 @@ -1,18 +1,19 @@
-/*	$NetBSD: dhc6.c,v 1.2 2013/03/24 15:53:58 christos Exp $	*/
+/*	$NetBSD: dhc6.c,v 1.3 2013/03/24 23:03:05 christos Exp $	*/
 /* dhc6.c - DHCPv6 client routines. */
 /*
  * Copyright (c) 2012 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 2006-2010 by Internet Systems Consortium, Inc. ("ISC")
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 @@ -100,26 +101,27 @@ static void start_bound(struct client_st
 static void start_informed(struct client_state *client);
 void informed_handler(struct packet *packet, struct client_state *client);
 void bound_handler(struct packet *packet, struct client_state *client);
 void start_renew6(void *input);
 void start_rebind6(void *input);
 void do_depref(void *input);
 void do_expire(void *input);
 static void make_client6_options(struct client_state *client,
 				 struct option_state **op,
 				 struct dhc6_lease *lease, u_int8_t message);
 static void script_write_params6(struct client_state *client,
 				 const char *prefix,
 				 struct option_state *options);
 static void script_write_requested6(struct client_state *client);
 static isc_boolean_t active_prefix(struct client_state *client);
 static int check_timing6(struct client_state *client, u_int8_t msg_type,
 		         char *msg_str, struct dhc6_lease *lease,
 		         struct data_string *ds);
 extern int onetry;
 extern int stateless;
 /*
  * The "best" default DUID, since we cannot predict any information
  * about the system (such as whether or not the hardware addresses are
  * integrated into the motherboard or similar), is the "LLT", link local
 @@ -205,28 +207,30 @@ dhcpv6_client_assignments(void)
+	}
 	if (remote_port == 0) {
 		ent = getservbyname("dhcpv6-server", "udp");
 		if (ent == NULL)
 			remote_port = htons(547);
 		else
 			remote_port = ent->s_port;
+	}
 	memset(&DHCPv6DestAddr, 0, sizeof(DHCPv6DestAddr));
 	DHCPv6DestAddr.sin6_family = AF_INET6;
 	DHCPv6DestAddr.sin6_port = remote_port;
-	inet_pton(AF_INET6, All_DHCP_Relay_Agents_and_Servers,
+	if (inet_pton(AF_INET6, All_DHCP_Relay_Agents_and_Servers,
-		  &DHCPv6DestAddr.sin6_addr);
+		      &DHCPv6DestAddr.sin6_addr) <= 0) {
 		log_fatal("Bad address %s", All_DHCP_Relay_Agents_and_Servers);
+	}
 	code = D6O_CLIENTID;
 	if (!option_code_hash_lookup(&clientid_option,
 				     dhcpv6_universe.code_hash, &code, 0, MDL))
 		log_fatal("Unable to find the CLIENTID option definition.");
 	code = D6O_ELAPSED_TIME;
 	if (!option_code_hash_lookup(&elapsed_option,
 				     dhcpv6_universe.code_hash, &code, 0, MDL))
 		log_fatal("Unable to find the ELAPSED_TIME option definition.");
 	code = D6O_IA_NA;
 	if (!option_code_hash_lookup(&ia_na_option, dhcpv6_universe.code_hash,
 @@ -647,27 +651,28 @@ dhc6_leaseify(struct packet *packet)
 			     lease->options) != ISC_R_SUCCESS) {
 		/* Error conditions are logged by the caller. */
 		dhc6_lease_destroy(&lease, MDL);
 		return NULL;
+	}
 	/*
 	 * This is last because in the future we may want to make a different
 	 * key based upon additional information from the packet (we may need
 	 * to allow multiple leases in one client state per server, but we're
 	 * not sure based on what additional keys now).
 	 */
 	oc = lookup_option(&dhcpv6_universe, packet->options, D6O_SERVERID);
-	if (!evaluate_option_cache(&lease->server_id, packet, NULL, NULL,
+	if ((oc == NULL) ||
 	    !evaluate_option_cache(&lease->server_id, packet, NULL, NULL,
 				   lease->options, NULL, &global_scope,
 				   oc, MDL) ||
 	    lease->server_id.len == 0) {
 		/* This should be impossible due to validation checks earlier.
 		 */
 		log_error("Invalid SERVERID option cache.");
 		dhc6_lease_destroy(&lease, MDL);
 		return NULL;
 	} else {
 		log_debug("RCV:  X-- Server ID: %s",
 			  print_hex_1(lease->server_id.len,
 				      lease->server_id.data, 52));
+	}
 @@ -4015,27 +4020,27 @@ dhc6_check_times(struct client_state *cl
 				tmp = ia->starts + use_expire;
 			} else if (ia->renew == 0xffffffff)
 				tmp = MAX_TIME;
 			else
 				tmp = ia->starts + ia->renew;
 			if (tmp < renew)
 				renew = tmp;
 			if (ia->rebind == 0) {
 				/* Set rebind to 3/4 expiration interval. */
 				tmp = ia->starts;
 				tmp += use_expire + (use_expire / 2);
-			} else if (ia->renew == 0xffffffff)
+			} else if (ia->rebind == 0xffffffff)
 				tmp = MAX_TIME;
 			else
 				tmp = ia->starts + ia->rebind;
 			if (tmp < rebind)
 				rebind = tmp;
+		}
 		/*
 		 * Return expiration ranges to EPOCH relative for event
 		 * scheduling (add_timeout()).
 		 */
 		this_ia_hi_expire += ia->starts;
 @@ -4327,58 +4332,61 @@ start_bound(struct client_state *client)
 			if ((oldaddr == NULL) && (ia->ia_type == D6O_IA_NA))
 				dhclient_schedule_updates(client,
 							  &addr->address,
 							  dns_update_offset++);
 #endif
 			/* Shell out to setup the new binding. */
 			script_init(client, reason, NULL);
 			if (old != NULL)
 				dhc6_marshall_values("old_", client, old,
 						     oldia, oldaddr);
 			dhc6_marshall_values("new_", client, lease, ia, addr);
 			script_write_requested6(client);
 			script_go(client);
+		}
 		/* XXX: maybe we should loop on the old values instead? */
 		if (ia->addrs == NULL) {
 			script_init(client, reason, NULL);
 			if (old != NULL)
 				dhc6_marshall_values("old_", client, old,
 						     oldia,
 						     oldia != NULL ?
 							 oldia->addrs : NULL);
 			dhc6_marshall_values("new_", client, lease, ia,
 					     NULL);
 			script_write_requested6(client);
 			script_go(client);
+		}
+	}
 	/* XXX: maybe we should loop on the old values instead? */
 	if (lease->bindings == NULL) {
 		script_init(client, reason, NULL);
 		if (old != NULL)
 			dhc6_marshall_values("old_", client, old,
 					     old->bindings,
 					     (old->bindings != NULL) ?
 						old->bindings->addrs : NULL);
 		dhc6_marshall_values("new_", client, lease, NULL, NULL);
 		script_write_requested6(client);
 		script_go(client);
+	}
 	go_daemon();
 	if (client->old_lease != NULL) {
 		dhc6_lease_destroy(&client->old_lease, MDL);
 		client->old_lease = NULL;
+	}
 	/* Schedule events. */
 	dhc6_check_times(client);
 @@ -4637,26 +4645,27 @@ do_depref(void *input)
 	lease = client->active_lease;
 	if (lease == NULL)
 		return;
 	for (ia = lease->bindings ; ia != NULL ; ia = ia->next) {
 		for (addr = ia->addrs ; addr != NULL ; addr = addr->next) {
 			if (addr->flags & DHC6_ADDR_DEPREFFED)
 				continue;
 			if (addr->starts + addr->preferred_life <= cur_time) {
 				script_init(client, "DEPREF6", NULL);
 				dhc6_marshall_values("cur_", client, lease,
 						     ia, addr);
 				script_write_requested6(client);
 				script_go(client);
 				addr->flags |= DHC6_ADDR_DEPREFFED;
 				if (ia->ia_type != D6O_IA_PD)
 				    log_info("PRC: Address %s depreferred.",
 					     piaddr(addr->address));
 				else
 				    log_info("PRC: Prefix %s/%u depreferred.",
 					     piaddr(addr->address),
 					     (unsigned) addr->plen);
 #if defined (NSUPDATE)
 @@ -4690,26 +4699,27 @@ do_expire(void *input)
 	lease = client->active_lease;
 	if (lease == NULL)
 		return;
 	for (ia = lease->bindings ; ia != NULL ; ia = ia->next) {
 		for (addr = ia->addrs ; addr != NULL ; addr = addr->next) {
 			if (addr->flags & DHC6_ADDR_EXPIRED)
 				continue;
 			if (addr->starts + addr->max_life <= cur_time) {
 				script_init(client, "EXPIRE6", NULL);
 				dhc6_marshall_values("old_", client, lease,
 						     ia, addr);
 				script_write_requested6(client);
 				script_go(client);
 				addr->flags |= DHC6_ADDR_EXPIRED;
 				if (ia->ia_type != D6O_IA_PD)
 				    log_info("PRC: Address %s expired.",
 					     piaddr(addr->address));
 				else
 				    log_info("PRC: Prefix %s/%u expired.",
 					     piaddr(addr->address),
 					     (unsigned) addr->plen);
 #if defined (NSUPDATE)
 @@ -4754,41 +4764,43 @@ do_expire(void *input)
  * Stateless is a special case.
  */
 void
 unconfigure6(struct client_state *client, const char *reason)
+{
 	struct dhc6_ia *ia;
 	struct dhc6_addr *addr;
 	if (stateless) {
 		script_init(client, reason, NULL);
 		if (client->active_lease != NULL)
 			script_write_params6(client, "old_",
 					     client->active_lease->options);
 		script_write_requested6(client);
 		script_go(client);
 		return;
+	}
 	if (client->active_lease == NULL)
 		return;
 	for (ia = client->active_lease->bindings ; ia != NULL ; ia = ia->next) {
 		if (ia->ia_type == D6O_IA_TA)
 			continue;
 		for (addr = ia->addrs ; addr != NULL ; addr = addr->next) {
 			script_init(client, reason, NULL);
 			dhc6_marshall_values("old_", client,
 					     client->active_lease, ia, addr);
 			script_write_requested6(client);
 			script_go(client);
 #if defined (NSUPDATE)
 			if ((ia->ia_type == D6O_IA_NA) &&
 			    client->config->do_forward_update)
 				client_dns_remove(client, &addr->address);
 #endif
+		}
+	}
+}
 static void
 refresh_info_request6(void *input)
 @@ -4862,26 +4874,27 @@ static void
 start_informed(struct client_state *client)
+{
 	client->v6_handler = informed_handler;
 	log_debug("PRC: Done.");
 	client->state = S_BOUND;
 	script_init(client, "RENEW6", NULL);
 	if (client->old_lease != NULL)
 		script_write_params6(client, "old_",
 				     client->old_lease->options);
 	script_write_params6(client, "new_", client->active_lease->options);
 	script_write_requested6(client);
 	script_go(client);
 	go_daemon();
 	if (client->old_lease != NULL) {
 		dhc6_lease_destroy(&client->old_lease, MDL);
 		client->old_lease = NULL;
+	}
 	/* Schedule events. */
 	dhc6_check_irt(client);
+}
 @@ -5089,26 +5102,52 @@ script_write_params6(struct client_state
 		return;
 	es.client = client;
 	es.prefix = prefix;
 	for (i = 0 ; i < options->universe_count ; i++) {
 		option_space_foreach(NULL, NULL, client, NULL, options,
 				     &global_scope, universes[i], &es,
 				     client_option_envadd);
+	}
+}
 /*
  * A clone of the DHCPv4 routine.
  * Write out the environment variables for the objects that the
  * client requested.  If the object was requested the variable will be:
  * requested_<option_name>=1
  * If it wasn't requested there won't be a variable.
  */
 static void script_write_requested6(client)
 	struct client_state *client;
+{
 	int i;
 	struct option **req;
 	char name[256];
 	req = client->config->requested_options;
 	if (req == NULL)
 		return;
 	for (i = 0 ; req[i] != NULL ; i++) {
 		if ((req[i]->universe == &dhcpv6_universe) &&
 		    dhcp_option_ev_name (name, sizeof(name), req[i])) {
 			client_envadd(client, "requested_", name, "%d", 1);
+		}
+	}
+}
 /*
  * Check if there is something not fully defined in the active lease.
  */
 static isc_boolean_t
 active_prefix(struct client_state *client)
+{
 	struct dhc6_lease *lease;
 	struct dhc6_ia *ia;
 	struct dhc6_addr *pref;
 	char zeros[16];
 	lease = client->active_lease;
 	if (lease == NULL)
 		return ISC_FALSE;

 @@ -1,21 +1,21 @@
-/*	$NetBSD: dhclient.c,v 1.2 2013/03/24 15:53:58 christos Exp $	*/
+/*	$NetBSD: dhclient.c,v 1.3 2013/03/24 23:03:05 christos Exp $	*/
 /* dhclient.c
    DHCP Client. */
 /*
- * Copyright (c) 2004-2011 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2004-2013 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 1995-2003 by Internet Software Consortium
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 @@ -60,27 +60,27 @@ int interfaces_requested = 0;
 struct iaddr iaddr_broadcast = { 4, { 255, 255, 255, 255 } };
 struct iaddr iaddr_any = { 4, { 0, 0, 0, 0 } };
 struct in_addr inaddr_any;
 struct sockaddr_in sockaddr_broadcast;
 struct in_addr giaddr;
 struct data_string default_duid;
 int duid_type = 0;
 /* ASSERT_STATE() does nothing now; it used to be
    assert (state_is == state_shouldbe). */
 #define ASSERT_STATE(state_is, state_shouldbe) {}
 static const char copyright[] =
-"Copyright 2004-2011 Internet Systems Consortium.";
+"Copyright 2004-2013 Internet Systems Consortium.";
 static const char arr [] = "All rights reserved.";
 static const char message [] = "Internet Systems Consortium DHCP Client";
 static const char url [] =
 "For info, please visit https://www.isc.org/software/dhcp/";
 u_int16_t local_port = 0;
 u_int16_t remote_port = 0;
 int no_daemon = 0;
 struct string_list *client_env = NULL;
 int client_env_count = 0;
 int onetry = 0;
 int quiet = 1;
 int nowait = 0;
 @@ -1197,26 +1197,27 @@ void bind_lease (client)
 	client -> new -> medium = client -> medium;
 	/* Run the client script with the new parameters. */
 	script_init (client, (client -> state == S_REQUESTING
 			  ? "BOUND"
 			  : (client -> state == S_RENEWING
 			     ? "RENEW"
 			     : (client -> state == S_REBOOTING
 				? "REBOOT" : "REBIND"))),
 		     client -> new -> medium);
 	if (client -> active && client -> state != S_REBOOTING)
 		script_write_params (client, "old_", client -> active);
 	script_write_params (client, "new_", client -> new);
 	script_write_requested(client);
 	if (client -> alias)
 		script_write_params (client, "alias_", client -> alias);
 	/* If the BOUND/RENEW code detects another machine using the
 	   offered address, it exits nonzero.  We need to send a
 	   DHCPDECLINE and toss the lease. */
 	if (script_go (client)) {
 		make_decline (client, client -> new);
 		send_decline (client);
 		destroy_client_lease (client -> new);
 		client -> new = (struct client_lease *)0;
 		state_init (client);
 		return;
 @@ -1303,26 +1304,27 @@ void state_stop (cpp)
+{
 	struct client_state *client = cpp;
 	/* Cancel all timeouts. */
 	cancel_timeout(state_selecting, client);
 	cancel_timeout(send_discover, client);
 	cancel_timeout(send_request, client);
 	cancel_timeout(state_bound, client);
 	/* If we have an address, unconfigure it. */
 	if (client->active) {
 		script_init(client, "STOP", client->active->medium);
 		script_write_params(client, "old_", client->active);
 		script_write_requested(client);
 		if (client->alias)
 			script_write_params(client, "alias_", client->alias);
 		script_go(client);
+	}
+}
 int commit_leases ()
+{
 	return 0;
+}
 int write_lease (lease)
 	struct lease *lease;
 @@ -1777,26 +1779,27 @@ void dhcpnak (packet)
 #if defined (DEBUG)
 		log_info ("DHCPNAK with no active lease.\n");
 #endif
 		return;
+	}
 	/* If we get a DHCPNAK, we use the EXPIRE dhclient-script state
 	 * to indicate that we want all old bindings to be removed.  (It
 	 * is possible that we may get a NAK while in the RENEW state,
 	 * so we might have bindings active at that time)
 	 */
 	script_init(client, "EXPIRE", NULL);
 	script_write_params(client, "old_", client->active);
 	script_write_requested(client);
 	if (client->alias)
 		script_write_params(client, "alias_", client->alias);
 	script_go(client);
 	destroy_client_lease (client -> active);
 	client -> active = (struct client_lease *)0;
 	/* Stop sending DHCPREQUEST packets... */
 	cancel_timeout (send_request, client);
 	/* On some scripts, 'EXPIRE' causes the interface to be ifconfig'd
 	 * down (this expunges any routes and arp cache).  This makes the
 	 * interface unusable by state_init(), which we call next.  So, we
 @@ -1893,31 +1896,34 @@ void send_discover (cpp)
 	/* Record the number of seconds since we started sending. */
 	if (interval < 65536)
 		client -> packet.secs = htons (interval);
 	else
 		client -> packet.secs = htons (65535);
 	client -> secs = client -> packet.secs;
 	log_info ("DHCPDISCOVER on %s to %s port %d interval %ld",
 	      client -> name ? client -> name : client -> interface -> name,
 	      inet_ntoa (sockaddr_broadcast.sin_addr),
 	      ntohs (sockaddr_broadcast.sin_port), (long)(client -> interval));
 	/* Send out a packet. */
-	result = send_packet (client -> interface, (struct packet *)0,
+	result = send_packet(client->interface, NULL, &client->packet,
-			      &client -> packet,
+			     client->packet_length, inaddr_any,
-			      client -> packet_length,
+                             &sockaddr_broadcast, NULL);
-			      inaddr_any, &sockaddr_broadcast,
+        if (result < 0) {
-			      (struct hardware *)0);
+		log_error("%s:%d: Failed to send %d byte long packet over %s "
 			  "interface.", MDL, client->packet_length,
 			  client->interface->name);
+	}
 	/*
 	 * If we used 0 microseconds here, and there were other clients on the
 	 * same network with a synchronized local clock (ntp), and a similar
 	 * zero-microsecond-scheduler behavior, then we could be participating
 	 * in a sub-second DOS ttck.
