Adding upstream version 3.2.3+dfsg.upstream/3.2.3+dfsg

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 866 insertions, 0 deletions

diff --git a/src/modules/proto_dhcp/dhcpd.c b/src/modules/proto_dhcp/dhcpd.c
new file mode 100644
index 0000000..bc51c36
--- /dev/null
+++ b/src/modules/proto_dhcp/dhcpd.c
@@ -0,0 +1,866 @@
+/*
+ * dhcp.c	DHCP processing.
+ *
+ * Version:	$Id$
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Copyright 2008 The FreeRADIUS server project
+ * Copyright 2008,2011 Alan DeKok <aland@deployingradius.com>
+ */
+
+/*
+ * Standard sequence:
+ *	INADDR_ANY : 68 -> INADDR_BROADCAST : 67	DISCOVER
+ *	CLIENT_IP : 68 <- DHCP_SERVER_IP : 67		OFFER
+ *	INADDR_ANY : 68 -> INADDR_BROADCAST : 67	REQUEST
+ *	CLIENT_IP : 68 <- DHCP_SERVER_IP : 67		ACK
+ *
+ * Relay sequence:
+ *	INADDR_ANY : 68 -> INADDR_BROADCAST : 67	DISCOVER
+ *	RELAY_IP : 67 -> NEXT_SERVER_IP : 67		DISCOVER
+ *				(NEXT_SERVER_IP can be a relay itself)
+ *	FIRST_RELAY_IP : 67 <- DHCP_SERVER_IP : 67	OFFER
+ *	CLIENT_IP : 68 <- FIRST_RELAY_IP : 67		OFFER
+ *	INADDR_ANY : 68 -> INADDR_BROADCAST : 67	REQUEST
+ *	RELAY_IP : 67 -> NEXT_SERVER_IP : 67		REQUEST
+ *				(NEXT_SERVER_IP can be a relay itself)
+ *	FIRST_RELAY_IP : 67 <- DHCP_SERVER_IP : 67	ACK
+ *	CLIENT_IP : 68 <- FIRST_RELAY_IP : 67		ACK
+ *
+ * Note: NACK are broadcasted, rest is unicast, unless client asked
+ * for a broadcast
+ */
+
+
+#include <freeradius-devel/radiusd.h>
+#include <freeradius-devel/modules.h>
+#include <freeradius-devel/protocol.h>
+#include <freeradius-devel/process.h>
+#include <freeradius-devel/dhcp.h>
+#include <freeradius-devel/rad_assert.h>
+
+#ifndef __MINGW32__
+#include <sys/ioctl.h>
+#endif
+
+/*
+ *	Same contents as listen_socket_t.
+ */
+typedef struct dhcp_socket_t {
+	listen_socket_t	lsock;
+
+	/*
+	 *	DHCP-specific additions.
+	 */
+	bool		suppress_responses;
+	RADCLIENT	dhcp_client;
+	char const	*src_interface;
+	fr_ipaddr_t     src_ipaddr;
+} dhcp_socket_t;
+
+#ifdef WITH_UDPFROMTO
+static int dhcprelay_process_client_request(REQUEST *request)
+{
+	int rcode;
+	uint8_t maxhops = 16;
+	VALUE_PAIR *vp, *giaddr;
+	dhcp_socket_t *sock;
+	RADIUS_PACKET *packet;
+
+	rad_assert(request->packet->data[0] == 1);
+
+	/*
+	 *	Do the forward by ourselves, do not rely on dhcp_socket_send()
+	 */
+	request->reply->code = 0;
+
+	/*
+	 * It's invalid to have giaddr=0 AND a relay option
+	 */
+	giaddr = fr_pair_find_by_num(request->packet->vps, 266, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Gateway-IP-Address */
+	if (giaddr && (giaddr->vp_ipaddr == htonl(INADDR_ANY)) &&
+	    fr_pair_find_by_num(request->packet->vps, 82, DHCP_MAGIC_VENDOR, TAG_ANY)) { /* DHCP-Relay-Agent-Information */
+		DEBUG("DHCP: Received packet with giaddr = 0 and containing relay option: Discarding packet\n");
+		return 1;
+	}
+
+	/*
+	 * RFC 1542 (BOOTP), page 15
+	 *
+	 * Drop requests if hop-count > 16 or admin specified another value
+	 */
+	if ((vp = fr_pair_find_by_num(request->config, 271, DHCP_MAGIC_VENDOR, TAG_ANY))) { /* DHCP-Relay-Max-Hop-Count */
+	    maxhops = vp->vp_integer;
+	}
+	vp = fr_pair_find_by_num(request->packet->vps, 259, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Hop-Count */
+	rad_assert(vp != NULL);
+	if (vp->vp_byte > maxhops) {
+		DEBUG("DHCP: Number of hops is greater than %d: not relaying\n", maxhops);
+		return 1;
+	} else {
+		/* Increment hop count */
+		vp->vp_byte++;
+	}
+
+	sock = request->listener->data;
+
+	/*
+	 *	Don't muck with the original request packet.  That's
+	 *	bad form.  Plus, dhcp_encode() does nothing if
+	 *	packet->data is already set.
