Home | History | Annotate | Line # | Download | only in nfs
nfs_bootdhcp.c revision 1.19
      1 /*	$NetBSD: nfs_bootdhcp.c,v 1.19 2002/03/20 23:07:37 thorpej Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 1995, 1997 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Adam Glass and Gordon W. Ross.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  * 3. All advertising materials mentioning features or use of this software
     19  *    must display the following acknowledgement:
     20  *	This product includes software developed by the NetBSD
     21  *	Foundation, Inc. and its contributors.
     22  * 4. Neither the name of The NetBSD Foundation nor the names of its
     23  *    contributors may be used to endorse or promote products derived
     24  *    from this software without specific prior written permission.
     25  *
     26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     36  * POSSIBILITY OF SUCH DAMAGE.
     37  */
     38 
     39 /*
     40  * Support for NFS diskless booting with BOOTP (RFC951, RFC1048)
     41  *
     42  * History:
     43  *
     44  * Tor Egge developed the initial version of this code based on
     45  * the Sun RPC/bootparam sources nfs_boot.c and krpc_subr.c and
     46  * submitted that work to NetBSD as bugreport "kern/2351" on
     47  * 29 Apr 1996.
     48  *
     49  * Gordon Ross reorganized Tor's version into this form and
     50  * integrated it into the NetBSD sources during Aug 1997.
     51  */
     52 
     53 #include <sys/cdefs.h>
     54 __KERNEL_RCSID(0, "$NetBSD: nfs_bootdhcp.c,v 1.19 2002/03/20 23:07:37 thorpej Exp $");
     55 
     56 #include "opt_nfs_boot.h"
     57 
     58 #include <sys/param.h>
     59 #include <sys/systm.h>
     60 #include <sys/kernel.h>
     61 #include <sys/device.h>
     62 #include <sys/ioctl.h>
     63 #include <sys/proc.h>
     64 #include <sys/mount.h>
     65 #include <sys/mbuf.h>
     66 #include <sys/reboot.h>
     67 #include <sys/socket.h>
     68 #include <sys/socketvar.h>
     69 
     70 #include <net/if.h>
     71 #include <net/if_types.h>
     72 #include <net/if_arp.h> 	/* ARPHRD_ETHER, etc. */
     73 #include <net/if_dl.h>
     74 #include <net/if_ether.h>
     75 #include <net/route.h>
     76 
     77 #include <netinet/in.h>
     78 #include <netinet/if_inarp.h>
     79 
     80 #include <nfs/rpcv2.h>
     81 
     82 #include <nfs/nfsproto.h>
     83 #include <nfs/nfs.h>
     84 #include <nfs/nfsmount.h>
     85 #include <nfs/nfsdiskless.h>
     86 
     87 /*
     88  * There are two implementations of NFS diskless boot.
     89  * This implementation uses BOOTP (RFC951, RFC1048), and
     90  * the other uses Sun RPC/bootparams (nfs_bootparam.c).
     91  *
     92  * This method gets everything it needs with one BOOTP
     93  * request and reply.  Note that this actually uses only
     94  * the old BOOTP functionality subset of DHCP.  It is not
     95  * clear that DHCP provides any advantage over BOOTP for
     96  * diskless boot.  DHCP allows the server to assign an IP
     97  * address without any a-priori knowledge of the client,
     98  * but we require that the server has a-priori knowledge
     99  * of the client so it can export our (unique) NFS root.
    100  * Given that the server needs a-priori knowledge about
    101  * the client anyway, it might as well assign a fixed IP
    102  * address for the client and support BOOTP.
