Home | History | Annotate | Line # | Download | only in nfs
nfs_bootdhcp.c revision 1.2.2.1
      1 /*	$NetBSD: nfs_bootdhcp.c,v 1.2.2.1 1998/05/08 06:58:32 mycroft Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 1995, 1997 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Adam Glass and Gordon W. Ross.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  * 3. All advertising materials mentioning features or use of this software
     19  *    must display the following acknowledgement:
     20  *        This product includes software developed by the NetBSD
     21  *        Foundation, Inc. and its contributors.
     22  * 4. Neither the name of The NetBSD Foundation nor the names of its
     23  *    contributors may be used to endorse or promote products derived
     24  *    from this software without specific prior written permission.
     25  *
     26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     36  * POSSIBILITY OF SUCH DAMAGE.
     37  */
     38 
     39 /*
     40  * Support for NFS diskless booting with BOOTP (RFC951, RFC1048)
     41  *
     42  * History:
     43  *
     44  * Tor Egge developed the initial version of this code based on
     45  * the Sun RPC/bootparam sources nfs_boot.c and krpc_subr.c and
     46  * submitted that work to NetBSD as bugreport "kern/2351" on
     47  * 29 Apr 1996.
     48  *
     49  * Gordon Ross reorganized Tor's version into this form and
     50  * integrated it into the NetBSD sources during Aug 1997.
     51  */
     52 
     53 #include <sys/param.h>
     54 #include <sys/systm.h>
     55 #include <sys/kernel.h>
     56 #include <sys/conf.h>
     57 #include <sys/device.h>
     58 #include <sys/ioctl.h>
     59 #include <sys/proc.h>
     60 #include <sys/mount.h>
     61 #include <sys/mbuf.h>
     62 #include <sys/reboot.h>
     63 #include <sys/socket.h>
     64 #include <sys/socketvar.h>
     65 
     66 #include <net/if.h>
     67 #include <net/if_arp.h> 	/* ARPHRD_ETHER, etc. */
     68 #include <net/if_dl.h>
     69 #include <net/if_ether.h>
     70 #include <net/route.h>
     71 
     72 #include <netinet/in.h>
     73 #include <netinet/if_inarp.h>
     74 
     75 #include <nfs/nfsproto.h>
     76 /* #include <nfs/nfs.h> */
     77 #include <nfs/nfsdiskless.h>
     78 
     79 /*
     80  * There are two implementations of NFS diskless boot.
     81  * This implementation uses BOOTP (RFC951, RFC1048), and
     82  * the other uses Sun RPC/bootparams (nfs_bootparam.c).
     83  *
     84  * This method gets everything it needs with one BOOTP
     85  * request and reply.  Note that this actually uses only
     86  * the old BOOTP functionality subset of DHCP.  It is not
     87  * clear that DHCP provides any advantage over BOOTP for
     88  * diskless boot.  DHCP allows the server to assign an IP
     89  * address without any a-priori knowledge of the client,
     90  * but we require that the server has a-priori knowledge
     91  * of the client so it can export our (unique) NFS root.
     92  * Given that the server needs a-priori knowledge about
     93  * the client anyway, it might as well assign a fixed IP
     94  * address for the client and support BOOTP.