+	 */
+	packet = rad_alloc(request, false);
+
+	/*
+	 *	Forward the request to the next server using the
+	 *	incoming request as a template.
+	 */
+	packet->code = request->packet->code;
+	packet->sockfd = request->packet->sockfd;
+
+	/*
+	 *	Forward the request to the next server using the
+	 *	incoming request as a template.
+	 */
+	/* set SRC ipaddr/port to the listener ipaddr/port */
+	packet->src_ipaddr.af = AF_INET;
+	packet->src_ipaddr.ipaddr.ip4addr.s_addr = sock->lsock.my_ipaddr.ipaddr.ip4addr.s_addr;
+	packet->src_port = sock->lsock.my_port;
+
+	vp = fr_pair_find_by_num(request->config, 270, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Relay-To-IP-Address */
+	rad_assert(vp != NULL);
+
+	/* set DEST ipaddr/port to the next server ipaddr/port */
+	packet->dst_ipaddr.af = AF_INET;
+	packet->dst_ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
+	packet->dst_port = sock->lsock.my_port;
+
+	packet->vps = request->packet->vps; /* hackity hack */
+
+	if (fr_dhcp_encode(packet) < 0) {
+		packet->vps = NULL;
+		talloc_free(packet);
+		DEBUG("dhcprelay_process_client_request: ERROR in fr_dhcp_encode\n");
+		return -1;
+	}
+
+	rcode = fr_dhcp_send(packet);
+	packet->vps = NULL;
+	talloc_free(packet);
+
+	return rcode;
+}
+
+
+/*
+ *	We've seen a reply from a server.
+ *	i.e. we're a relay.
+ */
+static int dhcprelay_process_server_reply(REQUEST *request)
+{
+	int rcode;
+	VALUE_PAIR *vp, *giaddr;
+	dhcp_socket_t *sock;
+	RADIUS_PACKET *packet;
+
+	rad_assert(request->packet->data[0] == 2);
+
+	/*
+	 * Do the forward by ourselves, do not rely on dhcp_socket_send()
+	 */
+	request->reply->code = 0;
+
+	sock = request->listener->data;
+
+	/*
+	 * Check that packet is for us.
+	 */
+	giaddr = fr_pair_find_by_num(request->packet->vps, 266, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Gateway-IP-Address */
+
+	/* --with-udpfromto is needed just for the following test */
+	if (!giaddr || giaddr->vp_ipaddr != request->packet->dst_ipaddr.ipaddr.ip4addr.s_addr) {
+		DEBUG("DHCP: Packet received from server was not for us (was for 0x%x). Discarding packet",
+		    ntohl(request->packet->dst_ipaddr.ipaddr.ip4addr.s_addr));
+		return 1;
+	}
+
+	/*
+	 *	Don't muck with the original request packet.  That's
+	 *	bad form.  Plus, dhcp_encode() does nothing if
+	 *	packet->data is already set.
+	 */
+	packet = rad_alloc(request, false);
+	rcode = -1;
+
+	/*
+	 *	Forward the request to the next server using the
+	 *	incoming request as a template.
+	 */
+	packet->code = request->packet->code;
+	packet->sockfd = request->packet->sockfd;
+
+	/* set SRC ipaddr/port to the listener ipaddr/port */
+	packet->src_ipaddr.af = AF_INET;
+	packet->src_port = sock->lsock.my_port;
+
+	/* set DEST ipaddr/port to clientip/68 or broadcast in specific cases */
+	packet->dst_ipaddr.af = AF_INET;
+
+	/*
+	 *	We're a relay, figure out where to send the packet.
