xref: /netbsd-src/sys/nfs/nfs_bootdhcp.c (revision 404fbe5fb94ca1e054339640cabb2801ce52dd30)
1 /*	$NetBSD: nfs_bootdhcp.c,v 1.45 2008/11/19 18:36:09 ad Exp $	*/
2 
3 /*-
4  * Copyright (c) 1995, 1997 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Adam Glass and Gordon W. Ross.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Support for NFS diskless booting with BOOTP (RFC951, RFC1048)
34  *
35  * History:
36  *
37  * Tor Egge developed the initial version of this code based on
38  * the Sun RPC/bootparam sources nfs_boot.c and krpc_subr.c and
39  * submitted that work to NetBSD as bugreport "kern/2351" on
40  * 29 Apr 1996.
41  *
42  * Gordon Ross reorganized Tor's version into this form and
43  * integrated it into the NetBSD sources during Aug 1997.
44  */
45 
46 #include <sys/cdefs.h>
47 __KERNEL_RCSID(0, "$NetBSD: nfs_bootdhcp.c,v 1.45 2008/11/19 18:36:09 ad Exp $");
48 
49 #ifdef _KERNEL_OPT
50 #include "opt_nfs_boot.h"
51 #include "opt_tftproot.h"
52 #endif
53 
54 #include <sys/param.h>
55 #include <sys/systm.h>
56 #include <sys/kernel.h>
57 #include <sys/device.h>
58 #include <sys/ioctl.h>
59 #include <sys/proc.h>
60 #include <sys/mount.h>
61 #include <sys/mbuf.h>
62 #include <sys/reboot.h>
63 #include <sys/socket.h>
64 #include <sys/socketvar.h>
65 
66 #include <net/if.h>
67 #include <net/if_types.h>
68 #include <net/if_arp.h> 	/* ARPHRD_ETHER, etc. */
69 #include <net/if_dl.h>
70 #include <net/if_ether.h>
71 #include <net/route.h>
72 
73 #include <netinet/in.h>
74 #include <netinet/if_inarp.h>
75 
76 #include <nfs/rpcv2.h>
77 
78 #include <nfs/nfsproto.h>
79 #include <nfs/nfs.h>
80 #include <nfs/nfsmount.h>
81 #include <nfs/nfsdiskless.h>
82 
83 /*
84  * There are two implementations of NFS diskless boot.
85  * This implementation uses BOOTP (RFC951, RFC1048), and
86  * the other uses Sun RPC/bootparams (nfs_bootparam.c).
87  *
88  * This method gets everything it needs with one BOOTP
89  * request and reply.  Note that this actually uses only
90  * the old BOOTP functionality subset of DHCP.  It is not
91  * clear that DHCP provides any advantage over BOOTP for
92  * diskless boot.  DHCP allows the server to assign an IP
93  * address without any a-priori knowledge of the client,
94  * but we require that the server has a-priori knowledge
95  * of the client so it can export our (unique) NFS root.
96  * Given that the server needs a-priori knowledge about
97  * the client anyway, it might as well assign a fixed IP
98  * address for the client and support BOOTP.
99  *
100  * On the other hand, disk-FULL clients may use DHCP, but
101  * in that case the DHCP client should be user-mode code,
102  * and has no bearing on the code below. -gwr
103  */
104 
105 /* Begin stuff from bootp.h */
106 /* Definitions from RFC951 */
107 #define BP_CHADDR_LEN	 16
108 #define BP_SNAME_LEN	 64
109 #define BP_FILE_LEN	128
110 #define BP_VEND_LEN	 64
111 struct bootp {
112 	u_int8_t	bp_op;		/* packet opcode type */
113 	u_int8_t	bp_htype;	/* hardware addr type */
114 	u_int8_t	bp_hlen;	/* hardware addr length */
115 	u_int8_t	bp_hops;	/* gateway hops */
116 	u_int32_t	bp_xid;		/* transaction ID */
117 	u_int16_t	bp_secs;	/* seconds since boot began */
118 	u_int16_t	bp_flags;	/* RFC1532 broadcast, etc. */
119 	struct in_addr	bp_ciaddr;	/* client IP address */
120 	struct in_addr	bp_yiaddr;	/* 'your' IP address */
121 	struct in_addr	bp_siaddr;	/* server IP address */
122 	struct in_addr	bp_giaddr;	/* gateway IP address */
123 	u_int8_t bp_chaddr[BP_CHADDR_LEN]; /* client hardware address */
124 	char	bp_sname[BP_SNAME_LEN]; /* server host name */
125 	char	bp_file[BP_FILE_LEN];	/* boot file name */
126 	u_int8_t bp_vend[BP_VEND_LEN];	/* RFC1048 options */
127 	/*
128 	 * Note that BOOTP packets are allowed to be longer
129 	 * (see RFC 1532 sect. 2.1) and common practice is to
130 	 * allow the option data in bp_vend to extend into the
131 	 * additional space provided in longer packets.