 	 */
 	tv.tv_sec = cur_tv.tv_sec + client->interval;
 	tv.tv_usec = client->interval > 1 ? random() % 1000000 : cur_tv.tv_usec;
 	add_timeout(&tv, send_discover, client, 0, 0);
+}
 /* state_panic gets called if we haven't received any offers in a preset
 @@ -1942,26 +1948,27 @@ void state_panic (cpp)
 	if (!client -> active && client -> leases)
 		goto activate_next;
 	/* Run through the list of leases and see if one can be used. */
 	while (client -> active) {
 		if (client -> active -> expiry > cur_time) {
 			log_info ("Trying recorded lease %s",
 			      piaddr (client -> active -> address));
 			/* Run the client script with the existing
 			   parameters. */
 			script_init (client, "TIMEOUT",
 				     client -> active -> medium);
 			script_write_params (client, "new_", client -> active);
 			script_write_requested(client);
 			if (client -> alias)
 				script_write_params (client, "alias_",
 						     client -> alias);
 			/* If the old lease is still good and doesn't
 			   yet need renewal, go into BOUND state and
 			   timeout at the renewal time. */
 			if (!script_go (client)) {
 			    if (cur_time < client -> active -> renewal) {
 				client -> state = S_BOUND;
 				log_info ("bound: renewal in %ld %s.",
 					  (long)(client -> active -> renewal -
 						 cur_time), "seconds");
 @@ -2080,26 +2087,27 @@ void send_request (cpp)
 			goto cancel;
 		/* Record the medium. */
 		client -> medium = client -> active -> medium;
+	}
 	/* If the lease has expired, relinquish the address and go back
 	   to the INIT state. */
 	if (client -> state != S_REQUESTING &&
 	    cur_time > client -> active -> expiry) {
 		/* Run the client script with the new parameters. */
 		script_init (client, "EXPIRE", (struct string_list *)0);
 		script_write_params (client, "old_", client -> active);
 		script_write_requested(client);
 		if (client -> alias)
 			script_write_params (client, "alias_",
 					     client -> alias);
 		script_go (client);
 		/* Now do a preinit on the interface so that we can
 		   discover a new address. */
 		script_init (client, "PREINIT", (struct string_list *)0);
 		if (client -> alias)
 			script_write_params (client, "alias_",
 					     client -> alias);
 		script_go (client);
 @@ -2160,65 +2168,77 @@ void send_request (cpp)
 	else {
 		if (interval < 65536)
 			client -> packet.secs = htons (interval);
 		else
 			client -> packet.secs = htons (65535);
+	}
 	log_info ("DHCPREQUEST on %s to %s port %d",
 	      client -> name ? client -> name : client -> interface -> name,
 	      inet_ntoa (destination.sin_addr),
 	      ntohs (destination.sin_port));
 	if (destination.sin_addr.s_addr != INADDR_BROADCAST &&
-	    fallback_interface)
+	    fallback_interface) {
-		result = send_packet (fallback_interface,
+		result = send_packet(fallback_interface, NULL, &client->packet,
-				      (struct packet *)0,
+				     client->packet_length, from, &destination,
-				      &client -> packet,
+				     NULL);
-				      client -> packet_length,
+		if (result < 0) {
-				      from, &destination,
+			log_error("%s:%d: Failed to send %d byte long packet "
-				      (struct hardware *)0);
+				  "over %s interface.", MDL,
-	else
+				  client->packet_length,
 				  fallback_interface->name);
+		}
+        }
 	else {
 		/* Send out a packet. */
-		result = send_packet (client -> interface, (struct packet *)0,
+		result = send_packet(client->interface, NULL, &client->packet,
-				      &client -> packet,
+				     client->packet_length, from, &destination,
-				      client -> packet_length,
+				     NULL);
-				      from, &destination,
+		if (result < 0) {
-				      (struct hardware *)0);
+			log_error("%s:%d: Failed to send %d byte long packet"
 				  " over %s interface.", MDL,
 				  client->packet_length,
 				  client->interface->name);
+		}
+        }
 	tv.tv_sec = cur_tv.tv_sec + client->interval;
 	tv.tv_usec = ((tv.tv_sec - cur_tv.tv_sec) > 1) ?
 			random() % 1000000 : cur_tv.tv_usec;
 	add_timeout(&tv, send_request, client, 0, 0);
+}
 void send_decline (cpp)
 	void *cpp;
+{
 	struct client_state *client = cpp;
 	int result;
 	log_info ("DHCPDECLINE on %s to %s port %d",
-	      client -> name ? client -> name : client -> interface -> name,
+	      client->name ? client->name : client->interface->name,
-	      inet_ntoa (sockaddr_broadcast.sin_addr),
+	      inet_ntoa(sockaddr_broadcast.sin_addr),
-	      ntohs (sockaddr_broadcast.sin_port));
+	      ntohs(sockaddr_broadcast.sin_port));
 	/* Send out a packet. */
-	result = send_packet (client -> interface, (struct packet *)0,
+	result = send_packet(client->interface, NULL, &client->packet,
-			      &client -> packet,
+			     client->packet_length, inaddr_any,
-			      client -> packet_length,
+			     &sockaddr_broadcast, NULL);
-			      inaddr_any, &sockaddr_broadcast,
+	if (result < 0) {
-			      (struct hardware *)0);
+		log_error("%s:%d: Failed to send %d byte long packet over %s"
 			  " interface.", MDL, client->packet_length,
 			  client->interface->name);
+	}
+}
 void send_release (cpp)
 	void *cpp;
+{
 	struct client_state *client = cpp;
 	int result;
 	struct sockaddr_in destination;
 	struct in_addr from;
 	memcpy (&from, client -> active -> address.iabuf,
 		sizeof from);
 @@ -2236,40 +2256,49 @@ void send_release (cpp)
 	client -> active -> expiry =
 		client -> active -> renewal =
 		client -> active -> rebind = cur_time;
 	if (!write_client_lease (client, client -> active, 1, 1)) {
 		log_error ("Can't release lease: lease write failed.");
 		return;
+	}
 	log_info ("DHCPRELEASE on %s to %s port %d",
 	      client -> name ? client -> name : client -> interface -> name,
 	      inet_ntoa (destination.sin_addr),
 	      ntohs (destination.sin_port));
-	if (fallback_interface)
+	if (fallback_interface) {
-		result = send_packet (fallback_interface,
+		result = send_packet(fallback_interface, NULL, &client->packet,
-				      (struct packet *)0,
+				      client->packet_length, from, &destination,
-				      &client -> packet,
+				      NULL);
-				      client -> packet_length,
+		if (result < 0) {
-				      from, &destination,
+			log_error("%s:%d: Failed to send %d byte long packet"
-				      (struct hardware *)0);
+				  " over %s interface.", MDL,
-	else
+				  client->packet_length,
 				  fallback_interface->name);
+		}
         } else {
 		/* Send out a packet. */
-		result = send_packet (client -> interface, (struct packet *)0,
+		result = send_packet(client->interface, NULL, &client->packet,
-				      &client -> packet,
+				      client->packet_length, from, &destination,
-				      client -> packet_length,
+				      NULL);
-				      from, &destination,
+		if (result < 0) {
-				      (struct hardware *)0);
+			log_error ("%s:%d: Failed to send %d byte long packet"
 				   " over %s interface.", MDL,
 				   client->packet_length,
 				   client->interface->name);
+		}
+        }
+}
 void
 make_client_options(struct client_state *client, struct client_lease *lease,
 		    u_int8_t *type, struct option_cache *sid,
 		    struct iaddr *rip, struct option **prl,
 		    struct option_state **op)
+{
 	unsigned i;
 	struct option_cache *oc;
 	struct option *option = NULL;
 	struct buffer *bp = (struct buffer *)0;
 @@ -2712,30 +2741,41 @@ void write_lease_option (struct option_c
 	char *preamble = stuff;
 	memset (&ds, 0, sizeof ds);
 	if (u != &dhcp_universe) {
 		name = u -> name;
 		dot = ".";
 	} else {
 		name = "";
 		dot = "";
+	}
 	if (evaluate_option_cache (&ds, packet, lease, client_state,
 				   in_options, cfg_options, scope, oc, MDL)) {
-		fprintf(leaseFile, "%soption %s%s%s %s;\n", preamble,
+		/* The option name */
-			name, dot, oc->option->name,
+		fprintf(leaseFile, "%soption %s%s%s", preamble,
-			pretty_print_option(oc->option, ds.data, ds.len,
+			name, dot, oc->option->name);
 , 1));
 		/* The option value if there is one */
 		if ((oc->option->format == NULL) ||
 		    (oc->option->format[0] != 'Z')) {
 			fprintf(leaseFile, " %s",
 				pretty_print_option(oc->option, ds.data,
 						    ds.len, 1, 1));
+		}
 		/* The closing semi-colon and newline */
 		fprintf(leaseFile, ";\n");
 		data_string_forget (&ds, MDL);
+	}
+}
 /* Write an option cache to the lease store. */
 static void
 write_options(struct client_state *client, struct option_state *options,
 	      const char *preamble)
+{
 	int i;
 	for (i = 0; i < options->universe_count; i++) {
 		option_space_foreach(NULL, NULL, client, NULL, options,
 @@ -3213,38 +3253,62 @@ void script_write_params (client, prefix
 	if (lease->server_name) {
 		if (check_option_values(NULL, DHO_HOST_NAME,
 					lease->server_name,
 					strlen(lease->server_name)) == 0 ) {
 			client_envadd (client, prefix, "server_name",
 				       "%s", lease->server_name);
 		} else {
 			log_error("suspect value in %s "
 				  "option - discarded",
 				  lease->server_name);
+		}
+	}
 	for (i = 0; i < lease -> options -> universe_count; i++) {
 		option_space_foreach ((struct packet *)0, (struct lease *)0,
 				      client, (struct option_state *)0,
 				      lease -> options, &global_scope,
 				      universes [i],
 				      &es, client_option_envadd);
+	}
 	client_envadd (client, prefix, "expiry", "%d", (int)(lease -> expiry));
+}
 /*
  * Write out the environment variables for the objects that the
  * client requested.  If the object was requested the variable will be:
  * requested_<option_name>=1
  * If it wasn't requested there won't be a variable.
  */
 void script_write_requested(client)
 	struct client_state *client;
+{
 	int i;
 	struct option **req;
 	char name[256];
 	req = client->config->requested_options;
 	if (req == NULL)
 		return;
 	for (i = 0 ; req[i] != NULL ; i++) {
 		if ((req[i]->universe == &dhcp_universe) &&
 		    dhcp_option_ev_name(name, sizeof(name), req[i])) {
 			client_envadd(client, "requested_", name, "%d", 1);
+		}
+	}
+}
 int script_go (client)
 	struct client_state *client;
+{
 	char *scriptName;
 	char *argv [2];
 	char **envp;
 	char reason [] = "REASON=NBI";
 	static char client_path [] = CLIENT_PATH;
 	int i;
 	struct string_list *sp, *next;
 	int pid, wpid, wstatus;
 	if (client)
 @@ -3532,26 +3596,27 @@ void do_release(client)
 		/* Zap the medium list... */
 		client -> medium = (struct string_list *)0;
 		/* Send out the first and only DHCPRELEASE packet. */
 		send_release (client);
 		/* Do the client script RELEASE operation. */
 		script_init (client,
 			     "RELEASE", (struct string_list *)0);
 		if (client -> alias)
 			script_write_params (client, "alias_",
 					     client -> alias);
 		script_write_params (client, "old_", client -> active);
 		script_write_requested(client);
 		script_go (client);
+	}
 	/* Cancel any timeouts. */
 	cancel_timeout (state_bound, client);
 	cancel_timeout (send_discover, client);
 	cancel_timeout (state_init, client);
 	cancel_timeout (send_request, client);
 	cancel_timeout (state_reboot, client);
 	client -> state = S_STOPPED;
+}
 int dhclient_interface_shutdown_hook (struct interface_info *interface)
 @@ -3698,47 +3763,47 @@ static void shutdown_exit (void *foo)
 /* The first and second stages are pretty similar so we combine them */
 static void
 client_dns_remove_action(dhcp_ddns_cb_t *ddns_cb,
 			 isc_result_t    eresult)
+{
 	isc_result_t result;
 	if ((eresult == ISC_R_SUCCESS) &&
 	    (ddns_cb->state == DDNS_STATE_REM_FW_YXDHCID)) {
 		/* Do the second stage of the FWD removal */
 		ddns_cb->state = DDNS_STATE_REM_FW_NXRR;
-		result = ddns_modify_fwd(ddns_cb);
+		result = ddns_modify_fwd(ddns_cb, MDL);
 		if (result == ISC_R_SUCCESS) {
 			return;
+		}
+	}
 	/* If we are done or have an error clean up */
 	ddns_cb_free(ddns_cb, MDL);
 	return;
+}
 void
 client_dns_remove(struct client_state *client,
 		  struct iaddr        *addr)
+{
 	dhcp_ddns_cb_t *ddns_cb;
 	isc_result_t result;
 	/* if we have an old ddns request for this client, cancel it */
 	if (client->ddns_cb != NULL) {
-		ddns_cancel(client->ddns_cb);
+		ddns_cancel(client->ddns_cb, MDL);
 		client->ddns_cb = NULL;
+	}
 	ddns_cb = ddns_cb_alloc(MDL);
 	if (ddns_cb != NULL) {
 		ddns_cb->address = *addr;
 		ddns_cb->timeout = 0;
 		ddns_cb->state = DDNS_STATE_REM_FW_YXDHCID;
 		ddns_cb->flags = DDNS_UPDATE_ADDR;
 		ddns_cb->cur_func = client_dns_remove_action;
 		result = client_dns_update(client, ddns_cb);
 @@ -3876,27 +3941,27 @@ client_dns_update_action(dhcp_ddns_cb_t
 		/* Either we succeeded or broke in a bad way, clean up */
 		break;
 	case DNS_R_YXRRSET:
 		/*
 		 * This is the only difference between the two stages,
 		 * check to see if it is the first stage, in which case
 		 * start the second stage
 		 */
 		if (ddns_cb->state == DDNS_STATE_ADD_FW_NXDOMAIN) {
 			ddns_cb->state = DDNS_STATE_ADD_FW_YXDHCID;
 			ddns_cb->cur_func = client_dns_update_action;
-			result = ddns_modify_fwd(ddns_cb);
+			result = ddns_modify_fwd(ddns_cb, MDL);
 			if (result == ISC_R_SUCCESS) {
 				return;
+			}
+		}
 		break;
 	case ISC_R_TIMEDOUT:
 		/*
 		 * We got a timeout response from the DNS module.  Schedule
 		 * another attempt for later.  We forget the name, dhcid and
 		 * zone so if it gets changed we will get the new information.
 		 */
 		data_string_forget(&ddns_cb->fwd_name, MDL);
 @@ -4013,27 +4078,27 @@ client_dns_update(struct client_state *c
 		} else
 			result = get_dhcid(&ddns_cb->dhcid, 0,
 					   client->interface->hw_address.hbuf,
 					   client->interface->hw_address.hlen);
+	}
 	if (!result) {
 		return ISC_R_SUCCESS;
+	}
 	/*
 	 * Perform updates.
 	 */
 	if (ddns_cb->fwd_name.len && ddns_cb->dhcid.len) {
-		rcode = ddns_modify_fwd(ddns_cb);
+		rcode = ddns_modify_fwd(ddns_cb, MDL);
 	} else
 		rcode = ISC_R_FAILURE;
 	/*
 	 * A success from the modify routine means we are performing
 	 * async processing, for which we use the timedout error message.
 	 */
 	if (rcode == ISC_R_SUCCESS) {
 		rcode = ISC_R_TIMEDOUT;
+	}
 	return rcode;
+}
 @@ -4046,27 +4111,27 @@ client_dns_update(struct client_state *c
 void
 dhclient_schedule_updates(struct client_state *client,
 			  struct iaddr        *addr,
 			  int                  offset)
+{
 	dhcp_ddns_cb_t *ddns_cb;
 	struct timeval tv;
 	if (!client->config->do_forward_update)
 		return;
 	/* cancel any outstanding ddns requests */
 	if (client->ddns_cb != NULL) {
-		ddns_cancel(client->ddns_cb);
+		ddns_cancel(client->ddns_cb, MDL);
 		client->ddns_cb = NULL;
+	}
 	ddns_cb = ddns_cb_alloc(MDL);
 	if (ddns_cb != NULL) {
 		ddns_cb->lease = (void *)client;
 		ddns_cb->address = *addr;
 		ddns_cb->timeout = 1;
 		/*
 		 * XXX: DNS TTL is a problem we need to solve properly.
 		 * Until that time, 300 is a placeholder default for

 @@ -1,21 +1,21 @@
-/*	$NetBSD: dns.c,v 1.2 2013/03/24 15:53:58 christos Exp $	*/
+/*	$NetBSD: dns.c,v 1.3 2013/03/24 23:03:06 christos Exp $	*/
 /* dns.c
    Domain Name Service subroutines. */
 /*
- * Copyright (c) 2009-2011 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2009-2012 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 2004-2007 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 2001-2003 by Internet Software Consortium
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 @@ -805,26 +805,32 @@ find_cached_zone(dhcp_ddns_cb_t *ddns_cb
 void forget_zone (struct dns_zone **zone)
+{
 	dns_zone_dereference (zone, MDL);
+}
 void repudiate_zone (struct dns_zone **zone)
+{
 	/* XXX Currently we're not differentiating between a cached
 	   XXX zone and a zone that's been repudiated, which means
 	   XXX that if we reap cached zones, we blow away repudiated
 	   XXX zones.   This isn't a big problem since we're not yet
 	   XXX caching zones... :'} */
 	/* verify that we have a pointer at least */
 	if ((zone == NULL) || (*zone == NULL)) {
 		log_info("Null argument to repudiate zone");
 		return;
+	}
 	(*zone) -> timeout = cur_time - 1;
 	dns_zone_dereference (zone, MDL);
+}
 /* Have to use TXT records for now. */
 #define T_DHCID T_TXT
 int get_dhcid (struct data_string *id,
 	       int type, const u_int8_t *data, unsigned len)
+{
 	unsigned char buf[ISC_MD5_DIGESTLENGTH];
 	isc_md5_t md5;
 	int i;
 @@ -1172,63 +1178,55 @@ ddns_modify_fwd_add2(dhcp_ddns_cb_t   *d
 /*
  * The entity chosen to handle the A record for this client (either the
  * client or the server) SHOULD delete the A record that was added when
  * the lease was made to the client.
+ *
  * In order to perform this delete, the updater prepares an UPDATE
  * query which contains two prerequisites.  The first prerequisite
  * asserts that the DHCID RR exists whose data is the client identity
  * described in Section 4.3. The second prerequisite asserts that the
  * data in the A RR contains the IP address of the lease that has
  * expired or been released.
  *   -- "Interaction between DHCP and DNS"
+ *
  * RFC 4703 has relaxed the prereqisites to only checking the DHCID RR
  * and we have adopted that to minizmie problems due to interruptions
  * when doing a deletion.