    103  *
    104  * On the other hand, disk-FULL clients may use DHCP, but
    105  * in that case the DHCP client should be user-mode code,
    106  * and has no bearing on the code below. -gwr
    107  */
    108 
    109 /* Begin stuff from bootp.h */
    110 /* Definitions from RFC951 */
    111 #define BP_CHADDR_LEN	 16
    112 #define BP_SNAME_LEN	 64
    113 #define BP_FILE_LEN	128
    114 #define BP_VEND_LEN	 64
    115 struct bootp {
    116 	u_int8_t	bp_op;		/* packet opcode type */
    117 	u_int8_t	bp_htype;	/* hardware addr type */
    118 	u_int8_t	bp_hlen;	/* hardware addr length */
    119 	u_int8_t	bp_hops;	/* gateway hops */
    120 	u_int32_t	bp_xid;		/* transaction ID */
    121 	u_int16_t	bp_secs;	/* seconds since boot began */
    122 	u_int16_t	bp_flags;	/* RFC1532 broadcast, etc. */
    123 	struct in_addr	bp_ciaddr;	/* client IP address */
    124 	struct in_addr	bp_yiaddr;	/* 'your' IP address */
    125 	struct in_addr	bp_siaddr;	/* server IP address */
    126 	struct in_addr	bp_giaddr;	/* gateway IP address */
    127 	u_int8_t bp_chaddr[BP_CHADDR_LEN]; /* client hardware address */
    128 	char	bp_sname[BP_SNAME_LEN]; /* server host name */
    129 	char	bp_file[BP_FILE_LEN];	/* boot file name */
    130 	u_int8_t bp_vend[BP_VEND_LEN];	/* RFC1048 options */
    131 	/*
    132 	 * Note that BOOTP packets are allowed to be longer
    133 	 * (see RFC 1532 sect. 2.1) and common practice is to
    134 	 * allow the option data in bp_vend to extend into the
    135 	 * additional space provided in longer packets.
    136 	 */
    137 };
    138 
    139 #define IPPORT_BOOTPS 67
    140 #define IPPORT_BOOTPC 68
    141 
    142 #define BOOTREQUEST		1
    143 #define BOOTREPLY		2
    144 
    145 /*
    146  * Is this available from the sockaddr_dl somehow?
    147  * Perhaps (struct arphdr)->ar_hrd = ARPHRD_ETHER?
    148  * The interface has ->if_type but not the ARP fmt.
    149  */
    150 #define HTYPE_ETHERNET		1
    151 #define HTYPE_IEEE802		6
    152 
    153 /*
    154  * Vendor magic cookie (v_magic) for RFC1048
    155  */
    156 static const u_int8_t vm_rfc1048[4] = { 99, 130, 83, 99 };
    157 
    158 /*
    159  * Tag values used to specify what information is being supplied in
    160  * the vendor (options) data area of the packet.
    161  */
    162 /* RFC 1048 */
    163 #define TAG_END			((unsigned char) 255)
    164 #define TAG_PAD			((unsigned char)   0)
    165 #define TAG_SUBNET_MASK		((unsigned char)   1)
    166 #define TAG_TIME_OFFSET		((unsigned char)   2)
    167 #define TAG_GATEWAY		((unsigned char)   3)
    168 #define TAG_TIME_SERVER		((unsigned char)   4)
    169 #define TAG_NAME_SERVER		((unsigned char)   5)
    170 #define TAG_DOMAIN_SERVER	((unsigned char)   6)
    171 #define TAG_LOG_SERVER		((unsigned char)   7)
    172 #define TAG_COOKIE_SERVER	((unsigned char)   8)
    173 #define TAG_LPR_SERVER		((unsigned char)   9)
    174 #define TAG_IMPRESS_SERVER	((unsigned char)  10)
    175 #define TAG_RLP_SERVER		((unsigned char)  11)
    176 #define TAG_HOST_NAME		((unsigned char)  12)
    177 #define TAG_BOOT_SIZE		((unsigned char)  13)
    178 /* RFC 1395 */
    179 #define TAG_DUMP_FILE		((unsigned char)  14)
    180 #define TAG_DOMAIN_NAME		((unsigned char)  15)
    181 #define TAG_SWAP_SERVER		((unsigned char)  16)
    182 #define TAG_ROOT_PATH		((unsigned char)  17)
    183 /* End of stuff from bootp.h */
    184 
    185 #ifdef NFS_BOOT_DHCP
    186 #define TAG_REQ_ADDR		((unsigned char)  50)
    187 #define TAG_LEASETIME		((unsigned char)  51)
    188 #define TAG_OVERLOAD		((unsigned char)  52)
    189 #define TAG_DHCP_MSGTYPE	((unsigned char)  53)
    190 #define TAG_SERVERID		((unsigned char)  54)
    191 #define TAG_PARAM_REQ		((unsigned char)  55)
    192 #define TAG_MSG			((unsigned char)  56)
    193 #define TAG_MAXSIZE		((unsigned char)  57)
    194 #define TAG_T1			((unsigned char)  58)
    195 #define TAG_T2			((unsigned char)  59)
    196 #define TAG_CLASSID		((unsigned char)  60)
    197 #define TAG_CLIENTID		((unsigned char)  61)
    198 #endif
    199 
    200 #ifdef NFS_BOOT_DHCP
    201 #define DHCPDISCOVER 1
    202 #define DHCPOFFER 2
    203 #define DHCPREQUEST 3
    204 #define DHCPDECLINE 4
    205 #define DHCPACK 5
    206 #define DHCPNAK 6
    207 #define DHCPRELEASE 7
    208 #endif
    209 
    210 #ifdef NFS_BOOT_DHCP
    211 #define BOOTP_SIZE_MAX	(sizeof(struct bootp)+312-64)
    212 #else
    213 /*
    214  * The "extended" size is somewhat arbitrary, but is
    215  * constrained by the maximum message size specified
    216  * by RFC1533 (567 total).  This value increases the
    217  * space for options from 64 bytes to 256 bytes.
