xref: /netbsd/sys/nfs/nfs_bootdhcp.c (revision c4a72b64)
1 /*	$NetBSD: nfs_bootdhcp.c,v 1.21 2002/06/10 17:45:54 drochner Exp $	*/
2 
3 /*-
4  * Copyright (c) 1995, 1997 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Adam Glass and Gordon W. Ross.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the NetBSD
21  *	Foundation, Inc. and its contributors.
22  * 4. Neither the name of The NetBSD Foundation nor the names of its
23  *    contributors may be used to endorse or promote products derived
24  *    from this software without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
36  * POSSIBILITY OF SUCH DAMAGE.
37  */
38 
39 /*
40  * Support for NFS diskless booting with BOOTP (RFC951, RFC1048)
41  *
42  * History:
43  *
44  * Tor Egge developed the initial version of this code based on
45  * the Sun RPC/bootparam sources nfs_boot.c and krpc_subr.c and
46  * submitted that work to NetBSD as bugreport "kern/2351" on
47  * 29 Apr 1996.
48  *
49  * Gordon Ross reorganized Tor's version into this form and
50  * integrated it into the NetBSD sources during Aug 1997.
51  */
52 
53 #include <sys/cdefs.h>
54 __KERNEL_RCSID(0, "$NetBSD: nfs_bootdhcp.c,v 1.21 2002/06/10 17:45:54 drochner Exp $");
55 
56 #include "opt_nfs_boot.h"
57 
58 #include <sys/param.h>
59 #include <sys/systm.h>
60 #include <sys/kernel.h>
61 #include <sys/device.h>
62 #include <sys/ioctl.h>
63 #include <sys/proc.h>
64 #include <sys/mount.h>
65 #include <sys/mbuf.h>
66 #include <sys/reboot.h>
67 #include <sys/socket.h>
68 #include <sys/socketvar.h>
69 
70 #include <net/if.h>
71 #include <net/if_types.h>
72 #include <net/if_arp.h> 	/* ARPHRD_ETHER, etc. */
73 #include <net/if_dl.h>
74 #include <net/if_ether.h>
75 #include <net/route.h>
76 
77 #include <netinet/in.h>
78 #include <netinet/if_inarp.h>
79 
80 #include <nfs/rpcv2.h>
81 
82 #include <nfs/nfsproto.h>
83 #include <nfs/nfs.h>
84 #include <nfs/nfsmount.h>
85 #include <nfs/nfsdiskless.h>
86 
87 /*
88  * There are two implementations of NFS diskless boot.
89  * This implementation uses BOOTP (RFC951, RFC1048), and
90  * the other uses Sun RPC/bootparams (nfs_bootparam.c).
91  *
92  * This method gets everything it needs with one BOOTP
93  * request and reply.  Note that this actually uses only
94  * the old BOOTP functionality subset of DHCP.  It is not
95  * clear that DHCP provides any advantage over BOOTP for
96  * diskless boot.  DHCP allows the server to assign an IP
97  * address without any a-priori knowledge of the client,
98  * but we require that the server has a-priori knowledge
99  * of the client so it can export our (unique) NFS root.
100  * Given that the server needs a-priori knowledge about
101  * the client anyway, it might as well assign a fixed IP
102  * address for the client and support BOOTP.