+ *
  * First try has:
  * DHCID RR exists, and matches client identity.
  * A RR matches the expiring lease.
  * Delete appropriate A RR.
  */
 static isc_result_t
 ddns_modify_fwd_rem1(dhcp_ddns_cb_t   *ddns_cb,
 		     dhcp_ddns_data_t *dataspace,
 		     dns_name_t       *pname,
 		     dns_name_t       *uname)
+{
 	isc_result_t result;
 	/* Consruct the prereq list */
 	/* The DHCID RR exists and matches the client identity */
 	result = make_dns_dataset(dns_rdataclass_in, dns_rdatatype_txt,
 				  dataspace,
 				  (unsigned char *)ddns_cb->dhcid.data,
 				  ddns_cb->dhcid.len, 0);
 	if (result != ISC_R_SUCCESS) {
 		return(result);
+	}
 	ISC_LIST_APPEND(pname->list, &dataspace->rdataset, link);
 	dataspace++;
 	/* The A RR matches the expiring lease */
 	result = make_dns_dataset(dns_rdataclass_in, ddns_cb->address_type,
 				  dataspace,
 				  (unsigned char *)ddns_cb->address.iabuf,
 				  ddns_cb->address.len, 0);
 	if (result != ISC_R_SUCCESS) {
 		return(result);
 	ISC_LIST_APPEND(pname->list, &dataspace->rdataset, link);
 	dataspace++;
 	/* Construct the update list */
 	/* Delete A RRset */
 	result = make_dns_dataset(dns_rdataclass_none, ddns_cb->address_type,
 				  dataspace,
 				  (unsigned char *)ddns_cb->address.iabuf,
 				  ddns_cb->address.len, 0);
 	if (result != ISC_R_SUCCESS) {
 		return(result);
+	}
 	ISC_LIST_APPEND(uname->list, &dataspace->rdataset, link);
 	return(ISC_R_SUCCESS);
+}
 @@ -1311,79 +1309,97 @@ void ddns_interlude(isc_task_t  *taskp,
 #endif
 #if defined (DEBUG_DNS_UPDATES)
 	print_dns_status(DDNS_PRINT_INBOUND, ddns_cb, eresult);
 #endif
 	/* This transaction is complete, clear the value */
 	dns_client_destroyupdatetrans(&ddns_cb->transaction);
 	/* If we cancelled or tried to cancel the operation we just
 	 * need to clean up. */
 	if ((eresult == ISC_R_CANCELED) ||
 	    ((ddns_cb->flags & DDNS_ABORT) != 0)) {
 #if defined (DEBUG_DNS_UPDATES)
 		log_info("DDNS: completeing transaction cancellation cb=%p, "
 			 "flags=%x, %s",
 			 ddns_cb, ddns_cb->flags, isc_result_totext(eresult));
 #endif
 		if ((ddns_cb->flags & DDNS_ABORT) == 0) {
 			log_info("DDNS: cleaning up lease pointer for a cancel "
 				 "cb=%p", ddns_cb);
 			/*
 			 * We shouldn't actually be able to get here but
 			 * we are.  This means we haven't cleaned up
 			 * the lease pointer so we need to do that before
 			 * freeing the cb.
 			 */
 			ddns_cb->cur_func(ddns_cb, eresult);
 			return;
+		}
 		if (ddns_cb->next_op != NULL) {
 			/* if necessary cleanup up next op block */
 			ddns_cb_free(ddns_cb->next_op, MDL);
+		}
 		ddns_cb_free(ddns_cb, MDL);
 		return;
+	}
 	/* If we had a problem with our key or zone try again */
 	if ((eresult == DNS_R_NOTAUTH) ||
 	    (eresult == DNS_R_NOTZONE)) {
 		int i;
 		/* Our zone information was questionable,
 		 * repudiate it and try again */
 		log_error("DDNS: bad zone information, repudiating zone %s",
 			  ddns_cb->zone_name);
 		repudiate_zone(&ddns_cb->zone);
 		ddns_cb->zone_name[0]    = 0;
 		ISC_LIST_INIT(ddns_cb->zone_server_list);
 		for (i = 0; i < DHCP_MAXNS; i++) {
 			ISC_LINK_INIT(&ddns_cb->zone_addrs[i], link);
+		}
-		if ((ddns_cb->state &
+		if ((ddns_cb->state == DDNS_STATE_ADD_PTR) ||
-		     (DDNS_STATE_ADD_PTR | DDNS_STATE_REM_PTR)) != 0) {
+		    (ddns_cb->state == DDNS_STATE_REM_PTR)) {
-			result = ddns_modify_ptr(ddns_cb);
+			result = ddns_modify_ptr(ddns_cb, MDL);
 		} else {
-			result = ddns_modify_fwd(ddns_cb);
+			result = ddns_modify_fwd(ddns_cb, MDL);
+		}
 		if (result != ISC_R_SUCCESS) {
-			/* if we couldn't redo the query toss it */
+			/* if we couldn't redo the query log it and
-			if (ddns_cb->next_op != NULL) {
+			 * let the next function clean it up */
-				/* cleanup up next op block */
+			log_info("DDNS: Failed to retry after zone failure");
-				ddns_cb_free(ddns_cb->next_op, MDL);
+			ddns_cb->cur_func(ddns_cb, result);
 			ddns_cb_free(ddns_cb, MDL);
+		}
 		return;
 	} else {
 		/* pass it along to be processed */
 		ddns_cb->cur_func(ddns_cb, eresult);
+	}
 	return;
+}
 /*
  * This routine does the generic work for sending a ddns message to
  * modify the forward record (A or AAAA) and calls one of a set of
  * routines to build the specific message.
  */
 isc_result_t
-ddns_modify_fwd(dhcp_ddns_cb_t *ddns_cb)
+ddns_modify_fwd(dhcp_ddns_cb_t *ddns_cb, const char *file, int line)
+{
 	isc_result_t result;
 	dns_tsec_t *tsec_key = NULL;
 	unsigned char *clientname;
 	dhcp_ddns_data_t *dataspace = NULL;
 	dns_namelist_t prereqlist, updatelist;
 	dns_fixedname_t zname0, pname0, uname0;
 	dns_name_t *zname = NULL, *pname, *uname;
 	isc_sockaddrlist_t *zlist = NULL;
 	/* Get a pointer to the clientname to make things easier. */
 @@ -1533,36 +1549,43 @@ ddns_modify_fwd(dhcp_ddns_cb_t *ddns_cb)
 			     ddns_interlude,
 			     (void *)ddns_cb,
 			     &ddns_cb->transaction);
 	if (result == ISC_R_FAMILYNOSUPPORT) {
 		log_info("Unable to perform DDNS update, "
 			 "address family not supported");
+	}
 #if defined (DEBUG_DNS_UPDATES)
 	print_dns_status(DDNS_PRINT_OUTBOUND, ddns_cb, result);
 #endif
  cleanup:
 #if defined (DEBUG_DNS_UPDATES)
 	if (result != ISC_R_SUCCESS) {
 		log_info("DDNS: %s(%d): error in ddns_modify_fwd %s for %p",
 			 file, line, isc_result_totext(result), ddns_cb);
+	}
 #endif
 	if (dataspace != NULL) {
 		isc_mem_put(dhcp_gbl_ctx.mctx, dataspace,
 			    sizeof(*dataspace) * 4);
+	}
 	return(result);
+}
 isc_result_t
-ddns_modify_ptr(dhcp_ddns_cb_t *ddns_cb)
+ddns_modify_ptr(dhcp_ddns_cb_t *ddns_cb, const char *file, int line)
+{
 	isc_result_t result;
 	dns_tsec_t *tsec_key  = NULL;
 	unsigned char *ptrname;
 	dhcp_ddns_data_t *dataspace = NULL;
 	dns_namelist_t updatelist;
 	dns_fixedname_t zname0, uname0;
 	dns_name_t *zname = NULL, *uname;
 	isc_sockaddrlist_t *zlist = NULL;
 	unsigned char buf[256];
 	int buflen;
 	/*
 @@ -1722,34 +1745,46 @@ ddns_modify_ptr(dhcp_ddns_cb_t *ddns_cb)
 			     dhcp_gbl_ctx.task,
 			     ddns_interlude, (void *)ddns_cb,
 			     &ddns_cb->transaction);
 	if (result == ISC_R_FAMILYNOSUPPORT) {
 		log_info("Unable to perform DDNS update, "
 			 "address family not supported");
+	}
 #if defined (DEBUG_DNS_UPDATES)
 	print_dns_status(DDNS_PRINT_OUTBOUND, ddns_cb, result);
 #endif
  cleanup:
 #if defined (DEBUG_DNS_UPDATES)
 	if (result != ISC_R_SUCCESS) {
 		log_info("DDNS: %s(%d): error in ddns_modify_ptr %s for %p",
 			 file, line, isc_result_totext(result), ddns_cb);
+	}
 #endif
 	if (dataspace != NULL) {
 		isc_mem_put(dhcp_gbl_ctx.mctx, dataspace,
 			    sizeof(*dataspace) * 2);
+	}
 	return(result);
+}
 void
-ddns_cancel(dhcp_ddns_cb_t *ddns_cb) {
+ddns_cancel(dhcp_ddns_cb_t *ddns_cb, const char *file, int line) {
 	ddns_cb->flags |= DDNS_ABORT;
 	if (ddns_cb->transaction != NULL) {
 		dns_client_cancelupdate((dns_clientupdatetrans_t *)
 					ddns_cb->transaction);
+	}
 	ddns_cb->lease = NULL;
 #if defined (DEBUG_DNS_UPDATES)
 	log_info("DDNS: %s(%d): cancelling transaction for  %p",
 		 file, line,  ddns_cb);
 #endif
+}
 #endif /* NSUPDATE */
 HASH_FUNCTIONS (dns_zone, const char *, struct dns_zone, dns_zone_hash_t,
 		dns_zone_reference, dns_zone_dereference, do_case_hash)

 @@ -1,21 +1,21 @@
-/*	$NetBSD: dhcpd.h,v 1.2 2013/03/24 15:53:58 christos Exp $	*/
+/*	$NetBSD: dhcpd.h,v 1.3 2013/03/24 23:03:06 christos Exp $	*/
 /* dhcpd.h
    Definitions for dhcpd... */
 /*
- * Copyright (c) 2004-2011 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2004-2012 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 1996-2003 by Internet Software Consortium
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 @@ -25,27 +25,27 @@
  *   Redwood City, CA 94063
  *   <info@isc.org>
  *   https://www.isc.org/
+ *
  * This software has been written for Internet Systems Consortium
  * by Ted Lemon in cooperation with Vixie Enterprises and Nominum, Inc.
  * To learn more about Internet Systems Consortium, see
  * ``https://www.isc.org/''.  To learn more about Vixie Enterprises,
  * see ``http://www.vix.com''.   To learn more about Nominum, Inc., see
  * ``http://www.nominum.com''.
  */
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: dhcpd.h,v 1.2 2013/03/24 15:53:58 christos Exp $");
+__RCSID("$NetBSD: dhcpd.h,v 1.3 2013/03/24 23:03:06 christos Exp $");
 #include "config.h"
 #ifndef __CYGWIN32__
 #include <sys/types.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
 #include <sys/un.h>
 #include <arpa/inet.h>
 #include <errno.h>
 #include <netdb.h>
 #else
 @@ -427,31 +427,37 @@ struct packet {
 	/* If we stash agent options onto the packet option state, to pretend
 	 * options we got in a previous exchange were still there, we need
 	 * to signal this in a reliable way.
 	 */
 	isc_boolean_t agent_options_stashed;
 	/*
 	 * ISC_TRUE if packet received unicast (as opposed to multicast).
 	 * Only used in DHCPv6.
 	 */
 	isc_boolean_t unicast;
 };
-/* A network interface's MAC address. */
+/*
  * A network interface's MAC address.
  * 20 bytes for the hardware address
  * and 1 byte for the type tag
  */
 #define HARDWARE_ADDR_LEN 20
 struct hardware {
 	u_int8_t hlen;
-	u_int8_t hbuf [17];
+	u_int8_t hbuf[HARDWARE_ADDR_LEN + 1];
 };
 #if defined(LDAP_CONFIGURATION)
 # define LDAP_BUFFER_SIZE		8192
 # define LDAP_METHOD_STATIC		0
 # define LDAP_METHOD_DYNAMIC	1
 #if defined (LDAP_USE_SSL)
 # define LDAP_SSL_OFF			0
 # define LDAP_SSL_ON			1
 # define LDAP_SSL_TLS			2
 # define LDAP_SSL_LDAPS			3
 #endif
 @@ -1552,27 +1558,27 @@ struct ipv6_pool {
 						   this pool */
 	struct subnet *subnet;			/* subnet for this pool */
 };
 /* Flags and state for dhcp_ddns_cb_t */
 #define DDNS_UPDATE_ADDR        0x01
 #define DDNS_UPDATE_PTR         0x02
 #define DDNS_INCLUDE_RRSET      0x04
 #define DDNS_CONFLICT_OVERRIDE  0x08
 #define DDNS_CLIENT_DID_UPDATE  0x10
 #define DDNS_EXECUTE_NEXT       0x20
 #define DDNS_ABORT              0x40
 #define DDNS_STATIC_LEASE       0x80
 #define DDNS_ACTIVE_LEASE	0x100
 /*
  * The following two groups are separate and we could reuse
  * values but not reusing them may be useful in the future.
  */
 #define DDNS_STATE_CLEANUP          0 // The previous step failed, cleanup
 #define DDNS_STATE_ADD_FW_NXDOMAIN  1
 #define DDNS_STATE_ADD_FW_YXDHCID   2
 #define DDNS_STATE_ADD_PTR          3
 #define DDNS_STATE_REM_FW_YXDHCID  17
 #define DDNS_STATE_REM_FW_NXRR     18
 #define DDNS_STATE_REM_PTR         19
 @@ -1593,27 +1599,27 @@ typedef struct dhcp_ddns_cb {
 	struct data_string rev_name;
 	struct data_string dhcid;
 	struct iaddr address;
 	int address_type;
 	unsigned long ttl;
 	unsigned char zone_name[DHCP_MAXDNS_WIRE];
 	isc_sockaddrlist_t zone_server_list;
 	isc_sockaddr_t zone_addrs[DHCP_MAXNS];
 	int zone_addr_count;
 	struct dns_zone *zone;
-	int flags;
+	u_int16_t flags;
 	TIME timeout;
 	int state;
 	ddns_action_t cur_func;
 	struct dhcp_ddns_cb * next_op;
 	/* Lease or client state that triggered the ddns operation */
 	void *lease;
 	struct binding_scope **scope;
 	void *transaction;
 	void *dataspace;
 } dhcp_ddns_cb_t;
 @@ -1848,26 +1854,28 @@ int linked_option_space_encapsulate (str
 				     struct option_state *,
 				     struct binding_scope **,
 				     struct universe *);
 void delete_linked_option (struct universe *, struct option_state *, int);
 struct option_cache *lookup_linked_option (struct universe *,
 					   struct option_state *, unsigned);
 void do_packet (struct interface_info *,
 		struct dhcp_packet *, unsigned,
 		unsigned int, struct iaddr, struct hardware *);
 void do_packet6(struct interface_info *, const char *,
 		int, int, const struct iaddr *, isc_boolean_t);
 int packet6_len_okay(const char *, int);
 int validate_packet(struct packet *);
 int add_option(struct option_state *options,
 	       unsigned int option_num,
 	       void *data,
 	       unsigned int data_len);
 /* dhcpd.c */
 extern struct timeval cur_tv;
 #define cur_time cur_tv.tv_sec
 extern int ddns_update_style;
 extern const char *path_dhcpd_conf;
 extern const char *path_dhcpd_db;
 @@ -1945,27 +1953,28 @@ void parse_address_range (struct parse *
 			  struct pool *, struct lease **);
 void parse_address_range6(struct parse *cfile, struct group *group);
 void parse_prefix6(struct parse *cfile, struct group *group);
 void parse_fixed_prefix6(struct parse *cfile, struct host_decl *host_decl);
 void parse_ia_na_declaration(struct parse *);
 void parse_ia_ta_declaration(struct parse *);
 void parse_ia_pd_declaration(struct parse *);
 void parse_server_duid(struct parse *cfile);
 void parse_server_duid_conf(struct parse *cfile);
 /* ddns.c */
 int ddns_updates(struct packet *, struct lease *, struct lease *,
 		 struct iasubopt *, struct iasubopt *, struct option_state *);
-int ddns_removals(struct lease *, struct iasubopt *, struct dhcp_ddns_cb *);
+isc_result_t ddns_removals(struct lease *, struct iasubopt *,
 			   struct dhcp_ddns_cb *, isc_boolean_t);
 #if defined (TRACING)
 void trace_ddns_init(void);
 #endif
 /* parse.c */
 void add_enumeration (struct enumeration *);
 struct enumeration *find_enumeration (const char *, int);
 struct enumeration_value *find_enumeration_value (const char *, int,
 						  unsigned *,
 						  const char *);
 void skip_to_semi (struct parse *);
 void skip_to_rbrace (struct parse *, int);
 int parse_semi (struct parse *);
 @@ -2167,27 +2176,31 @@ int mockup_lease (struct lease **, struc
 		  struct host_decl *);
 void static_lease_dereference (struct lease *, const char *, int);
 int allocate_lease (struct lease **, struct packet *,
 		    struct pool *, int *);
 int permitted (struct packet *, struct permit *);
 int locate_network (struct packet *);
 int parse_agent_information_option (struct packet *, int, u_int8_t *);
 unsigned cons_agent_information_options (struct option_state *,
 					 struct dhcp_packet *,
 					 unsigned, unsigned);
 void get_server_source_address(struct in_addr *from,
 			       struct option_state *options,
 			       struct option_state *out_options,
 			       struct packet *packet);
 void setup_server_source_address(struct in_addr *from,
 				 struct option_state *options,
 				 struct packet *packet);
 /* dhcpleasequery.c */
 void dhcpleasequery (struct packet *, int);
 void dhcpv6_leasequery (struct data_string *, struct packet *);
 /* dhcpv6.c */
 isc_boolean_t server_duid_isset(void);
 void copy_server_duid(struct data_string *ds, const char *file, int line);
 void set_server_duid(struct data_string *new_duid);
 isc_result_t set_server_duid_from_option(void);
 void set_server_duid_type(int type);
 isc_result_t generate_new_server_duid(void);
 isc_result_t get_client_id(struct packet *, struct data_string *);
 @@ -2725,26 +2738,27 @@ int write_client_lease (struct client_st
 isc_result_t write_client6_lease(struct client_state *client,
 				 struct dhc6_lease *lease,
 				 int rewrite, int sync);
 int dhcp_option_ev_name (char *, size_t, struct option *);
 void script_init (struct client_state *, const char *,
 		  struct string_list *);
 void client_option_envadd (struct option_cache *, struct packet *,
 			   struct lease *, struct client_state *,
 			   struct option_state *, struct option_state *,
 			   struct binding_scope **, struct universe *, void *);
 void script_write_params (struct client_state *, const char *,
 			  struct client_lease *);
 void script_write_requested (struct client_state *);
 int script_go (struct client_state *);
 void client_envadd (struct client_state *,
 		    const char *, const char *, const char *, ...)
