ISC Dynamic Host Configuration Protocol (DHCP)

Version 2 of the ISC DHCP Distribution, which was released in June of 1999, adds a DHCP Client and a DHCP/BOOTP Relay Agent to the DHCP Server that was offered in Version 1. Version 2 contains many changes that improve its correctness, as well as new features that enhance configurability. Some of the new capabilities include:

• IP addresses are now tested before they are assigned to clients. This allows the DHCP server to detect rogue machines that may have hijacked IP addresses before an IP address conflict can occur.
  
• The server may be configured so that some DHCP clients can be excluded from booting.
  
• Improved NAKing behaviour, so that clients that are using addresses other than the one the server knows they should be using are disciplined quickly.

dhcp-2 is not under new development. That said, the most recent release version of dhcp-2 was dhcp-2.0pl5. This release was known to have at least one security compromise, reported by debian. Users should make plans to upgrade to the latest release version of dhcp-3 at their earliest convenience. If that is impossible, users may wish to apply a patch to resolve this security issue:

• dhcp-2.0pl6.patch
• dhcp-2.0pl6.patch.asc (gpg signature)

A previous patch corrected a possible root exploit that was found in versions of the ISC DHCP client. This exploit is present in all versions of the ISC DHCP client prior to 2.0pl3. If you are using a DHCPv2 client prior to version 2.0pl3, please upgrade.

Version 2 of the ISC DHCP Distribution has been in a near feature freeze since January of 1998. This release is very stable. The current version will be the final production version - all new development is being done on version 3.

The source to the ISC DHCP Distribution is freely available at http://ftp.isc.org/isc/dhcp/dhcp-2.0-history/dhcp-2.0pl5.tar.gz.

If you need help building the DHCP server or getting it to work, please read the README file.

New features in this distribution

• A working DHCP Client.
• A working DHCP Relay agent.
• DHCP server can ping client IP addresses before offering them, so as to detect address conflicts.
• Improved NAKing, so that clients with mistaken notions of what their assigned address is can be disciplined quickly instead of timing out and possibly creating an address conflict.

Supported Platforms

• NetBSD: Full functionality
• FreeBSD: Full functionality
• Linux: Full functionality with Linux 2.0.33 and later kernels.
• Mac OS X: Full functionality.
• BSDI BSD/OS: Full functionality.
• DEC Alpha OSF/1: Full functionality.
• SunOS 4.1.4: Full functionality.
• Ultrix: Full functionality.
• Solaris 2.5, 2.6 and 7 on sparc: Full functionality.
• HPUX: Partial functionality: only systems with a single network interface are supported.
• NextStep: Full functionality, provided that the Berkeley Packet Filter option is installed.
• Rhapsody: Full functionality.

Changes in version 2.0 patchlevel 6 (released only as a patch)

• A possible root compromise from a malicious DNS server was repaired.

Changes in version 2.0 patchlevel 5

• Fix a prototype mismatch that causes compiles to fail on some architectures.
• Two minor cosmetic changes to manual pages.

Changes to version 2.0 patchlevel 4

• Fix a bug introduced in the client in the previous patchlevel where the broadcast would be set to the subnet number instead of the broadcast address.

Changes to version 2.0 patchlevel 3

• Rather than calling a client environment setup script, set the environment up directly, so as to avoid any possible exploit making use of clever shell metacharacter hacks. This is a security fix that applies to the DHCP client *only*.

Changes in version 2.0 patchlevel 2

• Fix a case where an unitialized pointer could result from an exceptional case in DHCPRELEASE and cause a core dump.

Changes in version 2.0 patchlevel 1

• Clean up DHCPRELEASE support.
• Don't use the broadcast flag when doing BOOTP unless we need to.
• Clean up the fallback mess.
• Quote all shell special characters in the client script.
• Fix ethernet header alignment on arm32.
• Clarify the "no subnet declaration" message.
• Correctly store the tftp server name in the lease file and the client script file.
• Avoid a potential spin loop in client when script file creation fails for reasons other than the presence of an existing file of the same name.
• Add support for Linux kernel versions greater than 2.2.
• Fix a problem in raw.c on Irix. Thanks to Don Badrak for the patch.

