xref: /netbsd-src/sys/nfs/nfs_bootdhcp.c (revision cd22f25e6f6d1cc1f197fe8c5468a80f51d1c4e1)
1 /*	$NetBSD: nfs_bootdhcp.c,v 1.39 2008/04/28 20:24:10 martin Exp $	*/
2 
3 /*-
4  * Copyright (c) 1995, 1997 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Adam Glass and Gordon W. Ross.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Support for NFS diskless booting with BOOTP (RFC951, RFC1048)
34  *
35  * History:
36  *
37  * Tor Egge developed the initial version of this code based on
38  * the Sun RPC/bootparam sources nfs_boot.c and krpc_subr.c and
39  * submitted that work to NetBSD as bugreport "kern/2351" on
40  * 29 Apr 1996.
41  *
42  * Gordon Ross reorganized Tor's version into this form and
43  * integrated it into the NetBSD sources during Aug 1997.
44  */
45 
46 #include <sys/cdefs.h>
47 __KERNEL_RCSID(0, "$NetBSD: nfs_bootdhcp.c,v 1.39 2008/04/28 20:24:10 martin Exp $");
48 
49 #include "opt_nfs_boot.h"
50 #include "opt_tftproot.h"
51 
52 #include <sys/param.h>
53 #include <sys/systm.h>
54 #include <sys/kernel.h>
55 #include <sys/device.h>
56 #include <sys/ioctl.h>
57 #include <sys/proc.h>
58 #include <sys/mount.h>
59 #include <sys/mbuf.h>
60 #include <sys/reboot.h>
61 #include <sys/socket.h>
62 #include <sys/socketvar.h>
63 
64 #include <net/if.h>
65 #include <net/if_types.h>
66 #include <net/if_arp.h> 	/* ARPHRD_ETHER, etc. */
67 #include <net/if_dl.h>
68 #include <net/if_ether.h>
69 #include <net/route.h>
70 
71 #include <netinet/in.h>
72 #include <netinet/if_inarp.h>
73 
74 #include <nfs/rpcv2.h>
75 
76 #include <nfs/nfsproto.h>
77 #include <nfs/nfs.h>
78 #include <nfs/nfsmount.h>
79 #include <nfs/nfsdiskless.h>
80 
81 /*
82  * There are two implementations of NFS diskless boot.
83  * This implementation uses BOOTP (RFC951, RFC1048), and
84  * the other uses Sun RPC/bootparams (nfs_bootparam.c).
85  *
86  * This method gets everything it needs with one BOOTP
87  * request and reply.  Note that this actually uses only
88  * the old BOOTP functionality subset of DHCP.  It is not
89  * clear that DHCP provides any advantage over BOOTP for
90  * diskless boot.  DHCP allows the server to assign an IP
91  * address without any a-priori knowledge of the client,
92  * but we require that the server has a-priori knowledge
93  * of the client so it can export our (unique) NFS root.
94  * Given that the server needs a-priori knowledge about
95  * the client anyway, it might as well assign a fixed IP
96  * address for the client and support BOOTP.
97  *
98  * On the other hand, disk-FULL clients may use DHCP, but
99  * in that case the DHCP client should be user-mode code,
100  * and has no bearing on the code below. -gwr
101  */
102 
103 /* Begin stuff from bootp.h */
104 /* Definitions from RFC951 */
105 #define BP_CHADDR_LEN	 16
106 #define BP_SNAME_LEN	 64
107 #define BP_FILE_LEN	128
108 #define BP_VEND_LEN	 64
109 struct bootp {
110 	u_int8_t	bp_op;		/* packet opcode type */
111 	u_int8_t	bp_htype;	/* hardware addr type */
112 	u_int8_t	bp_hlen;	/* hardware addr length */
113 	u_int8_t	bp_hops;	/* gateway hops */
114 	u_int32_t	bp_xid;		/* transaction ID */
115 	u_int16_t	bp_secs;	/* seconds since boot began */
116 	u_int16_t	bp_flags;	/* RFC1532 broadcast, etc. */
117 	struct in_addr	bp_ciaddr;	/* client IP address */
118 	struct in_addr	bp_yiaddr;	/* 'your' IP address */
119 	struct in_addr	bp_siaddr;	/* server IP address */
120 	struct in_addr	bp_giaddr;	/* gateway IP address */
121 	u_int8_t bp_chaddr[BP_CHADDR_LEN]; /* client hardware address */
122 	char	bp_sname[BP_SNAME_LEN]; /* server host name */
123 	char	bp_file[BP_FILE_LEN];	/* boot file name */
124 	u_int8_t bp_vend[BP_VEND_LEN];	/* RFC1048 options */
125 	/*
126 	 * Note that BOOTP packets are allowed to be longer
127 	 * (see RFC 1532 sect. 2.1) and common practice is to
128 	 * allow the option data in bp_vend to extend into the
129 	 * additional space provided in longer packets.
