option_data *options, unsigned char *buffer,
  56     int length)
  57 {
  58         unsigned char *s, *t, *end = buffer + length;
  59         int len, code;
  60
  61         for (s = buffer; *s != DHO_END && s < end; ) {
  62                 code = s[0];
  63
  64                 /* Pad options don't have a length - just skip them. */
  65                 if (code == DHO_PAD) {
  66                         s++;
  67                         continue;
  68                 }
  69
  70                 /*
  71                  * All options other than DHO_PAD and DHO_END have a
  72                  * one-byte length field.
  73                  */
  74                 if (s + 2 > end)
  75                         len = 0;
  76                 else
  77                         len = s[1];
  78
  79                 /*
  80                  * If the option claims to extend beyond the end of the buffer
  81                  * then mark the options buffer bad.
  82                  */
  83                 if (s + len + 2 > end) {
  84                         warning("option %s (%d) larger than buffer.",
  85                             dhcp_options[code].name, len);
  86                         warning("rejecting bogus offer.");
  87                         return (0);
  88                 }
  89
  90                 /*
  91                  * Strip trailing NULs from ascii ('t') options. They
  92                  * will be treated as DHO_PAD options. i.e. ignored. RFC 2132
  93                  * says "Options containing NVT ASCII data SHOULD NOT include
  94                  * a trailing NULL; however, the receiver of such options
  95                  * MUST be prepared to delete trailing nulls if they exist."
  96                  */
  97                 if (dhcp_options[code].format[0] == 't') {
  98                         for (len = s[1]; len > 0 && s[len + 1] == '\0'; len--)
  99                                 ;
 100                 }
 101
 102                 /*
 103                  * If we haven't seen this option before, just make
 104                  * space for it and copy it there.
 105                  */
 106                 if (!options[code].data) {
 107                         if (!(t = calloc(1, len + 1)))
 108                                 error("Can't allocate storage for option %s.",
 109                                     dhcp_options[code].name);
 110                         /*
 111                          * Copy and NUL-terminate the option (in case
 112                          * it's an ASCII string).
 113                          */
 114                         memcpy(t, &s[2], len);
 115                         t[len] = 0;
 116                         options[code].len = len;
 117                         options[code].data = t;
 118                 } else {
 119                         /*
 120                          * If it's a repeat, concatenate it to whatever
 121                          * we last saw.   This is really only required
 122                          * for clients, but what the heck...
 123                          */
 124                         t = calloc(1, len + options[code].len + 1);
 125                         if (!t)
 126                                 error("Can't expand storage for option %s.",
 127                                     dhcp_options[code].name);
 128                         memcpy(t, options[code].data, options[code].len);
 129                         memcpy(t + options[code].len, &s[2], len);
 130                         options[code].len += len;
 131                         t[options[code].len] = 0;
 132                         free(options[code].data);
 133                         options[code].data = t;
 134                 }
 135                 s += len + 2;
 136         }
 137
 138         return (1);
 139 }
 140
 141 /*
 142  * Copy as many options as fit in buflen bytes of buf. Return the
 143  * offset of the start of the last option copied. A caller can check
 144  * to see if it's DHO_END to decide if all the options were copied.
 145  */
 146 int
 147 cons_options(struct option_data *options)
 148 {
 149         unsigned char *buf = client->packet.options;
 150         int buflen = 576 - DHCP_FIXED_LEN;
 151         int ix, incr, length, bufix, code, lastopt = -1;
 152
 153         bzero(buf, buflen);
 154
 155         memcpy(buf, DHCP_OPTIONS_COOKIE, 4);
 156         if (options[DHO_DHCP_MESSAGE_TYPE].data) {
 157                 memcpy(&buf[4], DHCP_OPTIONS_MESSAGE_TYPE, 3);
 158                 buf[6] = options[DHO_DHCP_MESSAGE_TYPE].data[0];
 159                 bufix = 7;
 160         } else
 161                 bufix = 4;
 162
 163         for (code = DHO_SUBNET_MASK; code < DHO_END; code++) {
 164                 if (!options[code].data || code == DHO_DHCP_MESSAGE_TYPE)
 165                         continue;
 166
 167                 length = options[code].len;
 168                 if (bufix + length + 2*((length+254)/255) >= buflen)
 169                         return (lastopt);
 170
 171                 lastopt = bufix;
 172                 ix = 0;
 173
 174                 while (length) {
 175                         incr = length > 255 ? 255 : length;
 176
 177                         buf[bufix++] = code;
 178                         buf[bufix++] = incr;
 179                         memcpy(buf + bufix, options[code].data + ix, incr);
 180
 181                         length -= incr;
 182                         ix += incr;
 183                         bufix += incr;
 184                 }
 185         }
 186
 187         if (bufix < buflen) {
 188                 buf[bufix] = DHO_END;
 189                 lastopt = bufix;
 190         }
 191
 192         return (lastopt);
 193 }
 194
 195 /*
 196  * Format the specified option so that a human can easily read it.
