1 /* SPDX-License-Identifier: MIT */
2 /*
3 * QEMU BOOTP/DHCP server
4 *
5 * Copyright (c) 2004 Fabrice Bellard
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25 #include "slirp.h"
26
27 #if defined(_WIN32)
28 /* Windows ntohl() returns an u_long value.
29 * Add a type cast to match the format strings. */
30 #define ntohl(n) ((uint32_t)ntohl(n))
31 #endif
32
33 /* XXX: only DHCP is supported */
34
35 #define LEASE_TIME (24 * 3600)
36
37 static const uint8_t rfc1533_cookie[] = { RFC1533_COOKIE };
38
39 #define DPRINTF(fmt, ...) DEBUG_CALL(fmt, ##__VA_ARGS__)
40
get_new_addr(Slirp * slirp,struct in_addr * paddr,const uint8_t * macaddr)41 static BOOTPClient *get_new_addr(Slirp *slirp, struct in_addr *paddr,
42 const uint8_t *macaddr)
43 {
44 BOOTPClient *bc;
45 int i;
46
47 for (i = 0; i < NB_BOOTP_CLIENTS; i++) {
48 bc = &slirp->bootp_clients[i];
49 if (!bc->allocated || !memcmp(macaddr, bc->macaddr, 6))
50 goto found;
51 }
52 return NULL;
53 found:
54 bc = &slirp->bootp_clients[i];
55 bc->allocated = 1;
56 paddr->s_addr = slirp->vdhcp_startaddr.s_addr + htonl(i);
57 return bc;
58 }
59
request_addr(Slirp * slirp,const struct in_addr * paddr,const uint8_t * macaddr)60 static BOOTPClient *request_addr(Slirp *slirp, const struct in_addr *paddr,
61 const uint8_t *macaddr)
62 {
63 uint32_t req_addr = ntohl(paddr->s_addr);
64 uint32_t dhcp_addr = ntohl(slirp->vdhcp_startaddr.s_addr);
65 BOOTPClient *bc;
66
67 if (req_addr >= dhcp_addr && req_addr < (dhcp_addr + NB_BOOTP_CLIENTS)) {
68 bc = &slirp->bootp_clients[req_addr - dhcp_addr];
69 if (!bc->allocated || !memcmp(macaddr, bc->macaddr, 6)) {
70 bc->allocated = 1;
71 return bc;
72 }
73 }
74 return NULL;
75 }
76
find_addr(Slirp * slirp,struct in_addr * paddr,const uint8_t * macaddr)77 static BOOTPClient *find_addr(Slirp *slirp, struct in_addr *paddr,
78 const uint8_t *macaddr)
79 {
80 BOOTPClient *bc;
81 int i;
82
83 for (i = 0; i < NB_BOOTP_CLIENTS; i++) {
84 if (!memcmp(macaddr, slirp->bootp_clients[i].macaddr, 6))
85 goto found;
86 }
87 return NULL;
88 found:
89 bc = &slirp->bootp_clients[i];
90 bc->allocated = 1;
91 paddr->s_addr = slirp->vdhcp_startaddr.s_addr + htonl(i);
92 return bc;
93 }
94
dhcp_decode(const struct bootp_t * bp,const uint8_t * bp_end,int * pmsg_type,struct in_addr * preq_addr)95 static void dhcp_decode(const struct bootp_t *bp,
96 const uint8_t *bp_end,
97 int *pmsg_type,
98 struct in_addr *preq_addr)
99 {
100 const uint8_t *p;
101 int len, tag;
102
103 *pmsg_type = 0;
104 preq_addr->s_addr = htonl(0L);
105
106 p = bp->bp_vend;
107 if (memcmp(p, rfc1533_cookie, 4) != 0)
108 return;
109 p += 4;
110 while (p < bp_end) {
111 tag = p[0];
112 if (tag == RFC1533_PAD) {
113 p++;
114 } else if (tag == RFC1533_END) {
115 break;
116 } else {
117 p++;
118 if (p >= bp_end)
119 break;
120 len = *p++;
121 if (p + len > bp_end) {
122 break;
123 }
124 DPRINTF("dhcp: tag=%d len=%d\n", tag, len);
125
126 switch (tag) {
127 case RFC2132_MSG_TYPE:
128 if (len >= 1)
129 *pmsg_type = p[0];
130 break;
131 case RFC2132_REQ_ADDR:
132 if (len >= 4) {
133 memcpy(&(preq_addr->s_addr), p, 4);
134 }
135 break;
136 default:
137 break;
138 }
139 p += len;
140 }