130 	 */
131 };
132 
133 #define IPPORT_BOOTPS 67
134 #define IPPORT_BOOTPC 68
135 
136 #define BOOTREQUEST		1
137 #define BOOTREPLY		2
138 
139 /*
140  * Is this available from the sockaddr_dl somehow?
141  * Perhaps (struct arphdr)->ar_hrd = ARPHRD_ETHER?
142  * The interface has ->if_type but not the ARP fmt.
143  */
144 #define HTYPE_ETHERNET		1
145 #define HTYPE_IEEE802		6
146 
147 /*
148  * Vendor magic cookie (v_magic) for RFC1048
149  */
150 static const u_int8_t vm_rfc1048[4] = { 99, 130, 83, 99 };
151 
152 /*
153  * Tag values used to specify what information is being supplied in
154  * the vendor (options) data area of the packet.
155  */
156 /* RFC 1048 */
157 #define TAG_END			((unsigned char) 255)
158 #define TAG_PAD			((unsigned char)   0)
159 #define TAG_SUBNET_MASK		((unsigned char)   1)
160 #define TAG_TIME_OFFSET		((unsigned char)   2)
161 #define TAG_GATEWAY		((unsigned char)   3)
162 #define TAG_TIME_SERVER		((unsigned char)   4)
163 #define TAG_NAME_SERVER		((unsigned char)   5)
164 #define TAG_DOMAIN_SERVER	((unsigned char)   6)
165 #define TAG_LOG_SERVER		((unsigned char)   7)
166 #define TAG_COOKIE_SERVER	((unsigned char)   8)
167 #define TAG_LPR_SERVER		((unsigned char)   9)
168 #define TAG_IMPRESS_SERVER	((unsigned char)  10)
169 #define TAG_RLP_SERVER		((unsigned char)  11)
170 #define TAG_HOST_NAME		((unsigned char)  12)
171 #define TAG_BOOT_SIZE		((unsigned char)  13)
172 /* RFC 1395 */
173 #define TAG_DUMP_FILE		((unsigned char)  14)
174 #define TAG_DOMAIN_NAME		((unsigned char)  15)
175 #define TAG_SWAP_SERVER		((unsigned char)  16)
176 #define TAG_ROOT_PATH		((unsigned char)  17)
177 /* End of stuff from bootp.h */
178 
179 #ifdef NFS_BOOT_DHCP
180 #define TAG_REQ_ADDR		((unsigned char)  50)
181 #define TAG_LEASETIME		((unsigned char)  51)
182 #define TAG_OVERLOAD		((unsigned char)  52)
183 #define TAG_DHCP_MSGTYPE	((unsigned char)  53)
184 #define TAG_SERVERID		((unsigned char)  54)
185 #define TAG_PARAM_REQ		((unsigned char)  55)
186 #define TAG_MSG			((unsigned char)  56)
187 #define TAG_MAXSIZE		((unsigned char)  57)
188 #define TAG_T1			((unsigned char)  58)
189 #define TAG_T2			((unsigned char)  59)
190 #define TAG_CLASSID		((unsigned char)  60)
191 #define TAG_CLIENTID		((unsigned char)  61)
192 #endif
193 
194 #ifdef NFS_BOOT_DHCP
195 #define DHCPDISCOVER 1
196 #define DHCPOFFER 2
197 #define DHCPREQUEST 3
198 #define DHCPDECLINE 4
199 #define DHCPACK 5
200 #define DHCPNAK 6
201 #define DHCPRELEASE 7
202 #endif
203 
204 #ifdef NFS_BOOT_DHCP
205 #define BOOTP_SIZE_MAX	(sizeof(struct bootp)+312-64)
206 #else
207 /*
208  * The "extended" size is somewhat arbitrary, but is
209  * constrained by the maximum message size specified
210  * by RFC1533 (567 total).  This value increases the
211  * space for options from 64 bytes to 256 bytes.