     95  *
     96  * On the other hand, disk-FULL clients may use DHCP, but
     97  * in that case the DHCP client should be user-mode code,
     98  * and has no bearing on the code below. -gwr
     99  */
    100 
    101 /* Begin stuff from bootp.h */
    102 /* Definitions from RFC951 */
    103 #define BP_CHADDR_LEN	 16
    104 #define BP_SNAME_LEN	 64
    105 #define BP_FILE_LEN	128
    106 #define BP_VEND_LEN	 64
    107 struct bootp {
    108 	u_int8_t	bp_op;		/* packet opcode type */
    109 	u_int8_t	bp_htype;	/* hardware addr type */
    110 	u_int8_t	bp_hlen;	/* hardware addr length */
    111 	u_int8_t	bp_hops;	/* gateway hops */
    112 	u_int32_t	bp_xid;		/* transaction ID */
    113 	u_int16_t	bp_secs;	/* seconds since boot began */
    114 	u_int16_t	bp_flags;	/* RFC1532 broadcast, etc. */
    115 	struct in_addr	bp_ciaddr;	/* client IP address */
    116 	struct in_addr	bp_yiaddr;	/* 'your' IP address */
    117 	struct in_addr	bp_siaddr;	/* server IP address */
    118 	struct in_addr	bp_giaddr;	/* gateway IP address */
    119 	u_int8_t bp_chaddr[BP_CHADDR_LEN]; /* client hardware address */
    120 	char	bp_sname[BP_SNAME_LEN]; /* server host name */
    121 	char	bp_file[BP_FILE_LEN];	/* boot file name */
    122 	u_int8_t bp_vend[BP_VEND_LEN];	/* RFC1048 options */
    123 	/*
    124 	 * Note that BOOTP packets are allowed to be longer
    125 	 * (see RFC 1532 sect. 2.1) and common practice is to
    126 	 * allow the option data in bp_vend to extend into the
    127 	 * additional space provided in longer packets.
    128 	 */
    129 };
    130 
    131 #define IPPORT_BOOTPS 67
    132 #define IPPORT_BOOTPC 68
    133 
    134 #define BOOTREQUEST		1
    135 #define BOOTREPLY		2
    136 
    137 /*
    138  * Is this available from the sockaddr_dl somehow?
    139  * Perhaps (struct arphdr)->ar_hrd = ARPHRD_ETHER?
    140  * The interface has ->if_type but not the ARP fmt.
    141  */
    142 #define HTYPE_ETHERNET		  1
    143 
    144 /*
    145  * Vendor magic cookie (v_magic) for RFC1048
    146  */
    147 static const u_int8_t vm_rfc1048[4] = { 99, 130, 83, 99 };
    148 
    149 /*
    150  * Tag values used to specify what information is being supplied in
    151  * the vendor (options) data area of the packet.
    152  */
    153 /* RFC 1048 */
    154 #define TAG_END			((unsigned char) 255)
    155 #define TAG_PAD			((unsigned char)   0)
    156 #define TAG_SUBNET_MASK		((unsigned char)   1)
    157 #define TAG_TIME_OFFSET		((unsigned char)   2)
    158 #define TAG_GATEWAY		((unsigned char)   3)
    159 #define TAG_TIME_SERVER		((unsigned char)   4)
    160 #define TAG_NAME_SERVER		((unsigned char)   5)
    161 #define TAG_DOMAIN_SERVER	((unsigned char)   6)
    162 #define TAG_LOG_SERVER		((unsigned char)   7)
    163 #define TAG_COOKIE_SERVER	((unsigned char)   8)
    164 #define TAG_LPR_SERVER		((unsigned char)   9)
    165 #define TAG_IMPRESS_SERVER	((unsigned char)  10)
    166 #define TAG_RLP_SERVER		((unsigned char)  11)
    167 #define TAG_HOST_NAME		((unsigned char)  12)
    168 #define TAG_BOOT_SIZE		((unsigned char)  13)
    169 /* RFC 1395 */
    170 #define TAG_DUMP_FILE		((unsigned char)  14)
    171 #define TAG_DOMAIN_NAME		((unsigned char)  15)
    172 #define TAG_SWAP_SERVER		((unsigned char)  16)
    173 #define TAG_ROOT_PATH		((unsigned char)  17)
    174 /* End of stuff from bootp.h */
    175 
    176 #ifdef NFS_BOOT_DHCP
    177 #define TAG_REQ_ADDR		((unsigned char)  50)
    178 #define TAG_LEASETIME		((unsigned char)  51)
    179 #define TAG_OVERLOAD		((unsigned char)  52)
    180 #define TAG_DHCP_MSGTYPE	((unsigned char)  53)
    181 #define TAG_SERVERID		((unsigned char)  54)
    182 #define TAG_PARAM_REQ		((unsigned char)  55)
    183 #define TAG_MSG			((unsigned char)  56)
    184 #define TAG_MAXSIZE		((unsigned char)  57)
    185 #define TAG_T1			((unsigned char)  58)
    186 #define TAG_T2			((unsigned char)  59)
    187 #define TAG_CLASSID		((unsigned char)  60)
    188 #define TAG_CLIENTID		((unsigned char)  61)
    189 #endif
    190 
    191 #ifdef NFS_BOOT_DHCP
    192 #define DHCPDISCOVER 1
    193 #define DHCPOFFER 2
    194 #define DHCPREQUEST 3
    195 #define DHCPDECLINE 4
    196 #define DHCPACK 5
    197 #define DHCPNAK 6
    198 #define DHCPRELEASE 7
    199 #endif
    200 
    201 #ifdef NFS_BOOT_DHCP
    202 #define BOOTP_SIZE_MAX	(sizeof(struct bootp)+312-64)
    203 #else
    204 /*
    205  * The "extended" size is somewhat arbitrary, but is
    206  * constrained by the maximum message size specified
    207  * by RFC1533 (567 total).  This value increases the
    208  * space for options from 64 bytes to 256 bytes.