132 	 */
133 };
134 
135 #define IPPORT_BOOTPS 67
136 #define IPPORT_BOOTPC 68
137 
138 #define BOOTREQUEST		1
139 #define BOOTREPLY		2
140 
141 /*
142  * Is this available from the sockaddr_dl somehow?
143  * Perhaps (struct arphdr)->ar_hrd = ARPHRD_ETHER?
144  * The interface has ->if_type but not the ARP fmt.
145  */
146 #define HTYPE_ETHERNET		1
147 #define HTYPE_IEEE802		6
148 
149 /*
150  * Vendor magic cookie (v_magic) for RFC1048
151  */
152 static const u_int8_t vm_rfc1048[4] = { 99, 130, 83, 99 };
153 
154 /*
155  * Tag values used to specify what information is being supplied in
156  * the vendor (options) data area of the packet.
157  */
158 /* RFC 1048 */
159 #define TAG_END			((unsigned char) 255)
160 #define TAG_PAD			((unsigned char)   0)
161 #define TAG_SUBNET_MASK		((unsigned char)   1)
162 #define TAG_TIME_OFFSET		((unsigned char)   2)
163 #define TAG_GATEWAY		((unsigned char)   3)
164 #define TAG_TIME_SERVER		((unsigned char)   4)
165 #define TAG_NAME_SERVER		((unsigned char)   5)
166 #define TAG_DOMAIN_SERVER	((unsigned char)   6)
167 #define TAG_LOG_SERVER		((unsigned char)   7)
168 #define TAG_COOKIE_SERVER	((unsigned char)   8)
169 #define TAG_LPR_SERVER		((unsigned char)   9)
170 #define TAG_IMPRESS_SERVER	((unsigned char)  10)
171 #define TAG_RLP_SERVER		((unsigned char)  11)
172 #define TAG_HOST_NAME		((unsigned char)  12)
173 #define TAG_BOOT_SIZE		((unsigned char)  13)
174 /* RFC 1395 */
175 #define TAG_DUMP_FILE		((unsigned char)  14)
176 #define TAG_DOMAIN_NAME		((unsigned char)  15)
177 #define TAG_SWAP_SERVER		((unsigned char)  16)
178 #define TAG_ROOT_PATH		((unsigned char)  17)
179 /* End of stuff from bootp.h */
180 
181 #ifdef NFS_BOOT_DHCP
182 #define TAG_REQ_ADDR		((unsigned char)  50)
183 #define TAG_LEASETIME		((unsigned char)  51)
184 #define TAG_OVERLOAD		((unsigned char)  52)
185 #define TAG_DHCP_MSGTYPE	((unsigned char)  53)
186 #define TAG_SERVERID		((unsigned char)  54)
187 #define TAG_PARAM_REQ		((unsigned char)  55)
188 #define TAG_MSG			((unsigned char)  56)
189 #define TAG_MAXSIZE		((unsigned char)  57)
190 #define TAG_T1			((unsigned char)  58)
191 #define TAG_T2			((unsigned char)  59)
192 #define TAG_CLASSID		((unsigned char)  60)
193 #define TAG_CLIENTID		((unsigned char)  61)
194 #endif
195 
196 #ifdef NFS_BOOT_DHCP
197 #define DHCPDISCOVER 1
198 #define DHCPOFFER 2
199 #define DHCPREQUEST 3
200 #define DHCPDECLINE 4
201 #define DHCPACK 5
202 #define DHCPNAK 6
203 #define DHCPRELEASE 7
204 #endif
205 
206 #ifdef NFS_BOOT_DHCP
207 #define BOOTP_SIZE_MAX	(sizeof(struct bootp)+312-64)
208 #else
209 /*
210  * The "extended" size is somewhat arbitrary, but is
211  * constrained by the maximum message size specified
212  * by RFC1533 (567 total).  This value increases the
213  * space for options from 64 bytes to 256 bytes.