212  */
213 #define BOOTP_SIZE_MAX	(sizeof(struct bootp)+256-64)
214 #endif
215 #define BOOTP_SIZE_MIN	(sizeof(struct bootp))
216 
217 /* Convenience macro */
218 #define INTOHL(ina) ((u_int32_t)ntohl((ina).s_addr))
219 
220 static int bootpc_call __P((struct nfs_diskless *, struct lwp *));
221 static void bootp_extract __P((struct bootp *, int, struct nfs_diskless *));
222 
223 #ifdef	DEBUG_NFS_BOOT_DHCP
224 #define DPRINTF(s)  printf s
225 #else
226 #define DPRINTF(s)
227 #endif
228 
229 
230 /*
231  * Get our boot parameters using BOOTP.
232  */
233 int
234 nfs_bootdhcp(nd, lwp)
235 	struct nfs_diskless *nd;
236 	struct lwp *lwp;
237 {
238 	struct ifnet *ifp = nd->nd_ifp;
239 	int error;
240 
241 	/*
242 	 * Do enough of ifconfig(8) so that the chosen interface
243 	 * can talk to the servers.  Use address zero for now.
244 	 */
245 	error = nfs_boot_setaddress(ifp, lwp, INADDR_ANY, INADDR_ANY,
246 				    INADDR_BROADCAST);
247 	if (error) {
248 		printf("nfs_boot: set ifaddr zero, error=%d\n", error);
249 		return (error);
250 	}
251 
252 	/* This function call does the real send/recv work. */
253 	error = bootpc_call(nd, lwp);
254 
255 	/* Get rid of the temporary (zero) IP address. */
256 	(void) nfs_boot_deladdress(ifp, lwp, INADDR_ANY);
257 
258 	/* NOW we can test the error from bootpc_call. */
259 	if (error)
260 		goto out;
261 
262 	/*
263 	 * Do ifconfig with our real IP address and mask.
264 	 */
265 	error = nfs_boot_setaddress(ifp, lwp, nd->nd_myip.s_addr,
266 				    nd->nd_mask.s_addr, INADDR_ANY);
267 	if (error) {
268 		printf("nfs_boot: set ifaddr real, error=%d\n", error);
269 		goto out;
270 	}
271 
272 out:
273 	if (error) {
274 		(void) nfs_boot_ifupdown(ifp, lwp, 0);
275 		nfs_boot_flushrt(ifp);
276 	}
277 	return (error);
278 }
279 
280 struct bootpcontext {
281 	int xid;
282 	const u_char *haddr;
283 	u_char halen;
284 	struct bootp *replybuf;
285 	int replylen;
286 #ifdef NFS_BOOT_DHCP
287 	char expected_dhcpmsgtype, dhcp_ok;
288 	struct in_addr dhcp_serverip;
289 #endif
290 };
291 
292 static int bootpset __P((struct mbuf*, void*, int));
293 static int bootpcheck __P((struct mbuf*, void*));
294 
295 static int
296 bootpset(struct mbuf *m, void *context, int waited)
297 {
298 	struct bootp *bootp;
299 
300 	/* we know it's contigous (in 1 mbuf cluster) */
301 	bootp = mtod(m, struct bootp*);
302 
303 	bootp->bp_secs = htons(waited);
304 
305 	return (0);
306 }
307 
308 static int
309 bootpcheck(m, context)
310 	struct mbuf *m;
311 	void *context;
312 {
313 	struct bootp *bootp;
314 	struct bootpcontext *bpc = context;
315 	u_int tag, len;
316 	u_char *p, *limit;
317 
318 	/*
319 	 * Is this a valid reply?
