summaryrefslogtreecommitdiffstats
path: root/mdk-stage1/dhcp.c
blob: 53ff9261721ca091f1d4ebd15c576dc6be5c9de0 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
/*
 * Guillaume Cottenceau (gc@mandrakesoft.com)
 *
 * Copyright 2000 MandrakeSoft
 *
 * This software may be freely redistributed under the terms of the GNU
 * public license.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
 */

/*
 * Portions from Erik Troan (ewt@redhat.com)
 *
 * Copyright 1996 Red Hat Software 
 *
 */

/*
 * Portions from GRUB  --  GRand Unified Bootloader
 * Copyright (C) 2000  Free Software Foundation, Inc.
 */


#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <arpa/inet.h>
#include <net/route.h>
#include <errno.h>
#include <net/ethernet.h>
#include <netinet/ip.h>
#include <netinet/udp.h>
#include <sys/time.h>
#include <time.h>
#include <fcntl.h>

#include "stage1.h"
#include "log.h"
#include "network.h"
#include "frontend.h"

#include "dhcp.h"


typedef int bp_int32;
typedef short bp_int16;

#define BOOTP_OPTION_NETMASK		1
#define BOOTP_OPTION_GATEWAY		3
#define BOOTP_OPTION_DNS		6
#define BOOTP_OPTION_HOSTNAME		12
#define BOOTP_OPTION_DOMAIN		15
#define BOOTP_OPTION_BROADCAST		28

#define DHCP_OPTION_REQADDR		50
#define DHCP_OPTION_LEASE		51
#define DHCP_OPTION_TYPE		53
#define DHCP_OPTION_SERVER		54
#define DHCP_OPTION_OPTIONREQ		55
#define DHCP_OPTION_MAXSIZE		57

#define BOOTP_CLIENT_PORT	68
#define BOOTP_SERVER_PORT	67

#define BOOTP_OPCODE_REQUEST	1
#define BOOTP_OPCODE_REPLY	2

#define DHCP_TYPE_DISCOVER	1
#define DHCP_TYPE_OFFER		2
#define DHCP_TYPE_REQUEST	3
#define DHCP_TYPE_ACK		5
#define DHCP_TYPE_RELEASE	7

#define BOOTP_VENDOR_LENGTH	64
#define DHCP_VENDOR_LENGTH	340

struct bootp_request {
	char opcode;
	char hw;
	char hwlength;
	char hopcount;
	bp_int32 id;
	bp_int16 secs;
	bp_int16 flags;
	bp_int32 ciaddr, yiaddr, server_ip, bootp_gw_ip;
	char hwaddr[16];
	char servername[64];
	char bootfile[128];
	char vendor[DHCP_VENDOR_LENGTH];
} ;

static const char vendor_cookie[] = { 99, 130, 83, 99, 255 };


static unsigned int verify_checksum(void * buf2, int length2)
{
	unsigned int csum = 0;
	unsigned short * sp;

	for (sp = (unsigned short *) buf2; length2 > 0; (length2 -= 2), sp++)
		csum += *sp;
	
	while (csum >> 16)
		csum = (csum & 0xffff) + (csum >> 16);

	return (csum == 0xffff);
}


static int initial_setup_interface(char * device, int s) {
	struct sockaddr_in * addrp;
	struct ifreq req;
	struct rtentry route;
	int true = 1;
	
	addrp = (struct sockaddr_in *) &req.ifr_addr;
	
	strcpy(req.ifr_name, device);
	addrp->sin_family = AF_INET;
	addrp->sin_port = 0;
	memset(&addrp->sin_addr, 0, sizeof(addrp->sin_addr));
	
	req.ifr_flags = 0; /* take it down */
	if (ioctl(s, SIOCSIFFLAGS, &req)) {
		log_perror("SIOCSIFFLAGS (downing)");
		return -1;
	}
    
	addrp->sin_family = AF_INET;
	addrp->sin_addr.s_addr = htonl(0);
	if (ioctl(s, SIOCSIFADDR, &req)) {
		log_perror("SIOCSIFADDR");
		return -1;
	}

	req.ifr_flags = IFF_UP | IFF_BROADCAST | IFF_RUNNING;
	if (ioctl(s, SIOCSIFFLAGS, &req)) {
		log_perror("SIOCSIFFLAGS (upping)");
		return -1;
	}

	memset(&route, 0, sizeof(route));
	memcpy(&route.rt_gateway, addrp, sizeof(*addrp));
	
	addrp->sin_family = AF_INET;
	addrp->sin_port = 0;
	addrp->sin_addr.s_addr = INADDR_ANY;
	memcpy(&route.rt_dst, addrp, sizeof(*addrp));
	memcpy(&route.rt_genmask, addrp, sizeof(*addrp));
	