    218  */
    219 #define BOOTP_SIZE_MAX	(sizeof(struct bootp)+256-64)
    220 #endif
    221 #define BOOTP_SIZE_MIN	(sizeof(struct bootp))
    222 
    223 /* Convenience macro */
    224 #define INTOHL(ina) ((u_int32_t)ntohl((ina).s_addr))
    225 
    226 static int bootpc_call __P((struct nfs_diskless *, struct proc *));
    227 static void bootp_extract __P((struct bootp *, int, struct nfs_diskless *));
    228 
    229 /* #define DEBUG	XXX */
    230 
    231 #ifdef	DEBUG
    232 #define DPRINT(s) printf("nfs_boot: %s\n", s)
    233 #else
    234 #define DPRINT(s) (void)0
    235 #endif
    236 
    237 
    238 /*
    239  * Get our boot parameters using BOOTP.
    240  */
    241 int
    242 nfs_bootdhcp(nd, procp)
    243 	struct nfs_diskless *nd;
    244 	struct proc *procp;
    245 {
    246 	struct ifnet *ifp = nd->nd_ifp;
    247 	int error;
    248 
    249 	/*
    250 	 * Do enough of ifconfig(8) so that the chosen interface
    251 	 * can talk to the servers.  Use address zero for now.
    252 	 */
    253 	error = nfs_boot_setaddress(ifp, procp, INADDR_ANY, INADDR_ANY,
    254 				    INADDR_BROADCAST);
    255 	if (error) {
    256 		printf("nfs_boot: set ifaddr zero, error=%d\n", error);
    257 		return (error);
    258 	}
    259 
    260 	/* This function call does the real send/recv work. */
    261 	error = bootpc_call(nd, procp);
    262 
    263 	/* Get rid of the temporary (zero) IP address. */
    264 	(void) nfs_boot_deladdress(ifp, procp, INADDR_ANY);
    265 
    266 	/* NOW we can test the error from bootpc_call. */
    267 	if (error)
    268 		goto out;
    269 
    270 	/*
    271 	 * Do ifconfig with our real IP address and mask.
    272 	 */
    273 	error = nfs_boot_setaddress(ifp, procp, nd->nd_myip.s_addr,
    274 				    nd->nd_mask.s_addr, INADDR_ANY);
    275 	if (error) {
    276 		printf("nfs_boot: set ifaddr real, error=%d\n", error);
    277 		goto out;
    278 	}
    279 
    280 out:
    281 	if (error) {
    282 		(void) nfs_boot_ifupdown(ifp, procp, 0);
    283 		nfs_boot_flushrt(ifp);
    284 	}
    285 	return (error);
    286 }
    287 
    288 struct bootpcontext {
    289 	int xid;
    290 	u_char *haddr;
    291 	u_char halen;
    292 	struct bootp *replybuf;
    293 	int replylen;
    294 #ifdef NFS_BOOT_DHCP
    295 	char expected_dhcpmsgtype, dhcp_ok;
    296 	struct in_addr dhcp_serverip;
    297 #endif
    298 };
    299 
    300 static int bootpset __P((struct mbuf*, void*, int));
    301 static int bootpcheck __P((struct mbuf*, void*));
    302 
    303 static int
    304 bootpset(m, context, waited)
    305 	struct mbuf *m;
    306 	void *context;
    307 	int waited;
    308 {
    309 	struct bootp *bootp;
    310 
    311 	/* we know it's contigous (in 1 mbuf cluster) */
    312 	bootp = mtod(m, struct bootp*);
    313 
    314 	bootp->bp_secs = htons(waited);
    315 
    316 	return (0);
    317 }
    318 
    319 static int
    320 bootpcheck(m, context)
    321 	struct mbuf *m;
    322 	void *context;
    323 {
    324 	struct bootp *bootp;
    325 	struct bootpcontext *bpc = context;
    326 	u_int tag, len;
    327 	u_char *p, *limit;
    328 
    329 	/*
    330 	 * Is this a valid reply?