Changes in version 2.0

• Fix a long-standing but minor bug in the way the program name for syslog was derived.
• Fix a long-standing bug that prevented the DHCP server from broadcasting responses to BOOTP clients that requested a broadcast response.
• In dhcprequest(), check to make sure that there's a lease before trying to acknowledge it to the client. This fixes a potential core dump that a few people observed.

Changes in version 2.0 beta 1 patchlevel 29

• Fix some pastos I introduced when merging Andrew Chittenden's token ring support.
• Apply a patch to the token ring support from Andrew Chittenden.

Changes in version 2.0 beta 1 patchlevel 28

• Add dependencies to makefiles.
• Don't use ping -w 1 in freebsd client script.
• Token ring support for LPF, contributed by Andrew Chittenden.
• Fix a subtle bug that would cause the server to respond incorrectly in some cases when the client sent duplicate DHCPREQUEST packets.
• Fix option pretty printing for 'X' format.
• Add some special cases to deal with DHCPREQUEST packets from RFC1541 clients.
• Fix an obscure bug in nested subnet mask handling.
• Fix a bug in abandoned lease reclamation.
• Allow maximum message size to be set in configuration file.
• Allow parameter request list to be supplied in configuration file.

Changes in version 2.0 beta 1 patchlevel 27

• Fix UDP/IP checksum code
• Fix UDP payload length computation to prevent logging of spurious errors.
• Support compilation on MacOS X
• Add support for some options that were added in RFC2132.

Changes in version 2.0 beta 1 patchlevel 26

• Use the udp header's length rather than computing the length based on the number of bytes received, because some broken relay agents send packets with ip lengths that are longer than then sum of the ip header size and the udp length.
• Do path keyword substitution on unformatted manual pages before installing them.

Changes in version 2.0 beta 1 patchlevel 25

• D'oh! Fix a really stupid mistake in hash.c.

Changes in version 2.0 beta 1 patchlevel 24

• Support an always-reply-rfc1048 flag, which says to reply with an RFC1048-style vendor extensions buffer even if the client didn't send an RFC1048-style magic number.
• Fix a null pointer dereference.
• Use netmask from subnet if no netmask option specified.
• IRIX support (thanks to Don Badrak).
• Install unformatted manual pages on Linux.
• Add note in README about zcat vs. gzcat on BSD/os.

Changes in version 2.0 beta 1 patchlevel 23

• Test for lease before dereferencing it in dhcprequest.
• Free the client parameter request list in dhcpnak if there is one.

Changes in version 2.0 beta 1 patchlevel 22

• Fix a pasto in options.c that will cause a core dump whenever a client sends in a request without a parameter request list.

Changes in version 2.0 beta 1 patchlevel 21

• Actually do the client fix mentioned below - Patchlevel 20 only contained half of the fix.

Changes in version 2.0 beta 1 patchlevel 20

• Removed arp table clearing code from solaris client script.
• Document Linux "protocol not configured" error more thoroughly.
• Clean up some unused variables.
• Add entry and exit hooks to all dhcp client scripts, along with a make_resolv_conf function that can be redefined in the entry hooks. Document this new feature set.
• Fix client to take advantage of network APIs that allow it to receive a unicast instead of requesting that the DHCP server broadcast its response.
• Add -pf flag to all daemons allowing user to specify PID file name on command line.
• Undo a previous change that attempted to be clever about testing interface flags but wound up being stupid instead.
• Enforce access control on DHCPREQUEST messages as well as DHCPDISCOVER messages.