    209  */
    210 #define BOOTP_SIZE_MAX	(sizeof(struct bootp)+256-64)
    211 #endif
    212 #define BOOTP_SIZE_MIN	(sizeof(struct bootp))
    213 
    214 /* Convenience macro */
    215 #define INTOHL(ina) ((u_int32_t)ntohl((ina).s_addr))
    216 
    217 static int bootpc_call __P((struct socket *, struct ifnet *,
    218 			struct nfs_diskless *, struct proc *));
    219 static void bootp_extract __P((struct bootp *, int, struct nfs_diskless *));
    220 
    221 /* #define DEBUG	XXX */
    222 
    223 #ifdef	DEBUG
    224 #define DPRINT(s) printf("nfs_boot: %s\n", s)
    225 #else
    226 #define DPRINT(s) (void)0
    227 #endif
    228 
    229 
    230 /*
    231  * Get our boot parameters using BOOTP.
    232  */
    233 int
    234 nfs_bootdhcp(ifp, nd, procp)
    235 	struct ifnet *ifp;
    236 	struct nfs_diskless *nd;
    237 	struct proc *procp;
    238 {
    239 	struct ifaliasreq iareq;
    240 	struct socket *so;
    241 	struct sockaddr_in *sin;
    242 	int error;
    243 
    244 	/*
    245 	 * Get a socket to use for various things in here.
    246 	 * After this, use "goto out" to cleanup and return.
    247 	 */
    248 	error = socreate(AF_INET, &so, SOCK_DGRAM, 0);
    249 	if (error) {
    250 		printf("nfs_boot: socreate, error=%d\n", error);
    251 		return (error);
    252 	}
    253 
    254 	/*
    255 	 * Do enough of ifconfig(8) so that the chosen interface
    256 	 * can talk to the servers.  Use address zero for now.
    257 	 */
    258 	bzero(&iareq, sizeof(iareq));
    259 	bcopy(ifp->if_xname, iareq.ifra_name, IFNAMSIZ);
    260 	/* Set the I/F address */
    261 	sin = (struct sockaddr_in *)&iareq.ifra_addr;
    262 	sin->sin_len = sizeof(*sin);
    263 	sin->sin_family = AF_INET;
    264 	sin->sin_addr.s_addr = INADDR_ANY;
    265 	/* Leave subnetmask unspecified (len=0) */
    266 	/* Set the broadcast addr. */
    267 	sin = (struct sockaddr_in *)&iareq.ifra_broadaddr;
    268 	sin->sin_len = sizeof(*sin);
    269 	sin->sin_family = AF_INET;
    270 	sin->sin_addr.s_addr = INADDR_BROADCAST;
    271 	error = ifioctl(so, SIOCAIFADDR, (caddr_t)&iareq, procp);
    272 	if (error) {
    273 		printf("nfs_boot: set ifaddr zero, error=%d\n", error);
    274 		goto out;
    275 	}
    276 
    277 	/* This function call does the real send/recv work. */
    278 	error = bootpc_call(so, ifp, nd, procp);
    279 	/* Get rid of the temporary (zero) IP address. */
    280 	/*
    281 	 * XXX SIOCDIFADDR takes a "struct ifreq", which is
    282 	 * an exact subset of "struct ifaliasreq".