103  *
104  * On the other hand, disk-FULL clients may use DHCP, but
105  * in that case the DHCP client should be user-mode code,
106  * and has no bearing on the code below. -gwr
107  */
108 
109 /* Begin stuff from bootp.h */
110 /* Definitions from RFC951 */
111 #define BP_CHADDR_LEN	 16
112 #define BP_SNAME_LEN	 64
113 #define BP_FILE_LEN	128
114 #define BP_VEND_LEN	 64
115 struct bootp {
116 	u_int8_t	bp_op;		/* packet opcode type */
117 	u_int8_t	bp_htype;	/* hardware addr type */
118 	u_int8_t	bp_hlen;	/* hardware addr length */
119 	u_int8_t	bp_hops;	/* gateway hops */
120 	u_int32_t	bp_xid;		/* transaction ID */
121 	u_int16_t	bp_secs;	/* seconds since boot began */
122 	u_int16_t	bp_flags;	/* RFC1532 broadcast, etc. */
123 	struct in_addr	bp_ciaddr;	/* client IP address */
124 	struct in_addr	bp_yiaddr;	/* 'your' IP address */
125 	struct in_addr	bp_siaddr;	/* server IP address */
126 	struct in_addr	bp_giaddr;	/* gateway IP address */
127 	u_int8_t bp_chaddr[BP_CHADDR_LEN]; /* client hardware address */
128 	char	bp_sname[BP_SNAME_LEN]; /* server host name */
129 	char	bp_file[BP_FILE_LEN];	/* boot file name */
130 	u_int8_t bp_vend[BP_VEND_LEN];	/* RFC1048 options */
131 	/*
132 	 * Note that BOOTP packets are allowed to be longer
133 	 * (see RFC 1532 sect. 2.1) and common practice is to
134 	 * allow the option data in bp_vend to extend into the
135 	 * additional space provided in longer packets.
136 	 */
137 };
138 
139 #define IPPORT_BOOTPS 67
140 #define IPPORT_BOOTPC 68
141 
142 #define BOOTREQUEST		1
143 #define BOOTREPLY		2
144 
145 /*
146  * Is this available from the sockaddr_dl somehow?
147  * Perhaps (struct arphdr)->ar_hrd = ARPHRD_ETHER?
148  * The interface has ->if_type but not the ARP fmt.
149  */
150 #define HTYPE_ETHERNET		1
151 #define HTYPE_IEEE802		6
152 
153 /*
154  * Vendor magic cookie (v_magic) for RFC1048
155  */
156 static const u_int8_t vm_rfc1048[4] = { 99, 130, 83, 99 };
157 
158 /*
159  * Tag values used to specify what information is being supplied in
160  * the vendor (options) data area of the packet.
161  */
162 /* RFC 1048 */
163 #define TAG_END			((unsigned char) 255)
164 #define TAG_PAD			((unsigned char)   0)
165 #define TAG_SUBNET_MASK		((unsigned char)   1)
166 #define TAG_TIME_OFFSET		((unsigned char)   2)
167 #define TAG_GATEWAY		((unsigned char)   3)
168 #define TAG_TIME_SERVER		((unsigned char)   4)
169 #define TAG_NAME_SERVER		((unsigned char)   5)
170 #define TAG_DOMAIN_SERVER	((unsigned char)   6)
171 #define TAG_LOG_SERVER		((unsigned char)   7)
172 #define TAG_COOKIE_SERVER	((unsigned char)   8)
173 #define TAG_LPR_SERVER		((unsigned char)   9)
174 #define TAG_IMPRESS_SERVER	((unsigned char)  10)
175 #define TAG_RLP_SERVER		((unsigned char)  11)
176 #define TAG_HOST_NAME		((unsigned char)  12)
177 #define TAG_BOOT_SIZE		((unsigned char)  13)
178 /* RFC 1395 */
179 #define TAG_DUMP_FILE		((unsigned char)  14)
180 #define TAG_DOMAIN_NAME		((unsigned char)  15)
181 #define TAG_SWAP_SERVER		((unsigned char)  16)
182 #define TAG_ROOT_PATH		((unsigned char)  17)
183 /* End of stuff from bootp.h */
184 
185 #ifdef NFS_BOOT_DHCP
186 #define TAG_REQ_ADDR		((unsigned char)  50)
187 #define TAG_LEASETIME		((unsigned char)  51)
188 #define TAG_OVERLOAD		((unsigned char)  52)
189 #define TAG_DHCP_MSGTYPE	((unsigned char)  53)
190 #define TAG_SERVERID		((unsigned char)  54)
191 #define TAG_PARAM_REQ		((unsigned char)  55)
192 #define TAG_MSG			((unsigned char)  56)
193 #define TAG_MAXSIZE		((unsigned char)  57)
194 #define TAG_T1			((unsigned char)  58)
195 #define TAG_T2			((unsigned char)  59)
196 #define TAG_CLASSID		((unsigned char)  60)
197 #define TAG_CLIENTID		((unsigned char)  61)
198 #endif
199 
200 #ifdef NFS_BOOT_DHCP
201 #define DHCPDISCOVER 1
202 #define DHCPOFFER 2
203 #define DHCPREQUEST 3
204 #define DHCPDECLINE 4
205 #define DHCPACK 5
206 #define DHCPNAK 6
207 #define DHCPRELEASE 7
208 #endif
209 
210 #ifdef NFS_BOOT_DHCP
211 #define BOOTP_SIZE_MAX	(sizeof(struct bootp)+312-64)
212 #else
213 /*
214  * The "extended" size is somewhat arbitrary, but is
215  * constrained by the maximum message size specified
216  * by RFC1533 (567 total).  This value increases the
217  * space for options from 64 bytes to 256 bytes.