214  */
215 #define BOOTP_SIZE_MAX	(sizeof(struct bootp)+256-64)
216 #endif
217 #define BOOTP_SIZE_MIN	(sizeof(struct bootp))
218 
219 /* Convenience macro */
220 #define INTOHL(ina) ((u_int32_t)ntohl((ina).s_addr))
221 
222 static int bootpc_call (struct nfs_diskless *, struct lwp *, int *);
223 static void bootp_extract (struct bootp *, int, struct nfs_diskless *, int *);
224 
225 #ifdef	DEBUG_NFS_BOOT_DHCP
226 #define DPRINTF(s)  printf s
227 #else
228 #define DPRINTF(s)
229 #endif
230 
231 
232 /*
233  * Get our boot parameters using BOOTP.
234  */
235 int
236 nfs_bootdhcp(struct nfs_diskless *nd, struct lwp *lwp, int *flags)
237 {
238 	struct ifnet *ifp = nd->nd_ifp;
239 	int error;
240 
241 	/*
242 	 * Do enough of ifconfig(8) so that the chosen interface
243 	 * can talk to the servers.  Use address zero for now.
244 	 */
245 	error = nfs_boot_setaddress(ifp, lwp,
246 		*flags & NFS_BOOT_HAS_MYIP ? nd->nd_myip.s_addr : INADDR_ANY,
247 		*flags & NFS_BOOT_HAS_MASK ? nd->nd_mask.s_addr : INADDR_ANY,
248 		    INADDR_BROADCAST);
249 	if (error) {
250 		printf("nfs_boot: set ifaddr zero, error=%d\n", error);
251 		return (error);
252 	}
253 
254 	/* This function call does the real send/recv work. */
255 	error = bootpc_call(nd, lwp, flags);
256 
257 	/* Get rid of the temporary (zero) IP address. */
258 	(void) nfs_boot_deladdress(ifp, lwp, INADDR_ANY);
259 
260 	/* NOW we can test the error from bootpc_call. */
261 	if (error)
262 		goto out;
263 
264 	/*
265 	 * Do ifconfig with our real IP address and mask.
266 	 */
267 	error = nfs_boot_setaddress(ifp, lwp, nd->nd_myip.s_addr,
268 				    nd->nd_mask.s_addr, INADDR_ANY);
269 	if (error) {
270 		printf("nfs_boot: set ifaddr real, error=%d\n", error);
271 		goto out;
272 	}
273 
274 	if ((*flags & NFS_BOOT_ALLINFO) != NFS_BOOT_ALLINFO)
275 		return EADDRNOTAVAIL;
276 
277 out:
278 	if (error) {
279 		(void) nfs_boot_ifupdown(ifp, lwp, 0);
280 		nfs_boot_flushrt(ifp);
281 	}
282 	return (error);
283 }
284 
285 struct bootpcontext {
286 	int xid;
287 	const u_char *haddr;
288 	u_char halen;
289 	struct bootp *replybuf;
290 	int replylen;
291 #ifdef NFS_BOOT_DHCP
292 	char expected_dhcpmsgtype, dhcp_ok;
293 	struct in_addr dhcp_serverip;
294 #endif
295 };
296 
297 static int bootpset (struct mbuf*, void*, int);
298 static int bootpcheck (struct mbuf*, void*);
299 
300 static int
301 bootpset(struct mbuf *m, void *context, int waited)
302 {
303 	struct bootp *bootp;
304 
305 	/* we know it's contigous (in 1 mbuf cluster) */
306 	bootp = mtod(m, struct bootp*);
307 
308 	bootp->bp_secs = htons(waited);
309 
310 	return (0);
311 }
312 
313 static int
314 bootpcheck(struct mbuf *m, void *context)
315 {
316 	struct bootp *bootp;
317 	struct bootpcontext *bpc = context;
318 	u_int tag, len;
319 	u_char *p, *limit;
320 
321 	/*
322 	 * Is this a valid reply?