    283 	 */
    284 	(void) ifioctl(so, SIOCDIFADDR, (caddr_t)&iareq, procp);
    285 	/* NOW we can test the error from bootpc_call. */
    286 	if (error)
    287 		goto out;
    288 
    289 	/*
    290 	 * Do ifconfig with our real IP address and mask.
    291 	 */
    292 	/* I/F address */
    293 	sin = (struct sockaddr_in *)&iareq.ifra_addr;
    294 	sin->sin_addr = nd->nd_myip;
    295 	/* subnetmask */
    296 	if (nd->nd_mask.s_addr) {
    297 		sin = (struct sockaddr_in *)&iareq.ifra_mask;
    298 		sin->sin_len = sizeof(*sin);
    299 		sin->sin_family = AF_INET;
    300 		sin->sin_addr = nd->nd_mask;
    301 	}
    302 	/* Let ifioctl() default the broadcast address. */
    303 	sin = (struct sockaddr_in *)&iareq.ifra_broadaddr;
    304 	sin->sin_len = 0;
    305 	sin->sin_family = 0;
    306 	sin->sin_addr.s_addr = 0;
    307 	error = ifioctl(so, SIOCAIFADDR, (caddr_t)&iareq, procp);
    308 	if (error) {
    309 		printf("nfs_boot: set ifaddr real, error=%d\n", error);
    310 		goto out;
    311 	}
    312 
    313 out:
    314 	soclose(so);
    315 	return (error);
    316 }
    317 
    318 struct bootpcontext {
    319 	int xid;
    320 	u_char *haddr;
    321 	u_char halen;
    322 	struct bootp *replybuf;
    323 	int replylen;
    324 #ifdef NFS_BOOT_DHCP
    325 	char expected_dhcpmsgtype, dhcp_ok;
    326 	struct in_addr dhcp_serverip;
    327 #endif
    328 };
    329 
    330 static int bootpset __P((struct mbuf*, void*, int));
    331 static int bootpcheck __P((struct mbuf*, void*));
    332 
    333 static int
    334 bootpset(m, context, waited)
    335 	struct mbuf *m;
    336 	void *context;
    337 	int waited;
    338 {
    339 	struct bootp *bootp;
    340 
    341 	/* we know it's contigous (in 1 mbuf cluster) */
    342 	bootp = mtod(m, struct bootp*);
    343 
    344 	bootp->bp_secs = htons(waited);
    345 
    346 	return (0);
    347 }
    348 
    349 static int
    350 bootpcheck(m, context)
    351 	struct mbuf *m;
    352 	void *context;
    353 {
    354 	struct bootp *bootp;
    355 	struct bootpcontext *bpc = context;
    356 	u_int tag, len;
    357 	u_char *p, *limit;
    358 
    359 	/*
    360 	 * Is this a valid reply?
    361 	 */
    362 	if (m->m_pkthdr.len < BOOTP_SIZE_MIN) {
    363 		DPRINT("short packet");
    364 		return (-1);
    365 	}
    366 	if (m->m_pkthdr.len > BOOTP_SIZE_MAX) {
    367 		DPRINT("long packet");
    368 		return (-1);
    369 	}
    370 
    371 	/*
    372 	 * don't make first checks more expensive than necessary
    373 	 */
    374 #define ofs(what, elem) ((int)&(((what *)0)->elem))
    375 	if (m->m_len < ofs(struct bootp, bp_secs)) {
    376 		m = m_pullup(m, ofs(struct bootp, bp_secs));
    377 		if (m == NULL)
    378 			return (-1);
    379 	}
    380 #undef ofs
    381 	bootp = mtod(m, struct bootp*);
    382 
    383 	if (bootp->bp_op != BOOTREPLY) {
    384 		DPRINT("not reply");
    385 		return (-1);
    386 	}
    387 	if (bootp->bp_hlen != bpc->halen) {
    388 		DPRINT("bad hwa_len");
    389 		return (-1);
    390 	}
    391 	if (bcmp(bootp->bp_chaddr, bpc->haddr, bpc->halen)) {
    392 		DPRINT("wrong hwaddr");
    393 		return (-1);
    394 	}
    395 	if (bootp->bp_xid != bpc->xid) {
    396 		DPRINT("wrong xid");
    397 		return (-1);
    398 	}
    399 
    400 	/*
    401 	 * OK, it's worth to look deeper.