141 }
142 if (*pmsg_type == DHCPREQUEST && preq_addr->s_addr == htonl(0L) &&
143 bp->bp_ciaddr.s_addr) {
144 memcpy(&(preq_addr->s_addr), &bp->bp_ciaddr, 4);
145 }
146 }
147
bootp_reply(Slirp * slirp,const struct bootp_t * bp,const uint8_t * bp_end)148 static void bootp_reply(Slirp *slirp,
149 const struct bootp_t *bp,
150 const uint8_t *bp_end)
151 {
152 BOOTPClient *bc = NULL;
153 struct mbuf *m;
154 struct bootp_t *rbp;
155 struct sockaddr_in saddr, daddr;
156 struct in_addr preq_addr;
157 int dhcp_msg_type, val;
158 uint8_t *q;
159 uint8_t *end;
160 uint8_t client_ethaddr[ETH_ALEN];
161
162 /* extract exact DHCP msg type */
163 dhcp_decode(bp, bp_end, &dhcp_msg_type, &preq_addr);
164 DPRINTF("bootp packet op=%d msgtype=%d", bp->bp_op, dhcp_msg_type);
165 if (preq_addr.s_addr != htonl(0L))
166 DPRINTF(" req_addr=%08" PRIx32 "\n", ntohl(preq_addr.s_addr));
167 else {
168 DPRINTF("\n");
169 }
170
171 if (dhcp_msg_type == 0)
172 dhcp_msg_type = DHCPREQUEST; /* Force reply for old BOOTP clients */
173
174 if (dhcp_msg_type != DHCPDISCOVER && dhcp_msg_type != DHCPREQUEST)
175 return;
176
177 /* Get client's hardware address from bootp request */
178 memcpy(client_ethaddr, bp->bp_hwaddr, ETH_ALEN);
179
180 m = m_get(slirp);
181 if (!m) {
182 return;
183 }
184 m->m_data += IF_MAXLINKHDR;
185 m_inc(m, sizeof(struct bootp_t) + DHCP_OPT_LEN);
186 rbp = (struct bootp_t *)m->m_data;
187 m->m_data += sizeof(struct udpiphdr);
188 memset(rbp, 0, sizeof(struct bootp_t) + DHCP_OPT_LEN);
189
190 if (dhcp_msg_type == DHCPDISCOVER) {
191 if (preq_addr.s_addr != htonl(0L)) {
192 bc = request_addr(slirp, &preq_addr, client_ethaddr);
193 if (bc) {
194 daddr.sin_addr = preq_addr;
195 }
196 }
197 if (!bc) {
198 new_addr:
199 bc = get_new_addr(slirp, &daddr.sin_addr, client_ethaddr);
200 if (!bc) {
201 DPRINTF("no address left\n");
202 return;
203 }
204 }
205 memcpy(bc->macaddr, client_ethaddr, ETH_ALEN);
206 } else if (preq_addr.s_addr != htonl(0L)) {
207 bc = request_addr(slirp, &preq_addr, client_ethaddr);
208 if (bc) {
209 daddr.sin_addr = preq_addr;
210 memcpy(bc->macaddr, client_ethaddr, ETH_ALEN);
211 } else {
212 /* DHCPNAKs should be sent to broadcast */
213 daddr.sin_addr.s_addr = 0xffffffff;
214 }
215 } else {
216 bc = find_addr(slirp, &daddr.sin_addr, bp->bp_hwaddr);
217 if (!bc) {
218 /* if never assigned, behaves as if it was already
219 assigned (windows fix because it remembers its address) */
220 goto new_addr;
221 }
222 }
223
224 /* Update ARP table for this IP address */
225 arp_table_add(slirp, daddr.sin_addr.s_addr, client_ethaddr);
226
227 saddr.sin_addr = slirp->vhost_addr;
228 saddr.sin_port = htons(BOOTP_SERVER);
229
230 daddr.sin_port = htons(BOOTP_CLIENT);
231
232 rbp->bp_op = BOOTP_REPLY;
233 rbp->bp_xid = bp->bp_xid;
234 rbp->bp_htype = 1;
235 rbp->bp_hlen = 6;
236 memcpy(rbp->bp_hwaddr, bp->bp_hwaddr, ETH_ALEN);
237
238 rbp->bp_yiaddr = daddr.sin_addr; /* Client IP address */
239 rbp->bp_siaddr = saddr.sin_addr; /* Server IP address */
240
241 q = rbp->bp_vend;
242 end = rbp->bp_vend + DHCP_OPT_LEN;
243 memcpy(q, rfc1533_cookie, 4);
244 q += 4;
245
246 if (bc) {
247 DPRINTF("%s addr=%08" PRIx32 "\n",