 197  */
 198 char *
 199 pretty_print_option(unsigned int code, unsigned char *data, int len,
 200     int emit_commas, int emit_quotes)
 201 {
 202         static char optbuf[32768]; /* XXX */
 203         int hunksize = 0, numhunk = -1, numelem = 0;
 204         char fmtbuf[32], *op = optbuf;
 205         int i, j, k, opleft = sizeof(optbuf);
 206         unsigned char *dp = data;
 207         struct in_addr foo;
 208         char comma;
 209
 210         /* Code should be between 0 and 255. */
 211         if (code > 255)
 212                 error("pretty_print_option: bad code %d", code);
 213
 214         if (emit_commas)
 215                 comma = ',';
 216         else
 217                 comma = ' ';
 218
 219         /* Figure out the size of the data. */
 220         for (i = 0; dhcp_options[code].format[i]; i++) {
 221                 if (!numhunk) {
 222                         warning("%s: Excess information in format string: %s",
 223                             dhcp_options[code].name,
 224                             &(dhcp_options[code].format[i]));
 225                         break;
 226                 }
 227                 numelem++;
 228                 fmtbuf[i] = dhcp_options[code].format[i];
 229                 switch (dhcp_options[code].format[i]) {
 230                 case 'A':
 231                         --numelem;
 232                         fmtbuf[i] = 0;
 233                         numhunk = 0;
 234                         if (hunksize == 0) {
 235                                 warning("%s: no size indicator before A"
 236                                     " in format string: %s",
 237                                     dhcp_options[code].name,
 238                                     dhcp_options[code].format);
 239                                 return ("<fmt error>");
 240                         }
 241                         break;
 242                 case 'X':
 243                         for (k = 0; k < len; k++)
 244                                 if (!isascii(data[k]) ||
 245                                     !isprint(data[k]))
 246                                         break;
 247                         if (k == len) {
 248                                 fmtbuf[i] = 't';
 249                                 numhunk = -2;
 250                         } else {
 251                                 fmtbuf[i] = 'x';
 252                                 hunksize++;
 253                                 comma = ':';
 254                                 numhunk = 0;
 255                         }
 256                         fmtbuf[i + 1] = 0;
 257                         break;
 258                 case 't':
 259                         fmtbuf[i] = 't';
 260                         fmtbuf[i + 1] = 0;
 261                         numhunk = -2;
 262                         break;
 263                 case 'I':
 264                 case 'l':
 265                 case 'L':
 266                         hunksize += 4;
 267                         break;
 268                 case 's':
 269                 case 'S':
 270                         hunksize += 2;
 271                         break;
 272                 case 'b':
 273                 case 'B':
 274                 case 'f':
 275                         hunksize++;
 276                         break;
 277                 case 'e':
 278                         break;
 279                 default:
 280                         warning("%s: garbage in format string: %s",
 281                             dhcp_options[code].name,
 282                             &(dhcp_options[code].format[i]));
 283                         break;
 284                 }
 285         }
 286
 287         /* Check for too few bytes... */
 288         if (hunksize > len) {
 289                 warning("%s: expecting at least %d bytes; got %d",
 290                     dhcp_options[code].name, hunksize, len);
 291                 return ("<error>");
 292         }
 293         /* Check for too many bytes... */
 294         if (numhunk == -1 && hunksize < len)
 295                 warning("%s: %d extra bytes",
 296                     dhcp_options[code].name, len - hunksize);
 297
 298         /* If this is an array, compute its size. */
 299         if (!numhunk)
 300                 numhunk = len / hunksize;
 301         /* See if we got an exact number of hunks. */
 302         if (numhunk > 0 && numhunk * hunksize < len)
 303                 warning("%s: %d extra bytes at end of array",
 304                     dhcp_options[code].name, len - numhunk * hunksize);
 305
 306         /* A one-hunk array prints the same as a single hunk. */
 307         if (numhunk < 0)
 308                 numhunk = 1;
 309
 310         /* Cycle through the array (or hunk) printing the data. */
 311         for (i = 0; i < numhunk; i++) {
 312                 for (j = 0; j < numelem; j++) {
 313                         int opcount;
 314                         size_t oplen;
 315                         switch (fmtbuf[j]) {
 316                         case 't':
 317                                 if (emit_quotes) {
 318                                         *op++ = '"';
 319                                         opleft--;
 320                                 }
 321                                 for (; dp < data + len; dp++) {
 322                                         if (!isascii(*dp) ||
 323                                             !isprint(*dp)) {
 324                                                 if (dp + 1 != data + len ||
 325                                                     *dp != 0) {
 326                                                         size_t oplen;
 327                                                         snprintf(op, opleft,
 328                                                             "\\%03o", *dp);
 329                                                         oplen = strlen(op);
 330                                                         op += oplen;
 331                                                         opleft -= oplen;
 332                                                 }
 333                                         } else if (*dp == '"' ||
 334                                             *dp == '\'' ||
 335                                             *dp == '$' ||