    402 	 * We copy the mbuf into a flat buffer here because
    403 	 * m_pullup() is a bit limited for this purpose
    404 	 * (doesn't allocate a cluster if necessary).
    405 	 */
    406 	bpc->replylen = m->m_pkthdr.len;
    407 	m_copydata(m, 0, bpc->replylen, (caddr_t)bpc->replybuf);
    408 	bootp = bpc->replybuf;
    409 
    410 	/*
    411 	 * Check if the IP address we get looks correct.
    412 	 * (DHCP servers can send junk to unknown clients.)
    413 	 * XXX more checks might be needed
    414 	 */
    415 	if (bootp->bp_yiaddr.s_addr == INADDR_ANY ||
    416 	    bootp->bp_yiaddr.s_addr == INADDR_BROADCAST) {
    417 		printf("nfs_boot: wrong IP addr 0x%x",
    418 		       INTOHL(bootp->bp_yiaddr));
    419 		goto warn;
    420 	}
    421 
    422 	/*
    423 	 * Check the vendor data.
    424 	 */
    425 	if (bcmp(bootp->bp_vend, vm_rfc1048, 4)) {
    426 		printf("nfs_boot: reply missing options");
    427 		goto warn;
    428 	}
    429 	p = &bootp->bp_vend[4];
    430 	limit = ((char*)bootp) + bpc->replylen;
    431 	while (p < limit) {
    432 		tag = *p++;
    433 		if (tag == TAG_END)
    434 			break;
    435 		if (tag == TAG_PAD)
    436 			continue;
    437 		len = *p++;
    438 		if ((p + len) > limit) {
    439 			printf("nfs_boot: option %d too long", tag);
    440 			goto warn;
    441 		}
    442 		switch (tag) {
    443 #ifdef NFS_BOOT_DHCP
    444 		    case TAG_DHCP_MSGTYPE:
    445 			if (*p != bpc->expected_dhcpmsgtype)
    446 				return (-1);
    447 			bpc->dhcp_ok = 1;
    448 			break;
    449 		    case TAG_SERVERID:
    450 			bcopy(p, &bpc->dhcp_serverip.s_addr,
    451 			      sizeof(bpc->dhcp_serverip.s_addr));
    452 			break;
    453 #endif
    454 		    default:
    455 			break;
    456 		}
    457 		p += len;
    458 	}
    459 	return (0);
    460 
    461 warn:
    462 	printf(" (bad reply from 0x%x)\n", INTOHL(bootp->bp_siaddr));
    463 	return (-1);
    464 }
    465 
    466 static int
    467 bootpc_call(so, ifp, nd, procp)
    468 	struct socket *so;
    469 	struct ifnet *ifp;
    470 	struct nfs_diskless *nd;
    471 	struct proc *procp;
    472 {
    473 	static u_int32_t xid = ~0xFF;
    474 	struct bootp *bootp;	/* request */
    475 	struct mbuf *m, *nam;
    476 	struct sockaddr_in *sin;
    477 	int error;
    478 	u_char *haddr;
    479 	u_char hafmt, halen;
    480 	struct bootpcontext bpc;
    481 
    482 	/*
    483 	 * Initialize to NULL anything that will hold an allocation,
    484 	 * and free each at the end if not null.
    485 	 */
    486 	bpc.replybuf = NULL;
    487 	m = nam = NULL;
    488 
    489 	/* Record our H/W (Ethernet) address. */
    490 	{	struct sockaddr_dl *sdl = ifp->if_sadl;
    491 		hafmt = HTYPE_ETHERNET; /* XXX: sdl->sdl_type? */
    492 		halen = sdl->sdl_alen;
    493 		haddr = (unsigned char *)LLADDR(sdl);
    494 	}
    495 
    496 	/*
    497 	 * Skip the route table when sending on this socket.
