dhcpv4: fix out of bound access in dhcpv4_put
[project/odhcpd.git] / src / dhcpv4.c
1 /**
2 * Copyright (C) 2012-2013 Steven Barth <steven@midlink.org>
3 * Copyright (C) 2016 Hans Dedecker <dedeckeh@gmail.com>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License v2 as published by
7 * the Free Software Foundation.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 *
15 */
16
17 #include <time.h>
18 #include <errno.h>
19 #include <fcntl.h>
20 #include <unistd.h>
21 #include <stddef.h>
22 #include <stdlib.h>
23 #include <resolv.h>
24 #include <limits.h>
25 #include <net/if.h>
26 #include <net/if_arp.h>
27 #include <netinet/ip.h>
28 #include <sys/ioctl.h>
29 #include <sys/timerfd.h>
30 #include <arpa/inet.h>
31
32 #include "odhcpd.h"
33 #include "dhcpv4.h"
34 #include "dhcpv6.h"
35
36 static void free_dhcpv4_assignment(struct dhcpv4_assignment *a);
37 static void handle_dhcpv4(void *addr, void *data, size_t len,
38 struct interface *iface, void *dest_addr);
39 static struct dhcpv4_assignment* dhcpv4_lease(struct interface *iface,
40 enum dhcpv4_msg msg, const uint8_t *mac, struct in_addr reqaddr,
41 uint32_t *leasetime, const char *hostname, const size_t hostname_len);
42
43 /* Create socket and register events */
44 int init_dhcpv4(void)
45 {
46 return 0;
47 }
48
49 int setup_dhcpv4_interface(struct interface *iface, bool enable)
50 {
51 if (iface->dhcpv4_event.uloop.fd > 0) {
52 uloop_fd_delete(&iface->dhcpv4_event.uloop);
53 close(iface->dhcpv4_event.uloop.fd);
54 iface->dhcpv4_event.uloop.fd = -1;
55 }
56
57 if (iface->dhcpv4 && enable) {
58 if (!iface->dhcpv4_assignments.next)
59 INIT_LIST_HEAD(&iface->dhcpv4_assignments);
60
61 int sock = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, IPPROTO_UDP);
62 if (sock < 0) {
63 syslog(LOG_ERR, "Failed to create DHCPv4 server socket: %s",
64 strerror(errno));
65 return -1;
66 }
67
68 /* Basic IPv4 configuration */
69 int val = 1;
70 setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val));
71 setsockopt(sock, SOL_SOCKET, SO_BROADCAST, &val, sizeof(val));
72 setsockopt(sock, IPPROTO_IP, IP_PKTINFO, &val, sizeof(val));
73
74 val = IPTOS_PREC_INTERNETCONTROL;
75 setsockopt(sock, IPPROTO_IP, IP_TOS, &val, sizeof(val));
76
77 val = IP_PMTUDISC_DONT;
78 setsockopt(sock, IPPROTO_IP, IP_MTU_DISCOVER, &val, sizeof(val));
79
80 setsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE,
81 iface->ifname, strlen(iface->ifname));
82
83 struct sockaddr_in bind_addr = {AF_INET, htons(DHCPV4_SERVER_PORT),
84 {INADDR_ANY}, {0}};
85
86 if (bind(sock, (struct sockaddr*)&bind_addr, sizeof(bind_addr))) {
87 syslog(LOG_ERR, "Failed to open DHCPv4 server socket: %s",
88 strerror(errno));
89 return -1;
90 }
91
92
93 if (ntohl(iface->dhcpv4_start.s_addr) > ntohl(iface->dhcpv4_end.s_addr)) {
94 syslog(LOG_ERR, "Invalid DHCP range");
95 return -1;
96 }
97
98 /* Create a range if not specified */
99 struct ifreq ifreq;
100 strncpy(ifreq.ifr_name, iface->ifname, sizeof(ifreq.ifr_name));
101
102 struct sockaddr_in *saddr = (struct sockaddr_in*)&ifreq.ifr_addr;
103 struct sockaddr_in *smask = (struct sockaddr_in*)&ifreq.ifr_netmask;
104 if (!(iface->dhcpv4_start.s_addr & htonl(0xffff0000)) &&
105 !(iface->dhcpv4_end.s_addr & htonl(0xffff0000)) &&
106 !ioctl(sock, SIOCGIFADDR, &ifreq)) {
107 struct in_addr addr = saddr->sin_addr;
108
109 ioctl(sock, SIOCGIFNETMASK, &ifreq);
110 struct in_addr mask = smask->sin_addr;
111
112 uint32_t start = ntohl(iface->dhcpv4_start.s_addr);
113 uint32_t end = ntohl(iface->dhcpv4_end.s_addr);
114
115 if (start && end && start < end &&
116 start > ntohl(addr.s_addr & ~mask.s_addr) &&
117 (start & ntohl(~mask.s_addr)) == start &&
118 (end & ntohl(~mask.s_addr)) == end) {
119 iface->dhcpv4_start.s_addr = htonl(start) |
120 (addr.s_addr & mask.s_addr);
121 iface->dhcpv4_end.s_addr = htonl(end) |
122 (addr.s_addr & mask.s_addr);
123 } else if (ntohl(mask.s_addr) <= 0xfffffff0) {
124 start = addr.s_addr & mask.s_addr;
125 end = addr.s_addr & mask.s_addr;
126
127 if (ntohl(mask.s_addr) <= 0xffffff00) {
128 iface->dhcpv4_start.s_addr = start | htonl(100);
129 iface->dhcpv4_end.s_addr = end | htonl(250);
130 } else if (ntohl(mask.s_addr) <= 0xffffffc0) {
131 iface->dhcpv4_start.s_addr = start | htonl(10);
132 iface->dhcpv4_end.s_addr = end | htonl(60);
133 } else if (ntohl(mask.s_addr) <= 0xffffffe0) {
134 iface->dhcpv4_start.s_addr = start | htonl(10);
135 iface->dhcpv4_end.s_addr = end | htonl(30);
136 } else {
137 iface->dhcpv4_start.s_addr = start | htonl(3);
138 iface->dhcpv4_end.s_addr = end | htonl(12);
139 }
140 }
141
142
143 }
144
145 /* Parse static entries */
146 struct lease *lease;
147 list_for_each_entry(lease, &leases, head) {
148 /* Construct entry */
149 struct dhcpv4_assignment *a = calloc(1, sizeof(*a));
150 if (!a) {
151 syslog(LOG_ERR, "Calloc failed for static lease on interface %s",
152 iface->ifname);
153 return -1;
154 }
155
156 a->leasetime = lease->dhcpv4_leasetime;
157
158 a->addr = ntohl(lease->ipaddr.s_addr);
159 memcpy(a->hwaddr, lease->mac.ether_addr_octet, sizeof(a->hwaddr));
160 /* Static assignment */
161 a->flags |= OAF_STATIC;
162 /* Infinite valid */
163 a->valid_until = 0;
164
165 /* Assign to all interfaces */
166 struct dhcpv4_assignment *c;
167 list_for_each_entry(c, &iface->dhcpv4_assignments, head) {
168 if (c->addr > a->addr) {
169 list_add_tail(&a->head, &c->head);
170 break;
171 } else if (c->addr == a->addr)
172 /* Already an assignment with that number */
173 break;
174 }
175
176 if (&c->head == &iface->dhcpv4_assignments)
177 list_add(&a->head, &iface->dhcpv4_assignments);
178
179 if (a->head.next) {
180 if (lease->hostname[0]) {
181 free(a->hostname);
182 a->hostname = strdup(lease->hostname);
183 }
184 } else
185 free_dhcpv4_assignment(a);
186 }
187
188 // Clean invalid assignments
189 struct dhcpv4_assignment *a, *n;
190 list_for_each_entry_safe(a, n, &iface->dhcpv4_assignments, head) {
191 if ((htonl(a->addr) & smask->sin_addr.s_addr) !=
192 (iface->dhcpv4_start.s_addr & smask->sin_addr.s_addr))
193 free_dhcpv4_assignment(a);
194 }
195
196 iface->dhcpv4_event.uloop.fd = sock;
197 iface->dhcpv4_event.handle_dgram = handle_dhcpv4;
198 odhcpd_register(&iface->dhcpv4_event);
199 } else if (iface->dhcpv4_assignments.next) {
200 while (!list_empty(&iface->dhcpv4_assignments))
201 free_dhcpv4_assignment(list_first_entry(&iface->dhcpv4_assignments,
202 struct dhcpv4_assignment, head));
203 }
204 return 0;
205 }
206
207 static char *dhcpv4_msg_to_string(uint8_t reqmsg)
208 {
209 switch (reqmsg) {
210 case (DHCPV4_MSG_DISCOVER):
211 return "DHCPV4_MSG_DISCOVER";
212 case (DHCPV4_MSG_OFFER):
213 return "DHCPV4_MSG_OFFER";
214 case (DHCPV4_MSG_REQUEST):
215 return "DHCPV4_MSG_REQUEST";
216 case (DHCPV4_MSG_DECLINE):
217 return "DHCPV4_MSG_DECLINE";
218 case (DHCPV4_MSG_ACK):
219 return "DHCPV4_MSG_ACK";
220 case (DHCPV4_MSG_NAK):
221 return "DHCPV4_MSG_NAK";
222 case (DHCPV4_MSG_RELEASE):
223 return "DHCPV4_MSG_RELEASE";
224 case (DHCPV4_MSG_INFORM):
225 return "DHCPV4_MSG_INFORM";
226 default:
227 return "UNKNOWN";
228 }
229 }
230
231 static void free_dhcpv4_assignment(struct dhcpv4_assignment *a)
232 {
233 if (a->head.next)
234 list_del(&a->head);
235
236 free(a->hostname);
237 free(a);
238 }
239
240 static void dhcpv4_put(struct dhcpv4_message *msg, uint8_t **cookie,
241 uint8_t type, uint8_t len, const void *data)
242 {
243 uint8_t *c = *cookie;
244 uint8_t *end = (uint8_t *)msg + sizeof(*msg);
245
246 if (*cookie + 2 + len > end)
247 return;
248
249 *c++ = type;
250 *c++ = len;
251 memcpy(c, data, len);
252
253 *cookie = c + len;
254 }
255
256 // Handler for DHCPv4 messages
257 static void handle_dhcpv4(void *addr, void *data, size_t len,
258 struct interface *iface, _unused void *dest_addr)
259 {
260 if (!iface->dhcpv4)
261 return;
262
263 struct dhcpv4_message *req = data;
264 if (len < offsetof(struct dhcpv4_message, options) + 4 ||
265 req->op != DHCPV4_BOOTREQUEST || req->hlen != 6)
266 return;
267
268 int sock = iface->dhcpv4_event.uloop.fd;
269 struct sockaddr_in ifaddr;
270 struct sockaddr_in ifnetmask;
271
272 syslog(LOG_NOTICE, "Got DHCPv4 request");
273
274 struct ifreq ifreq;
275 memcpy(ifreq.ifr_name, iface->ifname, sizeof(ifreq.ifr_name));
276 if (ioctl(sock, SIOCGIFADDR, &ifreq)) {
277 syslog(LOG_WARNING, "DHCPv4 failed to detect address: %s", strerror(errno));
278 return;
279 }
280
281 memcpy(&ifaddr, &ifreq.ifr_addr, sizeof(ifaddr));
282 if (ioctl(sock, SIOCGIFNETMASK, &ifreq))
283 return;
284
285 memcpy(&ifnetmask, &ifreq.ifr_netmask, sizeof(ifnetmask));
286 uint32_t network = ifaddr.sin_addr.s_addr & ifnetmask.sin_addr.s_addr;
287
288 if ((iface->dhcpv4_start.s_addr & ifnetmask.sin_addr.s_addr) != network ||
289 (iface->dhcpv4_end.s_addr & ifnetmask.sin_addr.s_addr) != network) {
290 syslog(LOG_WARNING, "DHCPv4 range out of assigned network");
291 return;
292 }
293
294 struct ifreq ifr = {.ifr_name = ""};
295 strncpy(ifr.ifr_name, iface->ifname, sizeof(ifr.ifr_name));
296
297 struct dhcpv4_message reply = {
298 .op = DHCPV4_BOOTREPLY,
299 .htype = 1,
300 .hlen = 6,
301 .hops = 0,
302 .xid = req->xid,
303 .secs = 0,
304 .flags = req->flags,
305 .ciaddr = {INADDR_ANY},
306 .giaddr = req->giaddr,
307 .siaddr = ifaddr.sin_addr,
308 };
309 memcpy(reply.chaddr, req->chaddr, sizeof(reply.chaddr));
310
311 reply.options[0] = 0x63;
312 reply.options[1] = 0x82;
313 reply.options[2] = 0x53;
314 reply.options[3] = 0x63;
315
316 uint8_t *cookie = &reply.options[4];
317 uint8_t reqmsg = DHCPV4_MSG_REQUEST;
318 uint8_t msg = DHCPV4_MSG_ACK;
319
320 struct in_addr reqaddr = {INADDR_ANY};
321 uint32_t leasetime = 0;
322 size_t hostname_len = 0;
323 char hostname[256];
324
325 uint8_t *start = &req->options[4];
326 uint8_t *end = ((uint8_t*)data) + len;
327 struct dhcpv4_option *opt;
328 dhcpv4_for_each_option(start, end, opt) {
329 if (opt->type == DHCPV4_OPT_MESSAGE && opt->len == 1)
330 reqmsg = opt->data[0];
331 else if (opt->type == DHCPV4_OPT_HOSTNAME && opt->len > 0) {
332 hostname_len = opt->len;
333 memcpy(hostname, opt->data, hostname_len);
334 hostname[hostname_len] = 0;
335 } else if (opt->type == DHCPV4_OPT_IPADDRESS && opt->len == 4)
336 memcpy(&reqaddr, opt->data, 4);
337 else if (opt->type == DHCPV4_OPT_SERVERID && opt->len == 4) {
338 if (memcmp(opt->data, &ifaddr.sin_addr, 4))
339 return;
340 } else if (iface->filter_class && opt->type == DHCPV4_OPT_USER_CLASS) {
341 uint8_t *c = opt->data, *cend = &opt->data[opt->len];
342 for (; c < cend && &c[*c] < cend; c = &c[1 + *c]) {
343 size_t elen = strlen(iface->filter_class);
344 if (*c == elen && !memcmp(&c[1], iface->filter_class, elen))
345 return; // Ignore from homenet
346 }
347 } else if (opt->type == DHCPV4_OPT_LEASETIME && opt->len == 4)
348 memcpy(&leasetime, opt->data, 4);
349 }
350
351 if (reqmsg != DHCPV4_MSG_DISCOVER && reqmsg != DHCPV4_MSG_REQUEST &&
352 reqmsg != DHCPV4_MSG_INFORM && reqmsg != DHCPV4_MSG_DECLINE &&
353 reqmsg != DHCPV4_MSG_RELEASE)
354 return;
355
356 struct dhcpv4_assignment *lease = NULL;
357 if (reqmsg != DHCPV4_MSG_INFORM)
358 lease = dhcpv4_lease(iface, reqmsg, req->chaddr, reqaddr,
359 &leasetime, hostname, hostname_len);
360
361 if (!lease) {
362 if (reqmsg == DHCPV4_MSG_REQUEST)
363 msg = DHCPV4_MSG_NAK;
364 else if (reqmsg == DHCPV4_MSG_DISCOVER)
365 return;
366 } else if (reqmsg == DHCPV4_MSG_DISCOVER)
367 msg = DHCPV4_MSG_OFFER;
368 else if (reqmsg == DHCPV4_MSG_REQUEST && reqaddr.s_addr &&
369 reqaddr.s_addr != htonl(lease->addr)) {
370 msg = DHCPV4_MSG_NAK;
371 /*
372 * DHCP client requested an IP which we can't offer to him. Probably the
373 * client changed the network. The reply type is set to DHCPV4_MSG_NAK,
374 * because the client should not use that IP.
375 *
376 * For modern devices we build an answer that includes a valid IP, like
377 * a DHCPV4_MSG_ACK. The client will use that IP and doesn't need to
378 * perform additional DHCP round trips.
379 *
380 */
381 }
382
383 syslog(LOG_WARNING, "received %s from %x:%x:%x:%x:%x:%x",
384 dhcpv4_msg_to_string(reqmsg),
385 req->chaddr[0],req->chaddr[1],req->chaddr[2],
386 req->chaddr[3],req->chaddr[4],req->chaddr[5]);
387
388 if (reqmsg == DHCPV4_MSG_DECLINE || reqmsg == DHCPV4_MSG_RELEASE)
389 return;
390
391 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_MESSAGE, 1, &msg);
392 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_SERVERID, 4, &ifaddr.sin_addr);
393
394 if (lease) {
395 uint32_t val;
396
397 reply.yiaddr.s_addr = htonl(lease->addr);
398
399 val = htonl(leasetime);
400 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_LEASETIME, 4, &val);
401
402 if (leasetime != UINT32_MAX) {
403 val = htonl(500 * leasetime / 1000);
404 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_RENEW, 4, &val);
405
406 val = htonl(875 * leasetime / 1000);
407 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_REBIND, 4, &val);
408 }
409
410 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_NETMASK, 4, &ifnetmask.sin_addr);
411
412 if (lease->hostname)
413 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_HOSTNAME,
414 strlen(lease->hostname), lease->hostname);
415
416 if (!ioctl(sock, SIOCGIFBRDADDR, &ifr)) {
417 struct sockaddr_in *ina = (struct sockaddr_in*)&ifr.ifr_broadaddr;
418 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_BROADCAST, 4, &ina->sin_addr);
419 }
420 }
421
422 if (!ioctl(sock, SIOCGIFMTU, &ifr)) {
423 uint16_t mtu = htons(ifr.ifr_mtu);
424 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_MTU, 2, &mtu);
425 }
426
427 if (iface->search && iface->search_len <= 255)
428 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_SEARCH_DOMAIN,
429 iface->search_len, iface->search);
430 else if (!res_init() && _res.dnsrch[0] && _res.dnsrch[0][0]) {
431 uint8_t search_buf[256];
432 int len = dn_comp(_res.dnsrch[0], search_buf,
433 sizeof(search_buf), NULL, NULL);
434 if (len > 0)
435 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_SEARCH_DOMAIN,
436 len, search_buf);
437 }
438
439 if (iface->dhcpv4_router_cnt == 0)
440 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_ROUTER, 4, &ifaddr.sin_addr);
441 else
442 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_ROUTER,
443 4 * iface->dhcpv4_router_cnt, iface->dhcpv4_router);
444
445
446 if (iface->dhcpv4_dns_cnt == 0)
447 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_DNSSERVER, 4, &ifaddr.sin_addr);
448 else
449 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_DNSSERVER,
450 4 * iface->dhcpv4_dns_cnt, iface->dhcpv4_dns);
451
452
453 dhcpv4_put(&reply, &cookie, DHCPV4_OPT_END, 0, NULL);
454
455 struct sockaddr_in dest = *((struct sockaddr_in*)addr);
456 if (req->giaddr.s_addr) {
457 /*
458 * relay agent is configured, send reply to the agent
459 */
460 dest.sin_addr = req->giaddr;
461 dest.sin_port = htons(DHCPV4_SERVER_PORT);
462 } else if (req->ciaddr.s_addr && req->ciaddr.s_addr != dest.sin_addr.s_addr) {
463 /*
464 * client has existing configuration (ciaddr is set) AND this address is
465 * not the address it used for the dhcp message
466 */
467 dest.sin_addr = req->ciaddr;
468 dest.sin_port = htons(DHCPV4_CLIENT_PORT);
469 } else if ((ntohs(req->flags) & DHCPV4_FLAG_BROADCAST) ||
470 req->hlen != reply.hlen || !reply.yiaddr.s_addr) {
471 /*
472 * client requests a broadcast reply OR we can't offer an IP
473 */
474 dest.sin_addr.s_addr = INADDR_BROADCAST;
475 dest.sin_port = htons(DHCPV4_CLIENT_PORT);
476 } else if (!req->ciaddr.s_addr && msg == DHCPV4_MSG_NAK) {
477 /*
478 * client has no previous configuration -> no IP, so we need to reply
479 * with a broadcast packet
480 */
481 dest.sin_addr.s_addr = INADDR_BROADCAST;
482 dest.sin_port = htons(DHCPV4_CLIENT_PORT);
483 } else {
484 /*
485 * send reply to the newly (in this proccess) allocated IP
486 */
487 dest.sin_addr = reply.yiaddr;
488 dest.sin_port = htons(DHCPV4_CLIENT_PORT);
489
490 struct arpreq arp = {.arp_flags = ATF_COM};
491 memcpy(arp.arp_ha.sa_data, req->chaddr, 6);
492 memcpy(&arp.arp_pa, &dest, sizeof(arp.arp_pa));
493 memcpy(arp.arp_dev, iface->ifname, sizeof(arp.arp_dev));
494 ioctl(sock, SIOCSARP, &arp);
495 }
496
497 if (dest.sin_addr.s_addr == INADDR_BROADCAST)
498 /* reply goes to IP broadcast -> MAC broadcast */
499 syslog(LOG_WARNING, "sending %s to ff:ff:ff:ff:ff:ff - %s",
500 dhcpv4_msg_to_string(msg),
501 inet_ntoa(dest.sin_addr));
502 else
503 /*
504 * reply is send directly to IP,
505 * MAC is assumed to be the same as the request
506 */
507 syslog(LOG_WARNING, "sending %s to %x:%x:%x:%x:%x:%x - %s",
508 dhcpv4_msg_to_string(msg),
509 req->chaddr[0],req->chaddr[1],req->chaddr[2],
510 req->chaddr[3],req->chaddr[4],req->chaddr[5],
511 inet_ntoa(dest.sin_addr));
512
513 sendto(sock, &reply, sizeof(reply), MSG_DONTWAIT,
514 (struct sockaddr*)&dest, sizeof(dest));
515 }
516
517 static bool dhcpv4_test(struct interface *iface, uint32_t try)
518 {
519 struct dhcpv4_assignment *c;
520 list_for_each_entry(c, &iface->dhcpv4_assignments, head) {
521 if (c->addr == try)
522 return false;
523
524 }
525
526 return true;
527 }
528
529 static bool dhcpv4_assign(struct interface *iface,
530 struct dhcpv4_assignment *assign, uint32_t raddr)
531 {
532 uint32_t start = ntohl(iface->dhcpv4_start.s_addr);
533 uint32_t end = ntohl(iface->dhcpv4_end.s_addr);
534 uint32_t count = end - start + 1;
535
536 // try to assign the IP the client asked for
537 if (start <= raddr && raddr <= end && dhcpv4_test(iface, raddr)) {
538 assign->addr = raddr;
539 list_add(&assign->head, &iface->dhcpv4_assignments);
540 syslog(LOG_INFO, "assigning the IP the client asked for: %u.%u.%u.%u",
541 (assign->addr & 0xff000000) >> 24,
542 (assign->addr & 0x00ff0000) >> 16,
543 (assign->addr & 0x0000ff00) >> 8,
544 (assign->addr & 0x000000ff));
545 return true;
546 }
547
548 // Seed RNG with checksum of hwaddress
549 uint32_t seed = 0;
550 for (size_t i = 0; i < sizeof(assign->hwaddr); ++i) {
551 // Knuth's multiplicative method
552 uint8_t o = assign->hwaddr[i];
553 seed += (o*2654435761) % UINT32_MAX;
554 }
555
556 srand(seed);
557
558 uint32_t try = (((uint32_t)rand()) % count) + start;
559
560 if (list_empty(&iface->dhcpv4_assignments)) {
561 assign->addr = try;
562 list_add(&assign->head, &iface->dhcpv4_assignments);
563 syslog(LOG_INFO, "assigning mapped IP (empty list): %u.%u.%u.%u",
564 (assign->addr & 0xff000000) >> 24,
565 (assign->addr & 0x00ff0000) >> 16,
566 (assign->addr & 0x0000ff00) >> 8,
567 (assign->addr & 0x000000ff));
568 return true;
569 }
570
571 for (uint32_t i = 0; i < count; ++i) {
572 if (dhcpv4_test(iface, try)) {
573 /* test was successful: IP address is not assigned, assign it */
574 assign->addr = try;
575 list_add(&assign->head, &iface->dhcpv4_assignments);
576 syslog(LOG_DEBUG, "assigning mapped IP: %u.%u.%u.%u (try %u of %u)",
577 (assign->addr & 0xff000000) >> 24,
578 (assign->addr & 0x00ff0000) >> 16,
579 (assign->addr & 0x0000ff00) >> 8,
580 (assign->addr & 0x000000ff), i, count);
581 return true;
582 }
583 try = (((try - start) + 1) % count) + start;
584 }
585
586 syslog(LOG_WARNING, "can't assign any IP address -> address space is full");
587 return false;
588 }
589
590
591 static struct dhcpv4_assignment* dhcpv4_lease(struct interface *iface,
592 enum dhcpv4_msg msg, const uint8_t *mac, struct in_addr reqaddr,
593 uint32_t *leasetime, const char *hostname, const size_t hostname_len)
594 {
595 struct dhcpv4_assignment *lease = NULL;
596 uint32_t raddr = ntohl(reqaddr.s_addr);
597 time_t now = odhcpd_time();
598
599 struct dhcpv4_assignment *c, *n, *a = NULL;
600 list_for_each_entry_safe(c, n, &iface->dhcpv4_assignments, head) {
601 if (!memcmp(c->hwaddr, mac, 6)) {
602 a = c;
603 if (c->addr == raddr)
604 break;
605 } else if (!INFINITE_VALID(c->valid_until) && c->valid_until < now)
606 free_dhcpv4_assignment(c);
607 }
608
609 if (msg == DHCPV4_MSG_DISCOVER || msg == DHCPV4_MSG_REQUEST) {
610 bool assigned = !!a;
611 uint32_t my_leasetime;
612
613 if (!a && !iface->no_dynamic_dhcp) {
614 /* Create new binding */
615 a = calloc(1, sizeof(*a));
616 if (!a) {
617 syslog(LOG_ERR, "Failed to calloc binding on interface %s", iface->ifname);
618 return NULL;
619 }
620 memcpy(a->hwaddr, mac, sizeof(a->hwaddr));
621 /* Don't consider new assignment as infinite */
622 a->valid_until = now;
623
624 assigned = dhcpv4_assign(iface, a, raddr);
625 }
626
627 if (a->leasetime)
628 my_leasetime = a->leasetime;
629 else
630 my_leasetime = iface->dhcpv4_leasetime;
631
632 if ((*leasetime == 0) || (my_leasetime < *leasetime))
633 *leasetime = my_leasetime;
634
635 if (assigned) {
636 if (msg == DHCPV4_MSG_DISCOVER) {
637 a->flags &= ~OAF_BOUND;
638
639 if (!(a->flags & OAF_STATIC))
640 a->valid_until = now;
641 } else {
642 if (hostname_len > 0) {
643 a->hostname = realloc(a->hostname, hostname_len + 1);
644 if (a->hostname) {
645 memcpy(a->hostname, hostname, hostname_len);
646 a->hostname[hostname_len] = 0;
647 }
648 }
649
650 a->flags |= OAF_BOUND;
651
652 if (!(a->flags & OAF_STATIC))
653 a->valid_until = ((*leasetime == UINT32_MAX) ? 0 : (time_t)(now + *leasetime));
654 }
655 } else if (!assigned && a) {
656 /* Cleanup failed assignment */
657 free_dhcpv4_assignment(a);
658 a = NULL;
659 }
660
661 if (assigned && a)
662 lease = a;
663 } else if (msg == DHCPV4_MSG_RELEASE && a) {
664 a->flags &= ~OAF_BOUND;
665
666 if (!(a->flags & OAF_STATIC))
667 a->valid_until = now - 1;
668
669 } else if (msg == DHCPV4_MSG_DECLINE && a) {
670 a->flags &= ~OAF_BOUND;
671
672 if (!(a->flags & OAF_STATIC)) {
673 memset(a->hwaddr, 0, sizeof(a->hwaddr));
674 a->valid_until = now + 3600; /* Block address for 1h */
675 }
676 }
677
678 dhcpv6_write_statefile();
679
680 return lease;
681 }