 336                                             *dp == '`' ||
 337                                             *dp == '\\') {
 338                                                 *op++ = '\\';
 339                                                 *op++ = *dp;
 340                                                 opleft -= 2;
 341                                         } else {
 342                                                 *op++ = *dp;
 343                                                 opleft--;
 344                                         }
 345                                 }
 346                                 if (emit_quotes) {
 347                                         *op++ = '"';
 348                                         opleft--;
 349                                 }
 350
 351                                 *op = 0;
 352                                 break;
 353                         case 'I':
 354                                 foo.s_addr = htonl(getULong(dp));
 355                                 opcount = strlcpy(op, inet_ntoa(foo), opleft);
 356                                 if (opcount >= opleft)
 357                                         goto toobig;
 358                                 opleft -= opcount;
 359                                 dp += 4;
 360                                 break;
 361                         case 'l':
 362                                 opcount = snprintf(op, opleft, "%ld",
 363                                     (long)getLong(dp));
 364                                 if (opcount >= opleft || opcount == -1)
 365                                         goto toobig;
 366                                 opleft -= opcount;
 367                                 dp += 4;
 368                                 break;
 369                         case 'L':
 370                                 opcount = snprintf(op, opleft, "%ld",
 371                                     (unsigned long)getULong(dp));
 372                                 if (opcount >= opleft || opcount == -1)
 373                                         goto toobig;
 374                                 opleft -= opcount;
 375                                 dp += 4;
 376                                 break;
 377                         case 's':
 378                                 opcount = snprintf(op, opleft, "%d",
 379                                     getShort(dp));
 380                                 if (opcount >= opleft || opcount == -1)
 381                                         goto toobig;
 382                                 opleft -= opcount;
 383                                 dp += 2;
 384                                 break;
 385                         case 'S':
 386                                 opcount = snprintf(op, opleft, "%d",
 387                                     getUShort(dp));
 388                                 if (opcount >= opleft || opcount == -1)
 389                                         goto toobig;
 390                                 opleft -= opcount;
 391                                 dp += 2;
 392                                 break;
 393                         case 'b':
 394                                 opcount = snprintf(op, opleft, "%d",
 395                                     *(char *)dp++);
 396                                 if (opcount >= opleft || opcount == -1)
 397                                         goto toobig;
 398                                 opleft -= opcount;
 399                                 break;
 400                         case 'B':
 401                                 opcount = snprintf(op, opleft, "%d", *dp++);
 402                                 if (opcount >= opleft || opcount == -1)
 403                                         goto toobig;
 404                                 opleft -= opcount;
 405                                 break;
 406                         case 'x':
 407                                 opcount = snprintf(op, opleft, "%x", *dp++);
 408                                 if (opcount >= opleft || opcount == -1)
 409                                         goto toobig;
 410                                 opleft -= opcount;
 411                                 break;
 412                         case 'f':
 413                                 opcount = strlcpy(op,
 414                                     *dp++ ? "true" : "false", opleft);
 415                                 if (opcount >= opleft)
 416                                         goto toobig;
 417                                 opleft -= opcount;
 418                                 break;
 419                         default:
 420                                 warning("Unexpected format code %c", fmtbuf[j]);
 421                         }
 422                         oplen = strlen(op);
 423                         op += oplen;
 424                         opleft -= oplen;
 425                         if (opleft < 1)
 426                                 goto toobig;
 427                         if (j + 1 < numelem && comma != ':') {
 428                                 *op++ = ' ';
 429                                 opleft--;
 430                         }
 431                 }
 432                 if (i + 1 < numhunk) {
 433                         *op++ = comma;
 434                         opleft--;
 435                 }
 436                 if (opleft < 1)
 437                         goto toobig;
 438
 439         }
 440         return (optbuf);
 441  toobig:
 442         warning("dhcp option too large");
 443         return ("<error>");
 444 }
 445
 446 void
 447 do_packet(int len, unsigned int from_port, struct iaddr from,
 448     struct hardware *hfrom)
 449 {
 450         struct dhcp_packet *packet = &client->packet;
 451         struct option_data options[256];
 452         struct iaddrlist *ap;
 453         void (*handler)(struct iaddr, struct option_data *);
 454         char *type;
 455         int i, options_valid = 1;
 456
 457         if (packet->hlen > sizeof(packet->chaddr)) {
 458                 note("Discarding packet with invalid hlen.");
 459                 return;
 460         }
 461
 462         /*
 463          * Silently drop the packet if the client hardware address in the
 464          * packet is not the hardware address of the interface being managed.