    498 	 * If this is not done, ip_output finds the loopback
    499 	 * interface (why?) and then fails because broadcast
    500 	 * is not supported on that interface...
    501 	 */
    502 	{	int32_t *opt;
    503 		m = m_get(M_WAIT, MT_SOOPTS);
    504 		opt = mtod(m, int32_t *);
    505 		m->m_len = sizeof(*opt);
    506 		*opt = 1;
    507 		error = sosetopt(so, SOL_SOCKET, SO_DONTROUTE, m);
    508 		m = NULL;	/* was consumed */
    509 	}
    510 	if (error) {
    511 		DPRINT("SO_DONTROUTE");
    512 		goto out;
    513 	}
    514 
    515 	/* Enable broadcast. */
    516 	if ((error = nfs_boot_enbroadcast(so))) {
    517 		DPRINT("SO_BROADCAST");
    518 		goto out;
    519 	}
    520 
    521 	/* Set the receive timeout for the socket. */
    522 	if ((error = nfs_boot_setrecvtimo(so))) {
    523 		DPRINT("SO_RCVTIMEO");
    524 		goto out;
    525 	}
    526 
    527 	/*
    528 	 * Bind the local endpoint to a bootp client port.
    529 	 */
    530 	if ((error = nfs_boot_sobind_ipport(so, IPPORT_BOOTPC))) {
    531 		DPRINT("bind failed\n");
    532 		goto out;
    533 	}
    534 
    535 	/*
    536 	 * Setup socket address for the server.
    537 	 */
    538 	nam = m_get(M_WAIT, MT_SONAME);
    539 	sin = mtod(nam, struct sockaddr_in *);
    540 	sin->sin_len = nam->m_len = sizeof(*sin);
    541 	sin->sin_family = AF_INET;
    542 	sin->sin_addr.s_addr = INADDR_BROADCAST;
    543 	sin->sin_port = htons(IPPORT_BOOTPS);
    544 
    545 	/*
    546 	 * Allocate buffer used for request
    547 	 */
    548 	m = m_gethdr(M_WAIT, MT_DATA);
    549 	MCLGET(m, M_WAIT);
    550 	bootp = mtod(m, struct bootp*);
    551 	m->m_pkthdr.len = m->m_len = BOOTP_SIZE_MAX;
    552 	m->m_pkthdr.rcvif = NULL;
    553 
    554 	/*
    555 	 * Build the BOOTP reqest message.
    556 	 * Note: xid is host order! (opaque to server)
    557 	 */
    558 	bzero((caddr_t)bootp, BOOTP_SIZE_MAX);
    559 	bootp->bp_op    = BOOTREQUEST;
    560 	bootp->bp_htype = hafmt;
    561 	bootp->bp_hlen  = halen;	/* Hardware address length */
    562 	bootp->bp_xid = ++xid;
    563 	bcopy(haddr, bootp->bp_chaddr, halen);
    564 	/* Fill-in the vendor data. */
    565 	bcopy(vm_rfc1048, bootp->bp_vend, 4);
    566 #ifdef NFS_BOOT_DHCP
    567 	bootp->bp_vend[4] = TAG_DHCP_MSGTYPE;
    568 	bootp->bp_vend[5] = 1;
    569 	bootp->bp_vend[6] = DHCPDISCOVER;
    570 	bootp->bp_vend[7] = TAG_END;
    571 #else
    572 	bootp->bp_vend[4] = TAG_END;
    573 #endif
    574 
    575 	bpc.xid = xid;
    576 	bpc.haddr = haddr;
    577 	bpc.halen = halen;
    578 	bpc.replybuf = malloc(BOOTP_SIZE_MAX, M_DEVBUF, M_WAITOK);
    579 	if (bpc.replybuf == NULL)
    580 		panic("nfs_boot: malloc reply buf");
    581 #ifdef NFS_BOOT_DHCP
    582 	bpc.expected_dhcpmsgtype = DHCPOFFER;
    583 	bpc.dhcp_ok = 0;
    584 #endif
    585 
    586 	error = nfs_boot_sendrecv(so, nam, bootpset, m,
    587 				  bootpcheck, 0, 0, &bpc);
    588 	if (error)
    589 		goto out;
    590 
    591 #ifdef NFS_BOOT_DHCP
    592 	if (bpc.dhcp_ok) {
    593 		u_int32_t leasetime;
    594 		bootp->bp_vend[6] = DHCPREQUEST;