	route.rt_dev = device;
	route.rt_flags = RTF_UP;
	route.rt_metric = 0;
	
	if (ioctl(s, SIOCADDRT, &route)) {
		if (errno != EEXIST) {
			close(s);
			log_perror("SIOCADDRT");
			return -1;
		}
	}
	
	if (setsockopt(s, SOL_SOCKET, SO_BROADCAST, &true, sizeof(true))) {
		close(s);
		log_perror("setsockopt");
		return -1;
	}

	return 0;
}


void set_missing_ip_info(struct interface_info * intf)
{
	bp_int32 ipNum = *((bp_int32 *) &intf->ip);
	bp_int32 nmNum;

	if (intf->netmask.s_addr == 0)
		inet_aton(guess_netmask(inet_ntoa(intf->ip)), &intf->netmask);

	nmNum = *((bp_int32 *) &intf->netmask);

	if (intf->broadcast.s_addr == 0)
		*((bp_int32 *) &intf->broadcast) = (ipNum & nmNum) | ~(nmNum);

	if (intf->network.s_addr == 0)
		*((bp_int32 *) &intf->network) = ipNum & nmNum;
}

static void parse_reply(struct bootp_request * breq, struct interface_info * intf)
{
	unsigned char * chptr;
	unsigned char option, length;

	memcpy(&intf->ip, &breq->yiaddr, 4);

	chptr = breq->vendor;
	chptr += 4;
	while (*chptr != 0xFF && (void *) chptr < (void *) breq->vendor + DHCP_VENDOR_LENGTH) {
		char tmp_str[500];
		option = *chptr++;
		if (!option)
			continue;
		length = *chptr++;

		switch (option) {
		case BOOTP_OPTION_DNS:
			memcpy(&dns_server, chptr, sizeof(dns_server));
			if (length >= sizeof(dns_server)*2)
				memcpy(&dns_server2, chptr+sizeof(dns_server), sizeof(dns_server2));
			break;

		case BOOTP_OPTION_NETMASK:
			memcpy(&intf->netmask, chptr, 4);
			break;
		    
		case BOOTP_OPTION_DOMAIN:
			memcpy(tmp_str, chptr, length);
			tmp_str[length] = '\0';
			domain = strdup(tmp_str);
			break;

		case BOOTP_OPTION_BROADCAST:
			memcpy(&intf->broadcast, chptr, 4);
			break;

		case BOOTP_OPTION_GATEWAY:
			memcpy(&gateway, chptr, 4);
			break;

		case BOOTP_OPTION_HOSTNAME:
			memcpy(tmp_str, chptr, length);
			tmp_str[length] = '\0';
			hostname = strdup(tmp_str);
			log_message("DHCP: got hostname %s", hostname);
			break;

		}

		chptr += length;
	}

	set_missing_ip_info(intf);
}


static void init_vendor_codes(struct bootp_request * breq) {
	memcpy(breq->vendor, vendor_cookie, sizeof(vendor_cookie));
}

static char gen_hwaddr[16];

static int prepare_request(struct bootp_request * breq, int sock, char * device)
{
	struct ifreq req;
	
	memset(breq, 0, sizeof(*breq));
	
	breq->opcode = BOOTP_OPCODE_REQUEST;
	
	strcpy(req.ifr_name, device);
	if (ioctl(sock, SIOCGIFHWADDR, &req)) {
		log_perror("SIOCSIFHWADDR");
		return -1;
	}
	
	breq->hw = 1; 		/* ethernet */
	breq->hwlength = IFHWADDRLEN;	
	memcpy(breq->hwaddr, req.ifr_hwaddr.sa_data, IFHWADDRLEN);
	memcpy(gen_hwaddr, req.ifr_hwaddr.sa_data, IFHWADDRLEN);
	
	breq->hopcount = 0;
	
	init_vendor_codes(breq);
	
	return 0;
}

static int get_vendor_code(struct bootp_request * bresp, unsigned char option, void * data)
{
	unsigned char * chptr;
	unsigned int length, theOption;
	
	chptr = bresp->vendor + 4;
	while (*chptr != 0xFF && *chptr != option) {
		theOption = *chptr++;
		if (!theOption)
			continue;
		length = *chptr++;
		chptr += length;
	}
	
	if (*chptr++ == 0xff)
		return 1;
	
	length = *chptr++;
	memcpy(data, chptr, length);
	
	return 0;
}


static int currticks(void)
{
	struct timeval tv;
	long csecs;
	int ticks_per_csec, ticks_per_usec;
	
	/* Note: 18.2 ticks/sec.  */
	
	gettimeofday (&tv, 0);
	csecs = tv.tv_sec / 10;
	ticks_per_csec = csecs * 182;
	ticks_per_usec = (((tv.tv_sec - csecs * 10) * 1000000 + tv.tv_usec) * 182 / 10000000);
	return ticks_per_csec + ticks_per_usec;
}