Changes in version 2.0 beta 1 patchlevel 19

• Support added for AIX 4.1.5.0 (and hopefully other versions).
• Use /var/run instead of /etc on Digital Unix.
• Change DHCP client exponential backoff code to back off more slowly, so that it is more robust in lossy environments, at the expense of being a bit less polite to the server.
• Don't request a specific lease interval in the client unless the user says to do so.
• Don't print DHCPXXX in wrong xxx messages unless DEBUG is defined.
• Fix handling of secs field.
• Fix handling of append statement.
• Fix documentation for append and prepend statements.
• Fix server support for parameter request list and maximum message size.
• Parameterize more hardware types in discover_interfaces. Check for IFF_BROADCAST instead of !IFF_POINTOPOINT
• Print kernel configuration warning message if we get EINVAL when opening or configuring the Linux packet filter.
• Fix a bug in UDP checksum code (thanks to John Nemeth for figuring this out) and re-enable UDP checksumming. This allows the client to work with some buggy DHCP servers that can't handle zero checksums in the UDP header - in particular, the one John's cable modem ISP is using.
• Don't report packet header checksum errors unless we see a lot of them. It's perfectly normal for some number of checksum errors to occur.
• Refer to the dhcpd.leases man page when printing an error message prior to exiting because there's no lease database.
• Add information to the README telling the reader how to get to the manual pages.
• Fix the server packet transmission code to unicast when it can.
• Fix a typo in the dhcpd.conf manual page.

Changes in version 2.0 beta 1 patchlevel 18

• Fix a bug in the relay agent where messages to the client would be unicast in the IP header but broadcast in the link header. The Microsoft DHCP client would reject such packets, preventing it from being configured. This was only a problem on non-socket-API platforms.
• Do not attempt to reclaim requested abandoned leases in response to DHCPDISCOVER messages.
• Allow the maximum lease time parameter in a host declaration to override the maximum lease time parameter in a subnet declaration.
• Better document the -p flag for dhclient, dhcrelay and dhcpd.
• Apply John Wehle's patch to fix the endianness bug in the dlpi packet filter on Solaris.

Changes in version 2.0 beta 1 patchlevel 17

• Fix linux man page install location.
• Fix some confusion in the dhclient-script man page.
• Fix error in includes/cf/linux.h that would have made network API selections in site.h work incorrectly.
• Fix some major stupidity in the code that figures out where or not a client owns a particular lease.

Changes in version 2.0 beta 1 patchlevel 16

• Note: Patchlevel 16 is mostly a cosmetic release - if you're already operating well with patchlevel 15, there's no hurry to upgrade.
• Fix Makefile.conf on Linux to refer to /var/state/dhcp instead of /var/state/dhcpd.
• Eliminate redundant #defines in includes/cf/linux.h (for neatness).
• Fix an obscure case where dhcpd is started by the /etc/rc system with exactly the same pid each time, dhcpd.pid is not erased on reboot, and therefore dhcpd would detect a server (itself) with the pid in dhcpd.pid and decide that another server was running and exit.

Changes in version 2.0 beta 1 patchlevel 15

• Install the dhcp databases in /var/state/dhcp instead of /etc or /var/dhcpd, as suggested in the Linux Filesystem Hierarchy Standard.
• Fix an endianness bug in dlpi.c. As a consequence, make the Solaris/i386 use dlpi again.
• Fix a bunch of bugs in the Solaris client script.
• Adjust startup message in interface probe so that the relay agent and client's unattached status will not trigger questions.
• Update some error messages to provide more help to new users for some common mistakes.
• Create an interface alias on Solaris when setting up IP aliases, rather than trying to do things the *BSD way.
• Fix a null pointer dereference bug (this time I went through the whole function and audited it for more null pointer dereferences, and I didn't find any, for what that's worth).
• Don't ever release leases in response to a DHCPDISCOVER (I think this was unlikely anyway, but why not be correct?).
• Remove the shared-network example from the sample dhcpd.conf file.
• Make ``make install'' make all first.

Changes in version 2.0 beta 1 patchlevel 14

• Support DESTDIR on installs.
• Fix a bug in dhcp.c where a store through a null pointer would be made under some reasonably common circumstances.
• Add test for ARPHRD_TUNNEL so that client and server do not fail on versions of Linux running IPsec implementations or the like.
• Move tests for constants defined in O.S. headers into osdep.h - test for HAVE_whatever in .c files. Define relevant HAVE_whatevers in linux.h, so that versions of linux that define these constants as enums will still work.

Changes in version 2 Beta 1 Patchlevel 13

• Initialize the "quiet" variable in dhclient.c to zero (it was used without first having been initialized).
• Fix the parser code for the authoritative keyword.
• Adjust lease discovery code to NAK more aggressively for addresses the server knows it owns.
• Add several new messages for DHCPNAK.