323 	 */
324 	if (m->m_pkthdr.len < BOOTP_SIZE_MIN) {
325 		DPRINTF(("bootpcheck: short packet %d < %d\n", m->m_pkthdr.len,
326 		    BOOTP_SIZE_MIN));
327 		return (-1);
328 	}
329 	if (m->m_pkthdr.len > BOOTP_SIZE_MAX) {
330 		DPRINTF(("Bootpcheck: long packet %d > %d\n", m->m_pkthdr.len,
331 		    BOOTP_SIZE_MAX));
332 		return (-1);
333 	}
334 
335 	/*
336 	 * don't make first checks more expensive than necessary
337 	 */
338 	if (m->m_len < offsetof(struct bootp, bp_sname)) {
339 		m = m_pullup(m, offsetof(struct bootp, bp_sname));
340 		if (m == NULL) {
341 			DPRINTF(("bootpcheck: m_pullup failed\n"));
342 			return (-1);
343 		}
344 	}
345 	bootp = mtod(m, struct bootp*);
346 
347 	if (bootp->bp_op != BOOTREPLY) {
348 		DPRINTF(("bootpcheck: op %d is not reply\n", bootp->bp_op));
349 		return (-1);
350 	}
351 	if (bootp->bp_hlen != bpc->halen) {
352 		DPRINTF(("bootpcheck: hlen %d != %d\n", bootp->bp_hlen,
353 		    bpc->halen));
354 		return (-1);
355 	}
356 	if (memcmp(bootp->bp_chaddr, bpc->haddr, bpc->halen)) {
357 #ifdef DEBUG_NFS_BOOT_DHCP
358 		char *bp_chaddr, *haddr;
359 
360 		bp_chaddr = malloc(3 * bpc->halen, M_TEMP, M_WAITOK);
361 		haddr     = malloc(3 * bpc->halen, M_TEMP, M_WAITOK);
362 
363 		DPRINTF(("bootpcheck: incorrect hwaddr %s != %s\n",
364 		    ether_snprintf(bp_chaddr, 3 * bpc->halen,
365 		    bootp->bp_chaddr),
366 		    ether_snprintf(haddr, 3 * bpc->halen, bpc->haddr)));
367 
368 		free(bp_chaddr, M_TEMP);
369 		free(haddr, M_TEMP);
370 #endif
371 		return (-1);
372 	}
373 	if (bootp->bp_xid != bpc->xid) {
374 		DPRINTF(("bootpcheck: xid %d != %d\n", bootp->bp_xid,
375 		    bpc->xid));
376 		return (-1);
377 	}
378 
379 	/*
380 	 * OK, it's worth to look deeper.
381 	 * We copy the mbuf into a flat buffer here because
382 	 * m_pullup() is a bit limited for this purpose
383 	 * (doesn't allocate a cluster if necessary).
384 	 */
385 	bpc->replylen = m->m_pkthdr.len;
386 	m_copydata(m, 0, bpc->replylen, (void *)bpc->replybuf);
387 	bootp = bpc->replybuf;
388 
389 	/*
390 	 * Check if the IP address we get looks correct.
391 	 * (DHCP servers can send junk to unknown clients.)
392 	 * XXX more checks might be needed
393 	 */
394 	if (bootp->bp_yiaddr.s_addr == INADDR_ANY ||
395 	    bootp->bp_yiaddr.s_addr == INADDR_BROADCAST) {
396 		printf("nfs_boot: wrong IP addr %s",
397 		       inet_ntoa(bootp->bp_yiaddr));
398 		goto warn;
399 	}
400 
401 	/*
402 	 * Check the vendor data.
403 	 */
404 	if (memcmp(bootp->bp_vend, vm_rfc1048, 4)) {
405 		printf("nfs_boot: reply missing options");
406 		goto warn;
407 	}
408 	p = &bootp->bp_vend[4];
409 	limit = ((u_char*)bootp) + bpc->replylen;
410 	while (p < limit) {
411 		tag = *p++;
412 		if (tag == TAG_END)
413 			break;
414 		if (tag == TAG_PAD)
415 			continue;
416 		len = *p++;
417 		if ((p + len) > limit) {
418 			printf("nfs_boot: option %d too long", tag);
419 			goto warn;
420 		}
421 		switch (tag) {
422 #ifdef NFS_BOOT_DHCP
423 		case TAG_DHCP_MSGTYPE:
424 			if (*p != bpc->expected_dhcpmsgtype)
425 				return (-1);
426 			bpc->dhcp_ok = 1;
427 			break;
428 		case TAG_SERVERID:
429 			memcpy(&bpc->dhcp_serverip.s_addr, p,
430 			      sizeof(bpc->dhcp_serverip.s_addr));
431 			break;
432 #endif
433 		default:
434 			break;
435 		}
436 		p += len;
437 	}
438 	return (0);
439 
440 warn:
441 	printf(" (bad reply from %s)\n", inet_ntoa(bootp->bp_siaddr));
442 	return (-1);
443 }
444 
445 static int
446 bootpc_call(struct nfs_diskless *nd, struct lwp *lwp, int *flags)
447 {
448 	struct socket *so;
449 	struct ifnet *ifp = nd->nd_ifp;
450 	static u_int32_t xid = ~0xFF;
451 	struct bootp *bootp;	/* request */
452 	struct mbuf *m, *nam;
453 	struct sockaddr_in *sin;
454 	int error;
455 	const u_char *haddr;
456 	u_char hafmt, halen;
457 	struct bootpcontext bpc;
458 #ifdef NFS_BOOT_DHCP
459 	char vci[64];
460 	int vcilen;
461 #endif
462 
463 	error = socreate(AF_INET, &so, SOCK_DGRAM, 0, lwp, NULL);
464 	if (error) {
465 		printf("bootp: socreate, error=%d\n", error);
466 		return (error);
467 	}
468 
469 	/*
470 	 * Initialize to NULL anything that will hold an allocation,
471 	 * and free each at the end if not null.