218  */
219 #define BOOTP_SIZE_MAX	(sizeof(struct bootp)+256-64)
220 #endif
221 #define BOOTP_SIZE_MIN	(sizeof(struct bootp))
222 
223 /* Convenience macro */
224 #define INTOHL(ina) ((u_int32_t)ntohl((ina).s_addr))
225 
226 static int bootpc_call __P((struct nfs_diskless *, struct proc *));
227 static void bootp_extract __P((struct bootp *, int, struct nfs_diskless *));
228 
229 /* #define DEBUG	XXX */
230 
231 #ifdef	DEBUG
232 #define DPRINT(s) printf("nfs_boot: %s\n", s)
233 #else
234 #define DPRINT(s) (void)0
235 #endif
236 
237 
238 /*
239  * Get our boot parameters using BOOTP.
240  */
241 int
242 nfs_bootdhcp(nd, procp)
243 	struct nfs_diskless *nd;
244 	struct proc *procp;
245 {
246 	struct ifnet *ifp = nd->nd_ifp;
247 	int error;
248 
249 	/*
250 	 * Do enough of ifconfig(8) so that the chosen interface
251 	 * can talk to the servers.  Use address zero for now.
252 	 */
253 	error = nfs_boot_setaddress(ifp, procp, INADDR_ANY, INADDR_ANY,
254 				    INADDR_BROADCAST);
255 	if (error) {
256 		printf("nfs_boot: set ifaddr zero, error=%d\n", error);
257 		return (error);
258 	}
259 
260 	/* This function call does the real send/recv work. */
261 	error = bootpc_call(nd, procp);
262 
263 	/* Get rid of the temporary (zero) IP address. */
264 	(void) nfs_boot_deladdress(ifp, procp, INADDR_ANY);
265 
266 	/* NOW we can test the error from bootpc_call. */
267 	if (error)
268 		goto out;
269 
270 	/*
271 	 * Do ifconfig with our real IP address and mask.
272 	 */
273 	error = nfs_boot_setaddress(ifp, procp, nd->nd_myip.s_addr,
274 				    nd->nd_mask.s_addr, INADDR_ANY);
275 	if (error) {
276 		printf("nfs_boot: set ifaddr real, error=%d\n", error);
277 		goto out;
278 	}
279 
280 out:
281 	if (error) {
282 		(void) nfs_boot_ifupdown(ifp, procp, 0);
283 		nfs_boot_flushrt(ifp);
284 	}
285 	return (error);
286 }
287 
288 struct bootpcontext {
289 	int xid;
290 	u_char *haddr;
291 	u_char halen;
292 	struct bootp *replybuf;
293 	int replylen;
294 #ifdef NFS_BOOT_DHCP
295 	char expected_dhcpmsgtype, dhcp_ok;
296 	struct in_addr dhcp_serverip;
297 #endif
298 };
299 
300 static int bootpset __P((struct mbuf*, void*, int));
301 static int bootpcheck __P((struct mbuf*, void*));
302 
303 static int
304 bootpset(m, context, waited)
305 	struct mbuf *m;
306 	void *context;
307 	int waited;
308 {
309 	struct bootp *bootp;
310 
311 	/* we know it's contigous (in 1 mbuf cluster) */
312 	bootp = mtod(m, struct bootp*);
313 
314 	bootp->bp_secs = htons(waited);
315 
316 	return (0);
317 }
318 
319 static int
320 bootpcheck(m, context)
321 	struct mbuf *m;
322 	void *context;
323 {
324 	struct bootp *bootp;
325 	struct bootpcontext *bpc = context;
326 	u_int tag, len;
327 	u_char *p, *limit;
328 
329 	/*
330 	 * Is this a valid reply?