 	__attribute__((__format__(__printf__,4,5)));
 struct client_lease *packet_to_lease (struct packet *, struct client_state *);
 void go_daemon (void);
 void write_client_pid_file (void);
 void client_location_changed (void);
 void do_release (struct client_state *);
 int dhclient_interface_shutdown_hook (struct interface_info *);
 int dhclient_interface_discovery_hook (struct interface_info *);
 isc_result_t dhclient_interface_startup_hook (struct interface_info *);
 @@ -2773,26 +2787,27 @@ int write_lease (struct lease *);
 int write_host (struct host_decl *);
 int write_server_duid(void);
 #if defined (FAILOVER_PROTOCOL)
 int write_failover_state (dhcp_failover_state_t *);
 #endif
 int db_printable (const unsigned char *);
 int db_printable_len (const unsigned char *, unsigned);
 isc_result_t write_named_billing_class(const void *, unsigned, void *);
 void write_billing_classes (void);
 int write_billing_class (struct class *);
 void commit_leases_timeout (void *);
 void commit_leases_readerdry(void *);
 int commit_leases (void);
 int commit_leases_timed (void);
 void db_startup (int);
 int new_lease_file (void);
 int group_writer (struct group_object *);
 int write_ia(const struct ia_xx *);
 /* packet.c */
 u_int32_t checksum (unsigned char *, unsigned, u_int32_t);
 u_int32_t wrapsum (u_int32_t);
 void assemble_hw_header (struct interface_info *, unsigned char *,
 			 unsigned *, struct hardware *);
 void assemble_udp_ip_header (struct interface_info *, unsigned char *,
 			     unsigned *, u_int32_t, u_int32_t,
 			     u_int32_t, unsigned char *, unsigned);
 @@ -3238,27 +3253,30 @@ int find_grouped_subnet (struct subnet *
 int find_subnet(struct subnet **, struct iaddr, const char *, int);
 void enter_shared_network (struct shared_network *);
 void new_shared_network_interface (struct parse *,
 				   struct shared_network *,
 				   const char *);
 int subnet_inner_than(const struct subnet *, const struct subnet *, int);
 void enter_subnet (struct subnet *);
 void enter_lease (struct lease *);
 int supersede_lease (struct lease *, struct lease *, int, int, int);
 void make_binding_state_transition (struct lease *);
 int lease_copy (struct lease **, struct lease *, const char *, int);
 void release_lease (struct lease *, struct packet *);
 void abandon_lease (struct lease *, const char *);
 #if 0
 /* this appears to be unused and I plan to remove it SAR */
 void dissociate_lease (struct lease *);
 #endif
 void pool_timer (void *);
 int find_lease_by_uid (struct lease **, const unsigned char *,
 		       unsigned, const char *, int);
 int find_lease_by_hw_addr (struct lease **, const unsigned char *,
 			   unsigned, const char *, int);
 int find_lease_by_ip_addr (struct lease **, struct iaddr,
 			   const char *, int);
 void uid_hash_add (struct lease *);
 void uid_hash_delete (struct lease *);
 void hw_hash_add (struct lease *);
 void hw_hash_delete (struct lease *);
 int write_leases (void);
 int write_leases6(void);
 @@ -3504,29 +3522,33 @@ isc_result_t create_lease6(struct ipv6_p
 			   unsigned int *attempts,
 			   const struct data_string *uid,
 			   time_t soft_lifetime_end_time);
 isc_result_t add_lease6(struct ipv6_pool *pool,
 			struct iasubopt *lease,
 			time_t valid_lifetime_end_time);
 isc_result_t renew_lease6(struct ipv6_pool *pool, struct iasubopt *lease);
 isc_result_t expire_lease6(struct iasubopt **leasep,
 			   struct ipv6_pool *pool, time_t now);
 isc_result_t release_lease6(struct ipv6_pool *pool, struct iasubopt *lease);
 isc_result_t decline_lease6(struct ipv6_pool *pool, struct iasubopt *lease);
 isc_boolean_t lease6_exists(const struct ipv6_pool *pool,
 			    const struct in6_addr *addr);
 isc_boolean_t lease6_usable(struct iasubopt *lease);
 isc_result_t cleanup_lease6(ia_hash_t *ia_table,
 			    struct ipv6_pool *pool,
 			    struct iasubopt *lease,
 			    struct ia_xx *ia);
 isc_result_t mark_lease_unavailble(struct ipv6_pool *pool,
 				   const struct in6_addr *addr);
 isc_result_t create_prefix6(struct ipv6_pool *pool,
 			    struct iasubopt **pref,
 			    unsigned int *attempts,
 			    const struct data_string *uid,
 			    time_t soft_lifetime_end_time);
 isc_boolean_t prefix6_exists(const struct ipv6_pool *pool,
 			     const struct in6_addr *pref, u_int8_t plen);
 isc_result_t add_ipv6_pool(struct ipv6_pool *pool);
 isc_result_t find_ipv6_pool(struct ipv6_pool **pool, u_int16_t type,
 			    const struct in6_addr *addr);
 isc_boolean_t ipv6_in_pool(const struct in6_addr *addr,
 			   const struct ipv6_pool *pool);
 @@ -3538,23 +3560,23 @@ void schedule_lease_timeout(struct ipv6_
 void schedule_all_ipv6_lease_timeouts(void);
 void mark_hosts_unavailable(void);
 void mark_phosts_unavailable(void);
 void mark_interfaces_unavailable(void);
 dhcp_ddns_cb_t *ddns_cb_alloc(const char *file, int line);
 void ddns_cb_free (dhcp_ddns_cb_t *ddns_cb, const char *file, int line);
 void ddns_cb_forget_zone (dhcp_ddns_cb_t *ddns_cb);
 //void *key_from_zone(struct dns_zone *zone);
 isc_result_t
-ddns_modify_fwd(dhcp_ddns_cb_t *ddns_cb);
+ddns_modify_fwd(dhcp_ddns_cb_t *ddns_cb, const char *file, int line);
 isc_result_t
-ddns_modify_ptr(dhcp_ddns_cb_t *ddns_cb);
+ddns_modify_ptr(dhcp_ddns_cb_t *ddns_cb, const char *file, int line);
 void
-ddns_cancel(dhcp_ddns_cb_t *ddns_cb);
+ddns_cancel(dhcp_ddns_cb_t *ddns_cb, const char *file, int line);
 #define MAX_ADDRESS_STRING_LEN \
    (sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"))

 @@ -1,21 +1,21 @@
-/*	$NetBSD: ddns.c,v 1.2 2013/03/24 15:53:59 christos Exp $	*/
+/*	$NetBSD: ddns.c,v 1.3 2013/03/24 23:03:06 christos Exp $	*/
 /* ddns.c
    Dynamic DNS updates. */
 /*
- * Copyright (c) 2009-2011 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2009-2012 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 2004-2007 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 2000-2003 by Internet Software Consortium
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 @@ -26,27 +26,27 @@
  *   Redwood City, CA 94063
  *   <info@isc.org>
  *   https://www.isc.org/
+ *
  * This software has been donated to Internet Systems Consortium
  * by Damien Neil of Nominum, Inc.
+ *
  * To learn more about Internet Systems Consortium, see
  * ``https://www.isc.org/''.   To learn more about Nominum, Inc., see
  * ``http://www.nominum.com''.
  */
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: ddns.c,v 1.2 2013/03/24 15:53:59 christos Exp $");
+__RCSID("$NetBSD: ddns.c,v 1.3 2013/03/24 23:03:06 christos Exp $");
 #include "dhcpd.h"
 #include "dst/md5.h"
 #include <dns/result.h>
 #ifdef NSUPDATE
 static void ddns_fwd_srv_connector(struct lease          *lease,
 				   struct iasubopt       *lease6,
 				   struct binding_scope **inscope,
 				   dhcp_ddns_cb_t        *ddns_cb,
 				   isc_result_t           eresult);
 @@ -75,71 +75,74 @@ ddns_updates(struct packet *packet, stru
 	unsigned long ddns_ttl = DEFAULT_DDNS_TTL;
 	struct data_string ddns_hostname;
 	struct data_string ddns_domainname;
 	struct data_string old_ddns_fwd_name;
 	struct data_string ddns_fwd_name;
 	//struct data_string ddns_rev_name;
 	struct data_string ddns_dhcid;
 	struct binding_scope **scope = NULL;
 	//struct iaddr addr;
 	struct data_string d1;
 	struct option_cache *oc;
 	int s1, s2;
 	int result = 0;
 	isc_result_t rcode1 = ISC_R_SUCCESS;
 	int server_updates_a = 1;
 	//int server_updates_ptr = 1;
 	struct buffer *bp = (struct buffer *)0;
 	int ignorep = 0, client_ignorep = 0;
 	int rev_name_len;
 	int i;
 	dhcp_ddns_cb_t *ddns_cb;
 	int do_remove = 0;
 	if (ddns_update_style != 2)
 		return 0;
 	/*
 	 * sigh, I want to cancel any previous udpates before we do anything
 	 * else but this means we need to deal with the lease vs lease6
 	 * question twice.
 	 * If there is a ddns request already outstanding cancel it.
 	 */
 	if (lease != NULL) {
 		if ((old != NULL) && (old->ddns_cb != NULL)) {
-			ddns_cancel(old->ddns_cb);
+			ddns_cancel(old->ddns_cb, MDL);
 			old->ddns_cb = NULL;
+		}
 	} else if (lease6 != NULL) {
 		if ((old6 != NULL) && (old6->ddns_cb != NULL)) {
-			ddns_cancel(old6->ddns_cb);
+			ddns_cancel(old6->ddns_cb, MDL);
 			old6->ddns_cb = NULL;
+		}
 	} else {
 		log_fatal("Impossible condition at %s:%d.", MDL);
 		/* Silence compiler warnings. */
 		result = 0;
 		return(0);
+	}
 	/* allocate our control block */
 	ddns_cb = ddns_cb_alloc(MDL);
 	if (ddns_cb == NULL) {
 		return(0);
+	}
-	/* assume that we shall update both the A and ptr records */
+	/*
-	ddns_cb->flags = DDNS_UPDATE_ADDR | DDNS_UPDATE_PTR;
+	 * Assume that we shall update both the A and ptr records and,
 	 * as this is an update, set the active flag
 	 */
 	ddns_cb->flags = DDNS_UPDATE_ADDR | DDNS_UPDATE_PTR |
 		DDNS_ACTIVE_LEASE;
 	/*
 	 * For v4 we flag static leases so we don't try
 	 * and manipulate the lease later.  For v6 we don't
 	 * get static leases and don't need to flag them.
 	 */
 	if (lease != NULL) {
 		scope = &(lease->scope);
 		ddns_cb->address = lease->ip_addr;
 		if (lease->flags & STATIC_LEASE)
 			ddns_cb->flags |= DDNS_STATIC_LEASE;
 	} else if (lease6 != NULL) {
 		scope = &(lease6->scope);
 @@ -324,27 +327,27 @@ ddns_updates(struct packet *packet, stru
+	}
       in:
 	/* If we don't have a name that the client has been assigned, we
 	   can just skip all this. */
 	if ((!ddns_fwd_name.len) || (ddns_fwd_name.len > 255)) {
 		if (ddns_fwd_name.len > 255) {
 			log_error ("client provided fqdn: too long");
+		}
 		/* If desired do the removals */
 		if (do_remove != 0) {
-			(void) ddns_removals(lease, lease6, NULL);
+			(void) ddns_removals(lease, lease6, NULL, ISC_TRUE);
+		}
 		goto out;
+	}
 	/*
 	 * Compute the RR TTL.
+	 *
 	 * We have two ways of computing the TTL.
 	 * The old behavior was to allow for the customer to set up
 	 * the option or to default things.  For v4 this was 1/2
 	 * of the lease time, for v6 this was DEFAULT_DDNS_TTL.
 	 * The new behavior continues to allow the customer to set
 	 * up an option but the defaults are a little different.
 @@ -526,27 +529,31 @@ ddns_updates(struct packet *packet, stru
 						   NULL, packet->options,
 						   options, scope, oc, MDL))
 			ddns_cb->flags |= DDNS_CONFLICT_OVERRIDE;
+	}
 	/*
 	 * Previously if we failed during the removal operations
 	 * we skipped the fqdn option processing.  I'm not sure
 	 * if we want to continue with that if we fail before sending
 	 * the ddns messages.  Currently we don't.
 	 */
 	if (do_remove) {
-		rcode1 = ddns_removals(lease, lease6, ddns_cb);
+		/*
 		 * We should log a more specific error closer to the actual
 		 * error if we want one. ddns_removal failure not logged here.
 		 */
 		 (void) ddns_removals(lease, lease6, ddns_cb, ISC_TRUE);
+	}
 	else {
 		ddns_fwd_srv_connector(lease, lease6, scope, ddns_cb,
 				       ISC_R_SUCCESS);
+	}
 	ddns_cb = NULL;
       noerror:
 	/*
 	 * If fqdn-reply option is disabled in dhcpd.conf, then don't
 	 * send the client an FQDN option at all, even if one was requested.
 	 * (WinXP clients allegedly misbehave if the option is present,
 	 * refusing to handle PTR updates themselves).
 @@ -704,56 +711,77 @@ ddns_updates(struct packet *packet, stru
 	data_string_forget(&d1, MDL);
 	data_string_forget(&ddns_hostname, MDL);
 	data_string_forget(&ddns_domainname, MDL);
 	data_string_forget(&old_ddns_fwd_name, MDL);
 	data_string_forget(&ddns_fwd_name, MDL);
 	//data_string_forget(&ddns_rev_name, MDL);
 	//data_string_forget(&ddns_dhcid, MDL);
 	if (bp)
 		buffer_dereference(&bp, MDL);
 	return result;
+}
-/*
+/*%<
  * Utility function to update text strings within a lease.
+ *
  * The first issue is to find the proper scope.  Sometimes we shall be
  * called with a pointer to the scope in other cases we need to find
  * the proper lease and then get the scope.  Once we have the scope we update
  * the proper strings, as indicated by the state value in the control block.
  * Lastly, if we needed to find the scope we write it out, if we used a
  * scope that was passed as an argument we don't write it, assuming that
  * our caller (or his ...) will do the write.
+ *
  *\li ddns_cb - the control block for the DDNS request
+ *
  *\li inscope - a pointer to the scope to update.  This may be NULL
  *    in which case we use the control block to find the lease and
  *    then the scope.
+ *
  * Returns
  *\li ISC_R_SUCCESS
+ *
  *\li ISC_R_FAILURE - The routine was unable to find an expected scope.
  *    In some cases (static and inactive leases) we don't expect a scope
  *    and return success.
  */
 static isc_result_t
 ddns_update_lease_text(dhcp_ddns_cb_t        *ddns_cb,
 		       struct binding_scope **inscope)
+{
 	struct binding_scope **scope  = NULL;
 	struct lease          *lease  = NULL;
 	struct iasubopt       *lease6 = NULL;
 	struct ipv6_pool      *pool   = NULL;
 	struct in6_addr        addr;
 	struct data_string     lease_dhcid;
 	/*
 	 * If the lease was static (for a fixed address)
 	 * we don't need to do any work.
 	 */
 	if (ddns_cb->flags & DDNS_STATIC_LEASE)
 		return (ISC_R_SUCCESS);
 	/*
 	 * If we are processing an expired or released v6 lease
 	 * or some types of v4 leases we don't actually have a
 	 * scope to update
 	 */
 	if ((ddns_cb->flags & DDNS_ACTIVE_LEASE) == 0)
 		return (ISC_R_SUCCESS);
 	if (inscope != NULL) {
 		scope = inscope;
 	} else if (ddns_cb->address.len == 4) {
 		if (find_lease_by_ip_addr(&lease, ddns_cb->address, MDL) != 0){
 			scope = &(lease->scope);
+		}
 	} else if (ddns_cb->address.len == 16) {
 		memcpy(&addr, &ddns_cb->address.iabuf, 16);
 		if ((find_ipv6_pool(&pool, D6O_IA_TA, &addr) ==
 		     ISC_R_SUCCESS) ||
 		    (find_ipv6_pool(&pool, D6O_IA_NA, &addr) ==
 		     ISC_R_SUCCESS)) {
 			if (iasubopt_hash_lookup(&lease6,  pool->leases,
 @@ -1061,46 +1089,60 @@ safe_lease6_update(struct iasubopt *leas
  * addition to the address information from the cb to look up the lease.
  * using the same value twice allows me more flexibility.
  */
 static isc_result_t
 ddns_update_lease_ptr(struct lease    *lease,
 		      struct iasubopt *lease6,
 		      dhcp_ddns_cb_t  *ddns_cb,
 		      dhcp_ddns_cb_t  *ddns_cb_set,
 		      const char * file, int line)
+{
 	char ddns_address[MAX_ADDRESS_STRING_LEN];
 	sprintf(ddns_address, "unknown");
-	if (ddns_cb) {
+	if (ddns_cb == NULL) {
 		log_info("%s(%d): No control block for lease update",
 			 file, line);
 		return (ISC_R_FAILURE);
+	}
 	else {
 		strncpy(ddns_address, piaddr(ddns_cb->address),
 			MAX_ADDRESS_STRING_LEN);
+	}
 #if defined (DEBUG_DNS_UPDATES)
 	log_info("%s(%d): Updating lease_ptr for ddns_cp=%p (addr=%s)",
 		 file, line, ddns_cb, ddns_address );
 #endif
 	/*
 	 * If the lease was static (for a fixed address)
 	 * we don't need to do any work.