472 	 */
473 	bpc.replybuf = NULL;
474 	m = nam = NULL;
475 
476 	/* Record our H/W (Ethernet) address. */
477 	{	const struct sockaddr_dl *sdl = ifp->if_sadl;
478 		switch (sdl->sdl_type) {
479 		    case IFT_ISO88025:
480 			hafmt = HTYPE_IEEE802;
481 			break;
482 		    case IFT_ETHER:
483 		    case IFT_FDDI:
484 			hafmt = HTYPE_ETHERNET;
485 			break;
486 		    default:
487 			printf("bootp: unsupported interface type %d\n",
488 			       sdl->sdl_type);
489 			error = EINVAL;
490 			goto out;
491 		}
492 		halen = sdl->sdl_alen;
493 		haddr = (const unsigned char *)CLLADDR(sdl);
494 	}
495 
496 	/*
497 	 * Skip the route table when sending on this socket.
498 	 * If this is not done, ip_output finds the loopback
499 	 * interface (why?) and then fails because broadcast
500 	 * is not supported on that interface...
501 	 */
502 	{	int32_t opt;
503 
504 		opt = 1;
505 		error = so_setsockopt(NULL, so, SOL_SOCKET, SO_DONTROUTE, &opt,
506 		    sizeof(opt));
507 	}
508 	if (error) {
509 		DPRINTF(("bootpc_call: SO_DONTROUTE failed %d\n", error));
510 		goto out;
511 	}
512 
513 	/* Enable broadcast. */
514 	if ((error = nfs_boot_enbroadcast(so))) {
515 		DPRINTF(("bootpc_call: SO_BROADCAST failed %d\n", error));
516 		goto out;
517 	}
518 
519 	/*
520 	 * Set some TTL so we can boot through routers.
521 	 * Real BOOTP forwarding agents don't need this; they obey "bp_hops"
522 	 * and set "bp_giaddr", thus rewrite the packet anyway.
523 	 * The "helper-address" feature of some popular router vendor seems
524 	 * to do simple IP forwarding and drops packets with (ip_ttl == 1).
525 	 */
526 	{	u_char opt;
527 
528 		opt = 7;
529 		error = so_setsockopt(NULL, so, IPPROTO_IP, IP_MULTICAST_TTL,
530 		    &opt, sizeof(opt));
531 	}
532 	if (error) {
533 		DPRINTF(("bootpc_call: IP_MULTICAST_TTL failed %d\n", error));
534 		goto out;
535 	}
536 
537 	/* Set the receive timeout for the socket. */
538 	if ((error = nfs_boot_setrecvtimo(so))) {
539 		DPRINTF(("bootpc_call: SO_RCVTIMEO failed %d\n", error));
540 		goto out;
541 	}
542 
543 	/*
544 	 * Bind the local endpoint to a bootp client port.
545 	 */
546 	if ((error = nfs_boot_sobind_ipport(so, IPPORT_BOOTPC, lwp))) {
547 		DPRINTF(("bootpc_call: bind failed %d\n", error));
548 		goto out;
549 	}
550 
551 	/*
552 	 * Setup socket address for the server.