320 	 */
321 	if (m->m_pkthdr.len < BOOTP_SIZE_MIN) {
322 		DPRINTF(("bootpcheck: short packet %d < %d\n", m->m_pkthdr.len,
323 		    BOOTP_SIZE_MIN));
324 		return (-1);
325 	}
326 	if (m->m_pkthdr.len > BOOTP_SIZE_MAX) {
327 		DPRINTF(("bootpcheck: long packet %d > %d\n", m->m_pkthdr.len,
328 		    BOOTP_SIZE_MAX));
329 		return (-1);
330 	}
331 
332 	/*
333 	 * don't make first checks more expensive than necessary
334 	 */
335 	if (m->m_len < offsetof(struct bootp, bp_sname)) {
336 		m = m_pullup(m, offsetof(struct bootp, bp_sname));
337 		if (m == NULL) {
338 			DPRINTF(("bootpcheck: m_pullup failed\n"));
339 			return (-1);
340 		}
341 	}
342 	bootp = mtod(m, struct bootp*);
343 
344 	if (bootp->bp_op != BOOTREPLY) {
345 		DPRINTF(("bootpcheck: op %d is not reply\n", bootp->bp_op));
346 		return (-1);
347 	}
348 	if (bootp->bp_hlen != bpc->halen) {
349 		DPRINTF(("bootpcheck: hlen %d != %d\n", bootp->bp_hlen,
350 		    bpc->halen));
351 		return (-1);
352 	}
353 	if (memcmp(bootp->bp_chaddr, bpc->haddr, bpc->halen)) {
354 #ifdef DEBUG_NFS_BOOT_DHCP
355 		char bp_chaddr[3 * bpc->halen], haddr[3 * bpc->halen];
356 #endif
357 		DPRINTF(("bootpcheck: incorrect hwaddr %s != %s\n",
358 		    ether_snprintf(bp_chaddr, sizeof(bp_chaddr),
359 		    bootp->bp_chaddr),
360 		    ether_snprintf(haddr, sizeof(haddr), bpc->haddr)));
361 		return (-1);
362 	}
363 	if (bootp->bp_xid != bpc->xid) {
364 		DPRINTF(("bootpcheck: xid %d != %d\n", bootp->bp_xid,
365 		    bpc->xid));
366 		return (-1);
367 	}
368 
369 	/*
370 	 * OK, it's worth to look deeper.
371 	 * We copy the mbuf into a flat buffer here because
372 	 * m_pullup() is a bit limited for this purpose
373 	 * (doesn't allocate a cluster if necessary).
374 	 */
375 	bpc->replylen = m->m_pkthdr.len;
376 	m_copydata(m, 0, bpc->replylen, (void *)bpc->replybuf);
377 	bootp = bpc->replybuf;
378 
379 	/*
380 	 * Check if the IP address we get looks correct.
381 	 * (DHCP servers can send junk to unknown clients.)
382 	 * XXX more checks might be needed
383 	 */
384 	if (bootp->bp_yiaddr.s_addr == INADDR_ANY ||
385 	    bootp->bp_yiaddr.s_addr == INADDR_BROADCAST) {
386 		printf("nfs_boot: wrong IP addr %s",
387 		       inet_ntoa(bootp->bp_yiaddr));
388 		goto warn;
389 	}
390 
391 	/*
392 	 * Check the vendor data.
393 	 */
394 	if (memcmp(bootp->bp_vend, vm_rfc1048, 4)) {
395 		printf("nfs_boot: reply missing options");
396 		goto warn;
397 	}
398 	p = &bootp->bp_vend[4];
399 	limit = ((char*)bootp) + bpc->replylen;
400 	while (p < limit) {
401 		tag = *p++;
402 		if (tag == TAG_END)
403 			break;
404 		if (tag == TAG_PAD)
405 			continue;
406 		len = *p++;
407 		if ((p + len) > limit) {
408 			printf("nfs_boot: option %d too long", tag);
409 			goto warn;
410 		}
411 		switch (tag) {
412 #ifdef NFS_BOOT_DHCP
413 		case TAG_DHCP_MSGTYPE:
414 			if (*p != bpc->expected_dhcpmsgtype)
415 				return (-1);
416 			bpc->dhcp_ok = 1;
417 			break;
418 		case TAG_SERVERID:
419 			memcpy(&bpc->dhcp_serverip.s_addr, p,
420 			      sizeof(bpc->dhcp_serverip.s_addr));
421 			break;
422 #endif
423 		default:
424 			break;
425 		}
426 		p += len;
427 	}
428 	return (0);
429 
430 warn:
431 	printf(" (bad reply from %s)\n", inet_ntoa(bootp->bp_siaddr));
432 	return (-1);
433 }
434 
435 static int
436 bootpc_call(nd, lwp)
437 	struct nfs_diskless *nd;
438 	struct lwp *lwp;
439 {
440 	struct socket *so;
441 	struct ifnet *ifp = nd->nd_ifp;
442 	static u_int32_t xid = ~0xFF;
443 	struct bootp *bootp;	/* request */
444 	struct mbuf *m, *nam;
445 	struct sockaddr_in *sin;
446 	int error;
447 	const u_char *haddr;
448 	u_char hafmt, halen;
449 	struct bootpcontext bpc;
450 #ifdef NFS_BOOT_DHCP
451 	char vci[64];
452 	int vcilen;
453 #endif
454 
455 	error = socreate(AF_INET, &so, SOCK_DGRAM, 0, lwp, NULL);
456 	if (error) {
457 		printf("bootp: socreate, error=%d\n", error);
458 		return (error);
459 	}
460 
461 	/*
462 	 * Initialize to NULL anything that will hold an allocation,
463 	 * and free each at the end if not null.