    331 	 */
    332 	if (m->m_pkthdr.len < BOOTP_SIZE_MIN) {
    333 		DPRINT("short packet");
    334 		return (-1);
    335 	}
    336 	if (m->m_pkthdr.len > BOOTP_SIZE_MAX) {
    337 		DPRINT("long packet");
    338 		return (-1);
    339 	}
    340 
    341 	/*
    342 	 * don't make first checks more expensive than necessary
    343 	 */
    344 #define ofs(what, elem) ((int)&(((what *)0)->elem))
    345 	if (m->m_len < ofs(struct bootp, bp_secs)) {
    346 		m = m_pullup(m, ofs(struct bootp, bp_secs));
    347 		if (m == NULL)
    348 			return (-1);
    349 	}
    350 #undef ofs
    351 	bootp = mtod(m, struct bootp*);
    352 
    353 	if (bootp->bp_op != BOOTREPLY) {
    354 		DPRINT("not reply");
    355 		return (-1);
    356 	}
    357 	if (bootp->bp_hlen != bpc->halen) {
    358 		DPRINT("bad hwa_len");
    359 		return (-1);
    360 	}
    361 	if (memcmp(bootp->bp_chaddr, bpc->haddr, bpc->halen)) {
    362 		DPRINT("wrong hwaddr");
    363 		return (-1);
    364 	}
    365 	if (bootp->bp_xid != bpc->xid) {
    366 		DPRINT("wrong xid");
    367 		return (-1);
    368 	}
    369 
    370 	/*
    371 	 * OK, it's worth to look deeper.
    372 	 * We copy the mbuf into a flat buffer here because
    373 	 * m_pullup() is a bit limited for this purpose
    374 	 * (doesn't allocate a cluster if necessary).
    375 	 */
    376 	bpc->replylen = m->m_pkthdr.len;
    377 	m_copydata(m, 0, bpc->replylen, (caddr_t)bpc->replybuf);
    378 	bootp = bpc->replybuf;
    379 
    380 	/*
    381 	 * Check if the IP address we get looks correct.
    382 	 * (DHCP servers can send junk to unknown clients.)
    383 	 * XXX more checks might be needed
    384 	 */
    385 	if (bootp->bp_yiaddr.s_addr == INADDR_ANY ||
    386 	    bootp->bp_yiaddr.s_addr == INADDR_BROADCAST) {
    387 		printf("nfs_boot: wrong IP addr %s",
    388 		       inet_ntoa(bootp->bp_yiaddr));
    389 		goto warn;
    390 	}
    391 
    392 	/*
    393 	 * Check the vendor data.