553 	 */
554 	nam = m_get(M_WAIT, MT_SONAME);
555 	sin = mtod(nam, struct sockaddr_in *);
556 	sin->sin_len = nam->m_len = sizeof(*sin);
557 	sin->sin_family = AF_INET;
558 	sin->sin_addr.s_addr = INADDR_BROADCAST;
559 	sin->sin_port = htons(IPPORT_BOOTPS);
560 
561 	/*
562 	 * Allocate buffer used for request
563 	 */
564 	m = m_gethdr(M_WAIT, MT_DATA);
565 	m_clget(m, M_WAIT);
566 	bootp = mtod(m, struct bootp*);
567 	m->m_pkthdr.len = m->m_len = BOOTP_SIZE_MAX;
568 	m->m_pkthdr.rcvif = NULL;
569 
570 	/*
571 	 * Build the BOOTP reqest message.
572 	 * Note: xid is host order! (opaque to server)
573 	 */
574 	memset((void *)bootp, 0, BOOTP_SIZE_MAX);
575 	bootp->bp_op    = BOOTREQUEST;
576 	bootp->bp_htype = hafmt;
577 	bootp->bp_hlen  = halen;	/* Hardware address length */
578 	bootp->bp_xid = ++xid;
579 	memcpy(bootp->bp_chaddr, haddr, halen);
580 #ifdef NFS_BOOT_BOOTP_REQFILE
581 	strncpy(bootp->bp_file, NFS_BOOT_BOOTP_REQFILE, sizeof(bootp->bp_file));
582 #endif
583 	/* Fill-in the vendor data. */
584 	memcpy(bootp->bp_vend, vm_rfc1048, 4);
585 #ifdef NFS_BOOT_DHCP
586 	bootp->bp_vend[4] = TAG_DHCP_MSGTYPE;
587 	bootp->bp_vend[5] = 1;
588 	bootp->bp_vend[6] = DHCPDISCOVER;
589 	/*
590 	 * Insert a NetBSD Vendor Class Identifier option.
591 	 */
592 	snprintf(vci, sizeof(vci), "%s:%s:kernel:%s", ostype, MACHINE,
593 	    osrelease);
594 	vcilen = strlen(vci);
595 	bootp->bp_vend[7] = TAG_CLASSID;
596 	bootp->bp_vend[8] = vcilen;
597 	memcpy(&bootp->bp_vend[9], vci, vcilen);
598 	bootp->bp_vend[9 + vcilen] = TAG_END;
599 #else
600 	bootp->bp_vend[4] = TAG_END;
601 #endif
602 
603 	bpc.xid = xid;
604 	bpc.haddr = haddr;
605 	bpc.halen = halen;
606 	bpc.replybuf = malloc(BOOTP_SIZE_MAX, M_DEVBUF, M_WAITOK);
607 	if (bpc.replybuf == NULL)
608 		panic("nfs_boot: malloc reply buf");
609 #ifdef NFS_BOOT_DHCP
610 	bpc.expected_dhcpmsgtype = DHCPOFFER;
611 	bpc.dhcp_ok = 0;
612 #endif
613 
614 	error = nfs_boot_sendrecv(so, nam, bootpset, m,
615 				  bootpcheck, 0, 0, &bpc, lwp);
616 	if (error)
617 		goto out;
618 
619 #ifdef NFS_BOOT_DHCP
620 	if (bpc.dhcp_ok) {
621 		u_int32_t leasetime;
622 		bootp->bp_vend[6] = DHCPREQUEST;
623 		bootp->bp_vend[7] = TAG_REQ_ADDR;
624 		bootp->bp_vend[8] = 4;
625 		memcpy(&bootp->bp_vend[9], &bpc.replybuf->bp_yiaddr, 4);
626 		bootp->bp_vend[13] = TAG_SERVERID;
627 		bootp->bp_vend[14] = 4;
628 		memcpy(&bootp->bp_vend[15], &bpc.dhcp_serverip.s_addr, 4);
629 		bootp->bp_vend[19] = TAG_LEASETIME;
630 		bootp->bp_vend[20] = 4;
631 		leasetime = htonl(300);
632 		memcpy(&bootp->bp_vend[21], &leasetime, 4);
633 		bootp->bp_vend[25] = TAG_CLASSID;
634 		bootp->bp_vend[26] = vcilen;
635 		memcpy(&bootp->bp_vend[27], vci, vcilen);
636 		bootp->bp_vend[27 + vcilen] = TAG_END;
637 
638 		bpc.expected_dhcpmsgtype = DHCPACK;
639 
640 		error = nfs_boot_sendrecv(so, nam, bootpset, m,
641 					  bootpcheck, 0, 0, &bpc, lwp);
642 		if (error)
643 			goto out;
644 	}
645 #endif
646 
647 	/*
648 	 * bootpcheck() has copied the receive mbuf into
649 	 * the buffer at bpc.replybuf.