 	 */
 	if (ddns_cb->flags & DDNS_STATIC_LEASE) {
 #if defined (DEBUG_DNS_UPDATES)
 		log_info("lease is static, returning");
 #endif
 		return (ISC_R_SUCCESS);
+	}
 	/*
 	 * If we are processing an expired or released v6 lease
 	 * we don't actually have a lease to update
 	 */
 	if ((ddns_cb->address.len == 16) &&
 	    ((ddns_cb->flags & DDNS_ACTIVE_LEASE) == 0)) {
 		return (ISC_R_SUCCESS);
+	}
 	if (lease != NULL) {
 		safe_lease_update(lease, ddns_cb, ddns_cb_set,
 				  file, line);
 	} else if (lease6 != NULL) {
 		safe_lease6_update(lease6, ddns_cb, ddns_cb_set,
 				  file, line);
 	} else if (ddns_cb->address.len == 4) {
 		struct lease *find_lease = NULL;
 		if (find_lease_by_ip_addr(&find_lease,
 					  ddns_cb->address, MDL) != 0) {
 #if defined (DEBUG_DNS_UPDATES)
 			log_info("%s(%d): find_lease_by_ip_addr(%s) successful:"
 				 "lease=%p", file, line, ddns_address,
 @@ -1128,47 +1170,47 @@ ddns_update_lease_ptr(struct lease    *l
+		}
 	} else if (ddns_cb->address.len == 16) {
 		struct iasubopt *find_lease6 = NULL;
 		struct ipv6_pool *pool = NULL;
 		struct in6_addr addr;
 		char addrbuf[MAX_ADDRESS_STRING_LEN];
 		memcpy(&addr, &ddns_cb->address.iabuf, 16);
 		if ((find_ipv6_pool(&pool, D6O_IA_TA, &addr) !=
 		     ISC_R_SUCCESS) &&
 		    (find_ipv6_pool(&pool, D6O_IA_NA, &addr) !=
 		     ISC_R_SUCCESS)) {
-			inet_ntop(AF_INET6, &lease6->addr, addrbuf,
+			inet_ntop(AF_INET6, &addr, addrbuf,
 				  MAX_ADDRESS_STRING_LEN);
 			log_error("%s(%d): Pool for lease %s not found.",
 				  file, line, addrbuf);
 #if defined (DNS_UPDATES_MEMORY_CHECKS)
 			update_lease_failed(NULL, NULL, ddns_cb, ddns_cb_set,
 					    file, line);
 #endif
 			/*
 			 * never reached. update_lease_failed
 			 * calls log_fatal.
 			 */
 			return(ISC_R_FAILURE);
+		}
 		if (iasubopt_hash_lookup(&find_lease6, pool->leases,
 					 &addr, 16, MDL)) {
 			find_lease6->ddns_cb = ddns_cb_set;
 			iasubopt_dereference(&find_lease6, MDL);
 		} else {
-			inet_ntop(AF_INET6, &lease6->addr, addrbuf,
+			inet_ntop(AF_INET6, &addr, addrbuf,
 				  MAX_ADDRESS_STRING_LEN);
 			log_error("%s(%d): Lease %s not found within pool.",
 				  file, line, addrbuf);
 #if defined (DNS_UPDATES_MEMORY_CHECKS)
 			update_lease_failed(NULL, NULL, ddns_cb, ddns_cb_set,
 					    file, line);
 #endif
 			/*
 			 * never reached. update_lease_failed
 			 * calls log_fatal.
 			 */
 			return(ISC_R_FAILURE);
+		}
 @@ -1237,26 +1279,31 @@ ddns_ptr_remove(dhcp_ddns_cb_t *ddns_cb,
 		log_info("Removed reverse map on %.*s",
 			 (int)ddns_cb->rev_name.len,
 			 (const char *)ddns_cb->rev_name.data);
 		/* fall through */
 	case DNS_R_NXRRSET:
 	case DNS_R_NXDOMAIN:
 		/* No entry is the same as success.
 		 * Remove the information from the lease and
 		 * continue with any next step */
 		ddns_update_lease_text(ddns_cb, NULL);
 		/* trigger any add operation */
 		result = ISC_R_SUCCESS;
 #if defined (DEBUG_DNS_UPDATES)
 		log_info("DDNS: removed map or no reverse map to remove %.*s",
 			 (int)ddns_cb->rev_name.len,
 			 (const char *)ddns_cb->rev_name.data);
 #endif
 		break;
 	default:
 		log_error("Can't remove reverse map on %.*s: %s",
 			  (int)ddns_cb->rev_name.len,
 			  (const char *)ddns_cb->rev_name.data,
 			  isc_result_totext (eresult));
 		break;
+	}
 	ddns_update_lease_ptr(NULL, NULL, ddns_cb, NULL, MDL);
 	ddns_fwd_srv_connector(NULL, NULL, NULL, ddns_cb->next_op, result);
 	ddns_cb_free(ddns_cb, MDL);
 @@ -1311,27 +1358,27 @@ ddns_fwd_srv_add2(dhcp_ddns_cb_t *ddns_c
 			 ddns_address);
 		ddns_update_lease_text(ddns_cb, NULL);
 		if ((ddns_cb->flags & DDNS_UPDATE_PTR) != 0) {
 			/* if we have zone information get rid of it */
 			if (ddns_cb->zone != NULL) {
 				ddns_cb_forget_zone(ddns_cb);
+			}
 			ddns_cb->state = DDNS_STATE_ADD_PTR;
 			ddns_cb->cur_func = ddns_ptr_add;
-			result = ddns_modify_ptr(ddns_cb);
+			result = ddns_modify_ptr(ddns_cb, MDL);
 			if (result == ISC_R_SUCCESS) {
 				return;
+			}
+		}
 		break;
 	case DNS_R_YXRRSET:
 	case DNS_R_YXDOMAIN:
 		logstr = "DHCID mismatch, belongs to another client.";
 		break;
 	case DNS_R_NXRRSET:
 	case DNS_R_NXDOMAIN:
 @@ -1384,44 +1431,42 @@ ddns_fwd_srv_add1(dhcp_ddns_cb_t *ddns_c
 			  ddns_address);
 		ddns_update_lease_text(ddns_cb, NULL);
 		if ((ddns_cb->flags & DDNS_UPDATE_PTR) != 0) {
 			/* if we have zone information get rid of it */
 			if (ddns_cb->zone != NULL) {
 				ddns_cb_forget_zone(ddns_cb);
+			}
 			ddns_cb->state = DDNS_STATE_ADD_PTR;
 			ddns_cb->cur_func = ddns_ptr_add;
-			result = ddns_modify_ptr(ddns_cb);
+			result = ddns_modify_ptr(ddns_cb, MDL);
 			if (result == ISC_R_SUCCESS) {
 				return;
+			}
+		}
 		break;
 	case DNS_R_YXDOMAIN:
 		/* we can reuse the zone information */
 		ddns_cb->state = DDNS_STATE_ADD_FW_YXDHCID;
 		ddns_cb->cur_func = ddns_fwd_srv_add2;
-		result = ddns_modify_fwd(ddns_cb);
+		result = ddns_modify_fwd(ddns_cb, MDL);
 		if (result == ISC_R_SUCCESS) {
 			return;
+		}
 		break;
 	default:
 		log_error ("Unable to add forward map from %.*s to %s: %s",
 			   (int)ddns_cb->fwd_name.len,
 			   (const char *)ddns_cb->fwd_name.data,
 			   ddns_address,
 			   isc_result_totext (eresult));
 		break;
+	}
 	ddns_update_lease_ptr(NULL, NULL, ddns_cb, NULL, MDL);
 	ddns_cb_free(ddns_cb, MDL);
 @@ -1452,32 +1497,32 @@ ddns_fwd_srv_connector(struct lease
 		/* nothing to do */
 		return;
+	}
 	if (eresult == ISC_R_SUCCESS) {
 		/*
 		 * If we have updates dispatch as appropriate,
 		 * if not do FQDN binding if desired.
 		 */
 		if (ddns_cb->flags & DDNS_UPDATE_ADDR) {
 			ddns_cb->state    = DDNS_STATE_ADD_FW_NXDOMAIN;
 			ddns_cb->cur_func = ddns_fwd_srv_add1;
-			result = ddns_modify_fwd(ddns_cb);
+			result = ddns_modify_fwd(ddns_cb, MDL);
 		} else if ((ddns_cb->flags & DDNS_UPDATE_PTR) &&
 			 (ddns_cb->rev_name.len != 0)) {
 			ddns_cb->state    = DDNS_STATE_ADD_PTR;
 			ddns_cb->cur_func = ddns_ptr_add;
-			result = ddns_modify_ptr(ddns_cb);
+			result = ddns_modify_ptr(ddns_cb, MDL);
 		} else {
 			ddns_update_lease_text(ddns_cb, inscope);
+		}
+	}
 	if (result == ISC_R_SUCCESS) {
 		ddns_update_lease_ptr(lease, lease6, ddns_cb, ddns_cb, MDL);
 	} else {
 		ddns_cb_free(ddns_cb, MDL);
+	}
 	return;
+}
 @@ -1502,27 +1547,27 @@ ddns_fwd_srv_rem2(dhcp_ddns_cb_t *ddns_c
 	if (eresult == ISC_R_SUCCESS) {
 		ddns_update_lease_text(ddns_cb, NULL);
 		/* Do the next operation */
 		if ((ddns_cb->flags & DDNS_UPDATE_PTR) != 0) {
 			/* if we have zone information get rid of it */
 			if (ddns_cb->zone != NULL) {
 				ddns_cb_forget_zone(ddns_cb);
+			}
 			ddns_cb->state = DDNS_STATE_REM_PTR;
 			ddns_cb->cur_func = ddns_ptr_remove;
-			eresult = ddns_modify_ptr(ddns_cb);
+			eresult = ddns_modify_ptr(ddns_cb, MDL);
 			if (eresult == ISC_R_SUCCESS) {
 				return;
+			}
+		}
+	}
 	ddns_update_lease_ptr(NULL, NULL, ddns_cb, NULL, MDL);
 	ddns_fwd_srv_connector(NULL, NULL, NULL, ddns_cb->next_op, eresult);
 	ddns_cb_free(ddns_cb, MDL);
 	return;
+}
 @@ -1542,124 +1587,224 @@ ddns_fwd_srv_rem1(dhcp_ddns_cb_t *ddns_c
 	switch(eresult) {
 	case ISC_R_SUCCESS:
 		/* Construct a printable form of the address for logging */
 		strcpy(ddns_address, piaddr(ddns_cb->address));
 		log_info("Removed forward map from %.*s to %s",
 			 (int)ddns_cb->fwd_name.len,
 			 (const char*)ddns_cb->fwd_name.data,
 			 ddns_address);
 		/* Do the second step of the FWD removal */
 		ddns_cb->state    = DDNS_STATE_REM_FW_NXRR;
 		ddns_cb->cur_func = ddns_fwd_srv_rem2;
-		result = ddns_modify_fwd(ddns_cb);
+		result = ddns_modify_fwd(ddns_cb, MDL);
 		if (result == ISC_R_SUCCESS) {
 			return;
+		}
 		break;
 	case DNS_R_NXRRSET:
 	case DNS_R_NXDOMAIN:
 		ddns_update_lease_text(ddns_cb, NULL);
 #if defined (DEBUG_DNS_UPDATES)
 		log_info("DDNS: no forward map to remove. %p", ddns_cb);
 #endif
 		/* Do the next operation */
 		if ((ddns_cb->flags & DDNS_UPDATE_PTR) != 0) {
 			/* if we have zone information get rid of it */
 			if (ddns_cb->zone != NULL) {
 				ddns_cb_forget_zone(ddns_cb);
+			}
 			ddns_cb->state    = DDNS_STATE_REM_PTR;
 			ddns_cb->cur_func = ddns_ptr_remove;
-			result = ddns_modify_ptr(ddns_cb);
+			result = ddns_modify_ptr(ddns_cb, MDL);
 			if (result == ISC_R_SUCCESS) {
 				return;
+			}
+		}
 		else {
 			/* Trigger the add operation */
 			eresult = ISC_R_SUCCESS;
+		}
 		break;
 	default:
 		break;
+	}
 	ddns_update_lease_ptr(NULL, NULL, ddns_cb, NULL, MDL);
 	ddns_fwd_srv_connector(NULL, NULL, NULL, ddns_cb->next_op, eresult);
 	ddns_cb_free(ddns_cb, MDL);
+}
 /*%<
 /*
  * Remove relevant entries from DNS.
+ *
- * Return values:
+ * \li lease  - lease to start with if this is for v4
  * 0 - badness occurred and we weren't able to do what was wanted
- * 1 - we were able to do stuff but it's in progress
+ * \li lease6 - lease to start with if this is for v6
+ *
  * \li add_ddns_cb - control block for additional DDNS work.  This
  *     is used when the code is going to add a DDNS entry after removing
  *     the current entry.
+ *
  * \li active - indication about the status of the lease. It is
  *     ISC_TRUE if the lease is still active, and FALSE if the lease
  *     is inactive.  This is used to indicate if the lease is inactive or going
  *     to inactive so we can avoid trying to update the lease with cb pointers
  *     and text information if it isn't useful.
+ *
  * Returns
  * \li #ISC_R_FAILURE - badness occurred and we weren't able to do what was wanted
  * \li #ISC_R_SUCCESS - we were able to do stuff but it's in progress
+ *
  * in both cases any additional block has been passed on to it's handler
  */
-int
+isc_result_t
 ddns_removals(struct lease    *lease,
 	      struct iasubopt *lease6,
-	      dhcp_ddns_cb_t  *add_ddns_cb)
+	      dhcp_ddns_cb_t  *add_ddns_cb,
 	      isc_boolean_t    active)
+{
 	isc_result_t rcode, execute_add = ISC_R_FAILURE;
 	struct binding_scope **scope = NULL;
-	int result = 0;
+	isc_result_t result = ISC_R_FAILURE;
 	dhcp_ddns_cb_t        *ddns_cb = NULL;
 	struct data_string     leaseid;
 	/*
-	 * Cancel any outstanding requests.  When called
+	 * See if we need to cancel an outstanding request.  Mostly this is
-	 * from within the DNS code we probably will have
+	 * used to handle the case where this routine is called twice for
-	 * already done the cancel but if called from outside
+	 * the same release or abandon event.
 	 * - for example as part of a lease expiry - we won't.
-	 */
+	 * When called from the dns code as part of an update request
-	if ((lease != NULL) && (lease->ddns_cb != NULL)) {
+	 * (add_ddns_cb != NULL) any outstanding requests will have already
-		ddns_cancel(lease->ddns_cb);
+	 * been cancelled.
 		lease->ddns_cb = NULL;
-	} else if ((lease6 != NULL) && (lease6->ddns_cb != NULL)) {
+	 * If the new request is just a removal and we have an outstanding
-		ddns_cancel(lease6->ddns_cb);
+	 * request we have several options:
 		lease6->ddns_cb = NULL;
 	 * - we are doing an update or we are doing a removal and the active
 	 * flag has changed from TRUE to FALSE.  In these cases we  need to
 	 * cancel the old request and start the new one.
+	 *
 	 * - other wise we are doing a removal with the active flag unchanged.
 	 * In this case we can let the current removal continue and do not need
 	 * to start a new one.  If the old request included an update to be
 	 * done after the removal we need to kill the update part of the
 	 * request.
 	 */
 	if (add_ddns_cb == NULL) {
 		if ((lease != NULL) && (lease->ddns_cb != NULL)) {
 			ddns_cb = lease->ddns_cb;
 			/*
 			 * Is the old request an update or did the
 			 * the active flag change?
 			 */
 			if (((ddns_cb->state == DDNS_STATE_ADD_PTR) ||
 			     (ddns_cb->state == DDNS_STATE_ADD_FW_NXDOMAIN) ||
 			     (ddns_cb->state == DDNS_STATE_ADD_FW_YXDHCID)) ||
 			    ((active == ISC_FALSE) &&
 			     ((ddns_cb->flags & DDNS_ACTIVE_LEASE) != 0))) {
 				/* Cancel the current request */
 				ddns_cancel(lease->ddns_cb, MDL);
 				lease->ddns_cb = NULL;
 			} else {
 				/* Remvoval, check and remove updates */
 				if (ddns_cb->next_op != NULL) {
 					ddns_cb_free(ddns_cb->next_op, MDL);
 					ddns_cb->next_op = NULL;
+				}
 #if defined (DEBUG_DNS_UPDATES)
 				log_info("DDNS %s(%d): removal already in "
 					 "progress new ddns_cb=%p",
 					 MDL, ddns_cb);
 #endif
 				return (ISC_R_SUCCESS);
+			}
 		} else if ((lease6 != NULL) && (lease6->ddns_cb != NULL)) {
 			ddns_cb = lease6->ddns_cb;
 			/*
 			 * Is the old request an update or did the
 			 * the active flag change?
 			 */
 			if (((ddns_cb->state == DDNS_STATE_ADD_PTR) ||
 			     (ddns_cb->state == DDNS_STATE_ADD_FW_NXDOMAIN) ||
 			     (ddns_cb->state == DDNS_STATE_ADD_FW_YXDHCID)) ||
 			    ((active == ISC_FALSE) &&
 			     ((ddns_cb->flags & DDNS_ACTIVE_LEASE) != 0))) {
 				/* Cancel the current request */
 				ddns_cancel(lease6->ddns_cb, MDL);
 				lease6->ddns_cb = NULL;
 			} else {
 				/* Remvoval, check and remove updates */
 				if (ddns_cb->next_op != NULL) {
 					ddns_cb_free(ddns_cb->next_op, MDL);
 					ddns_cb->next_op = NULL;
+				}
 #if defined (DEBUG_DNS_UPDATES)
 				log_info("DDNS %s(%d): removal already in "
 					 "progress new ddns_cb=%p",
 					 MDL, ddns_cb);
 #endif
 				return (ISC_R_SUCCESS);
+			}
+		}
 		ddns_cb = NULL;
+	}
 	/* allocate our control block */
 	ddns_cb = ddns_cb_alloc(MDL);
 	if (ddns_cb == NULL) {
 		goto cleanup;
+	}
 	/*
 	 * For v4 we flag static leases so we don't try
 	 * and manipulate the lease later.  For v6 we don't
 	 * get static leases and don't need to flag them.
 	 */
 	if (lease != NULL) {
 		scope = &(lease->scope);
 		ddns_cb->address = lease->ip_addr;
 		if (lease->flags & STATIC_LEASE)
 			ddns_cb->flags |= DDNS_STATIC_LEASE;
 	} else if (lease6 != NULL) {
 		scope = &(lease6->scope);
 		memcpy(&ddns_cb->address.iabuf, lease6->addr.s6_addr, 16);
 		ddns_cb->address.len = 16;
 	} else
 		goto cleanup;
 	/*
 	 * Set the flag bit if the lease is active, that is it isn't
 	 * expired or released.  This is used to determine if we need
 	 * to update the scope information for both v4 and v6 and
 	 * the lease information for v6 when the response
 	 * from the DNS code is processed.
 	 */
 	if (active == ISC_TRUE) {
 		ddns_cb->flags |= DDNS_ACTIVE_LEASE;
+	}
 	/* No scope implies that DDNS has not been performed for this lease. */
 	if (*scope == NULL)
 		goto cleanup;
 	if (ddns_update_style != 2)
 		goto cleanup;
 	/* Assume that we are removing both records */
 	ddns_cb->flags |= DDNS_UPDATE_ADDR | DDNS_UPDATE_PTR;
 	/* and that we want to do the add call */
 	execute_add = ISC_R_SUCCESS;
 @@ -1724,31 +1869,31 @@ ddns_removals(struct lease    *lease,
 	/*
 	 * Now that we've collected the information we can try to process it.