331 	 */
332 	if (m->m_pkthdr.len < BOOTP_SIZE_MIN) {
333 		DPRINT("short packet");
334 		return (-1);
335 	}
336 	if (m->m_pkthdr.len > BOOTP_SIZE_MAX) {
337 		DPRINT("long packet");
338 		return (-1);
339 	}
340 
341 	/*
342 	 * don't make first checks more expensive than necessary
343 	 */
344 	if (m->m_len < offsetof(struct bootp, bp_sname)) {
345 		m = m_pullup(m, offsetof(struct bootp, bp_sname));
346 		if (m == NULL)
347 			return (-1);
348 	}
349 	bootp = mtod(m, struct bootp*);
350 
351 	if (bootp->bp_op != BOOTREPLY) {
352 		DPRINT("not reply");
353 		return (-1);
354 	}
355 	if (bootp->bp_hlen != bpc->halen) {
356 		DPRINT("bad hwa_len");
357 		return (-1);
358 	}
359 	if (memcmp(bootp->bp_chaddr, bpc->haddr, bpc->halen)) {
360 		DPRINT("wrong hwaddr");
361 		return (-1);
362 	}
363 	if (bootp->bp_xid != bpc->xid) {
364 		DPRINT("wrong xid");
365 		return (-1);
366 	}
367 
368 	/*
369 	 * OK, it's worth to look deeper.
370 	 * We copy the mbuf into a flat buffer here because
371 	 * m_pullup() is a bit limited for this purpose
372 	 * (doesn't allocate a cluster if necessary).
373 	 */
374 	bpc->replylen = m->m_pkthdr.len;
375 	m_copydata(m, 0, bpc->replylen, (caddr_t)bpc->replybuf);
376 	bootp = bpc->replybuf;
377 
378 	/*
379 	 * Check if the IP address we get looks correct.
380 	 * (DHCP servers can send junk to unknown clients.)
381 	 * XXX more checks might be needed
382 	 */
383 	if (bootp->bp_yiaddr.s_addr == INADDR_ANY ||
384 	    bootp->bp_yiaddr.s_addr == INADDR_BROADCAST) {
385 		printf("nfs_boot: wrong IP addr %s",
386 		       inet_ntoa(bootp->bp_yiaddr));
387 		goto warn;
388 	}
389 
390 	/*
391 	 * Check the vendor data.
392 	 */
393 	if (memcmp(bootp->bp_vend, vm_rfc1048, 4)) {
394 		printf("nfs_boot: reply missing options");
395 		goto warn;
396 	}
397 	p = &bootp->bp_vend[4];
398 	limit = ((char*)bootp) + bpc->replylen;
399 	while (p < limit) {
400 		tag = *p++;
401 		if (tag == TAG_END)
402 			break;
403 		if (tag == TAG_PAD)
404 			continue;
405 		len = *p++;
406 		if ((p + len) > limit) {
407 			printf("nfs_boot: option %d too long", tag);
408 			goto warn;
409 		}
410 		switch (tag) {
411 #ifdef NFS_BOOT_DHCP
412 		case TAG_DHCP_MSGTYPE:
413 			if (*p != bpc->expected_dhcpmsgtype)
414 				return (-1);
415 			bpc->dhcp_ok = 1;
416 			break;
417 		case TAG_SERVERID:
418 			memcpy(&bpc->dhcp_serverip.s_addr, p,
419 			      sizeof(bpc->dhcp_serverip.s_addr));
420 			break;
421 #endif
422 		default:
423 			break;
424 		}
425 		p += len;
426 	}
427 	return (0);
428 
429 warn:
430 	printf(" (bad reply from %s)\n", inet_ntoa(bootp->bp_siaddr));
431 	return (-1);
432 }
433 
434 static int
435 bootpc_call(nd, procp)
436 	struct nfs_diskless *nd;
437 	struct proc *procp;
438 {
439 	struct socket *so;
440 	struct ifnet *ifp = nd->nd_ifp;
441 	static u_int32_t xid = ~0xFF;
442 	struct bootp *bootp;	/* request */
443 	struct mbuf *m, *nam;
444 	struct sockaddr_in *sin;
445 	int error;
446 	u_char *haddr;
447 	u_char hafmt, halen;
448 	struct bootpcontext bpc;
449 #ifdef NFS_BOOT_DHCP
450 	char vci[64];
451 	int vcilen;
452 #endif
453 
454 	error = socreate(AF_INET, &so, SOCK_DGRAM, 0);
455 	if (error) {
456 		printf("bootp: socreate, error=%d\n", error);
457 		return (error);
458 	}
459 
460 	/*
461 	 * Initialize to NULL anything that will hold an allocation,
462 	 * and free each at the end if not null.