650 	 */
651 #ifdef NFS_BOOT_DHCP
652 	printf("nfs_boot: %s next-server: %s\n",
653 	       (bpc.dhcp_ok ? "DHCP" : "BOOTP"),
654 #else
655 	printf("nfs_boot: BOOTP next-server: %s\n",
656 #endif
657 	       inet_ntoa(bpc.replybuf->bp_siaddr));
658 
659 	bootp_extract(bpc.replybuf, bpc.replylen, nd, flags);
660 
661 out:
662 	if (bpc.replybuf)
663 		free(bpc.replybuf, M_DEVBUF);
664 	if (m)
665 		m_freem(m);
666 	if (nam)
667 		m_freem(nam);
668 	soclose(so);
669 	return (error);
670 }
671 
672 static void
673 bootp_extract(struct bootp *bootp, int replylen,
674 		struct nfs_diskless *nd, int *flags)
675 {
676 	struct sockaddr_in *sin;
677 	struct in_addr netmask;
678 	struct in_addr gateway;
679 	struct in_addr rootserver;
680 	char *myname;	/* my hostname */
681 	char *mydomain;	/* my domainname */
682 	char *rootpath;
683 	int mynamelen;
684 	int mydomainlen;
685 	int rootpathlen;
686 	int overloaded;
687 	u_int tag, len;
688 	u_char *p, *limit;
689 
690 	/* Default these to "unspecified". */
691 	netmask.s_addr = 0;
692 	gateway.s_addr = 0;
693 	mydomain    = myname    = rootpath = NULL;
694 	mydomainlen = mynamelen = rootpathlen = 0;
695 
696 	/* default root server to bootp next-server */
697 	rootserver = bootp->bp_siaddr;
698 	/* assume that server name field is not overloaded by default */
699 	overloaded = 0;
700 
701 	p = &bootp->bp_vend[4];
702 	limit = ((u_char*)bootp) + replylen;
703 	while (p < limit) {
704 		tag = *p++;
705 		if (tag == TAG_END)
706 			break;
707 		if (tag == TAG_PAD)
708 			continue;
709 		len = *p++;
710 #if 0 /* already done in bootpcheck() */
711 		if ((p + len) > limit) {
712 			printf("nfs_boot: option %d too long\n", tag);
713 			break;
714 		}
715 #endif
716 		switch (tag) {
717 		    case TAG_SUBNET_MASK:
718 			memcpy(&netmask, p, 4);
719 			break;
720 		    case TAG_GATEWAY:
721 			/* Routers */
722 			memcpy(&gateway, p, 4);
723 			break;
724 		    case TAG_HOST_NAME:
725 			if (len >= sizeof(hostname)) {
726 				printf("nfs_boot: host name >= %lu bytes",
727 				       (u_long)sizeof(hostname));
728 				break;
729 			}
730 			myname = p;
731 			mynamelen = len;
732 			break;
733 		    case TAG_DOMAIN_NAME:
734 			if (len >= sizeof(domainname)) {
735 				printf("nfs_boot: domain name >= %lu bytes",
736 				       (u_long)sizeof(domainname));
737 				break;
738 			}
739 			mydomain = p;
740 			mydomainlen = len;
741 			break;
742 		    case TAG_ROOT_PATH:
743 			/* Leave some room for the server name. */
744 			if (len >= (MNAMELEN-10)) {
745 				printf("nfs_boot: rootpath >=%d bytes",
746 				       (MNAMELEN-10));
747 				break;
748 			}
749 			rootpath = p;
750 			rootpathlen = len;
751 			break;
752 		    case TAG_SWAP_SERVER:
753 			/* override NFS server address */
754 			memcpy(&rootserver, p, 4);
755 			break;
756 #ifdef NFS_BOOT_DHCP
757 		    case TAG_OVERLOAD:
758 			if (len > 0 && ((*p & 0x02) != 0))
759 				/*
760 				 * The server name field in the dhcp packet
761 				 * is overloaded and we can't find server
762 				 * name there.