    394 	 */
    395 	if (memcmp(bootp->bp_vend, vm_rfc1048, 4)) {
    396 		printf("nfs_boot: reply missing options");
    397 		goto warn;
    398 	}
    399 	p = &bootp->bp_vend[4];
    400 	limit = ((char*)bootp) + bpc->replylen;
    401 	while (p < limit) {
    402 		tag = *p++;
    403 		if (tag == TAG_END)
    404 			break;
    405 		if (tag == TAG_PAD)
    406 			continue;
    407 		len = *p++;
    408 		if ((p + len) > limit) {
    409 			printf("nfs_boot: option %d too long", tag);
    410 			goto warn;
    411 		}
    412 		switch (tag) {
    413 #ifdef NFS_BOOT_DHCP
    414 		case TAG_DHCP_MSGTYPE:
    415 			if (*p != bpc->expected_dhcpmsgtype)
    416 				return (-1);
    417 			bpc->dhcp_ok = 1;
    418 			break;
    419 		case TAG_SERVERID:
    420 			memcpy(&bpc->dhcp_serverip.s_addr, p,
    421 			      sizeof(bpc->dhcp_serverip.s_addr));
    422 			break;
    423 #endif
    424 		default:
    425 			break;
    426 		}
    427 		p += len;
    428 	}
    429 	return (0);
    430 
    431 warn:
    432 	printf(" (bad reply from %s)\n", inet_ntoa(bootp->bp_siaddr));
    433 	return (-1);
    434 }
    435 
    436 static int
    437 bootpc_call(nd, procp)
    438 	struct nfs_diskless *nd;
    439 	struct proc *procp;
    440 {
    441 	struct socket *so;
    442 	struct ifnet *ifp = nd->nd_ifp;
    443 	static u_int32_t xid = ~0xFF;
    444 	struct bootp *bootp;	/* request */
    445 	struct mbuf *m, *nam;
    446 	struct sockaddr_in *sin;
    447 	int error;
    448 	u_char *haddr;
    449 	u_char hafmt, halen;
    450 	struct bootpcontext bpc;
    451 #ifdef NFS_BOOT_DHCP
    452 	char vci[64];
    453 	int vcilen;
    454 #endif
    455 
    456 	error = socreate(AF_INET, &so, SOCK_DGRAM, 0);
    457 	if (error) {
    458 		printf("bootp: socreate, error=%d\n", error);
    459 		return (error);
    460 	}
    461 
    462 	/*
    463 	 * Initialize to NULL anything that will hold an allocation,
    464 	 * and free each at the end if not null.
    465 	 */
    466 	bpc.replybuf = NULL;
    467 	m = nam = NULL;
    468 
    469 	/* Record our H/W (Ethernet) address. */
    470 	{	struct sockaddr_dl *sdl = ifp->if_sadl;
    471 		switch (sdl->sdl_type) {
    472 		    case IFT_ISO88025:
    473 			hafmt = HTYPE_IEEE802;
    474 			break;
    475 		    case IFT_ETHER:
    476 		    case IFT_FDDI:
    477 			hafmt = HTYPE_ETHERNET;
    478 			break;
    479 		    default:
    480 			printf("bootp: unsupported interface type %d\n",
    481 			       sdl->sdl_type);
    482 			error = EINVAL;
    483 			goto out;
    484 		}
    485 		halen = sdl->sdl_alen;
    486 		haddr = (unsigned char *)LLADDR(sdl);
    487 	}
    488 
    489 	/*
    490 	 * Skip the route table when sending on this socket.
    491 	 * If this is not done, ip_output finds the loopback
    492 	 * interface (why?) and then fails because broadcast
    493 	 * is not supported on that interface...
    494 	 */
    495 	{	int32_t *opt;
    496 		m = m_get(M_WAIT, MT_SOOPTS);
    497 		opt = mtod(m, int32_t *);
    498 		m->m_len = sizeof(*opt);
    499 		*opt = 1;
    500 		error = sosetopt(so, SOL_SOCKET, SO_DONTROUTE, m);
    501 		m = NULL;	/* was consumed */
    502 	}
    503 	if (error) {
    504 		DPRINT("SO_DONTROUTE");
    505 		goto out;
    506 	}
    507 
    508 	/* Enable broadcast. */
    509 	if ((error = nfs_boot_enbroadcast(so))) {
    510 		DPRINT("SO_BROADCAST");
    511 		goto out;
    512 	}
    513 
    514 	/* Set the receive timeout for the socket. */
    515 	if ((error = nfs_boot_setrecvtimo(so))) {
    516 		DPRINT("SO_RCVTIMEO");
    517 		goto out;
    518 	}
    519 
    520 	/*
    521 	 * Bind the local endpoint to a bootp client port.
    522 	 */
    523 	if ((error = nfs_boot_sobind_ipport(so, IPPORT_BOOTPC))) {
    524 		DPRINT("bind failed\n");
    525 		goto out;
    526 	}
    527 
    528 	/*
    529 	 * Setup socket address for the server.