 	 * If necessary we call an appropriate routine to send a message and
 	 * provide it with an action routine to run on the control block given
 	 * the results of the message.  We have three entry points from here,
 	 * one for removing the A record, the next for removing the PTR and
 	 * the third for doing any requested add.
 	 */
 	if ((ddns_cb->flags & DDNS_UPDATE_ADDR) != 0) {
 		if (ddns_cb->fwd_name.len != 0) {
 			ddns_cb->state    = DDNS_STATE_REM_FW_YXDHCID;
 			ddns_cb->cur_func = ddns_fwd_srv_rem1;
-			rcode = ddns_modify_fwd(ddns_cb);
+			rcode = ddns_modify_fwd(ddns_cb, MDL);
 			if (rcode == ISC_R_SUCCESS) {
 				ddns_update_lease_ptr(lease, lease6, ddns_cb,
 						      ddns_cb, MDL);
-				return(1);
+				return (ISC_R_SUCCESS);
+			}
 			/*
 			 * We weren't able to process the request tag the
 			 * add so we won't execute it.
 			 */
 			execute_add = ISC_R_FAILURE;
 			goto cleanup;
+		}
 		else {
 			/*remove info from scope */
 			unset(*scope, "ddns-fwd-name");
 			unset(*scope, "ddns-txt");
 @@ -1761,44 +1906,44 @@ ddns_removals(struct lease    *lease,
 		/*
 		 * if execute add isn't success remove the control block so
 		 * it won't be processed when the remove completes.  We
 		 * also arrange to clean it up and get rid of it.
 		 */
 		if (execute_add != ISC_R_SUCCESS) {
 		   	ddns_cb->next_op = NULL;
 			ddns_fwd_srv_connector(lease, lease6, scope,
 					       add_ddns_cb, execute_add);
 			add_ddns_cb = NULL;
+		}
 		else {
-			result = 1;
+			result = ISC_R_SUCCESS;
+		}
-		rcode = ddns_modify_ptr(ddns_cb);
+		rcode = ddns_modify_ptr(ddns_cb, MDL);
 		if (rcode == ISC_R_SUCCESS) {
 			ddns_update_lease_ptr(lease, lease6, ddns_cb, ddns_cb,
 					      MDL);
-			return(result);
+			return (result);
+		}
 		/* We weren't able to process the request tag the
 		 * add so we won't execute it */
 		execute_add = ISC_R_FAILURE;
 		goto cleanup;
+	}
  cleanup:
 	/*
 	 * We've gotten here because we didn't need to send a message or
 	 * we failed when trying to do so.  We send the additional cb
 	 * off to handle sending and/or cleanup and cleanup anything
 	 * we allocated here.
 	 */
 	ddns_fwd_srv_connector(lease, lease6, scope, add_ddns_cb, execute_add);
 	if (ddns_cb != NULL)
 		ddns_cb_free(ddns_cb, MDL);
-	return(result);
+	return (result);
+}
 #endif /* NSUPDATE */

 @@ -1,17 +1,17 @@
-/*	$NetBSD: dhcpv6.c,v 1.2 2013/03/24 15:53:59 christos Exp $	*/
+/*	$NetBSD: dhcpv6.c,v 1.3 2013/03/24 23:03:06 christos Exp $	*/
 /*
- * Copyright (C) 2006-2011 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006-2012 by Internet Systems Consortium, Inc. ("ISC")
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  * PERFORMANCE OF THIS SOFTWARE.
  */
 @@ -564,26 +564,27 @@ exit:
+ *
  *   -  The message includes an IA option.
  */
 static int
 valid_client_info_req(struct packet *packet, struct data_string *server_id) {
 	int ret_val;
 	struct option_cache *oc;
 	struct data_string client_id;
 	char client_id_str[80];	/* print_hex_1() uses maximum 60 characters,
 				   plus a few more for extra information */
 	ret_val = 0;
 	memset(server_id, 0, sizeof(*server_id));
 	memset(&client_id, 0, sizeof(client_id));
 	/*
 	 * Make a string that we can print out to give more
 	 * information about the client if we need to.
+	 *
 	 * By RFC 3315, Section 18.1.5 clients SHOULD have a
 	 * client-id on an Information-request packet, but it
 	 * is not strictly necessary.
 	 */
 	if (get_client_id(packet, &client_id) == ISC_R_SUCCESS) {
 		snprintf(client_id_str, sizeof(client_id_str), " (CLIENTID %s)",
 			 print_hex_1(client_id.len, client_id.data, 60));
 		data_string_forget(&client_id, MDL);
 @@ -1084,42 +1085,42 @@ static isc_result_t
 try_client_v6_prefix(struct iasubopt **pref,
 		     struct ipv6_pool *pool,
 		     const struct data_string *requested_pref)
+{
 	u_int8_t tmp_plen;
 	struct in6_addr tmp_pref;
 	struct iaddr ia;
 	isc_result_t result;
 	if (requested_pref->len < sizeof(tmp_plen) + sizeof(tmp_pref)) {
 		return DHCP_R_INVALIDARG;
+	}
 	tmp_plen = (int) requested_pref->data[0];
-	if ((tmp_plen < 3) || (tmp_plen > 128)) {
+	if ((tmp_plen < 3) || (tmp_plen > 128) ||
 	    ((int)tmp_plen != pool->units)) {
 		return ISC_R_FAILURE;
+	}
 	memcpy(&tmp_pref, requested_pref->data + 1, sizeof(tmp_pref));
 	if (IN6_IS_ADDR_UNSPECIFIED(&tmp_pref)) {
 		return ISC_R_FAILURE;
+	}
 	ia.len = 16;
 	memcpy(&ia.iabuf, &tmp_pref, 16);
 	if (!is_cidr_mask_valid(&ia, (int) tmp_plen)) {
 		return ISC_R_FAILURE;
+	}
-	if (((int)tmp_plen != pool->units) ||
+	if (!ipv6_in_pool(&tmp_pref, pool)) {
-	    !ipv6_in_pool(&tmp_pref, pool)) {
+		return ISC_R_ADDRNOTAVAIL;
 		return ISC_R_FAILURE;
+	}
 	if (prefix6_exists(pool, &tmp_pref, tmp_plen)) {
 		return ISC_R_ADDRINUSE;
+	}
 	result = iasubopt_allocate(pref, MDL);
 	if (result != ISC_R_SUCCESS) {
 		return result;
+	}
 	(*pref)->addr = tmp_pref;
 	(*pref)->plen = tmp_plen;
 @@ -1199,83 +1200,97 @@ pick_v6_prefix(struct iasubopt **pref, i
 			return ISC_R_SUCCESS;
+		}
+	}
 	/*
 	 * If we failed to pick an IPv6 prefix
 	 * Presumably that means we have no prefixes for the client.
 	 */
 	log_debug("Unable to pick client prefix: no prefixes available");
 	return ISC_R_NORESOURCES;
+}
 /*
  *! \file server/dhcpv6.c
+ *
  * \brief construct a reply containing information about a client's lease
+ *
  * lease_to_client() is called from several messages to construct a
  * reply that contains all that we know about the client's correct lease
  * (or projected lease).
+ *
  * Solicit - "Soft" binding, ignore unknown addresses or bindings, just
  *	     send what we "may" give them on a request.
+ *
  * Request - "Hard" binding, but ignore supplied addresses (just provide what
  *	     the client should really use).
+ *
  * Renew   - "Hard" binding, but client-supplied addresses are 'real'.  Error
  * Rebind    out any "wrong" addresses the client sends.  This means we send
  *	     an empty IA_NA with a status code of NoBinding or NotOnLink or
  *	     possibly send the address with zeroed lifetimes.
+ *
  * Information-Request - No binding.
+ *
  * The basic structure is to traverse the client-supplied data first, and
  * validate and echo back any contents that can be.  If the client-supplied
  * data does not error out (on renew/rebind as above), but we did not send
  * any addresses, attempt to allocate one.
+ *
  * At the end of the this function we call commit_leases_timed() to
  * fsync and rotate the file as necessary.  commit_leases_timed() will
  * check that we have written at least one lease to the file and that
  * some time has passed before doing any fsync or file rewrite so we
  * don't bother tracking if we did a write_ia during this function.
  */
 /* TODO: look at client hints for lease times */
 static void
 lease_to_client(struct data_string *reply_ret,
 		struct packet *packet,
 		const struct data_string *client_id,
 		const struct data_string *server_id)
+{
 	static struct reply_state reply;
 	struct option_cache *oc;
 	struct data_string packet_oro;
-	isc_boolean_t no_resources_avail;
+#if defined (RFC3315_PRE_ERRATA_2010_08)
 	isc_boolean_t no_resources_avail = ISC_FALSE;
 #endif
 	memset(&packet_oro, 0, sizeof(packet_oro));
 	/* Locate the client.  */
 	if (shared_network_from_packet6(&reply.shared,
 					packet) != ISC_R_SUCCESS)
 		goto exit;
 	/*
 	 * Initialize the reply.
 	 */
 	packet_reference(&reply.packet, packet, MDL);
 	data_string_copy(&reply.client_id, client_id, MDL);
 	if (!start_reply(packet, client_id, server_id, &reply.opt_state,
 			 &reply.buf.reply))
 		goto exit;
 	/* Set the write cursor to just past the reply header. */
 	reply.cursor = REPLY_OPTIONS_INDEX;
 	/*
 	 * Get the ORO from the packet, if any.
 	 */
 	oc = lookup_option(&dhcpv6_universe, packet->options, D6O_ORO);
 	memset(&packet_oro, 0, sizeof(packet_oro));
 	if (oc != NULL) {
 		if (!evaluate_option_cache(&packet_oro, packet,
 					   NULL, NULL,
 					   packet->options, NULL,
 					   &global_scope, oc, MDL)) {
 			log_error("lease_to_client: error evaluating ORO.");
 			goto exit;
+		}
+	}
 	/*
 	 * Find a host record that matches from the packet, if any, and is
 	 * valid for the shared network the client is on.
 @@ -1289,103 +1304,100 @@ lease_to_client(struct data_string *repl
 		seek_shared_host(&reply.host, reply.shared);
 	/*
 	 * Check for 'hardware' matches last, as some of the synthesis methods
 	 * are not considered to be as reliable.
 	 */
 	if ((reply.host == NULL) &&
 	    find_hosts_by_duid_chaddr(&reply.host, client_id))
 		seek_shared_host(&reply.host, reply.shared);
 	/* Process the client supplied IA's onto the reply buffer. */
 	reply.ia_count = 0;
 	oc = lookup_option(&dhcpv6_universe, packet->options, D6O_IA_NA);
 	no_resources_avail = ISC_FALSE;
 	for (; oc != NULL ; oc = oc->next) {
 		isc_result_t status;
 		/* Start counting resources (addresses) offered. */
 		reply.client_resources = 0;
 		reply.resources_included = ISC_FALSE;
 		status = reply_process_ia_na(&reply, oc);
 		/*
 		 * We continue to try other IA's whether we can address
 		 * this one or not.  Any other result is an immediate fail.
 		 */
 		if ((status != ISC_R_SUCCESS) &&
 		    (status != ISC_R_NORESOURCES))
 			goto exit;
 #if defined (RFC3315_PRE_ERRATA_2010_08)
 		/*
 		 * If any address cannot be given to any IA, then set the
 		 * NoAddrsAvail status code.
 		 */
 		if (reply.client_resources == 0)
 			no_resources_avail = ISC_TRUE;
 #endif
+	}
 	oc = lookup_option(&dhcpv6_universe, packet->options, D6O_IA_TA);
 	for (; oc != NULL ; oc = oc->next) {
 		isc_result_t status;
 		/* Start counting resources (addresses) offered. */
 		reply.client_resources = 0;
 		reply.resources_included = ISC_FALSE;
 		status = reply_process_ia_ta(&reply, oc);
 		/*
 		 * We continue to try other IA's whether we can address
 		 * this one or not.  Any other result is an immediate fail.
 		 */
 		if ((status != ISC_R_SUCCESS) &&
 		    (status != ISC_R_NORESOURCES))
 			goto exit;
 #if defined (RFC3315_PRE_ERRATA_2010_08)
 		/*
 		 * If any address cannot be given to any IA, then set the
 		 * NoAddrsAvail status code.
 		 */
 		if (reply.client_resources == 0)
 			no_resources_avail = ISC_TRUE;
 #endif
+	}
 	/* Same for IA_PD's. */
 	reply.pd_count = 0;
 	oc = lookup_option(&dhcpv6_universe, packet->options, D6O_IA_PD);
 	for (; oc != NULL ; oc = oc->next) {
 		isc_result_t status;
 		/* Start counting resources (prefixes) offered. */
 		reply.client_resources = 0;
 		reply.resources_included = ISC_FALSE;
 		status = reply_process_ia_pd(&reply, oc);
 		/*
 		 * We continue to try other IA_PD's whether we can address
 		 * this one or not.  Any other result is an immediate fail.
 		 */
 		if ((status != ISC_R_SUCCESS) &&
 		    (status != ISC_R_NORESOURCES))
 			goto exit;
 		/*
 		 * If any prefix cannot be given to any IA_PD, then
 		 * set the NoPrefixAvail status code.
 		 */
 		if (reply.client_resources == 0)
 			no_resources_avail = ISC_TRUE;
+	}
 	/*
 	 * Make no reply if we gave no resources and is not
 	 * for Information-Request.
 	 */
 	if ((reply.ia_count == 0) && (reply.pd_count == 0)) {
 		if (reply.packet->dhcpv6_msg_type !=
 					    DHCPV6_INFORMATION_REQUEST)
 			goto exit;
 		/*
 		 * Because we only execute statements on a per-IA basis,
 @@ -1421,26 +1433,27 @@ lease_to_client(struct data_string *repl
+	 *
 	 * If the server cannot assign any addresses to an IA in the
 	 * message from the client, the server MUST include the IA in
 	 * the Reply message with no addresses in the IA and a Status
 	 * Code option in the IA containing status code NoAddrsAvail.
+	 *
 	 * Section 18.1.8 (Client Behavior):
+	 *
 	 * Leave unchanged any information about addresses the client has
 	 * recorded in the IA but that were not included in the IA from
 	 * the server.
 	 * Sends a Renew/Rebind if the IA is not in the Reply message.
 	 */
 #if defined (RFC3315_PRE_ERRATA_2010_08)
 	if (no_resources_avail && (reply.ia_count != 0) &&
 	    (reply.packet->dhcpv6_msg_type == DHCPV6_SOLICIT))
+	{
 		/* Set the NoAddrsAvail status code. */
 		if (!set_status_code(STATUS_NoAddrsAvail,
 				     "No addresses available for this "
 				     "interface.", reply.opt_state)) {
 			log_error("lease_to_client: Unable to set "
 				  "NoAddrsAvail status code.");
 			goto exit;
+		}
 		/* Rewind the cursor to the start. */
 @@ -1451,91 +1464,77 @@ lease_to_client(struct data_string *repl
+		 *
 		 * Status code.
 		 * Server DUID.
 		 * Client DUID.
 		 */
 		reply.buf.reply.msg_type = DHCPV6_ADVERTISE;
 		reply.cursor += store_options6((char *)reply.buf.data +
 							reply.cursor,
 					       sizeof(reply.buf) -
 					       		reply.cursor,
 					       reply.opt_state, reply.packet,
 					       required_opts_NAA,
 					       NULL);
 	} else if (no_resources_avail && (reply.ia_count == 0) &&
 		   (reply.packet->dhcpv6_msg_type == DHCPV6_SOLICIT))
 		/* Set the NoPrefixAvail status code. */
 		if (!set_status_code(STATUS_NoPrefixAvail,
 				     "No prefixes available for this "
 				     "interface.", reply.opt_state)) {
 			log_error("lease_to_client: Unable to set "
 				  "NoPrefixAvail status code.");
 			goto exit;
 		/* Rewind the cursor to the start. */
 		reply.cursor = REPLY_OPTIONS_INDEX;
 		/*
 		 * Produce an advertise that includes only:
 		 * Status code.
 		 * Server DUID.
 		 * Client DUID.
 		 */
 		reply.buf.reply.msg_type = DHCPV6_ADVERTISE;
 		reply.cursor += store_options6((char *)reply.buf.data +
 							reply.cursor,
 					       sizeof(reply.buf) -
 					       		reply.cursor,
 					       reply.opt_state, reply.packet,
 					       required_opts_NAA,
 					       NULL);
 	} else {
 		/*
 		 * Having stored the client's IA's, store any options that
 		 * will fit in the remaining space.
 		 */
 		reply.cursor += store_options6((char *)reply.buf.data +
 							reply.cursor,
 					       sizeof(reply.buf) -
 							reply.cursor,
 					       reply.opt_state, reply.packet,
 					       required_opts_solicit,
 					       &packet_oro);
+	}
 #else /* defined (RFC3315_PRE_ERRATA_2010_08) */
 	/*
 	 * Having stored the client's IA's, store any options that
 	 * will fit in the remaining space.
 	 */
 	reply.cursor += store_options6((char *)reply.buf.data + reply.cursor,
 				       sizeof(reply.buf) - reply.cursor,
 				       reply.opt_state, reply.packet,
 				       required_opts_solicit,
 				       &packet_oro);
 #endif /* defined (RFC3315_PRE_ERRATA_2010_08) */
 	/* Return our reply to the caller. */
 	reply_ret->len = reply.cursor;
 	reply_ret->buffer = NULL;
 	if (!buffer_allocate(&reply_ret->buffer, reply.cursor, MDL)) {
 		log_fatal("No memory to store Reply.");
+	}
 	memcpy(reply_ret->buffer->data, reply.buf.data, reply.cursor);
 	reply_ret->data = reply_ret->buffer->data;
 	/* If appropriate commit and rotate the lease file */
 	(void) commit_leases_timed();
       exit:
 	/* Cleanup. */
 	if (reply.shared != NULL)
 		shared_network_dereference(&reply.shared, MDL);
 	if (reply.host != NULL)
 		host_dereference(&reply.host, MDL);
 	if (reply.opt_state != NULL)
 		option_state_dereference(&reply.opt_state, MDL);
 	if (reply.packet != NULL)
 		packet_dereference(&reply.packet, MDL);
 	if (reply.client_id.data != NULL)
 		data_string_forget(&reply.client_id, MDL);
 	if (packet_oro.buffer != NULL)
 		data_string_forget(&packet_oro, MDL);
 	reply.renew = reply.rebind = reply.prefer = reply.valid = 0;
 	reply.cursor = 0;
+}
 /* Process a client-supplied IA_NA.  This may append options to the tail of
  * the reply packet being built in the reply_state structure.