763 				 */
764 				overloaded = 1;
765 			break;
766 #endif
767 		    default:
768 			break;
769 		}
770 		p += len;
771 	}
772 
773 	/*
774 	 * Store and print network config info.
775 	 */
776 	if (myname) {
777 		myname[mynamelen] = '\0';
778 		strncpy(hostname, myname, sizeof(hostname));
779 		hostnamelen = mynamelen;
780 		printf("nfs_boot: my_name=%s\n", hostname);
781 	}
782 	if (mydomain) {
783 		mydomain[mydomainlen] = '\0';
784 		strncpy(domainname, mydomain, sizeof(domainname));
785 		domainnamelen = mydomainlen;
786 		printf("nfs_boot: my_domain=%s\n", domainname);
787 	}
788 	if (!(*flags & NFS_BOOT_HAS_MYIP)) {
789 		nd->nd_myip = bootp->bp_yiaddr;
790 		printf("nfs_boot: my_addr=%s\n", inet_ntoa(nd->nd_myip));
791 		*flags |= NFS_BOOT_HAS_MYIP;
792 	}
793 	if (!(*flags & NFS_BOOT_HAS_MASK)) {
794 		nd->nd_mask = netmask;
795 		printf("nfs_boot: my_mask=%s\n", inet_ntoa(nd->nd_mask));
796 		*flags |= NFS_BOOT_HAS_MASK;
797 	}
798 	if (!(*flags & NFS_BOOT_HAS_GWIP)) {
799 		nd->nd_gwip = gateway;
800 		printf("nfs_boot: gateway=%s\n", inet_ntoa(nd->nd_gwip));
801 		*flags |= NFS_BOOT_HAS_GWIP;
802 	}
803 
804 	/*
805 	 * Store the information about our NFS root mount.
806 	 * The caller will print it, so be silent here.
807 	 */
808 	do {
809 		struct nfs_dlmount *ndm = &nd->nd_root;
810 
811 
812 		if (!(*flags & NFS_BOOT_HAS_SERVADDR)) {
813 			/* Server IP address. */
814 			sin = (struct sockaddr_in *) &ndm->ndm_saddr;
815 			memset((void *)sin, 0, sizeof(*sin));
816 			sin->sin_len = sizeof(*sin);
817 			sin->sin_family = AF_INET;
818 			sin->sin_addr = rootserver;
819 			*flags |= NFS_BOOT_HAS_SERVADDR;
820 		}
821 
822 		if (!(*flags & NFS_BOOT_HAS_SERVER)) {
823 			/* Server name. */
824 			if (!overloaded && bootp->bp_sname[0] != 0 &&
825 			    !memcmp(&rootserver, &bootp->bp_siaddr,
826 				  sizeof(struct in_addr)))
827 			{
828 				/* standard root server, we have the name */
829 				strncpy(ndm->ndm_host, bootp->bp_sname,
830 					BP_SNAME_LEN-1);
831 				*flags |= NFS_BOOT_HAS_SERVER;
832 			} else {
833 				/* Show the server IP address numerically. */
834 				strncpy(ndm->ndm_host, inet_ntoa(rootserver),
835 					BP_SNAME_LEN-1);
836 				*flags |= NFS_BOOT_HAS_SERVER;
837 			}
838 		}
839 
840 		if (!(*flags & NFS_BOOT_HAS_ROOTPATH)) {
841 			len = strlen(ndm->ndm_host);
842 			if (rootpath &&
843 			    len + 1 + rootpathlen + 1 <= sizeof(ndm->ndm_host))
844 			{
845 				ndm->ndm_host[len++] = ':';
846 				strncpy(ndm->ndm_host + len,
847 					rootpath, rootpathlen);
848 				ndm->ndm_host[len + rootpathlen] = '\0';
849 				*flags |= NFS_BOOT_HAS_ROOTPATH;
850 			} /* else: upper layer will handle error */
851 		}
852 	} while(0);
853 
854 #ifdef TFTPROOT
855 #if BP_FILE_LEN > MNAMELEN
856 #define BOOTFILELEN MNAMELEN
857 #else
858 #define BOOTFILELEN BP_FILE_LEN
859 #endif
860 	strncpy(nd->nd_bootfile, bootp->bp_file, BOOTFILELEN);
861 	nd->nd_bootfile[BOOTFILELEN - 1] = '\0';
862 #undef BOOTFILELEN
863 #endif /* TFTPROOT */
864 }
865