 465          */
 466         if ((ifi->hw_address.hlen != packet->hlen) ||
 467             (memcmp(ifi->hw_address.haddr, packet->chaddr, packet->hlen)))
 468                 return;
 469
 470         memset(options, 0, sizeof(options));
 471
 472         if (memcmp(&packet->options, DHCP_OPTIONS_COOKIE, 4) == 0) {
 473                 /* Parse the BOOTP/DHCP options field. */
 474                 options_valid = parse_option_buffer(options,
 475                     &packet->options[4], sizeof(packet->options) - 4);
 476
 477                 /* Only DHCP packets have overload areas for options. */
 478                 if (options_valid &&
 479                     options[DHO_DHCP_MESSAGE_TYPE].data &&
 480                     options[DHO_DHCP_OPTION_OVERLOAD].data) {
 481                         if (options[DHO_DHCP_OPTION_OVERLOAD].data[0] & 1)
 482                                 options_valid = parse_option_buffer(options,
 483                                     (unsigned char *)packet->file,
 484                                     sizeof(packet->file));
 485                         if (options_valid &&
 486                             options[DHO_DHCP_OPTION_OVERLOAD].data[0] & 2)
 487                                 options_valid = parse_option_buffer(options,
 488                                     (unsigned char *)packet->sname,
 489                                     sizeof(packet->sname));
 490                 }
 491         }
 492
 493         type = "";
 494         handler = NULL;
 495
 496         if (options[DHO_DHCP_MESSAGE_TYPE].data) {
 497                 /* Always try a DHCP packet, even if a bad option was seen. */
 498                 switch (options[DHO_DHCP_MESSAGE_TYPE].data[0]) {
 499                 case DHCPOFFER:
 500                         handler = dhcpoffer;
 501                         type = "DHCPOFFER";
 502                         break;
 503                 case DHCPNAK:
 504                         handler = dhcpnak;
 505                         type = "DHCPNACK";
 506                         break;
 507                 case DHCPACK:
 508                         handler = dhcpack;
 509                         type = "DHCPACK";
 510                         break;
 511                 default:
 512                         break;
 513                 }
 514         } else if (options_valid && packet->op == BOOTREPLY) {
 515                 handler = dhcpoffer;
 516                 type = "BOOTREPLY";
 517         }
 518
 519         if (handler && client->xid == client->packet.xid) {
 520                 if (hfrom->hlen == 6)
 521                         note("%s from %s (%s)", type, piaddr(from),
 522                             ether_ntoa((struct ether_addr *)hfrom->haddr));
 523                 else
 524                         note("%s from %s", type, piaddr(from));
 525         } else
 526                 handler = NULL;
 527
 528         for (ap = config->reject_list; ap && handler; ap = ap->next)
 529                 if (addr_eq(from, ap->addr)) {
 530                         note("%s from %s rejected.", type, piaddr(from));
 531                         handler = NULL;
 532                 }
 533
 534         if (handler)
 535                 (*handler)(from, options);
 536
 537         for (i = 0; i < 256; i++)
 538                 if (options[i].len && options[i].data)
 539                         free(options[i].data);
 540 }