From nobody@FreeBSD.org  Tue Apr 18 17:43:58 2006
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B885D16A412
	for <freebsd-gnats-submit@FreeBSD.org>; Tue, 18 Apr 2006 17:43:58 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7085F43D49
	for <freebsd-gnats-submit@FreeBSD.org>; Tue, 18 Apr 2006 17:43:58 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id k3IHhwo3060171
	for <freebsd-gnats-submit@FreeBSD.org>; Tue, 18 Apr 2006 17:43:58 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id k3IHhwHL060170;
	Tue, 18 Apr 2006 17:43:58 GMT
	(envelope-from nobody)
Message-Id: <200604181743.k3IHhwHL060170@www.freebsd.org>
Date: Tue, 18 Apr 2006 17:43:58 GMT
From: Christopher Chin <cchin@ack.Berkeley.EDU>
To: freebsd-gnats-submit@FreeBSD.org
Subject: dhclient broadcasts unicast DHCPREQUEST renewals
X-Send-Pr-Version: www-2.3

>Number:         96018
>Category:       bin
>Synopsis:       [patch] dhclient(8): dhclient broadcasts unicast DHCPREQUEST renewals
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    brooks
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Apr 18 17:50:13 GMT 2006
>Closed-Date:    Thu May 15 01:59:52 UTC 2008
>Last-Modified:  Thu May 15 02:00:17 UTC 2008
>Originator:     Christopher Chin
>Release:        RELENG_6
>Organization:
UC Berkeley
>Environment:
FreeBSD bubble.Net.Berkeley.EDU 6.1-RC FreeBSD 6.1-RC #1: Fri Apr 14 12:41:38 PDT 2006     cchin@bubble.Berkeley.EDU:/usr/obj/usr/src/sys/BUBBLE  i386

>Description:
When initially running dhclient, the DHCPREQUEST is
broadcast as expected.  The renewal requests appear to
be unicast (as they should be), but in this case, go
unanswered.

Finally, the client sends a broadcast DHCPDISCOVER,
which is answered.

     bubble (cchin):/home/cchin# dhclient -d xl0
     DHCPREQUEST on xl0 to 255.255.255.255 port 67
     DHCPACK from 128.32.155.1
     bound to 128.32.155.110 -- renewal in 150 seconds.
     DHCPREQUEST on xl0 to 169.229.252.134 port 67
     DHCPREQUEST on xl0 to 169.229.252.134 port 67
     DHCPREQUEST on xl0 to 169.229.252.134 port 67
     DHCPREQUEST on xl0 to 169.229.252.134 port 67
     DHCPREQUEST on xl0 to 169.229.252.134 port 67
     DHCPDISCOVER on xl0 to 255.255.255.255 port 67 interval 8
     DHCPOFFER from 128.32.155.1
     DHCPREQUEST on xl0 to 255.255.255.255 port 67
     DHCPACK from 128.32.155.1
     bound to 128.32.155.110 -- renewal in 523 seconds.
     ^C
     bubble (cchin):/home/cchin# 

It turns out that the "unicast" renewal requests are
actually being marked as broadcast on the link level.
Instead of the ethernet address of the dhcp server (or
the router), the destination is marked all 1s.

Here is a dump of the above:

     09:45:05.900520 00:0d:56:73:f6:60 (oui Unknown) > Broadcast, ethertype IPv4
 (0x0800), length 342: s2484-dhcp-13.LIPS.Berkeley.EDU.bootpc > 255.255.255.255.
bootps: BOOTP/DHCP, Request from 00:0d:56:73:f6:60 (oui Unknown), length: 300
     09:45:05.903876 00:d0:05:78:30:00 (oui Unknown) > 00:0d:56:73:f6:60 (oui Un
known), ethertype IPv4 (0x0800), length 348: vlan520.inr-299-2484shatt.Berkeley.
EDU.bootps > s2484-dhcp-13.LIPS.Berkeley.EDU.bootpc: BOOTP/DHCP, Reply, length: 
306
     09:47:35.057867 00:0d:56:73:f6:60 (oui Unknown) > Broadcast, ethertype IPv4
 (0x0800), length 342: s2484-dhcp-13.LIPS.Berkeley.EDU.bootpc > dhcp2.Berkeley.E
DU.bootps: BOOTP/DHCP, Request from 00:0d:56:73:f6:60 (oui Unknown), length: 300
     09:47:40.062107 00:0d:56:73:f6:60 (oui Unknown) > Broadcast, ethertype IPv4
 (0x0800), length 342: s2484-dhcp-13.LIPS.Berkeley.EDU.bootpc > dhcp2.Berkeley.E
DU.bootps: BOOTP/DHCP, Request from 00:0d:56:73:f6:60 (oui Unknown), length: 300
     09:47:53.065115 00:0d:56:73:f6:60 (oui Unknown) > Broadcast, ethertype IPv4
 (0x0800), length 342: s2484-dhcp-13.LIPS.Berkeley.EDU.bootpc > dhcp2.Berkeley.E
DU.bootps: BOOTP/DHCP, Request from 00:0d:56:73:f6:60 (oui Unknown), length: 300
     09:48:17.074460 00:0d:56:73:f6:60 (oui Unknown) > Broadcast, ethertype IPv4
 (0x0800), length 342: s2484-dhcp-13.LIPS.Berkeley.EDU.bootpc > dhcp2.Berkeley.E
DU.bootps: BOOTP/DHCP, Request from 00:0d:56:73:f6:60 (oui Unknown), length: 300
     09:49:16.087475 00:0d:56:73:f6:60 (oui Unknown) > Broadcast, ethertype IPv4
 (0x0800), length 342: s2484-dhcp-13.LIPS.Berkeley.EDU.bootpc > dhcp2.Berkeley.E
DU.bootps: BOOTP/DHCP, Request from 00:0d:56:73:f6:60 (oui Unknown), length: 300
     09:50:06.177279 00:0d:56:73:f6:60 (oui Unknown) > Broadcast, ethertype IPv4
 (0x0800), length 342: 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Requ
est from 00:0d:56:73:f6:60 (oui Unknown), length: 300
     09:50:06.266529 00:d0:05:78:30:00 (oui Unknown) > 00:0d:56:73:f6:60 (oui Un
known), ethertype IPv4 (0x0800), length 348: vlan520.inr-299-2484shatt.Berkeley.
EDU.bootps > s2484-dhcp-13.LIPS.Berkeley.EDU.bootpc: BOOTP/DHCP, Reply, length: 
306
     09:50:08.313891 00:0d:56:73:f6:60 (oui Unknown) > Broadcast, ethertype IPv4
 (0x0800), length 342: 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Requ
est from 00:0d:56:73:f6:60 (oui Unknown), length: 300
     09:50:08.316849 00:d0:05:78:30:00 (oui Unknown) > 00:0d:56:73:f6:60 (oui Un
known), ethertype IPv4 (0x0800), length 348: vlan520.inr-299-2484shatt.Berkeley.
EDU.bootps > s2484-dhcp-13.LIPS.Berkeley.EDU.bootpc: BOOTP/DHCP, Reply, length: 
306
     


One example packet in detail:

     09:47:40.062107 IP s2484-dhcp-13.LIPS.Berkeley.EDU.bootpc > dhcp2.Berkeley.EDU.bootps: BOOTP/DHCP, Request from 00:0d:56:73:f6:60 (oui Unknown), length: 300
             0x0000:  ffff ffff ffff 000d 5673 f660 0800 4510  ........Vs.`..E.
             0x0010:  0148 0000 0000 1011 e79a 8020 9b6e a9e5  .H...........n..
             0x0020:  fc86 0044 0043 0134 a190 0101 0600 1fbf  ...D.C.4........
             0x0030:  f000 0005 0000 8020 9b6e 0000 0000 0000  .........n......
             0x0040:  0000 0000 0000 000d 5673 f660 0000 0000  ........Vs.`....
             0x0050:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x0060:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x0070:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x0080:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x0090:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x00a0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x00b0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x00c0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x00d0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x00e0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x00f0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x0100:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x0110:  0000 0000 0000 6382 5363 3501 0337 0701  ......c.Sc5..7..
             0x0120:  1c02 030f 060c ff00 0000 0000 0000 0000  ................
             0x0130:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x0140:  0000 0000 0000 0000 0000 0000 0000 0000  ................
             0x0150:  0000 0000 0000                           ......
     