+	 */
+	packet->dst_ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_BROADCAST);
+	packet->dst_port = request->packet->dst_port;		/* server port */
+
+	/*
+	  *	Unicast the response to another relay if requested.
+	  */
+	vp = fr_pair_find_by_num(request->config, 270, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Relay-To-IP-Address */
+	if (vp) {
+		RDEBUG("DHCP: response will be relayed to previous gateway");
+		packet->dst_ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
+		giaddr->vp_ipaddr = vp->vp_ipaddr;
+
+	} else if ((packet->code == PW_DHCP_NAK) ||
+	    !sock->src_interface ||
+	    ((vp = fr_pair_find_by_num(request->packet->vps, 262, DHCP_MAGIC_VENDOR, TAG_ANY)) /* DHCP-Flags */ &&
+	     (vp->vp_integer & 0x8000) &&
+	     ((vp = fr_pair_find_by_num(request->packet->vps, 263, DHCP_MAGIC_VENDOR, TAG_ANY)) /* DHCP-Client-IP-Address */ &&
+	      (vp->vp_ipaddr == htonl(INADDR_ANY))))) {
+		/*
+		 * RFC 2131, page 23
+		 *
+		 * Broadcast on
+		 * - DHCPNAK
+		 * or
+		 * - Broadcast flag is set up and ciaddr == NULL
+		 */
+		RDEBUG("DHCP: response will be broadcast");
+		packet->dst_ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_BROADCAST);
+
+	} else if ((vp = fr_pair_find_by_num(request->packet->vps, 263, DHCP_MAGIC_VENDOR, TAG_ANY)) /* DHCP-Client-IP-Address */ &&
+		   (vp->vp_ipaddr != htonl(INADDR_ANY))) {
+		/*
+		 * RFC 2131, page 23
+		 *
+		 * Unicast to
+		 * - ciaddr if present
+		 * otherwise to yiaddr
+		 */
+		packet->dst_ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
+	} else {
+		vp = fr_pair_find_by_num(request->packet->vps, 264, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Your-IP-Address */
+		if (!vp) {
+			DEBUG("DHCP: Failed to find IP Address for request");
+			goto error;
+		}
+
+		RDEBUG("DHCP: response will be unicast to your-ip-address");
+		packet->dst_ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
+
+		/*
+		 * When sending a DHCP_OFFER, make sure our ARP table
+		 * contains an entry for the client IP address, or else
+		 * packet may not be forwarded if it was the first time
+		 * the client was requesting an IP address.
+		 */
+		if (packet->code == PW_DHCP_OFFER) {
+			VALUE_PAIR *hwvp = fr_pair_find_by_num(request->packet->vps, 267, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Client-Hardware-Address */
+			if (hwvp == NULL) {
+				DEBUG("DHCP: DHCP_OFFER packet received with "
+				      "no Client Hardware Address. Discarding packet");
+				goto error;
+			}
+			if (fr_dhcp_add_arp_entry(packet->sockfd, sock->src_interface, hwvp, vp) < 0) {
+				DEBUG("Failed adding ARP entry: %s", fr_strerror());
+				goto error;
+			}
+		}
+	}
+
+	packet->vps = request->packet->vps; /* hackity hack */
+	
+	if (fr_dhcp_encode(packet) < 0) {
+		DEBUG("dhcprelay_process_server_reply: ERROR in fr_dhcp_encode\n");
+		goto error;
+	}
+
+	rcode = fr_dhcp_send(packet);
+
+error:
+	packet->vps = NULL;
+	talloc_free(packet);
+	return rcode;
+}
+#else  /* WITH_UDPFROMTO */
+static int dhcprelay_process_server_reply(UNUSED REQUEST *request)
+{
+	WARN("DHCP Relaying requires the server to be configured with UDPFROMTO");
+	return -1;
+}
+
+static int dhcprelay_process_client_request(UNUSED REQUEST *request)
+{
+	WARN("DHCP Relaying requires the server to be configured with UDPFROMTO");
+	return -1;
+}
+
+#endif	/* WITH_UDPFROMTO */
+
+static const uint32_t attrnums[] = {
+	57,	/* DHCP-DHCP-Maximum-Msg-Size */
+	256,	/* DHCP-Opcode */
+	257,	/* DHCP-Hardware-Type */
+	258,	/* DHCP-Hardware-Address-Length */
+	259,	/* DHCP-Hop-Count */
+	260,	/* DHCP-Transaction-Id */
+	262,	/* DHCP-Flags */
+	263,	/* DHCP-Client-IP-Address */
+	266,	/* DHCP-Gateway-IP-Address */
+	267	/* DHCP-Client-Hardware-Address */
+};
+
+static int dhcp_process(REQUEST *request)
+{
+	int rcode;
+	unsigned int i;
+	VALUE_PAIR *vp;
+	dhcp_socket_t *sock;
+
+	/*
+	 *	If there's a giaddr, save it as the Relay-IP-Address
+	 *	in the response.  That way the later code knows where
+	 *	to send the reply.