#define BACKOFF_LIMIT 7
#define	TICKS_PER_SEC 18
#define MAX_ARP_RETRIES	4

static void rfc951_sleep(int exp)
{
	static long seed = 0;
	long q;
	unsigned long tmo;
	
	if (exp > BACKOFF_LIMIT)
		exp = BACKOFF_LIMIT;
	
	if (!seed)
		/* Initialize linear congruential generator.  */
		seed = (currticks () + *(long *) &gen_hwaddr + ((short *) gen_hwaddr)[2]);
  
	/* Simplified version of the LCG given in Bruce Scheier's
	   "Applied Cryptography".  */
	q = seed / 53668;
	if ((seed = 40014 * (seed - 53668 * q) - 12211 * q) < 0)
		seed += 2147483563l;
	
	/* Compute mask.  */
	for (tmo = 63; tmo <= 60 * TICKS_PER_SEC && --exp > 0; tmo = 2 * tmo + 1)
		;
  
	/* Sleep.  */
	log_message("<sleep>");
	
	for (tmo = (tmo & seed) + currticks (); currticks () < tmo;);
}


static int handle_transaction(int s, struct bootp_request * breq, struct bootp_request * bresp,
			      struct sockaddr_in * server_addr, int dhcp_type)
{
	struct timeval tv;
	fd_set readfs;
	int i, j;
	int retry = 1;
	int sin;
	char eth_packet[ETH_FRAME_LEN];
	struct iphdr * ip_hdr;
	struct udphdr * udp_hdr;
	unsigned char type;
	unsigned long starttime;
	int timeout = 1;

	breq->id = starttime = currticks();
	breq->secs = 0;

	sin = socket(AF_PACKET, SOCK_DGRAM, ntohs(ETH_P_IP));
	if (sin < 0) {
		log_perror("af_packet socket");
		return -1;
	}

	while (retry <= MAX_ARP_RETRIES) {
		i = sizeof(*breq);

		if (sendto(s, breq, i, 0, (struct sockaddr *) server_addr, sizeof(*server_addr)) != i) {
			close(s);
			log_perror("sendto");
			return -1;
		}
		
		FD_ZERO(&readfs);
		FD_SET(sin, &readfs);
		tv.tv_usec = 0;
		tv.tv_sec = timeout;

		while (select(sin + 1, &readfs, NULL, NULL, &tv) == 1) {

			if ((j = recv(sin, eth_packet, sizeof(eth_packet), 0)) == -1) {
				log_perror("recv");
				continue;
			}
			
			/* We need to do some basic sanity checking of the header */
			if (j < (sizeof(*ip_hdr) + sizeof(*udp_hdr)))
				continue;
			
			ip_hdr = (void *) eth_packet;
			if (!verify_checksum(ip_hdr, sizeof(*ip_hdr)))
				continue;

			if (ntohs(ip_hdr->tot_len) > j)
				continue;

			j = ntohs(ip_hdr->tot_len);
			
			if (ip_hdr->protocol != IPPROTO_UDP)
				continue;
			
			udp_hdr = (void *) (eth_packet + sizeof(*ip_hdr));

			if (ntohs(udp_hdr->source) != BOOTP_SERVER_PORT)
				continue;
			
			if (ntohs(udp_hdr->dest) != BOOTP_CLIENT_PORT)
				continue;
			/* Go on with this packet; it looks sane */
			
			/* Originally copied sizeof (*bresp) - this is a security
			   problem due to a potential underflow of the source
			   buffer.  Also, it trusted that the packet was properly
			   0xFF terminated, which is not true in the case of the
			   DHCP server on Cisco 800 series ISDN router. */
			
			memset (bresp, 0xFF, sizeof (*bresp));
			memcpy (bresp, (char *) udp_hdr + sizeof (*udp_hdr), j - sizeof (*ip_hdr) - sizeof (*udp_hdr));
			
			/* sanity checks */
			if (bresp->id != breq->id)
				continue;
			if (bresp->opcode != BOOTP_OPCODE_REPLY)
				continue;
			if (bresp->hwlength != breq->hwlength)
				continue;
			if (memcmp(bresp->hwaddr, breq->hwaddr, bresp->hwlength))
				continue;
			if (get_vendor_code(bresp, DHCP_OPTION_TYPE, &type) || type != dhcp_type)
				continue;
			if (memcmp(bresp->vendor, vendor_cookie, 4))
				continue;
			return 0;
		}
		rfc951_sleep(retry);
		breq->secs = htons ((currticks () - starttime) / 20);
		retry++;
		timeout *= 2;
		if (timeout > 5)
			timeout = 5;
	}
	
	error_message("No DHCP reply received.");
	return -1;
}

static void add_vendor_code(struct bootp_request * breq, unsigned char option, unsigned char length, void * data)
{
	unsigned char * chptr;
	int theOption, theLength;

	chptr = breq->vendor;
	chptr += 4;
	while (*chptr != 0xFF && *chptr != option) {
		theOption = *chptr++;
		if (!theOption) continue;
		theLength = *chptr++;
		chptr += theLength;
	}