    530 	 */
    531 	nam = m_get(M_WAIT, MT_SONAME);
    532 	sin = mtod(nam, struct sockaddr_in *);
    533 	sin->sin_len = nam->m_len = sizeof(*sin);
    534 	sin->sin_family = AF_INET;
    535 	sin->sin_addr.s_addr = INADDR_BROADCAST;
    536 	sin->sin_port = htons(IPPORT_BOOTPS);
    537 
    538 	/*
    539 	 * Allocate buffer used for request
    540 	 */
    541 	m = m_gethdr(M_WAIT, MT_DATA);
    542 	MCLGET(m, M_WAIT);
    543 	bootp = mtod(m, struct bootp*);
    544 	m->m_pkthdr.len = m->m_len = BOOTP_SIZE_MAX;
    545 	m->m_pkthdr.rcvif = NULL;
    546 
    547 	/*
    548 	 * Build the BOOTP reqest message.
    549 	 * Note: xid is host order! (opaque to server)
    550 	 */
    551 	memset((caddr_t)bootp, 0, BOOTP_SIZE_MAX);
    552 	bootp->bp_op    = BOOTREQUEST;
    553 	bootp->bp_htype = hafmt;
    554 	bootp->bp_hlen  = halen;	/* Hardware address length */
    555 	bootp->bp_xid = ++xid;
    556 	memcpy(bootp->bp_chaddr, haddr, halen);
    557 #ifdef NFS_BOOT_BOOTP_REQFILE
    558 	strncpy(bootp->bp_file, NFS_BOOT_BOOTP_REQFILE, sizeof(bootp->bp_file));
    559 #endif
    560 	/* Fill-in the vendor data. */
    561 	memcpy(bootp->bp_vend, vm_rfc1048, 4);
    562 #ifdef NFS_BOOT_DHCP
    563 	bootp->bp_vend[4] = TAG_DHCP_MSGTYPE;
    564 	bootp->bp_vend[5] = 1;
    565 	bootp->bp_vend[6] = DHCPDISCOVER;
    566 	/*
    567 	 * Insert a NetBSD Vendor Class Identifier option.
    568 	 */
    569 	sprintf(vci, "%s:%s:kernel:%s", ostype, MACHINE, osrelease);
    570 	vcilen = strlen(vci);
    571 	bootp->bp_vend[7] = TAG_CLASSID;
    572 	bootp->bp_vend[8] = vcilen;
    573 	memcpy(&bootp->bp_vend[9], vci, vcilen);
    574 	bootp->bp_vend[9 + vcilen] = TAG_END;
    575 #else
    576 	bootp->bp_vend[4] = TAG_END;
    577 #endif
    578 
    579 	bpc.xid = xid;
    580 	bpc.haddr = haddr;
    581 	bpc.halen = halen;
    582 	bpc.replybuf = malloc(BOOTP_SIZE_MAX, M_DEVBUF, M_WAITOK);
    583 	if (bpc.replybuf == NULL)
    584 		panic("nfs_boot: malloc reply buf");
    585 #ifdef NFS_BOOT_DHCP
    586 	bpc.expected_dhcpmsgtype = DHCPOFFER;
    587 	bpc.dhcp_ok = 0;
    588 #endif
    589 
    590 	error = nfs_boot_sendrecv(so, nam, bootpset, m,
    591 				  bootpcheck, 0, 0, &bpc);
    592 	if (error)
    593 		goto out;
    594 
    595 #ifdef NFS_BOOT_DHCP
    596 	if (bpc.dhcp_ok) {
    597 		u_int32_t leasetime;
    598 		bootp->bp_vend[6] = DHCPREQUEST;
    599 		bootp->bp_vend[7] = TAG_REQ_ADDR;
    600 		bootp->bp_vend[8] = 4;
    601 		memcpy(&bootp->bp_vend[9], &bpc.replybuf->bp_yiaddr, 4);
    602 		bootp->bp_vend[13] = TAG_SERVERID;
    603 		bootp->bp_vend[14] = 4;
    604 		memcpy(&bootp->bp_vend[15], &bpc.dhcp_serverip.s_addr, 4);
    605 		bootp->bp_vend[19] = TAG_LEASETIME;
    606 		bootp->bp_vend[20] = 4;
    607 		leasetime = htonl(300);
    608 		memcpy(&bootp->bp_vend[21], &leasetime, 4);
    609 		/*
    610 		 * Insert a NetBSD Vendor Class Identifier option.