+	 */
+	vp = fr_pair_find_by_num(request->packet->vps, 266, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Gateway-IP-Address */
+	if (vp && (vp->vp_ipaddr != htonl(INADDR_ANY))) {
+		VALUE_PAIR *relay;
+
+		/* DHCP-Relay-IP-Address */
+		relay = radius_pair_create(request->reply, &request->reply->vps,
+					  272, DHCP_MAGIC_VENDOR);
+		if (relay) relay->vp_ipaddr = vp->vp_ipaddr;
+	}
+
+	/*
+	 *	RFC 6842: If there's a DHCP-Client-Identifier ("uid") in the
+	 *	request then echo this in the reply.
+	 */
+	vp = fr_pair_find_by_num(request->packet->vps, 61, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Client-Identifier */
+	if (vp && !fr_pair_find_by_num(request->reply->vps, 61, DHCP_MAGIC_VENDOR, TAG_ANY)) {
+		fr_pair_add(&request->reply->vps, fr_pair_copy(request->reply, vp));
+	}
+
+	vp = fr_pair_find_by_num(request->packet->vps, 53, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Message-Type */
+	if (vp) {
+		DICT_VALUE *dv = dict_valbyattr(53, DHCP_MAGIC_VENDOR, vp->vp_byte);
+		DEBUG("Trying sub-section dhcp %s {...}",
+		      dv ? dv->name : "<unknown>");
+		rcode = process_post_auth(vp->vp_byte, request);
+	} else {
+		DEBUG("DHCP: Failed to find DHCP-Message-Type in packet!");
+		rcode = RLM_MODULE_FAIL;
+	}
+
+	vp = fr_pair_find_by_num(request->reply->vps, 53, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Message-Type */
+	if (vp) {
+		request->reply->code = vp->vp_byte;
+		if ((request->reply->code != 0) &&
+		    (request->reply->code < PW_DHCP_OFFSET)) {
+			request->reply->code += PW_DHCP_OFFSET;
+		}
+	}
+	else switch (rcode) {
+	case RLM_MODULE_OK:
+	case RLM_MODULE_UPDATED:
+		if (request->packet->code == PW_DHCP_DISCOVER) {
+			request->reply->code = PW_DHCP_OFFER;
+			break;
+
+		} else if (request->packet->code == PW_DHCP_REQUEST) {
+			request->reply->code = PW_DHCP_ACK;
+			break;
+		}
+		request->reply->code = PW_DHCP_NAK;
+		break;
+
+	default:
+	case RLM_MODULE_REJECT:
+	case RLM_MODULE_FAIL:
+	case RLM_MODULE_INVALID:
+	case RLM_MODULE_NOOP:
+	case RLM_MODULE_NOTFOUND:
+		if (request->packet->code == PW_DHCP_DISCOVER) {
+			request->reply->code = 0; /* ignore the packet */
+		} else {
+			request->reply->code = PW_DHCP_NAK;
+		}
+		break;
+
+	case RLM_MODULE_HANDLED:
+		request->reply->code = 0; /* ignore the packet */
+		break;
+	}
+
+	/*
+	 *	TODO: Handle 'output' of RLM_MODULE when acting as a
+	 *	DHCP relay We may want to not forward packets in
+	 *	certain circumstances.
+	 */
+
+	/*
+	 * 	Handle requests when acting as a DHCP relay
+	 */
+	vp = fr_pair_find_by_num(request->packet->vps, 256, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Opcode */
+	if (!vp) {
+		RDEBUG("FAILURE: Someone deleted the DHCP-Opcode!");
+		return 1;
+	}
+
+	/* BOOTREPLY received on port 67 (i.e. from a server) */
+	if (vp->vp_byte == 2) {
+		if (request->reply->code == 0) {
+			return 1;
+		}
+		return dhcprelay_process_server_reply(request);
+	}
+
+	/*
+	 *	If it's not BOOTREQUEST, we ignore it.