464 	 */
465 	bpc.replybuf = NULL;
466 	m = nam = NULL;
467 
468 	/* Record our H/W (Ethernet) address. */
469 	{	const struct sockaddr_dl *sdl = ifp->if_sadl;
470 		switch (sdl->sdl_type) {
471 		    case IFT_ISO88025:
472 			hafmt = HTYPE_IEEE802;
473 			break;
474 		    case IFT_ETHER:
475 		    case IFT_FDDI:
476 			hafmt = HTYPE_ETHERNET;
477 			break;
478 		    default:
479 			printf("bootp: unsupported interface type %d\n",
480 			       sdl->sdl_type);
481 			error = EINVAL;
482 			goto out;
483 		}
484 		halen = sdl->sdl_alen;
485 		haddr = (const unsigned char *)CLLADDR(sdl);
486 	}
487 
488 	/*
489 	 * Skip the route table when sending on this socket.
490 	 * If this is not done, ip_output finds the loopback
491 	 * interface (why?) and then fails because broadcast
492 	 * is not supported on that interface...
493 	 */
494 	{	int32_t *opt;
495 		m = m_get(M_WAIT, MT_SOOPTS);
496 		opt = mtod(m, int32_t *);
497 		m->m_len = sizeof(*opt);
498 		*opt = 1;
499 		error = sosetopt(so, SOL_SOCKET, SO_DONTROUTE, m);
500 		m = NULL;	/* was consumed */
501 	}
502 	if (error) {
503 		DPRINTF(("bootpc_call: SO_DONTROUTE failed %d\n", error));
504 		goto out;
505 	}
506 
507 	/* Enable broadcast. */
508 	if ((error = nfs_boot_enbroadcast(so))) {
509 		DPRINTF(("bootpc_call: SO_BROADCAST failed %d\n", error));
510 		goto out;
511 	}
512 
513 	/*
514 	 * Set some TTL so we can boot through routers.
515 	 * Real BOOTP forwarding agents don't need this; they obey "bp_hops"
516 	 * and set "bp_giaddr", thus rewrite the packet anyway.
517 	 * The "helper-address" feature of some popular router vendor seems
518 	 * to do simple IP forwarding and drops packets with (ip_ttl == 1).
519 	 */
520 	{	u_char *opt;
521 		m = m_get(M_WAIT, MT_SOOPTS);
522 		opt = mtod(m, u_char *);
523 		m->m_len = sizeof(*opt);
524 		*opt = 7;
525 		error = sosetopt(so, IPPROTO_IP, IP_MULTICAST_TTL, m);
526 		m = NULL;	/* was consumed */
527 	}
528 	if (error) {
529 		DPRINTF(("bootpc_call: IP_MULTICAST_TTL failed %d\n", error));
530 		goto out;
531 	}
532 
533 	/* Set the receive timeout for the socket. */
534 	if ((error = nfs_boot_setrecvtimo(so))) {
535 		DPRINTF(("bootpc_call: SO_RCVTIMEO failed %d\n", error));
536 		goto out;
537 	}
538 
539 	/*
540 	 * Bind the local endpoint to a bootp client port.