    595 		bootp->bp_vend[7] = TAG_REQ_ADDR;
    596 		bootp->bp_vend[8] = 4;
    597 		bcopy(&bpc.replybuf->bp_yiaddr, &bootp->bp_vend[9], 4);
    598 		bootp->bp_vend[13] = TAG_SERVERID;
    599 		bootp->bp_vend[14] = 4;
    600 		bcopy(&bpc.dhcp_serverip.s_addr, &bootp->bp_vend[15], 4);
    601 		bootp->bp_vend[19] = TAG_LEASETIME;
    602 		bootp->bp_vend[20] = 4;
    603 		leasetime = htonl(300);
    604 		bcopy(&leasetime, &bootp->bp_vend[21], 4);
    605 		bootp->bp_vend[25] = TAG_END;
    606 
    607 		bpc.expected_dhcpmsgtype = DHCPACK;
    608 
    609 		error = nfs_boot_sendrecv(so, nam, bootpset, m,
    610 					  bootpcheck, 0, 0, &bpc);
    611 		if (error)
    612 			goto out;
    613 	}
    614 #endif
    615 
    616 	/*
    617 	 * bootpcheck() has copied the receive mbuf into
    618 	 * the buffer at bpc.replybuf.
    619 	 */
    620 #ifdef NFS_BOOT_DHCP
    621 	printf("nfs_boot: %s server: 0x%x\n",
    622 	       (bpc.dhcp_ok ? "DHCP" : "BOOTP"),
    623 #else
    624 	printf("nfs_boot: BOOTP server: 0x%x\n",
    625 #endif
    626 	       INTOHL(bpc.replybuf->bp_siaddr));
    627 
    628 	bootp_extract(bpc.replybuf, bpc.replylen, nd);
    629 
    630 out:
    631 	if (bpc.replybuf)
    632 		free(bpc.replybuf, M_DEVBUF);
    633 	if (m)
    634 		m_freem(m);
    635 	if (nam)
    636 		m_freem(nam);
    637 	return (error);
    638 }
    639 
    640 static void
    641 bootp_extract(bootp, replylen, nd)
    642 	struct bootp *bootp;
    643 	int replylen;
    644 	struct nfs_diskless *nd;
    645 {
    646 	struct sockaddr_in *sin;
    647 	struct in_addr netmask;
    648 	struct in_addr gateway;
    649 	struct in_addr rootserver;
    650 	char *myname;	/* my hostname */
    651 	char *mydomain;	/* my domainname */
    652 	char *rootpath;
    653 	int mynamelen;
    654 	int mydomainlen;
    655 	int rootpathlen;
    656 	u_int tag, len;
    657 	u_char *p, *limit;
    658 
    659 	/* Default these to "unspecified". */
    660 	netmask.s_addr = 0;
    661 	gateway.s_addr = 0;
    662 	mydomain    = myname    = rootpath = NULL;
    663 	mydomainlen = mynamelen = rootpathlen = 0;
    664 	/* default root server to bootp next-server */
    665 	rootserver = bootp->bp_siaddr;
    666 
    667 	p = &bootp->bp_vend[4];
    668 	limit = ((char*)bootp) + replylen;
    669 	while (p < limit) {
    670 		tag = *p++;
    671 		if (tag == TAG_END)
    672 			break;
    673 		if (tag == TAG_PAD)
    674 			continue;
    675 		len = *p++;
    676 #if 0 /* already done in bootpcheck() */
    677 		if ((p + len) > limit) {
    678 			printf("nfs_boot: option %d too long\n", tag);
    679 			break;
    680 		}
    681 #endif
    682 		switch (tag) {
    683 		    case TAG_SUBNET_MASK:
    684 			bcopy(p, &netmask, 4);
    685 			break;
    686 		    case TAG_GATEWAY:
    687 			/* Routers */
    688 			bcopy(p, &gateway, 4);
    689 			break;
    690 		    case TAG_HOST_NAME:
    691 			if (len >= sizeof(hostname)) {
    692 				printf("nfs_boot: host name >=%d bytes",
    693 				       sizeof(hostname));
    694 				break;