+	 */
+	if (vp->vp_byte != 1) {
+		REDEBUG("Ignoring invalid packet code %u", vp->vp_byte);
+		return 1;
+	}
+
+	/* Packet from client, and we have DHCP-Relay-To-IP-Address */
+	if (fr_pair_find_by_num(request->config, 270, DHCP_MAGIC_VENDOR, TAG_ANY)) {
+		return dhcprelay_process_client_request(request);
+	}
+
+	sock = request->listener->data;
+
+	/*
+	 *	Handle requests when acting as a DHCP server
+	 */
+
+	/*
+	 *	Releases don't get replies.
+	 */
+	if (request->packet->code == PW_DHCP_RELEASE) {
+		request->reply->code = 0;
+	}
+
+	if (request->reply->code == 0) {
+		return 1;
+	}
+
+	request->reply->sockfd = request->packet->sockfd;
+
+	/*
+	 *	Copy specific fields from packet to reply, if they
+	 *	don't already exist
+	 */
+	for (i = 0; i < sizeof(attrnums) / sizeof(attrnums[0]); i++) {
+		uint32_t attr = attrnums[i];
+
+		if (fr_pair_find_by_num(request->reply->vps, attr, DHCP_MAGIC_VENDOR, TAG_ANY)) continue;
+
+		vp = fr_pair_find_by_num(request->packet->vps, attr, DHCP_MAGIC_VENDOR, TAG_ANY);
+		if (vp) {
+			fr_pair_add(&request->reply->vps, fr_pair_copy(request->reply, vp));
+		}
+	}
+
+	vp = fr_pair_find_by_num(request->reply->vps, 256, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Opcode */
+	rad_assert(vp != NULL);
+	vp->vp_byte = 2; /* BOOTREPLY */
+
+	/*
+	 *	Allow NAKs to be delayed for a short period of time.
+	 */
+	if (request->reply->code == PW_DHCP_NAK) {
+		vp = fr_pair_find_by_num(request->reply->vps, PW_FREERADIUS_RESPONSE_DELAY, 0, TAG_ANY);
+		if (vp) {
+			if (vp->vp_integer <= 10) {
+				request->response_delay.tv_sec = vp->vp_integer;
+				request->response_delay.tv_usec = 0;
+			} else {
+				request->response_delay.tv_sec = 10;
+				request->response_delay.tv_usec = 0;
+			}
+		} else {
+#define USEC 1000000
+			vp = fr_pair_find_by_num(request->reply->vps, PW_FREERADIUS_RESPONSE_DELAY_USEC, 0, TAG_ANY);
+			if (vp) {
+				if (vp->vp_integer <= 10 * USEC) {
+					request->response_delay.tv_sec = vp->vp_integer / USEC;
+					request->response_delay.tv_usec = vp->vp_integer % USEC;
+				} else {
+					request->response_delay.tv_sec = 10;
+					request->response_delay.tv_usec = 0;
+				}
+			}
+		}
+	}
+
+	/*
+	 *	Prepare the reply packet for sending through dhcp_socket_send()
+	 */
+	request->reply->dst_ipaddr.af = AF_INET;
+	request->reply->src_ipaddr.af = AF_INET;
+	request->reply->src_ipaddr.prefix = 32;
+
+	/*
+	 *	Packet-Src-IP-Address has highest precedence
+	 */
+	vp = fr_pair_find_by_num(request->reply->vps, PW_PACKET_SRC_IP_ADDRESS, 0, TAG_ANY);
+	if (vp) {
+		request->reply->src_ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
+	/*
+	 *	The request was unicast (via a relay)
+	 */
+	} else if (request->packet->dst_ipaddr.ipaddr.ip4addr.s_addr != htonl(INADDR_BROADCAST) &&
+		   request->packet->dst_ipaddr.ipaddr.ip4addr.s_addr != htonl(INADDR_ANY)) {
+		request->reply->src_ipaddr.ipaddr.ip4addr.s_addr = request->packet->dst_ipaddr.ipaddr.ip4addr.s_addr;
+	/*
+	 *	The listener was bound to an IP address, or we determined
+	 *	the address automatically, as it was the only address bound
+	 *	to the interface, and we bound to the interface.