541 	 */
542 	if ((error = nfs_boot_sobind_ipport(so, IPPORT_BOOTPC, lwp))) {
543 		DPRINTF(("bootpc_call: bind failed %d\n", error));
544 		goto out;
545 	}
546 
547 	/*
548 	 * Setup socket address for the server.
549 	 */
550 	nam = m_get(M_WAIT, MT_SONAME);
551 	sin = mtod(nam, struct sockaddr_in *);
552 	sin->sin_len = nam->m_len = sizeof(*sin);
553 	sin->sin_family = AF_INET;
554 	sin->sin_addr.s_addr = INADDR_BROADCAST;
555 	sin->sin_port = htons(IPPORT_BOOTPS);
556 
557 	/*
558 	 * Allocate buffer used for request
559 	 */
560 	m = m_gethdr(M_WAIT, MT_DATA);
561 	m_clget(m, M_WAIT);
562 	bootp = mtod(m, struct bootp*);
563 	m->m_pkthdr.len = m->m_len = BOOTP_SIZE_MAX;
564 	m->m_pkthdr.rcvif = NULL;
565 
566 	/*
567 	 * Build the BOOTP reqest message.
568 	 * Note: xid is host order! (opaque to server)
569 	 */
570 	memset((void *)bootp, 0, BOOTP_SIZE_MAX);
571 	bootp->bp_op    = BOOTREQUEST;
572 	bootp->bp_htype = hafmt;
573 	bootp->bp_hlen  = halen;	/* Hardware address length */
574 	bootp->bp_xid = ++xid;
575 	memcpy(bootp->bp_chaddr, haddr, halen);
576 #ifdef NFS_BOOT_BOOTP_REQFILE
577 	strncpy(bootp->bp_file, NFS_BOOT_BOOTP_REQFILE, sizeof(bootp->bp_file));
578 #endif
579 	/* Fill-in the vendor data. */
580 	memcpy(bootp->bp_vend, vm_rfc1048, 4);
581 #ifdef NFS_BOOT_DHCP
582 	bootp->bp_vend[4] = TAG_DHCP_MSGTYPE;
583 	bootp->bp_vend[5] = 1;
584 	bootp->bp_vend[6] = DHCPDISCOVER;
585 	/*
586 	 * Insert a NetBSD Vendor Class Identifier option.
587 	 */
588 	snprintf(vci, sizeof(vci), "%s:%s:kernel:%s", ostype, MACHINE,
589 	    osrelease);
590 	vcilen = strlen(vci);
591 	bootp->bp_vend[7] = TAG_CLASSID;
592 	bootp->bp_vend[8] = vcilen;
593 	memcpy(&bootp->bp_vend[9], vci, vcilen);
594 	bootp->bp_vend[9 + vcilen] = TAG_END;
595 #else
596 	bootp->bp_vend[4] = TAG_END;
597 #endif
598 
599 	bpc.xid = xid;
600 	bpc.haddr = haddr;
601 	bpc.halen = halen;
602 	bpc.replybuf = malloc(BOOTP_SIZE_MAX, M_DEVBUF, M_WAITOK);
603 	if (bpc.replybuf == NULL)
604 		panic("nfs_boot: malloc reply buf");
605 #ifdef NFS_BOOT_DHCP
606 	bpc.expected_dhcpmsgtype = DHCPOFFER;
607 	bpc.dhcp_ok = 0;
608 #endif
609 
610 	error = nfs_boot_sendrecv(so, nam, bootpset, m,
611 				  bootpcheck, 0, 0, &bpc, lwp);
612 	if (error)
613 		goto out;
614 
615 #ifdef NFS_BOOT_DHCP
616 	if (bpc.dhcp_ok) {
617 		u_int32_t leasetime;
618 		bootp->bp_vend[6] = DHCPREQUEST;
619 		bootp->bp_vend[7] = TAG_REQ_ADDR;
620 		bootp->bp_vend[8] = 4;
621 		memcpy(&bootp->bp_vend[9], &bpc.replybuf->bp_yiaddr, 4);
622 		bootp->bp_vend[13] = TAG_SERVERID;
623 		bootp->bp_vend[14] = 4;
624 		memcpy(&bootp->bp_vend[15], &bpc.dhcp_serverip.s_addr, 4);
625 		bootp->bp_vend[19] = TAG_LEASETIME;
626 		bootp->bp_vend[20] = 4;
627 		leasetime = htonl(300);
628 		memcpy(&bootp->bp_vend[21], &leasetime, 4);
629 		bootp->bp_vend[25] = TAG_CLASSID;
630 		bootp->bp_vend[26] = vcilen;
631 		memcpy(&bootp->bp_vend[27], vci, vcilen);
632 		bootp->bp_vend[27 + vcilen] = TAG_END;
633 
634 		bpc.expected_dhcpmsgtype = DHCPACK;
635 
636 		error = nfs_boot_sendrecv(so, nam, bootpset, m,
637 					  bootpcheck, 0, 0, &bpc, lwp);
638 		if (error)
639 			goto out;
640 	}
641 #endif
642 
643 	/*
644 	 * bootpcheck() has copied the receive mbuf into
645 	 * the buffer at bpc.replybuf.