    695 			}
    696 			myname = p;
    697 			mynamelen = len;
    698 			break;
    699 		    case TAG_DOMAIN_NAME:
    700 			if (len >= sizeof(domainname)) {
    701 				printf("nfs_boot: domain name >=%d bytes",
    702 				       sizeof(domainname));
    703 				break;
    704 			}
    705 			mydomain = p;
    706 			mydomainlen = len;
    707 			break;
    708 		    case TAG_ROOT_PATH:
    709 			/* Leave some room for the server name. */
    710 			if (len >= (MNAMELEN-10)) {
    711 				printf("nfs_boot: rootpath >=%d bytes",
    712 				       (MNAMELEN-10));
    713 				break;
    714 			}
    715 			rootpath = p;
    716 			rootpathlen = len;
    717 			break;
    718 		    case TAG_SWAP_SERVER:
    719 			/* override NFS server address */
    720 			bcopy(p, &rootserver, 4);
    721 			break;
    722 		    default:
    723 			break;
    724 		}
    725 		p += len;
    726 	}
    727 
    728 	/*
    729 	 * Store and print network config info.
    730 	 */
    731 	if (myname) {
    732 		myname[mynamelen] = '\0';
    733 		strncpy(hostname, myname, sizeof(hostname));
    734 		hostnamelen = mynamelen;
    735 		printf("nfs_boot: my_name=%s\n", hostname);
    736 	}
    737 	if (mydomain) {
    738 		mydomain[mydomainlen] = '\0';
    739 		strncpy(domainname, mydomain, sizeof(domainname));
    740 		domainnamelen = mydomainlen;
    741 		printf("nfs_boot: my_domain=%s\n", domainname);
    742 	}
    743 	nd->nd_myip = bootp->bp_yiaddr;
    744 	if (nd->nd_myip.s_addr)
    745 		printf("nfs_boot: my_addr=0x%x\n", INTOHL(nd->nd_myip));
    746 	nd->nd_mask = netmask;
    747 	if (nd->nd_mask.s_addr)
    748 		printf("nfs_boot: my_mask=0x%x\n", INTOHL(nd->nd_mask));
    749 	nd->nd_gwip = gateway;
    750 	if (nd->nd_gwip.s_addr)
    751 		printf("nfs_boot: gateway=0x%x\n", INTOHL(nd->nd_gwip));
    752 
    753 	/*
    754 	 * Store the information about our NFS root mount.
    755 	 * The caller will print it, so be silent here.
    756 	 */
    757 	{
    758 		struct nfs_dlmount *ndm = &nd->nd_root;
    759 
    760 		/* Server IP address. */
    761 		sin = (struct sockaddr_in *) &ndm->ndm_saddr;
    762 		bzero((caddr_t)sin, sizeof(*sin));
    763 		sin->sin_len = sizeof(*sin);
    764 		sin->sin_family = AF_INET;
    765 		sin->sin_addr = rootserver;
    766 		/* Server name. */
    767 		if (!bcmp(&rootserver, &bootp->bp_siaddr,
    768 			  sizeof(struct in_addr))) {
    769 			/* standard root server, we have the name */
    770 			strncpy(ndm->ndm_host, bootp->bp_sname, BP_SNAME_LEN-1);
    771 		} else {
    772 			/* Show the server IP address numerically. */
    773 			sprintf(ndm->ndm_host, "0x%8x",
    774 				INTOHL(rootserver));
    775 		}
    776 		len = strlen(ndm->ndm_host);
    777 		if (rootpath &&
    778 		    len + 1 + rootpathlen + 1 <= sizeof(ndm->ndm_host)) {
    779 			ndm->ndm_host[len++] = ':';
    780 			strncpy(ndm->ndm_host + len,
    781 				rootpath, rootpathlen);
    782 			ndm->ndm_host[len + rootpathlen] = '\0';
    783 		} /* else: upper layer will handle error */
    784 	}
    785 }
    786