+	 */
+	} else if (sock->src_ipaddr.ipaddr.ip4addr.s_addr != htonl(INADDR_ANY)) {
+		request->reply->src_ipaddr.ipaddr.ip4addr.s_addr = sock->src_ipaddr.ipaddr.ip4addr.s_addr;
+	/*
+	 *	There's a Server-Identification attribute
+	 */
+	} else if ((vp = fr_pair_find_by_num(request->reply->vps, 54, DHCP_MAGIC_VENDOR, TAG_ANY))) {
+		request->reply->src_ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
+	} else {
+		REDEBUG("Unable to determine correct src_ipaddr for response");
+		return -1;
+	}
+	request->reply->dst_port = request->packet->src_port;
+	request->reply->src_port = request->packet->dst_port;
+
+	/*
+	 *	Answer to client's nearest DHCP relay.
+	 *
+	 *	Which may be different than the giaddr given in the
+	 *	packet to the client.  i.e. the relay may have a
+	 *	public IP, but the gateway a private one.
+	 */
+	vp = fr_pair_find_by_num(request->reply->vps, 272, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Relay-IP-Address */
+	if (vp && (vp->vp_ipaddr != ntohl(INADDR_ANY))) {
+		RDEBUG("DHCP: Reply will be unicast to giaddr from original packet");
+		request->reply->dst_ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
+		request->reply->dst_port = request->packet->dst_port;
+
+		vp = fr_pair_find_by_num(request->reply->vps, PW_PACKET_DST_PORT, 0, TAG_ANY);
+		if (vp) request->reply->dst_port = vp->vp_integer;
+
+		return 1;
+	}
+
+	/*
+	 *	Answer to client's nearest DHCP gateway.  In this
+	 *	case, the client can reach the gateway, as can the
+	 *	server.
+	 *
+	 *	We also use *our* source port as the destination port.
+	 *	Gateways are servers, and listen on the server port,
+	 *	not the client port.
+	 */
+	vp = fr_pair_find_by_num(request->reply->vps, 266, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Gateway-IP-Address */
+	if (vp && (vp->vp_ipaddr != htonl(INADDR_ANY))) {
+		RDEBUG("DHCP: Reply will be unicast to giaddr");
+		request->reply->dst_ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
+		request->reply->dst_port = request->packet->dst_port;
+		return 1;
+	}
+
+	/*
+	 *	If it's a NAK, or the broadcast flag was set, ond
+	 *	there's no client-ip-address, send a broadcast.
+	 */
+	if ((request->reply->code == PW_DHCP_NAK) ||
+	    ((vp = fr_pair_find_by_num(request->reply->vps, 262, DHCP_MAGIC_VENDOR, TAG_ANY)) && /* DHCP-Flags */
+	     (vp->vp_integer & 0x8000) &&
+	     ((vp = fr_pair_find_by_num(request->reply->vps, 263, DHCP_MAGIC_VENDOR, TAG_ANY)) && /* DHCP-Client-IP-Address */
+	      (vp->vp_ipaddr == htonl(INADDR_ANY))))) {
+		/*
+		 * RFC 2131, page 23
+		 *
+		 * Broadcast on
+		 * - DHCPNAK
+		 * or
+		 * - Broadcast flag is set up and ciaddr == NULL
+		 */
+		RDEBUG("DHCP: Reply will be broadcast");
+		request->reply->dst_ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_BROADCAST);
+		return 1;
+	}
+
+	/*
+	 *	RFC 2131, page 23
+	 *
+	 *	Unicast to ciaddr if present, otherwise to yiaddr.
+	 */
+	if ((vp = fr_pair_find_by_num(request->reply->vps, 263, DHCP_MAGIC_VENDOR, TAG_ANY)) && /* DHCP-Client-IP-Address */
+	    (vp->vp_ipaddr != htonl(INADDR_ANY))) {
+		RDEBUG("DHCP: Reply will be sent unicast to client-ip-address");
+		request->reply->dst_ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
+		return 1;
+	}
+
+	vp = fr_pair_find_by_num(request->reply->vps, 264, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Your-IP-Address */
+	if (!vp) {
+		RDEBUG("DHCP: Failed to find DHCP-Client-IP-Address or DHCP-Your-IP-Address for request; "
+		       "not responding");
+		/*
+		 *	There is nowhere to send the response to, so don't bother.