  */
 static isc_result_t
 reply_process_ia_na(struct reply_state *reply, struct option_cache *ia) {
 	isc_result_t status = ISC_R_SUCCESS;
 	u_int32_t iaid;
 	unsigned ia_cursor;
 	struct option_state *packet_ia;
 @@ -1831,29 +1830,26 @@ reply_process_ia_na(struct reply_state *
 	    (reply->ia->num_iasubopt != 0)) {
 		struct iasubopt *tmp;
 		struct data_string *ia_id;
 		int i;
 		for (i = 0 ; i < reply->ia->num_iasubopt ; i++) {
 			tmp = reply->ia->iasubopt[i];
 			if (tmp->ia != NULL)
 				ia_dereference(&tmp->ia, MDL);
 			ia_reference(&tmp->ia, reply->ia, MDL);
 			/* Commit 'hard' bindings. */
 			tmp->hard_lifetime_end_time =
 				tmp->soft_lifetime_end_time;
 			tmp->soft_lifetime_end_time = 0;
 			renew_lease6(tmp->ipv6_pool, tmp);
 			schedule_lease_timeout(tmp->ipv6_pool);
 #if defined (NSUPDATE)
 			/*
 			 * Perform ddns updates.
 			 */
 			oc = lookup_option(&server_universe, reply->opt_state,
 					   SV_DDNS_UPDATES);
 			if ((oc == NULL) ||
 			    evaluate_boolean_option_cache(NULL, reply->packet,
 							  NULL, NULL,
 							reply->packet->options,
 @@ -2220,46 +2216,49 @@ reply_process_addr(struct reply_state *r
  */
 static isc_boolean_t
 address_is_owned(struct reply_state *reply, struct iaddr *addr) {
 	int i;
 	/*
 	 * This faults out addresses that don't match fixed addresses.
 	 */
 	if (reply->static_lease) {
 		if (reply->fixed.data == NULL)
 			log_fatal("Impossible condition at %s:%d.", MDL);
 		if (memcmp(addr->iabuf, reply->fixed.data, 16) == 0)
-			return ISC_TRUE;
+			return (ISC_TRUE);
-		return ISC_FALSE;
+		return (ISC_FALSE);
+	}
 	if ((reply->old_ia == NULL) || (reply->old_ia->num_iasubopt == 0))
-		return ISC_FALSE;
+		return (ISC_FALSE);
 	for (i = 0 ; i < reply->old_ia->num_iasubopt ; i++) {
 		struct iasubopt *tmp;
 		tmp = reply->old_ia->iasubopt[i];
 		if (memcmp(addr->iabuf, &tmp->addr, 16) == 0) {
 			if (lease6_usable(tmp) == ISC_FALSE) {
 				return (ISC_FALSE);
+			}
 			iasubopt_reference(&reply->lease, tmp, MDL);
-			return ISC_TRUE;
+			return (ISC_TRUE);
+		}
+	}
-	return ISC_FALSE;
+	return (ISC_FALSE);
+}
 /* Process a client-supplied IA_TA.  This may append options to the tail of
  * the reply packet being built in the reply_state structure.
  */
 static isc_result_t
 reply_process_ia_ta(struct reply_state *reply, struct option_cache *ia) {
 	isc_result_t status = ISC_R_SUCCESS;
 	u_int32_t iaid;
 	unsigned ia_cursor;
 	struct option_state *packet_ia;
 	struct option_cache *oc;
 	struct data_string ia_data, data;
 @@ -2489,29 +2488,26 @@ reply_process_ia_ta(struct reply_state *
 	    (reply->ia->num_iasubopt != 0)) {
 		struct iasubopt *tmp;
 		struct data_string *ia_id;
 		int i;
 		for (i = 0 ; i < reply->ia->num_iasubopt ; i++) {
 			tmp = reply->ia->iasubopt[i];
 			if (tmp->ia != NULL)
 				ia_dereference(&tmp->ia, MDL);
 			ia_reference(&tmp->ia, reply->ia, MDL);
 			/* Commit 'hard' bindings. */
 			tmp->hard_lifetime_end_time =
 				tmp->soft_lifetime_end_time;
 			tmp->soft_lifetime_end_time = 0;
 			renew_lease6(tmp->ipv6_pool, tmp);
 			schedule_lease_timeout(tmp->ipv6_pool);
 #if defined (NSUPDATE)
 			/*
 			 * Perform ddns updates.
 			 */
 			oc = lookup_option(&server_universe, reply->opt_state,
 					   SV_DDNS_UPDATES);
 			if ((oc == NULL) ||
 			    evaluate_boolean_option_cache(NULL, reply->packet,
 							  NULL, NULL,
 							reply->packet->options,
 @@ -2677,71 +2673,75 @@ find_client_temporaries(struct reply_sta
 		status = reply_process_is_addressed(reply,
 						    &reply->lease->scope,
 				      reply->lease->ipv6_pool->subnet->group);
 		if (status != ISC_R_SUCCESS) {
 			goto cleanup;
+		}
 		send_addr.len = 16;
 		memcpy(send_addr.iabuf, &reply->lease->addr, 16);
 		status = reply_process_send_addr(reply, &send_addr);
 		if (status != ISC_R_SUCCESS) {
 			goto cleanup;
+		}
-		if (reply->lease != NULL) {
+		/*
-			iasubopt_dereference(&reply->lease, MDL);
+		 * reply->lease can't be null as we use it above
 		 * add check if that changes
 		 */
 		iasubopt_dereference(&reply->lease, MDL);
+	}
       cleanup:
 	if (reply->lease != NULL) {
 		iasubopt_dereference(&reply->lease, MDL);
+	}
 	return status;
+}
 /*
  * This function only returns failure on 'hard' failures.  If it succeeds,
  * it will leave a lease structure behind.
  */
 static isc_result_t
 reply_process_try_addr(struct reply_state *reply, struct iaddr *addr) {
-	isc_result_t status = ISC_R_NORESOURCES;
+	isc_result_t status = ISC_R_ADDRNOTAVAIL;
 	struct ipv6_pool *pool;
 	int i;
 	struct data_string data_addr;
 	if ((reply == NULL) || (reply->shared == NULL) ||
-	    (reply->shared->ipv6_pools == NULL) || (addr == NULL) ||
+	    (addr == NULL) || (reply->lease != NULL))
-	    (reply->lease != NULL))
+		return (DHCP_R_INVALIDARG);
 		return DHCP_R_INVALIDARG;
 	if  (reply->shared->ipv6_pools == NULL)
 		return (ISC_R_ADDRNOTAVAIL);
 	memset(&data_addr, 0, sizeof(data_addr));
 	data_addr.len = addr->len;
 	data_addr.data = addr->iabuf;
 	for (i = 0 ; (pool = reply->shared->ipv6_pools[i]) != NULL ; i++) {
 		if (pool->pool_type != D6O_IA_NA)
 			continue;
 		status = try_client_v6_address(&reply->lease, pool,
 					       &data_addr);
 		if (status == ISC_R_SUCCESS)
 			break;
+	}
 	/* Note that this is just pedantry.  There is no allocation to free. */
 	data_string_forget(&data_addr, MDL);
 	/* Return just the most recent status... */
-	return status;
+	return (status);
+}
 /* Look around for an address to give the client.  First, look through the
  * old IA for addresses we can extend.  Second, try to allocate a new address.
  * Finally, actually add that address into the current reply IA.
  */
 static isc_result_t
 find_client_address(struct reply_state *reply) {
 	struct iaddr send_addr;
 	isc_result_t status = ISC_R_NORESOURCES;
 	struct iasubopt *lease, *best_lease = NULL;
 	struct binding_scope **scope;
 	struct group *group;
 @@ -2761,38 +2761,39 @@ find_client_address(struct reply_state *
+	}
 	if (reply->old_ia != NULL)  {
 		for (i = 0 ; i < reply->old_ia->num_iasubopt ; i++) {
 			struct shared_network *candidate_shared;
 			lease = reply->old_ia->iasubopt[i];
 			candidate_shared = lease->ipv6_pool->shared_network;
 			/*
 			 * Look for the best lease on the client's shared
 			 * network.
 			 */
-			if (candidate_shared == reply->shared) {
+			if ((candidate_shared == reply->shared) &&
 			    (lease6_usable(lease) == ISC_TRUE)) {
 				best_lease = lease_compare(lease, best_lease);
+			}
+		}
+	}
 	/* Try to pick a new address if we didn't find one, or if we found an
 	 * abandoned lease.
 	 */
 	if ((best_lease == NULL) || (best_lease->state == FTS_ABANDONED)) {
 		status = pick_v6_address(&reply->lease, reply->shared,
-					 &reply->client_id);
+					 &reply->ia->iaid_duid);
 	} else if (best_lease != NULL) {
 		iasubopt_reference(&reply->lease, best_lease, MDL);
 		status = ISC_R_SUCCESS;
+	}
 	/* Pick the abandoned lease as a last resort. */
 	if ((status == ISC_R_NORESOURCES) && (best_lease != NULL)) {
 		/* I don't see how this is supposed to be done right now. */
 		log_error("Reclaiming abandoned addresses is not yet "
 			  "supported.  Treating this as an out of space "
 			  "condition.");
 		/* iasubopt_reference(&reply->lease, best_lease, MDL); */
+	}
 @@ -3216,27 +3217,29 @@ reply_process_ia_pd(struct reply_state *
 	reply->preflen = -1;
 	for (; oc != NULL ; oc = oc->next) {
 		status = reply_process_prefix(reply, oc);
 		/*
 		 * Canceled means we did not allocate prefixes to the
 		 * client, but we're "done" with this IA - we set a status
 		 * code.  So transmit this reply, e.g., move on to the next
 		 * IA.
 		 */
 		if (status == ISC_R_CANCELED)
 			break;
-		if ((status != ISC_R_SUCCESS) && (status != ISC_R_ADDRINUSE))
+		if ((status != ISC_R_SUCCESS) &&
 		    (status != ISC_R_ADDRINUSE) &&
 		    (status != ISC_R_ADDRNOTAVAIL))
 			goto cleanup;
+	}
 	reply->pd_count++;
 	/*
 	 * If we fell through the above and never gave the client
 	 * a prefix, give it one now.
 	 */
 	if ((status != ISC_R_CANCELED) && (reply->client_resources == 0)) {
 		status = find_client_prefix(reply);
 		if (status == ISC_R_NORESOURCES) {
 @@ -3356,29 +3359,26 @@ reply_process_ia_pd(struct reply_state *
 	    (reply->ia->num_iasubopt != 0)) {
 		struct iasubopt *tmp;
 		struct data_string *ia_id;
 		int i;
 		for (i = 0 ; i < reply->ia->num_iasubopt ; i++) {
 			tmp = reply->ia->iasubopt[i];
 			if (tmp->ia != NULL)
 				ia_dereference(&tmp->ia, MDL);
 			ia_reference(&tmp->ia, reply->ia, MDL);
 			/* Commit 'hard' bindings. */
 			tmp->hard_lifetime_end_time =
 				tmp->soft_lifetime_end_time;
 			tmp->soft_lifetime_end_time = 0;
 			renew_lease6(tmp->ipv6_pool, tmp);
 			schedule_lease_timeout(tmp->ipv6_pool);
+		}
 		/* Remove any old ia from the hash. */
 		if (reply->old_ia != NULL) {
 			ia_id = &reply->old_ia->iaid_duid;
 			ia_hash_delete(ia_pd_active,
 				       (unsigned char *)ia_id->data,
 				       ia_id->len, MDL);
 			ia_dereference(&reply->old_ia, MDL);
+		}
 @@ -3495,28 +3495,29 @@ reply_process_prefix(struct reply_state
+	}
 	memcpy(tmp_pref.lo_addr.iabuf, iapref.data + 9, 16);
 	/* Verify the prefix belongs to the client. */
 	if (!prefix_is_owned(reply, &tmp_pref)) {
 		/* Same than for addresses. */
 		if ((reply->packet->dhcpv6_msg_type == DHCPV6_SOLICIT) ||
 		    (reply->packet->dhcpv6_msg_type == DHCPV6_REQUEST) ||
 		    (reply->packet->dhcpv6_msg_type == DHCPV6_REBIND)) {
 			status = reply_process_try_prefix(reply, &tmp_pref);
 			/* Either error out or skip this prefix. */
 			if ((status != ISC_R_SUCCESS) &&
-			    (status != ISC_R_ADDRINUSE))
+			    (status != ISC_R_ADDRINUSE) &&
 			    (status != ISC_R_ADDRNOTAVAIL))
 				goto cleanup;
 			if (reply->lease == NULL) {
 				if (reply->packet->dhcpv6_msg_type ==
 							DHCPV6_REBIND) {
 					reply->send_prefer = 0;
 					reply->send_valid = 0;
 					goto send_pref;
+				}
 				/* status remains success - ignore */
 				goto cleanup;
+			}
 @@ -3644,91 +3645,96 @@ reply_process_prefix(struct reply_state
 static isc_boolean_t
 prefix_is_owned(struct reply_state *reply, struct iaddrcidrnet *pref) {
 	struct iaddrcidrnetlist *l;
 	int i;
 	/*
 	 * This faults out prefixes that don't match fixed prefixes.
 	 */
 	if (reply->static_prefixes > 0) {
 		for (l = reply->host->fixed_prefix; l != NULL; l = l->next) {
 			if ((pref->bits == l->cidrnet.bits) &&
 			    (memcmp(pref->lo_addr.iabuf,
 				    l->cidrnet.lo_addr.iabuf, 16) == 0))
-				return ISC_TRUE;
+				return (ISC_TRUE);
+		}
-		return ISC_FALSE;
+		return (ISC_FALSE);
+	}
 	if ((reply->old_ia == NULL) ||
 	    (reply->old_ia->num_iasubopt == 0))
-		return ISC_FALSE;
+		return (ISC_FALSE);
 	for (i = 0 ; i < reply->old_ia->num_iasubopt ; i++) {
 		struct iasubopt *tmp;
 		tmp = reply->old_ia->iasubopt[i];
 		if ((pref->bits == (int) tmp->plen) &&
-		    memcmp(pref->lo_addr.iabuf, &tmp->addr, 16) == 0) {
+		    (memcmp(pref->lo_addr.iabuf, &tmp->addr, 16) == 0)) {
 			if (lease6_usable(tmp) == ISC_FALSE) {
 				return (ISC_FALSE);
+			}
 			iasubopt_reference(&reply->lease, tmp, MDL);
-			return ISC_TRUE;
+			return (ISC_TRUE);
+		}
+	}
-	return ISC_FALSE;
+	return (ISC_FALSE);
+}
 /*
  * This function only returns failure on 'hard' failures.  If it succeeds,
  * it will leave a prefix structure behind.
  */
 static isc_result_t
 reply_process_try_prefix(struct reply_state *reply,
 			 struct iaddrcidrnet *pref) {
-	isc_result_t status = ISC_R_NORESOURCES;
+	isc_result_t status = ISC_R_ADDRNOTAVAIL;
 	struct ipv6_pool *pool;
 	int i;
 	struct data_string data_pref;
 	if ((reply == NULL) || (reply->shared == NULL) ||
-	    (reply->shared->ipv6_pools == NULL) || (pref == NULL) ||
+	    (pref == NULL) || (reply->lease != NULL))
-	    (reply->lease != NULL))
+		return (DHCP_R_INVALIDARG);
 		return DHCP_R_INVALIDARG;
 	if (reply->shared->ipv6_pools == NULL)
 		return (ISC_R_ADDRNOTAVAIL);
 	memset(&data_pref, 0, sizeof(data_pref));
 	data_pref.len = 17;
 	if (!buffer_allocate(&data_pref.buffer, data_pref.len, MDL)) {
 		log_error("reply_process_try_prefix: out of memory.");
-		return ISC_R_NOMEMORY;
+		return (ISC_R_NOMEMORY);
+	}
 	data_pref.data = data_pref.buffer->data;
 	data_pref.buffer->data[0] = (u_int8_t) pref->bits;
 	memcpy(data_pref.buffer->data + 1, pref->lo_addr.iabuf, 16);
 	for (i = 0 ; (pool = reply->shared->ipv6_pools[i]) != NULL ; i++) {
 		if (pool->pool_type != D6O_IA_PD)
 			continue;
 		status = try_client_v6_prefix(&reply->lease, pool,
 					      &data_pref);
                 /* If we found it in this pool (either in use or available),
                    there is no need to look further. */
 		if ( (status == ISC_R_SUCCESS) || (status == ISC_R_ADDRINUSE) )
 			break;
+	}
 	data_string_forget(&data_pref, MDL);
 	/* Return just the most recent status... */
-	return status;
+	return (status);
+}
 /* Look around for a prefix to give the client.  First, look through the old
  * IA_PD for prefixes we can extend.  Second, try to allocate a new prefix.
  * Finally, actually add that prefix into the current reply IA_PD.
  */
 static isc_result_t
 find_client_prefix(struct reply_state *reply) {
 	struct iaddrcidrnet send_pref;
 	isc_result_t status = ISC_R_NORESOURCES;
 	struct iasubopt *prefix, *best_prefix = NULL;
 	struct binding_scope **scope;
 	int i;
 @@ -3759,28 +3765,29 @@ find_client_prefix(struct reply_state *r
 	if (reply->old_ia != NULL)  {
 		for (i = 0 ; i < reply->old_ia->num_iasubopt ; i++) {
 			struct shared_network *candidate_shared;
 			prefix = reply->old_ia->iasubopt[i];
 			candidate_shared = prefix->ipv6_pool->shared_network;
 			/*
 			 * Consider this prefix if it is in a global pool or
 			 * if it is scoped in a pool under the client's shared
 			 * network.
 			 */
-			if (candidate_shared == NULL ||
+			if (((candidate_shared == NULL) ||
-			    candidate_shared == reply->shared) {
+			     (candidate_shared == reply->shared)) &&
 			    (lease6_usable(prefix) == ISC_TRUE)) {
 				best_prefix = prefix_compare(reply, prefix,
 							     best_prefix);
+			}
+		}
+	}
 	/* Try to pick a new prefix if we didn't find one, or if we found an
 	 * abandoned prefix.
