RFC2132 is not clear about whether the "Maximum DHCP Message Size"

refers to the size of the whole ethernet packet, just the DHCP
message within the UDP payload, or something else. bootpd interpreted
it as a maximum UDP payload size, so it could end up sending
fragmented packets to clients (such as some versions of Etherboot)
that used different interpretations of the maximum message size.

Switch to the most conservative interpretation: ensure that the
ethernet packet containing the response is no larger than the
specified maximum message size. This matches the behaviour of
the ISC dhcpd.

MFC after:	1 week

2 files changed, 4 insertions, 2 deletions

diff --git a/libexec/bootpd/bootp.h b/libexec/bootpd/bootp.h
index 479dd3b..c3a3909 100644
--- a/libexec/bootpd/bootp.h
+++ b/libexec/bootpd/bootp.h
@@ -38,6 +38,8 @@ SOFTWARE.
 #define BP_FILE_LEN	128
 #define BP_VEND_LEN	 64
 #define BP_MINPKTSZ	300	/* to check sizeof(struct bootp) */
+/* Overhead to fit a bootp message into an Ethernet packet. */
+#define BP_MSG_OVERHEAD	(14 + 20 + 8)	/* Ethernet + IP + UDP headers */
 
 struct bootp {
     unsigned char    bp_op;			/* packet opcode type */
diff --git a/libexec/bootpd/bootpd.c b/libexec/bootpd/bootpd.c
index aac6263..54de708 100644
--- a/libexec/bootpd/bootpd.c
+++ b/libexec/bootpd/bootpd.c
@@ -1292,10 +1292,10 @@ dovend_rfc1048(bp, hp, bootsize)
 				p += len;
 			}
 
-			if (msgsz > sizeof(*bp)) {
+			if (msgsz > sizeof(*bp) + BP_MSG_OVERHEAD) {
 				if (debug > 1)
 					report(LOG_INFO, "request has DHCP msglen=%d", msgsz);
-				pktlen = msgsz;
+				pktlen = msgsz - BP_MSG_OVERHEAD;
 			}
 		}
 	}