646 	 */
647 #ifdef NFS_BOOT_DHCP
648 	printf("nfs_boot: %s next-server: %s\n",
649 	       (bpc.dhcp_ok ? "DHCP" : "BOOTP"),
650 #else
651 	printf("nfs_boot: BOOTP next-server: %s\n",
652 #endif
653 	       inet_ntoa(bpc.replybuf->bp_siaddr));
654 
655 	bootp_extract(bpc.replybuf, bpc.replylen, nd);
656 
657 out:
658 	if (bpc.replybuf)
659 		free(bpc.replybuf, M_DEVBUF);
660 	if (m)
661 		m_freem(m);
662 	if (nam)
663 		m_freem(nam);
664 	soclose(so);
665 	return (error);
666 }
667 
668 static void
669 bootp_extract(bootp, replylen, nd)
670 	struct bootp *bootp;
671 	int replylen;
672 	struct nfs_diskless *nd;
673 {
674 	struct sockaddr_in *sin;
675 	struct in_addr netmask;
676 	struct in_addr gateway;
677 	struct in_addr rootserver;
678 	char *myname;	/* my hostname */
679 	char *mydomain;	/* my domainname */
680 	char *rootpath;
681 	int mynamelen;
682 	int mydomainlen;
683 	int rootpathlen;
684 	int overloaded;
685 	u_int tag, len;
686 	u_char *p, *limit;
687 
688 	/* Default these to "unspecified". */
689 	netmask.s_addr = 0;
690 	gateway.s_addr = 0;
691 	mydomain    = myname    = rootpath = NULL;
692 	mydomainlen = mynamelen = rootpathlen = 0;
693 
694 	/* default root server to bootp next-server */
695 	rootserver = bootp->bp_siaddr;
696 	/* assume that server name field is not overloaded by default */
697 	overloaded = 0;
698 
699 	p = &bootp->bp_vend[4];
700 	limit = ((char*)bootp) + replylen;
701 	while (p < limit) {
702 		tag = *p++;
703 		if (tag == TAG_END)
704 			break;
705 		if (tag == TAG_PAD)
706 			continue;
707 		len = *p++;
708 #if 0 /* already done in bootpcheck() */
709 		if ((p + len) > limit) {
710 			printf("nfs_boot: option %d too long\n", tag);
711 			break;
712 		}
713 #endif
714 		switch (tag) {
715 		    case TAG_SUBNET_MASK:
716 			memcpy(&netmask, p, 4);
717 			break;
718 		    case TAG_GATEWAY:
719 			/* Routers */
720 			memcpy(&gateway, p, 4);
721 			break;
722 		    case TAG_HOST_NAME:
723 			if (len >= sizeof(hostname)) {
724 				printf("nfs_boot: host name >= %lu bytes",
725 				       (u_long)sizeof(hostname));
726 				break;
727 			}
728 			myname = p;
729 			mynamelen = len;
730 			break;
731 		    case TAG_DOMAIN_NAME:
732 			if (len >= sizeof(domainname)) {
733 				printf("nfs_boot: domain name >= %lu bytes",
734 				       (u_long)sizeof(domainname));
735 				break;
736 			}
737 			mydomain = p;
738 			mydomainlen = len;
739 			break;
740 		    case TAG_ROOT_PATH:
741 			/* Leave some room for the server name. */
742 			if (len >= (MNAMELEN-10)) {
743 				printf("nfs_boot: rootpath >=%d bytes",
744 				       (MNAMELEN-10));
745 				break;
746 			}
747 			rootpath = p;
748 			rootpathlen = len;
749 			break;
750 		    case TAG_SWAP_SERVER:
751 			/* override NFS server address */
752 			memcpy(&rootserver, p, 4);
753 			break;
754 #ifdef NFS_BOOT_DHCP
755 		    case TAG_OVERLOAD:
756 			if (len > 0 && ((*p & 0x02) != 0))
757 				/*
758 				 * The server name field in the dhcp packet
759 				 * is overloaded and we can't find server
760 				 * name there.