+		 */
+		request->reply->code = 0;
+		return -1;
+	}
+
+#ifdef SIOCSARP
+	/*
+	 *	The system is configured to listen for broadcast
+	 *	packets, which means we'll need to send unicast
+	 *	replies, to IPs which haven't yet been assigned.
+	 *	Therefore, we need to update the ARP table.
+	 *
+	 *	However, they haven't specified a interface.  So we
+	 *	can't update the ARP table.  And we must send a
+	 *	broadcast response.
+	 */
+	if (sock->lsock.broadcast && !sock->src_interface) {
+		WARN("You MUST set \"interface\" if you have \"broadcast = yes\"");
+		RDEBUG("DHCP: Reply will be broadcast as no interface was defined");
+		request->reply->dst_ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_BROADCAST);
+		return 1;
+	}
+
+	RDEBUG("DHCP: Reply will be unicast to your-ip-address");
+	request->reply->dst_ipaddr.ipaddr.ip4addr.s_addr = vp->vp_ipaddr;
+
+	/*
+	 *	When sending a DHCP_OFFER, make sure our ARP table
+	 *	contains an entry for the client IP address.
+	 *	Otherwise the packet may not be sent to the client, as
+	 *	the OS has no ARP entry for it.
+	 *
+	 *	This is a cute hack to avoid us having to create a raw
+	 *	socket to send DHCP packets.
+	 */
+	if (request->reply->code == PW_DHCP_OFFER) {
+		VALUE_PAIR *hwvp = fr_pair_find_by_num(request->reply->vps, 267, DHCP_MAGIC_VENDOR, TAG_ANY); /* DHCP-Client-Hardware-Address */
+
+		if (!hwvp) return -1;
+
+		if (fr_dhcp_add_arp_entry(request->reply->sockfd, sock->src_interface, hwvp, vp) < 0) {
+			RDEBUG("Failed adding ARP entry: %s", fr_strerror());
+			return -1;
+		}
+	}
+#else
+	if (request->packet->src_ipaddr.ipaddr.ip4addr.s_addr != ntohl(INADDR_NONE)) {
+		RDEBUG("DHCP: Request will be unicast to the unicast source IP address");
+		request->reply->dst_ipaddr.ipaddr.ip4addr.s_addr = request->packet->src_ipaddr.ipaddr.ip4addr.s_addr;
+	} else {
+		RDEBUG("DHCP: Reply will be broadcast as this system does not support ARP updates");
+		request->reply->dst_ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_BROADCAST);
+	}
+#endif
+
+	return 1;
+}
+
+static int dhcp_socket_parse(CONF_SECTION *cs, rad_listen_t *this)
+{
+	int rcode, broadcast = 1;
+	int on = 1;
+	dhcp_socket_t *sock;
+	RADCLIENT *client;
+	CONF_PAIR *cp;
+
+	/*
+	 *	Set if before parsing, so the user can forcibly turn
+	 *	it off later.
+	 */
+	this->nodup = true;
+
+	rcode = common_socket_parse(cs, this);
+	if (rcode != 0) return rcode;
+
+	if (check_config) return 0;
+
+	sock = this->data;
+
+	if (!sock->lsock.interface) {
+		WARN("No \"interface\" setting is defined.  Only unicast DHCP will work");
+	}
+
+	/*
+	 *	See whether or not we enable broadcast packets.
+	 */
+	cp = cf_pair_find(cs, "broadcast");
+	if (cp) {
+		char const *value = cf_pair_value(cp);
+		if (value && (strcmp(value, "no") == 0)) {
+			broadcast = 0;
+		}
+	}
+
+	if (broadcast) {
+		if (setsockopt(this->fd, SOL_SOCKET, SO_BROADCAST, &on, sizeof(on)) < 0) {
+			ERROR("Can't set broadcast option: %s\n",
+			       fr_syserror(errno));
+			return -1;
+		}
+	}
+
+	if (setsockopt(this->fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) < 0) {
+		ERROR("Can't set re-use address option: %s\n",
+		       fr_syserror(errno));
+		return -1;
+	}
+
+	/*
+	 *	Undocumented extension for testing without
+	 *	destroying your network!