Changes in version 2 Beta 1 Patchlevel 12

• Use DLPI only on sparcs running Solaris, since it seems not to work on i386 boxes running Solaris for reasons yet to be determined.
• In the client, close standard I/O descriptors when forking a daemon.
• Don't let large lease lengths wrap lease expiry times - just use what fits into a TIME value.
• Fix a bug in the SIOCGIFCONF interface scanning code.
• Fix a core dump in the interface scanner that crops up on Linux when an interface is specified on the command line.
• Don't use %D in strftime because egcs complains about it.
• Print the error message if SO_BINDTODEVICE fails.

Changes in version 2 Beta 1 Patchlevel 11

• Update top-level Makefile so that it exits correctly on errors in submakes under bash/gnu make (dunno which is the culprit, and don't really care).
• Print a more helpful message if no free BPF devices are found.
• Add support for specifying that the server is or is not authoritative for a particular network segment.
• Fix two stupid typos in lpf.c.
• Print a more helpful message if we can't create an LPF socket or can't attach a filter to it.

Changes in version 2 Beta 1 Patchlevel 10

• Correct the hopelessly outdated information about Linux at the top of the README - many apologies to the Linux people who have had to read that nonsense for the past couple of snapshots and have been confused or annoyed by it. I simply hadn't read it recently, and didn't realize how out-of-date it was.
• Print a message if the client finds no broadcast interfaces to configure.
• Add support for use-lease-addr-for-default-route flag in server, so that Windows machines can be made to ARP for all addresses.
• Update README file to mention new Linux gotchas.
• After finally understanding Brian Murrel's code (my fault, not his) to get interface names from /proc/net/dev on Linux, fix what I broke of his code and document it.
• Use sendto rather than send for SOCK_PACKET sockets, because they can't be connected, only bound. :'(
• Fix up SOCK_PACKET creation so that the kernel doesn't complain about it.
• Fix incorrect tests in linux client script: [ $relmajor == 2 ] -> [ $relmajor -eq 2 ]
• Make typedefs for u8, u16 and u32 types. These are Linux kernel internal data types which are unfortunately exposed in the linux packetfilter header file.
• Don't include in lpf.c - it defines things we're already correctly defining elsewhere, and doesn't define any useful new stuff.
• Finally fix client PREINIT bug that causes interfaces not specified on the command line to be preinitialized. If no interfaces are specified on the command line, all interfaces are still preinitialized.

Changes in version 2 Beta 1 Patchlevel 9

• Fix socket API fallback setup code, which was causing Linux servers and clients to loop endlessly on select when run as daemons.
• Add support for Linux 2.2 version number (treated the same as Linux 2.1, for now).
• Correct apparent error in DHCPREQUEST destination address handling when in INIT-REBOOT state.
• Do not set BROADCAST flag if we have a valid IP address.
• Remove hard-coded filenames and use system-specific manifest constants.
• Add entry and exit hooks to Linux dhclient-script (should be added to all operating systems once tested).
• Test for linux major and minor version so as to correctly invoke network configuration programs.
• Add support for Linux's gratuitous name change of bpf_insn structure (can't pollute precious Linux sources with the "Berkeley" word, I guess.
• Correct USE_BPF_{SEND,RECEIVE} ifdefs for if_reinitialize_* functions.
• Ensure that we have ifreq structure before initializing interface - if an interface was specified on the command line on Linux, this was not the case.
• Get rid of references to enstamp structure in lpf.c. Correctly declare and initialize sock_fprog structure (aka bpf_filter structure on non-Linux machines).
• Define ssize_t on Ultrix.

Changes in version 2 Beta 1 Patchlevel 8

• Generalize FDDI support.
• Fix potential core dump in interface discovery code.
• Put explicit release versions on startup messages.