    611 		 */
    612 		sprintf(vci, "%s:%s:kernel:%s", ostype, MACHINE, osrelease);
    613 		vcilen = strlen(vci);
    614 		bootp->bp_vend[25] = TAG_CLASSID;
    615 		bootp->bp_vend[26] = vcilen;
    616 		memcpy(&bootp->bp_vend[27], vci, vcilen);
    617 		bootp->bp_vend[27 + vcilen] = TAG_END;
    618 
    619 		bpc.expected_dhcpmsgtype = DHCPACK;
    620 
    621 		error = nfs_boot_sendrecv(so, nam, bootpset, m,
    622 					  bootpcheck, 0, 0, &bpc);
    623 		if (error)
    624 			goto out;
    625 	}
    626 #endif
    627 
    628 	/*
    629 	 * bootpcheck() has copied the receive mbuf into
    630 	 * the buffer at bpc.replybuf.
    631 	 */
    632 #ifdef NFS_BOOT_DHCP
    633 	printf("nfs_boot: %s next-server: %s\n",
    634 	       (bpc.dhcp_ok ? "DHCP" : "BOOTP"),
    635 #else
    636 	printf("nfs_boot: BOOTP next-server: %s\n",
    637 #endif
    638 	       inet_ntoa(bpc.replybuf->bp_siaddr));
    639 
    640 	bootp_extract(bpc.replybuf, bpc.replylen, nd);
    641 
    642 out:
    643 	if (bpc.replybuf)
    644 		free(bpc.replybuf, M_DEVBUF);
    645 	if (m)
    646 		m_freem(m);
    647 	if (nam)
    648 		m_freem(nam);
    649 	soclose(so);
    650 	return (error);
    651 }
    652 
    653 static void
    654 bootp_extract(bootp, replylen, nd)
    655 	struct bootp *bootp;
    656 	int replylen;
    657 	struct nfs_diskless *nd;
    658 {
    659 	struct sockaddr_in *sin;
    660 	struct in_addr netmask;
    661 	struct in_addr gateway;
    662 	struct in_addr rootserver;
    663 	char *myname;	/* my hostname */
    664 	char *mydomain;	/* my domainname */
    665 	char *rootpath;
    666 	int mynamelen;
    667 	int mydomainlen;
    668 	int rootpathlen;
    669 	int overloaded;
    670 	u_int tag, len;
    671 	u_char *p, *limit;
    672 
    673 	/* Default these to "unspecified". */
    674 	netmask.s_addr = 0;
    675 	gateway.s_addr = 0;
    676 	mydomain    = myname    = rootpath = NULL;
    677 	mydomainlen = mynamelen = rootpathlen = 0;
    678 	/* default root server to bootp next-server */
    679 	rootserver = bootp->bp_siaddr;
    680 	/* assume that server name field is not overloaded by default */
    681 	overloaded = 0;
    682 
    683 	p = &bootp->bp_vend[4];
    684 	limit = ((char*)bootp) + replylen;
    685 	while (p < limit) {
    686 		tag = *p++;
    687 		if (tag == TAG_END)
    688 			break;
    689 		if (tag == TAG_PAD)
    690 			continue;
    691 		len = *p++;
    692 #if 0 /* already done in bootpcheck() */
    693 		if ((p + len) > limit) {
    694 			printf("nfs_boot: option %d too long\n", tag);
    695 			break;
    696 		}
    697 #endif
    698 		switch (tag) {
    699 		    case TAG_SUBNET_MASK:
    700 			memcpy(&netmask, p, 4);
    701 			break;
    702 		    case TAG_GATEWAY:
    703 			/* Routers */
    704 			memcpy(&gateway, p, 4);
    705 			break;
    706 		    case TAG_HOST_NAME:
    707 			if (len >= sizeof(hostname)) {
    708 				printf("nfs_boot: host name >= %lu bytes",
    709 				       (u_long)sizeof(hostname));
    710 				break;
    711 			}
    712 			myname = p;
    713 			mynamelen = len;
    714 			break;
    715 		    case TAG_DOMAIN_NAME:
    716 			if (len >= sizeof(domainname)) {
    717 				printf("nfs_boot: domain name >= %lu bytes",
    718 				       (u_long)sizeof(domainname));
    719 				break;
    720 			}
    721 			mydomain = p;
    722 			mydomainlen = len;
    723 			break;
    724 		    case TAG_ROOT_PATH:
    725 			/* Leave some room for the server name. */
    726 			if (len >= (MNAMELEN-10)) {
    727 				printf("nfs_boot: rootpath >=%d bytes",
    728 				       (MNAMELEN-10));
    729 				break;
    730 			}
    731 			rootpath = p;
    732 			rootpathlen = len;
    733 			break;
    734 		    case TAG_SWAP_SERVER:
    735 			/* override NFS server address */
    736 			memcpy(&rootserver, p, 4);
    737 			break;
    738 #ifdef NFS_BOOT_DHCP
    739 		    case TAG_OVERLOAD:
    740 			if (len > 0 && ((*p & 0x02) != 0))
    741 				/*
    742 				 * The server name field in the dhcp packet
    743 				 * is overloaded and we can't find server
    744 				 * name there.