761 				 */
762 				overloaded = 1;
763 			break;
764 #endif
765 		    default:
766 			break;
767 		}
768 		p += len;
769 	}
770 
771 	/*
772 	 * Store and print network config info.
773 	 */
774 	if (myname) {
775 		myname[mynamelen] = '\0';
776 		strncpy(hostname, myname, sizeof(hostname));
777 		hostnamelen = mynamelen;
778 		printf("nfs_boot: my_name=%s\n", hostname);
779 	}
780 	if (mydomain) {
781 		mydomain[mydomainlen] = '\0';
782 		strncpy(domainname, mydomain, sizeof(domainname));
783 		domainnamelen = mydomainlen;
784 		printf("nfs_boot: my_domain=%s\n", domainname);
785 	}
786 	nd->nd_myip = bootp->bp_yiaddr;
787 	if (nd->nd_myip.s_addr)
788 		printf("nfs_boot: my_addr=%s\n", inet_ntoa(nd->nd_myip));
789 	nd->nd_mask = netmask;
790 	if (nd->nd_mask.s_addr)
791 		printf("nfs_boot: my_mask=%s\n", inet_ntoa(nd->nd_mask));
792 	nd->nd_gwip = gateway;
793 	if (nd->nd_gwip.s_addr)
794 		printf("nfs_boot: gateway=%s\n", inet_ntoa(nd->nd_gwip));
795 
796 	/*
797 	 * Store the information about our NFS root mount.
798 	 * The caller will print it, so be silent here.
799 	 */
800 	{
801 		struct nfs_dlmount *ndm = &nd->nd_root;
802 
803 		/* Server IP address. */
804 		sin = (struct sockaddr_in *) &ndm->ndm_saddr;
805 		memset((void *)sin, 0, sizeof(*sin));
806 		sin->sin_len = sizeof(*sin);
807 		sin->sin_family = AF_INET;
808 		sin->sin_addr = rootserver;
809 		/* Server name. */
810 		if (!overloaded && bootp->bp_sname[0] != 0 &&
811 		    !memcmp(&rootserver, &bootp->bp_siaddr,
812 			  sizeof(struct in_addr))) {
813 			/* standard root server, we have the name */
814 			strncpy(ndm->ndm_host, bootp->bp_sname, BP_SNAME_LEN-1);
815 		} else {
816 			/* Show the server IP address numerically. */
817 			strncpy(ndm->ndm_host, inet_ntoa(rootserver),
818 				BP_SNAME_LEN-1);
819 		}
820 		len = strlen(ndm->ndm_host);
821 		if (rootpath &&
822 		    len + 1 + rootpathlen + 1 <= sizeof(ndm->ndm_host)) {
823 			ndm->ndm_host[len++] = ':';
824 			strncpy(ndm->ndm_host + len,
825 				rootpath, rootpathlen);
826 			ndm->ndm_host[len + rootpathlen] = '\0';
827 		} /* else: upper layer will handle error */
828 	}
829 
830 #ifdef TFTPROOT
831 #if BP_FILE_LEN > MNAMELEN
832 #define BOOTFILELEN MNAMELEN
833 #else
834 #define BOOTFILELEN BP_FILE_LEN
835 #endif
836 	strncpy(nd->nd_bootfile, bootp->bp_file, BOOTFILELEN);
837 	nd->nd_bootfile[BOOTFILELEN - 1] = '\0';
838 #undef BOOTFILELEN
839 #endif /* TFTPROOT */
840 }
841