I may be mistaken, but that certainly doesn't seem like
the correct behavior.

- Christopher

======================

>How-To-Repeat:
running dhclient on either my xl0 or wi0 interface produces the same results.
>Fix:

>Release-Note:
>Audit-Trail:

From: Christopher Chin <cchin@ack.Berkeley.EDU>
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: bin/96018: dhclient broadcasts unicast DHCPREQUEST renewals
Date: Wed, 14 Jun 2006 15:38:15 -0700 (PDT)

 FTR,
 
 I've upgraded to stable, but there's still no fix to 
 the the function of of /sbin/dhclient
 
 FreeBSD bubble.Berkeley.EDU 6.1-STABLE FreeBSD 6.1-STABLE #2: Wed Jun 14 13:19:04 PDT 2006     cchin@bubble.Berkeley.EDU:/usr/obj/usr/src/sys/BUBBLE  i386
 
 
     bubble (cchin):/home/cchin# dhclient -d wi0
     DHCPREQUEST on wi0 to 255.255.255.255 port 67
     DHCPACK from 169.229.201.1
     bound to 169.229.201.44 -- renewal in 485 seconds.
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 255.255.255.255 port 67
     DHCPACK from 169.229.201.1
     bound to 169.229.201.44 -- renewal in 247 seconds.
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 169.229.252.130 port 67
     DHCPREQUEST on wi0 to 255.255.255.255 port 67
     DHCPACK from 169.229.201.1
     bound to 169.229.201.44 -- renewal in 454 seconds.
 
 
 lather, rinse, repeat....
 
 
 The "unicast" renewal requests are still marked as 
 broadcast on the link level.
 
 Instead of the ethernet address of the dhcp server (or
 the router), the destination is marked all 1s.
 
 As such, unicast renewal requests are NOT forwarded 
 to their destination.
 
   - Christopher
 
 ======================
 
Responsible-Changed-From-To: freebsd-bugs->bms 
Responsible-Changed-By: bms 
Responsible-Changed-When: Mon Mar 5 09:54:13 UTC 2007 
Responsible-Changed-Why:  
I am working on a possible solution for other issues in dhclient 
(IP_SENDIF, don't use BPF) which might help to cure this problem. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=96018 

From: =?ISO-8859-1?Q?Thomas_Nystr=F6m?= <thn@saeab.se>
To: bug-followup@FreeBSD.org, bms@FreeBSD.org
Cc:  
Subject: Re: bin/96018: dhclient broadcasts unicast DHCPREQUEST renewals
Date: Mon, 05 Mar 2007 11:11:53 +0100

 This is a multi-part message in MIME format.
 --------------050805020106080505030108
 Content-Type: text/plain; charset=ISO-8859-1; format=flowed
 Content-Transfer-Encoding: 8bit
 
 I have seen the same but this triggers a lockout of my connection
 to my ISP (via a cable-TV-network).
 
 I sent a mail about this to freebsd-stable back in july but got no
 response.
 http://docs.freebsd.org/cgi/getmsg.cgi?fetch=958076+0+archive/2006/freebsd-stable/20060730.freebsd-stable
 
 Since then I have applied the attached patch to
 src/sbin/dhclient/bpf.c and I got normal function again!
 