248 (dhcp_msg_type == DHCPDISCOVER) ? "offered" : "ack'ed",
249 ntohl(daddr.sin_addr.s_addr));
250
251 if (dhcp_msg_type == DHCPDISCOVER) {
252 *q++ = RFC2132_MSG_TYPE;
253 *q++ = 1;
254 *q++ = DHCPOFFER;
255 } else /* DHCPREQUEST */ {
256 *q++ = RFC2132_MSG_TYPE;
257 *q++ = 1;
258 *q++ = DHCPACK;
259 }
260
261 if (slirp->bootp_filename) {
262 g_assert(strlen(slirp->bootp_filename) < sizeof(rbp->bp_file));
263 strcpy(rbp->bp_file, slirp->bootp_filename);
264 }
265
266 *q++ = RFC2132_SRV_ID;
267 *q++ = 4;
268 memcpy(q, &saddr.sin_addr, 4);
269 q += 4;
270
271 *q++ = RFC1533_NETMASK;
272 *q++ = 4;
273 memcpy(q, &slirp->vnetwork_mask, 4);
274 q += 4;
275
276 if (!slirp->restricted) {
277 *q++ = RFC1533_GATEWAY;
278 *q++ = 4;
279 memcpy(q, &saddr.sin_addr, 4);
280 q += 4;
281
282 *q++ = RFC1533_DNS;
283 *q++ = 4;
284 memcpy(q, &slirp->vnameserver_addr, 4);
285 q += 4;
286 }
287
288 *q++ = RFC2132_LEASE_TIME;
289 *q++ = 4;
290 val = htonl(LEASE_TIME);
291 memcpy(q, &val, 4);
292 q += 4;
293
294 if (*slirp->client_hostname) {
295 val = strlen(slirp->client_hostname);
296 if (q + val + 2 >= end) {
297 g_warning("DHCP packet size exceeded, "
298 "omitting host name option.");
299 } else {
300 *q++ = RFC1533_HOSTNAME;
301 *q++ = val;
302 memcpy(q, slirp->client_hostname, val);
303 q += val;
304 }
305 }
306
307 if (slirp->vdomainname) {
308 val = strlen(slirp->vdomainname);
309 if (q + val + 2 >= end) {
310 g_warning("DHCP packet size exceeded, "
311 "omitting domain name option.");
312 } else {
313 *q++ = RFC1533_DOMAINNAME;
314 *q++ = val;
315 memcpy(q, slirp->vdomainname, val);
316 q += val;
317 }
318 }
319
320 if (slirp->tftp_server_name) {
321 val = strlen(slirp->tftp_server_name);
322 if (q + val + 2 >= end) {
323 g_warning("DHCP packet size exceeded, "
324 "omitting tftp-server-name option.");
325 } else {
326 *q++ = RFC2132_TFTP_SERVER_NAME;
327 *q++ = val;
328 memcpy(q, slirp->tftp_server_name, val);
329 q += val;
330 }
331 }
332
333 if (slirp->vdnssearch) {
334 val = slirp->vdnssearch_len;
335 if (q + val >= end) {
336 g_warning("DHCP packet size exceeded, "
337 "omitting domain-search option.");
338 } else {
339 memcpy(q, slirp->vdnssearch, val);
340 q += val;
341 }
342 }
343 } else {
344 static const char nak_msg[] = "requested address not available";
345
346 DPRINTF("nak'ed addr=%08" PRIx32 "\n", ntohl(preq_addr.s_addr));
347
348 *q++ = RFC2132_MSG_TYPE;
349 *q++ = 1;
350 *q++ = DHCPNAK;
351
352 *q++ = RFC2132_MESSAGE;
353 *q++ = sizeof(nak_msg) - 1;
354 memcpy(q, nak_msg, sizeof(nak_msg) - 1);
355 q += sizeof(nak_msg) - 1;
356 }
357 assert(q < end);
358 *q = RFC1533_END;
359
360 daddr.sin_addr.s_addr = 0xffffffffu;
361
362 assert ((q - rbp->bp_vend + 1) <= DHCP_OPT_LEN);
363
364 m->m_len = sizeof(struct bootp_t) + (q - rbp->bp_vend + 1) - sizeof(struct ip) - sizeof(struct udphdr);
365 udp_output(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY);
366 }
367
bootp_input(struct mbuf * m)368 void bootp_input(struct mbuf *m)
369 {
370 struct bootp_t *bp = mtod_check(m, sizeof(struct bootp_t));
371
372 if (bp && bp->bp_op == BOOTP_REQUEST) {
373 bootp_reply(m->slirp, bp, m_end(m));
374 }
375 }
376