Changes in version 2 Beta 1 Patchlevel 7

• Add support for Linux Packet Filter (thanks to Brian Murrell, Interlinx).
• Add support for FDDI hardware type.
• Fix a long-standing bug in DLPI support where the ethertype was being set incorrectly (thanks to Gong Wei, CCENet).
• Don't use DLPI RAW mode on Solaris.
• In the client, when a lease expires, the interface to which that lease is attached is unconfigured. On systems that use the socket API, the interface needs to then be reconfigured with the 0.0.0.0 address so that it can be used to get a new address.
• Add fallback support for Linux. This fixes a problem with the relay agent when relaying over non-broadcast links, and may also fix some obscure problems with unicasting DHCPACKs in both the server and relay agent.
• When allocating leases, if the oldest lease is abandoned, try to find a younger-but-still-expired lease rather than reclaiming the abandoned lease.
• Add more documentation to README.
• The absence of the /etc/dhclient.conf file is no longer considered an error.
• The dhcp client's lease file name can be specified on the command line.
• The DHCP client should no longer zap interfaces that it has not been directed to configure.
• If a client starts up in the init-reboot state, the xid will be a "random" number rather than always being zero, as was previously the case.
• In addition to comparing transaction IDs, compare hardware addresses in response packets to verify that they are ours.
• Rewrite the client lease database after 20 leases have been written.
• Fix the exponential backoff code.
• Add a Y2k comment to indicate that something suspicious-looking is in fact _not_ a problem.
• Use mkstemp if possible.
• Add missing fi in various client scripts.
• Use "search" instead of "domain" in linux resolv.conf files.
• Specify a hop count in all route command on solaris.
• If an allocation fails, don't try to zero out the allocation buffer we didn't get.
• Support subnets that are subsets of other subnets - that is, for example, 10.0.1.0/24 and 10.0.0.0/16. This is useful in fairly obscure circumstances.
• Don't set the lease end time if it's already expired.
• Don't define INADDR_LOOPBACK on FreeBSD if it's already defined in a system header.
• Use the broadcast address in the relay agent if we are using the BSD socket API.
• Allow host declarations without names.
• Allow the server identifier option to be specified.
• Don't dump hostnames into the lease file if they contain non-printable characters.
• Copy the entire client hardware address buffer that the client sends to the output packet, not just the portion of it that's supposedly significant according to the hardware address length field. This is done for the benefit of certain Microsoft clients.
• Don't send a second ICMP echo request if we receive two DHCPDISCOVER messages in quick succession. This prevents a rather annoying timing race in configuring some Win95 clients.
• Fix up dhcp-options man page to make it more readable. Note that netbios-name-server is the same thing as WINS.

Changes in Release 2.0 Beta 1 Patchlevel 6

• If you are running versions prior to v2.0b1pl2, upgrading to this patchlevel will fix two significant security bugs.
• Define some extra DLPI support flags that make DLPI work much better on Solaris.
• Fix inet_aton prototype/declaration to match ISC BIND distribution.
• Document new server-identifier functionality.

Changes in Release 2.0 Beta 1 Patchlevel 5

• Do not use -Wstrict-prototypes on Solaris with gcc - if the ISC BIND distribution is not installed, this produces errors.
• Actually use the new DLPI support on Solaris - although the code was added in Patchlevel 2, it wasn't enabled (blush).
• Fix a prototype bug that's exposed when DLPI support is enabled on Solaris.

Changes in Release 2.0 Beta 1 Patchlevel 4

• Fix a really stupid typo in the Makefile configuration for Solaris that prevented builds from working on Solaris with gcc.

Changes in Release 2.0 Beta 1 Patchlevel 3

• Allow server-identifier in any scope. Use in-scope server identifier option rather than the default, if one exists.
• Delete newlines from abandoned lease reclaimation warning.
• Only release other applicable leases held by a client when the client sends a DHCPREQUEST.
• Fix core dump when find_lease didn't find a lease.
• Update dhcpd.leases man page.

Changes in Release 2.0 Beta 1 Patchlevel 2

• This Patchlevel contains two significant security bug fixes.
• Use -Wno-char-subscript on Solaris to prevent bogus warnings from gcc on Solaris 2.6.
• Add support for Apple's new Rhapsody operating system.
• Use DLPI on Solaris instead of using the BSD Sockets API.
• Fix two network input buffer overflow problems which could allow an attacker to pervert the stack.
• Fix an ancient typo that could theoretically cause memory corruption.
• Sort abandoned leases in at current time rather than end of time. This allows abandoned leases to be reclaimed if there are no available free leases.
• If a client explicitly requests a lease that's been abandoned, it's probably the system that was answering pings on that address, so let it have the lease.
• Fix a bunch of type conversion errors that are flagged by the Solaris C compiler.