 /thn
 
 -- 
 ---------------------------------------------------------------
 Svensk Aktuell Elektronik AB                     Thomas Nystrm
 Box 10                                    Phone: +46 8 35 92 85
 S-191 21  Sollentuna                        Fax: +46 8 35 92 86
 Sweden                                      Email: thn@saeab.se
 ---------------------------------------------------------------
 
 --------------050805020106080505030108
 Content-Type: text/plain;
  name="bpf.diff"
 Content-Transfer-Encoding: 7bit
 Content-Disposition: inline;
  filename="bpf.diff"
 
 --- bpf.c.orig	Tue Dec 20 22:11:16 2005
 +++ bpf.c	Thu Sep 28 16:02:47 2006
 @@ -245,6 +245,21 @@
  	unsigned char buf[256];
  	struct iovec iov[2];
  	int result, bufp = 0;
 +	int sock;
 +
 +	if (to->sin_addr.s_addr != INADDR_BROADCAST) {
 +		note("SENDING DIRECT");
 +		/* We know who the server is, send the packet via
 +		   normal socket interface */
 +
 +		if ((sock = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP)) >= 0) {
 +			result = sendto (sock, (char *)raw, len, 0,
 +					 (struct sockaddr *)to, sizeof *to);
 +			close(sock);
 +			if (result > 0)
 +				return result;
 +			}
 +		}
  
  	/* Assemble the headers... */
  	assemble_hw_header(interface, buf, &bufp, hto);
 
 --------------050805020106080505030108--
Responsible-Changed-From-To: bms->brooks 
Responsible-Changed-By: bms 
Responsible-Changed-When: Mon Mar 5 15:37:18 UTC 2007 
Responsible-Changed-Why:  
by request! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=96018 
State-Changed-From-To: open->patched 
State-Changed-By: brooks 
State-Changed-When: Tue Apr 15 22:49:11 UTC 2008 
State-Changed-Why:  
Committed to head (finally) 

http://www.freebsd.org/cgi/query-pr.cgi?pr=96018 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: bin/96018: commit references a PR
Date: Tue, 15 Apr 2008 22:49:05 +0000 (UTC)

 brooks      2008-04-15 22:48:56 UTC
 
   FreeBSD src repository
 
   Modified files:
     sbin/dhclient        bpf.c 
   Log:
   When sending packets directly to the DHCP server, use a socket and send
   directly rather than bogusly sending it out as a link layer broadcast
   (which fails to be received on some networks).
   
   PR:             bin/96018
   MFC after:      2 weeks
   
   Revision  Changes    Path
   1.8       +15 -0     src/sbin/dhclient/bpf.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: bin/96018: commit references a PR
Date: Tue, 29 Apr 2008 21:29:16 +0000 (UTC)

 brooks      2008-04-29 21:29:09 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_7)
     sbin/dhclient        bpf.c 
   Log:
   MFC rev 1.8
   
   When sending packets directly to the DHCP server, use a socket and send
   directly rather than bogusly sending it out as a link layer broadcast
   (which fails to be received on some networks).
   
   PR:             bin/96018
   MFC after:      2 weeks
   
   Revision  Changes    Path
   1.7.2.1   +15 -0     src/sbin/dhclient/bpf.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: patched->closed 
State-Changed-By: brooks 
State-Changed-When: Thu May 15 01:59:34 UTC 2008 
State-Changed-Why:  
patched in 6 

http://www.freebsd.org/cgi/query-pr.cgi?pr=96018 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: bin/96018: commit references a PR
Date: Thu, 15 May 2008 01:59:26 +0000 (UTC)

 brooks      2008-05-15 01:59:20 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_6)
     sbin/dhclient        bpf.c 
   Log:
   MFC rev 1.8: When sending packets directly to the DHCP server, use a socket
   and send directly rather than bogusly sending it out as a link layer
   broadcast (which fails to be received on some networks).
   
   PR:     bin/96018
   
   Revision  Changes    Path
   1.2.2.5   +15 -0     src/sbin/dhclient/bpf.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
>Unformatted:
