ISC DHCP  4.3.6
A reference DHCPv4 and DHCPv6 implementation
dhcpv6.c
Go to the documentation of this file.
1 /*
2  * Copyright (C) 2006-2017 by Internet Systems Consortium, Inc. ("ISC")
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
9  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
10  * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
11  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
12  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
13  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
14  * PERFORMANCE OF THIS SOFTWARE.
15  */
16 
19 #include "dhcpd.h"
20 
21 #ifdef DHCPv6
22 
23 #ifdef DHCP4o6
24 static void forw_dhcpv4_query(struct packet *packet);
25 static void send_dhcpv4_response(struct data_string *raw);
26 
27 static void recv_dhcpv4_query(struct data_string *raw);
28 static void dhcp4o6_dhcpv4_query(struct data_string *reply_ret,
29  struct packet *packet);
30 #endif
31 
32 /*
33  * We use print_hex_1() to output DUID values. We could actually output
34  * the DUID with more information... MAC address if using type 1 or 3,
35  * and so on. However, RFC 3315 contains Grave Warnings against actually
36  * attempting to understand a DUID.
37  */
38 
39 /*
40  * TODO: gettext() or other method of localization for the messages
41  * for status codes (and probably for log formats eventually)
42  * TODO: refactoring (simplify, simplify, simplify)
43  * TODO: support multiple shared_networks on each interface (this
44  * will allow the server to issue multiple IPv6 addresses to
45  * a single interface)
46  */
47 
48 /*
49  * DHCPv6 Reply workflow assist. A Reply packet is built by various
50  * different functions; this gives us one location where we keep state
51  * regarding a reply.
52  */
53 struct reply_state {
54  /* root level persistent state */
55  struct shared_network *shared;
56  struct host_decl *host;
57  struct subnet *subnet; /* Used to match fixed-addrs to subnet scopes. */
58  struct option_state *opt_state;
59  struct packet *packet;
60  struct data_string client_id;
61 
62  /* IA level persistent state */
63  unsigned ia_count;
64  unsigned pd_count;
65  unsigned client_resources;
66  isc_boolean_t resources_included;
67  isc_boolean_t static_lease;
68  unsigned static_prefixes;
69  struct ia_xx *ia;
70  struct ia_xx *old_ia;
71  struct option_state *reply_ia;
72  struct data_string fixed;
73  struct iaddrcidrnet fixed_pref; /* static prefix for logging */
74 
75  /* IAADDR/PREFIX level persistent state */
76  struct iasubopt *lease;
77 
78  /*
79  * "t1", "t2", preferred, and valid lifetimes records for calculating
80  * t1 and t2 (min/max).
81  */
82  u_int32_t renew, rebind, min_prefer, min_valid;
83 
84  /* Client-requested valid and preferred lifetimes. */
85  u_int32_t client_valid, client_prefer;
86 
87  /* Chosen values to transmit for valid and preferred lifetimes. */
88  u_int32_t send_valid, send_prefer;
89 
90  /* Preferred prefix length (-1 is any). */
91  int preflen;
92 
93  /* Index into the data field that has been consumed. */
94  unsigned cursor;
95 
96  /* Space for the on commit statements for a fixed host */
97  struct on_star on_star;
98 
99  union reply_buffer {
100  unsigned char data[65536];
101  struct dhcpv6_packet reply;
102  } buf;
103 };
104 
105 /*
106  * Prototypes local to this file.
107  */
108 static int get_encapsulated_IA_state(struct option_state **enc_opt_state,
109  struct data_string *enc_opt_data,
110  struct packet *packet,
111  struct option_cache *oc,
112  int offset);
113 static void build_dhcpv6_reply(struct data_string *, struct packet *);
114 static isc_result_t shared_network_from_packet6(struct shared_network **shared,
115  struct packet *packet);
116 static void seek_shared_host(struct host_decl **hp,
117  struct shared_network *shared);
118 static isc_boolean_t fixed_matches_shared(struct host_decl *host,
119  struct shared_network *shared);
120 static isc_result_t reply_process_ia_na(struct reply_state *reply,
121  struct option_cache *ia);
122 static isc_result_t reply_process_ia_ta(struct reply_state *reply,
123  struct option_cache *ia);
124 static isc_result_t reply_process_addr(struct reply_state *reply,
125  struct option_cache *addr);
126 static isc_boolean_t address_is_owned(struct reply_state *reply,
127  struct iaddr *addr);
128 static isc_boolean_t temporary_is_available(struct reply_state *reply,
129  struct iaddr *addr);
130 static isc_result_t find_client_temporaries(struct reply_state *reply);
131 static isc_result_t reply_process_try_addr(struct reply_state *reply,
132  struct iaddr *addr);
133 static isc_result_t find_client_address(struct reply_state *reply);
134 static isc_result_t reply_process_is_addressed(struct reply_state *reply,
135  struct binding_scope **scope,
136  struct group *group);
137 static isc_result_t reply_process_send_addr(struct reply_state *reply,
138  struct iaddr *addr);
139 static struct iasubopt *lease_compare(struct iasubopt *alpha,
140  struct iasubopt *beta);
141 static isc_result_t reply_process_ia_pd(struct reply_state *reply,
142  struct option_cache *ia_pd);
143 static struct group *find_group_by_prefix(struct reply_state *reply);
144 static isc_result_t reply_process_prefix(struct reply_state *reply,
145  struct option_cache *pref);
146 static isc_boolean_t prefix_is_owned(struct reply_state *reply,
147  struct iaddrcidrnet *pref);
148 static isc_result_t find_client_prefix(struct reply_state *reply);
149 static isc_result_t reply_process_try_prefix(struct reply_state *reply,
150  struct iaddrcidrnet *pref);
151 static isc_result_t reply_process_is_prefixed(struct reply_state *reply,
152  struct binding_scope **scope,
153  struct group *group);
154 static isc_result_t reply_process_send_prefix(struct reply_state *reply,
155  struct iaddrcidrnet *pref);
156 static struct iasubopt *prefix_compare(struct reply_state *reply,
157  struct iasubopt *alpha,
158  struct iasubopt *beta);
159 static void schedule_lease_timeout_reply(struct reply_state *reply);
160 
161 static int eval_prefix_mode(int thislen, int preflen, int prefix_mode);
162 static isc_result_t pick_v6_prefix_helper(struct reply_state *reply,
163  int prefix_mode);
164 
165 static void unicast_reject(struct data_string *reply_ret, struct packet *packet,
166  const struct data_string *client_id,
167  const struct data_string *server_id);
168 
169 static isc_boolean_t is_unicast_option_defined(struct packet *packet);
170 static isc_result_t shared_network_from_requested_addr (struct shared_network
171  **shared,
172  struct packet* packet);
173 static isc_result_t get_first_ia_addr_val (struct packet* packet, int addr_type,
174  struct iaddr* iaddr);
175 
176 static void
177 set_reply_tee_times(struct reply_state* reply, unsigned ia_cursor);
178 
179 #ifdef DHCP4o6
180 /*
181  * \brief Omapi I/O handler
182  *
183  * The inter-process communication receive handler.
184  * Get the message, put it into the raw data_string
185  * and call \ref send_dhcpv4_response() (DHCPv6 side) or
186  * \ref recv_dhcpv4_query() (DHCPv4 side)
187  *
188  * \param h the OMAPI object
189  * \return a result for I/O success or error (used by the I/O subsystem)
190  */
191 isc_result_t dhcpv4o6_handler(omapi_object_t *h) {
192  char buf[65536];
193  struct data_string raw;
194  int cc;
195 
196  if (h->type != dhcp4o6_type)
197  return DHCP_R_INVALIDARG;
198 
199  cc = recv(dhcp4o6_fd, buf, sizeof(buf), 0);
200 
201  if (cc < DHCP_FIXED_NON_UDP + 32)
202  return ISC_R_UNEXPECTED;
203  memset(&raw, 0, sizeof(raw));
204  if (!buffer_allocate(&raw.buffer, cc, MDL)) {
205  log_error("dhcpv4o6_handler: no memory buffer.");
206  return ISC_R_NOMEMORY;
207  }
208  raw.data = raw.buffer->data;
209  raw.len = cc;
210  memcpy(raw.buffer->data, buf, cc);
211 
212  if (local_family == AF_INET6) {
213  send_dhcpv4_response(&raw);
214  } else {
215  recv_dhcpv4_query(&raw);
216  }
217 
218  data_string_forget(&raw, MDL);
219 
220  return ISC_R_SUCCESS;
221 }
222 
223 /*
224  * \brief Send the DHCPv4-response back to the DHCPv6 side
225  * (DHCPv6 server function)
226  *
227  * Format: interface:16 + address:16 + DHCPv6 DHCPv4-response message
228  *
229  * \param raw the IPC message content
230  */
231 static void send_dhcpv4_response(struct data_string *raw) {
232  struct interface_info *ip;
233  char name[16 + 1];
234  struct sockaddr_in6 to_addr;
235  char pbuf[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
236  int send_ret;
237 
238  memset(name, 0, sizeof(name));
239  memcpy(name, raw->data, 16);
240  for (ip = interfaces; ip != NULL; ip = ip->next) {
241  if (!strcmp(name, ip->name))
242  break;
243  }
244  if (ip == NULL) {
245  log_error("send_dhcpv4_response: can't find interface %s.",
246  name);
247  return;
248  }
249 
250  memset(&to_addr, 0, sizeof(to_addr));
251  to_addr.sin6_family = AF_INET6;
252  memcpy(&to_addr.sin6_addr, raw->data + 16, 16);
253  if ((raw->data[32] == DHCPV6_RELAY_FORW) ||
254  (raw->data[32] == DHCPV6_RELAY_REPL)) {
255  to_addr.sin6_port = local_port;
256  } else {
257  to_addr.sin6_port = remote_port;
258  }
259 
260  log_info("send_dhcpv4_response(): sending %s on %s to %s port %d",
261  dhcpv6_type_names[raw->data[32]],
262  name,
263  inet_ntop(AF_INET6, raw->data + 16, pbuf, sizeof(pbuf)),
264  ntohs(to_addr.sin6_port));
265 
266  send_ret = send_packet6(ip, raw->data + 32, raw->len - 32, &to_addr);
267  if (send_ret < 0) {
268  log_error("send_dhcpv4_response: send_packet6(): %m");
269  } else if (send_ret != raw->len - 32) {
270  log_error("send_dhcpv4_response: send_packet6() "
271  "sent %d of %d bytes",
272  send_ret, raw->len - 32);
273  }
274 }
275 #endif /* DHCP4o6 */
276 
277 /*
278  * Schedule lease timeouts for all of the iasubopts in the reply.
279  * This is currently used to schedule timeouts for soft leases.
280  */
281 
282 static void
283 schedule_lease_timeout_reply(struct reply_state *reply) {
284  struct iasubopt *tmp;
285  int i;
286 
287  /* sanity check the reply */
288  if ((reply == NULL) || (reply->ia == NULL) || (reply->ia->iasubopt == NULL))
289  return;
290 
291  /* walk through the list, scheduling as we go */
292  for (i = 0 ; i < reply->ia->num_iasubopt ; i++) {
293  tmp = reply->ia->iasubopt[i];
295  }
296 }
297 
298 /*
299  * This function returns the time since DUID time start for the
300  * given time_t value.
301  */
302 static u_int32_t
303 duid_time(time_t when) {
304  /*
305  * This time is modulo 2^32.
306  */
307  while ((when - DUID_TIME_EPOCH) > 4294967295u) {
308  /* use 2^31 to avoid spurious compiler warnings */
309  when -= 2147483648u;
310  when -= 2147483648u;
311  }
312 
313  return when - DUID_TIME_EPOCH;
314 }
315 
316 
317 /*
318  * Server DUID.
319  *
320  * This must remain the same for the lifetime of this server, because
321  * clients return the server DUID that we sent them in Request packets.
322  *
323  * We pick the server DUID like this:
324  *
325  * 1. Check dhcpd.conf - any value the administrator has configured
326  * overrides any possible values.
327  * 2. Check the leases.txt - we want to use the previous value if
328  * possible.
329  * 3. Check if dhcpd.conf specifies a type of server DUID to use,
330  * and generate that type.
331  * 4. Generate a type 1 (time + hardware address) DUID.
332  */
333 static struct data_string server_duid;
334 
335 /*
336  * Check if the server_duid has been set.
337  */
338 isc_boolean_t
339 server_duid_isset(void) {
340  return (server_duid.data != NULL);
341 }
342 
343 /*
344  * Return the server_duid.
345  */
346 void
347 copy_server_duid(struct data_string *ds, const char *file, int line) {
348  data_string_copy(ds, &server_duid, file, line);
349 }
350 
351 /*
352  * Set the server DUID to a specified value. This is used when
353  * the server DUID is stored in persistent memory (basically the
354  * leases.txt file).
355  */
356 void
357 set_server_duid(struct data_string *new_duid) {
358  /* INSIST(new_duid != NULL); */
359  /* INSIST(new_duid->data != NULL); */
360 
361  if (server_duid_isset()) {
362  data_string_forget(&server_duid, MDL);
363  }
364  data_string_copy(&server_duid, new_duid, MDL);
365 }
366 
367 
368 /*
369  * Set the server DUID based on the D6O_SERVERID option. This handles
370  * the case where the administrator explicitly put it in the dhcpd.conf
371  * file.
372  */
373 isc_result_t
375  struct option_state *opt_state;
376  struct option_cache *oc;
377  struct data_string option_duid;
378  isc_result_t ret_val;
379 
380  opt_state = NULL;
381  if (!option_state_allocate(&opt_state, MDL)) {
382  log_fatal("No memory for server DUID.");
383  }
384 
385  execute_statements_in_scope(NULL, NULL, NULL, NULL, NULL,
386  opt_state, &global_scope, root_group,
387  NULL, NULL);
388 
389  oc = lookup_option(&dhcpv6_universe, opt_state, D6O_SERVERID);
390  if (oc == NULL) {
391  ret_val = ISC_R_NOTFOUND;
392  } else {
393  memset(&option_duid, 0, sizeof(option_duid));
394  if (!evaluate_option_cache(&option_duid, NULL, NULL, NULL,
395  opt_state, NULL, &global_scope,
396  oc, MDL)) {
397  ret_val = ISC_R_UNEXPECTED;
398  } else {
399  set_server_duid(&option_duid);
400  data_string_forget(&option_duid, MDL);
401  ret_val = ISC_R_SUCCESS;
402  }
403  }
404 
405  option_state_dereference(&opt_state, MDL);
406 
407  return ret_val;
408 }
409 
410 /*
411  * DUID layout, as defined in RFC 3315, section 9.
412  *
413  * We support type 1 (hardware address plus time) and type 3 (hardware
414  * address).
415  *
416  * We can support type 2 for specific vendors in the future, if they
417  * publish the specification. And of course there may be additional
418  * types later.
419  */
420 static int server_duid_type = DUID_LLT;
421 
422 /*
423  * Set the DUID type.
424  */
425 void
426 set_server_duid_type(int type) {
427  server_duid_type = type;
428 }
429 
430 /*
431  * Generate a new server DUID. This is done if there was no DUID in
432  * the leases.txt or in the dhcpd.conf file.
433  */
434 isc_result_t
436  struct interface_info *p;
437  u_int32_t time_val;
438  struct data_string generated_duid;
439 
440  /*
441  * Verify we have a type that we support.
442  */
443  if ((server_duid_type != DUID_LL) && (server_duid_type != DUID_LLT)) {
444  log_error("Invalid DUID type %d specified, "
445  "only LL and LLT types supported", server_duid_type);
446  return DHCP_R_INVALIDARG;
447  }
448 
449  /*
450  * Find an interface with a hardware address.
451  * Any will do. :)
452  */
453  for (p = interfaces; p != NULL; p = p->next) {
454  if (p->hw_address.hlen > 0) {
455  break;
456  }
457  if (p->next == NULL && p->hw_address.hbuf[0] == HTYPE_RESERVED) {
458  log_error("Can not generate DUID from interfaces which do not have hardware addresses, please configure server-duid!");
459  }
460  }
461  if (p == NULL) {
462  return ISC_R_UNEXPECTED;
463  }
464 
465  /*
466  * Build our DUID.
467  */
468  memset(&generated_duid, 0, sizeof(generated_duid));
469  if (server_duid_type == DUID_LLT) {
470  time_val = duid_time(time(NULL));
471  generated_duid.len = 8 + p->hw_address.hlen - 1;
472  if (!buffer_allocate(&generated_duid.buffer,
473  generated_duid.len, MDL)) {
474  log_fatal("No memory for server DUID.");
475  }
476  generated_duid.data = generated_duid.buffer->data;
477  putUShort(generated_duid.buffer->data, DUID_LLT);
478  putUShort(generated_duid.buffer->data + 2,
479  p->hw_address.hbuf[0]);
480  putULong(generated_duid.buffer->data + 4, time_val);
481  memcpy(generated_duid.buffer->data + 8,
482  p->hw_address.hbuf+1, p->hw_address.hlen-1);
483  } else if (server_duid_type == DUID_LL) {
484  generated_duid.len = 4 + p->hw_address.hlen - 1;
485  if (!buffer_allocate(&generated_duid.buffer,
486  generated_duid.len, MDL)) {
487  log_fatal("No memory for server DUID.");
488  }
489  generated_duid.data = generated_duid.buffer->data;
490  putUShort(generated_duid.buffer->data, DUID_LL);
491  putUShort(generated_duid.buffer->data + 2,
492  p->hw_address.hbuf[0]);
493  memcpy(generated_duid.buffer->data + 4,
494  p->hw_address.hbuf+1, p->hw_address.hlen-1);
495  } else {
496  log_fatal("Unsupported server DUID type %d.", server_duid_type);
497  }
498 
499  set_server_duid(&generated_duid);
500  data_string_forget(&generated_duid, MDL);
501 
502  return ISC_R_SUCCESS;
503 }
504 
505 /*
506  * Get the client identifier from the packet.
507  */
508 isc_result_t
509 get_client_id(struct packet *packet, struct data_string *client_id) {
510  struct option_cache *oc;
511 
512  /*
513  * Verify our client_id structure is empty.
514  */
515  if ((client_id->data != NULL) || (client_id->len != 0)) {
516  return DHCP_R_INVALIDARG;
517  }
518 
520  if (oc == NULL) {
521  return ISC_R_NOTFOUND;
522  }
523 
524  if (!evaluate_option_cache(client_id, packet, NULL, NULL,
525  packet->options, NULL,
526  &global_scope, oc, MDL)) {
527  return ISC_R_FAILURE;
528  }
529 
530  return ISC_R_SUCCESS;
531 }
532 
533 /*
534  * Message validation, defined in RFC 3315, sections 15.2, 15.5, 15.7:
535  *
536  * Servers MUST discard any Solicit messages that do not include a
537  * Client Identifier option or that do include a Server Identifier
538  * option.
539  */
540 int
541 valid_client_msg(struct packet *packet, struct data_string *client_id) {
542  int ret_val;
543  struct option_cache *oc;
544  struct data_string data;
545 
546  ret_val = 0;
547  memset(client_id, 0, sizeof(*client_id));
548  memset(&data, 0, sizeof(data));
549 
550  switch (get_client_id(packet, client_id)) {
551  case ISC_R_SUCCESS:
552  break;
553  case ISC_R_NOTFOUND:
554  log_debug("Discarding %s from %s; "
555  "client identifier missing",
558  goto exit;
559  default:
560  log_error("Error processing %s from %s; "
561  "unable to evaluate Client Identifier",
564  goto exit;
565  }
566 
567  /*
568  * Required by RFC 3315, section 15.
569  */
570  if (packet->unicast) {
571  log_debug("Discarding %s from %s; packet sent unicast "
572  "(CLIENTID %s)",
575  print_hex_1(client_id->len, client_id->data, 60));
576  goto exit;
577  }
578 
579 
581  if (oc != NULL) {
582  if (evaluate_option_cache(&data, packet, NULL, NULL,
583  packet->options, NULL,
584  &global_scope, oc, MDL)) {
585  log_debug("Discarding %s from %s; "
586  "server identifier found "
587  "(CLIENTID %s, SERVERID %s)",
590  print_hex_1(client_id->len,
591  client_id->data, 60),
592  print_hex_2(data.len,
593  data.data, 60));
594  } else {
595  log_debug("Discarding %s from %s; "
596  "server identifier found "
597  "(CLIENTID %s)",
599  print_hex_1(client_id->len,
600  client_id->data, 60),
602  }
603  goto exit;
604  }
605 
606  /* looks good */
607  ret_val = 1;
608 
609 exit:
610  if (data.len > 0) {
612  }
613  if (!ret_val) {
614  if (client_id->len > 0) {
615  data_string_forget(client_id, MDL);
616  }
617  }
618  return ret_val;
619 }
620 
621 /*
622  * Response validation, defined in RFC 3315, sections 15.4, 15.6, 15.8,
623  * 15.9 (slightly different wording, but same meaning):
624  *
625  * Servers MUST discard any received Request message that meet any of
626  * the following conditions:
627  *
628  * - the message does not include a Server Identifier option.
629  * - the contents of the Server Identifier option do not match the
630  * server's DUID.
631  * - the message does not include a Client Identifier option.
632  */
633 int
634 valid_client_resp(struct packet *packet,
635  struct data_string *client_id,
636  struct data_string *server_id)
637 {
638  int ret_val;
639  struct option_cache *oc;
640 
641  /* INSIST((duid.data != NULL) && (duid.len > 0)); */
642 
643  ret_val = 0;
644  memset(client_id, 0, sizeof(*client_id));
645  memset(server_id, 0, sizeof(*server_id));
646 
647  switch (get_client_id(packet, client_id)) {
648  case ISC_R_SUCCESS:
649  break;
650  case ISC_R_NOTFOUND:
651  log_debug("Discarding %s from %s; "
652  "client identifier missing",
655  goto exit;
656  default:
657  log_error("Error processing %s from %s; "
658  "unable to evaluate Client Identifier",
661  goto exit;
662  }
663 
665  if (oc == NULL) {
666  log_debug("Discarding %s from %s: "
667  "server identifier missing (CLIENTID %s)",
670  print_hex_1(client_id->len, client_id->data, 60));
671  goto exit;
672  }
673  if (!evaluate_option_cache(server_id, packet, NULL, NULL,
674  packet->options, NULL,
675  &global_scope, oc, MDL)) {
676  log_error("Error processing %s from %s; "
677  "unable to evaluate Server Identifier (CLIENTID %s)",
680  print_hex_1(client_id->len, client_id->data, 60));
681  goto exit;
682  }
683  if ((server_duid.len != server_id->len) ||
684  (memcmp(server_duid.data, server_id->data, server_duid.len) != 0)) {
685  log_debug("Discarding %s from %s; "
686  "not our server identifier "
687  "(CLIENTID %s, SERVERID %s, server DUID %s)",
690  print_hex_1(client_id->len, client_id->data, 60),
691  print_hex_2(server_id->len, server_id->data, 60),
692  print_hex_3(server_duid.len, server_duid.data, 60));
693  goto exit;
694  }
695 
696  /* looks good */
697  ret_val = 1;
698 
699 exit:
700  if (!ret_val) {
701  if (server_id->len > 0) {
702  data_string_forget(server_id, MDL);
703  }
704  if (client_id->len > 0) {
705  data_string_forget(client_id, MDL);
706  }
707  }
708  return ret_val;
709 }
710 
711 /*
712  * Information request validation, defined in RFC 3315, section 15.12:
713  *
714  * Servers MUST discard any received Information-request message that
715  * meets any of the following conditions:
716  *
717  * - The message includes a Server Identifier option and the DUID in
718  * the option does not match the server's DUID.
719  *
720  * - The message includes an IA option.
721  */
722 int
723 valid_client_info_req(struct packet *packet, struct data_string *server_id) {
724  int ret_val;
725  struct option_cache *oc;
726  struct data_string client_id;
727  char client_id_str[80]; /* print_hex_1() uses maximum 60 characters,
728  plus a few more for extra information */
729 
730  ret_val = 0;
731  memset(server_id, 0, sizeof(*server_id));
732  memset(&client_id, 0, sizeof(client_id));
733 
734  /*
735  * Make a string that we can print out to give more
736  * information about the client if we need to.
737  *
738  * By RFC 3315, Section 18.1.5 clients SHOULD have a
739  * client-id on an Information-request packet, but it
740  * is not strictly necessary.
741  */
742  if (get_client_id(packet, &client_id) == ISC_R_SUCCESS) {
743  snprintf(client_id_str, sizeof(client_id_str), " (CLIENTID %s)",
744  print_hex_1(client_id.len, client_id.data, 60));
745  data_string_forget(&client_id, MDL);
746  } else {
747  client_id_str[0] = '\0';
748  }
749 
750  /*
751  * Required by RFC 3315, section 15.
752  */
753  if (packet->unicast) {
754  log_debug("Discarding %s from %s; packet sent unicast%s",
756  piaddr(packet->client_addr), client_id_str);
757  goto exit;
758  }
759 
761  if (oc != NULL) {
762  log_debug("Discarding %s from %s; "
763  "IA_NA option present%s",
765  piaddr(packet->client_addr), client_id_str);
766  goto exit;
767  }
769  if (oc != NULL) {
770  log_debug("Discarding %s from %s; "
771  "IA_TA option present%s",
773  piaddr(packet->client_addr), client_id_str);
774  goto exit;
775  }
777  if (oc != NULL) {
778  log_debug("Discarding %s from %s; "
779  "IA_PD option present%s",
781  piaddr(packet->client_addr), client_id_str);
782  goto exit;
783  }
784 
786  if (oc != NULL) {
787  if (!evaluate_option_cache(server_id, packet, NULL, NULL,
788  packet->options, NULL,
789  &global_scope, oc, MDL)) {
790  log_error("Error processing %s from %s; "
791  "unable to evaluate Server Identifier%s",
793  piaddr(packet->client_addr), client_id_str);
794  goto exit;
795  }
796  if ((server_duid.len != server_id->len) ||
797  (memcmp(server_duid.data, server_id->data,
798  server_duid.len) != 0)) {
799  log_debug("Discarding %s from %s; "
800  "not our server identifier "
801  "(SERVERID %s, server DUID %s)%s",
804  print_hex_1(server_id->len,
805  server_id->data, 60),
806  print_hex_2(server_duid.len,
807  server_duid.data, 60),
808  client_id_str);
809  goto exit;
810  }
811  }
812 
813  /* looks good */
814  ret_val = 1;
815 
816 exit:
817  if (!ret_val) {
818  if (server_id->len > 0) {
819  data_string_forget(server_id, MDL);
820  }
821  }
822  return ret_val;
823 }
824 
825 /*
826  * Options that we want to send, in addition to what was requested
827  * via the ORO.
828  */
829 static const int required_opts[] = {
830  D6O_CLIENTID,
831  D6O_SERVERID,
834  0
835 };
836 static const int required_opts_solicit[] = {
837  D6O_CLIENTID,
838  D6O_SERVERID,
839  D6O_IA_NA,
840  D6O_IA_TA,
841  D6O_IA_PD,
846  0
847 };
848 static const int required_opts_agent[] = {
851  0
852 };
853 static const int required_opts_IA[] = {
854  D6O_IAADDR,
856  0
857 };
858 static const int required_opts_IA_PD[] = {
859  D6O_IAPREFIX,
861  0
862 };
863 static const int required_opts_STATUS_CODE[] = {
865  0
866 };
867 #ifdef DHCP4o6
868 static const int required_opts_4o6[] = {
870  0
871 };
872 #endif
873 
874 static const int unicast_reject_opts[] = {
875  D6O_CLIENTID,
876  D6O_SERVERID,
878  0
879 };
880 
881 
882 /*
883  * Extracts from packet contents an IA_* option, storing the IA structure
884  * in its entirety in enc_opt_data, and storing any decoded DHCPv6 options
885  * in enc_opt_state for later lookup and evaluation. The 'offset' indicates
886  * where in the IA_* the DHCPv6 options commence.
887  */
888 static int
889 get_encapsulated_IA_state(struct option_state **enc_opt_state,
890  struct data_string *enc_opt_data,
891  struct packet *packet,
892  struct option_cache *oc,
893  int offset)
894 {
895  /*
896  * Get the raw data for the encapsulated options.
897  */
898  memset(enc_opt_data, 0, sizeof(*enc_opt_data));
899  if (!evaluate_option_cache(enc_opt_data, packet,
900  NULL, NULL, packet->options, NULL,
901  &global_scope, oc, MDL)) {
902  log_error("get_encapsulated_IA_state: "
903  "error evaluating raw option.");
904  return 0;
905  }
906  if (enc_opt_data->len < offset) {
907  log_error("get_encapsulated_IA_state: raw option too small.");
908  data_string_forget(enc_opt_data, MDL);
909  return 0;
910  }
911 
912  /*
913  * Now create the option state structure, and pass it to the
914  * function that parses options.
915  */
916  *enc_opt_state = NULL;
917  if (!option_state_allocate(enc_opt_state, MDL)) {
918  log_error("get_encapsulated_IA_state: no memory for options.");
919  data_string_forget(enc_opt_data, MDL);
920  return 0;
921  }
922  if (!parse_option_buffer(*enc_opt_state,
923  enc_opt_data->data + offset,
924  enc_opt_data->len - offset,
925  &dhcpv6_universe)) {
926  log_error("get_encapsulated_IA_state: error parsing options.");
927  option_state_dereference(enc_opt_state, MDL);
928  data_string_forget(enc_opt_data, MDL);
929  return 0;
930  }
931 
932  return 1;
933 }
934 
935 static int
936 set_status_code(u_int16_t status_code, const char *status_message,
937  struct option_state *opt_state)
938 {
939  struct data_string d;
940  int ret_val;
941 
942  memset(&d, 0, sizeof(d));
943  d.len = sizeof(status_code) + strlen(status_message);
944  if (!buffer_allocate(&d.buffer, d.len, MDL)) {
945  log_fatal("set_status_code: no memory for status code.");
946  }
947  d.data = d.buffer->data;
948  putUShort(d.buffer->data, status_code);
949  memcpy(d.buffer->data + sizeof(status_code),
950  status_message, d.len - sizeof(status_code));
951  if (!save_option_buffer(&dhcpv6_universe, opt_state,
952  d.buffer, (unsigned char *)d.data, d.len,
953  D6O_STATUS_CODE, 0)) {
954  log_error("set_status_code: error saving status code.");
955  ret_val = 0;
956  } else {
957  ret_val = 1;
958  }
959  data_string_forget(&d, MDL);
960  return ret_val;
961 }
962 
963 void check_pool6_threshold(struct reply_state *reply,
964  struct iasubopt *lease)
965 {
966  struct ipv6_pond *pond;
967  isc_uint64_t used, count, high_threshold;
968  int poolhigh = 0, poollow = 0;
969  char *shared_name = "no name";
970  char tmp_addr[INET6_ADDRSTRLEN];
971 
972  if ((lease->ipv6_pool == NULL) || (lease->ipv6_pool->ipv6_pond == NULL))
973  return;
974  pond = lease->ipv6_pool->ipv6_pond;
975 
976  /* If the address range is too large to track, just skip all this. */
977  if (pond->jumbo_range == 1) {
978  return;
979  }
980 
981  count = pond->num_total;
982  used = pond->num_active;
983 
984  /* get network name for logging */
985  if ((pond->shared_network != NULL) &&
986  (pond->shared_network->name != NULL)) {
987  shared_name = pond->shared_network->name;
988  }
989 
990  /* The logged flag indicates if we have already crossed the high
991  * threshold and emitted a log message. If it is set we check to
992  * see if we have re-crossed the low threshold and need to reset
993  * things. When we cross the high threshold we determine what
994  * the low threshold is and save it into the low_threshold value.
995  * When we cross that threshold we reset the logged flag and
996  * the low_threshold to 0 which allows the high threshold message
997  * to be emitted once again.
998  * if we haven't recrossed the boundry we don't need to do anything.
999  */
1000  if (pond->logged !=0) {
1001  if (used <= pond->low_threshold) {
1002  pond->low_threshold = 0;
1003  pond->logged = 0;
1004  log_error("Pool threshold reset - shared subnet: %s; "
1005  "address: %s; low threshold %llu/%llu.",
1006  shared_name,
1007  inet_ntop(AF_INET6, &lease->addr,
1008  tmp_addr, sizeof(tmp_addr)),
1009  (long long unsigned)(used),
1010  (long long unsigned)(count));
1011  }
1012  return;
1013  }
1014 
1015  /* find the high threshold */
1016  if (get_option_int(&poolhigh, &server_universe, reply->packet, NULL,
1017  NULL, reply->packet->options, reply->opt_state,
1018  reply->opt_state, &lease->scope,
1019  SV_LOG_THRESHOLD_HIGH, MDL) == 0) {
1020  /* no threshold bail out */
1021  return;
1022  }
1023 
1024  /* We do have a threshold for this pool, see if its valid */
1025  if ((poolhigh <= 0) || (poolhigh > 100)) {
1026  /* not valid */
1027  return;
1028  }
1029 
1030  /* we have a valid value, have we exceeded it */
1031  high_threshold = FIND_POND6_PERCENT(count, poolhigh);
1032  if (used < high_threshold) {
1033  /* nope, no more to do */
1034  return;
1035  }
1036 
1037  /* we've exceeded it, output a message */
1038  log_error("Pool threshold exceeded - shared subnet: %s; "
1039  "address: %s; high threshold %d%% %llu/%llu.",
1040  shared_name,
1041  inet_ntop(AF_INET6, &lease->addr, tmp_addr, sizeof(tmp_addr)),
1042  poolhigh, (long long unsigned)(used),
1043  (long long unsigned)(count));
1044 
1045  /* handle the low threshold now, if we don't
1046  * have one we default to 0. */
1047  if ((get_option_int(&poollow, &server_universe, reply->packet, NULL,
1048  NULL, reply->packet->options, reply->opt_state,
1049  reply->opt_state, &lease->scope,
1050  SV_LOG_THRESHOLD_LOW, MDL) == 0) ||
1051  (poollow > 100)) {
1052  poollow = 0;
1053  }
1054 
1055  /*
1056  * If the low theshold is higher than the high threshold we continue to log
1057  * If it isn't then we set the flag saying we already logged and determine
1058  * what the reset threshold is.
1059  */
1060  if (poollow < poolhigh) {
1061  pond->logged = 1;
1062  pond->low_threshold = FIND_POND6_PERCENT(count, poollow);
1063  }
1064 }
1065 
1066 /*
1067  * We have a set of operations we do to set up the reply packet, which
1068  * is the same for many message types.
1069  */
1070 static int
1071 start_reply(struct packet *packet,
1072  const struct data_string *client_id,
1073  const struct data_string *server_id,
1074  struct option_state **opt_state,
1075  struct dhcpv6_packet *reply)
1076 {
1077  struct option_cache *oc;
1078  const unsigned char *server_id_data;
1079  int server_id_len;
1080 
1081  /*
1082  * Build our option state for reply.
1083  */
1084  *opt_state = NULL;
1085  if (!option_state_allocate(opt_state, MDL)) {
1086  log_error("start_reply: no memory for option_state.");
1087  return 0;
1088  }
1089  execute_statements_in_scope(NULL, packet, NULL, NULL,
1090  packet->options, *opt_state,
1091  &global_scope, root_group, NULL, NULL);
1092 
1093  /*
1094  * A small bit of special handling for Solicit messages.
1095  *
1096  * We could move the logic into a flag, but for now just check
1097  * explicitly.
1098  */
1100  reply->msg_type = DHCPV6_ADVERTISE;
1101 
1102  /*
1103  * If:
1104  * - this message type supports rapid commit (Solicit), and
1105  * - the server is configured to supply a rapid commit, and
1106  * - the client requests a rapid commit,
1107  * Then we add a rapid commit option, and send Reply (instead
1108  * of an Advertise).
1109  */
1111  *opt_state, D6O_RAPID_COMMIT);
1112  if (oc != NULL) {
1115  if (oc != NULL) {
1116  /* Rapid-commit in action. */
1117  reply->msg_type = DHCPV6_REPLY;
1118  } else {
1119  /* Don't want a rapid-commit in advertise. */
1121  *opt_state, D6O_RAPID_COMMIT);
1122  }
1123  }
1124  } else {
1125  reply->msg_type = DHCPV6_REPLY;
1126  /* Delete the rapid-commit from the sent options. */
1128  *opt_state, D6O_RAPID_COMMIT);
1129  if (oc != NULL) {
1131  *opt_state, D6O_RAPID_COMMIT);
1132  }
1133  }
1134 
1135  /*
1136  * Use the client's transaction identifier for the reply.
1137  */
1139  sizeof(reply->transaction_id));
1140 
1141  /*
1142  * RFC 3315, section 18.2 says we need server identifier and
1143  * client identifier.
1144  *
1145  * If the server ID is defined via the configuration file, then
1146  * it will already be present in the option state at this point,
1147  * so we don't need to set it.
1148  *
1149  * If we have a server ID passed in from the caller,
1150  * use that, otherwise use the global DUID.
1151  */
1152  oc = lookup_option(&dhcpv6_universe, *opt_state, D6O_SERVERID);
1153  if (oc == NULL) {
1154  if (server_id == NULL) {
1155  server_id_data = server_duid.data;
1156  server_id_len = server_duid.len;
1157  } else {
1158  server_id_data = server_id->data;
1159  server_id_len = server_id->len;
1160  }
1161  if (!save_option_buffer(&dhcpv6_universe, *opt_state,
1162  NULL, (unsigned char *)server_id_data,
1163  server_id_len, D6O_SERVERID, 0)) {
1164  log_error("start_reply: "
1165  "error saving server identifier.");
1166  return 0;
1167  }
1168  }
1169 
1170  if (client_id->buffer != NULL) {
1171  if (!save_option_buffer(&dhcpv6_universe, *opt_state,
1172  client_id->buffer,
1173  (unsigned char *)client_id->data,
1174  client_id->len,
1175  D6O_CLIENTID, 0)) {
1176  log_error("start_reply: error saving "
1177  "client identifier.");
1178  return 0;
1179  }
1180  }
1181 
1182  /*
1183  * If the client accepts reconfiguration, let it know that we
1184  * will send them.
1185  *
1186  * Note: we don't actually do this yet, but DOCSIS requires we
1187  * claim to.
1188  */
1191  if (oc != NULL) {
1192  if (!save_option_buffer(&dhcpv6_universe, *opt_state,
1193  NULL, (unsigned char *)"", 0,
1194  D6O_RECONF_ACCEPT, 0)) {
1195  log_error("start_reply: "
1196  "error saving RECONF_ACCEPT option.");
1197  option_state_dereference(opt_state, MDL);
1198  return 0;
1199  }
1200  }
1201 
1202  return 1;
1203 }
1204 
1205 /*
1206  * Try to get the IPv6 address the client asked for from the
1207  * pool.
1208  *
1209  * addr is the result (should be a pointer to NULL on entry)
1210  * pool is the pool to search in
1211  * requested_addr is the address the client wants
1212  */
1213 static isc_result_t
1214 try_client_v6_address(struct iasubopt **addr,
1215  struct ipv6_pool *pool,
1216  const struct data_string *requested_addr)
1217 {
1218  struct in6_addr tmp_addr;
1219  isc_result_t result;
1220 
1221  if (requested_addr->len < sizeof(tmp_addr)) {
1222  return DHCP_R_INVALIDARG;
1223  }
1224  memcpy(&tmp_addr, requested_addr->data, sizeof(tmp_addr));
1225  if (IN6_IS_ADDR_UNSPECIFIED(&tmp_addr)) {
1226  return ISC_R_FAILURE;
1227  }
1228 
1229  /*
1230  * The address is not covered by this (or possibly any) dynamic
1231  * range.
1232  */
1233  if (!ipv6_in_pool(&tmp_addr, pool)) {
1234  return ISC_R_ADDRNOTAVAIL;
1235  }
1236 
1237  if (lease6_exists(pool, &tmp_addr)) {
1238  return ISC_R_ADDRINUSE;
1239  }
1240 
1241  result = iasubopt_allocate(addr, MDL);
1242  if (result != ISC_R_SUCCESS) {
1243  return result;
1244  }
1245  (*addr)->addr = tmp_addr;
1246  (*addr)->plen = 0;
1247 
1248  /* Default is soft binding for 2 minutes. */
1249  result = add_lease6(pool, *addr, cur_time + 120);
1250  if (result != ISC_R_SUCCESS) {
1251  iasubopt_dereference(addr, MDL);
1252  }
1253  return result;
1254 }
1255 
1256 
1278 static isc_result_t
1279 pick_v6_address(struct reply_state *reply)
1280 {
1281  struct ipv6_pool *p = NULL;
1282  struct ipv6_pond *pond;
1283  int i;
1284  int start_pool;
1285  unsigned int attempts;
1286  char tmp_buf[INET6_ADDRSTRLEN];
1287  struct iasubopt **addr = &reply->lease;
1288  isc_uint64_t total = 0;
1289  isc_uint64_t active = 0;
1290  isc_uint64_t abandoned = 0;
1291  int jumbo_range = 0;
1292  char *shared_name = (reply->shared->name ?
1293  reply->shared->name : "(no name)");
1294 
1295  /*
1296  * Do a quick walk through of the ponds and pools
1297  * to see if we have any NA address pools
1298  */
1299  for (pond = reply->shared->ipv6_pond; pond != NULL; pond = pond->next) {
1300  if (pond->ipv6_pools == NULL)
1301  continue;
1302 
1303  for (i = 0; (p = pond->ipv6_pools[i]) != NULL; i++) {
1304  if (p->pool_type == D6O_IA_NA)
1305  break;
1306  }
1307  if (p != NULL)
1308  break;
1309  }
1310 
1311  /* If we get here and p is NULL we have no useful pools */
1312  if (p == NULL) {
1313  log_debug("Unable to pick client address: "
1314  "no IPv6 pools on this shared network");
1315  return ISC_R_NORESOURCES;
1316  }
1317 
1318  /*
1319  * We have at least one pool that could provide an address
1320  * Now we walk through the ponds and pools again and check
1321  * to see if the client is permitted and if an address is
1322  * available
1323  *
1324  * Within a given pond we start looking at the last pool we
1325  * allocated from, unless it had a collision trying to allocate
1326  * an address. This will tend to move us into less-filled pools.
1327  */
1328 
1329  for (pond = reply->shared->ipv6_pond; pond != NULL; pond = pond->next) {
1330  isc_result_t result = ISC_R_FAILURE;
1331 
1332  if (((pond->prohibit_list != NULL) &&
1333  (permitted(reply->packet, pond->prohibit_list))) ||
1334  ((pond->permit_list != NULL) &&
1335  (!permitted(reply->packet, pond->permit_list))))
1336  continue;
1337 
1338  start_pool = pond->last_ipv6_pool;
1339  i = start_pool;
1340  do {
1341  p = pond->ipv6_pools[i];
1342  if (p->pool_type == D6O_IA_NA) {
1343  result = create_lease6(p, addr, &attempts,
1344  &reply->ia->iaid_duid,
1345  cur_time + 120);
1346  if (result == ISC_R_SUCCESS) {
1347  /*
1348  * Record the pool used (or next one if
1349  * there was a collision).
1350  */
1351  if (attempts > 1) {
1352  i++;
1353  if (pond->ipv6_pools[i]
1354  == NULL) {
1355  i = 0;
1356  }
1357  }
1358 
1359  pond->last_ipv6_pool = i;
1360 
1361  log_debug("Picking pool address %s",
1362  inet_ntop(AF_INET6,
1363  &((*addr)->addr),
1364  tmp_buf, sizeof(tmp_buf)));
1365  return (ISC_R_SUCCESS);
1366  }
1367  }
1368 
1369  i++;
1370  if (pond->ipv6_pools[i] == NULL) {
1371  i = 0;
1372  }
1373  } while (i != start_pool);
1374 
1375  if (result == ISC_R_NORESOURCES) {
1376  jumbo_range += pond->jumbo_range;
1377  total += pond->num_total;
1378  active += pond->num_active;
1379  abandoned += pond->num_abandoned;
1380  }
1381  }
1382 
1383  /*
1384  * If we failed to pick an IPv6 address from any of the subnets.
1385  * Presumably that means we have no addresses for the client.
1386  */
1387  if (jumbo_range != 0) {
1388  log_debug("Unable to pick client address: "
1389  "no addresses available - shared network %s: "
1390  " 2^64-1 < total, %llu active, %llu abandoned",
1391  shared_name, (long long unsigned)(active - abandoned),
1392  (long long unsigned)(abandoned));
1393  } else {
1394  log_debug("Unable to pick client address: "
1395  "no addresses available - shared network %s: "
1396  "%llu total, %llu active, %llu abandoned",
1397  shared_name, (long long unsigned)(total),
1398  (long long unsigned)(active - abandoned),
1399  (long long unsigned)(abandoned));
1400  }
1401 
1402  return ISC_R_NORESOURCES;
1403 }
1404 
1405 /*
1406  * Try to get the IPv6 prefix the client asked for from the
1407  * prefix pool.
1408  *
1409  * pref is the result (should be a pointer to NULL on entry)
1410  * pool is the prefix pool to search in
1411  * requested_pref is the address the client wants
1412  */
1413 static isc_result_t
1414 try_client_v6_prefix(struct iasubopt **pref,
1415  struct ipv6_pool *pool,
1416  const struct data_string *requested_pref)
1417 {
1418  u_int8_t tmp_plen;
1419  struct in6_addr tmp_pref;
1420  struct iaddr ia;
1421  isc_result_t result;
1422 
1423  if (requested_pref->len < sizeof(tmp_plen) + sizeof(tmp_pref)) {
1424  return DHCP_R_INVALIDARG;
1425  }
1426 
1427  tmp_plen = (int) requested_pref->data[0];
1428  if ((tmp_plen < 3) || (tmp_plen > 128)) {
1429  return ISC_R_FAILURE;
1430  }
1431 
1432  memcpy(&tmp_pref, requested_pref->data + 1, sizeof(tmp_pref));
1433  if (IN6_IS_ADDR_UNSPECIFIED(&tmp_pref)) {
1434  return ISC_R_FAILURE;
1435  }
1436 
1437  ia.len = 16;
1438  memcpy(&ia.iabuf, &tmp_pref, 16);
1439  if (!is_cidr_mask_valid(&ia, (int) tmp_plen)) {
1440  return ISC_R_FAILURE;
1441  }
1442 
1443  if (!ipv6_in_pool(&tmp_pref, pool) ||
1444  ((int)tmp_plen != pool->units)) {
1445  return ISC_R_ADDRNOTAVAIL;
1446  }
1447 
1448  if (prefix6_exists(pool, &tmp_pref, tmp_plen)) {
1449  return ISC_R_ADDRINUSE;
1450  }
1451 
1452  result = iasubopt_allocate(pref, MDL);
1453  if (result != ISC_R_SUCCESS) {
1454  return result;
1455  }
1456 
1457  (*pref)->addr = tmp_pref;
1458  (*pref)->plen = tmp_plen;
1459 
1460  /* Default is soft binding for 2 minutes. */
1461  result = add_lease6(pool, *pref, cur_time + 120);
1462  if (result != ISC_R_SUCCESS) {
1463  iasubopt_dereference(pref, MDL);
1464  }
1465 
1466  return result;
1467 }
1468 
1508 static isc_result_t
1509 pick_v6_prefix(struct reply_state *reply) {
1510  struct ipv6_pool *p = NULL;
1511  struct ipv6_pond *pond;
1512  int i;
1513  isc_result_t result;
1514 
1515  /*
1516  * Do a quick walk through of the ponds and pools
1517  * to see if we have any prefix pools
1518  */
1519  for (pond = reply->shared->ipv6_pond; pond != NULL; pond = pond->next) {
1520  if (pond->ipv6_pools == NULL)
1521  continue;
1522 
1523  for (i = 0; (p = pond->ipv6_pools[i]) != NULL; i++) {
1524  if (p->pool_type == D6O_IA_PD)
1525  break;
1526  }
1527  if (p != NULL)
1528  break;
1529  }
1530 
1531  /* If we get here and p is NULL we have no useful pools */
1532  if (p == NULL) {
1533  log_debug("Unable to pick client prefix: "
1534  "no IPv6 pools on this shared network");
1535  return ISC_R_NORESOURCES;
1536  }
1537 
1538  if (reply->preflen <= 0) {
1539  /* If we didn't get a plen (-1) or client plen is 0, then just
1540  * select first available (same as PLM_INGORE) */
1541  result = pick_v6_prefix_helper(reply, PLM_IGNORE);
1542  } else {
1543  switch (prefix_length_mode) {
1544  case PLM_PREFER:
1545  /* First we look for an exact match, if not found
1546  * then first available */
1547  result = pick_v6_prefix_helper(reply, PLM_EXACT);
1548  if (result != ISC_R_SUCCESS) {
1549  result = pick_v6_prefix_helper(reply,
1550  PLM_IGNORE);
1551  }
1552  break;
1553 
1554  case PLM_EXACT:
1555  /* Match exactly or fail */
1556  result = pick_v6_prefix_helper(reply, PLM_EXACT);
1557  break;
1558 
1559  case PLM_MINIMUM:
1560  case PLM_MAXIMUM:
1561  /* First we look for an exact match, if not found
1562  * then first available by mode */
1563  result = pick_v6_prefix_helper(reply, PLM_EXACT);
1564  if (result != ISC_R_SUCCESS) {
1565  result = pick_v6_prefix_helper(reply,
1567  }
1568  break;
1569 
1570  default:
1571  /* First available */
1572  result = pick_v6_prefix_helper(reply, PLM_IGNORE);
1573  break;
1574  }
1575  }
1576 
1577  if (result == ISC_R_SUCCESS) {
1578  char tmp_buf[INET6_ADDRSTRLEN];
1579 
1580  log_debug("Picking pool prefix %s/%u",
1581  inet_ntop(AF_INET6, &(reply->lease->addr),
1582  tmp_buf, sizeof(tmp_buf)),
1583  (unsigned)(reply->lease->plen));
1584  return (ISC_R_SUCCESS);
1585  }
1586 
1587  /*
1588  * If we failed to pick an IPv6 prefix
1589  * Presumably that means we have no prefixes for the client.
1590  */
1591  log_debug("Unable to pick client prefix: no prefixes available");
1592  return ISC_R_NORESOURCES;
1593 }
1594 
1618 isc_result_t
1619 pick_v6_prefix_helper(struct reply_state *reply, int prefix_mode) {
1620  struct ipv6_pool *p = NULL;
1621  struct ipv6_pond *pond;
1622  int i;
1623  unsigned int attempts;
1624  struct iasubopt **pref = &reply->lease;
1625 
1626  for (pond = reply->shared->ipv6_pond; pond != NULL; pond = pond->next) {
1627  if (((pond->prohibit_list != NULL) &&
1628  (permitted(reply->packet, pond->prohibit_list))) ||
1629  ((pond->permit_list != NULL) &&
1630  (!permitted(reply->packet, pond->permit_list))))
1631  continue;
1632 
1633  for (i = 0; (p = pond->ipv6_pools[i]) != NULL; i++) {
1634  if ((p->pool_type == D6O_IA_PD) &&
1635  (eval_prefix_mode(p->units, reply->preflen,
1636  prefix_mode) == 1) &&
1637  (create_prefix6(p, pref, &attempts,
1638  &reply->ia->iaid_duid,
1639  cur_time + 120) == ISC_R_SUCCESS)) {
1640  return (ISC_R_SUCCESS);
1641  }
1642  }
1643  }
1644 
1645  return ISC_R_NORESOURCES;
1646 }
1647 
1662 int
1663 eval_prefix_mode(int len, int preflen, int prefix_mode) {
1664  int use_it = 1;
1665  switch (prefix_mode) {
1666  case PLM_EXACT:
1667  use_it = (len == preflen);
1668  break;
1669  case PLM_MINIMUM:
1670  /* they asked for a prefix length no "shorter" than preflen */
1671  use_it = (len >= preflen);
1672  break;
1673  case PLM_MAXIMUM:
1674  /* they asked for a prefix length no "longer" than preflen */
1675  use_it = (len <= preflen);
1676  break;
1677  default:
1678  /* otherwise use it */
1679  break;
1680  }
1681 
1682  return (use_it);
1683 }
1684 
1685 /*
1686  *! \file server/dhcpv6.c
1687  *
1688  * \brief construct a reply containing information about a client's lease
1689  *
1690  * lease_to_client() is called from several messages to construct a
1691  * reply that contains all that we know about the client's correct lease
1692  * (or projected lease).
1693  *
1694  * Solicit - "Soft" binding, ignore unknown addresses or bindings, just
1695  * send what we "may" give them on a request.
1696  *
1697  * Request - "Hard" binding, but ignore supplied addresses (just provide what
1698  * the client should really use).
1699  *
1700  * Renew - "Hard" binding, but client-supplied addresses are 'real'. Error
1701  * Rebind out any "wrong" addresses the client sends. This means we send
1702  * an empty IA_NA with a status code of NoBinding or NotOnLink or
1703  * possibly send the address with zeroed lifetimes.
1704  *
1705  * Information-Request - No binding.
1706  *
1707  * The basic structure is to traverse the client-supplied data first, and
1708  * validate and echo back any contents that can be. If the client-supplied
1709  * data does not error out (on renew/rebind as above), but we did not send
1710  * any addresses, attempt to allocate one.
1711  *
1712  * At the end of the this function we call commit_leases_timed() to
1713  * fsync and rotate the file as necessary. commit_leases_timed() will
1714  * check that we have written at least one lease to the file and that
1715  * some time has passed before doing any fsync or file rewrite so we
1716  * don't bother tracking if we did a write_ia during this function.
1717  */
1718 /* TODO: look at client hints for lease times */
1719 
1720 static void
1721 lease_to_client(struct data_string *reply_ret,
1722  struct packet *packet,
1723  const struct data_string *client_id,
1724  const struct data_string *server_id)
1725 {
1726  static struct reply_state reply;
1727  struct option_cache *oc;
1728  struct data_string packet_oro;
1729  int i;
1730 
1731  memset(&packet_oro, 0, sizeof(packet_oro));
1732 
1733  /* Locate the client. */
1734  if (shared_network_from_packet6(&reply.shared,
1735  packet) != ISC_R_SUCCESS)
1736  goto exit;
1737 
1738  /*
1739  * Initialize the reply.
1740  */
1741  packet_reference(&reply.packet, packet, MDL);
1742  data_string_copy(&reply.client_id, client_id, MDL);
1743 
1744  if (!start_reply(packet, client_id, server_id, &reply.opt_state,
1745  &reply.buf.reply))
1746  goto exit;
1747 
1748  /* Set the write cursor to just past the reply header. */
1749  reply.cursor = REPLY_OPTIONS_INDEX;
1750 
1751  /*
1752  * Get the ORO from the packet, if any.
1753  */
1755  if (oc != NULL) {
1756  if (!evaluate_option_cache(&packet_oro, packet,
1757  NULL, NULL,
1758  packet->options, NULL,
1759  &global_scope, oc, MDL)) {
1760  log_error("lease_to_client: error evaluating ORO.");
1761  goto exit;
1762  }
1763  }
1764 
1765  /*
1766  * Find a host record that matches the packet, if any, and is
1767  * valid for the shared network the client is on.
1768  */
1769  if (find_hosts6(&reply.host, packet, client_id, MDL)) {
1770  packet->known = 1;
1771  seek_shared_host(&reply.host, reply.shared);
1772  }
1773 
1774  /* Process the client supplied IA's onto the reply buffer. */
1775  reply.ia_count = 0;
1777 
1778  for (; oc != NULL ; oc = oc->next) {
1779  isc_result_t status;
1780 
1781  /* Start counting resources (addresses) offered. */
1782  reply.client_resources = 0;
1783  reply.resources_included = ISC_FALSE;
1784 
1785  status = reply_process_ia_na(&reply, oc);
1786 
1787  /*
1788  * We continue to try other IA's whether we can address
1789  * this one or not. Any other result is an immediate fail.
1790  */
1791  if ((status != ISC_R_SUCCESS) &&
1792  (status != ISC_R_NORESOURCES))
1793  goto exit;
1794  }
1796  for (; oc != NULL ; oc = oc->next) {
1797  isc_result_t status;
1798 
1799  /* Start counting resources (addresses) offered. */
1800  reply.client_resources = 0;
1801  reply.resources_included = ISC_FALSE;
1802 
1803  status = reply_process_ia_ta(&reply, oc);
1804 
1805  /*
1806  * We continue to try other IA's whether we can address
1807  * this one or not. Any other result is an immediate fail.
1808  */
1809  if ((status != ISC_R_SUCCESS) &&
1810  (status != ISC_R_NORESOURCES))
1811  goto exit;
1812  }
1813 
1814  /* Same for IA_PD's. */
1815  reply.pd_count = 0;
1817  for (; oc != NULL ; oc = oc->next) {
1818  isc_result_t status;
1819 
1820  /* Start counting resources (prefixes) offered. */
1821  reply.client_resources = 0;
1822  reply.resources_included = ISC_FALSE;
1823 
1824  status = reply_process_ia_pd(&reply, oc);
1825 
1826  /*
1827  * We continue to try other IA_PD's whether we can address
1828  * this one or not. Any other result is an immediate fail.
1829  */
1830  if ((status != ISC_R_SUCCESS) &&
1831  (status != ISC_R_NORESOURCES))
1832  goto exit;
1833  }
1834 
1835  /*
1836  * Make no reply if we gave no resources and is not
1837  * for Information-Request.
1838  */
1839  if ((reply.ia_count == 0) && (reply.pd_count == 0)) {
1840  if (reply.packet->dhcpv6_msg_type !=
1842  goto exit;
1843 
1844  /*
1845  * Because we only execute statements on a per-IA basis,
1846  * we need to execute statements in any non-IA reply to
1847  * source configuration.
1848  */
1849  execute_statements_in_scope(NULL, reply.packet, NULL, NULL,
1850  reply.packet->options,
1851  reply.opt_state, &global_scope,
1852  reply.shared->group, root_group,
1853  NULL);
1854 
1855  /* Execute statements from class scopes. */
1856  for (i = reply.packet->class_count; i > 0; i--) {
1857  execute_statements_in_scope(NULL, reply.packet,
1858  NULL, NULL,
1859  reply.packet->options,
1860  reply.opt_state,
1861  &global_scope,
1862  reply.packet->classes[i - 1]->group,
1863  reply.shared->group, NULL);
1864  }
1865 
1866  /* Bring in any configuration from a host record. */
1867  if (reply.host != NULL)
1868  execute_statements_in_scope(NULL, reply.packet,
1869  NULL, NULL,
1870  reply.packet->options,
1871  reply.opt_state,
1872  &global_scope,
1873  reply.host->group,
1874  reply.shared->group, NULL);
1875  }
1876 
1877  /*
1878  * RFC3315 section 17.2.2 (Solicit):
1879  *
1880  * If the server will not assign any addresses to any IAs in a
1881  * subsequent Request from the client, the server MUST send an
1882  * Advertise message to the client that includes only a Status
1883  * Code option with code NoAddrsAvail and a status message for
1884  * the user, a Server Identifier option with the server's DUID,
1885  * and a Client Identifier option with the client's DUID.
1886  *
1887  * This has been updated by an errata such that the server
1888  * can always send an IA.
1889  *
1890  * Section 18.2.1 (Request):
1891  *
1892  * If the server cannot assign any addresses to an IA in the
1893  * message from the client, the server MUST include the IA in
1894  * the Reply message with no addresses in the IA and a Status
1895  * Code option in the IA containing status code NoAddrsAvail.
1896  *
1897  * Section 18.1.8 (Client Behavior):
1898  *
1899  * Leave unchanged any information about addresses the client has
1900  * recorded in the IA but that were not included in the IA from
1901  * the server.
1902  * Sends a Renew/Rebind if the IA is not in the Reply message.
1903  */
1904 
1905  /*
1906  * Having stored the client's IA's, store any options that
1907  * will fit in the remaining space.
1908  */
1909  reply.cursor += store_options6((char *)reply.buf.data + reply.cursor,
1910  sizeof(reply.buf) - reply.cursor,
1911  reply.opt_state, reply.packet,
1912  required_opts_solicit,
1913  &packet_oro);
1914 
1915  /* Return our reply to the caller. */
1916  reply_ret->len = reply.cursor;
1917  reply_ret->buffer = NULL;
1918  if (!buffer_allocate(&reply_ret->buffer, reply.cursor, MDL)) {
1919  log_fatal("No memory to store Reply.");
1920  }
1921  memcpy(reply_ret->buffer->data, reply.buf.data, reply.cursor);
1922  reply_ret->data = reply_ret->buffer->data;
1923 
1924  /* If appropriate commit and rotate the lease file */
1925  (void) commit_leases_timed();
1926 
1927  exit:
1928  /* Cleanup. */
1929  if (reply.shared != NULL)
1930  shared_network_dereference(&reply.shared, MDL);
1931  if (reply.host != NULL)
1932  host_dereference(&reply.host, MDL);
1933  if (reply.opt_state != NULL)
1934  option_state_dereference(&reply.opt_state, MDL);
1935  if (reply.packet != NULL)
1936  packet_dereference(&reply.packet, MDL);
1937  if (reply.client_id.data != NULL)
1938  data_string_forget(&reply.client_id, MDL);
1939  if (packet_oro.buffer != NULL)
1940  data_string_forget(&packet_oro, MDL);
1941  reply.renew = reply.rebind = reply.min_prefer = reply.min_valid = 0;
1942  reply.cursor = 0;
1943 }
1944 
1945 /* Process a client-supplied IA_NA. This may append options to the tail of
1946  * the reply packet being built in the reply_state structure.
1947  */
1948 static isc_result_t
1949 reply_process_ia_na(struct reply_state *reply, struct option_cache *ia) {
1950  isc_result_t status = ISC_R_SUCCESS;
1951  u_int32_t iaid;
1952  unsigned ia_cursor;
1953  struct option_state *packet_ia;
1954  struct option_cache *oc;
1955  struct data_string ia_data, data;
1956 
1957  /* Initialize values that will get cleaned up on return. */
1958  packet_ia = NULL;
1959  memset(&ia_data, 0, sizeof(ia_data));
1960  memset(&data, 0, sizeof(data));
1961  /*
1962  * Note that find_client_address() may set reply->lease.
1963  */
1964 
1965  /* Make sure there is at least room for the header. */
1966  if ((reply->cursor + IA_NA_OFFSET + 4) > sizeof(reply->buf)) {
1967  log_error("reply_process_ia_na: Reply too long for IA.");
1968  return ISC_R_NOSPACE;
1969  }
1970 
1971 
1972  /* Fetch the IA_NA contents. */
1973  if (!get_encapsulated_IA_state(&packet_ia, &ia_data, reply->packet,
1974  ia, IA_NA_OFFSET)) {
1975  log_error("reply_process_ia_na: error evaluating ia");
1976  status = ISC_R_FAILURE;
1977  goto cleanup;
1978  }
1979 
1980  /* Extract IA_NA header contents. */
1981  iaid = getULong(ia_data.data);
1982  reply->renew = getULong(ia_data.data + 4);
1983  reply->rebind = getULong(ia_data.data + 8);
1984 
1985  /* Create an IA_NA structure. */
1986  if (ia_allocate(&reply->ia, iaid, (char *)reply->client_id.data,
1987  reply->client_id.len, MDL) != ISC_R_SUCCESS) {
1988  log_error("reply_process_ia_na: no memory for ia.");
1989  status = ISC_R_NOMEMORY;
1990  goto cleanup;
1991  }
1992  reply->ia->ia_type = D6O_IA_NA;
1993 
1994  /* Cache pre-existing IA, if any. */
1995  ia_hash_lookup(&reply->old_ia, ia_na_active,
1996  (unsigned char *)reply->ia->iaid_duid.data,
1997  reply->ia->iaid_duid.len, MDL);
1998 
1999  /*
2000  * Create an option cache to carry the IA_NA option contents, and
2001  * execute any user-supplied values into it.
2002  */
2003  if (!option_state_allocate(&reply->reply_ia, MDL)) {
2004  status = ISC_R_NOMEMORY;
2005  goto cleanup;
2006  }
2007 
2008  /* Check & cache the fixed host record. */
2009  if ((reply->host != NULL) && (reply->host->fixed_addr != NULL)) {
2010  struct iaddr tmp_addr;
2011 
2012  if (!evaluate_option_cache(&reply->fixed, NULL, NULL, NULL,
2013  NULL, NULL, &global_scope,
2014  reply->host->fixed_addr, MDL)) {
2015  log_error("reply_process_ia_na: unable to evaluate "
2016  "fixed address.");
2017  status = ISC_R_FAILURE;
2018  goto cleanup;
2019  }
2020 
2021  if (reply->fixed.len < 16) {
2022  log_error("reply_process_ia_na: invalid fixed address.");
2023  status = DHCP_R_INVALIDARG;
2024  goto cleanup;
2025  }
2026 
2027  /* Find the static lease's subnet. */
2028  tmp_addr.len = 16;
2029  memcpy(tmp_addr.iabuf, reply->fixed.data, 16);
2030 
2031  if (find_grouped_subnet(&reply->subnet, reply->shared,
2032  tmp_addr, MDL) == 0)
2033  log_fatal("Impossible condition at %s:%d.", MDL);
2034 
2035  reply->static_lease = ISC_TRUE;
2036  } else
2037  reply->static_lease = ISC_FALSE;
2038 
2039  /*
2040  * Save the cursor position at the start of the IA, so we can
2041  * set length and adjust t1/t2 values later. We write a temporary
2042  * header out now just in case we decide to adjust the packet
2043  * within sub-process functions.
2044  */
2045  ia_cursor = reply->cursor;
2046 
2047  /* Initialize the IA_NA header. First the code. */
2048  putUShort(reply->buf.data + reply->cursor, (unsigned)D6O_IA_NA);
2049  reply->cursor += 2;
2050 
2051  /* Then option length. */
2052  putUShort(reply->buf.data + reply->cursor, 0x0Cu);
2053  reply->cursor += 2;
2054 
2055  /* Then IA_NA header contents; IAID. */
2056  putULong(reply->buf.data + reply->cursor, iaid);
2057  reply->cursor += 4;
2058 
2059  /* We store the client's t1 for now, and may over-ride it later. */
2060  putULong(reply->buf.data + reply->cursor, reply->renew);
2061  reply->cursor += 4;
2062 
2063  /* We store the client's t2 for now, and may over-ride it later. */
2064  putULong(reply->buf.data + reply->cursor, reply->rebind);
2065  reply->cursor += 4;
2066 
2067  /*
2068  * For each address in this IA_NA, decide what to do about it.
2069  *
2070  * Guidelines:
2071  *
2072  * The client leaves unchanged any information about addresses
2073  * it has recorded but are not included ("cancel/break" below).
2074  * A not included IA ("cleanup" below) could give a Renew/Rebind.
2075  */
2076  oc = lookup_option(&dhcpv6_universe, packet_ia, D6O_IAADDR);
2077  reply->min_valid = reply->min_prefer = INFINITE_TIME;
2078  reply->client_valid = reply->client_prefer = 0;
2079  for (; oc != NULL ; oc = oc->next) {
2080  status = reply_process_addr(reply, oc);
2081 
2082  /*
2083  * Canceled means we did not allocate addresses to the
2084  * client, but we're "done" with this IA - we set a status
2085  * code. So transmit this reply, e.g., move on to the next
2086  * IA.
2087  */
2088  if (status == ISC_R_CANCELED)
2089  break;
2090 
2091  if ((status != ISC_R_SUCCESS) &&
2092  (status != ISC_R_ADDRINUSE) &&
2093  (status != ISC_R_ADDRNOTAVAIL))
2094  goto cleanup;
2095  }
2096 
2097  reply->ia_count++;
2098 
2099  /*
2100  * If we fell through the above and never gave the client
2101  * an address, give it one now.
2102  */
2103  if ((status != ISC_R_CANCELED) && (reply->client_resources == 0)) {
2104  status = find_client_address(reply);
2105 
2106  if (status == ISC_R_NORESOURCES) {
2107  switch (reply->packet->dhcpv6_msg_type) {
2108  case DHCPV6_SOLICIT:
2109  /*
2110  * No address for any IA is handled
2111  * by the caller.
2112  */
2113  /* FALL THROUGH */
2114 
2115  case DHCPV6_REQUEST:
2116  /* Section 18.2.1 (Request):
2117  *
2118  * If the server cannot assign any addresses to
2119  * an IA in the message from the client, the
2120  * server MUST include the IA in the Reply
2121  * message with no addresses in the IA and a
2122  * Status Code option in the IA containing
2123  * status code NoAddrsAvail.
2124  */
2125  option_state_dereference(&reply->reply_ia, MDL);
2126  if (!option_state_allocate(&reply->reply_ia,
2127  MDL))
2128  {
2129  log_error("reply_process_ia_na: No "
2130  "memory for option state "
2131  "wipe.");
2132  status = ISC_R_NOMEMORY;
2133  goto cleanup;
2134  }
2135 
2136  if (!set_status_code(STATUS_NoAddrsAvail,
2137  "No addresses available "
2138  "for this interface.",
2139  reply->reply_ia)) {
2140  log_error("reply_process_ia_na: Unable "
2141  "to set NoAddrsAvail status "
2142  "code.");
2143  status = ISC_R_FAILURE;
2144  goto cleanup;
2145  }
2146 
2147  status = ISC_R_SUCCESS;
2148  break;
2149 
2150  default:
2151  /*
2152  * RFC 3315 does not tell us to emit a status
2153  * code in this condition, or anything else.
2154  *
2155  * If we included non-allocated addresses
2156  * (zeroed lifetimes) in an IA, then the client
2157  * will deconfigure them.
2158  *
2159  * So we want to include the IA even if we
2160  * can't give it a new address if it includes
2161  * zeroed lifetime addresses.
2162  *
2163  * We don't want to include the IA if we
2164  * provide zero addresses including zeroed
2165  * lifetimes.
2166  */
2167  if (reply->resources_included)
2168  status = ISC_R_SUCCESS;
2169  else
2170  goto cleanup;
2171  break;
2172  }
2173  }
2174 
2175  if (status != ISC_R_SUCCESS)
2176  goto cleanup;
2177  }
2178 
2179  reply->cursor += store_options6((char *)reply->buf.data + reply->cursor,
2180  sizeof(reply->buf) - reply->cursor,
2181  reply->reply_ia, reply->packet,
2182  required_opts_IA, NULL);
2183 
2184  /* Reset the length of this IA to match what was just written. */
2185  putUShort(reply->buf.data + ia_cursor + 2,
2186  reply->cursor - (ia_cursor + 4));
2187 
2188  /* Calculate T1/T2 and stuff them in the reply */
2189  set_reply_tee_times(reply, ia_cursor);
2190 
2191  /*
2192  * yes, goto's aren't the best but we also want to avoid extra
2193  * indents
2194  */
2195  if (status == ISC_R_CANCELED)
2196  goto cleanup;
2197 
2198  /*
2199  * Handle static leases, we always log stuff and if it's
2200  * a hard binding we run any commit statements that we have
2201  */
2202  if (reply->static_lease) {
2203  char tmp_addr[INET6_ADDRSTRLEN];
2204  log_info("%s NA: address %s to client with duid %s iaid = %d "
2205  "static",
2206  dhcpv6_type_names[reply->buf.reply.msg_type],
2207  inet_ntop(AF_INET6, reply->fixed.data, tmp_addr,
2208  sizeof(tmp_addr)),
2209  print_hex_1(reply->client_id.len,
2210  reply->client_id.data, 60),
2211  iaid);
2212 
2213  if ((reply->buf.reply.msg_type == DHCPV6_REPLY) &&
2214  (reply->on_star.on_commit != NULL)) {
2215  execute_statements(NULL, reply->packet, NULL, NULL,
2216  reply->packet->options,
2217  reply->opt_state, NULL,
2218  reply->on_star.on_commit, NULL);
2220  (&reply->on_star.on_commit, MDL);
2221  }
2222  goto cleanup;
2223  }
2224 
2225  /*
2226  * If we have any addresses log what we are doing.
2227  */
2228  if (reply->ia->num_iasubopt != 0) {
2229  struct iasubopt *tmp;
2230  int i;
2231  char tmp_addr[INET6_ADDRSTRLEN];
2232 
2233  for (i = 0 ; i < reply->ia->num_iasubopt ; i++) {
2234  tmp = reply->ia->iasubopt[i];
2235 
2236  log_info("%s NA: address %s to client with duid %s "
2237  "iaid = %d valid for %u seconds",
2238  dhcpv6_type_names[reply->buf.reply.msg_type],
2239  inet_ntop(AF_INET6, &tmp->addr,
2240  tmp_addr, sizeof(tmp_addr)),
2241  print_hex_1(reply->client_id.len,
2242  reply->client_id.data, 60),
2243  iaid, tmp->valid);
2244  }
2245  }
2246 
2247  /*
2248  * If this is not a 'soft' binding, consume the new changes into
2249  * the database (if any have been attached to the ia_na).
2250  *
2251  * Loop through the assigned dynamic addresses, referencing the
2252  * leases onto this IA_NA rather than any old ones, and updating
2253  * pool timers for each (if any).
2254  */
2255 
2256  if ((reply->ia->num_iasubopt != 0) &&
2257  (reply->buf.reply.msg_type == DHCPV6_REPLY)) {
2258  struct iasubopt *tmp;
2259  struct data_string *ia_id;
2260  int i;
2261 
2262  for (i = 0 ; i < reply->ia->num_iasubopt ; i++) {
2263  tmp = reply->ia->iasubopt[i];
2264 
2265  if (tmp->ia != NULL)
2266  ia_dereference(&tmp->ia, MDL);
2267  ia_reference(&tmp->ia, reply->ia, MDL);
2268 
2269  /* Commit 'hard' bindings. */
2270  renew_lease6(tmp->ipv6_pool, tmp);
2272 
2273  /* If we have anything to do on commit do it now */
2274  if (tmp->on_star.on_commit != NULL) {
2275  execute_statements(NULL, reply->packet,
2276  NULL, NULL,
2277  reply->packet->options,
2278  reply->opt_state,
2279  &tmp->scope,
2280  tmp->on_star.on_commit,
2281  &tmp->on_star);
2283  (&tmp->on_star.on_commit, MDL);
2284  }
2285 
2286 #if defined (NSUPDATE)
2287  /*
2288  * Perform ddns updates.
2289  */
2290  oc = lookup_option(&server_universe, reply->opt_state,
2291  SV_DDNS_UPDATES);
2292  if ((oc == NULL) ||
2293  evaluate_boolean_option_cache(NULL, reply->packet,
2294  NULL, NULL,
2295  reply->packet->options,
2296  reply->opt_state,
2297  &tmp->scope,
2298  oc, MDL)) {
2299  ddns_updates(reply->packet, NULL, NULL,
2300  tmp, NULL, reply->opt_state);
2301  }
2302 #endif
2303  /* Do our threshold check. */
2304  check_pool6_threshold(reply, tmp);
2305  }
2306 
2307  /* Remove any old ia from the hash. */
2308  if (reply->old_ia != NULL) {
2309  ia_id = &reply->old_ia->iaid_duid;
2310  ia_hash_delete(ia_na_active,
2311  (unsigned char *)ia_id->data,
2312  ia_id->len, MDL);
2313  ia_dereference(&reply->old_ia, MDL);
2314  }
2315 
2316  /* Put new ia into the hash. */
2317  reply->ia->cltt = cur_time;
2318  ia_id = &reply->ia->iaid_duid;
2319  ia_hash_add(ia_na_active, (unsigned char *)ia_id->data,
2320  ia_id->len, reply->ia, MDL);
2321 
2322  write_ia(reply->ia);
2323  } else {
2324  schedule_lease_timeout_reply(reply);
2325  }
2326 
2327  cleanup:
2328  if (packet_ia != NULL)
2329  option_state_dereference(&packet_ia, MDL);
2330  if (reply->reply_ia != NULL)
2331  option_state_dereference(&reply->reply_ia, MDL);
2332  if (ia_data.data != NULL)
2333  data_string_forget(&ia_data, MDL);
2334  if (data.data != NULL)
2336  if (reply->ia != NULL)
2337  ia_dereference(&reply->ia, MDL);
2338  if (reply->old_ia != NULL)
2339  ia_dereference(&reply->old_ia, MDL);
2340  if (reply->lease != NULL)
2341  iasubopt_dereference(&reply->lease, MDL);
2342  if (reply->fixed.data != NULL)
2343  data_string_forget(&reply->fixed, MDL);
2344  if (reply->subnet != NULL)
2345  subnet_dereference(&reply->subnet, MDL);
2346  if (reply->on_star.on_expiry != NULL)
2348  (&reply->on_star.on_expiry, MDL);
2349  if (reply->on_star.on_release != NULL)
2351  (&reply->on_star.on_release, MDL);
2352 
2353  /*
2354  * ISC_R_CANCELED is a status code used by the addr processing to
2355  * indicate we're replying with a status code. This is still a
2356  * success at higher layers.
2357  */
2358  return((status == ISC_R_CANCELED) ? ISC_R_SUCCESS : status);
2359 }
2360 
2361 /*
2362  * Process an IAADDR within a given IA_xA, storing any IAADDR reply contents
2363  * into the reply's current ia-scoped option cache. Returns ISC_R_CANCELED
2364  * in the event we are replying with a status code and do not wish to process
2365  * more IAADDRs within this IA.
2366  */
2367 static isc_result_t
2368 reply_process_addr(struct reply_state *reply, struct option_cache *addr) {
2369  u_int32_t pref_life, valid_life;
2370  struct binding_scope **scope;
2371  struct group *group;
2372  struct subnet *subnet;
2373  struct iaddr tmp_addr;
2374  struct option_cache *oc;
2375  struct data_string iaaddr, data;
2376  isc_result_t status = ISC_R_SUCCESS;
2377 
2378  /* Initializes values that will be cleaned up. */
2379  memset(&iaaddr, 0, sizeof(iaaddr));
2380  memset(&data, 0, sizeof(data));
2381  /* Note that reply->lease may be set by address_is_owned() */
2382 
2383  /*
2384  * There is no point trying to process an incoming address if there
2385  * is no room for an outgoing address.
2386  */
2387  if ((reply->cursor + 28) > sizeof(reply->buf)) {
2388  log_error("reply_process_addr: Out of room for address.");
2389  return ISC_R_NOSPACE;
2390  }
2391 
2392  /* Extract this IAADDR option. */
2393  if (!evaluate_option_cache(&iaaddr, reply->packet, NULL, NULL,
2394  reply->packet->options, NULL, &global_scope,
2395  addr, MDL) ||
2396  (iaaddr.len < IAADDR_OFFSET)) {
2397  log_error("reply_process_addr: error evaluating IAADDR.");
2398  status = ISC_R_FAILURE;
2399  goto cleanup;
2400  }
2401 
2402  /* The first 16 bytes are the IPv6 address. */
2403  pref_life = getULong(iaaddr.data + 16);
2404  valid_life = getULong(iaaddr.data + 20);
2405 
2406  if ((reply->client_valid == 0) ||
2407  (reply->client_valid > valid_life))
2408  reply->client_valid = valid_life;
2409 
2410  if ((reply->client_prefer == 0) ||
2411  (reply->client_prefer > pref_life))
2412  reply->client_prefer = pref_life;
2413 
2414  /*
2415  * Clients may choose to send :: as an address, with the idea to give
2416  * hints about preferred-lifetime or valid-lifetime.
2417  */
2418  tmp_addr.len = 16;
2419  memset(tmp_addr.iabuf, 0, 16);
2420  if (!memcmp(iaaddr.data, tmp_addr.iabuf, 16)) {
2421  /* Status remains success; we just ignore this one. */
2422  goto cleanup;
2423  }
2424 
2425  /* tmp_addr len remains 16 */
2426  memcpy(tmp_addr.iabuf, iaaddr.data, 16);
2427 
2428  /*
2429  * Verify that this address is on the client's network.
2430  */
2431  for (subnet = reply->shared->subnets ; subnet != NULL ;
2432  subnet = subnet->next_sibling) {
2433  if (addr_eq(subnet_number(tmp_addr, subnet->netmask),
2434  subnet->net))
2435  break;
2436  }
2437 
2438  /* Address not found on shared network. */
2439  if (subnet == NULL) {
2440  /* Ignore this address on 'soft' bindings. */
2441  if (reply->packet->dhcpv6_msg_type == DHCPV6_SOLICIT) {
2442  /* disable rapid commit */
2443  reply->buf.reply.msg_type = DHCPV6_ADVERTISE;
2445  reply->opt_state,
2447  /* status remains success */
2448  goto cleanup;
2449  }
2450 
2451  /*
2452  * RFC3315 section 18.2.1:
2453  *
2454  * If the server finds that the prefix on one or more IP
2455  * addresses in any IA in the message from the client is not
2456  * appropriate for the link to which the client is connected,
2457  * the server MUST return the IA to the client with a Status
2458  * Code option with the value NotOnLink.
2459  */
2460  if (reply->packet->dhcpv6_msg_type == DHCPV6_REQUEST) {
2461  /* Rewind the IA_NA to empty. */
2462  option_state_dereference(&reply->reply_ia, MDL);
2463  if (!option_state_allocate(&reply->reply_ia, MDL)) {
2464  log_error("reply_process_addr: No memory for "
2465  "option state wipe.");
2466  status = ISC_R_NOMEMORY;
2467  goto cleanup;
2468  }
2469 
2470  /* Append a NotOnLink status code. */
2471  if (!set_status_code(STATUS_NotOnLink,
2472  "Address not for use on this "
2473  "link.", reply->reply_ia)) {
2474  log_error("reply_process_addr: Failure "
2475  "setting status code.");
2476  status = ISC_R_FAILURE;
2477  goto cleanup;
2478  }
2479 
2480  /* Fin (no more IAADDRs). */
2481  status = ISC_R_CANCELED;
2482  goto cleanup;
2483  }
2484 
2485  /*
2486  * RFC3315 sections 18.2.3 and 18.2.4 have identical language:
2487  *
2488  * If the server finds that any of the addresses are not
2489  * appropriate for the link to which the client is attached,
2490  * the server returns the address to the client with lifetimes
2491  * of 0.
2492  */
2493  if ((reply->packet->dhcpv6_msg_type != DHCPV6_RENEW) &&
2494  (reply->packet->dhcpv6_msg_type != DHCPV6_REBIND)) {
2495  log_error("It is impossible to lease a client that is "
2496  "not sending a solicit, request, renew, or "
2497  "rebind.");
2498  status = ISC_R_FAILURE;
2499  goto cleanup;
2500  }
2501 
2502  reply->send_prefer = reply->send_valid = 0;
2503  goto send_addr;
2504  }
2505 
2506  /* Verify the address belongs to the client. */
2507  if (!address_is_owned(reply, &tmp_addr)) {
2508  /*
2509  * For solicit and request, any addresses included are
2510  * 'requested' addresses. For rebind, we actually have
2511  * no direction on what to do from 3315 section 18.2.4!
2512  * So I think the best bet is to try and give it out, and if
2513  * we can't, zero lifetimes.
2514  */
2515  if ((reply->packet->dhcpv6_msg_type == DHCPV6_SOLICIT) ||
2516  (reply->packet->dhcpv6_msg_type == DHCPV6_REQUEST) ||
2517  (reply->packet->dhcpv6_msg_type == DHCPV6_REBIND)) {
2518  status = reply_process_try_addr(reply, &tmp_addr);
2519 
2520  /*
2521  * If the address is in use, or isn't in any dynamic
2522  * range, continue as normal. If any other error was
2523  * found, error out.
2524  */
2525  if ((status != ISC_R_SUCCESS) &&
2526  (status != ISC_R_ADDRINUSE) &&
2527  (status != ISC_R_ADDRNOTAVAIL))
2528  goto cleanup;
2529 
2530  /*
2531  * If we didn't honor this lease, for solicit and
2532  * request we simply omit it from our answer. For
2533  * rebind, we send it with zeroed lifetimes.
2534  */
2535  if (reply->lease == NULL) {
2536  if (reply->packet->dhcpv6_msg_type ==
2537  DHCPV6_REBIND) {
2538  reply->send_prefer = 0;
2539  reply->send_valid = 0;
2540  goto send_addr;
2541  }
2542 
2543  /* status remains success - ignore */
2544  goto cleanup;
2545  }
2546  /*
2547  * RFC3315 section 18.2.3:
2548  *
2549  * If the server cannot find a client entry for the IA the
2550  * server returns the IA containing no addresses with a Status
2551  * Code option set to NoBinding in the Reply message.
2552  *
2553  * On mismatch we (ab)use this pretending we have not the IA
2554  * as soon as we have not an address.
2555  */
2556  } else if (reply->packet->dhcpv6_msg_type == DHCPV6_RENEW) {
2557  /* Rewind the IA_NA to empty. */
2558  option_state_dereference(&reply->reply_ia, MDL);
2559  if (!option_state_allocate(&reply->reply_ia, MDL)) {
2560  log_error("reply_process_addr: No memory for "
2561  "option state wipe.");
2562  status = ISC_R_NOMEMORY;
2563  goto cleanup;
2564  }
2565 
2566  /* Append a NoBinding status code. */
2567  if (!set_status_code(STATUS_NoBinding,
2568  "Address not bound to this "
2569  "interface.", reply->reply_ia)) {
2570  log_error("reply_process_addr: Unable to "
2571  "attach status code.");
2572  status = ISC_R_FAILURE;
2573  goto cleanup;
2574  }
2575 
2576  /* Fin (no more IAADDRs). */
2577  status = ISC_R_CANCELED;
2578  goto cleanup;
2579  } else {
2580  log_error("It is impossible to lease a client that is "
2581  "not sending a solicit, request, renew, or "
2582  "rebind message.");
2583  status = ISC_R_FAILURE;
2584  goto cleanup;
2585  }
2586  }
2587 
2588  if (reply->static_lease) {
2589  if (reply->host == NULL)
2590  log_fatal("Impossible condition at %s:%d.", MDL);
2591 
2592  scope = &global_scope;
2593  group = reply->subnet->group;
2594  } else {
2595  if (reply->lease == NULL)
2596  log_fatal("Impossible condition at %s:%d.", MDL);
2597 
2598  scope = &reply->lease->scope;
2599  group = reply->lease->ipv6_pool->ipv6_pond->group;
2600  }
2601 
2602  /*
2603  * If client_resources is nonzero, then the reply_process_is_addressed
2604  * function has executed configuration state into the reply option
2605  * cache. We will use that valid cache to derive configuration for
2606  * whether or not to engage in additional addresses, and similar.
2607  */
2608  if (reply->client_resources != 0) {
2609  unsigned limit = 1;
2610 
2611  /*
2612  * Does this client have "enough" addresses already? Default
2613  * to one. Everybody gets one, and one should be enough for
2614  * anybody.
2615  */
2616  oc = lookup_option(&server_universe, reply->opt_state,
2618  if (oc != NULL) {
2619  if (!evaluate_option_cache(&data, reply->packet,
2620  NULL, NULL,
2621  reply->packet->options,
2622  reply->opt_state,
2623  scope, oc, MDL) ||
2624  (data.len != 4)) {
2625  log_error("reply_process_addr: unable to "
2626  "evaluate addrs-per-ia value.");
2627  status = ISC_R_FAILURE;
2628  goto cleanup;
2629  }
2630 
2631  limit = getULong(data.data);
2633  }
2634 
2635  /*
2636  * If we wish to limit the client to a certain number of
2637  * addresses, then omit the address from the reply.
2638  */
2639  if (reply->client_resources >= limit)
2640  goto cleanup;
2641  }
2642 
2643  status = reply_process_is_addressed(reply, scope, group);
2644  if (status != ISC_R_SUCCESS)
2645  goto cleanup;
2646 
2647  send_addr:
2648  status = reply_process_send_addr(reply, &tmp_addr);
2649 
2650  cleanup:
2651  if (iaaddr.data != NULL)
2652  data_string_forget(&iaaddr, MDL);
2653  if (data.data != NULL)
2655  if (reply->lease != NULL)
2656  iasubopt_dereference(&reply->lease, MDL);
2657 
2658  return status;
2659 }
2660 
2661 /*
2662  * Verify the address belongs to the client. If we've got a host
2663  * record with a fixed address, it has to be the assigned address
2664  * (fault out all else). Otherwise it's a dynamic address, so lookup
2665  * that address and make sure it belongs to this DUID:IAID pair.
2666  */
2667 static isc_boolean_t
2668 address_is_owned(struct reply_state *reply, struct iaddr *addr) {
2669  int i;
2670  struct ipv6_pond *pond;
2671 
2672  /*
2673  * This faults out addresses that don't match fixed addresses.
2674  */
2675  if (reply->static_lease) {
2676  if (reply->fixed.data == NULL)
2677  log_fatal("Impossible condition at %s:%d.", MDL);
2678 
2679  if (memcmp(addr->iabuf, reply->fixed.data, 16) == 0)
2680  return (ISC_TRUE);
2681 
2682  return (ISC_FALSE);
2683  }
2684 
2685  if ((reply->old_ia == NULL) || (reply->old_ia->num_iasubopt == 0))
2686  return (ISC_FALSE);
2687 
2688  for (i = 0 ; i < reply->old_ia->num_iasubopt ; i++) {
2689  struct iasubopt *tmp;
2690 
2691  tmp = reply->old_ia->iasubopt[i];
2692 
2693  if (memcmp(addr->iabuf, &tmp->addr, 16) == 0) {
2694  if (lease6_usable(tmp) == ISC_FALSE) {
2695  return (ISC_FALSE);
2696  }
2697 
2698  pond = tmp->ipv6_pool->ipv6_pond;
2699  if (((pond->prohibit_list != NULL) &&
2700  (permitted(reply->packet, pond->prohibit_list))) ||
2701  ((pond->permit_list != NULL) &&
2702  (!permitted(reply->packet, pond->permit_list))))
2703  return (ISC_FALSE);
2704 
2705  iasubopt_reference(&reply->lease, tmp, MDL);
2706 
2707  return (ISC_TRUE);
2708  }
2709  }
2710 
2711  return (ISC_FALSE);
2712 }
2713 
2714 /* Process a client-supplied IA_TA. This may append options to the tail of
2715  * the reply packet being built in the reply_state structure.
2716  */
2717 static isc_result_t
2718 reply_process_ia_ta(struct reply_state *reply, struct option_cache *ia) {
2719  isc_result_t status = ISC_R_SUCCESS;
2720  u_int32_t iaid;
2721  unsigned ia_cursor;
2722  struct option_state *packet_ia;
2723  struct option_cache *oc;
2724  struct data_string ia_data, data;
2725  struct data_string iaaddr;
2726  u_int32_t pref_life, valid_life;
2727  struct iaddr tmp_addr;
2728 
2729  /* Initialize values that will get cleaned up on return. */
2730  packet_ia = NULL;
2731  memset(&ia_data, 0, sizeof(ia_data));
2732  memset(&data, 0, sizeof(data));
2733  memset(&iaaddr, 0, sizeof(iaaddr));
2734 
2735  /* Make sure there is at least room for the header. */
2736  if ((reply->cursor + IA_TA_OFFSET + 4) > sizeof(reply->buf)) {
2737  log_error("reply_process_ia_ta: Reply too long for IA.");
2738  return ISC_R_NOSPACE;
2739  }
2740 
2741 
2742  /* Fetch the IA_TA contents. */
2743  if (!get_encapsulated_IA_state(&packet_ia, &ia_data, reply->packet,
2744  ia, IA_TA_OFFSET)) {
2745  log_error("reply_process_ia_ta: error evaluating ia");
2746  status = ISC_R_FAILURE;
2747  goto cleanup;
2748  }
2749 
2750  /* Extract IA_TA header contents. */
2751  iaid = getULong(ia_data.data);
2752 
2753  /* Create an IA_TA structure. */
2754  if (ia_allocate(&reply->ia, iaid, (char *)reply->client_id.data,
2755  reply->client_id.len, MDL) != ISC_R_SUCCESS) {
2756  log_error("reply_process_ia_ta: no memory for ia.");
2757  status = ISC_R_NOMEMORY;
2758  goto cleanup;
2759  }
2760  reply->ia->ia_type = D6O_IA_TA;
2761 
2762  /* Cache pre-existing IA, if any. */
2763  ia_hash_lookup(&reply->old_ia, ia_ta_active,
2764  (unsigned char *)reply->ia->iaid_duid.data,
2765  reply->ia->iaid_duid.len, MDL);
2766 
2767  /*
2768  * Create an option cache to carry the IA_TA option contents, and
2769  * execute any user-supplied values into it.
2770  */
2771  if (!option_state_allocate(&reply->reply_ia, MDL)) {
2772  status = ISC_R_NOMEMORY;
2773  goto cleanup;
2774  }
2775 
2776  /*
2777  * Temporary leases are dynamic by definition.
2778  */
2779  reply->static_lease = ISC_FALSE;
2780 
2781  /*
2782  * Save the cursor position at the start of the IA, so we can
2783  * set length later. We write a temporary
2784  * header out now just in case we decide to adjust the packet
2785  * within sub-process functions.
2786  */
2787  ia_cursor = reply->cursor;
2788 
2789  /* Initialize the IA_TA header. First the code. */
2790  putUShort(reply->buf.data + reply->cursor, (unsigned)D6O_IA_TA);
2791  reply->cursor += 2;
2792 
2793  /* Then option length. */
2794  putUShort(reply->buf.data + reply->cursor, 0x04u);
2795  reply->cursor += 2;
2796 
2797  /* Then IA_TA header contents; IAID. */
2798  putULong(reply->buf.data + reply->cursor, iaid);
2799  reply->cursor += 4;
2800 
2801  /*
2802  * Deal with an IAADDR for lifetimes.
2803  * For all or none, process IAADDRs as hints.
2804  */
2805  reply->min_valid = reply->min_prefer = INFINITE_TIME;
2806  reply->client_valid = reply->client_prefer = 0;
2807  oc = lookup_option(&dhcpv6_universe, packet_ia, D6O_IAADDR);
2808  for (; oc != NULL; oc = oc->next) {
2809  memset(&iaaddr, 0, sizeof(iaaddr));
2810  if (!evaluate_option_cache(&iaaddr, reply->packet,
2811  NULL, NULL,
2812  reply->packet->options, NULL,
2813  &global_scope, oc, MDL) ||
2814  (iaaddr.len < IAADDR_OFFSET)) {
2815  log_error("reply_process_ia_ta: error "
2816  "evaluating IAADDR.");
2817  status = ISC_R_FAILURE;
2818  goto cleanup;
2819  }
2820  /* The first 16 bytes are the IPv6 address. */
2821  pref_life = getULong(iaaddr.data + 16);
2822  valid_life = getULong(iaaddr.data + 20);
2823 
2824  if ((reply->client_valid == 0) ||
2825  (reply->client_valid > valid_life))
2826  reply->client_valid = valid_life;
2827 
2828  if ((reply->client_prefer == 0) ||
2829  (reply->client_prefer > pref_life))
2830  reply->client_prefer = pref_life;
2831 
2832  /* Nothing more if something has failed. */
2833  if (status == ISC_R_CANCELED)
2834  continue;
2835 
2836  tmp_addr.len = 16;
2837  memcpy(tmp_addr.iabuf, iaaddr.data, 16);
2838  if (!temporary_is_available(reply, &tmp_addr))
2839  goto bad_temp;
2840  status = reply_process_is_addressed(reply,
2841  &reply->lease->scope,
2842  reply->lease->ipv6_pool->ipv6_pond->group);
2843  if (status != ISC_R_SUCCESS)
2844  goto bad_temp;
2845  status = reply_process_send_addr(reply, &tmp_addr);
2846  if (status != ISC_R_SUCCESS)
2847  goto bad_temp;
2848  if (reply->lease != NULL)
2849  iasubopt_dereference(&reply->lease, MDL);
2850  continue;
2851 
2852  bad_temp:
2853  /* Rewind the IA_TA to empty. */
2854  option_state_dereference(&reply->reply_ia, MDL);
2855  if (!option_state_allocate(&reply->reply_ia, MDL)) {
2856  status = ISC_R_NOMEMORY;
2857  goto cleanup;
2858  }
2859  status = ISC_R_CANCELED;
2860  reply->client_resources = 0;
2861  reply->resources_included = ISC_FALSE;
2862  if (reply->lease != NULL)
2863  iasubopt_dereference(&reply->lease, MDL);
2864  }
2865  reply->ia_count++;
2866 
2867  /*
2868  * Give the client temporary addresses.
2869  */
2870  if (reply->client_resources != 0)
2871  goto store;
2872  status = find_client_temporaries(reply);
2873  if (status == ISC_R_NORESOURCES) {
2874  switch (reply->packet->dhcpv6_msg_type) {
2875  case DHCPV6_SOLICIT:
2876  /*
2877  * No address for any IA is handled
2878  * by the caller.
2879  */
2880  /* FALL THROUGH */
2881 
2882  case DHCPV6_REQUEST:
2883  /* Section 18.2.1 (Request):
2884  *
2885  * If the server cannot assign any addresses to
2886  * an IA in the message from the client, the
2887  * server MUST include the IA in the Reply
2888  * message with no addresses in the IA and a
2889  * Status Code option in the IA containing
2890  * status code NoAddrsAvail.
2891  */
2892  option_state_dereference(&reply->reply_ia, MDL);
2893  if (!option_state_allocate(&reply->reply_ia, MDL)) {
2894  log_error("reply_process_ia_ta: No "
2895  "memory for option state wipe.");
2896  status = ISC_R_NOMEMORY;
2897  goto cleanup;
2898  }
2899 
2900  if (!set_status_code(STATUS_NoAddrsAvail,
2901  "No addresses available "
2902  "for this interface.",
2903  reply->reply_ia)) {
2904  log_error("reply_process_ia_ta: Unable "
2905  "to set NoAddrsAvail status code.");
2906  status = ISC_R_FAILURE;
2907  goto cleanup;
2908  }
2909 
2910  status = ISC_R_SUCCESS;
2911  break;
2912 
2913  default:
2914  /*
2915  * We don't want to include the IA if we
2916  * provide zero addresses including zeroed
2917  * lifetimes.
2918  */
2919  if (reply->resources_included)
2920  status = ISC_R_SUCCESS;
2921  else
2922  goto cleanup;
2923  break;
2924  }
2925  } else if (status != ISC_R_SUCCESS)
2926  goto cleanup;
2927 
2928  store:
2929  reply->cursor += store_options6((char *)reply->buf.data + reply->cursor,
2930  sizeof(reply->buf) - reply->cursor,
2931  reply->reply_ia, reply->packet,
2932  required_opts_IA, NULL);
2933 
2934  /* Reset the length of this IA to match what was just written. */
2935  putUShort(reply->buf.data + ia_cursor + 2,
2936  reply->cursor - (ia_cursor + 4));
2937 
2938  /*
2939  * yes, goto's aren't the best but we also want to avoid extra
2940  * indents
2941  */
2942  if (status == ISC_R_CANCELED)
2943  goto cleanup;
2944 
2945  /*
2946  * If we have any addresses log what we are doing.
2947  */
2948  if (reply->ia->num_iasubopt != 0) {
2949  struct iasubopt *tmp;
2950  int i;
2951  char tmp_addr[INET6_ADDRSTRLEN];
2952 
2953  for (i = 0 ; i < reply->ia->num_iasubopt ; i++) {
2954  tmp = reply->ia->iasubopt[i];
2955 
2956  log_info("%s TA: address %s to client with duid %s "
2957  "iaid = %d valid for %u seconds",
2958  dhcpv6_type_names[reply->buf.reply.msg_type],
2959  inet_ntop(AF_INET6, &tmp->addr,
2960  tmp_addr, sizeof(tmp_addr)),
2961  print_hex_1(reply->client_id.len,
2962  reply->client_id.data, 60),
2963  iaid,
2964  tmp->valid);
2965  }
2966  }
2967 
2968  /*
2969  * For hard bindings we consume the new changes into
2970  * the database (if any have been attached to the ia_ta).
2971  *
2972  * Loop through the assigned dynamic addresses, referencing the
2973  * leases onto this IA_TA rather than any old ones, and updating
2974  * pool timers for each (if any).
2975  */
2976  if ((reply->ia->num_iasubopt != 0) &&
2977  (reply->buf.reply.msg_type == DHCPV6_REPLY)) {
2978  struct iasubopt *tmp;
2979  struct data_string *ia_id;
2980  int i;
2981 
2982  for (i = 0 ; i < reply->ia->num_iasubopt ; i++) {
2983  tmp = reply->ia->iasubopt[i];
2984 
2985  if (tmp->ia != NULL)
2986  ia_dereference(&tmp->ia, MDL);
2987  ia_reference(&tmp->ia, reply->ia, MDL);
2988 
2989  /* Commit 'hard' bindings. */
2990  renew_lease6(tmp->ipv6_pool, tmp);
2992 
2993  /* If we have anything to do on commit do it now */
2994  if (tmp->on_star.on_commit != NULL) {
2995  execute_statements(NULL, reply->packet,
2996  NULL, NULL,
2997  reply->packet->options,
2998  reply->opt_state,
2999  &tmp->scope,
3000  tmp->on_star.on_commit,
3001  &tmp->on_star);
3003  (&tmp->on_star.on_commit, MDL);
3004  }
3005 
3006 #if defined (NSUPDATE)
3007  /*
3008  * Perform ddns updates.
3009  */
3010  oc = lookup_option(&server_universe, reply->opt_state,
3011  SV_DDNS_UPDATES);
3012  if ((oc == NULL) ||
3013  evaluate_boolean_option_cache(NULL, reply->packet,
3014  NULL, NULL,
3015  reply->packet->options,
3016  reply->opt_state,
3017  &tmp->scope,
3018  oc, MDL)) {
3019  ddns_updates(reply->packet, NULL, NULL,
3020  tmp, NULL, reply->opt_state);
3021  }
3022 #endif
3023  /* Do our threshold check. */
3024  check_pool6_threshold(reply, tmp);
3025  }
3026 
3027  /* Remove any old ia from the hash. */
3028  if (reply->old_ia != NULL) {
3029  ia_id = &reply->old_ia->iaid_duid;
3030  ia_hash_delete(ia_ta_active,
3031  (unsigned char *)ia_id->data,
3032  ia_id->len, MDL);
3033  ia_dereference(&reply->old_ia, MDL);
3034  }
3035 
3036  /* Put new ia into the hash. */
3037  reply->ia->cltt = cur_time;
3038  ia_id = &reply->ia->iaid_duid;
3039  ia_hash_add(ia_ta_active, (unsigned char *)ia_id->data,
3040  ia_id->len, reply->ia, MDL);
3041 
3042  write_ia(reply->ia);
3043  } else {
3044  schedule_lease_timeout_reply(reply);
3045  }
3046 
3047  cleanup:
3048  if (packet_ia != NULL)
3049  option_state_dereference(&packet_ia, MDL);
3050  if (iaaddr.data != NULL)
3051  data_string_forget(&iaaddr, MDL);
3052  if (reply->reply_ia != NULL)
3053  option_state_dereference(&reply->reply_ia, MDL);
3054  if (ia_data.data != NULL)
3055  data_string_forget(&ia_data, MDL);
3056  if (data.data != NULL)
3058  if (reply->ia != NULL)
3059  ia_dereference(&reply->ia, MDL);
3060  if (reply->old_ia != NULL)
3061  ia_dereference(&reply->old_ia, MDL);
3062  if (reply->lease != NULL)
3063  iasubopt_dereference(&reply->lease, MDL);
3064 
3065  /*
3066  * ISC_R_CANCELED is a status code used by the addr processing to
3067  * indicate we're replying with other addresses. This is still a
3068  * success at higher layers.
3069  */
3070  return((status == ISC_R_CANCELED) ? ISC_R_SUCCESS : status);
3071 }
3072 
3073 /*
3074  * Verify the temporary address is available.
3075  */
3076 static isc_boolean_t
3077 temporary_is_available(struct reply_state *reply, struct iaddr *addr) {
3078  struct in6_addr tmp_addr;
3079  struct subnet *subnet;
3080  struct ipv6_pool *pool = NULL;
3081  struct ipv6_pond *pond = NULL;
3082  int i;
3083 
3084  memcpy(&tmp_addr, addr->iabuf, sizeof(tmp_addr));
3085  /*
3086  * Clients may choose to send :: as an address, with the idea to give
3087  * hints about preferred-lifetime or valid-lifetime.
3088  * So this is not a request for this address.
3089  */
3090  if (IN6_IS_ADDR_UNSPECIFIED(&tmp_addr))
3091  return ISC_FALSE;
3092 
3093  /*
3094  * Verify that this address is on the client's network.
3095  */
3096  for (subnet = reply->shared->subnets ; subnet != NULL ;
3097  subnet = subnet->next_sibling) {
3098  if (addr_eq(subnet_number(*addr, subnet->netmask),
3099  subnet->net))
3100  break;
3101  }
3102 
3103  /* Address not found on shared network. */
3104  if (subnet == NULL)
3105  return ISC_FALSE;
3106 
3107  /*
3108  * Check if this address is owned (must be before next step).
3109  */
3110  if (address_is_owned(reply, addr))
3111  return ISC_TRUE;
3112 
3113  /*
3114  * Verify that this address is in a temporary pool and try to get it.
3115  */
3116  for (pond = reply->shared->ipv6_pond; pond != NULL; pond = pond->next) {
3117  if (((pond->prohibit_list != NULL) &&
3118  (permitted(reply->packet, pond->prohibit_list))) ||
3119  ((pond->permit_list != NULL) &&
3120  (!permitted(reply->packet, pond->permit_list))))
3121  continue;
3122 
3123  for (i = 0 ; (pool = pond->ipv6_pools[i]) != NULL ; i++) {
3124  if (pool->pool_type != D6O_IA_TA)
3125  continue;
3126 
3127  if (ipv6_in_pool(&tmp_addr, pool))
3128  break;
3129  }
3130 
3131  if (pool != NULL)
3132  break;
3133  }
3134 
3135  if (pool == NULL)
3136  return ISC_FALSE;
3137  if (lease6_exists(pool, &tmp_addr))
3138  return ISC_FALSE;
3139  if (iasubopt_allocate(&reply->lease, MDL) != ISC_R_SUCCESS)
3140  return ISC_FALSE;
3141  reply->lease->addr = tmp_addr;
3142  reply->lease->plen = 0;
3143  /* Default is soft binding for 2 minutes. */
3144  if (add_lease6(pool, reply->lease, cur_time + 120) != ISC_R_SUCCESS)
3145  return ISC_FALSE;
3146 
3147  return ISC_TRUE;
3148 }
3149 
3150 /*
3151  * Get a temporary address per prefix.
3152  */
3153 static isc_result_t
3154 find_client_temporaries(struct reply_state *reply) {
3155  int i;
3156  struct ipv6_pool *p = NULL;
3157  struct ipv6_pond *pond;
3158  isc_result_t status = ISC_R_NORESOURCES;;
3159  unsigned int attempts;
3160  struct iaddr send_addr;
3161 
3162  /*
3163  * Do a quick walk through of the ponds and pools
3164  * to see if we have any prefix pools
3165  */
3166  for (pond = reply->shared->ipv6_pond; pond != NULL; pond = pond->next) {
3167  if (pond->ipv6_pools == NULL)
3168  continue;
3169 
3170  for (i = 0; (p = pond->ipv6_pools[i]) != NULL; i++) {
3171  if (p->pool_type == D6O_IA_TA)
3172  break;
3173  }
3174  if (p != NULL)
3175  break;
3176  }
3177 
3178  /* If we get here and p is NULL we have no useful pools */
3179  if (p == NULL) {
3180  log_debug("Unable to get client addresses: "
3181  "no IPv6 pools on this shared network");
3182  return ISC_R_NORESOURCES;
3183  }
3184 
3185  /*
3186  * We have at least one pool that could provide an address
3187  * Now we walk through the ponds and pools again and check
3188  * to see if the client is permitted and if an address is
3189  * available
3190  */
3191 
3192  for (pond = reply->shared->ipv6_pond; pond != NULL; pond = pond->next) {
3193  if (((pond->prohibit_list != NULL) &&
3194  (permitted(reply->packet, pond->prohibit_list))) ||
3195  ((pond->permit_list != NULL) &&
3196  (!permitted(reply->packet, pond->permit_list))))
3197  continue;
3198 
3199  for (i = 0; (p = pond->ipv6_pools[i]) != NULL; i++) {
3200  if (p->pool_type != D6O_IA_TA) {
3201  continue;
3202  }
3203 
3204  /*
3205  * Get an address in this temporary pool.
3206  */
3207  status = create_lease6(p, &reply->lease, &attempts,
3208  &reply->client_id, cur_time + 120);
3209  if (status != ISC_R_SUCCESS) {
3210  log_debug("Unable to get a temporary address.");
3211  goto cleanup;
3212  }
3213 
3214  status = reply_process_is_addressed(reply,
3215  &reply->lease->scope,
3216  pond->group);
3217  if (status != ISC_R_SUCCESS) {
3218  goto cleanup;
3219  }
3220  send_addr.len = 16;
3221  memcpy(send_addr.iabuf, &reply->lease->addr, 16);
3222  status = reply_process_send_addr(reply, &send_addr);
3223  if (status != ISC_R_SUCCESS) {
3224  goto cleanup;
3225  }
3226  /*
3227  * reply->lease can't be null as we use it above
3228  * add check if that changes
3229  */
3230  iasubopt_dereference(&reply->lease, MDL);
3231  }
3232  }
3233 
3234  cleanup:
3235  if (reply->lease != NULL) {
3236  iasubopt_dereference(&reply->lease, MDL);
3237  }
3238  return status;
3239 }
3240 
3241 /*
3242  * This function only returns failure on 'hard' failures. If it succeeds,
3243  * it will leave a lease structure behind.
3244  */
3245 static isc_result_t
3246 reply_process_try_addr(struct reply_state *reply, struct iaddr *addr) {
3247  isc_result_t status = ISC_R_ADDRNOTAVAIL;
3248  struct ipv6_pool *pool = NULL;
3249  struct ipv6_pond *pond = NULL;
3250  int i;
3251  struct data_string data_addr;
3252 
3253  if ((reply == NULL) || (reply->shared == NULL) ||
3254  (addr == NULL) || (reply->lease != NULL))
3255  return (DHCP_R_INVALIDARG);
3256 
3257  /*
3258  * Do a quick walk through of the ponds and pools
3259  * to see if we have any NA address pools
3260  */
3261  for (pond = reply->shared->ipv6_pond; pond != NULL; pond = pond->next) {
3262  if (pond->ipv6_pools == NULL)
3263  continue;
3264 
3265  for (i = 0; ; i++) {
3266  pool = pond->ipv6_pools[i];
3267  if ((pool == NULL) ||
3268  (pool->pool_type == D6O_IA_NA))
3269  break;
3270  }
3271  if (pool != NULL)
3272  break;
3273  }
3274 
3275  /* If we get here and p is NULL we have no useful pools */
3276  if (pool == NULL) {
3277  return (ISC_R_ADDRNOTAVAIL);
3278  }
3279 
3280  memset(&data_addr, 0, sizeof(data_addr));
3281  data_addr.len = addr->len;
3282  data_addr.data = addr->iabuf;
3283 
3284  /*
3285  * We have at least one pool that could provide an address
3286  * Now we walk through the ponds and pools again and check
3287  * to see if the client is permitted and if an address is
3288  * available
3289  *
3290  * Within a given pond we start looking at the last pool we
3291  * allocated from, unless it had a collision trying to allocate
3292  * an address. This will tend to move us into less-filled pools.
3293  */
3294 
3295  for (pond = reply->shared->ipv6_pond; pond != NULL; pond = pond->next) {
3296  if (((pond->prohibit_list != NULL) &&
3297  (permitted(reply->packet, pond->prohibit_list))) ||
3298  ((pond->permit_list != NULL) &&
3299  (!permitted(reply->packet, pond->permit_list))))
3300  continue;
3301 
3302  for (i = 0 ; (pool = pond->ipv6_pools[i]) != NULL ; i++) {
3303  if (pool->pool_type != D6O_IA_NA)
3304  continue;
3305 
3306  status = try_client_v6_address(&reply->lease, pool,
3307  &data_addr);
3308  if (status == ISC_R_SUCCESS)
3309  break;
3310  }
3311 
3312  if (status == ISC_R_SUCCESS)
3313  break;
3314  }
3315 
3316  /* Note that this is just pedantry. There is no allocation to free. */
3317  data_string_forget(&data_addr, MDL);
3318  /* Return just the most recent status... */
3319  return (status);
3320 }
3321 
3322 /* Look around for an address to give the client. First, look through the
3323  * old IA for addresses we can extend. Second, try to allocate a new address.
3324  * Finally, actually add that address into the current reply IA.
3325  */
3326 static isc_result_t
3327 find_client_address(struct reply_state *reply) {
3328  struct iaddr send_addr;
3329  isc_result_t status = ISC_R_NORESOURCES;
3330  struct iasubopt *lease, *best_lease = NULL;
3331  struct binding_scope **scope;
3332  struct group *group;
3333  int i;
3334 
3335  if (reply->static_lease) {
3336  if (reply->host == NULL)
3337  return DHCP_R_INVALIDARG;
3338 
3339  send_addr.len = 16;
3340  memcpy(send_addr.iabuf, reply->fixed.data, 16);
3341 
3342  scope = &global_scope;
3343  group = reply->subnet->group;
3344  goto send_addr;
3345  }
3346 
3347  if (reply->old_ia != NULL) {
3348  for (i = 0 ; i < reply->old_ia->num_iasubopt ; i++) {
3349  struct shared_network *candidate_shared;
3350  struct ipv6_pond *pond;
3351 
3352  lease = reply->old_ia->iasubopt[i];
3353  candidate_shared = lease->ipv6_pool->shared_network;
3354  pond = lease->ipv6_pool->ipv6_pond;
3355 
3356  /*
3357  * Look for the best lease on the client's shared
3358  * network, that is still permitted
3359  */
3360 
3361  if ((candidate_shared != reply->shared) ||
3362  (lease6_usable(lease) != ISC_TRUE))
3363  continue;
3364 
3365  if (((pond->prohibit_list != NULL) &&
3366  (permitted(reply->packet, pond->prohibit_list))) ||
3367  ((pond->permit_list != NULL) &&
3368  (!permitted(reply->packet, pond->permit_list))))
3369  continue;
3370 
3371  best_lease = lease_compare(lease, best_lease);
3372  }
3373  }
3374 
3375  /* Try to pick a new address if we didn't find one, or if we found an
3376  * abandoned lease.
3377  */
3378  if ((best_lease == NULL) || (best_lease->state == FTS_ABANDONED)) {
3379  status = pick_v6_address(reply);
3380  } else if (best_lease != NULL) {
3381  iasubopt_reference(&reply->lease, best_lease, MDL);
3382  status = ISC_R_SUCCESS;
3383  }
3384 
3385  /* Pick the abandoned lease as a last resort. */
3386  if ((status == ISC_R_NORESOURCES) && (best_lease != NULL)) {
3387  /* I don't see how this is supposed to be done right now. */
3388  log_error("Best match for DUID %s is an abandoned address,"
3389  " This may be a result of multiple clients attempting"
3390  " to use this DUID",
3391  print_hex_1(reply->client_id.len,
3392  reply->client_id.data, 60));
3393  /* iasubopt_reference(&reply->lease, best_lease, MDL); */
3394  }
3395 
3396  /* Give up now if we didn't find a lease. */
3397  if (status != ISC_R_SUCCESS)
3398  return status;
3399 
3400  if (reply->lease == NULL)
3401  log_fatal("Impossible condition at %s:%d.", MDL);
3402 
3403  /* Draw binding scopes from the lease's binding scope, and config
3404  * from the lease's containing subnet and higher. Note that it may
3405  * be desirable to place the group attachment directly in the pool.
3406  */
3407  scope = &reply->lease->scope;
3408  group = reply->lease->ipv6_pool->ipv6_pond->group;
3409 
3410  send_addr.len = 16;
3411  memcpy(send_addr.iabuf, &reply->lease->addr, 16);
3412 
3413  send_addr:
3414  status = reply_process_is_addressed(reply, scope, group);
3415  if (status != ISC_R_SUCCESS)
3416  return status;
3417 
3418  status = reply_process_send_addr(reply, &send_addr);
3419  return status;
3420 }
3421 
3422 /* Once an address is found for a client, perform several common functions;
3423  * Calculate and store valid and preferred lease times, draw client options
3424  * into the option state.
3425  */
3426 static isc_result_t
3427 reply_process_is_addressed(struct reply_state *reply,
3428  struct binding_scope **scope, struct group *group)
3429 {
3430  isc_result_t status = ISC_R_SUCCESS;
3431  struct data_string data;
3432  struct option_cache *oc;
3433  struct option_state *tmp_options = NULL;
3434  struct on_star *on_star;
3435  int i;
3436 
3437  /* Initialize values we will cleanup. */
3438  memset(&data, 0, sizeof(data));
3439 
3440  /*
3441  * Find the proper on_star block to use. We use the
3442  * one in the lease if we have a lease or the one in
3443  * the reply if we don't have a lease because this is
3444  * a static instance
3445  */
3446  if (reply->lease) {
3447  on_star = &reply->lease->on_star;
3448  } else {
3449  on_star = &reply->on_star;
3450  }
3451 
3452  /*
3453  * Bring in the root configuration. We only do this to bring
3454  * in the on * statements, as we didn't have the lease available
3455  * we did it the first time.
3456  */
3457  option_state_allocate(&tmp_options, MDL);
3458  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
3459  reply->packet->options, tmp_options,
3460  &global_scope, root_group, NULL,
3461  on_star);
3462  if (tmp_options != NULL) {
3463  option_state_dereference(&tmp_options, MDL);
3464  }
3465 
3466  /*
3467  * Bring configured options into the root packet level cache - start
3468  * with the lease's closest enclosing group (passed in by the caller
3469  * as 'group').
3470  */
3471  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
3472  reply->packet->options, reply->opt_state,
3473  scope, group, root_group, on_star);
3474 
3475  /* Execute statements from class scopes. */
3476  for (i = reply->packet->class_count; i > 0; i--) {
3477  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
3478  reply->packet->options,
3479  reply->opt_state, scope,
3480  reply->packet->classes[i - 1]->group,
3481  group, on_star);
3482  }
3483 
3484  /*
3485  * If there is a host record, over-ride with values configured there,
3486  * without re-evaluating configuration from the previously executed
3487  * group or its common enclosers.
3488  */
3489  if (reply->host != NULL)
3490  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
3491  reply->packet->options,
3492  reply->opt_state, scope,
3493  reply->host->group, group,
3494  on_star);
3495 
3496  /* Determine valid lifetime. */
3497  if (reply->client_valid == 0)
3498  reply->send_valid = DEFAULT_DEFAULT_LEASE_TIME;
3499  else
3500  reply->send_valid = reply->client_valid;
3501 
3502  oc = lookup_option(&server_universe, reply->opt_state,
3504  if (oc != NULL) {
3505  if (!evaluate_option_cache(&data, reply->packet, NULL, NULL,
3506  reply->packet->options,
3507  reply->opt_state,
3508  scope, oc, MDL) ||
3509  (data.len != 4)) {
3510  log_error("reply_process_is_addressed: unable to "
3511  "evaluate default lease time");
3512  status = ISC_R_FAILURE;
3513  goto cleanup;
3514  }
3515 
3516  reply->send_valid = getULong(data.data);
3517  data_string_forget(&data, MDL);
3518  }
3519 
3520  /* Check to see if the lease time would cause us to wrap
3521  * in which case we make it infinite.
3522  * The following doesn't work on at least some systems:
3523  * (cur_time + reply->send_valid < cur_time)
3524  */
3525  if (reply->send_valid != INFINITE_TIME) {
3526  time_t test_time = cur_time + reply->send_valid;
3527  if (test_time < cur_time)
3528  reply->send_valid = INFINITE_TIME;
3529  }
3530 
3531  if (reply->client_prefer == 0)
3532  reply->send_prefer = reply->send_valid;
3533  else
3534  reply->send_prefer = reply->client_prefer;
3535 
3536  if ((reply->send_prefer >= reply->send_valid) &&
3537  (reply->send_valid != INFINITE_TIME))
3538  reply->send_prefer = (reply->send_valid / 2) +
3539  (reply->send_valid / 8);
3540 
3541  oc = lookup_option(&server_universe, reply->opt_state,
3543  if (oc != NULL) {
3544  if (!evaluate_option_cache(&data, reply->packet, NULL, NULL,
3545  reply->packet->options,
3546  reply->opt_state,
3547  scope, oc, MDL) ||
3548  (data.len != 4)) {
3549  log_error("reply_process_is_addressed: unable to "
3550  "evaluate preferred lease time");
3551  status = ISC_R_FAILURE;
3552  goto cleanup;
3553  }
3554 
3555  reply->send_prefer = getULong(data.data);
3556  data_string_forget(&data, MDL);
3557  }
3558 
3559  /* Note lowest values for later calculation of renew/rebind times. */
3560  if (reply->min_prefer > reply->send_prefer)
3561  reply->min_prefer = reply->send_prefer;
3562 
3563  if (reply->min_valid > reply->send_valid)
3564  reply->min_valid = reply->send_valid;
3565 
3566 #if 0
3567  /*
3568  * XXX: Old 4.0.0 alpha code would change the host {} record
3569  * XXX: uid upon lease assignment. This was intended to cover the
3570  * XXX: case where a client first identifies itself using vendor
3571  * XXX: options in a solicit, or request, but later neglects to include
3572  * XXX: these options in a Renew or Rebind. It is not clear that this
3573  * XXX: is required, and has some startling ramifications (such as
3574  * XXX: how to recover this dynamic host {} state across restarts).
3575  */
3576  if (reply->host != NULL)
3577  change_host_uid(host, reply->client_id->data,
3578  reply->client_id->len);
3579 #endif /* 0 */
3580 
3581  /* Perform dynamic lease related update work. */
3582  if (reply->lease != NULL) {
3583  /* Cached lifetimes */
3584  reply->lease->prefer = reply->send_prefer;
3585  reply->lease->valid = reply->send_valid;
3586 
3587  /* Advance (or rewind) the valid lifetime.
3588  * In the protocol 0xFFFFFFFF is infinite
3589  * when connecting to the lease file MAX_TIME is
3590  */
3591  if (reply->buf.reply.msg_type == DHCPV6_REPLY) {
3592  if (reply->send_valid == INFINITE_TIME) {
3593  reply->lease->soft_lifetime_end_time = MAX_TIME;
3594  } else {
3595  reply->lease->soft_lifetime_end_time =
3596  cur_time + reply->send_valid;
3597  }
3598  /* Wait before renew! */
3599  }
3600 
3601  status = ia_add_iasubopt(reply->ia, reply->lease, MDL);
3602  if (status != ISC_R_SUCCESS) {
3603  log_fatal("reply_process_is_addressed: Unable to "
3604  "attach lease to new IA: %s",
3605  isc_result_totext(status));
3606  }
3607 
3608  /*
3609  * If this is a new lease, make sure it is attached somewhere.
3610  */
3611  if (reply->lease->ia == NULL) {
3612  ia_reference(&reply->lease->ia, reply->ia, MDL);
3613  }
3614  }
3615 
3616  /* Bring a copy of the relevant options into the IA scope. */
3617  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
3618  reply->packet->options, reply->reply_ia,
3619  scope, group, root_group, NULL);
3620 
3621  /* Execute statements from class scopes. */
3622  for (i = reply->packet->class_count; i > 0; i--) {
3623  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
3624  reply->packet->options,
3625  reply->reply_ia, scope,
3626  reply->packet->classes[i - 1]->group,
3627  group, NULL);
3628  }
3629 
3630  /*
3631  * And bring in host record configuration, if any, but not to overlap
3632  * the previous group or its common enclosers.
3633  */
3634  if (reply->host != NULL)
3635  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
3636  reply->packet->options,
3637  reply->reply_ia, scope,
3638  reply->host->group, group, NULL);
3639 
3640  cleanup:
3641  if (data.data != NULL)
3642  data_string_forget(&data, MDL);
3643 
3644  if (status == ISC_R_SUCCESS)
3645  reply->client_resources++;
3646 
3647  return status;
3648 }
3649 
3650 /* Simply send an IAADDR within the IA scope as described. */
3651 static isc_result_t
3652 reply_process_send_addr(struct reply_state *reply, struct iaddr *addr) {
3653  isc_result_t status = ISC_R_SUCCESS;
3654  struct data_string data;
3655 
3656  memset(&data, 0, sizeof(data));
3657 
3658  /* Now append the lease. */
3659  data.len = IAADDR_OFFSET;
3660  if (!buffer_allocate(&data.buffer, data.len, MDL)) {
3661  log_error("reply_process_send_addr: out of memory"
3662  "allocating new IAADDR buffer.");
3663  status = ISC_R_NOMEMORY;
3664  goto cleanup;
3665  }
3666  data.data = data.buffer->data;
3667 
3668  memcpy(data.buffer->data, addr->iabuf, 16);
3669  putULong(data.buffer->data + 16, reply->send_prefer);
3670  putULong(data.buffer->data + 20, reply->send_valid);
3671 
3672  if (!append_option_buffer(&dhcpv6_universe, reply->reply_ia,
3673  data.buffer, data.buffer->data,
3674  data.len, D6O_IAADDR, 0)) {
3675  log_error("reply_process_send_addr: unable "
3676  "to save IAADDR option");
3677  status = ISC_R_FAILURE;
3678  goto cleanup;
3679  }
3680 
3681  reply->resources_included = ISC_TRUE;
3682 
3683  cleanup:
3684  if (data.data != NULL)
3686 
3687  return status;
3688 }
3689 
3690 /* Choose the better of two leases. */
3691 static struct iasubopt *
3692 lease_compare(struct iasubopt *alpha, struct iasubopt *beta) {
3693  if (alpha == NULL)
3694  return beta;
3695  if (beta == NULL)
3696  return alpha;
3697 
3698  switch(alpha->state) {
3699  case FTS_ACTIVE:
3700  switch(beta->state) {
3701  case FTS_ACTIVE:
3702  /* Choose the lease with the longest lifetime (most
3703  * likely the most recently allocated).
3704  */
3705  if (alpha->hard_lifetime_end_time <
3706  beta->hard_lifetime_end_time)
3707  return beta;
3708  else
3709  return alpha;
3710 
3711  case FTS_EXPIRED:
3712  case FTS_ABANDONED:
3713  return alpha;
3714 
3715  default:
3716  log_fatal("Impossible condition at %s:%d.", MDL);
3717  }
3718  break;
3719 
3720  case FTS_EXPIRED:
3721  switch (beta->state) {
3722  case FTS_ACTIVE:
3723  return beta;
3724 
3725  case FTS_EXPIRED:
3726  /* Choose the most recently expired lease. */
3727  if (alpha->hard_lifetime_end_time <
3728  beta->hard_lifetime_end_time)
3729  return beta;
3730  else if ((alpha->hard_lifetime_end_time ==
3731  beta->hard_lifetime_end_time) &&
3732  (alpha->soft_lifetime_end_time <
3733  beta->soft_lifetime_end_time))
3734  return beta;
3735  else
3736  return alpha;
3737 
3738  case FTS_ABANDONED:
3739  return alpha;
3740 
3741  default:
3742  log_fatal("Impossible condition at %s:%d.", MDL);
3743  }
3744  break;
3745 
3746  case FTS_ABANDONED:
3747  switch (beta->state) {
3748  case FTS_ACTIVE:
3749  case FTS_EXPIRED:
3750  return alpha;
3751 
3752  case FTS_ABANDONED:
3753  /* Choose the lease that was abandoned longest ago. */
3754  if (alpha->hard_lifetime_end_time <
3755  beta->hard_lifetime_end_time)
3756  return alpha;
3757  else
3758  return beta;
3759 
3760  default:
3761  log_fatal("Impossible condition at %s:%d.", MDL);
3762  }
3763  break;
3764 
3765  default:
3766  log_fatal("Impossible condition at %s:%d.", MDL);
3767  }
3768 
3769  log_fatal("Triple impossible condition at %s:%d.", MDL);
3770  return NULL;
3771 }
3772 
3773 /* Process a client-supplied IA_PD. This may append options to the tail of
3774  * the reply packet being built in the reply_state structure.
3775  */
3776 static isc_result_t
3777 reply_process_ia_pd(struct reply_state *reply, struct option_cache *ia) {
3778  isc_result_t status = ISC_R_SUCCESS;
3779  u_int32_t iaid;
3780  unsigned ia_cursor;
3781  struct option_state *packet_ia;
3782  struct option_cache *oc;
3783  struct data_string ia_data, data;
3784 
3785  /* Initialize values that will get cleaned up on return. */
3786  packet_ia = NULL;
3787  memset(&ia_data, 0, sizeof(ia_data));
3788  memset(&data, 0, sizeof(data));
3789  /*
3790  * Note that find_client_prefix() may set reply->lease.
3791  */
3792 
3793  /* Make sure there is at least room for the header. */
3794  if ((reply->cursor + IA_PD_OFFSET + 4) > sizeof(reply->buf)) {
3795  log_error("reply_process_ia_pd: Reply too long for IA.");
3796  return ISC_R_NOSPACE;
3797  }
3798 
3799 
3800  /* Fetch the IA_PD contents. */
3801  if (!get_encapsulated_IA_state(&packet_ia, &ia_data, reply->packet,
3802  ia, IA_PD_OFFSET)) {
3803  log_error("reply_process_ia_pd: error evaluating ia");
3804  status = ISC_R_FAILURE;
3805  goto cleanup;
3806  }
3807 
3808  /* Extract IA_PD header contents. */
3809  iaid = getULong(ia_data.data);
3810  reply->renew = getULong(ia_data.data + 4);
3811  reply->rebind = getULong(ia_data.data + 8);
3812 
3813  /* Create an IA_PD structure. */
3814  if (ia_allocate(&reply->ia, iaid, (char *)reply->client_id.data,
3815  reply->client_id.len, MDL) != ISC_R_SUCCESS) {
3816  log_error("reply_process_ia_pd: no memory for ia.");
3817  status = ISC_R_NOMEMORY;
3818  goto cleanup;
3819  }
3820  reply->ia->ia_type = D6O_IA_PD;
3821 
3822  /* Cache pre-existing IA_PD, if any. */
3823  ia_hash_lookup(&reply->old_ia, ia_pd_active,
3824  (unsigned char *)reply->ia->iaid_duid.data,
3825  reply->ia->iaid_duid.len, MDL);
3826 
3827  /*
3828  * Create an option cache to carry the IA_PD option contents, and
3829  * execute any user-supplied values into it.
3830  */
3831  if (!option_state_allocate(&reply->reply_ia, MDL)) {
3832  status = ISC_R_NOMEMORY;
3833  goto cleanup;
3834  }
3835 
3836  /* Check & count the fixed prefix host records. */
3837  reply->static_prefixes = 0;
3838  if ((reply->host != NULL) && (reply->host->fixed_prefix != NULL)) {
3839  struct iaddrcidrnetlist *fp;
3840 
3841  for (fp = reply->host->fixed_prefix; fp != NULL;
3842  fp = fp->next) {
3843  reply->static_prefixes += 1;
3844  }
3845  }
3846 
3847  /*
3848  * Save the cursor position at the start of the IA_PD, so we can
3849  * set length and adjust t1/t2 values later. We write a temporary
3850  * header out now just in case we decide to adjust the packet
3851  * within sub-process functions.
3852  */
3853  ia_cursor = reply->cursor;
3854 
3855  /* Initialize the IA_PD header. First the code. */
3856  putUShort(reply->buf.data + reply->cursor, (unsigned)D6O_IA_PD);
3857  reply->cursor += 2;
3858 
3859  /* Then option length. */
3860  putUShort(reply->buf.data + reply->cursor, 0x0Cu);
3861  reply->cursor += 2;
3862 
3863  /* Then IA_PD header contents; IAID. */
3864  putULong(reply->buf.data + reply->cursor, iaid);
3865  reply->cursor += 4;
3866 
3867  /* We store the client's t1 for now, and may over-ride it later. */
3868  putULong(reply->buf.data + reply->cursor, reply->renew);
3869  reply->cursor += 4;
3870 
3871  /* We store the client's t2 for now, and may over-ride it later. */
3872  putULong(reply->buf.data + reply->cursor, reply->rebind);
3873  reply->cursor += 4;
3874 
3875  /*
3876  * For each prefix in this IA_PD, decide what to do about it.
3877  */
3878  oc = lookup_option(&dhcpv6_universe, packet_ia, D6O_IAPREFIX);
3879  reply->min_valid = reply->min_prefer = INFINITE_TIME;
3880  reply->client_valid = reply->client_prefer = 0;
3881  reply->preflen = -1;
3882  for (; oc != NULL ; oc = oc->next) {
3883  status = reply_process_prefix(reply, oc);
3884 
3885  /*
3886  * Canceled means we did not allocate prefixes to the
3887  * client, but we're "done" with this IA - we set a status
3888  * code. So transmit this reply, e.g., move on to the next
3889  * IA.
3890  */
3891  if (status == ISC_R_CANCELED)
3892  break;
3893 
3894  if ((status != ISC_R_SUCCESS) &&
3895  (status != ISC_R_ADDRINUSE) &&
3896  (status != ISC_R_ADDRNOTAVAIL))
3897  goto cleanup;
3898  }
3899 
3900  reply->pd_count++;
3901 
3902  /*
3903  * If we fell through the above and never gave the client
3904  * a prefix, give it one now.
3905  */
3906  if ((status != ISC_R_CANCELED) && (reply->client_resources == 0)) {
3907  status = find_client_prefix(reply);
3908 
3909  if (status == ISC_R_NORESOURCES) {
3910  switch (reply->packet->dhcpv6_msg_type) {
3911  case DHCPV6_SOLICIT:
3912  /*
3913  * No prefix for any IA is handled
3914  * by the caller.
3915  */
3916  /* FALL THROUGH */
3917 
3918  case DHCPV6_REQUEST:
3919  /* Same than for addresses. */
3920  option_state_dereference(&reply->reply_ia, MDL);
3921  if (!option_state_allocate(&reply->reply_ia,
3922  MDL))
3923  {
3924  log_error("reply_process_ia_pd: No "
3925  "memory for option state "
3926  "wipe.");
3927  status = ISC_R_NOMEMORY;
3928  goto cleanup;
3929  }
3930 
3931  if (!set_status_code(STATUS_NoPrefixAvail,
3932  "No prefixes available "
3933  "for this interface.",
3934  reply->reply_ia)) {
3935  log_error("reply_process_ia_pd: "
3936  "Unable to set "
3937  "NoPrefixAvail status "
3938  "code.");
3939  status = ISC_R_FAILURE;
3940  goto cleanup;
3941  }
3942 
3943  status = ISC_R_SUCCESS;
3944  break;
3945 
3946  default:
3947  if (reply->resources_included)
3948  status = ISC_R_SUCCESS;
3949  else
3950  goto cleanup;
3951  break;
3952  }
3953  }
3954 
3955  if (status != ISC_R_SUCCESS)
3956  goto cleanup;
3957  }
3958 
3959  reply->cursor += store_options6((char *)reply->buf.data + reply->cursor,
3960  sizeof(reply->buf) - reply->cursor,
3961  reply->reply_ia, reply->packet,
3962  required_opts_IA_PD, NULL);
3963 
3964  /* Reset the length of this IA_PD to match what was just written. */
3965  putUShort(reply->buf.data + ia_cursor + 2,
3966  reply->cursor - (ia_cursor + 4));
3967 
3968  /* Calculate T1/T2 and stuff them in the reply */
3969  set_reply_tee_times(reply, ia_cursor);
3970 
3971  /*
3972  * yes, goto's aren't the best but we also want to avoid extra
3973  * indents
3974  */
3975  if (status == ISC_R_CANCELED)
3976  goto cleanup;
3977 
3978  /*
3979  * Handle static prefixes, we always log stuff and if it's
3980  * a hard binding we run any commit statements that we have
3981  */
3982  if (reply->static_prefixes != 0) {
3983  char tmp_addr[INET6_ADDRSTRLEN];
3984  log_info("%s PD: address %s/%d to client with duid %s "
3985  "iaid = %d static",
3986  dhcpv6_type_names[reply->buf.reply.msg_type],
3987  inet_ntop(AF_INET6, reply->fixed_pref.lo_addr.iabuf,
3988  tmp_addr, sizeof(tmp_addr)),
3989  reply->fixed_pref.bits,
3990  print_hex_1(reply->client_id.len,
3991  reply->client_id.data, 60),
3992  iaid);
3993  if ((reply->buf.reply.msg_type == DHCPV6_REPLY) &&
3994  (reply->on_star.on_commit != NULL)) {
3995  execute_statements(NULL, reply->packet, NULL, NULL,
3996  reply->packet->options,
3997  reply->opt_state,
3998  NULL, reply->on_star.on_commit,
3999  NULL);
4001  (&reply->on_star.on_commit, MDL);
4002  }
4003  goto cleanup;
4004  }
4005 
4006  /*
4007  * If we have any addresses log what we are doing.
4008  */
4009  if (reply->ia->num_iasubopt != 0) {
4010  struct iasubopt *tmp;
4011  int i;
4012  char tmp_addr[INET6_ADDRSTRLEN];
4013 
4014  for (i = 0 ; i < reply->ia->num_iasubopt ; i++) {
4015  tmp = reply->ia->iasubopt[i];
4016 
4017  log_info("%s PD: address %s/%d to client with duid %s"
4018  " iaid = %d valid for %u seconds",
4019  dhcpv6_type_names[reply->buf.reply.msg_type],
4020  inet_ntop(AF_INET6, &tmp->addr,
4021  tmp_addr, sizeof(tmp_addr)),
4022  (int)tmp->plen,
4023  print_hex_1(reply->client_id.len,
4024  reply->client_id.data, 60),
4025  iaid, tmp->valid);
4026  }
4027  }
4028 
4029  /*
4030  * If this is not a 'soft' binding, consume the new changes into
4031  * the database (if any have been attached to the ia_pd).
4032  *
4033  * Loop through the assigned dynamic prefixes, referencing the
4034  * prefixes onto this IA_PD rather than any old ones, and updating
4035  * prefix pool timers for each (if any).
4036  */
4037  if ((reply->buf.reply.msg_type == DHCPV6_REPLY) &&
4038  (reply->ia->num_iasubopt != 0)) {
4039  struct iasubopt *tmp;
4040  struct data_string *ia_id;
4041  int i;
4042 
4043  for (i = 0 ; i < reply->ia->num_iasubopt ; i++) {
4044  tmp = reply->ia->iasubopt[i];
4045 
4046  if (tmp->ia != NULL)
4047  ia_dereference(&tmp->ia, MDL);
4048  ia_reference(&tmp->ia, reply->ia, MDL);
4049 
4050  /* Commit 'hard' bindings. */
4051  renew_lease6(tmp->ipv6_pool, tmp);
4053 
4054  /* If we have anything to do on commit do it now */
4055  if (tmp->on_star.on_commit != NULL) {
4056  execute_statements(NULL, reply->packet,
4057  NULL, NULL,
4058  reply->packet->options,
4059  reply->opt_state,
4060  &tmp->scope,
4061  tmp->on_star.on_commit,
4062  &tmp->on_star);
4064  (&tmp->on_star.on_commit, MDL);
4065  }
4066 
4067  /* Do our threshold check. */
4068  check_pool6_threshold(reply, tmp);
4069  }
4070 
4071  /* Remove any old ia from the hash. */
4072  if (reply->old_ia != NULL) {
4073  ia_id = &reply->old_ia->iaid_duid;
4074  ia_hash_delete(ia_pd_active,
4075  (unsigned char *)ia_id->data,
4076  ia_id->len, MDL);
4077  ia_dereference(&reply->old_ia, MDL);
4078  }
4079 
4080  /* Put new ia into the hash. */
4081  reply->ia->cltt = cur_time;
4082  ia_id = &reply->ia->iaid_duid;
4083  ia_hash_add(ia_pd_active, (unsigned char *)ia_id->data,
4084  ia_id->len, reply->ia, MDL);
4085 
4086  write_ia(reply->ia);
4087  } else {
4088  schedule_lease_timeout_reply(reply);
4089  }
4090 
4091  cleanup:
4092  if (packet_ia != NULL)
4093  option_state_dereference(&packet_ia, MDL);
4094  if (reply->reply_ia != NULL)
4095  option_state_dereference(&reply->reply_ia, MDL);
4096  if (ia_data.data != NULL)
4097  data_string_forget(&ia_data, MDL);
4098  if (data.data != NULL)
4100  if (reply->ia != NULL)
4101  ia_dereference(&reply->ia, MDL);
4102  if (reply->old_ia != NULL)
4103  ia_dereference(&reply->old_ia, MDL);
4104  if (reply->lease != NULL)
4105  iasubopt_dereference(&reply->lease, MDL);
4106  if (reply->on_star.on_expiry != NULL)
4108  (&reply->on_star.on_expiry, MDL);
4109  if (reply->on_star.on_release != NULL)
4111  (&reply->on_star.on_release, MDL);
4112 
4113  /*
4114  * ISC_R_CANCELED is a status code used by the prefix processing to
4115  * indicate we're replying with a status code. This is still a
4116  * success at higher layers.
4117  */
4118  return((status == ISC_R_CANCELED) ? ISC_R_SUCCESS : status);
4119 }
4120 
4140 static struct group *
4141 find_group_by_prefix(struct reply_state *reply) {
4142  /* default group if we don't find anything better */
4143  struct group *group = reply->shared->group;
4144  struct subnet *subnet = NULL;
4145  struct iaddr tmp_addr;
4146  struct data_string fixed_addr;
4147 
4148  /* Try with the prefix first */
4149  if (find_grouped_subnet(&subnet, reply->shared,
4150  reply->fixed_pref.lo_addr, MDL) != 0) {
4151  group = subnet->group;
4152  subnet_dereference(&subnet, MDL);
4153  return (group);
4154  }
4155 
4156  /* Didn't find a subnet via prefix, what about fixed address */
4157  /* The caller has already tested reply->host != NULL */
4158 
4159  memset(&fixed_addr, 0, sizeof(fixed_addr));
4160 
4161  if ((reply->host->fixed_addr != NULL) &&
4162  (evaluate_option_cache(&fixed_addr, NULL, NULL, NULL,
4163  NULL, NULL, &global_scope,
4164  reply->host->fixed_addr, MDL))) {
4165  if (fixed_addr.len >= 16) {
4166  tmp_addr.len = 16;
4167  memcpy(tmp_addr.iabuf, fixed_addr.data, 16);
4168  if (find_grouped_subnet(&subnet, reply->shared,
4169  tmp_addr, MDL) != 0) {
4170  group = subnet->group;
4171  subnet_dereference(&subnet, MDL);
4172  }
4173  }
4174  data_string_forget(&fixed_addr, MDL);
4175  }
4176 
4177  /* return whatever we got */
4178  return (group);
4179 }
4180 
4181 /*
4182  * Process an IAPREFIX within a given IA_PD, storing any IAPREFIX reply
4183  * contents into the reply's current ia_pd-scoped option cache. Returns
4184  * ISC_R_CANCELED in the event we are replying with a status code and do
4185  * not wish to process more IAPREFIXes within this IA_PD.
4186  */
4187 static isc_result_t
4188 reply_process_prefix(struct reply_state *reply, struct option_cache *pref) {
4189  u_int32_t pref_life, valid_life;
4190  struct binding_scope **scope;
4191  struct iaddrcidrnet tmp_pref;
4192  struct option_cache *oc;
4193  struct data_string iapref, data;
4194  isc_result_t status = ISC_R_SUCCESS;
4195  struct group *group;
4196 
4197  /* Initializes values that will be cleaned up. */
4198  memset(&iapref, 0, sizeof(iapref));
4199  memset(&data, 0, sizeof(data));
4200  /* Note that reply->lease may be set by prefix_is_owned() */
4201 
4202  /*
4203  * There is no point trying to process an incoming prefix if there
4204  * is no room for an outgoing prefix.
4205  */
4206  if ((reply->cursor + 29) > sizeof(reply->buf)) {
4207  log_error("reply_process_prefix: Out of room for prefix.");
4208  return ISC_R_NOSPACE;
4209  }
4210 
4211  /* Extract this IAPREFIX option. */
4212  if (!evaluate_option_cache(&iapref, reply->packet, NULL, NULL,
4213  reply->packet->options, NULL, &global_scope,
4214  pref, MDL) ||
4215  (iapref.len < IAPREFIX_OFFSET)) {
4216  log_error("reply_process_prefix: error evaluating IAPREFIX.");
4217  status = ISC_R_FAILURE;
4218  goto cleanup;
4219  }
4220 
4221  /*
4222  * Layout: preferred and valid lifetimes followed by the prefix
4223  * length and the IPv6 address.
4224  */
4225  pref_life = getULong(iapref.data);
4226  valid_life = getULong(iapref.data + 4);
4227 
4228  if ((reply->client_valid == 0) ||
4229  (reply->client_valid > valid_life))
4230  reply->client_valid = valid_life;
4231 
4232  if ((reply->client_prefer == 0) ||
4233  (reply->client_prefer > pref_life))
4234  reply->client_prefer = pref_life;
4235 
4236  /*
4237  * Clients may choose to send ::/0 as a prefix, with the idea to give
4238  * hints about preferred-lifetime or valid-lifetime.
4239  */
4240  tmp_pref.lo_addr.len = 16;
4241  memset(tmp_pref.lo_addr.iabuf, 0, 16);
4242  if ((iapref.data[8] == 0) &&
4243  (memcmp(iapref.data + 9, tmp_pref.lo_addr.iabuf, 16) == 0)) {
4244  /* Status remains success; we just ignore this one. */
4245  goto cleanup;
4246  }
4247 
4248  /*
4249  * Clients may choose to send ::/X as a prefix to specify a
4250  * preferred/requested prefix length. Note X is never zero here.
4251  */
4252  tmp_pref.bits = (int) iapref.data[8];
4253  if (reply->preflen < 0) {
4254  /* Cache the first preferred prefix length. */
4255  reply->preflen = tmp_pref.bits;
4256  }
4257  if (memcmp(iapref.data + 9, tmp_pref.lo_addr.iabuf, 16) == 0) {
4258  goto cleanup;
4259  }
4260 
4261  memcpy(tmp_pref.lo_addr.iabuf, iapref.data + 9, 16);
4262 
4263  /* Verify the prefix belongs to the client. */
4264  if (!prefix_is_owned(reply, &tmp_pref)) {
4265  /* Same than for addresses. */
4266  if ((reply->packet->dhcpv6_msg_type == DHCPV6_SOLICIT) ||
4267  (reply->packet->dhcpv6_msg_type == DHCPV6_REQUEST) ||
4268  (reply->packet->dhcpv6_msg_type == DHCPV6_REBIND)) {
4269  status = reply_process_try_prefix(reply, &tmp_pref);
4270 
4271  /* Either error out or skip this prefix. */
4272  if ((status != ISC_R_SUCCESS) &&
4273  (status != ISC_R_ADDRINUSE) &&
4274  (status != ISC_R_ADDRNOTAVAIL))
4275  goto cleanup;
4276 
4277  if (reply->lease == NULL) {
4278  if (reply->packet->dhcpv6_msg_type ==
4279  DHCPV6_REBIND) {
4280  reply->send_prefer = 0;
4281  reply->send_valid = 0;
4282  goto send_pref;
4283  }
4284 
4285  /* status remains success - ignore */
4286  goto cleanup;
4287  }
4288  /*
4289  * RFC3633 section 18.2.3:
4290  *
4291  * If the delegating router cannot find a binding
4292  * for the requesting router's IA_PD the delegating
4293  * router returns the IA_PD containing no prefixes
4294  * with a Status Code option set to NoBinding in the
4295  * Reply message.
4296  *
4297  * On mismatch we (ab)use this pretending we have not the IA
4298  * as soon as we have not a prefix.
4299  */
4300  } else if (reply->packet->dhcpv6_msg_type == DHCPV6_RENEW) {
4301  /* Rewind the IA_PD to empty. */
4302  option_state_dereference(&reply->reply_ia, MDL);
4303  if (!option_state_allocate(&reply->reply_ia, MDL)) {
4304  log_error("reply_process_prefix: No memory "
4305  "for option state wipe.");
4306  status = ISC_R_NOMEMORY;
4307  goto cleanup;
4308  }
4309 
4310  /* Append a NoBinding status code. */
4311  if (!set_status_code(STATUS_NoBinding,
4312  "Prefix not bound to this "
4313  "interface.", reply->reply_ia)) {
4314  log_error("reply_process_prefix: Unable to "
4315  "attach status code.");
4316  status = ISC_R_FAILURE;
4317  goto cleanup;
4318  }
4319 
4320  /* Fin (no more IAPREFIXes). */
4321  status = ISC_R_CANCELED;
4322  goto cleanup;
4323  } else {
4324  log_error("It is impossible to lease a client that is "
4325  "not sending a solicit, request, renew, or "
4326  "rebind message.");
4327  status = ISC_R_FAILURE;
4328  goto cleanup;
4329  }
4330  }
4331 
4332  if (reply->static_prefixes > 0) {
4333  if (reply->host == NULL)
4334  log_fatal("Impossible condition at %s:%d.", MDL);
4335 
4336  scope = &global_scope;
4337 
4338  /* Copy the static prefix for logging and finding the group */
4339  memcpy(&reply->fixed_pref, &tmp_pref, sizeof(tmp_pref));
4340 
4341  /* Try to find a group for the static prefix */
4342  group = find_group_by_prefix(reply);
4343  } else {
4344  if (reply->lease == NULL)
4345  log_fatal("Impossible condition at %s:%d.", MDL);
4346 
4347  scope = &reply->lease->scope;
4348  group = reply->lease->ipv6_pool->ipv6_pond->group;
4349  }
4350 
4351  /*
4352  * If client_resources is nonzero, then the reply_process_is_prefixed
4353  * function has executed configuration state into the reply option
4354  * cache. We will use that valid cache to derive configuration for
4355  * whether or not to engage in additional prefixes, and similar.
4356  */
4357  if (reply->client_resources != 0) {
4358  unsigned limit = 1;
4359 
4360  /*
4361  * Does this client have "enough" prefixes already? Default
4362  * to one. Everybody gets one, and one should be enough for
4363  * anybody.
4364  */
4365  oc = lookup_option(&server_universe, reply->opt_state,
4367  if (oc != NULL) {
4368  if (!evaluate_option_cache(&data, reply->packet,
4369  NULL, NULL,
4370  reply->packet->options,
4371  reply->opt_state,
4372  scope, oc, MDL) ||
4373  (data.len != 4)) {
4374  log_error("reply_process_prefix: unable to "
4375  "evaluate prefs-per-ia value.");
4376  status = ISC_R_FAILURE;
4377  goto cleanup;
4378  }
4379 
4380  limit = getULong(data.data);
4381  data_string_forget(&data, MDL);
4382  }
4383 
4384  /*
4385  * If we wish to limit the client to a certain number of
4386  * prefixes, then omit the prefix from the reply.
4387  */
4388  if (reply->client_resources >= limit)
4389  goto cleanup;
4390  }
4391 
4392  status = reply_process_is_prefixed(reply, scope, group);
4393  if (status != ISC_R_SUCCESS)
4394  goto cleanup;
4395 
4396  send_pref:
4397  status = reply_process_send_prefix(reply, &tmp_pref);
4398 
4399  cleanup:
4400  if (iapref.data != NULL)
4401  data_string_forget(&iapref, MDL);
4402  if (data.data != NULL)
4403  data_string_forget(&data, MDL);
4404  if (reply->lease != NULL)
4405  iasubopt_dereference(&reply->lease, MDL);
4406 
4407  return status;
4408 }
4409 
4410 /*
4411  * Verify the prefix belongs to the client. If we've got a host
4412  * record with fixed prefixes, it has to be an assigned prefix
4413  * (fault out all else). Otherwise it's a dynamic prefix, so lookup
4414  * that prefix and make sure it belongs to this DUID:IAID pair.
4415  */
4416 static isc_boolean_t
4417 prefix_is_owned(struct reply_state *reply, struct iaddrcidrnet *pref) {
4418  struct iaddrcidrnetlist *l;
4419  int i;
4420  struct ipv6_pond *pond;
4421 
4422  /*
4423  * This faults out prefixes that don't match fixed prefixes.
4424  */
4425  if (reply->static_prefixes > 0) {
4426  for (l = reply->host->fixed_prefix; l != NULL; l = l->next) {
4427  if ((pref->bits == l->cidrnet.bits) &&
4428  (memcmp(pref->lo_addr.iabuf,
4429  l->cidrnet.lo_addr.iabuf, 16) == 0))
4430  return (ISC_TRUE);
4431  }
4432  return (ISC_FALSE);
4433  }
4434 
4435  if ((reply->old_ia == NULL) ||
4436  (reply->old_ia->num_iasubopt == 0))
4437  return (ISC_FALSE);
4438 
4439  for (i = 0 ; i < reply->old_ia->num_iasubopt ; i++) {
4440  struct iasubopt *tmp;
4441 
4442  tmp = reply->old_ia->iasubopt[i];
4443 
4444  if ((pref->bits == (int) tmp->plen) &&
4445  (memcmp(pref->lo_addr.iabuf, &tmp->addr, 16) == 0)) {
4446  if (lease6_usable(tmp) == ISC_FALSE) {
4447  return (ISC_FALSE);
4448  }
4449 
4450  pond = tmp->ipv6_pool->ipv6_pond;
4451  if (((pond->prohibit_list != NULL) &&
4452  (permitted(reply->packet, pond->prohibit_list))) ||
4453  ((pond->permit_list != NULL) &&
4454  (!permitted(reply->packet, pond->permit_list))))
4455  return (ISC_FALSE);
4456 
4457  iasubopt_reference(&reply->lease, tmp, MDL);
4458  return (ISC_TRUE);
4459  }
4460  }
4461 
4462  return (ISC_FALSE);
4463 }
4464 
4465 /*
4466  * This function only returns failure on 'hard' failures. If it succeeds,
4467  * it will leave a prefix structure behind.
4468  */
4469 static isc_result_t
4470 reply_process_try_prefix(struct reply_state *reply,
4471  struct iaddrcidrnet *pref) {
4472  isc_result_t status = ISC_R_ADDRNOTAVAIL;
4473  struct ipv6_pool *pool = NULL;
4474  struct ipv6_pond *pond = NULL;
4475  int i;
4476  struct data_string data_pref;
4477 
4478  if ((reply == NULL) || (reply->shared == NULL) ||
4479  (pref == NULL) || (reply->lease != NULL))
4480  return (DHCP_R_INVALIDARG);
4481 
4482  /*
4483  * Do a quick walk through of the ponds and pools
4484  * to see if we have any prefix pools
4485  */
4486  for (pond = reply->shared->ipv6_pond; pond != NULL; pond = pond->next) {
4487  if (pond->ipv6_pools == NULL)
4488  continue;
4489 
4490  for (i = 0; (pool = pond->ipv6_pools[i]) != NULL; i++) {
4491  if (pool->pool_type == D6O_IA_PD)
4492  break;
4493  }
4494  if (pool != NULL)
4495  break;
4496  }
4497 
4498  /* If we get here and p is NULL we have no useful pools */
4499  if (pool == NULL) {
4500  return (ISC_R_ADDRNOTAVAIL);
4501  }
4502 
4503  memset(&data_pref, 0, sizeof(data_pref));
4504  data_pref.len = 17;
4505  if (!buffer_allocate(&data_pref.buffer, data_pref.len, MDL)) {
4506  log_error("reply_process_try_prefix: out of memory.");
4507  return (ISC_R_NOMEMORY);
4508  }
4509  data_pref.data = data_pref.buffer->data;
4510  data_pref.buffer->data[0] = (u_int8_t) pref->bits;
4511  memcpy(data_pref.buffer->data + 1, pref->lo_addr.iabuf, 16);
4512 
4513  /*
4514  * We have at least one pool that could provide a prefix
4515  * Now we walk through the ponds and pools again and check
4516  * to see if the client is permitted and if an prefix is
4517  * available
4518  *
4519  */
4520 
4521  for (pond = reply->shared->ipv6_pond; pond != NULL; pond = pond->next) {
4522  if (((pond->prohibit_list != NULL) &&
4523  (permitted(reply->packet, pond->prohibit_list))) ||
4524  ((pond->permit_list != NULL) &&
4525  (!permitted(reply->packet, pond->permit_list))))
4526  continue;
4527 
4528  for (i = 0; (pool = pond->ipv6_pools[i]) != NULL; i++) {
4529  if (pool->pool_type != D6O_IA_PD) {
4530  continue;
4531  }
4532 
4533  status = try_client_v6_prefix(&reply->lease, pool,
4534  &data_pref);
4535  /* If we found it in this pool (either in use or available),
4536  there is no need to look further. */
4537  if ( (status == ISC_R_SUCCESS) || (status == ISC_R_ADDRINUSE) )
4538  break;
4539  }
4540  if ( (status == ISC_R_SUCCESS) || (status == ISC_R_ADDRINUSE) )
4541  break;
4542  }
4543 
4544  data_string_forget(&data_pref, MDL);
4545  /* Return just the most recent status... */
4546  return (status);
4547 }
4548 
4549 /* Look around for a prefix to give the client. First, look through the old
4550  * IA_PD for prefixes we can extend. Second, try to allocate a new prefix.
4551  * Finally, actually add that prefix into the current reply IA_PD.
4552  */
4553 static isc_result_t
4554 find_client_prefix(struct reply_state *reply) {
4555  struct iaddrcidrnet send_pref;
4556  isc_result_t status = ISC_R_NORESOURCES;
4557  struct iasubopt *prefix, *best_prefix = NULL;
4558  struct binding_scope **scope;
4559  int i;
4560  struct group *group;
4561 
4562  if (reply->static_prefixes > 0) {
4563  struct iaddrcidrnetlist *l;
4564 
4565  if (reply->host == NULL)
4566  return DHCP_R_INVALIDARG;
4567 
4568  for (l = reply->host->fixed_prefix; l != NULL; l = l->next) {
4569  if (l->cidrnet.bits == reply->preflen)
4570  break;
4571  }
4572  if (l == NULL) {
4573  /*
4574  * If no fixed prefix has the preferred length,
4575  * get the first one.
4576  */
4577  l = reply->host->fixed_prefix;
4578  }
4579  memcpy(&send_pref, &l->cidrnet, sizeof(send_pref));
4580 
4581  scope = &global_scope;
4582 
4583  /* Copy the prefix for logging purposes */
4584  memcpy(&reply->fixed_pref, &l->cidrnet, sizeof(send_pref));
4585 
4586  /* Try to find a group for the static prefix */
4587  group = find_group_by_prefix(reply);
4588 
4589  goto send_pref;
4590  }
4591 
4592  if (reply->old_ia != NULL) {
4593  for (i = 0 ; i < reply->old_ia->num_iasubopt ; i++) {
4594  struct shared_network *candidate_shared;
4595  struct ipv6_pond *pond;
4596 
4597  prefix = reply->old_ia->iasubopt[i];
4598  candidate_shared = prefix->ipv6_pool->shared_network;
4599  pond = prefix->ipv6_pool->ipv6_pond;
4600 
4601  /*
4602  * Consider this prefix if it is in a global pool or
4603  * if it is scoped in a pool under the client's shared
4604  * network.
4605  */
4606  if (((candidate_shared != NULL) &&
4607  (candidate_shared != reply->shared)) ||
4608  (lease6_usable(prefix) != ISC_TRUE))
4609  continue;
4610 
4611  /*
4612  * And check if the prefix is still permitted
4613  */
4614 
4615  if (((pond->prohibit_list != NULL) &&
4616  (permitted(reply->packet, pond->prohibit_list))) ||
4617  ((pond->permit_list != NULL) &&
4618  (!permitted(reply->packet, pond->permit_list))))
4619  continue;
4620 
4621  best_prefix = prefix_compare(reply, prefix,
4622  best_prefix);
4623  }
4624  }
4625 
4626  /* Try to pick a new prefix if we didn't find one, or if we found an
4627  * abandoned prefix.
4628  */
4629  if ((best_prefix == NULL) || (best_prefix->state == FTS_ABANDONED)) {
4630  status = pick_v6_prefix(reply);
4631  } else if (best_prefix != NULL) {
4632  iasubopt_reference(&reply->lease, best_prefix, MDL);
4633  status = ISC_R_SUCCESS;
4634  }
4635 
4636  /* Pick the abandoned prefix as a last resort. */
4637  if ((status == ISC_R_NORESOURCES) && (best_prefix != NULL)) {
4638  /* I don't see how this is supposed to be done right now. */
4639  log_error("Reclaiming abandoned prefixes is not yet "
4640  "supported. Treating this as an out of space "
4641  "condition.");
4642  /* iasubopt_reference(&reply->lease, best_prefix, MDL); */
4643  }
4644 
4645  /* Give up now if we didn't find a prefix. */
4646  if (status != ISC_R_SUCCESS)
4647  return status;
4648 
4649  if (reply->lease == NULL)
4650  log_fatal("Impossible condition at %s:%d.", MDL);
4651 
4652  scope = &reply->lease->scope;
4653  group = reply->lease->ipv6_pool->ipv6_pond->group;
4654 
4655  send_pref.lo_addr.len = 16;
4656  memcpy(send_pref.lo_addr.iabuf, &reply->lease->addr, 16);
4657  send_pref.bits = (int) reply->lease->plen;
4658 
4659  send_pref:
4660  status = reply_process_is_prefixed(reply, scope, group);
4661  if (status != ISC_R_SUCCESS)
4662  return status;
4663 
4664  status = reply_process_send_prefix(reply, &send_pref);
4665  return status;
4666 }
4667 
4668 /* Once a prefix is found for a client, perform several common functions;
4669  * Calculate and store valid and preferred prefix times, draw client options
4670  * into the option state.
4671  */
4672 static isc_result_t
4673 reply_process_is_prefixed(struct reply_state *reply,
4674  struct binding_scope **scope, struct group *group)
4675 {
4676  isc_result_t status = ISC_R_SUCCESS;
4677  struct data_string data;
4678  struct option_cache *oc;
4679  struct option_state *tmp_options = NULL;
4680  struct on_star *on_star;
4681  int i;
4682 
4683  /* Initialize values we will cleanup. */
4684  memset(&data, 0, sizeof(data));
4685 
4686  /*
4687  * Find the proper on_star block to use. We use the
4688  * one in the lease if we have a lease or the one in
4689  * the reply if we don't have a lease because this is
4690  * a static instance
4691  */
4692  if (reply->lease) {
4693  on_star = &reply->lease->on_star;
4694  } else {
4695  on_star = &reply->on_star;
4696  }
4697 
4698  /*
4699  * Bring in the root configuration. We only do this to bring
4700  * in the on * statements, as we didn't have the lease available
4701  * we we did it the first time.
4702  */
4703  option_state_allocate(&tmp_options, MDL);
4704  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
4705  reply->packet->options, tmp_options,
4706  &global_scope, root_group, NULL,
4707  on_star);
4708  if (tmp_options != NULL) {
4709  option_state_dereference(&tmp_options, MDL);
4710  }
4711 
4712  /*
4713  * Bring configured options into the root packet level cache - start
4714  * with the lease's closest enclosing group (passed in by the caller
4715  * as 'group').
4716  */
4717  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
4718  reply->packet->options, reply->opt_state,
4719  scope, group, root_group, on_star);
4720 
4721  /* Execute statements from class scopes. */
4722  for (i = reply->packet->class_count; i > 0; i--) {
4723  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
4724  reply->packet->options,
4725  reply->opt_state, scope,
4726  reply->packet->classes[i - 1]->group,
4727  group, on_star);
4728  }
4729 
4730  /*
4731  * If there is a host record, over-ride with values configured there,
4732  * without re-evaluating configuration from the previously executed
4733  * group or its common enclosers.
4734  */
4735  if (reply->host != NULL)
4736  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
4737  reply->packet->options,
4738  reply->opt_state, scope,
4739  reply->host->group, group,
4740  on_star);
4741 
4742  /* Determine valid lifetime. */
4743  if (reply->client_valid == 0)
4744  reply->send_valid = DEFAULT_DEFAULT_LEASE_TIME;
4745  else
4746  reply->send_valid = reply->client_valid;
4747 
4748  oc = lookup_option(&server_universe, reply->opt_state,
4750  if (oc != NULL) {
4751  if (!evaluate_option_cache(&data, reply->packet, NULL, NULL,
4752  reply->packet->options,
4753  reply->opt_state,
4754  scope, oc, MDL) ||
4755  (data.len != 4)) {
4756  log_error("reply_process_is_prefixed: unable to "
4757  "evaluate default prefix time");
4758  status = ISC_R_FAILURE;
4759  goto cleanup;
4760  }
4761 
4762  reply->send_valid = getULong(data.data);
4763  data_string_forget(&data, MDL);
4764  }
4765 
4766  /* Check to see if the lease time would cause us to wrap
4767  * in which case we make it infinite.
4768  * The following doesn't work on at least some systems:
4769  * (cur_time + reply->send_valid < cur_time)
4770  */
4771  if (reply->send_valid != INFINITE_TIME) {
4772  time_t test_time = cur_time + reply->send_valid;
4773  if (test_time < cur_time)
4774  reply->send_valid = INFINITE_TIME;
4775  }
4776 
4777  if (reply->client_prefer == 0)
4778  reply->send_prefer = reply->send_valid;
4779  else
4780  reply->send_prefer = reply->client_prefer;
4781 
4782  if ((reply->send_prefer >= reply->send_valid) &&
4783  (reply->send_valid != INFINITE_TIME))
4784  reply->send_prefer = (reply->send_valid / 2) +
4785  (reply->send_valid / 8);
4786 
4787  oc = lookup_option(&server_universe, reply->opt_state,
4789  if (oc != NULL) {
4790  if (!evaluate_option_cache(&data, reply->packet, NULL, NULL,
4791  reply->packet->options,
4792  reply->opt_state,
4793  scope, oc, MDL) ||
4794  (data.len != 4)) {
4795  log_error("reply_process_is_prefixed: unable to "
4796  "evaluate preferred prefix time");
4797  status = ISC_R_FAILURE;
4798  goto cleanup;
4799  }
4800 
4801  reply->send_prefer = getULong(data.data);
4802  data_string_forget(&data, MDL);
4803  }
4804 
4805  /* Note lowest values for later calculation of renew/rebind times. */
4806  if (reply->min_prefer > reply->send_prefer)
4807  reply->min_prefer = reply->send_prefer;
4808 
4809  if (reply->min_valid > reply->send_valid)
4810  reply->min_valid = reply->send_valid;
4811 
4812  /* Perform dynamic prefix related update work. */
4813  if (reply->lease != NULL) {
4814  /* Cached lifetimes */
4815  reply->lease->prefer = reply->send_prefer;
4816  reply->lease->valid = reply->send_valid;
4817 
4818  /* Advance (or rewind) the valid lifetime.
4819  * In the protocol 0xFFFFFFFF is infinite
4820  * when connecting to the lease file MAX_TIME is
4821  */
4822  if (reply->buf.reply.msg_type == DHCPV6_REPLY) {
4823  if (reply->send_valid == INFINITE_TIME) {
4824  reply->lease->soft_lifetime_end_time = MAX_TIME;
4825  } else {
4826  reply->lease->soft_lifetime_end_time =
4827  cur_time + reply->send_valid;
4828  }
4829  /* Wait before renew! */
4830  }
4831 
4832  status = ia_add_iasubopt(reply->ia, reply->lease, MDL);
4833  if (status != ISC_R_SUCCESS) {
4834  log_fatal("reply_process_is_prefixed: Unable to "
4835  "attach prefix to new IA_PD: %s",
4836  isc_result_totext(status));
4837  }
4838 
4839  /*
4840  * If this is a new prefix, make sure it is attached somewhere.
4841  */
4842  if (reply->lease->ia == NULL) {
4843  ia_reference(&reply->lease->ia, reply->ia, MDL);
4844  }
4845  }
4846 
4847  /* Bring a copy of the relevant options into the IA_PD scope. */
4848  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
4849  reply->packet->options, reply->reply_ia,
4850  scope, group, root_group, NULL);
4851 
4852  /* Execute statements from class scopes. */
4853  for (i = reply->packet->class_count; i > 0; i--) {
4854  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
4855  reply->packet->options,
4856  reply->reply_ia, scope,
4857  reply->packet->classes[i - 1]->group,
4858  group, NULL);
4859  }
4860 
4861  /*
4862  * And bring in host record configuration, if any, but not to overlap
4863  * the previous group or its common enclosers.
4864  */
4865  if (reply->host != NULL)
4866  execute_statements_in_scope(NULL, reply->packet, NULL, NULL,
4867  reply->packet->options,
4868  reply->reply_ia, scope,
4869  reply->host->group, group, NULL);
4870 
4871  cleanup:
4872  if (data.data != NULL)
4873  data_string_forget(&data, MDL);
4874 
4875  if (status == ISC_R_SUCCESS)
4876  reply->client_resources++;
4877 
4878  return status;
4879 }
4880 
4881 /* Simply send an IAPREFIX within the IA_PD scope as described. */
4882 static isc_result_t
4883 reply_process_send_prefix(struct reply_state *reply,
4884  struct iaddrcidrnet *pref) {
4885  isc_result_t status = ISC_R_SUCCESS;
4886  struct data_string data;
4887 
4888  memset(&data, 0, sizeof(data));
4889 
4890  /* Now append the prefix. */
4891  data.len = IAPREFIX_OFFSET;
4892  if (!buffer_allocate(&data.buffer, data.len, MDL)) {
4893  log_error("reply_process_send_prefix: out of memory"
4894  "allocating new IAPREFIX buffer.");
4895  status = ISC_R_NOMEMORY;
4896  goto cleanup;
4897  }
4898  data.data = data.buffer->data;
4899 
4900  putULong(data.buffer->data, reply->send_prefer);
4901  putULong(data.buffer->data + 4, reply->send_valid);
4902  data.buffer->data[8] = pref->bits;
4903  memcpy(data.buffer->data + 9, pref->lo_addr.iabuf, 16);
4904 
4905  if (!append_option_buffer(&dhcpv6_universe, reply->reply_ia,
4906  data.buffer, data.buffer->data,
4907  data.len, D6O_IAPREFIX, 0)) {
4908  log_error("reply_process_send_prefix: unable "
4909  "to save IAPREFIX option");
4910  status = ISC_R_FAILURE;
4911  goto cleanup;
4912  }
4913 
4914  reply->resources_included = ISC_TRUE;
4915 
4916  cleanup:
4917  if (data.data != NULL)
4919 
4920  return status;
4921 }
4922 
4923 /* Choose the better of two prefixes. */
4924 static struct iasubopt *
4925 prefix_compare(struct reply_state *reply,
4926  struct iasubopt *alpha, struct iasubopt *beta) {
4927  if (alpha == NULL)
4928  return beta;
4929  if (beta == NULL)
4930  return alpha;
4931 
4932  if (reply->preflen >= 0) {
4933  if ((alpha->plen == reply->preflen) &&
4934  (beta->plen != reply->preflen))
4935  return alpha;
4936  if ((beta->plen == reply->preflen) &&
4937  (alpha->plen != reply->preflen))
4938  return beta;
4939  }
4940 
4941  switch(alpha->state) {
4942  case FTS_ACTIVE:
4943  switch(beta->state) {
4944  case FTS_ACTIVE:
4945  /* Choose the prefix with the longest lifetime (most
4946  * likely the most recently allocated).
4947  */
4948  if (alpha->hard_lifetime_end_time <
4949  beta->hard_lifetime_end_time)
4950  return beta;
4951  else
4952  return alpha;
4953 
4954  case FTS_EXPIRED:
4955  case FTS_ABANDONED:
4956  return alpha;
4957 
4958  default:
4959  log_fatal("Impossible condition at %s:%d.", MDL);
4960  }
4961  break;
4962 
4963  case FTS_EXPIRED:
4964  switch (beta->state) {
4965  case FTS_ACTIVE:
4966  return beta;
4967 
4968  case FTS_EXPIRED:
4969  /* Choose the most recently expired prefix. */
4970  if (alpha->hard_lifetime_end_time <
4971  beta->hard_lifetime_end_time)
4972  return beta;
4973  else if ((alpha->hard_lifetime_end_time ==
4974  beta->hard_lifetime_end_time) &&
4975  (alpha->soft_lifetime_end_time <
4976  beta->soft_lifetime_end_time))
4977  return beta;
4978  else
4979  return alpha;
4980 
4981  case FTS_ABANDONED:
4982  return alpha;
4983 
4984  default:
4985  log_fatal("Impossible condition at %s:%d.", MDL);
4986  }
4987  break;
4988 
4989  case FTS_ABANDONED:
4990  switch (beta->state) {
4991  case FTS_ACTIVE:
4992  case FTS_EXPIRED:
4993  return alpha;
4994 
4995  case FTS_ABANDONED:
4996  /* Choose the prefix that was abandoned longest ago. */
4997  if (alpha->hard_lifetime_end_time <
4998  beta->hard_lifetime_end_time)
4999  return alpha;
5000  else
5001  return beta;
5002 
5003  default:
5004  log_fatal("Impossible condition at %s:%d.", MDL);
5005  }
5006  break;
5007 
5008  default:
5009  log_fatal("Impossible condition at %s:%d.", MDL);
5010  }
5011 
5012  log_fatal("Triple impossible condition at %s:%d.", MDL);
5013  return NULL;
5014 }
5015 
5016 /*
5017  * Solicit is how a client starts requesting addresses.
5018  *
5019  * If the client asks for rapid commit, and we support it, we will
5020  * allocate the addresses and reply.
5021  *
5022  * Otherwise we will send an advertise message.
5023  */
5024 
5025 static void
5026 dhcpv6_solicit(struct data_string *reply_ret, struct packet *packet) {
5027  struct data_string client_id;
5028 
5029  /*
5030  * Validate our input.
5031  */
5032  if (!valid_client_msg(packet, &client_id)) {
5033  return;
5034  }
5035 
5036  lease_to_client(reply_ret, packet, &client_id, NULL);
5037 
5038  /*
5039  * Clean up.
5040  */
5041  data_string_forget(&client_id, MDL);
5042 }
5043 
5044 /*
5045  * Request is how a client actually requests addresses.
5046  *
5047  * Very similar to Solicit handling, except the server DUID is required.
5048  */
5049 
5050 static void
5051 dhcpv6_request(struct data_string *reply_ret, struct packet *packet) {
5052  struct data_string client_id;
5053  struct data_string server_id;
5054 
5055  /*
5056  * Validate our input.
5057  */
5058  if (!valid_client_resp(packet, &client_id, &server_id)) {
5059  return;
5060  }
5061 
5062  /* If the REQUEST arrived via unicast and unicast option isn't set,
5063  * reject it per RFC 3315, Sec 18.2.1 */
5064  if (packet->unicast == ISC_TRUE &&
5065  is_unicast_option_defined(packet) == ISC_FALSE) {
5066  unicast_reject(reply_ret, packet, &client_id, &server_id);
5067  } else {
5068  /*
5069  * Issue our lease.
5070  */
5071  lease_to_client(reply_ret, packet, &client_id, &server_id);
5072  }
5073 
5074  /*
5075  * Cleanup.
5076  */
5077  data_string_forget(&client_id, MDL);
5078  data_string_forget(&server_id, MDL);
5079 }
5080 
5081 /* Find a DHCPv6 packet's shared network from hints in the packet.
5082  */
5083 static isc_result_t
5084 shared_network_from_packet6(struct shared_network **shared,
5085  struct packet *packet)
5086 {
5087  const struct packet *chk_packet;
5088  const struct in6_addr *link_addr, *first_link_addr;
5089  struct iaddr tmp_addr;
5090  struct subnet *subnet;
5091  isc_result_t status;
5092 
5093  if ((shared == NULL) || (*shared != NULL) || (packet == NULL))
5094  return DHCP_R_INVALIDARG;
5095 
5096  /*
5097  * First, find the link address where the packet from the client
5098  * first appeared (if this packet was relayed).
5099  */
5100  first_link_addr = NULL;
5101  chk_packet = packet->dhcpv6_container_packet;
5102  while (chk_packet != NULL) {
5103  link_addr = &chk_packet->dhcpv6_link_address;
5104  if (!IN6_IS_ADDR_UNSPECIFIED(link_addr) &&
5105  !IN6_IS_ADDR_LINKLOCAL(link_addr)) {
5106  first_link_addr = link_addr;
5107  break;
5108  }
5109  chk_packet = chk_packet->dhcpv6_container_packet;
5110  }
5111 
5112  /*
5113  * If there is a relayed link address, find the subnet associated
5114  * with that, and use that to get the appropriate
5115  * shared_network.
5116  */
5117  if (first_link_addr != NULL) {
5118  tmp_addr.len = sizeof(*first_link_addr);
5119  memcpy(tmp_addr.iabuf,
5120  first_link_addr, sizeof(*first_link_addr));
5121  subnet = NULL;
5122  if (!find_subnet(&subnet, tmp_addr, MDL)) {
5123  log_debug("No subnet found for link-address %s.",
5124  piaddr(tmp_addr));
5125  return ISC_R_NOTFOUND;
5126  }
5127  status = shared_network_reference(shared,
5129  subnet_dereference(&subnet, MDL);
5130 
5131  /*
5132  * If there is no link address, we will use the interface
5133  * that this packet came in on to pick the shared_network.
5134  */
5135  } else if (packet->interface != NULL) {
5136  status = shared_network_reference(shared,
5138  MDL);
5139  if (packet->dhcpv6_container_packet != NULL) {
5140  log_info("[L2 Relay] No link address in relay packet "
5141  "assuming L2 relay and using receiving "
5142  "interface");
5143  }
5144 
5145  } else {
5146  /*
5147  * We shouldn't be able to get here but if there is no link
5148  * address and no interface we don't know where to get the
5149  * pool from log an error and return an error.
5150  */
5151  log_error("No interface and no link address "
5152  "can't determine pool");
5153  status = DHCP_R_INVALIDARG;
5154  }
5155 
5156  return status;
5157 }
5158 
5159 /*
5160  * When a client thinks it might be on a new link, it sends a
5161  * Confirm message.
5162  *
5163  * From RFC3315 section 18.2.2:
5164  *
5165  * When the server receives a Confirm message, the server determines
5166  * whether the addresses in the Confirm message are appropriate for the
5167  * link to which the client is attached. If all of the addresses in the
5168  * Confirm message pass this test, the server returns a status of
5169  * Success. If any of the addresses do not pass this test, the server
5170  * returns a status of NotOnLink. If the server is unable to perform
5171  * this test (for example, the server does not have information about
5172  * prefixes on the link to which the client is connected), or there were
5173  * no addresses in any of the IAs sent by the client, the server MUST
5174  * NOT send a reply to the client.
5175  */
5176 
5177 static void
5178 dhcpv6_confirm(struct data_string *reply_ret, struct packet *packet) {
5179  struct shared_network *shared;
5180  struct subnet *subnet;
5181  struct option_cache *ia, *ta, *oc;
5182  struct data_string cli_enc_opt_data, iaaddr, client_id, packet_oro;
5183  struct option_state *cli_enc_opt_state, *opt_state;
5184  struct iaddr cli_addr;
5185  int pass;
5186  isc_boolean_t inappropriate, has_addrs;
5187  char reply_data[65536];
5188  struct dhcpv6_packet *reply = (struct dhcpv6_packet *)reply_data;
5189  int reply_ofs = (int)(offsetof(struct dhcpv6_packet, options));
5190 
5191  /*
5192  * Basic client message validation.
5193  */
5194  memset(&client_id, 0, sizeof(client_id));
5195  if (!valid_client_msg(packet, &client_id)) {
5196  return;
5197  }
5198 
5199  /*
5200  * Do not process Confirms that do not have IA's we do not recognize.
5201  */
5204  if ((ia == NULL) && (ta == NULL))
5205  return;
5206 
5207  /*
5208  * IA_PD's are simply ignored.
5209  */
5211 
5212  /*
5213  * Bit of variable initialization.
5214  */
5215  opt_state = cli_enc_opt_state = NULL;
5216  memset(&cli_enc_opt_data, 0, sizeof(cli_enc_opt_data));
5217  memset(&iaaddr, 0, sizeof(iaaddr));
5218  memset(&packet_oro, 0, sizeof(packet_oro));
5219 
5220  /* Determine what shared network the client is connected to. We
5221  * must not respond if we don't have any information about the
5222  * network the client is on.
5223  */
5224  shared = NULL;
5225  if ((shared_network_from_packet6(&shared, packet) != ISC_R_SUCCESS) ||
5226  (shared == NULL))
5227  goto exit;
5228 
5229  /* If there are no recorded subnets, then we have no
5230  * information about this subnet - ignore Confirms.
5231  */
5232  subnet = shared->subnets;
5233  if (subnet == NULL)
5234  goto exit;
5235 
5236  /* Are the addresses in all the IA's appropriate for that link? */
5237  has_addrs = inappropriate = ISC_FALSE;
5238  pass = D6O_IA_NA;
5239  while(!inappropriate) {
5240  /* If we've reached the end of the IA_NA pass, move to the
5241  * IA_TA pass.
5242  */
5243  if ((pass == D6O_IA_NA) && (ia == NULL)) {
5244  pass = D6O_IA_TA;
5245  ia = ta;
5246  }
5247 
5248  /* If we've reached the end of all passes, we're done. */
5249  if (ia == NULL)
5250  break;
5251 
5252  if (((pass == D6O_IA_NA) &&
5253  !get_encapsulated_IA_state(&cli_enc_opt_state,
5254  &cli_enc_opt_data,
5255  packet, ia, IA_NA_OFFSET)) ||
5256  ((pass == D6O_IA_TA) &&
5257  !get_encapsulated_IA_state(&cli_enc_opt_state,
5258  &cli_enc_opt_data,
5259  packet, ia, IA_TA_OFFSET))) {
5260  goto exit;
5261  }
5262 
5263  oc = lookup_option(&dhcpv6_universe, cli_enc_opt_state,
5264  D6O_IAADDR);
5265 
5266  for ( ; oc != NULL ; oc = oc->next) {
5267  if (!evaluate_option_cache(&iaaddr, packet, NULL, NULL,
5268  packet->options, NULL,
5269  &global_scope, oc, MDL) ||
5270  (iaaddr.len < IAADDR_OFFSET)) {
5271  log_error("dhcpv6_confirm: "
5272  "error evaluating IAADDR.");
5273  goto exit;
5274  }
5275 
5276  /* Copy out the IPv6 address for processing. */
5277  cli_addr.len = 16;
5278  memcpy(cli_addr.iabuf, iaaddr.data, 16);
5279 
5280  data_string_forget(&iaaddr, MDL);
5281 
5282  /* Record that we've processed at least one address. */
5283  has_addrs = ISC_TRUE;
5284 
5285  /* Find out if any subnets cover this address. */
5286  for (subnet = shared->subnets ; subnet != NULL ;
5287  subnet = subnet->next_sibling) {
5288  if (addr_eq(subnet_number(cli_addr,
5289  subnet->netmask),
5290  subnet->net))
5291  break;
5292  }
5293 
5294  /* If we reach the end of the subnet list, and no
5295  * subnet matches the client address, then it must
5296  * be inappropriate to the link (so far as our
5297  * configuration says). Once we've found one
5298  * inappropriate address, there is no reason to
5299  * continue searching.
5300  */
5301  if (subnet == NULL) {
5302  inappropriate = ISC_TRUE;
5303  break;
5304  }
5305  }
5306 
5307  option_state_dereference(&cli_enc_opt_state, MDL);
5308  data_string_forget(&cli_enc_opt_data, MDL);
5309 
5310  /* Advance to the next IA_*. */
5311  ia = ia->next;
5312  }
5313 
5314  /* If the client supplied no addresses, do not reply. */
5315  if (!has_addrs)
5316  goto exit;
5317 
5318  /*
5319  * Set up reply.
5320  */
5321  if (!start_reply(packet, &client_id, NULL, &opt_state, reply)) {
5322  goto exit;
5323  }
5324 
5325  /*
5326  * Set our status.
5327  */
5328  if (inappropriate) {
5329  if (!set_status_code(STATUS_NotOnLink,
5330  "Some of the addresses are not on link.",
5331  opt_state)) {
5332  goto exit;
5333  }
5334  } else {
5335  if (!set_status_code(STATUS_Success,
5336  "All addresses still on link.",
5337  opt_state)) {
5338  goto exit;
5339  }
5340  }
5341 
5342  /*
5343  * Only one option: add it.
5344  */
5345  reply_ofs += store_options6(reply_data+reply_ofs,
5346  sizeof(reply_data)-reply_ofs,
5347  opt_state, packet,
5348  required_opts, &packet_oro);
5349 
5350  /*
5351  * Return our reply to the caller.
5352  */
5353  reply_ret->len = reply_ofs;
5354  reply_ret->buffer = NULL;
5355  if (!buffer_allocate(&reply_ret->buffer, reply_ofs, MDL)) {
5356  log_fatal("No memory to store reply.");
5357  }
5358  reply_ret->data = reply_ret->buffer->data;
5359  memcpy(reply_ret->buffer->data, reply, reply_ofs);
5360 
5361 exit:
5362  /* Cleanup any stale data strings. */
5363  if (cli_enc_opt_data.buffer != NULL)
5364  data_string_forget(&cli_enc_opt_data, MDL);
5365  if (iaaddr.buffer != NULL)
5366  data_string_forget(&iaaddr, MDL);
5367  if (client_id.buffer != NULL)
5368  data_string_forget(&client_id, MDL);
5369  if (packet_oro.buffer != NULL)
5370  data_string_forget(&packet_oro, MDL);
5371 
5372  /* Release any stale option states. */
5373  if (cli_enc_opt_state != NULL)
5374  option_state_dereference(&cli_enc_opt_state, MDL);
5375  if (opt_state != NULL)
5376  option_state_dereference(&opt_state, MDL);
5377 }
5378 
5379 /*
5380  * Renew is when a client wants to extend its lease/prefix, at time T1.
5381  *
5382  * We handle this the same as if the client wants a new lease/prefix,
5383  * except for the error code of when addresses don't match.
5384  */
5385 
5386 static void
5387 dhcpv6_renew(struct data_string *reply, struct packet *packet) {
5388  struct data_string client_id;
5389  struct data_string server_id;
5390 
5391  /*
5392  * Validate the request.
5393  */
5394  if (!valid_client_resp(packet, &client_id, &server_id)) {
5395  return;
5396  }
5397 
5398  /* If the RENEW arrived via unicast and unicast option isn't set,
5399  * reject it per RFC 3315, Sec 18.2.3 */
5400  if (packet->unicast == ISC_TRUE &&
5401  is_unicast_option_defined(packet) == ISC_FALSE) {
5402  unicast_reject(reply, packet, &client_id, &server_id);
5403  } else {
5404  /*
5405  * Renew our lease.
5406  */
5407  lease_to_client(reply, packet, &client_id, &server_id);
5408  }
5409 
5410  /*
5411  * Cleanup.
5412  */
5413  data_string_forget(&server_id, MDL);
5414  data_string_forget(&client_id, MDL);
5415 }
5416 
5417 /*
5418  * Rebind is when a client wants to extend its lease, at time T2.
5419  *
5420  * We handle this the same as if the client wants a new lease, except
5421  * for the error code of when addresses don't match.
5422  */
5423 
5424 static void
5425 dhcpv6_rebind(struct data_string *reply, struct packet *packet) {
5426  struct data_string client_id;
5427 
5428  if (!valid_client_msg(packet, &client_id)) {
5429  return;
5430  }
5431 
5432  lease_to_client(reply, packet, &client_id, NULL);
5433 
5434  data_string_forget(&client_id, MDL);
5435 }
5436 
5437 static void
5438 ia_na_match_decline(const struct data_string *client_id,
5439  const struct data_string *iaaddr,
5440  struct iasubopt *lease)
5441 {
5442  char tmp_addr[INET6_ADDRSTRLEN];
5443 
5444  log_error("Client %s reports address %s is "
5445  "already in use by another host!",
5446  print_hex_1(client_id->len, client_id->data, 60),
5447  inet_ntop(AF_INET6, iaaddr->data,
5448  tmp_addr, sizeof(tmp_addr)));
5449  if (lease != NULL) {
5450  decline_lease6(lease->ipv6_pool, lease);
5451  lease->ia->cltt = cur_time;
5452  write_ia(lease->ia);
5453  }
5454 }
5455 
5456 static void
5457 ia_na_nomatch_decline(const struct data_string *client_id,
5458  const struct data_string *iaaddr,
5459  u_int32_t *ia_na_id,
5460  struct packet *packet,
5461  char *reply_data,
5462  int *reply_ofs,
5463  int reply_len)
5464 {
5465  char tmp_addr[INET6_ADDRSTRLEN];
5466  struct option_state *host_opt_state;
5467  int len;
5468 
5469  log_info("Client %s declines address %s, which is not offered to it.",
5470  print_hex_1(client_id->len, client_id->data, 60),
5471  inet_ntop(AF_INET6, iaaddr->data, tmp_addr, sizeof(tmp_addr)));
5472 
5473  /*
5474  * Create state for this IA_NA.
5475  */
5476  host_opt_state = NULL;
5477  if (!option_state_allocate(&host_opt_state, MDL)) {
5478  log_error("ia_na_nomatch_decline: out of memory "
5479  "allocating option_state.");
5480  goto exit;
5481  }
5482 
5483  if (!set_status_code(STATUS_NoBinding, "Decline for unknown address.",
5484  host_opt_state)) {
5485  goto exit;
5486  }
5487 
5488  /*
5489  * Insure we have enough space
5490  */
5491  if (reply_len < (*reply_ofs + 16)) {
5492  log_error("ia_na_nomatch_decline: "
5493  "out of space for reply packet.");
5494  goto exit;
5495  }
5496 
5497  /*
5498  * Put our status code into the reply packet.
5499  */
5500  len = store_options6(reply_data+(*reply_ofs)+16,
5501  reply_len-(*reply_ofs)-16,
5502  host_opt_state, packet,
5503  required_opts_STATUS_CODE, NULL);
5504 
5505  /*
5506  * Store the non-encapsulated option data for this
5507  * IA_NA into our reply packet. Defined in RFC 3315,
5508  * section 22.4.
5509  */
5510  /* option number */
5511  putUShort((unsigned char *)reply_data+(*reply_ofs), D6O_IA_NA);
5512  /* option length */
5513  putUShort((unsigned char *)reply_data+(*reply_ofs)+2, len + 12);
5514  /* IA_NA, copied from the client */
5515  memcpy(reply_data+(*reply_ofs)+4, ia_na_id, 4);
5516  /* t1 and t2, odd that we need them, but here it is */
5517  putULong((unsigned char *)reply_data+(*reply_ofs)+8, 0);
5518  putULong((unsigned char *)reply_data+(*reply_ofs)+12, 0);
5519 
5520  /*
5521  * Get ready for next IA_NA.
5522  */
5523  *reply_ofs += (len + 16);
5524 
5525 exit:
5526  option_state_dereference(&host_opt_state, MDL);
5527 }
5528 
5529 static void
5530 iterate_over_ia_na(struct data_string *reply_ret,
5531  struct packet *packet,
5532  const struct data_string *client_id,
5533  const struct data_string *server_id,
5534  const char *packet_type,
5535  void (*ia_na_match)(),
5536  void (*ia_na_nomatch)())
5537 {
5538  struct option_state *opt_state;
5539  struct host_decl *packet_host;
5540  struct option_cache *ia;
5541  struct option_cache *oc;
5542  /* cli_enc_... variables come from the IA_NA/IA_TA options */
5543  struct data_string cli_enc_opt_data;
5544  struct option_state *cli_enc_opt_state;
5545  struct host_decl *host;
5546  struct data_string iaaddr;
5547  struct data_string fixed_addr;
5548  char reply_data[65536];
5549  struct dhcpv6_packet *reply = (struct dhcpv6_packet *)reply_data;
5550  int reply_ofs = (int)(offsetof(struct dhcpv6_packet, options));
5551  char status_msg[32];
5552  struct iasubopt *lease;
5553  struct ia_xx *existing_ia_na;
5554  int i;
5555  struct data_string key;
5556  u_int32_t iaid;
5557 
5558  /*
5559  * Initialize to empty values, in case we have to exit early.
5560  */
5561  opt_state = NULL;
5562  memset(&cli_enc_opt_data, 0, sizeof(cli_enc_opt_data));
5563  cli_enc_opt_state = NULL;
5564  memset(&iaaddr, 0, sizeof(iaaddr));
5565  memset(&fixed_addr, 0, sizeof(fixed_addr));
5566  lease = NULL;
5567 
5568  /*
5569  * Find the host record that matches from the packet, if any.
5570  */
5571  packet_host = NULL;
5572  find_hosts6(&packet_host, packet, client_id, MDL);
5573 
5574  /*
5575  * Set our reply information.
5576  */
5577  reply->msg_type = DHCPV6_REPLY;
5579  sizeof(reply->transaction_id));
5580 
5581  /*
5582  * Build our option state for reply.
5583  */
5584  opt_state = NULL;
5585  if (!option_state_allocate(&opt_state, MDL)) {
5586  log_error("iterate_over_ia_na: no memory for option_state.");
5587  goto exit;
5588  }
5589  execute_statements_in_scope(NULL, packet, NULL, NULL,
5590  packet->options, opt_state,
5591  &global_scope, root_group, NULL, NULL);
5592 
5593  /*
5594  * RFC 3315, section 18.2.7 tells us which options to include.
5595  */
5596  oc = lookup_option(&dhcpv6_universe, opt_state, D6O_SERVERID);
5597  if (oc == NULL) {
5598  if (!save_option_buffer(&dhcpv6_universe, opt_state, NULL,
5599  (unsigned char *)server_duid.data,
5600  server_duid.len, D6O_SERVERID, 0)) {
5601  log_error("iterate_over_ia_na: "
5602  "error saving server identifier.");
5603  goto exit;
5604  }
5605  }
5606 
5607  if (!save_option_buffer(&dhcpv6_universe, opt_state,
5608  client_id->buffer,
5609  (unsigned char *)client_id->data,
5610  client_id->len,
5611  D6O_CLIENTID, 0)) {
5612  log_error("iterate_over_ia_na: "
5613  "error saving client identifier.");
5614  goto exit;
5615  }
5616 
5617  snprintf(status_msg, sizeof(status_msg), "%s received.", packet_type);
5618  if (!set_status_code(STATUS_Success, status_msg, opt_state)) {
5619  goto exit;
5620  }
5621 
5622  /*
5623  * Add our options that are not associated with any IA_NA or IA_TA.
5624  */
5625  reply_ofs += store_options6(reply_data+reply_ofs,
5626  sizeof(reply_data)-reply_ofs,
5627  opt_state, packet,
5628  required_opts, NULL);
5629 
5630  /*
5631  * Loop through the IA_NA reported by the client, and deal with
5632  * addresses reported as already in use.
5633  */
5635  ia != NULL; ia = ia->next) {
5636 
5637  if (!get_encapsulated_IA_state(&cli_enc_opt_state,
5638  &cli_enc_opt_data,
5639  packet, ia, IA_NA_OFFSET)) {
5640  goto exit;
5641  }
5642 
5643  iaid = getULong(cli_enc_opt_data.data);
5644 
5645  /*
5646  * XXX: It is possible that we can get multiple addresses
5647  * sent by the client. We don't send multiple
5648  * addresses, so this indicates a client error.
5649  * We should check for multiple IAADDR options, log
5650  * if found, and set as an error.
5651  */
5652  oc = lookup_option(&dhcpv6_universe, cli_enc_opt_state,
5653  D6O_IAADDR);
5654  if (oc == NULL) {
5655  /* no address given for this IA, ignore */
5656  option_state_dereference(&cli_enc_opt_state, MDL);
5657  data_string_forget(&cli_enc_opt_data, MDL);
5658  continue;
5659  }
5660 
5661  memset(&iaaddr, 0, sizeof(iaaddr));
5662  if (!evaluate_option_cache(&iaaddr, packet, NULL, NULL,
5663  packet->options, NULL,
5664  &global_scope, oc, MDL)) {
5665  log_error("iterate_over_ia_na: "
5666  "error evaluating IAADDR.");
5667  goto exit;
5668  }
5669 
5670  /*
5671  * Now we need to figure out which host record matches
5672  * this IA_NA and IAADDR (encapsulated option contents
5673  * matching a host record by option).
5674  *
5675  * XXX: We don't currently track IA_NA separately, but
5676  * we will need to do this!
5677  */
5678  host = NULL;
5679  if (!find_hosts_by_option(&host, packet,
5680  cli_enc_opt_state, MDL)) {
5681  if (packet_host != NULL) {
5682  host = packet_host;
5683  } else {
5684  host = NULL;
5685  }
5686  }
5687  while (host != NULL) {
5688  if (host->fixed_addr != NULL) {
5689  if (!evaluate_option_cache(&fixed_addr, NULL,
5690  NULL, NULL, NULL,
5691  NULL, &global_scope,
5692  host->fixed_addr,
5693  MDL)) {
5694  log_error("iterate_over_ia_na: error "
5695  "evaluating host address.");
5696  goto exit;
5697  }
5698  if ((iaaddr.len >= 16) &&
5699  !memcmp(fixed_addr.data, iaaddr.data, 16)) {
5700  data_string_forget(&fixed_addr, MDL);
5701  break;
5702  }
5703  data_string_forget(&fixed_addr, MDL);
5704  }
5705  host = host->n_ipaddr;
5706  }
5707 
5708  if ((host == NULL) && (iaaddr.len >= IAADDR_OFFSET)) {
5709  /*
5710  * Find existing IA_NA.
5711  */
5712  if (ia_make_key(&key, iaid,
5713  (char *)client_id->data,
5714  client_id->len,
5715  MDL) != ISC_R_SUCCESS) {
5716  log_fatal("iterate_over_ia_na: no memory for "
5717  "key.");
5718  }
5719 
5720  existing_ia_na = NULL;
5721  if (ia_hash_lookup(&existing_ia_na, ia_na_active,
5722  (unsigned char *)key.data,
5723  key.len, MDL)) {
5724  /*
5725  * Make sure this address is in the IA_NA.
5726  */
5727  for (i=0; i<existing_ia_na->num_iasubopt; i++) {
5728  struct iasubopt *tmp;
5729  struct in6_addr *in6_addr;
5730 
5731  tmp = existing_ia_na->iasubopt[i];
5732  in6_addr = &tmp->addr;
5733  if (memcmp(in6_addr,
5734  iaaddr.data, 16) == 0) {
5736  tmp, MDL);
5737  break;
5738  }
5739  }
5740  }
5741 
5742  data_string_forget(&key, MDL);
5743  }
5744 
5745  if ((host != NULL) || (lease != NULL)) {
5746  ia_na_match(client_id, &iaaddr, lease);
5747  } else {
5748  ia_na_nomatch(client_id, &iaaddr,
5749  (u_int32_t *)cli_enc_opt_data.data,
5750  packet, reply_data, &reply_ofs,
5751  sizeof(reply_data));
5752  }
5753 
5754  if (lease != NULL) {
5756  }
5757 
5758  data_string_forget(&iaaddr, MDL);
5759  option_state_dereference(&cli_enc_opt_state, MDL);
5760  data_string_forget(&cli_enc_opt_data, MDL);
5761  }
5762 
5763  /*
5764  * Return our reply to the caller.
5765  */
5766  reply_ret->len = reply_ofs;
5767  reply_ret->buffer = NULL;
5768  if (!buffer_allocate(&reply_ret->buffer, reply_ofs, MDL)) {
5769  log_fatal("No memory to store reply.");
5770  }
5771  reply_ret->data = reply_ret->buffer->data;
5772  memcpy(reply_ret->buffer->data, reply, reply_ofs);
5773 
5774 exit:
5775  if (lease != NULL) {
5777  }
5778  if (fixed_addr.buffer != NULL) {
5779  data_string_forget(&fixed_addr, MDL);
5780  }
5781  if (iaaddr.buffer != NULL) {
5782  data_string_forget(&iaaddr, MDL);
5783  }
5784  if (cli_enc_opt_state != NULL) {
5785  option_state_dereference(&cli_enc_opt_state, MDL);
5786  }
5787  if (cli_enc_opt_data.buffer != NULL) {
5788  data_string_forget(&cli_enc_opt_data, MDL);
5789  }
5790  if (opt_state != NULL) {
5791  option_state_dereference(&opt_state, MDL);
5792  }
5793 }
5794 
5795 /*
5796  * Decline means a client has detected that something else is using an
5797  * address we gave it.
5798  *
5799  * Since we're only dealing with fixed leases for now, there's not
5800  * much we can do, other that log the occurrence.
5801  *
5802  * When we start issuing addresses from pools, then we will have to
5803  * record our declined addresses and issue another. In general with
5804  * IPv6 there is no worry about DoS by clients exhausting space, but
5805  * we still need to be aware of this possibility.
5806  */
5807 
5808 /* TODO: IA_TA */
5809 static void
5810 dhcpv6_decline(struct data_string *reply, struct packet *packet) {
5811  struct data_string client_id;
5812  struct data_string server_id;
5813 
5814  /*
5815  * Validate our input.
5816  */
5817  if (!valid_client_resp(packet, &client_id, &server_id)) {
5818  return;
5819  }
5820 
5821  /* If the DECLINE arrived via unicast and unicast option isn't set,
5822  * reject it per RFC 3315, Sec 18.2.7 */
5823  if (packet->unicast == ISC_TRUE &&
5824  is_unicast_option_defined(packet) == ISC_FALSE) {
5825  unicast_reject(reply, packet, &client_id, &server_id);
5826  } else {
5827  /*
5828  * Undefined for IA_PD.
5829  */
5831 
5832  /*
5833  * And operate on each IA_NA in this packet.
5834  */
5835  iterate_over_ia_na(reply, packet, &client_id, &server_id,
5836  "Decline", ia_na_match_decline,
5837  ia_na_nomatch_decline);
5838 
5839  }
5840 
5841  data_string_forget(&server_id, MDL);
5842  data_string_forget(&client_id, MDL);
5843 }
5844 
5845 static void
5846 ia_na_match_release(const struct data_string *client_id,
5847  const struct data_string *iaaddr,
5848  struct iasubopt *lease)
5849 {
5850  char tmp_addr[INET6_ADDRSTRLEN];
5851 
5852  log_info("Client %s releases address %s",
5853  print_hex_1(client_id->len, client_id->data, 60),
5854  inet_ntop(AF_INET6, iaaddr->data, tmp_addr, sizeof(tmp_addr)));
5855  if (lease != NULL) {
5856  release_lease6(lease->ipv6_pool, lease);
5857  lease->ia->cltt = cur_time;
5858  write_ia(lease->ia);
5859  }
5860 }
5861 
5862 static void
5863 ia_na_nomatch_release(const struct data_string *client_id,
5864  const struct data_string *iaaddr,
5865  u_int32_t *ia_na_id,
5866  struct packet *packet,
5867  char *reply_data,
5868  int *reply_ofs,
5869  int reply_len)
5870 {
5871  char tmp_addr[INET6_ADDRSTRLEN];
5872  struct option_state *host_opt_state;
5873  int len;
5874 
5875  log_info("Client %s releases address %s, which is not leased to it.",
5876  print_hex_1(client_id->len, client_id->data, 60),
5877  inet_ntop(AF_INET6, iaaddr->data, tmp_addr, sizeof(tmp_addr)));
5878 
5879  /*
5880  * Create state for this IA_NA.
5881  */
5882  host_opt_state = NULL;
5883  if (!option_state_allocate(&host_opt_state, MDL)) {
5884  log_error("ia_na_nomatch_release: out of memory "
5885  "allocating option_state.");
5886  goto exit;
5887  }
5888 
5889  if (!set_status_code(STATUS_NoBinding,
5890  "Release for non-leased address.",
5891  host_opt_state)) {
5892  goto exit;
5893  }
5894 
5895  /*
5896  * Insure we have enough space
5897  */
5898  if (reply_len < (*reply_ofs + 16)) {
5899  log_error("ia_na_nomatch_release: "
5900  "out of space for reply packet.");
5901  goto exit;
5902  }
5903 
5904  /*
5905  * Put our status code into the reply packet.
5906  */
5907  len = store_options6(reply_data+(*reply_ofs)+16,
5908  reply_len-(*reply_ofs)-16,
5909  host_opt_state, packet,
5910  required_opts_STATUS_CODE, NULL);
5911 
5912  /*
5913  * Store the non-encapsulated option data for this
5914  * IA_NA into our reply packet. Defined in RFC 3315,
5915  * section 22.4.
5916  */
5917  /* option number */
5918  putUShort((unsigned char *)reply_data+(*reply_ofs), D6O_IA_NA);
5919  /* option length */
5920  putUShort((unsigned char *)reply_data+(*reply_ofs)+2, len + 12);
5921  /* IA_NA, copied from the client */
5922  memcpy(reply_data+(*reply_ofs)+4, ia_na_id, 4);
5923  /* t1 and t2, odd that we need them, but here it is */
5924  putULong((unsigned char *)reply_data+(*reply_ofs)+8, 0);
5925  putULong((unsigned char *)reply_data+(*reply_ofs)+12, 0);
5926 
5927  /*
5928  * Get ready for next IA_NA.
5929  */
5930  *reply_ofs += (len + 16);
5931 
5932 exit:
5933  option_state_dereference(&host_opt_state, MDL);
5934 }
5935 
5936 static void
5937 ia_pd_match_release(const struct data_string *client_id,
5938  const struct data_string *iapref,
5939  struct iasubopt *prefix)
5940 {
5941  char tmp_addr[INET6_ADDRSTRLEN];
5942 
5943  log_info("Client %s releases prefix %s/%u",
5944  print_hex_1(client_id->len, client_id->data, 60),
5945  inet_ntop(AF_INET6, iapref->data + 9,
5946  tmp_addr, sizeof(tmp_addr)),
5947  (unsigned) getUChar(iapref->data + 8));
5948  if (prefix != NULL) {
5949  release_lease6(prefix->ipv6_pool, prefix);
5950  prefix->ia->cltt = cur_time;
5951  write_ia(prefix->ia);
5952  }
5953 }
5954 
5955 static void
5956 ia_pd_nomatch_release(const struct data_string *client_id,
5957  const struct data_string *iapref,
5958  u_int32_t *ia_pd_id,
5959  struct packet *packet,
5960  char *reply_data,
5961  int *reply_ofs,
5962  int reply_len)
5963 {
5964  char tmp_addr[INET6_ADDRSTRLEN];
5965  struct option_state *host_opt_state;
5966  int len;
5967 
5968  log_info("Client %s releases prefix %s/%u, which is not leased to it.",
5969  print_hex_1(client_id->len, client_id->data, 60),
5970  inet_ntop(AF_INET6, iapref->data + 9,
5971  tmp_addr, sizeof(tmp_addr)),
5972  (unsigned) getUChar(iapref->data + 8));
5973 
5974  /*
5975  * Create state for this IA_PD.
5976  */
5977  host_opt_state = NULL;
5978  if (!option_state_allocate(&host_opt_state, MDL)) {
5979  log_error("ia_pd_nomatch_release: out of memory "
5980  "allocating option_state.");
5981  goto exit;
5982  }
5983 
5984  if (!set_status_code(STATUS_NoBinding,
5985  "Release for non-leased prefix.",
5986  host_opt_state)) {
5987  goto exit;
5988  }
5989 
5990  /*
5991  * Insure we have enough space
5992  */
5993  if (reply_len < (*reply_ofs + 16)) {
5994  log_error("ia_pd_nomatch_release: "
5995  "out of space for reply packet.");
5996  goto exit;
5997  }
5998 
5999  /*
6000  * Put our status code into the reply packet.
6001  */
6002  len = store_options6(reply_data+(*reply_ofs)+16,
6003  reply_len-(*reply_ofs)-16,
6004  host_opt_state, packet,
6005  required_opts_STATUS_CODE, NULL);
6006 
6007  /*
6008  * Store the non-encapsulated option data for this
6009  * IA_PD into our reply packet. Defined in RFC 3315,
6010  * section 22.4.
6011  */
6012  /* option number */
6013  putUShort((unsigned char *)reply_data+(*reply_ofs), D6O_IA_PD);
6014  /* option length */
6015  putUShort((unsigned char *)reply_data+(*reply_ofs)+2, len + 12);
6016  /* IA_PD, copied from the client */
6017  memcpy(reply_data+(*reply_ofs)+4, ia_pd_id, 4);
6018  /* t1 and t2, odd that we need them, but here it is */
6019  putULong((unsigned char *)reply_data+(*reply_ofs)+8, 0);
6020  putULong((unsigned char *)reply_data+(*reply_ofs)+12, 0);
6021 
6022  /*
6023  * Get ready for next IA_PD.
6024  */
6025  *reply_ofs += (len + 16);
6026 
6027 exit:
6028  option_state_dereference(&host_opt_state, MDL);
6029 }
6030 
6031 static void
6032 iterate_over_ia_pd(struct data_string *reply_ret,
6033  struct packet *packet,
6034  const struct data_string *client_id,
6035  const struct data_string *server_id,
6036  const char *packet_type,
6037  void (*ia_pd_match)(),
6038  void (*ia_pd_nomatch)())
6039 {
6040  struct data_string reply_new;
6041  int reply_len;
6042  struct option_state *opt_state;
6043  struct host_decl *packet_host;
6044  struct option_cache *ia;
6045  struct option_cache *oc;
6046  /* cli_enc_... variables come from the IA_PD options */
6047  struct data_string cli_enc_opt_data;
6048  struct option_state *cli_enc_opt_state;
6049  struct host_decl *host;
6050  struct data_string iaprefix;
6051  char reply_data[65536];
6052  int reply_ofs;
6053  struct iasubopt *prefix;
6054  struct ia_xx *existing_ia_pd;
6055  int i;
6056  struct data_string key;
6057  u_int32_t iaid;
6058 
6059  /*
6060  * Initialize to empty values, in case we have to exit early.
6061  */
6062  memset(&reply_new, 0, sizeof(reply_new));
6063  opt_state = NULL;
6064  memset(&cli_enc_opt_data, 0, sizeof(cli_enc_opt_data));
6065  cli_enc_opt_state = NULL;
6066  memset(&iaprefix, 0, sizeof(iaprefix));
6067  prefix = NULL;
6068 
6069  /*
6070  * Compute the available length for the reply.
6071  */
6072  reply_len = sizeof(reply_data) - reply_ret->len;
6073  reply_ofs = 0;
6074 
6075  /*
6076  * Find the host record that matches from the packet, if any.
6077  */
6078  packet_host = NULL;
6079  find_hosts6(&packet_host, packet, client_id, MDL);
6080 
6081  /*
6082  * Build our option state for reply.
6083  */
6084  opt_state = NULL;
6085  if (!option_state_allocate(&opt_state, MDL)) {
6086  log_error("iterate_over_ia_pd: no memory for option_state.");
6087  goto exit;
6088  }
6089  execute_statements_in_scope(NULL, packet, NULL, NULL,
6090  packet->options, opt_state,
6091  &global_scope, root_group, NULL, NULL);
6092 
6093  /*
6094  * Loop through the IA_PD reported by the client, and deal with
6095  * prefixes reported as already in use.
6096  */
6098  ia != NULL; ia = ia->next) {
6099 
6100  if (!get_encapsulated_IA_state(&cli_enc_opt_state,
6101  &cli_enc_opt_data,
6102  packet, ia, IA_PD_OFFSET)) {
6103  goto exit;
6104  }
6105 
6106  iaid = getULong(cli_enc_opt_data.data);
6107 
6108  oc = lookup_option(&dhcpv6_universe, cli_enc_opt_state,
6109  D6O_IAPREFIX);
6110  if (oc == NULL) {
6111  /* no prefix given for this IA_PD, ignore */
6112  option_state_dereference(&cli_enc_opt_state, MDL);
6113  data_string_forget(&cli_enc_opt_data, MDL);
6114  continue;
6115  }
6116 
6117  for (; oc != NULL; oc = oc->next) {
6118  memset(&iaprefix, 0, sizeof(iaprefix));
6119  if (!evaluate_option_cache(&iaprefix, packet, NULL, NULL,
6120  packet->options, NULL,
6121  &global_scope, oc, MDL)) {
6122  log_error("iterate_over_ia_pd: "
6123  "error evaluating IAPREFIX.");
6124  goto exit;
6125  }
6126 
6127  /*
6128  * Now we need to figure out which host record matches
6129  * this IA_PD and IAPREFIX (encapsulated option contents
6130  * matching a host record by option).
6131  *
6132  * XXX: We don't currently track IA_PD separately, but
6133  * we will need to do this!
6134  */
6135  host = NULL;
6136  if (!find_hosts_by_option(&host, packet,
6137  cli_enc_opt_state, MDL)) {
6138  if (packet_host != NULL) {
6139  host = packet_host;
6140  } else {
6141  host = NULL;
6142  }
6143  }
6144  while (host != NULL) {
6145  if (host->fixed_prefix != NULL) {
6146  struct iaddrcidrnetlist *l;
6147  int plen = (int) getUChar(iaprefix.data + 8);
6148 
6149  for (l = host->fixed_prefix; l != NULL;
6150  l = l->next) {
6151  if (plen != l->cidrnet.bits)
6152  continue;
6153  if (memcmp(iaprefix.data + 9,
6154  l->cidrnet.lo_addr.iabuf,
6155  16) == 0)
6156  break;
6157  }
6158  if ((l != NULL) && (iaprefix.len >= 17))
6159  break;
6160  }
6161  host = host->n_ipaddr;
6162  }
6163 
6164  if ((host == NULL) && (iaprefix.len >= IAPREFIX_OFFSET)) {
6165  /*
6166  * Find existing IA_PD.
6167  */
6168  if (ia_make_key(&key, iaid,
6169  (char *)client_id->data,
6170  client_id->len,
6171  MDL) != ISC_R_SUCCESS) {
6172  log_fatal("iterate_over_ia_pd: no memory for "
6173  "key.");
6174  }
6175 
6176  existing_ia_pd = NULL;
6177  if (ia_hash_lookup(&existing_ia_pd, ia_pd_active,
6178  (unsigned char *)key.data,
6179  key.len, MDL)) {
6180  /*
6181  * Make sure this prefix is in the IA_PD.
6182  */
6183  for (i = 0;
6184  i < existing_ia_pd->num_iasubopt;
6185  i++) {
6186  struct iasubopt *tmp;
6187  u_int8_t plen;
6188 
6189  plen = getUChar(iaprefix.data + 8);
6190  tmp = existing_ia_pd->iasubopt[i];
6191  if ((tmp->plen == plen) &&
6192  (memcmp(&tmp->addr,
6193  iaprefix.data + 9,
6194  16) == 0)) {
6195  iasubopt_reference(&prefix,
6196  tmp, MDL);
6197  break;
6198  }
6199  }
6200  }
6201 
6202  data_string_forget(&key, MDL);
6203  }
6204 
6205  if ((host != NULL) || (prefix != NULL)) {
6206  ia_pd_match(client_id, &iaprefix, prefix);
6207  } else {
6208  ia_pd_nomatch(client_id, &iaprefix,
6209  (u_int32_t *)cli_enc_opt_data.data,
6210  packet, reply_data, &reply_ofs,
6211  reply_len - reply_ofs);
6212  }
6213 
6214  if (prefix != NULL) {
6215  iasubopt_dereference(&prefix, MDL);
6216  }
6217 
6218  data_string_forget(&iaprefix, MDL);
6219  }
6220 
6221  option_state_dereference(&cli_enc_opt_state, MDL);
6222  data_string_forget(&cli_enc_opt_data, MDL);
6223  }
6224 
6225  /*
6226  * Return our reply to the caller.
6227  * The IA_NA routine has already filled at least the header.
6228  */
6229  reply_new.len = reply_ret->len + reply_ofs;
6230  if (!buffer_allocate(&reply_new.buffer, reply_new.len, MDL)) {
6231  log_fatal("No memory to store reply.");
6232  }
6233  reply_new.data = reply_new.buffer->data;
6234  memcpy(reply_new.buffer->data,
6235  reply_ret->buffer->data, reply_ret->len);
6236  memcpy(reply_new.buffer->data + reply_ret->len,
6237  reply_data, reply_ofs);
6238  data_string_forget(reply_ret, MDL);
6239  data_string_copy(reply_ret, &reply_new, MDL);
6240  data_string_forget(&reply_new, MDL);
6241 
6242 exit:
6243  if (prefix != NULL) {
6244  iasubopt_dereference(&prefix, MDL);
6245  }
6246  if (iaprefix.buffer != NULL) {
6247  data_string_forget(&iaprefix, MDL);
6248  }
6249  if (cli_enc_opt_state != NULL) {
6250  option_state_dereference(&cli_enc_opt_state, MDL);
6251  }
6252  if (cli_enc_opt_data.buffer != NULL) {
6253  data_string_forget(&cli_enc_opt_data, MDL);
6254  }
6255  if (opt_state != NULL) {
6256  option_state_dereference(&opt_state, MDL);
6257  }
6258 }
6259 
6260 /*
6261  * Release means a client is done with the leases.
6262  */
6263 
6264 static void
6265 dhcpv6_release(struct data_string *reply, struct packet *packet) {
6266  struct data_string client_id;
6267  struct data_string server_id;
6268 
6269  /*
6270  * Validate our input.
6271  */
6272  if (!valid_client_resp(packet, &client_id, &server_id)) {
6273  return;
6274  }
6275 
6276  /* If the RELEASE arrived via unicast and unicast option isn't set,
6277  * reject it per RFC 3315, Sec 18.2.6 */
6278  if (packet->unicast == ISC_TRUE &&
6279  is_unicast_option_defined(packet) == ISC_FALSE) {
6280  unicast_reject(reply, packet, &client_id, &server_id);
6281  } else {
6282  /*
6283  * And operate on each IA_NA in this packet.
6284  */
6285  iterate_over_ia_na(reply, packet, &client_id, &server_id,
6286  "Release", ia_na_match_release,
6287  ia_na_nomatch_release);
6288 
6289  /*
6290  * And operate on each IA_PD in this packet.
6291  */
6292  iterate_over_ia_pd(reply, packet, &client_id, &server_id,
6293  "Release", ia_pd_match_release,
6294  ia_pd_nomatch_release);
6295  }
6296 
6297  data_string_forget(&server_id, MDL);
6298  data_string_forget(&client_id, MDL);
6299 }
6300 
6301 /*
6302  * Information-Request is used by clients who have obtained an address
6303  * from other means, but want configuration information from the server.
6304  */
6305 
6306 static void
6307 dhcpv6_information_request(struct data_string *reply, struct packet *packet) {
6308  struct data_string client_id;
6309  struct data_string server_id;
6310 
6311  /*
6312  * Validate our input.
6313  */
6314  if (!valid_client_info_req(packet, &server_id)) {
6315  return;
6316  }
6317 
6318  /*
6319  * Get our client ID, if there is one.
6320  */
6321  memset(&client_id, 0, sizeof(client_id));
6322  if (get_client_id(packet, &client_id) != ISC_R_SUCCESS) {
6323  data_string_forget(&client_id, MDL);
6324  }
6325 
6326  /*
6327  * Use the lease_to_client() function. This will work fine,
6328  * because the valid_client_info_req() insures that we
6329  * don't have any IA that would cause us to allocate
6330  * resources to the client.
6331  */
6332  lease_to_client(reply, packet, &client_id,
6333  server_id.data != NULL ? &server_id : NULL);
6334 
6335  /*
6336  * Cleanup.
6337  */
6338  if (client_id.data != NULL) {
6339  data_string_forget(&client_id, MDL);
6340  }
6341  data_string_forget(&server_id, MDL);
6342 }
6343 
6344 /*
6345  * The Relay-forw message is sent by relays. It typically contains a
6346  * single option, which encapsulates an entire packet.
6347  *
6348  * We need to build an encapsulated reply.
6349  */
6350 
6351 /* XXX: this is very, very similar to do_packet6(), and should probably
6352  be combined in a clever way */
6353 /* DHCPv6 server side */
6354 static void
6355 dhcpv6_relay_forw(struct data_string *reply_ret, struct packet *packet) {
6356  struct option_cache *oc;
6357  struct data_string enc_opt_data;
6358  struct packet *enc_packet;
6359  unsigned char msg_type;
6360  const struct dhcpv6_packet *msg;
6361  const struct dhcpv6_relay_packet *relay;
6362  struct data_string enc_reply;
6363  char link_addr[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
6364  char peer_addr[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
6365  struct data_string a_opt, packet_ero;
6366  struct option_state *opt_state;
6367  static char reply_data[65536];
6368  struct dhcpv6_relay_packet *reply;
6369  int reply_ofs;
6370 
6371  /*
6372  * Initialize variables for early exit.
6373  */
6374  opt_state = NULL;
6375  memset(&a_opt, 0, sizeof(a_opt));
6376  memset(&packet_ero, 0, sizeof(packet_ero));
6377  memset(&enc_reply, 0, sizeof(enc_reply));
6378  memset(&enc_opt_data, 0, sizeof(enc_opt_data));
6379  enc_packet = NULL;
6380 
6381  /*
6382  * Get our encapsulated relay message.
6383  */
6385  if (oc == NULL) {
6386  inet_ntop(AF_INET6, &packet->dhcpv6_link_address,
6387  link_addr, sizeof(link_addr));
6388  inet_ntop(AF_INET6, &packet->dhcpv6_peer_address,
6389  peer_addr, sizeof(peer_addr));
6390  log_info("Relay-forward from %s with link address=%s and "
6391  "peer address=%s missing Relay Message option.",
6392  piaddr(packet->client_addr), link_addr, peer_addr);
6393  goto exit;
6394  }
6395 
6396  if (!evaluate_option_cache(&enc_opt_data, NULL, NULL, NULL,
6397  NULL, NULL, &global_scope, oc, MDL)) {
6398  /* should be dhcpv6_relay_forw */
6399  log_error("dhcpv6_forw_relay: error evaluating "
6400  "relayed message.");
6401  goto exit;
6402  }
6403 
6404  if (!packet6_len_okay((char *)enc_opt_data.data, enc_opt_data.len)) {
6405  /* should be dhcpv6_relay_forw */
6406  log_error("dhcpv6_forw_relay: encapsulated packet too short.");
6407  goto exit;
6408  }
6409 
6410  /*
6411  * Build a packet structure from this encapsulated packet.
6412  */
6413  enc_packet = NULL;
6414  if (!packet_allocate(&enc_packet, MDL)) {
6415  /* should be dhcpv6_relay_forw */
6416  log_error("dhcpv6_forw_relay: "
6417  "no memory for encapsulated packet.");
6418  goto exit;
6419  }
6420 
6421  if (!option_state_allocate(&enc_packet->options, MDL)) {
6422  /* should be dhcpv6_relay_forw */
6423  log_error("dhcpv6_forw_relay: "
6424  "no memory for encapsulated packet's options.");
6425  goto exit;
6426  }
6427 
6428  enc_packet->client_port = packet->client_port;
6429  enc_packet->client_addr = packet->client_addr;
6430  interface_reference(&enc_packet->interface, packet->interface, MDL);
6431  enc_packet->dhcpv6_container_packet = packet;
6432 
6433  msg_type = enc_opt_data.data[0];
6434  if ((msg_type == DHCPV6_RELAY_FORW) ||
6435  (msg_type == DHCPV6_RELAY_REPL)) {
6436  int relaylen = (int)(offsetof(struct dhcpv6_relay_packet, options));
6437  relay = (struct dhcpv6_relay_packet *)enc_opt_data.data;
6438  enc_packet->dhcpv6_msg_type = relay->msg_type;
6439 
6440  /* relay-specific data */
6441  enc_packet->dhcpv6_hop_count = relay->hop_count;
6442  memcpy(&enc_packet->dhcpv6_link_address,
6443  relay->link_address, sizeof(relay->link_address));
6444  memcpy(&enc_packet->dhcpv6_peer_address,
6445  relay->peer_address, sizeof(relay->peer_address));
6446 
6447  if (!parse_option_buffer(enc_packet->options,
6448  relay->options,
6449  enc_opt_data.len - relaylen,
6450  &dhcpv6_universe)) {
6451  /* no logging here, as parse_option_buffer() logs all
6452  cases where it fails */
6453  goto exit;
6454  }
6455  } else if ((msg_type == DHCPV6_DHCPV4_QUERY) ||
6457 #ifdef DHCP4o6
6458  if (!dhcpv4_over_dhcpv6 ||
6460  log_error("dhcpv6_relay_forw: "
6461  "unsupported %s message type.",
6463  goto exit;
6464  }
6465  forw_dhcpv4_query(packet);
6466  goto exit;
6467 #else /* DHCP4o6 */
6468  log_error("dhcpv6_relay_forw: unsupported %s message type.",
6470  goto exit;
6471 #endif /* DHCP4o6 */
6472  } else {
6473  int msglen = (int)(offsetof(struct dhcpv6_packet, options));
6474  msg = (struct dhcpv6_packet *)enc_opt_data.data;
6475  enc_packet->dhcpv6_msg_type = msg->msg_type;
6476 
6477  /* message-specific data */
6478  memcpy(enc_packet->dhcpv6_transaction_id,
6479  msg->transaction_id,
6480  sizeof(enc_packet->dhcpv6_transaction_id));
6481 
6482  if (!parse_option_buffer(enc_packet->options,
6483  msg->options,
6484  enc_opt_data.len - msglen,
6485  &dhcpv6_universe)) {
6486  /* no logging here, as parse_option_buffer() logs all
6487  cases where it fails */
6488  goto exit;
6489  }
6490  }
6491 
6492  /*
6493  * This is recursive. It is possible to exceed maximum packet size.
6494  * XXX: This will cause the packet send to fail.
6495  */
6496  build_dhcpv6_reply(&enc_reply, enc_packet);
6497 
6498  /*
6499  * If we got no encapsulated data, then it is discarded, and
6500  * our reply-forw is also discarded.
6501  */
6502  if (enc_reply.data == NULL) {
6503  goto exit;
6504  }
6505 
6506  /*
6507  * Now we can use the reply_data buffer.
6508  * Packet header stuff all comes from the forward message.
6509  */
6510  reply = (struct dhcpv6_relay_packet *)reply_data;
6511  reply->msg_type = DHCPV6_RELAY_REPL;
6512  reply->hop_count = packet->dhcpv6_hop_count;
6513  memcpy(reply->link_address, &packet->dhcpv6_link_address,
6514  sizeof(reply->link_address));
6515  memcpy(reply->peer_address, &packet->dhcpv6_peer_address,
6516  sizeof(reply->peer_address));
6517  reply_ofs = (int)(offsetof(struct dhcpv6_relay_packet, options));
6518 
6519  /*
6520  * Get the reply option state.
6521  */
6522  opt_state = NULL;
6523  if (!option_state_allocate(&opt_state, MDL)) {
6524  log_error("dhcpv6_relay_forw: no memory for option state.");
6525  goto exit;
6526  }
6527 
6528  /*
6529  * Append the interface-id if present.
6530  */
6533  if (oc != NULL) {
6534  if (!evaluate_option_cache(&a_opt, packet,
6535  NULL, NULL,
6536  packet->options, NULL,
6537  &global_scope, oc, MDL)) {
6538  log_error("dhcpv6_relay_forw: error evaluating "
6539  "Interface ID.");
6540  goto exit;
6541  }
6542  if (!save_option_buffer(&dhcpv6_universe, opt_state, NULL,
6543  (unsigned char *)a_opt.data,
6544  a_opt.len,
6545  D6O_INTERFACE_ID, 0)) {
6546  log_error("dhcpv6_relay_forw: error saving "
6547  "Interface ID.");
6548  goto exit;
6549  }
6550  data_string_forget(&a_opt, MDL);
6551  }
6552 
6553  /*
6554  * Append our encapsulated stuff for caller.
6555  */
6556  if (!save_option_buffer(&dhcpv6_universe, opt_state, NULL,
6557  (unsigned char *)enc_reply.data,
6558  enc_reply.len,
6559  D6O_RELAY_MSG, 0)) {
6560  log_error("dhcpv6_relay_forw: error saving Relay MSG.");
6561  goto exit;
6562  }
6563 
6564  /*
6565  * Get the ERO if any.
6566  */
6568  if (oc != NULL) {
6569  unsigned req;
6570  int i;
6571 
6572  if (!evaluate_option_cache(&packet_ero, packet,
6573  NULL, NULL,
6574  packet->options, NULL,
6575  &global_scope, oc, MDL) ||
6576  (packet_ero.len & 1)) {
6577  log_error("dhcpv6_relay_forw: error evaluating ERO.");
6578  goto exit;
6579  }
6580 
6581  /* Decode and apply the ERO. */
6582  for (i = 0; i < packet_ero.len; i += 2) {
6583  req = getUShort(packet_ero.data + i);
6584  /* Already in the reply? */
6585  oc = lookup_option(&dhcpv6_universe, opt_state, req);
6586  if (oc != NULL)
6587  continue;
6588  /* Get it from the packet if present. */
6590  packet->options,
6591  req);
6592  if (oc == NULL)
6593  continue;
6594  if (!evaluate_option_cache(&a_opt, packet,
6595  NULL, NULL,
6596  packet->options, NULL,
6597  &global_scope, oc, MDL)) {
6598  log_error("dhcpv6_relay_forw: error "
6599  "evaluating option %u.", req);
6600  goto exit;
6601  }
6603  opt_state,
6604  NULL,
6605  (unsigned char *)a_opt.data,
6606  a_opt.len,
6607  req,
6608  0)) {
6609  log_error("dhcpv6_relay_forw: error saving "
6610  "option %u.", req);
6611  goto exit;
6612  }
6613  data_string_forget(&a_opt, MDL);
6614  }
6615  }
6616 
6617  reply_ofs += store_options6(reply_data + reply_ofs,
6618  sizeof(reply_data) - reply_ofs,
6619  opt_state, packet,
6620  required_opts_agent, &packet_ero);
6621 
6622  /*
6623  * Return our reply to the caller.
6624  */
6625  reply_ret->len = reply_ofs;
6626  reply_ret->buffer = NULL;
6627  if (!buffer_allocate(&reply_ret->buffer, reply_ret->len, MDL)) {
6628  log_fatal("No memory to store reply.");
6629  }
6630  reply_ret->data = reply_ret->buffer->data;
6631  memcpy(reply_ret->buffer->data, reply_data, reply_ofs);
6632 
6633 exit:
6634  if (opt_state != NULL)
6635  option_state_dereference(&opt_state, MDL);
6636  if (a_opt.data != NULL) {
6637  data_string_forget(&a_opt, MDL);
6638  }
6639  if (packet_ero.data != NULL) {
6640  data_string_forget(&packet_ero, MDL);
6641  }
6642  if (enc_reply.data != NULL) {
6643  data_string_forget(&enc_reply, MDL);
6644  }
6645  if (enc_opt_data.data != NULL) {
6646  data_string_forget(&enc_opt_data, MDL);
6647  }
6648  if (enc_packet != NULL) {
6649  packet_dereference(&enc_packet, MDL);
6650  }
6651 }
6652 
6653 #ifdef DHCP4o6
6654 /* \brief Internal processing of a relayed DHCPv4-query
6655  * (DHCPv4 server side)
6656  *
6657  * Code copied from \ref dhcpv6_relay_forw() which itself is
6658  * from \ref do_packet6().
6659  *
6660  * \param reply_ret pointer to the response
6661  * \param packet the query
6662  */
6663 static void
6664 dhcp4o6_relay_forw(struct data_string *reply_ret, struct packet *packet) {
6665  struct option_cache *oc;
6666  struct data_string enc_opt_data;
6667  struct packet *enc_packet;
6668  unsigned char msg_type;
6669  const struct dhcpv6_relay_packet *relay;
6670  const struct dhcpv4_over_dhcpv6_packet *msg;
6671  struct data_string enc_reply;
6672  char link_addr[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
6673  char peer_addr[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
6674  struct data_string a_opt, packet_ero;
6675  struct option_state *opt_state;
6676  static char reply_data[65536];
6677  struct dhcpv6_relay_packet *reply;
6678  int reply_ofs;
6679 
6680  /*
6681  * Initialize variables for early exit.
6682  */
6683  opt_state = NULL;
6684  memset(&a_opt, 0, sizeof(a_opt));
6685  memset(&packet_ero, 0, sizeof(packet_ero));
6686  memset(&enc_reply, 0, sizeof(enc_reply));
6687  memset(&enc_opt_data, 0, sizeof(enc_opt_data));
6688  enc_packet = NULL;
6689 
6690  /*
6691  * Get our encapsulated relay message.
6692  */
6694  if (oc == NULL) {
6695  inet_ntop(AF_INET6, &packet->dhcpv6_link_address,
6696  link_addr, sizeof(link_addr));
6697  inet_ntop(AF_INET6, &packet->dhcpv6_peer_address,
6698  peer_addr, sizeof(peer_addr));
6699  log_info("Relay-forward from %s with link address=%s and "
6700  "peer address=%s missing Relay Message option.",
6701  piaddr(packet->client_addr), link_addr, peer_addr);
6702  goto exit;
6703  }
6704 
6705  if (!evaluate_option_cache(&enc_opt_data, NULL, NULL, NULL,
6706  NULL, NULL, &global_scope, oc, MDL)) {
6707  log_error("dhcp4o6_relay_forw: error evaluating "
6708  "relayed message.");
6709  goto exit;
6710  }
6711 
6712  if (!packet6_len_okay((char *)enc_opt_data.data, enc_opt_data.len)) {
6713  log_error("dhcp4o6_relay_forw: "
6714  "encapsulated packet too short.");
6715  goto exit;
6716  }
6717 
6718  /*
6719  * Build a packet structure from this encapsulated packet.
6720  */
6721  if (!packet_allocate(&enc_packet, MDL)) {
6722  log_error("dhcp4o6_relay_forw: "
6723  "no memory for encapsulated packet.");
6724  goto exit;
6725  }
6726 
6727  if (!option_state_allocate(&enc_packet->options, MDL)) {
6728  log_error("dhcp4o6_relay_forw: "
6729  "no memory for encapsulated packet's options.");
6730  goto exit;
6731  }
6732 
6733  enc_packet->client_port = packet->client_port;
6734  enc_packet->client_addr = packet->client_addr;
6735  interface_reference(&enc_packet->interface, packet->interface, MDL);
6736  enc_packet->dhcpv6_container_packet = packet;
6737 
6738  msg_type = enc_opt_data.data[0];
6739  if ((msg_type == DHCPV6_RELAY_FORW) ||
6740  (msg_type == DHCPV6_RELAY_REPL)) {
6741  int relaylen = (int)(offsetof(struct dhcpv6_relay_packet, options));
6742  relay = (struct dhcpv6_relay_packet *)enc_opt_data.data;
6743  enc_packet->dhcpv6_msg_type = relay->msg_type;
6744 
6745  /* relay-specific data */
6746  enc_packet->dhcpv6_hop_count = relay->hop_count;
6747  memcpy(&enc_packet->dhcpv6_link_address,
6748  relay->link_address, sizeof(relay->link_address));
6749  memcpy(&enc_packet->dhcpv6_peer_address,
6750  relay->peer_address, sizeof(relay->peer_address));
6751 
6752  if (!parse_option_buffer(enc_packet->options,
6753  relay->options,
6754  enc_opt_data.len - relaylen,
6755  &dhcpv6_universe)) {
6756  /* no logging here, as parse_option_buffer() logs all
6757  cases where it fails */
6758  goto exit;
6759  }
6760  } else if ((msg_type == DHCPV6_DHCPV4_QUERY) ||
6762  int msglen =
6763  (int)(offsetof(struct dhcpv4_over_dhcpv6_packet, options));
6764  msg = (struct dhcpv4_over_dhcpv6_packet *)enc_opt_data.data;
6765  enc_packet->dhcpv6_msg_type = msg->msg_type;
6766 
6767  /* message-specific data */
6768  memcpy(enc_packet->dhcp4o6_flags,
6769  msg->flags,
6770  sizeof(enc_packet->dhcp4o6_flags));
6771 
6772  if (!parse_option_buffer(enc_packet->options,
6773  msg->options,
6774  enc_opt_data.len - msglen,
6775  &dhcpv6_universe)) {
6776  /* no logging here, as parse_option_buffer() logs all
6777  cases where it fails */
6778  goto exit;
6779  }
6780  } else {
6781  log_error("dhcp4o6_relay_forw: unexpected message of type %d.",
6782  (int)msg_type);
6783  goto exit;
6784  }
6785 
6786  /*
6787  * This is recursive. It is possible to exceed maximum packet size.
6788  * XXX: This will cause the packet send to fail.
6789  */
6790  build_dhcpv6_reply(&enc_reply, enc_packet);
6791 
6792  /*
6793  * If we got no encapsulated data, then it is discarded, and
6794  * our reply-forw is also discarded.
6795  */
6796  if (enc_reply.data == NULL) {
6797  goto exit;
6798  }
6799 
6800  /*
6801  * Now we can use the reply_data buffer.
6802  * Packet header stuff all comes from the forward message.
6803  */
6804  reply = (struct dhcpv6_relay_packet *)reply_data;
6805  reply->msg_type = DHCPV6_RELAY_REPL;
6806  reply->hop_count = packet->dhcpv6_hop_count;
6807  memcpy(reply->link_address, &packet->dhcpv6_link_address,
6808  sizeof(reply->link_address));
6809  memcpy(reply->peer_address, &packet->dhcpv6_peer_address,
6810  sizeof(reply->peer_address));
6811  reply_ofs = (int)(offsetof(struct dhcpv6_relay_packet, options));
6812 
6813  /*
6814  * Get the reply option state.
6815  */
6816  if (!option_state_allocate(&opt_state, MDL)) {
6817  log_error("dhcp4o6_relay_forw: no memory for option state.");
6818  goto exit;
6819  }
6820 
6821  /*
6822  * Append the interface-id if present.
6823  */
6826  if (oc != NULL) {
6827  if (!evaluate_option_cache(&a_opt, packet,
6828  NULL, NULL,
6829  packet->options, NULL,
6830  &global_scope, oc, MDL)) {
6831  log_error("dhcp4o6_relay_forw: error evaluating "
6832  "Interface ID.");
6833  goto exit;
6834  }
6835  if (!save_option_buffer(&dhcpv6_universe, opt_state, NULL,
6836  (unsigned char *)a_opt.data,
6837  a_opt.len,
6838  D6O_INTERFACE_ID, 0)) {
6839  log_error("dhcp4o6_relay_forw: error saving "
6840  "Interface ID.");
6841  goto exit;
6842  }
6843  data_string_forget(&a_opt, MDL);
6844  }
6845 
6846  /*
6847  * Append our encapsulated stuff for caller.
6848  */
6849  if (!save_option_buffer(&dhcpv6_universe, opt_state, NULL,
6850  (unsigned char *)enc_reply.data,
6851  enc_reply.len,
6852  D6O_RELAY_MSG, 0)) {
6853  log_error("dhcp4o6_relay_forw: error saving Relay MSG.");
6854  goto exit;
6855  }
6856 
6857  /*
6858  * Get the ERO if any.
6859  */
6861  if (oc != NULL) {
6862  unsigned req;
6863  int i;
6864 
6865  if (!evaluate_option_cache(&packet_ero, packet,
6866  NULL, NULL,
6867  packet->options, NULL,
6868  &global_scope, oc, MDL) ||
6869  (packet_ero.len & 1)) {
6870  log_error("dhcp4o6_relay_forw: error evaluating ERO.");
6871  goto exit;
6872  }
6873 
6874  /* Decode and apply the ERO. */
6875  for (i = 0; i < packet_ero.len; i += 2) {
6876  req = getUShort(packet_ero.data + i);
6877  /* Already in the reply? */
6878  oc = lookup_option(&dhcpv6_universe, opt_state, req);
6879  if (oc != NULL)
6880  continue;
6881  /* Get it from the packet if present. */
6883  packet->options,
6884  req);
6885  if (oc == NULL)
6886  continue;
6887  if (!evaluate_option_cache(&a_opt, packet,
6888  NULL, NULL,
6889  packet->options, NULL,
6890  &global_scope, oc, MDL)) {
6891  log_error("dhcp4o6_relay_forw: error "
6892  "evaluating option %u.", req);
6893  goto exit;
6894  }
6896  opt_state,
6897  NULL,
6898  (unsigned char *)a_opt.data,
6899  a_opt.len,
6900  req,
6901  0)) {
6902  log_error("dhcp4o6_relay_forw: error saving "
6903  "option %u.", req);
6904  goto exit;
6905  }
6906  data_string_forget(&a_opt, MDL);
6907  }
6908  }
6909 
6910  reply_ofs += store_options6(reply_data + reply_ofs,
6911  sizeof(reply_data) - reply_ofs,
6912  opt_state, packet,
6913  required_opts_agent, &packet_ero);
6914 
6915  /*
6916  * Return our reply to the caller.
6917  */
6918  reply_ret->len = reply_ofs;
6919  reply_ret->buffer = NULL;
6920  if (!buffer_allocate(&reply_ret->buffer, reply_ret->len, MDL)) {
6921  log_fatal("No memory to store reply.");
6922  }
6923  reply_ret->data = reply_ret->buffer->data;
6924  memcpy(reply_ret->buffer->data, reply_data, reply_ofs);
6925 
6926 exit:
6927  if (opt_state != NULL)
6928  option_state_dereference(&opt_state, MDL);
6929  if (a_opt.data != NULL) {
6930  data_string_forget(&a_opt, MDL);
6931  }
6932  if (packet_ero.data != NULL) {
6933  data_string_forget(&packet_ero, MDL);
6934  }
6935  if (enc_reply.data != NULL) {
6936  data_string_forget(&enc_reply, MDL);
6937  }
6938  if (enc_opt_data.data != NULL) {
6939  data_string_forget(&enc_opt_data, MDL);
6940  }
6941  if (enc_packet != NULL) {
6942  packet_dereference(&enc_packet, MDL);
6943  }
6944 }
6945 
6946 /*
6947  * \brief Internal processing of a DHCPv4-query
6948  * (DHCPv4 server function)
6949  *
6950  * Code copied from \ref do_packet().
6951  *
6952  * \param reply_ret pointer to the response
6953  * \param packet the query
6954  */
6955 static void
6956 dhcp4o6_dhcpv4_query(struct data_string *reply_ret, struct packet *packet) {
6957  struct option_cache *oc;
6958  struct data_string enc_opt_data;
6959  struct packet *enc_packet;
6960  struct data_string enc_response;
6961  struct option_state *opt_state;
6962  static char response_data[65536];
6963  struct dhcpv4_over_dhcpv6_packet *response;
6964  int response_ofs;
6965 
6966  /*
6967  * Initialize variables for early exit.
6968  */
6969  opt_state = NULL;
6970  memset(&enc_response, 0, sizeof(enc_response));
6971  memset(&enc_opt_data, 0, sizeof(enc_opt_data));
6972  enc_packet = NULL;
6973 
6974  /*
6975  * Get our encapsulated relay message.
6976  */
6978  if (oc == NULL) {
6979  log_info("DHCPv4-query from %s missing DHCPv4 Message option.",
6981  goto exit;
6982  }
6983 
6984  if (!evaluate_option_cache(&enc_opt_data, NULL, NULL, NULL,
6985  NULL, NULL, &global_scope, oc, MDL)) {
6986  log_error("dhcp4o6_dhcpv4_query: error evaluating "
6987  "DHCPv4 message.");
6988  goto exit;
6989  }
6990 
6991  if (enc_opt_data.len < DHCP_FIXED_NON_UDP) {
6992  log_error("dhcp4o6_dhcpv4_query: DHCPv4 packet too short.");
6993  goto exit;
6994  }
6995 
6996  /*
6997  * Build a packet structure from this encapsulated packet.
6998  */
6999  if (!packet_allocate(&enc_packet, MDL)) {
7000  log_error("dhcp4o6_dhcpv4_query: "
7001  "no memory for encapsulated packet.");
7002  goto exit;
7003  }
7004 
7005  enc_packet->raw = (struct dhcp_packet *)enc_opt_data.data;
7006  enc_packet->packet_length = enc_opt_data.len;
7007  enc_packet->dhcp4o6_response = &enc_response;
7008  enc_packet->client_port = packet->client_port;
7009  enc_packet->client_addr = packet->client_addr;
7010  interface_reference(&enc_packet->interface, packet->interface, MDL);
7011  enc_packet->dhcpv6_container_packet = packet;
7013  enc_packet->unicast = 1;
7014 
7015  if (enc_packet->raw->hlen > sizeof(enc_packet->raw->chaddr)) {
7016  log_info("dhcp4o6_dhcpv4_query: "
7017  "discarding packet with bogus hlen.");
7018  goto exit;
7019  }
7020 
7021  /* Allocate packet->options now so it is non-null for all packets */
7022  if (!option_state_allocate (&enc_packet->options, MDL)) {
7023  log_error("dhcp4o6_dhcpv4_query: no memory for options.");
7024  goto exit;
7025  }
7026 
7027  /* If there's an option buffer, try to parse it. */
7028  if (enc_packet->packet_length >= DHCP_FIXED_NON_UDP + 4) {
7029  struct option_cache *op;
7030  if (!parse_options(enc_packet)) {
7031  if (enc_packet->options)
7033  (&enc_packet->options, MDL);
7034  packet_dereference (&enc_packet, MDL);
7035  goto exit;
7036  }
7037 
7038  if (enc_packet->options_valid &&
7040  enc_packet->options,
7042  struct data_string dp;
7043  memset(&dp, 0, sizeof dp);
7044  evaluate_option_cache(&dp, enc_packet, NULL, NULL,
7045  enc_packet->options, NULL,
7046  NULL, op, MDL);
7047  if (dp.len > 0)
7048  enc_packet->packet_type = dp.data[0];
7049  else
7050  enc_packet->packet_type = 0;
7051  data_string_forget(&dp, MDL);
7052  }
7053  }
7054 
7055  if (validate_packet(enc_packet) != 0) {
7056  if (enc_packet->packet_type)
7057  dhcp(enc_packet);
7058  else
7059  bootp(enc_packet);
7060  }
7061 
7062  /* If the caller kept the packet, they'll have upped the refcnt. */
7063  packet_dereference(&enc_packet, MDL);
7064 
7065  /*
7066  * If we got no response data, then it is discarded, and
7067  * our DHCPv4-response is also discarded.
7068  */
7069  if (enc_response.data == NULL) {
7070  goto exit;
7071  }
7072 
7073  /*
7074  * Now we can use the response_data buffer.
7075  */
7076  response = (struct dhcpv4_over_dhcpv6_packet *)response_data;
7077  response->msg_type = DHCPV6_DHCPV4_RESPONSE;
7078  response->flags[0] = response->flags[1] = response->flags[2] = 0;
7079  response_ofs =
7080  (int)(offsetof(struct dhcpv4_over_dhcpv6_packet, options));
7081 
7082  /*
7083  * Get the response option state.
7084  */
7085  if (!option_state_allocate(&opt_state, MDL)) {
7086  log_error("dhcp4o6_dhcpv4_query: no memory for option state.");
7087  goto exit;
7088  }
7089 
7090  /*
7091  * Append our encapsulated stuff for caller.
7092  */
7093  if (!save_option_buffer(&dhcpv6_universe, opt_state, NULL,
7094  (unsigned char *)enc_response.data,
7095  enc_response.len,
7096  D6O_DHCPV4_MSG, 0)) {
7097  log_error("dhcp4o6_dhcpv4_query: error saving DHCPv4 MSG.");
7098  goto exit;
7099  }
7100 
7101  response_ofs += store_options6(response_data + response_ofs,
7102  sizeof(response_data) - response_ofs,
7103  opt_state, packet,
7104  required_opts_4o6, NULL);
7105 
7106  /*
7107  * Return our response to the caller.
7108  */
7109  reply_ret->len = response_ofs;
7110  reply_ret->buffer = NULL;
7111  if (!buffer_allocate(&reply_ret->buffer, reply_ret->len, MDL)) {
7112  log_fatal("dhcp4o6_dhcpv4_query: no memory to store reply.");
7113  }
7114  reply_ret->data = reply_ret->buffer->data;
7115  memcpy(reply_ret->buffer->data, response_data, response_ofs);
7116 
7117 exit:
7118  if (opt_state != NULL)
7119  option_state_dereference(&opt_state, MDL);
7120  if (enc_response.data != NULL) {
7121  data_string_forget(&enc_response, MDL);
7122  }
7123  if (enc_opt_data.data != NULL) {
7124  data_string_forget(&enc_opt_data, MDL);
7125  }
7126  if (enc_packet != NULL) {
7127  packet_dereference(&enc_packet, MDL);
7128  }
7129 }
7130 
7131 /*
7132  * \brief Forward a DHCPv4-query message to the DHCPv4 side
7133  * (DHCPv6 server function)
7134  *
7135  * Format: interface:16 + address:16 + DHCPv6 DHCPv4-query message
7136  *
7137  * \brief packet the DHCPv6 DHCPv4-query message
7138  */
7139 static void forw_dhcpv4_query(struct packet *packet) {
7140  struct data_string ds;
7141  unsigned len;
7142  int cc;
7143 
7144  /* Get the initial message. */
7145  while (packet->dhcpv6_container_packet != NULL)
7147 
7148  /* Check the initial message. */
7149  if ((packet->raw == NULL) ||
7150  (packet->client_addr.len != 16) ||
7151  (packet->interface == NULL)) {
7152  log_error("forw_dhcpv4_query: can't find initial message.");
7153  return;
7154  }
7155 
7156  /* Get a buffer. */
7157  len = packet->packet_length + 32;
7158  memset(&ds, 0, sizeof(ds));
7159  if (!buffer_allocate(&ds.buffer, len, MDL)) {
7160  log_error("forw_dhcpv4_query: "
7161  "no memory for encapsulating packet.");
7162  return;
7163  }
7164  ds.data = ds.buffer->data;
7165  ds.len = len;
7166 
7167  /* Fill the buffer. */
7168  strncpy((char *)ds.buffer->data, packet->interface->name, 16);
7169  memcpy(ds.buffer->data + 16,
7170  packet->client_addr.iabuf, 16);
7171  memcpy(ds.buffer->data + 32,
7172  (unsigned char *)packet->raw,
7174 
7175  /* Forward to the DHCPv4 server. */
7176  cc = send(dhcp4o6_fd, ds.data, ds.len, 0);
7177  if (cc < 0)
7178  log_error("forw_dhcpv4_query: send(): %m");
7179  data_string_forget(&ds, MDL);
7180 }
7181 #endif
7182 
7183 static void
7184 dhcpv6_discard(struct packet *packet) {
7185  /* INSIST(packet->msg_type > 0); */
7186  /* INSIST(packet->msg_type < dhcpv6_type_name_max); */
7187 
7188  log_debug("Discarding %s from %s; message type not handled by server",
7191 }
7192 
7193 static void
7194 build_dhcpv6_reply(struct data_string *reply, struct packet *packet) {
7195  memset(reply, 0, sizeof(*reply));
7196 
7197  /* I would like to classify the client once here, but
7198  * as I don't want to classify all of the incoming packets
7199  * I need to do it before handling specific types.
7200  * We don't need to classify if we are tossing the packet
7201  * or if it is a relay - the classification step will get
7202  * done when we process the inner client packet.
7203  */
7204 
7205  switch (packet->dhcpv6_msg_type) {
7206  case DHCPV6_SOLICIT:
7208  dhcpv6_solicit(reply, packet);
7209  break;
7210  case DHCPV6_ADVERTISE:
7211  dhcpv6_discard(packet);
7212  break;
7213  case DHCPV6_REQUEST:
7215  dhcpv6_request(reply, packet);
7216  break;
7217  case DHCPV6_CONFIRM:
7219  dhcpv6_confirm(reply, packet);
7220  break;
7221  case DHCPV6_RENEW:
7223  dhcpv6_renew(reply, packet);
7224  break;
7225  case DHCPV6_REBIND:
7227  dhcpv6_rebind(reply, packet);
7228  break;
7229  case DHCPV6_REPLY:
7230  dhcpv6_discard(packet);
7231  break;
7232  case DHCPV6_RELEASE:
7234  dhcpv6_release(reply, packet);
7235  break;
7236  case DHCPV6_DECLINE:
7238  dhcpv6_decline(reply, packet);
7239  break;
7240  case DHCPV6_RECONFIGURE:
7241  dhcpv6_discard(packet);
7242  break;
7245  dhcpv6_information_request(reply, packet);
7246  break;
7247  case DHCPV6_RELAY_FORW:
7248 #ifdef DHCP4o6
7249  if (dhcpv4_over_dhcpv6 && (local_family == AF_INET))
7250  dhcp4o6_relay_forw(reply, packet);
7251  else
7252 #endif /* DHCP4o6 */
7253  dhcpv6_relay_forw(reply, packet);
7254  break;
7255  case DHCPV6_RELAY_REPL:
7256  dhcpv6_discard(packet);
7257  break;
7258  case DHCPV6_LEASEQUERY:
7260  dhcpv6_leasequery(reply, packet);
7261  break;
7263  dhcpv6_discard(packet);
7264  break;
7265  case DHCPV6_DHCPV4_QUERY:
7266 #ifdef DHCP4o6
7267  if (dhcpv4_over_dhcpv6) {
7268  if (local_family == AF_INET6) {
7269  forw_dhcpv4_query(packet);
7270  } else {
7271  dhcp4o6_dhcpv4_query(reply, packet);
7272  }
7273  } else
7274 #endif /* DHCP4o6 */
7275  dhcpv6_discard(packet);
7276  break;
7278  dhcpv6_discard(packet);
7279  break;
7280  default:
7281  /* XXX: would be nice if we had "notice" level,
7282  as syslog, for this */
7283  log_info("Discarding unknown DHCPv6 message type %d "
7284  "from %s", packet->dhcpv6_msg_type,
7286  }
7287 }
7288 
7289 static void
7290 log_packet_in(const struct packet *packet) {
7291  struct data_string s;
7292  u_int32_t tid;
7293  char tmp_addr[INET6_ADDRSTRLEN];
7294  const void *addr;
7295 
7296  memset(&s, 0, sizeof(s));
7297 
7299  data_string_sprintfa(&s, "%s message from %s port %d",
7302  ntohs(packet->client_port));
7303  } else {
7305  "Unknown message type %d from %s port %d",
7308  ntohs(packet->client_port));
7309  }
7312  addr = &packet->dhcpv6_link_address;
7313  data_string_sprintfa(&s, ", link address %s",
7314  inet_ntop(AF_INET6, addr,
7315  tmp_addr, sizeof(tmp_addr)));
7316  addr = &packet->dhcpv6_peer_address;
7317  data_string_sprintfa(&s, ", peer address %s",
7318  inet_ntop(AF_INET6, addr,
7319  tmp_addr, sizeof(tmp_addr)));
7320  } else if ((packet->dhcpv6_msg_type != DHCPV6_DHCPV4_QUERY) &&
7322  tid = 0;
7323  memcpy(((char *)&tid)+1, packet->dhcpv6_transaction_id, 3);
7324  data_string_sprintfa(&s, ", transaction ID 0x%06X", tid);
7325 
7326 /*
7327  oc = lookup_option(&dhcpv6_universe, packet->options,
7328  D6O_CLIENTID);
7329  if (oc != NULL) {
7330  memset(&tmp_ds, 0, sizeof(tmp_ds_));
7331  if (!evaluate_option_cache(&tmp_ds, packet, NULL, NULL,
7332  packet->options, NULL,
7333  &global_scope, oc, MDL)) {
7334  log_error("Error evaluating Client Identifier");
7335  } else {
7336  data_strint_sprintf(&s, ", client ID %s",
7337 
7338  data_string_forget(&tmp_ds, MDL);
7339  }
7340  }
7341 */
7342 
7343  }
7344  log_info("%s", s.data);
7345 
7346  data_string_forget(&s, MDL);
7347 }
7348 
7349 void
7350 dhcpv6(struct packet *packet) {
7351  struct data_string reply;
7352  struct sockaddr_in6 to_addr;
7353  int send_ret;
7354 
7355  /*
7356  * Log a message that we received this packet.
7357  */
7358  log_packet_in(packet);
7359 
7360  /*
7361  * Build our reply packet.
7362  */
7363  build_dhcpv6_reply(&reply, packet);
7364 
7365  if (reply.data != NULL) {
7366  /*
7367  * Send our reply, if we have one.
7368  */
7369  memset(&to_addr, 0, sizeof(to_addr));
7370  to_addr.sin6_family = AF_INET6;
7373  to_addr.sin6_port = local_port;
7374  } else {
7375  to_addr.sin6_port = remote_port;
7376  }
7377 
7378 #if defined (REPLY_TO_SOURCE_PORT)
7379  /*
7380  * This appears to have been included for testing so we would
7381  * not need a root client, but was accidently left in the
7382  * final code. We continue to include it in case
7383  * some users have come to rely upon it, but leave
7384  * it off by default as it's a bad idea.
7385  */
7386  to_addr.sin6_port = packet->client_port;
7387 #endif
7388 
7389  memcpy(&to_addr.sin6_addr, packet->client_addr.iabuf,
7390  sizeof(to_addr.sin6_addr));
7391 
7392  log_info("Sending %s to %s port %d",
7393  dhcpv6_type_names[reply.data[0]],
7395  ntohs(to_addr.sin6_port));
7396 
7397  send_ret = send_packet6(packet->interface,
7398  reply.data, reply.len, &to_addr);
7399  if (send_ret != reply.len) {
7400  log_error("dhcpv6: send_packet6() sent %d of %d bytes",
7401  send_ret, reply.len);
7402  }
7403  data_string_forget(&reply, MDL);
7404  }
7405 }
7406 
7407 #ifdef DHCP4o6
7408 /*
7409  * \brief Receive a DHCPv4-query message from the DHCPv6 side
7410  * (DHCPv4 server function)
7411  *
7412  * Receive a message with a DHCPv4-query inside from the DHCPv6 server.
7413  * (code copied from \ref do_packet6() \ref and dhcpv6())
7414  *
7415  * Format: interface:16 + address:16 + DHCPv6 DHCPv4-query message
7416  *
7417  * \param raw the DHCPv6 DHCPv4-query message raw content
7418  */
7419 static void recv_dhcpv4_query(struct data_string *raw) {
7420  struct interface_info *ip;
7421  char name[16 + 1];
7422  struct iaddr iaddr;
7423  struct packet *packet;
7424  unsigned char msg_type;
7425  const struct dhcpv6_relay_packet *relay;
7426  const struct dhcpv4_over_dhcpv6_packet *msg;
7427  struct data_string reply;
7428  struct data_string ds;
7429  unsigned len;
7430  int cc;
7431 
7432  memset(name, 0, sizeof(name));
7433  memcpy(name, raw->data, 16);
7434  for (ip = interfaces; ip != NULL; ip = ip->next) {
7435  if (!strcmp(name, ip->name))
7436  break;
7437  }
7438  if (ip == NULL) {
7439  log_error("recv_dhcpv4_query: can't find interface %s.",
7440  name);
7441  return;
7442  }
7443 
7444  iaddr.len = 16;
7445  memcpy(iaddr.iabuf, raw->data + 16, 16);
7446 
7447  /*
7448  * From do_packet6().
7449  */
7450 
7451  if (!packet6_len_okay((char *)raw->data + 32, raw->len - 32)) {
7452  log_error("recv_dhcpv4_query: "
7453  "short packet from %s, len %d, dropped",
7454  piaddr(iaddr), raw->len - 32);
7455  return;
7456  }
7457 
7458  /*
7459  * Build a packet structure.
7460  */
7461  packet = NULL;
7462  if (!packet_allocate(&packet, MDL)) {
7463  log_error("recv_dhcpv4_query: no memory for packet.");
7464  return;
7465  }
7466 
7468  log_error("recv_dhcpv4_query: no memory for options.");
7470  return;
7471  }
7472 
7473  packet->raw = (struct dhcp_packet *)(raw->data + 32);
7474  packet->packet_length = raw->len - 32;
7477  interface_reference(&packet->interface, ip, MDL);
7478 
7479  msg_type = raw->data[32];
7480  if ((msg_type == DHCPV6_RELAY_FORW) ||
7481  (msg_type == DHCPV6_RELAY_REPL)) {
7482  int relaylen =
7483  (int)(offsetof(struct dhcpv6_relay_packet, options));
7484  relay = (const struct dhcpv6_relay_packet *)(raw->data + 32);
7485  packet->dhcpv6_msg_type = relay->msg_type;
7486 
7487  /* relay-specific data */
7488  packet->dhcpv6_hop_count = relay->hop_count;
7489  memcpy(&packet->dhcpv6_link_address,
7490  relay->link_address, sizeof(relay->link_address));
7491  memcpy(&packet->dhcpv6_peer_address,
7492  relay->peer_address, sizeof(relay->peer_address));
7493 
7495  relay->options,
7496  raw->len - 32 - relaylen,
7497  &dhcpv6_universe)) {
7498  /* no logging here, as parse_option_buffer() logs all
7499  cases where it fails */
7501  return;
7502  }
7503  } else if ((msg_type == DHCPV6_DHCPV4_QUERY) ||
7505  int msglen =
7506  (int)(offsetof(struct dhcpv4_over_dhcpv6_packet, options));
7507  msg = (struct dhcpv4_over_dhcpv6_packet *)(raw->data + 32);
7509 
7510  /* message-specific data */
7511  memcpy(packet->dhcp4o6_flags, msg->flags,
7512  sizeof(packet->dhcp4o6_flags));
7513 
7515  msg->options,
7516  raw->len - 32 - msglen,
7517  &dhcpv6_universe)) {
7518  /* no logging here, as parse_option_buffer() logs all
7519  cases where it fails */
7521  return;
7522  }
7523  } else {
7524  log_error("recv_dhcpv4_query: unexpected message of type %d.",
7525  (int)msg_type);
7527  return;
7528  }
7529 
7530  /*
7531  * From dhcpv6().
7532  */
7533 
7534  /*
7535  * Log a message that we received this packet.
7536  */
7537  /* log_packet_in(packet); */
7538  memset(&ds, 0, sizeof(ds));
7540  data_string_sprintfa(&ds, "%s message from %s",
7543  } else {
7545  "Unknown message type %d from %s",
7548  }
7551  char tmp_addr[INET6_ADDRSTRLEN];
7552  const void *addr;
7553 
7554  addr = &packet->dhcpv6_link_address;
7555  data_string_sprintfa(&ds, ", link address %s",
7556  inet_ntop(AF_INET6, addr,
7557  tmp_addr, sizeof(tmp_addr)));
7558  addr = &packet->dhcpv6_peer_address;
7559  data_string_sprintfa(&ds, ", peer address %s",
7560  inet_ntop(AF_INET6, addr,
7561  tmp_addr, sizeof(tmp_addr)));
7562  } else if ((packet->dhcpv6_msg_type != DHCPV6_DHCPV4_QUERY) &&
7564  u_int32_t tid = 0;
7565 
7566  memcpy(((char *)&tid)+1, packet->dhcpv6_transaction_id, 3);
7567  data_string_sprintfa(&ds, ", transaction ID 0x%06X", tid);
7568  }
7569  log_info("%s", ds.data);
7570  data_string_forget(&ds, MDL);
7571 
7572  /*
7573  * Build our reply packet.
7574  */
7575  build_dhcpv6_reply(&reply, packet);
7576 
7578 
7579  if (reply.data == NULL)
7580  return;
7581 
7582  /*
7583  * Forward the response.
7584  */
7585  len = reply.len + 32;
7586  memset(&ds, 0, sizeof(ds));
7587  if (!buffer_allocate(&ds.buffer, len, MDL)) {
7588  log_error("recv_dhcpv4_query: no memory.");
7589  return;
7590  }
7591  ds.data = ds.buffer->data;
7592  ds.len = len;
7593 
7594  memcpy(ds.buffer->data, name, 16);
7595  memcpy(ds.buffer->data + 16, iaddr.iabuf, 16);
7596  memcpy(ds.buffer->data + 32, reply.data, reply.len);
7597  cc = send(dhcp4o6_fd, ds.data, ds.len, 0);
7598  if (cc < 0)
7599  log_error("recv_dhcpv4_query: send(): %m");
7600  data_string_forget(&ds, MDL);
7601 }
7602 #endif /* DHCP4o6 */
7603 
7604 static void
7605 seek_shared_host(struct host_decl **hp, struct shared_network *shared) {
7606  struct host_decl *nofixed = NULL;
7607  struct host_decl *seek, *hold = NULL;
7608 
7609  /*
7610  * Seek forward through fixed addresses for the right link.
7611  *
7612  * Note: how to do this for fixed prefixes???
7613  */
7614  host_reference(&hold, *hp, MDL);
7615  host_dereference(hp, MDL);
7616  seek = hold;
7617  while (seek != NULL) {
7618  if (seek->fixed_addr == NULL)
7619  nofixed = seek;
7620  else if (fixed_matches_shared(seek, shared))
7621  break;
7622 
7623  seek = seek->n_ipaddr;
7624  }
7625 
7626  if ((seek == NULL) && (nofixed != NULL))
7627  seek = nofixed;
7628 
7629  if (seek != NULL)
7630  host_reference(hp, seek, MDL);
7631 }
7632 
7633 static isc_boolean_t
7634 fixed_matches_shared(struct host_decl *host, struct shared_network *shared) {
7635  struct subnet *subnet;
7636  struct data_string addr;
7637  isc_boolean_t matched;
7638  struct iaddr fixed;
7639 
7640  if (host->fixed_addr == NULL)
7641  return ISC_FALSE;
7642 
7643  memset(&addr, 0, sizeof(addr));
7644  if (!evaluate_option_cache(&addr, NULL, NULL, NULL, NULL, NULL,
7645  &global_scope, host->fixed_addr, MDL))
7646  return ISC_FALSE;
7647 
7648  if (addr.len < 16) {
7649  data_string_forget(&addr, MDL);
7650  return ISC_FALSE;
7651  }
7652 
7653  fixed.len = 16;
7654  memcpy(fixed.iabuf, addr.data, 16);
7655 
7656  matched = ISC_FALSE;
7657  for (subnet = shared->subnets ; subnet != NULL ;
7658  subnet = subnet->next_sibling) {
7659  if (addr_eq(subnet_number(fixed, subnet->netmask),
7660  subnet->net)) {
7661  matched = ISC_TRUE;
7662  break;
7663  }
7664  }
7665 
7666  data_string_forget(&addr, MDL);
7667  return matched;
7668 }
7669 
7686 void
7687 unicast_reject(struct data_string *reply_ret,
7688  struct packet *packet,
7689  const struct data_string *client_id,
7690  const struct data_string *server_id)
7691 {
7692  struct reply_state reply;
7693  memset(&reply, 0x0, sizeof(struct reply_state));
7694 
7695  /* Locate the client. */
7696  if (shared_network_from_packet6(&reply.shared, packet)
7697  != ISC_R_SUCCESS) {
7698  log_error("unicast_reject: could not locate client.");
7699  return;
7700  }
7701 
7702  /* Initialize the reply. */
7703  packet_reference(&reply.packet, packet, MDL);
7704  data_string_copy(&reply.client_id, client_id, MDL);
7705 
7706  if (start_reply(packet, client_id, server_id, &reply.opt_state,
7707  &reply.buf.reply)) {
7708  /* Set the UseMulticast status code. */
7709  if (!set_status_code(STATUS_UseMulticast,
7710  "Unicast not allowed by server.",
7711  reply.opt_state)) {
7712  log_error("unicast_reject: Unable to set status code.");
7713  } else {
7714  /* Set write cursor to just past the reply header. */
7715  reply.cursor = REPLY_OPTIONS_INDEX;
7716  reply.cursor += store_options6(((char *)reply.buf.data
7717  + reply.cursor),
7718  (sizeof(reply.buf)
7719  - reply.cursor),
7720  reply.opt_state,
7721  reply.packet,
7722  unicast_reject_opts,
7723  NULL);
7724 
7725  /* Return our reply to the caller. */
7726  reply_ret->len = reply.cursor;
7727  reply_ret->buffer = NULL;
7728  if (!buffer_allocate(&reply_ret->buffer,
7729  reply.cursor, MDL)) {
7730  log_fatal("unicast_reject:"
7731  "No memory to store Reply.");
7732  }
7733 
7734  memcpy(reply_ret->buffer->data, reply.buf.data,
7735  reply.cursor);
7736  reply_ret->data = reply_ret->buffer->data;
7737  }
7738 
7739  }
7740 
7741  /* Cleanup. */
7742  if (reply.shared != NULL)
7743  shared_network_dereference(&reply.shared, MDL);
7744  if (reply.opt_state != NULL)
7745  option_state_dereference(&reply.opt_state, MDL);
7746  if (reply.packet != NULL)
7747  packet_dereference(&reply.packet, MDL);
7748  if (reply.client_id.data != NULL)
7749  data_string_forget(&reply.client_id, MDL);
7750 }
7751 
7770 isc_boolean_t
7771 is_unicast_option_defined(struct packet *packet) {
7772  isc_boolean_t is_defined = ISC_FALSE;
7773  struct option_state *opt_state = NULL;
7774  struct option_cache *oc = NULL;
7775  struct shared_network *shared = NULL;
7776 
7777  if (!option_state_allocate(&opt_state, MDL)) {
7778  log_fatal("is_unicast_option_defined:"
7779  "No memory for option state.");
7780  }
7781 
7782  /* We try to map the packet to a network first by an IA_XX value.
7783  * If that fails, we try by packet source. */
7784  if (((shared_network_from_requested_addr(&shared, packet)
7785  != ISC_R_SUCCESS) &&
7786  (shared_network_from_packet6(&shared, packet) != ISC_R_SUCCESS))
7787  || (shared == NULL)) {
7788  /* @todo what would this really mean? I think wrong network
7789  * logic will catch it */
7790  log_error("is_unicast_option_defined:"
7791  "cannot attribute packet to a network.");
7792  return (ISC_FALSE);
7793  }
7794 
7795  /* Now that we've mapped it to a network, execute statments to that
7796  * scope, looking for the unicast option. We don't care about the
7797  * value of the option, only whether or not it is defined. */
7798  execute_statements_in_scope(NULL, NULL, NULL, NULL, NULL, opt_state,
7799  &global_scope, shared->group, NULL, NULL);
7800 
7801  oc = lookup_option(&dhcpv6_universe, opt_state, D6O_UNICAST);
7802  is_defined = (oc != NULL ? ISC_TRUE : ISC_FALSE);
7803  log_debug("is_unicast_option_defined: option found : %d", is_defined);
7804 
7805  if (shared != NULL) {
7806  shared_network_dereference(&shared, MDL);
7807  }
7808 
7809  if (opt_state != NULL) {
7810  option_state_dereference(&opt_state, MDL);
7811  }
7812 
7813  return (is_defined);
7814 }
7815 
7831 static isc_result_t
7832 shared_network_from_requested_addr (struct shared_network **shared,
7833  struct packet* packet) {
7834  struct iaddr iaddr;
7835  struct subnet* subnet = NULL;
7836  isc_result_t status = ISC_R_FAILURE;
7837 
7838  /* Try to match first IA_ address or prefix we find to a subnet. In
7839  * theory all IA_ values in a given request are supposed to be in the
7840  * same subnet so we only need to try one right? */
7841  if ((get_first_ia_addr_val(packet, D6O_IA_NA, &iaddr) != ISC_R_SUCCESS)
7842  && (get_first_ia_addr_val(packet, D6O_IA_PD, &iaddr)
7843  != ISC_R_SUCCESS)
7844  && (get_first_ia_addr_val(packet, D6O_IA_TA, &iaddr)
7845  != ISC_R_SUCCESS)) {
7846  /* we found nothing to match against */
7847  log_debug("share_network_from_request_addr: nothing to match");
7848  return (ISC_R_FAILURE);
7849  }
7850 
7851  if (!find_subnet(&subnet, iaddr, MDL)) {
7852  log_debug("shared_network_from_requested_addr:"
7853  "No subnet found for addr %s.", piaddr(iaddr));
7854  } else {
7855  status = shared_network_reference(shared,
7857  subnet_dereference(&subnet, MDL);
7858  log_debug("shared_network_from_requested_addr:"
7859  " found shared network %s for address %s.",
7860  ((*shared)->name ? (*shared)->name : "unnamed"),
7861  piaddr(iaddr));
7862  return (status);
7863  }
7864 
7865  return (ISC_R_FAILURE);
7866 }
7867 
7886 static isc_result_t
7887 get_first_ia_addr_val (struct packet* packet, int addr_type,
7888  struct iaddr* iaddr) {
7889  struct option_cache *ia;
7890  struct option_cache *oc = NULL;
7891  struct data_string cli_enc_opt_data;
7892  struct option_state *cli_enc_opt_state;
7893  int addr_opt_offset;
7894  int addr_opt;
7895  int addr_opt_data_len;
7896  int ip_addr_offset;
7897 
7898  isc_result_t status = ISC_R_FAILURE;
7899  memset(iaddr, 0, sizeof(struct iaddr));
7900 
7901  /* Set up address type specifics */
7902  switch (addr_type) {
7903  case D6O_IA_NA:
7904  addr_opt_offset = IA_NA_OFFSET;
7905  addr_opt = D6O_IAADDR;
7906  addr_opt_data_len = 24;
7907  ip_addr_offset = 0;
7908  break;
7909  case D6O_IA_TA:
7910  addr_opt_offset = IA_TA_OFFSET;
7911  addr_opt = D6O_IAADDR;
7912  addr_opt_data_len = 24;
7913  ip_addr_offset = 0;
7914  break;
7915  case D6O_IA_PD:
7916  addr_opt_offset = IA_PD_OFFSET;
7917  addr_opt = D6O_IAPREFIX;
7918  addr_opt_data_len = 25;
7919  ip_addr_offset = 9;
7920  break;
7921  default:
7922  /* shouldn't be here */
7923  log_error ("get_first_ia_addr_val: invalid opt type %d",
7924  addr_type);
7925  return (ISC_R_FAILURE);
7926  }
7927 
7928  /* Find the first, non-blank IA_XX value within an D6O_IA_XX option. */
7929  for (ia = lookup_option(&dhcpv6_universe, packet->options, addr_type);
7930  ia != NULL && oc == NULL; ia = ia->next) {
7931  if (!get_encapsulated_IA_state(&cli_enc_opt_state,
7932  &cli_enc_opt_data,
7933  packet, ia, addr_opt_offset)) {
7934  log_debug ("get_first_ia_addr_val:"
7935  " couldn't unroll enclosing option");
7936  return (ISC_R_FAILURE);
7937  }
7938 
7939  oc = lookup_option(&dhcpv6_universe, cli_enc_opt_state,
7940  addr_opt);
7941  if (oc == NULL) {
7942  /* no address given for this IA, ignore */
7943  option_state_dereference(&cli_enc_opt_state, MDL);
7944  data_string_forget(&cli_enc_opt_data, MDL);
7945  }
7946  }
7947 
7948  /* If we found a non-blank IA_XX then extract its ip address. */
7949  if (oc != NULL) {
7950  struct data_string iaddr_str;
7951 
7952  memset(&iaddr_str, 0, sizeof(iaddr_str));
7953  if (!evaluate_option_cache(&iaddr_str, packet, NULL, NULL,
7954  packet->options, NULL, &global_scope,
7955  oc, MDL)) {
7956  log_error("get_first_ia_addr_val: "
7957  "error evaluating IA_XX option.");
7958  } else {
7959  if (iaddr_str.len != addr_opt_data_len) {
7960  log_error("shared_network_from_requested_addr:"
7961  " invalid length %d, expected %d",
7962  iaddr_str.len, addr_opt_data_len);
7963  } else {
7964  iaddr->len = 16;
7965  memcpy (iaddr->iabuf,
7966  iaddr_str.data + ip_addr_offset, 16);
7967  status = ISC_R_SUCCESS;
7968  }
7969  data_string_forget(&iaddr_str, MDL);
7970  }
7971 
7972  option_state_dereference(&cli_enc_opt_state, MDL);
7973  data_string_forget(&cli_enc_opt_data, MDL);
7974  }
7975 
7976  return (status);
7977 }
7978 
7979 /*
7980 * \brief Calculates the reply T1/T2 times and stuffs them in outbound buffer
7981 *
7982 * T1/T2 time selection is kind of weird. We actually use DHCP * (v4) scoped
7983 * options, dhcp-renewal-time and dhcp-rebinding-time, as handy existing places
7984 * where these can be configured by an administrator. A value of zero tells the
7985 * client it may choose its own value.
7986 *
7987 * When those options are not defined, the values will be set to zero unless
7988 * the global option, dhcpv6-set-tee-times is enabled. When this option is
7989 * enabled the values are calculated as recommended by RFC 3315, Section 22.4:
7990 *
7991 * T1 will be set to 0.5 times the shortest preferred lifetime
7992 * in the IA_XX option. If the "shortest" preferred lifetime is
7993 * 0xFFFFFFFF, T1 will set to 0xFFFFFFFF.
7994 *
7995 * T2 will be set to 0.8 times the shortest preferred lifetime
7996 * in the IA_XX option. If the "shortest" preferred lifetime is
7997 * 0xFFFFFFFF, T2 will set to 0xFFFFFFFF.
7998 *
7999 * Note that dhcpv6-set-tee-times is intended to be transitional and will
8000 * likely be removed in 4.4.0, leaving the behavior as getting the values
8001 * either from the configured parameters (if you want zeros, define them as
8002 * zeros) or by calculating them per the RFC.
8003 *
8004 * \param reply - pointer to the reply_state structure
8005 * \param ia_cursor - offset of the beginning of the IA_XX option within the
8006 * reply's outbound data buffer
8007 */
8008 static void
8009 set_reply_tee_times(struct reply_state* reply, unsigned ia_cursor)
8010 {
8011  struct option_cache *oc;
8012  int set_tee_times;
8013 
8014  /* Found out if calculated values are enabled. */
8015  oc = lookup_option(&server_universe, reply->opt_state,
8017  set_tee_times = (oc &&
8018  evaluate_boolean_option_cache(NULL, reply->packet,
8019  NULL, NULL,
8020  reply->packet->options,
8021  reply->opt_state,
8022  &global_scope, oc, MDL));
8023 
8024  oc = lookup_option(&dhcp_universe, reply->opt_state,
8026  if (oc != NULL) {
8027  /* dhcp-renewal-time is defined, use it */
8028  struct data_string data;
8029  memset(&data, 0x00, sizeof(data));
8030 
8031  if (!evaluate_option_cache(&data, reply->packet, NULL, NULL,
8032  reply->packet->options,
8033  reply->opt_state, &global_scope,
8034  oc, MDL) ||
8035  (data.len != 4)) {
8036  log_error("Invalid renewal time.");
8037  reply->renew = 0;
8038  } else {
8039  reply->renew = getULong(data.data);
8040  }
8041 
8042  if (data.data != NULL)
8044  } else if (set_tee_times) {
8045  /* Setting them is enabled so T1 is either infinite or
8046  * 0.5 * the shortest preferred lifetime in the IA_XX */
8047  if (reply->min_prefer == INFINITE_TIME)
8048  reply->renew = INFINITE_TIME;
8049  else
8050  reply->renew = reply->min_prefer / 2;
8051  } else {
8052  /* Default is to let the client choose */
8053  reply->renew = 0;
8054  }
8055 
8056  putULong(reply->buf.data + ia_cursor + 8, reply->renew);
8057 
8058  /* Now T2. */
8059  oc = lookup_option(&dhcp_universe, reply->opt_state,
8061  if (oc != NULL) {
8062  /* dhcp-rebinding-time is defined, use it */
8063  struct data_string data;
8064  memset(&data, 0x00, sizeof(data));
8065 
8066  if (!evaluate_option_cache(&data, reply->packet, NULL, NULL,
8067  reply->packet->options,
8068  reply->opt_state, &global_scope,
8069  oc, MDL) ||
8070  (data.len != 4)) {
8071  log_error("Invalid rebinding time.");
8072  reply->rebind = 0;
8073  } else {
8074  reply->rebind = getULong(data.data);
8075  }
8076 
8077  if (data.data != NULL)
8079  } else if (set_tee_times) {
8080  /* Setting them is enabled so T2 is either infinite or
8081  * 0.8 * the shortest preferred lifetime in the reply */
8082  if (reply->min_prefer == INFINITE_TIME)
8083  reply->rebind = INFINITE_TIME;
8084  else
8085  reply->rebind = (reply->min_prefer / 5) * 4;
8086  } else {
8087  /* Default is to let the client choose */
8088  reply->rebind = 0;
8089  }
8090 
8091  putULong(reply->buf.data + ia_cursor + 12, reply->rebind);
8092 }
8093 
8094 
8095 #endif /* DHCPv6 */
#define FTS_ABANDONED
Definition: dhcpd.h:538
struct iaddrcidrnet cidrnet
Definition: inet.h:77
ia_hash_t * ia_ta_active
#define DHCP_FIXED_NON_UDP
Definition: dhcp.h:37
isc_result_t renew_lease6(struct ipv6_pool *pool, struct iasubopt *lease)
Renew a lease in the pool.
Definition: mdb6.c:1448
struct ipv6_pond * next
Definition: dhcpd.h:1713
int find_grouped_subnet(struct subnet **, struct shared_network *, struct iaddr, const char *, int)
Definition: mdb.c:931
unsigned char peer_address[16]
Definition: dhcp6.h:241
const char int line
Definition: dhcpd.h:3725
#define D6O_IAADDR
Definition: dhcp6.h:34
struct binding_scope * global_scope
Definition: tree.c:38
#define STATUS_NoBinding
Definition: dhcp6.h:125
#define DHCPV6_RELEASE
Definition: dhcp6.h:145
struct subnet * subnets
Definition: dhcpd.h:1035
isc_result_t add_lease6(struct ipv6_pool *pool, struct iasubopt *lease, time_t valid_lifetime_end_time)
Definition: mdb6.c:1239
Definition: dhcpd.h:557
isc_result_t ia_make_key(struct data_string *key, u_int32_t iaid, const char *duid, unsigned int duid_len, const char *file, int line)
Definition: mdb6.c:311
unsigned len
Definition: tree.h:80
int executable_statement_dereference(struct executable_statement **ptr, const char *file, int line)
Definition: execute.c:623
isc_uint64_t num_active
Definition: dhcpd.h:1726
struct shared_network * shared_network
Definition: dhcpd.h:1352
int bits
Definition: inet.h:72
const char * piaddr(const struct iaddr addr)
Definition: inet.c:579
u_int8_t hlen
Definition: dhcpd.h:489
Definition: dhcpd.h:1647
#define D6O_STATUS_CODE
Definition: dhcp6.h:42
unsigned char dhcpv6_transaction_id[3]
Definition: dhcpd.h:414
char name[IFNAMSIZ]
Definition: dhcpd.h:1376
isc_boolean_t server_duid_isset(void)
unsigned char options[FLEXIBLE_ARRAY_MEMBER]
Definition: dhcp6.h:242
int units
Definition: dhcpd.h:1686
int prefix_length_mode
Definition: dhcpd.c:81
void dhcpv6_leasequery(struct data_string *, struct packet *)
isc_result_t ia_dereference(struct ia_xx **ia, const char *file, int line)
Definition: mdb6.c:403
#define PLM_EXACT
Definition: dhcpd.h:860
unsigned char msg_type
Definition: dhcp6.h:226
int data_string_sprintfa(struct data_string *ds, const char *fmt,...)
Definition: tree.c:56
Definition: dhcpd.h:1045
struct universe server_universe
Definition: stables.c:175
int execute_statements(struct binding_value **result, struct packet *packet, struct lease *lease, struct client_state *client_state, struct option_state *in_options, struct option_state *out_options, struct binding_scope **scope, struct executable_statement *statements, struct on_star *on_star)
Definition: execute.c:35
#define HTYPE_RESERVED
Definition: dhcp.h:84
#define MDL
Definition: omapip.h:568
isc_boolean_t lease6_usable(struct iasubopt *lease)
Check if address is available to a lease.
Definition: mdb6.c:1377
#define D6O_PREFERENCE
Definition: dhcp6.h:36
int find_hosts_by_option(struct host_decl **, struct packet *, struct option_state *, const char *, int)
Definition: mdb.c:638
unsigned char iabuf[16]
Definition: inet.h:33
#define print_hex_1(len, data, limit)
Definition: dhcpd.h:2577
#define IA_PD_OFFSET
Definition: dhcp6.h:173
u_int8_t hlen
Definition: dhcp.h:51
#define DHCP_R_INVALIDARG
Definition: result.h:49
#define STATUS_NoAddrsAvail
Definition: dhcp6.h:124
const char * dhcpv6_type_names[]
Definition: tables.c:656
int int int log_debug(const char *,...) __attribute__((__format__(__printf__
#define DHCPV6_REPLY
Definition: dhcp6.h:144
#define DHCPV6_REQUEST
Definition: dhcp6.h:140
int last_ipv6_pool
Definition: dhcpd.h:1723
unsigned char msg_type
Definition: dhcp6.h:250
#define DHCPV6_RECONFIGURE
Definition: dhcp6.h:147
#define IAADDR_OFFSET
Definition: dhcp6.h:176
#define SV_PREFER_LIFETIME
Definition: dhcpd.h:760
struct group * group
Definition: dhcpd.h:1039
#define D6O_RAPID_COMMIT
Definition: dhcp6.h:43
#define PLM_PREFER
Definition: dhcpd.h:859
struct universe dhcp_universe
int dhcpv4_over_dhcpv6
Definition: discover.c:47
#define D6O_SERVERID
Definition: dhcp6.h:31
#define STATUS_NotOnLink
Definition: dhcp6.h:126
void data_string_forget(struct data_string *data, const char *file, int line)
Definition: alloc.c:1339
struct option_cache * next
Definition: dhcpd.h:387
void bootp(struct packet *packet)
Definition: dhclient.c:2027
struct shared_network * shared_network
Definition: dhcpd.h:1715
#define D6O_INTERFACE_ID
Definition: dhcp6.h:47
struct option_cache * fixed_addr
Definition: dhcpd.h:956
struct group * root_group
Definition: memory.c:31
unsigned char msg_type
Definition: dhcp6.h:238
#define DUID_LL
Definition: dhcp6.h:167
void delete_option(struct universe *universe, struct option_state *options, int code)
Definition: options.c:2851
u_int32_t valid
Definition: dhcpd.h:1622
int log_error(const char *,...) __attribute__((__format__(__printf__
time_t cltt
Definition: dhcpd.h:1653
#define FTS_EXPIRED
Definition: dhcpd.h:536
struct on_star on_star
Definition: dhcpd.h:1644
int known
Definition: dhcpd.h:457
struct binding_scope * scope
Definition: dhcpd.h:1618
struct ipv6_pond * ipv6_pond
Definition: dhcpd.h:1697
void copy_server_duid(struct data_string *ds, const char *file, int line)
#define DHO_DHCP_REBINDING_TIME
Definition: dhcp.h:151
#define STATUS_Success
Definition: dhcp6.h:122
unsigned len
Definition: inet.h:32
#define IA_NA_OFFSET
Definition: dhcp6.h:171
#define DHCPV6_DHCPV4_QUERY
Definition: dhcp6.h:157
#define D6O_DHCPV4_MSG
Definition: dhcp6.h:116
unsigned char flags[3]
Definition: dhcp6.h:251
int logged
Definition: dhcpd.h:1728
#define D6O_CLIENTID
Definition: dhcp6.h:30
struct permit * prohibit_list
Definition: dhcpd.h:1718
Definition: dhcpd.h:550
struct option_state * options
Definition: dhcpd.h:449
unsigned char dhcpv6_hop_count
Definition: dhcpd.h:417
unsigned char link_address[16]
Definition: dhcp6.h:240
#define INFINITE_TIME
Definition: dhcpd.h:1597
unsigned char dhcpv6_msg_type
Definition: dhcpd.h:411
isc_boolean_t lease6_exists(const struct ipv6_pool *pool, const struct in6_addr *addr)
Definition: mdb6.c:1349
void log_fatal(const char *,...) __attribute__((__format__(__printf__
#define DHCPV6_RELAY_REPL
Definition: dhcp6.h:150
int client_port
Definition: dhcpd.h:431
#define DHCPV6_LEASEQUERY
Definition: dhcp6.h:151
#define D6O_IA_TA
Definition: dhcp6.h:33
int parse_option_buffer(struct option_state *options, const unsigned char *buffer, unsigned length, struct universe *universe)
Definition: options.c:117
#define PLM_MINIMUM
Definition: dhcpd.h:861
#define SV_LOG_THRESHOLD_HIGH
Definition: dhcpd.h:800
#define D6O_UNICAST
Definition: dhcp6.h:41
struct dhcp_packet * raw
Definition: dhcpd.h:406
isc_result_t decline_lease6(struct ipv6_pool *pool, struct iasubopt *lease)
Definition: mdb6.c:1599
int find_hosts6(struct host_decl **host, struct packet *packet, const struct data_string *client_id, char *file, int line)
Definition: mdb6.c:2773
struct iaddr subnet_number(struct iaddr addr, struct iaddr mask)
Definition: inet.c:34
#define SV_DDNS_UPDATES
Definition: dhcpd.h:737
int find_subnet(struct subnet **sp, struct iaddr addr, const char *file, int line)
Definition: dhclient.c:1447
#define D6O_IAPREFIX
Definition: dhcp6.h:55
void execute_statements_in_scope(struct binding_value **result, struct packet *packet, struct lease *lease, struct client_state *client_state, struct option_state *in_options, struct option_state *out_options, struct binding_scope **scope, struct group *group, struct group *limiting_group, struct on_star *on_star)
Definition: execute.c:563
void change_host_uid(struct host_decl *host, const char *data, int len)
Definition: mdb.c:184
isc_result_t release_lease6(struct ipv6_pool *pool, struct iasubopt *lease)
Definition: mdb6.c:1624
void schedule_lease_timeout(struct ipv6_pool *pool)
Definition: mdb6.c:1988
#define DUID_TIME_EPOCH
Definition: dhcp6.h:273
int option_state_allocate(struct option_state **ptr, const char *file, int line)
Definition: alloc.c:846
time_t hard_lifetime_end_time
Definition: dhcpd.h:1619
int evaluate_option_cache(struct data_string *result, struct packet *packet, struct lease *lease, struct client_state *client_state, struct option_state *in_options, struct option_state *cfg_options, struct binding_scope **scope, struct option_cache *oc, const char *file, int line)
Definition: tree.c:2699
#define STATUS_NoPrefixAvail
Definition: dhcp6.h:128
#define DHCPV6_DHCPV4_RESPONSE
Definition: dhcp6.h:158
unsigned char chaddr[16]
Definition: dhcp.h:60
int packet_reference(struct packet **ptr, struct packet *bp, const char *file, int line)
Definition: alloc.c:1053
Definition: dhcpd.h:999
#define DHCPV6_RENEW
Definition: dhcp6.h:142
int options_valid
Definition: dhcpd.h:430
ia_hash_t * ia_na_active
struct ipv6_pool * ipv6_pool
Definition: dhcpd.h:1624
struct iaddr net
Definition: dhcpd.h:1052
int buffer_allocate(struct buffer **ptr, unsigned len, const char *file, int line)
Definition: alloc.c:679
struct interface_info * interface
Definition: dhcpd.h:433
#define PLM_IGNORE
Definition: dhcpd.h:858
ssize_t send_packet6(struct interface_info *, const unsigned char *, size_t, struct sockaddr_in6 *)
#define PLM_MAXIMUM
Definition: dhcpd.h:862
void putULong(unsigned char *, u_int32_t)
Definition: convert.c:70
#define DHCPV6_REBIND
Definition: dhcp6.h:143
u_int16_t local_port
Definition: dhclient.c:92
Definition: dhcpd.h:405
struct iaddrcidrnetlist * next
Definition: inet.h:76
#define DEFAULT_DEFAULT_LEASE_TIME
Definition: dhcpd.h:832
u_int8_t plen
Definition: dhcpd.h:1616
#define cur_time
Definition: dhcpd.h:2079
Definition: ip.h:47
#define DHCPV6_RELAY_FORW
Definition: dhcp6.h:149
int save_option_buffer(struct universe *universe, struct option_state *options, struct buffer *bp, unsigned char *buffer, unsigned length, unsigned code, int terminatep)
Definition: options.c:2490
u_int32_t getUShort(const unsigned char *)
#define D6O_ERO
Definition: dhcp6.h:72
void set_server_duid(struct data_string *new_duid)
isc_result_t create_lease6(struct ipv6_pool *pool, struct iasubopt **addr, unsigned int *attempts, const struct data_string *uid, time_t soft_lifetime_end_time)
Definition: mdb6.c:958
struct host_decl * n_ipaddr
Definition: dhcpd.h:946
#define SV_DHCPV6_SET_TEE_TIMES
Definition: dhcpd.h:804
int jumbo_range
Definition: dhcpd.h:1730
struct hardware hw_address
Definition: dhcpd.h:1354
int packet_type
Definition: dhcpd.h:409
struct option_cache * lookup_option(struct universe *universe, struct option_state *options, unsigned code)
Definition: options.c:2448
#define IA_TA_OFFSET
Definition: dhcp6.h:172
#define print_hex_3(len, data, limit)
Definition: dhcpd.h:2579
int permitted(struct packet *, struct permit *)
Definition: dhcp.c:5023
void set_server_duid_type(int type)
int num_iasubopt
Definition: dhcpd.h:1651
int int log_info(const char *,...) __attribute__((__format__(__printf__
struct ipv6_pool ** ipv6_pools
Definition: dhcpd.h:1722
binding_state_t state
Definition: dhcpd.h:1617
int packet6_len_okay(const char *packet, int len)
Definition: options.c:4082
int parse_options(struct packet *packet)
Definition: options.c:47
struct interface_info * interfaces
Definition: discover.c:42
unsigned char dhcp4o6_flags[3]
Definition: dhcpd.h:425
u_int32_t getULong(const unsigned char *)
struct shared_network * shared_network
Definition: dhcpd.h:1049
int validate_packet(struct packet *packet)
Definition: options.c:4435
int addr_eq(struct iaddr addr1, struct iaddr addr2)
Definition: inet.c:166
struct group * group
Definition: dhcpd.h:1055
isc_boolean_t ipv6_in_pool(const struct in6_addr *addr, const struct ipv6_pool *pool)
Definition: mdb6.c:2096
void cleanup(void)
#define DHCPV6_LEASEQUERY_REPLY
Definition: dhcp6.h:152
TIME cltt
Definition: dhcpd.h:637
isc_result_t get_client_id(struct packet *, struct data_string *)
#define IAPREFIX_OFFSET
Definition: dhcp6.h:179
Definition: inet.h:31
ipv6_pool structure
Definition: dhcpd.h:1681
#define DHCP4O6_QUERY_UNICAST
Definition: dhcp6.h:254
int store_options6(char *buf, int buflen, struct option_state *opt_state, struct packet *packet, const int *required_opts, struct data_string *oro)
Definition: options.c:1029
int local_family
Definition: discover.c:55
int append_option_buffer(struct universe *universe, struct option_state *options, struct buffer *bp, unsigned char *buffer, unsigned length, unsigned code, int terminatep)
Definition: options.c:2514
#define FIND_POND6_PERCENT(count, percent)
Definition: dhcpd.h:3837
u_int32_t getUChar(const unsigned char *)
struct data_string * dhcp4o6_response
Definition: dhcpd.h:428
struct iaddrcidrnetlist * fixed_prefix
Definition: dhcpd.h:957
int option_state_dereference(struct option_state **ptr, const char *file, int line)
Definition: alloc.c:911
ia_hash_t * ia_pd_active
Definition: dhcpd.h:932
void dhcpv6(struct packet *)
int commit_leases_timed(void)
Definition: db.c:1043
const int dhcpv6_type_name_max
Definition: tables.c:680
isc_boolean_t is_cidr_mask_valid(const struct iaddr *addr, int bits)
Definition: inet.c:303
unsigned char hop_count
Definition: dhcp6.h:239
isc_uint64_t low_threshold
Definition: dhcpd.h:1729
struct interface_info * next
Definition: dhcpd.h:1351
struct universe dhcpv6_universe
Definition: tables.c:343
isc_boolean_t prefix6_exists(const struct ipv6_pool *pool, const struct in6_addr *pref, u_int8_t plen)
Definition: mdb6.c:1806
int evaluate_boolean_option_cache(int *ignorep, struct packet *packet, struct lease *lease, struct client_state *client_state, struct option_state *in_options, struct option_state *cfg_options, struct binding_scope **scope, struct option_cache *oc, const char *file, int line)
Definition: tree.c:2733
#define D6O_IA_NA
Definition: dhcp6.h:32
#define print_hex_2(len, data, limit)
Definition: dhcpd.h:2578
int packet_dereference(struct packet **ptr, const char *file, int line)
Definition: alloc.c:1081
int ddns_updates(struct packet *, struct lease *, struct lease *, struct iasubopt *, struct iasubopt *, struct option_state *)
int packet_allocate(struct packet **ptr, const char *file, int line)
Definition: alloc.c:1015
const char int
Definition: omapip.h:443
struct iaddr netmask
Definition: dhcpd.h:1053
isc_result_t iasubopt_dereference(struct iasubopt **iasubopt, const char *file, int line)
Definition: mdb6.c:261
#define DHCPV6_ADVERTISE
Definition: dhcp6.h:139
#define SV_LOG_THRESHOLD_LOW
Definition: dhcpd.h:799
isc_uint64_t num_abandoned
Definition: dhcpd.h:1727
isc_result_t set_server_duid_from_option(void)
isc_result_t ia_allocate(struct ia_xx **ia, u_int32_t iaid, const char *duid, unsigned int duid_len, const char *file, int line)
Definition: mdb6.c:339
#define D6O_ORO
Definition: dhcp6.h:35
struct subnet * next_sibling
Definition: dhcpd.h:1048
isc_boolean_t unicast
Definition: dhcpd.h:470
isc_result_t ia_add_iasubopt(struct ia_xx *ia, struct iasubopt *iasubopt, const char *file, int line)
Definition: mdb6.c:439
unsigned char data[1]
Definition: tree.h:63
unsigned char transaction_id[3]
Definition: dhcp6.h:227
time_t soft_lifetime_end_time
Definition: dhcpd.h:1620
struct iaddr lo_addr
Definition: inet.h:71
#define SV_DEFAULT_LEASE_TIME
Definition: dhcpd.h:708
u_int8_t hbuf[HARDWARE_ADDR_LEN+1]
Definition: dhcpd.h:490
#define MAX_TIME
Definition: dhcpd.h:1598
#define DHCPV6_CONFIRM
Definition: dhcp6.h:141
struct iaddr client_addr
Definition: dhcpd.h:432
ipv6_pond structure
Definition: dhcpd.h:1711
isc_uint64_t num_total
Definition: dhcpd.h:1725
#define D6O_IA_PD
Definition: dhcp6.h:54
#define REPLY_OPTIONS_INDEX
Definition: dhcp6.h:232
#define DUID_LLT
Definition: dhcp6.h:165
void dhcp(struct packet *packet)
Definition: dhclient.c:2060
struct iasubopt ** iasubopt
Definition: dhcpd.h:1654
int write_ia(const struct ia_xx *)
Definition: db.c:518
struct ia_xx * ia
Definition: dhcpd.h:1623
u_int16_t remote_port
Definition: dhclient.c:93
#define DHO_DHCP_RENEWAL_TIME
Definition: dhcp.h:150
struct in6_addr dhcpv6_peer_address
Definition: dhcpd.h:419
const char * file
Definition: dhcpd.h:3725
char * name
Definition: dhcpd.h:1030
void putUShort(unsigned char *, u_int32_t)
Definition: convert.c:86
isc_result_t create_prefix6(struct ipv6_pool *pool, struct iasubopt **pref, unsigned int *attempts, const struct data_string *uid, time_t soft_lifetime_end_time)
Definition: mdb6.c:1717
struct shared_network * shared_network
Definition: dhcpd.h:1694
struct in6_addr addr
Definition: dhcpd.h:1615
isc_result_t ia_reference(struct ia_xx **ia, struct ia_xx *src, const char *file, int line)
Definition: mdb6.c:377
struct executable_statement * on_commit
Definition: dhcpd.h:552
#define SV_LIMIT_ADDRS_PER_IA
Definition: dhcpd.h:763
unsigned char options[FLEXIBLE_ARRAY_MEMBER]
Definition: dhcp6.h:252
const unsigned char * data
Definition: tree.h:79
#define DHO_DHCP_MESSAGE_TYPE
Definition: dhcp.h:145
int get_option_int(int *result, struct universe *universe, struct packet *packet, struct lease *lease, struct client_state *client_state, struct option_state *in_options, struct option_state *cfg_options, struct option_state *options, struct binding_scope **scope, unsigned code, const char *file, int line)
Definition: options.c:2303
isc_result_t generate_new_server_duid(void)
struct binding_scope * scope
Definition: dhcpd.h:572
void data_string_copy(struct data_string *dest, const struct data_string *src, const char *file, int line)
Definition: alloc.c:1323
unsigned packet_length
Definition: dhcpd.h:408
#define D6O_RELAY_MSG
Definition: dhcp6.h:38
struct permit * permit_list
Definition: dhcpd.h:1717
#define D6O_RECONF_ACCEPT
Definition: dhcp6.h:49
u_int16_t pool_type
Definition: dhcpd.h:1683
#define DHCPV6_INFORMATION_REQUEST
Definition: dhcp6.h:148
#define DHCPV6_DECLINE
Definition: dhcp6.h:146
struct in6_addr dhcpv6_link_address
Definition: dhcpd.h:418
unsigned char options[FLEXIBLE_ARRAY_MEMBER]
Definition: dhcp6.h:228
void classify_client(struct packet *)
Definition: class.c:63
struct group * group
Definition: dhcpd.h:1714
#define DHCPV6_SOLICIT
Definition: dhcp6.h:138
struct buffer * buffer
Definition: tree.h:78
#define SV_LIMIT_PREFS_PER_IA
Definition: dhcpd.h:764
unsigned char options[DHCP_MAX_OPTION_LEN]
Definition: dhcp.h:63
#define STATUS_UseMulticast
Definition: dhcp6.h:127
struct packet * dhcpv6_container_packet
Definition: dhcpd.h:422
#define FTS_ACTIVE
Definition: dhcpd.h:535
isc_result_t iasubopt_reference(struct iasubopt **iasubopt, struct iasubopt *src, const char *file, int line)
Definition: mdb6.c:234