463 	 */
464 	bpc.replybuf = NULL;
465 	m = nam = NULL;
466 
467 	/* Record our H/W (Ethernet) address. */
468 	{	struct sockaddr_dl *sdl = ifp->if_sadl;
469 		switch (sdl->sdl_type) {
470 		    case IFT_ISO88025:
471 			hafmt = HTYPE_IEEE802;
472 			break;
473 		    case IFT_ETHER:
474 		    case IFT_FDDI:
475 			hafmt = HTYPE_ETHERNET;
476 			break;
477 		    default:
478 			printf("bootp: unsupported interface type %d\n",
479 			       sdl->sdl_type);
480 			error = EINVAL;
481 			goto out;
482 		}
483 		halen = sdl->sdl_alen;
484 		haddr = (unsigned char *)LLADDR(sdl);
485 	}
486 
487 	/*
488 	 * Skip the route table when sending on this socket.
489 	 * If this is not done, ip_output finds the loopback
490 	 * interface (why?) and then fails because broadcast
491 	 * is not supported on that interface...
492 	 */
493 	{	int32_t *opt;
494 		m = m_get(M_WAIT, MT_SOOPTS);
495 		opt = mtod(m, int32_t *);
496 		m->m_len = sizeof(*opt);
497 		*opt = 1;
498 		error = sosetopt(so, SOL_SOCKET, SO_DONTROUTE, m);
499 		m = NULL;	/* was consumed */
500 	}
501 	if (error) {
502 		DPRINT("SO_DONTROUTE");
503 		goto out;
504 	}
505 
506 	/* Enable broadcast. */
507 	if ((error = nfs_boot_enbroadcast(so))) {
508 		DPRINT("SO_BROADCAST");
509 		goto out;
510 	}
511 
512 	/*
513 	 * Set some TTL so we can boot through routers.
514 	 * Real BOOTP forwarding agents don't need this; they obey "bp_hops"
515 	 * and set "bp_giaddr", thus rewrite the packet anyway.
516 	 * The "helper-address" feature of some popular router vendor seems
517 	 * to do simple IP forwarding and drops packets with (ip_ttl == 1).
518 	 */
519 	{	u_char *opt;
520 		m = m_get(M_WAIT, MT_SOOPTS);
521 		opt = mtod(m, u_char *);
522 		m->m_len = sizeof(*opt);
523 		*opt = 7;
524 		error = sosetopt(so, IPPROTO_IP, IP_MULTICAST_TTL, m);
525 		m = NULL;	/* was consumed */
526 	}
527 	if (error) {
528 		DPRINT("IP_MULTICAST_TTL");
529 		goto out;
530 	}
531 
532 	/* Set the receive timeout for the socket. */
533 	if ((error = nfs_boot_setrecvtimo(so))) {
534 		DPRINT("SO_RCVTIMEO");
535 		goto out;
536 	}
537 
538 	/*
539 	 * Bind the local endpoint to a bootp client port.