+	 */
+	sock->suppress_responses = false;
+	cp = cf_pair_find(cs, "suppress_responses");
+	if (cp) {
+		rcode = cf_item_parse(cs, "suppress_responses", FR_ITEM_POINTER(PW_TYPE_BOOLEAN, &sock->suppress_responses), NULL);
+		if (rcode < 0) return -1;
+	}
+
+	cp = cf_pair_find(cs, "src_interface");
+	if (cp) {
+		rcode = cf_item_parse(cs, "src_interface", FR_ITEM_POINTER(PW_TYPE_STRING, &sock->src_interface), NULL);
+		if (rcode < 0) return -1;
+	} else {
+		sock->src_interface = sock->lsock.interface;
+	}
+
+	if (!sock->src_interface && sock->lsock.interface) {
+		sock->src_interface = talloc_typed_strdup(sock, sock->lsock.interface);
+	}
+
+	cp = cf_pair_find(cs, "src_ipaddr");
+	if (cp) {
+		memset(&sock->src_ipaddr, 0, sizeof(sock->src_ipaddr));
+		sock->src_ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_NONE);
+		rcode = cf_item_parse(cs, "src_ipaddr", FR_ITEM_POINTER(PW_TYPE_IPV4_ADDR, &sock->src_ipaddr), NULL);
+		if (rcode < 0) return -1;
+
+		sock->src_ipaddr.af = AF_INET;
+	} else {
+		memcpy(&sock->src_ipaddr, &sock->lsock.my_ipaddr, sizeof(sock->src_ipaddr));
+	}
+
+	/*
+	 *	Initialize the fake client.
+	 */
+	client = &sock->dhcp_client;
+	memset(client, 0, sizeof(*client));
+	client->ipaddr.af = AF_INET;
+	client->ipaddr.ipaddr.ip4addr.s_addr = ntohl(INADDR_NONE);
+	client->ipaddr.prefix = 0;
+	client->longname = client->shortname = "dhcp";
+	client->secret = client->shortname;
+	client->nas_type = talloc_typed_strdup(sock, "none");
+
+	return 0;
+}
+
+
+/*
+ *	Check if an incoming request is "ok"
+ *
+ *	It takes packets, not requests.  It sees if the packet looks
+ *	OK.  If so, it does a number of sanity checks on it.
+ */
+static int dhcp_socket_recv(rad_listen_t *listener)
+{
+	RADIUS_PACKET	*packet;
+	dhcp_socket_t	*sock;
+
+	packet = fr_dhcp_recv(listener->fd);
+	if (!packet) {
+		ERROR("%s", fr_strerror());
+		return 0;
+	}
+
+	sock = listener->data;
+	if (!request_receive(NULL, listener, packet, &sock->dhcp_client, dhcp_process)) {
+		rad_free(&packet);
+		return 0;
+	}
+
+	return 1;
+}
+
+
+/*
+ *	Send an authentication response packet
+ */
+static int dhcp_socket_send(rad_listen_t *listener, REQUEST *request)
+{
+	dhcp_socket_t	*sock;
+
+	rad_assert(request->listener == listener);
+	rad_assert(listener->send == dhcp_socket_send);
+
+	if (request->reply->code == 0) return 0; /* don't reply */
+
+	if (fr_dhcp_encode(request->reply) < 0) {
+		DEBUG("dhcp_socket_send: ERROR\n");
+		return -1;
+	}
+
+	sock = listener->data;
+	if (sock->suppress_responses) return 0;
+
+	return fr_dhcp_send(request->reply);
+}
+
+
+static int dhcp_socket_encode(UNUSED rad_listen_t *listener, UNUSED REQUEST *request)
+{
+	return 0;
+}
+
+
+static int dhcp_socket_decode(UNUSED rad_listen_t *listener, REQUEST *request)
+{
+	return fr_dhcp_decode(request->packet);
+}
+
+extern fr_protocol_t proto_dhcp;
+fr_protocol_t proto_dhcp = {
+	.magic		= RLM_MODULE_INIT,
+	.name		= "dhcp",
+	.inst_size	= sizeof(dhcp_socket_t),
+	.parse		= dhcp_socket_parse,
+	.recv		= dhcp_socket_recv,
+	.send		= dhcp_socket_send,
+	.print		= common_socket_print,
+	.encode		= dhcp_socket_encode,
+	.decode		= dhcp_socket_decode
+};