    745 				 */
    746 				overloaded = 1;
    747 			break;
    748 #endif
    749 		    default:
    750 			break;
    751 		}
    752 		p += len;
    753 	}
    754 
    755 	/*
    756 	 * Store and print network config info.
    757 	 */
    758 	if (myname) {
    759 		myname[mynamelen] = '\0';
    760 		strncpy(hostname, myname, sizeof(hostname));
    761 		hostnamelen = mynamelen;
    762 		printf("nfs_boot: my_name=%s\n", hostname);
    763 	}
    764 	if (mydomain) {
    765 		mydomain[mydomainlen] = '\0';
    766 		strncpy(domainname, mydomain, sizeof(domainname));
    767 		domainnamelen = mydomainlen;
    768 		printf("nfs_boot: my_domain=%s\n", domainname);
    769 	}
    770 	nd->nd_myip = bootp->bp_yiaddr;
    771 	if (nd->nd_myip.s_addr)
    772 		printf("nfs_boot: my_addr=%s\n", inet_ntoa(nd->nd_myip));
    773 	nd->nd_mask = netmask;
    774 	if (nd->nd_mask.s_addr)
    775 		printf("nfs_boot: my_mask=%s\n", inet_ntoa(nd->nd_mask));
    776 	nd->nd_gwip = gateway;
    777 	if (nd->nd_gwip.s_addr)
    778 		printf("nfs_boot: gateway=%s\n", inet_ntoa(nd->nd_gwip));
    779 
    780 	/*
    781 	 * Store the information about our NFS root mount.
    782 	 * The caller will print it, so be silent here.
    783 	 */
    784 	{
    785 		struct nfs_dlmount *ndm = &nd->nd_root;
    786 
    787 		/* Server IP address. */
    788 		sin = (struct sockaddr_in *) &ndm->ndm_saddr;
    789 		memset((caddr_t)sin, 0, sizeof(*sin));
    790 		sin->sin_len = sizeof(*sin);
    791 		sin->sin_family = AF_INET;
    792 		sin->sin_addr = rootserver;
    793 		/* Server name. */
    794 		if (!overloaded && bootp->bp_sname[0] != 0 &&
    795 		    !memcmp(&rootserver, &bootp->bp_siaddr,
    796 			  sizeof(struct in_addr))) {
    797 			/* standard root server, we have the name */
    798 			strncpy(ndm->ndm_host, bootp->bp_sname, BP_SNAME_LEN-1);
    799 		} else {
    800 			/* Show the server IP address numerically. */
    801 			strncpy(ndm->ndm_host, inet_ntoa(rootserver),
    802 				BP_SNAME_LEN-1);
    803 		}
    804 		len = strlen(ndm->ndm_host);
    805 		if (rootpath &&
    806 		    len + 1 + rootpathlen + 1 <= sizeof(ndm->ndm_host)) {
    807 			ndm->ndm_host[len++] = ':';
    808 			strncpy(ndm->ndm_host + len,
    809 				rootpath, rootpathlen);
    810 			ndm->ndm_host[len + rootpathlen] = '\0';
    811 		} /* else: upper layer will handle error */
    812 	}
    813 }
    814