540 	 */
541 	if ((error = nfs_boot_sobind_ipport(so, IPPORT_BOOTPC))) {
542 		DPRINT("bind failed\n");
543 		goto out;
544 	}
545 
546 	/*
547 	 * Setup socket address for the server.
548 	 */
549 	nam = m_get(M_WAIT, MT_SONAME);
550 	sin = mtod(nam, struct sockaddr_in *);
551 	sin->sin_len = nam->m_len = sizeof(*sin);
552 	sin->sin_family = AF_INET;
553 	sin->sin_addr.s_addr = INADDR_BROADCAST;
554 	sin->sin_port = htons(IPPORT_BOOTPS);
555 
556 	/*
557 	 * Allocate buffer used for request
558 	 */
559 	m = m_gethdr(M_WAIT, MT_DATA);
560 	MCLGET(m, M_WAIT);
561 	bootp = mtod(m, struct bootp*);
562 	m->m_pkthdr.len = m->m_len = BOOTP_SIZE_MAX;
563 	m->m_pkthdr.rcvif = NULL;
564 
565 	/*
566 	 * Build the BOOTP reqest message.
567 	 * Note: xid is host order! (opaque to server)
568 	 */
569 	memset((caddr_t)bootp, 0, BOOTP_SIZE_MAX);
570 	bootp->bp_op    = BOOTREQUEST;
571 	bootp->bp_htype = hafmt;
572 	bootp->bp_hlen  = halen;	/* Hardware address length */
573 	bootp->bp_xid = ++xid;
574 	memcpy(bootp->bp_chaddr, haddr, halen);
575 #ifdef NFS_BOOT_BOOTP_REQFILE
576 	strncpy(bootp->bp_file, NFS_BOOT_BOOTP_REQFILE, sizeof(bootp->bp_file));
577 #endif
578 	/* Fill-in the vendor data. */
579 	memcpy(bootp->bp_vend, vm_rfc1048, 4);
580 #ifdef NFS_BOOT_DHCP
581 	bootp->bp_vend[4] = TAG_DHCP_MSGTYPE;
582 	bootp->bp_vend[5] = 1;
583 	bootp->bp_vend[6] = DHCPDISCOVER;
584 	/*
585 	 * Insert a NetBSD Vendor Class Identifier option.
586 	 */
587 	sprintf(vci, "%s:%s:kernel:%s", ostype, MACHINE, osrelease);
588 	vcilen = strlen(vci);
589 	bootp->bp_vend[7] = TAG_CLASSID;
590 	bootp->bp_vend[8] = vcilen;
591 	memcpy(&bootp->bp_vend[9], vci, vcilen);
592 	bootp->bp_vend[9 + vcilen] = TAG_END;
593 #else
594 	bootp->bp_vend[4] = TAG_END;
595 #endif
596 
597 	bpc.xid = xid;
598 	bpc.haddr = haddr;
599 	bpc.halen = halen;
600 	bpc.replybuf = malloc(BOOTP_SIZE_MAX, M_DEVBUF, M_WAITOK);
601 	if (bpc.replybuf == NULL)
602 		panic("nfs_boot: malloc reply buf");
603 #ifdef NFS_BOOT_DHCP
604 	bpc.expected_dhcpmsgtype = DHCPOFFER;
605 	bpc.dhcp_ok = 0;
606 #endif
607 
608 	error = nfs_boot_sendrecv(so, nam, bootpset, m,
609 				  bootpcheck, 0, 0, &bpc);
610 	if (error)
611 		goto out;
612 
613 #ifdef NFS_BOOT_DHCP
614 	if (bpc.dhcp_ok) {
615 		u_int32_t leasetime;
616 		bootp->bp_vend[6] = DHCPREQUEST;
617 		bootp->bp_vend[7] = TAG_REQ_ADDR;
618 		bootp->bp_vend[8] = 4;
619 		memcpy(&bootp->bp_vend[9], &bpc.replybuf->bp_yiaddr, 4);
620 		bootp->bp_vend[13] = TAG_SERVERID;
621 		bootp->bp_vend[14] = 4;
622 		memcpy(&bootp->bp_vend[15], &bpc.dhcp_serverip.s_addr, 4);
623 		bootp->bp_vend[19] = TAG_LEASETIME;
624 		bootp->bp_vend[20] = 4;
625 		leasetime = htonl(300);
626 		memcpy(&bootp->bp_vend[21], &leasetime, 4);
627 		/*
628 		 * Insert a NetBSD Vendor Class Identifier option.