	*chptr++ = option;
	*chptr++ = length;
	memcpy(chptr, data, length);
	chptr[length] = 0xff;
}



enum return_type perform_dhcp(struct interface_info * intf)
{
	int s, i;
	struct sockaddr_in server_addr;
	struct sockaddr_in client_addr;
	struct sockaddr_in broadcast_addr;
	struct bootp_request breq, bresp;
	unsigned char messageType;
	unsigned int lease;
	short aShort;
	int num_options;
	char requested_options[50];

	if (strncmp(intf->device, "eth", 3)) {
		error_message("DHCP available only for Ethernet networking.");
		return RETURN_ERROR;
	}

	s = socket(AF_INET, SOCK_DGRAM, 0);
	if (s < 0) {
		log_perror("socket");
		return RETURN_ERROR;
	}

	if (initial_setup_interface(intf->device, s) != 0) {
		close(s);
		return RETURN_ERROR;
	}

	if (prepare_request(&breq, s, intf->device) != 0) {
		close(s);
		return RETURN_ERROR;
	}

	messageType = DHCP_TYPE_DISCOVER;
	add_vendor_code(&breq, DHCP_OPTION_TYPE, 1, &messageType);

	memset(&client_addr.sin_addr, 0, sizeof(&client_addr.sin_addr));
	client_addr.sin_family = AF_INET;
	client_addr.sin_port = htons(BOOTP_CLIENT_PORT);	/* bootp client */

	if (bind(s, (struct sockaddr *) &client_addr, sizeof(client_addr))) {
		log_perror("bind");
		return RETURN_ERROR;
	}

	broadcast_addr.sin_family = AF_INET;
	broadcast_addr.sin_port = htons(BOOTP_SERVER_PORT);	/* bootp server */
	memset(&broadcast_addr.sin_addr, 0xff, sizeof(broadcast_addr.sin_addr));  /* broadcast */

	log_message("DHCP: sending DISCOVER");

	wait_message("Sending DHCP request...");
	i = handle_transaction(s, &breq, &bresp, &broadcast_addr, DHCP_TYPE_OFFER);
	remove_wait_message();

	if (i != 0) {
		close(s);
		return RETURN_ERROR;
	}

	server_addr.sin_family = AF_INET;
	server_addr.sin_port = htons(BOOTP_SERVER_PORT);	/* bootp server */
	if (get_vendor_code(&bresp, DHCP_OPTION_SERVER, &server_addr.sin_addr)) {
		close(s);
		log_message("DHCPOFFER didn't include server address");
		return RETURN_ERROR;
	}

	init_vendor_codes(&breq);
	messageType = DHCP_TYPE_REQUEST;
	add_vendor_code(&breq, DHCP_OPTION_TYPE, 1, &messageType);
	add_vendor_code(&breq, DHCP_OPTION_SERVER, 4, &server_addr.sin_addr);
	add_vendor_code(&breq, DHCP_OPTION_REQADDR, 4, &bresp.yiaddr);

	aShort = ntohs(sizeof(struct bootp_request));
	add_vendor_code(&breq, DHCP_OPTION_MAXSIZE, 2, &aShort);

	num_options = 0;
	requested_options[num_options++] = BOOTP_OPTION_NETMASK;
	requested_options[num_options++] = BOOTP_OPTION_GATEWAY;
	requested_options[num_options++] = BOOTP_OPTION_DNS;
	requested_options[num_options++] = BOOTP_OPTION_DOMAIN;
	requested_options[num_options++] = BOOTP_OPTION_BROADCAST;
	add_vendor_code(&breq, DHCP_OPTION_OPTIONREQ, num_options, requested_options);

	/* request a lease of 1 hour */
	i = htonl(60 * 60);
	add_vendor_code(&breq, DHCP_OPTION_LEASE, 4, &i);

	log_message("DHCP: sending REQUEST");

	i = handle_transaction(s, &breq, &bresp, &broadcast_addr, DHCP_TYPE_ACK);

	if (i != 0) {
		close(s);
		return RETURN_ERROR;
	}

	if (get_vendor_code(&bresp, DHCP_OPTION_LEASE, &lease)) {
		log_message("failed to get lease time\n");
		return RETURN_ERROR;
	}
	lease = ntohl(lease);

	close(s);

	intf->netmask.s_addr = 0;
	intf->broadcast.s_addr = 0;
	intf->network.s_addr = 0;

	parse_reply(&bresp, intf);

	return RETURN_OK;
}