629 		 */
630 		sprintf(vci, "%s:%s:kernel:%s", ostype, MACHINE, osrelease);
631 		vcilen = strlen(vci);
632 		bootp->bp_vend[25] = TAG_CLASSID;
633 		bootp->bp_vend[26] = vcilen;
634 		memcpy(&bootp->bp_vend[27], vci, vcilen);
635 		bootp->bp_vend[27 + vcilen] = TAG_END;
636 
637 		bpc.expected_dhcpmsgtype = DHCPACK;
638 
639 		error = nfs_boot_sendrecv(so, nam, bootpset, m,
640 					  bootpcheck, 0, 0, &bpc);
641 		if (error)
642 			goto out;
643 	}
644 #endif
645 
646 	/*
647 	 * bootpcheck() has copied the receive mbuf into
648 	 * the buffer at bpc.replybuf.
649 	 */
650 #ifdef NFS_BOOT_DHCP
651 	printf("nfs_boot: %s next-server: %s\n",
652 	       (bpc.dhcp_ok ? "DHCP" : "BOOTP"),
653 #else
654 	printf("nfs_boot: BOOTP next-server: %s\n",
655 #endif
656 	       inet_ntoa(bpc.replybuf->bp_siaddr));
657 
658 	bootp_extract(bpc.replybuf, bpc.replylen, nd);
659 
660 out:
661 	if (bpc.replybuf)
662 		free(bpc.replybuf, M_DEVBUF);
663 	if (m)
664 		m_freem(m);
665 	if (nam)
666 		m_freem(nam);
667 	soclose(so);
668 	return (error);
669 }
670 
671 static void
672 bootp_extract(bootp, replylen, nd)
673 	struct bootp *bootp;
674 	int replylen;
675 	struct nfs_diskless *nd;
676 {
677 	struct sockaddr_in *sin;
678 	struct in_addr netmask;
679 	struct in_addr gateway;
680 	struct in_addr rootserver;
681 	char *myname;	/* my hostname */
682 	char *mydomain;	/* my domainname */
683 	char *rootpath;
684 	int mynamelen;
685 	int mydomainlen;
686 	int rootpathlen;
687 	int overloaded;
688 	u_int tag, len;
689 	u_char *p, *limit;
690 
691 	/* Default these to "unspecified". */
692 	netmask.s_addr = 0;
693 	gateway.s_addr = 0;
694 	mydomain    = myname    = rootpath = NULL;
695 	mydomainlen = mynamelen = rootpathlen = 0;
696 	/* default root server to bootp next-server */
697 	rootserver = bootp->bp_siaddr;
698 	/* assume that server name field is not overloaded by default */
699 	overloaded = 0;
700 
701 	p = &bootp->bp_vend[4];
702 	limit = ((char*)bootp) + replylen;
703 	while (p < limit) {
704 		tag = *p++;
705 		if (tag == TAG_END)
706 			break;
707 		if (tag == TAG_PAD)
708 			continue;
709 		len = *p++;
710 #if 0 /* already done in bootpcheck() */
711 		if ((p + len) > limit) {
712 			printf("nfs_boot: option %d too long\n", tag);
713 			break;
714 		}
715 #endif
716 		switch (tag) {
717 		    case TAG_SUBNET_MASK:
718 			memcpy(&netmask, p, 4);
719 			break;
720 		    case TAG_GATEWAY:
721 			/* Routers */
722 			memcpy(&gateway, p, 4);
723 			break;
724 		    case TAG_HOST_NAME:
725 			if (len >= sizeof(hostname)) {
726 				printf("nfs_boot: host name >= %lu bytes",
727 				       (u_long)sizeof(hostname));
728 				break;
729 			}
730 			myname = p;
731 			mynamelen = len;
732 			break;
733 		    case TAG_DOMAIN_NAME:
734 			if (len >= sizeof(domainname)) {
735 				printf("nfs_boot: domain name >= %lu bytes",
736 				       (u_long)sizeof(domainname));
737 				break;
738 			}
739 			mydomain = p;
740 			mydomainlen = len;
741 			break;
742 		    case TAG_ROOT_PATH:
743 			/* Leave some room for the server name. */
744 			if (len >= (MNAMELEN-10)) {
745 				printf("nfs_boot: rootpath >=%d bytes",
746 				       (MNAMELEN-10));
747 				break;
748 			}
749 			rootpath = p;
750 			rootpathlen = len;
751 			break;
752 		    case TAG_SWAP_SERVER:
753 			/* override NFS server address */
754 			memcpy(&rootserver, p, 4);
755 			break;
756 #ifdef NFS_BOOT_DHCP
757 		    case TAG_OVERLOAD:
758 			if (len > 0 && ((*p & 0x02) != 0))
759 				/*
760 				 * The server name field in the dhcp packet
761 				 * is overloaded and we can't find server
762 				 * name there.
763 				 */
764 				overloaded = 1;
765 			break;
766 #endif
767 		    default:
768 			break;
769 		}
770 		p += len;
771 	}
772 
773 	/*
774 	 * Store and print network config info.
775 	 */
776 	if (myname) {
777 		myname[mynamelen] = '\0';
778 		strncpy(hostname, myname, sizeof(hostname));
779 		hostnamelen = mynamelen;
780 		printf("nfs_boot: my_name=%s\n", hostname);
781 	}
782 	if (mydomain) {
783 		mydomain[mydomainlen] = '\0';
784 		strncpy(domainname, mydomain, sizeof(domainname));
785 		domainnamelen = mydomainlen;
786 		printf("nfs_boot: my_domain=%s\n", domainname);
787 	}
788 	nd->nd_myip = bootp->bp_yiaddr;
789 	if (nd->nd_myip.s_addr)
790 		printf("nfs_boot: my_addr=%s\n", inet_ntoa(nd->nd_myip));
791 	nd->nd_mask = netmask;
792 	if (nd->nd_mask.s_addr)
793 		printf("nfs_boot: my_mask=%s\n", inet_ntoa(nd->nd_mask));
794 	nd->nd_gwip = gateway;
795 	if (nd->nd_gwip.s_addr)
796 		printf("nfs_boot: gateway=%s\n", inet_ntoa(nd->nd_gwip));
797 
798 	/*
799 	 * Store the information about our NFS root mount.
800 	 * The caller will print it, so be silent here.
801 	 */
802 	{
803 		struct nfs_dlmount *ndm = &nd->nd_root;
804 
805 		/* Server IP address. */
806 		sin = (struct sockaddr_in *) &ndm->ndm_saddr;
807 		memset((caddr_t)sin, 0, sizeof(*sin));
808 		sin->sin_len = sizeof(*sin);
809 		sin->sin_family = AF_INET;
810 		sin->sin_addr = rootserver;
811 		/* Server name. */
812 		if (!overloaded && bootp->bp_sname[0] != 0 &&
813 		    !memcmp(&rootserver, &bootp->bp_siaddr,
814 			  sizeof(struct in_addr))) {
815 			/* standard root server, we have the name */
816 			strncpy(ndm->ndm_host, bootp->bp_sname, BP_SNAME_LEN-1);
817 		} else {
818 			/* Show the server IP address numerically. */
819 			strncpy(ndm->ndm_host, inet_ntoa(rootserver),
820 				BP_SNAME_LEN-1);
821 		}
822 		len = strlen(ndm->ndm_host);
823 		if (rootpath &&
824 		    len + 1 + rootpathlen + 1 <= sizeof(ndm->ndm_host)) {
825 			ndm->ndm_host[len++] = ':';
826 			strncpy(ndm->ndm_host + len,
827 				rootpath, rootpathlen);
828 			ndm->ndm_host[len + rootpathlen] = '\0';
829 		} /* else: upper layer will handle error */
830 	}
831 }
832