 	 */
 	if ((best_prefix == NULL) || (best_prefix->state == FTS_ABANDONED)) {
 		status = pick_v6_prefix(&reply->lease, reply->preflen,
 					reply->shared, &reply->client_id);
 	} else if (best_prefix != NULL) {
 @@ -4614,27 +4621,26 @@ iterate_over_ia_na(struct data_string *r
 					 int *, int))
+{
 	struct option_state *opt_state;
 	struct host_decl *packet_host;
 	struct option_cache *ia;
 	struct option_cache *oc;
 	/* cli_enc_... variables come from the IA_NA/IA_TA options */
 	struct data_string cli_enc_opt_data;
 	struct option_state *cli_enc_opt_state;
 	struct host_decl *host;
 	struct option_state *host_opt_state;
 	struct data_string iaaddr;
 	struct data_string fixed_addr;
 	int iaaddr_is_found;
 	char reply_data[65536];
 	struct dhcpv6_packet *reply = (struct dhcpv6_packet *)reply_data;
 	int reply_ofs = (int)(offsetof(struct dhcpv6_packet, options));
 	char status_msg[32];
 	struct iasubopt *lease;
 	struct ia_xx *existing_ia_na;
 	int i;
 	struct data_string key;
 	u_int32_t iaid;
 	/*
 	 * Initialize to empty values, in case we have to exit early.
 	 */
 @@ -4721,27 +4727,26 @@ iterate_over_ia_na(struct data_string *r
 	 * Add our options that are not associated with any IA_NA or IA_TA.
 	 */
 	reply_ofs += store_options6(reply_data+reply_ofs,
 				    sizeof(reply_data)-reply_ofs,
 				    opt_state, packet,
 				    required_opts, NULL);
 	/*
 	 * Loop through the IA_NA reported by the client, and deal with
 	 * addresses reported as already in use.
 	 */
 	for (ia = lookup_option(&dhcpv6_universe, packet->options, D6O_IA_NA);
 	     ia != NULL; ia = ia->next) {
 	     	iaaddr_is_found = 0;
 		if (!get_encapsulated_IA_state(&cli_enc_opt_state,
 					       &cli_enc_opt_data,
 					       packet, ia, IA_NA_OFFSET)) {
 			goto exit;
+		}
 		iaid = getULong(cli_enc_opt_data.data);
 		/*
 		 * XXX: It is possible that we can get multiple addresses
 		 *      sent by the client. We don't send multiple
 		 *      addresses, so this indicates a client error.
 @@ -5138,27 +5143,26 @@ iterate_over_ia_pd(struct data_string *r
+{
 	struct data_string reply_new;
 	int reply_len;
 	struct option_state *opt_state;
 	struct host_decl *packet_host;
 	struct option_cache *ia;
 	struct option_cache *oc;
 	/* cli_enc_... variables come from the IA_PD options */
 	struct data_string cli_enc_opt_data;
 	struct option_state *cli_enc_opt_state;
 	struct host_decl *host;
 	struct option_state *host_opt_state;
 	struct data_string iaprefix;
 	int iaprefix_is_found;
 	char reply_data[65536];
 	int reply_ofs;
 	struct iasubopt *prefix;
 	struct ia_xx *existing_ia_pd;
 	int i;
 	struct data_string key;
 	u_int32_t iaid;
 	/*
 	 * Initialize to empty values, in case we have to exit early.
 	 */
 	memset(&reply_new, 0, sizeof(reply_new));
 	opt_state = NULL;
 @@ -5205,27 +5209,26 @@ iterate_over_ia_pd(struct data_string *r
 		log_error("iterate_over_ia_pd: no memory for option_state.");
 		goto exit;
+	}
 	execute_statements_in_scope(NULL, packet, NULL, NULL,
 				    packet->options, opt_state,
 				    &global_scope, root_group, NULL);
 	/*
 	 * Loop through the IA_PD reported by the client, and deal with
 	 * prefixes reported as already in use.
 	 */
 	for (ia = lookup_option(&dhcpv6_universe, packet->options, D6O_IA_PD);
 	     ia != NULL; ia = ia->next) {
 	    iaprefix_is_found = 0;
 	    if (!get_encapsulated_IA_state(&cli_enc_opt_state,
 					   &cli_enc_opt_data,
 					   packet, ia, IA_PD_OFFSET)) {
 		goto exit;
+	    }
 	    iaid = getULong(cli_enc_opt_data.data);
 	    oc = lookup_option(&dhcpv6_universe, cli_enc_opt_state,
 			       D6O_IAPREFIX);
 	    if (oc == NULL) {
 		/* no prefix given for this IA_PD, ignore */
 @@ -5533,56 +5536,58 @@ dhcpv6_relay_forw(struct data_string *re
 		log_error("dhcpv6_forw_relay: "
 			  "no memory for encapsulated packet's options.");
 		goto exit;
+	}
 	enc_packet->client_port = packet->client_port;
 	enc_packet->client_addr = packet->client_addr;
 	interface_reference(&enc_packet->interface, packet->interface, MDL);
 	enc_packet->dhcpv6_container_packet = packet;
 	msg_type = enc_opt_data.data[0];
 	if ((msg_type == DHCPV6_RELAY_FORW) ||
 	    (msg_type == DHCPV6_RELAY_REPL)) {
 		int relaylen = (int)(offsetof(struct dhcpv6_relay_packet, options));
 		relay = (struct dhcpv6_relay_packet *)enc_opt_data.data;
 		enc_packet->dhcpv6_msg_type = relay->msg_type;
 		/* relay-specific data */
 		enc_packet->dhcpv6_hop_count = relay->hop_count;
 		memcpy(&enc_packet->dhcpv6_link_address,
 		       relay->link_address, sizeof(relay->link_address));
 		memcpy(&enc_packet->dhcpv6_peer_address,
 		       relay->peer_address, sizeof(relay->peer_address));
 		if (!parse_option_buffer(enc_packet->options,
 					 relay->options,
-					 enc_opt_data.len-sizeof(*relay),
+					 enc_opt_data.len - relaylen,
 					 &dhcpv6_universe)) {
 			/* no logging here, as parse_option_buffer() logs all
 			   cases where it fails */
 			goto exit;
+		}
 	} else {
 		int msglen = (int)(offsetof(struct dhcpv6_packet, options));
 		msg = (struct dhcpv6_packet *)enc_opt_data.data;
 		enc_packet->dhcpv6_msg_type = msg->msg_type;
 		/* message-specific data */
 		memcpy(enc_packet->dhcpv6_transaction_id,
 		       msg->transaction_id,
 		       sizeof(enc_packet->dhcpv6_transaction_id));
 		if (!parse_option_buffer(enc_packet->options,
 					 msg->options,
-					 enc_opt_data.len-sizeof(*msg),
+					 enc_opt_data.len - msglen,
 					 &dhcpv6_universe)) {
 			/* no logging here, as parse_option_buffer() logs all
 			   cases where it fails */
 			goto exit;
+		}
+	}
 	/*
 	 * This is recursive. It is possible to exceed maximum packet size.
 	 * XXX: This will cause the packet send to fail.
 	 */
 	build_dhcpv6_reply(&enc_reply, enc_packet);
 @@ -6031,27 +6036,27 @@ find_hosts_by_duid_chaddr(struct host_de
 	      case DUID_LL:
 		/*
 		 * Note that client_id->len must be greater than or equal
 		 * to four to get to this point in the function.
 		 */
 		hlen = client_id->len - 4;
 		chaddr = client_id->data + 4;
 		break;
 	      default:
 		break;
+	}
-	if (hlen == 0)
+	if ((hlen == 0) || (hlen > HARDWARE_ADDR_LEN))
 		return 0;
 	/*
 	 * XXX: DHCPv6 gives a 16-bit field for the htype.  DHCPv4 gives an
 	 * 8-bit field.  To change the semantics of the generic 'hardware'
 	 * structure, we would have to adjust many DHCPv4 sources (from
 	 * interface to DHCPv4 lease code), and we would have to update the
 	 * 'hardware' config directive (probably being reverse compatible and
 	 * providing a new upgrade/replacement primitive).  This is a little
 	 * too much to change for now.  Hopefully we will revisit this before
 	 * hardware types exceeding 8 bits are assigned.
 	 */
 	if ((htype & 0xFF00) && !once_htype) {

 @@ -1,34 +1,96 @@
-/*	$NetBSD: mdb6.c,v 1.2 2013/03/24 15:53:59 christos Exp $	*/
+/*	$NetBSD: mdb6.c,v 1.3 2013/03/24 23:03:06 christos Exp $	*/
 /*
- * Copyright (C) 2007-2011 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007-2012 by Internet Systems Consortium, Inc. ("ISC")
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  * PERFORMANCE OF THIS SOFTWARE.
  */
-/* TODO: assert() */
+/*!
-/* TODO: simplify functions, as pool is now in iaaddr */
+ * \todo assert()
  * \todo simplify functions, as pool is now in iaaddr
  */
 /*! \file server/mdb6.c
+ *
  * \page ipv6structures IPv6 Structures Overview
+ *
  * A brief description of the IPv6 structures as reverse engineered.
+ *
  * There are three major data strucutes involved in the database:
+ *
  * - ipv6_pool - this contains information about a pool of addresses or prefixes
  *             that the server is using.  This includes a hash table that
  *             tracks the active items and a pair of heap tables one for
  *             active items and one for non-active items.  The heap tables
  *             are used to determine the next items to be modified due to
  *             timing events (expire mostly).
  * - ia_xx   - this contains information about a single IA from a request
  *             normally it will contain one pointer to a lease for the client
  *             but it may contain more in some circumstances.  There are 3
  *             hash tables to aid in accessing these one each for NA, TA and PD.
  * - iasubopt- the v6 lease structure.  These are created dynamically when
  *             a client asks for something and will eventually be destroyed
  *             if the client doesn't re-ask for that item.  A lease has space
  *             for backpointers to the IA and to the pool to which it belongs.
  *             The pool backpointer is always filled, the IA pointer may not be.
+ *
  * In normal use we then have something like this:
+ *
  * \verbatim
  * ia hash tables
  *  ia_na_active                           +----------------+
  *  ia_ta_active          +------------+   | pool           |
  *  ia_pd_active          | iasubopt   |<--|  active hash   |
  * +-----------------+    | aka lease  |<--|  active heap   |
  * | ia_xx           |    |  pool ptr  |-->|                |
  * |  iasubopt array |<---|  iaptr     |<--|  inactive heap |
  * |   lease ptr     |--->|            |   |                |
  * +-----------------+    +------------+   +----------------+
  * \endverbatim
+ *
  * For the pool either the inactive heap will have a pointer
  * or both the active heap and the active hash will have pointers.
+ *
  * I think there are several major items to notice.   The first is
  * that as a lease moves around it will be added to and removed
  * from the address hash table in the pool and between the active
  * and inactive hash tables.  The hash table and the active heap
  * are used when the lease is either active or abandoned.  The
  * inactive heap is used for all other states.  In particular a
  * lease that has expired or been released will be cleaned
  * (DDNS removal etc) and then moved to the inactive heap.  After
  * some time period (currently 1 hour) it will be freed.
+ *
  * The second is that when a client requests specific addresses,
  * either because it previously owned them or if the server supplied
  * them as part of a solicit, the server will try to lookup the ia_xx
  * associated with the client and find the addresses there.  If it
  * does find appropriate leases it moves them from the old IA to
  * a new IA and eventually replaces the old IA with the new IA
  * in the IA hash tables.
+ *
  */
 #include "config.h"
 #include <sys/types.h>
 #include <time.h>
 #include <netinet/in.h>
 #include <stdarg.h>
 #include "dhcpd.h"
 #include "omapip/omapip.h"
 #include "omapip/hash.h"
 #include <isc/md5.h>
 HASH_FUNCTIONS(ia, unsigned char *, struct ia_xx, ia_hash_t,
 @@ -305,26 +367,28 @@ ia_add_iasubopt(struct ia_xx *ia, struct
 	return ISC_R_SUCCESS;
+}
 /*
  * Remove an IAADDR/PREFIX entry to an IA structure.
+ *
  * Note: if a suboption appears more than once, then only ONE will be removed.
  */
 void
 ia_remove_iasubopt(struct ia_xx *ia, struct iasubopt *iasubopt,
 		   const char *file, int line) {
 	int i, j;
         if (ia == NULL || iasubopt == NULL)
             return;
 	for (i=0; i<ia->num_iasubopt; i++) {
 		if (ia->iasubopt[i] == iasubopt) {
 			/* remove this sub option */
 			iasubopt_dereference(&(ia->iasubopt[i]), file, line);
 			/* move remaining suboption pointers down one */
 			for (j=i+1; j < ia->num_iasubopt; j++) {
 				ia->iasubopt[j-1] = ia->iasubopt[j];
+			}
 			/* decrease our total count */
 			/* remove the back-reference in the suboption itself */
 			ia_dereference(&iasubopt->ia, file, line);
 			ia->num_iasubopt--;
 @@ -800,35 +864,34 @@ create_lease6(struct ipv6_pool *pool, st
 			build_temporary6(&tmp, &pool->start_addr,
 					 pool->bits, &ds);
 			break;
 		case D6O_IA_PD:
 			/* prefix */
 			log_error("create_lease6: prefix pool.");
 			return DHCP_R_INVALIDARG;
 		default:
 			log_error("create_lease6: untyped pool.");
 			return DHCP_R_INVALIDARG;
+		}
 		/*
-		 * Avoid reserved interface IDs.
+		 * Avoid reserved interface IDs. (cf. RFC 5453)
 		 * (cf. draft-krishnan-ipv6-reserved-iids-02.txt)
 		 */
 		reserved_iid = ISC_FALSE;
-		if (memcmp(&tmp.s6_addr[8], &rtany, 8) == 0) {
+		if (memcmp(&tmp.s6_addr[8], &rtany.s6_addr[8], 8) == 0) {
 			reserved_iid = ISC_TRUE;
+		}
 		if (!reserved_iid &&
-		    (memcmp(&tmp.s6_addr[8], &resany, 7) == 0) &&
+		    (memcmp(&tmp.s6_addr[8], &resany.s6_addr[8], 7) == 0) &&
 		    ((tmp.s6_addr[15] & 0x80) == 0x80)) {
 			reserved_iid = ISC_TRUE;
+		}
 		/*
 		 * If this address is not in use, we're happy with it
 		 */
 		test_iaaddr = NULL;
 		if (!reserved_iid &&
 		    (iasubopt_hash_lookup(&test_iaaddr, pool->leases,
 					  &tmp, sizeof(tmp), MDL) == 0)) {
 			break;
+		}
 @@ -867,26 +930,165 @@ create_lease6(struct ipv6_pool *pool, st
 	memcpy(&iaaddr->addr, &tmp, sizeof(iaaddr->addr));
 	/*
 	 * Add the lease to the pool (note state is free, not active?!).
 	 */
 	result = add_lease6(pool, iaaddr, soft_lifetime_end_time);
 	if (result == ISC_R_SUCCESS) {
 		iasubopt_reference(addr, iaaddr, MDL);
+	}
 	iasubopt_dereference(&iaaddr, MDL);
 	return result;
+}
 /*!
+ *
  * \brief Cleans up leases when reading from a lease file
+ *
  * This function is only expected to be run when reading leases in from a file.
  * It checks to see if a lease already exists for the new leases's address.
  * We don't add expired leases to the structures when reading a lease file
  * which limits what can happen.  We have two variables the owners of the leases
  * being the same or different and the new lease being active or non-active:
  * Owners active
  * same   no     remove old lease and its connections
  * same   yes    nothing to do, other code will update the structures.
  * diff   no     nothing to do
  * diff   yes    this combination shouldn't happen, we should only have a
  *               single active lease per address at a time and that lease
  *               should move to non-active before any other lease can
  *               become active for that address.
  *               Currently we delete the previous lease and pass an error
  *               to the caller who should log an error.
+ *
  * When we remove a lease we remove it from the hash table and active heap
  * (remember only active leases are in the structures at this time) for the
  * pool, and from the IA's array.  If, after we've removed the pointer from
  * IA's array to the lease, the IA has no more pointers we remove it from
  * the appropriate hash table as well.
+ *
  * \param[in] ia_table = the hash table for the IA
  * \param[in] pool     = the pool to update
  * \param[in] lease    = the new lease we want to add
  * \param[in] ia       = the new ia we are building
+ *
  * \return
  * ISC_R_SUCCESS = the incoming lease and any previous lease were in
  *                 an expected state - one of the first 3 options above.
  *                 If necessary the old lease was removed.
  * ISC_R_FAILURE = there is already an active lease for the address in
  *                 the incoming lease.  This shouldn't happen if it does
  *                 flag an error for the caller to log.
  */
 isc_result_t
 cleanup_lease6(ia_hash_t *ia_table,
 	       struct ipv6_pool *pool,
 	       struct iasubopt *lease,
 	       struct ia_xx *ia) {
 	struct iasubopt *test_iasubopt, *tmp_iasubopt;
 	struct ia_xx *old_ia;
 	isc_result_t status = ISC_R_SUCCESS;
 	test_iasubopt = NULL;
 	old_ia = NULL;
 	/*
 	 * Look up the address - if we don't find a lease
 	 * we don't need to do anything.
 	 */
 	if (iasubopt_hash_lookup(&test_iasubopt, pool->leases,
 				 &lease->addr, sizeof(lease->addr),
 				 MDL) == 0) {
 		return (ISC_R_SUCCESS);
+	}
 	if (test_iasubopt->ia == NULL) {
 		/* no old ia, no work to do */
 		iasubopt_dereference(&test_iasubopt, MDL);
 		return (status);
+	}
 	ia_reference(&old_ia, test_iasubopt->ia, MDL);
 	if ((old_ia->iaid_duid.len == ia->iaid_duid.len) &&
 	    (memcmp((unsigned char *)ia->iaid_duid.data,
 		    (unsigned char *)old_ia->iaid_duid.data,
 		    ia->iaid_duid.len) == 0)) {
 		/* same IA */
 		if ((lease->state == FTS_ACTIVE) ||
 		    (lease->state == FTS_ABANDONED)) {
 			/* still active, no need to delete */
 			goto cleanup;
+		}
 	} else {
 		/* different IA */
 		if ((lease->state != FTS_ACTIVE) &&
 		    (lease->state != FTS_ABANDONED)) {
 			/* new lease isn't active, no work */
 			goto cleanup;
+		}
 		/*
 		 * We appear to have two active leases, this shouldn't happen.
 		 * Before a second lease can be set to active the first lease
 		 * should be set to inactive (released, expired etc). For now
 		 * delete the previous lease and indicate a failure to the
 		 * caller so it can generate a warning.
 		 * In the future we may try and determine which is the better
 		 * lease to keep.
 		 */
 		status = ISC_R_FAILURE;
+	}
 	/*
 	 * Remove the old lease from the active heap and from the hash table
 	 * then remove the lease from the IA and clean up the IA if necessary.
 	 */
 	isc_heap_delete(pool->active_timeouts, test_iasubopt->heap_index);
 	pool->num_active--;
 	iasubopt_hash_delete(pool->leases, &test_iasubopt->addr,
 			     sizeof(test_iasubopt->addr), MDL);
 	ia_remove_iasubopt(old_ia, test_iasubopt, MDL);
 	if (old_ia->num_iasubopt <= 0) {
 		ia_hash_delete(ia_table,
 			       (unsigned char *)old_ia->iaid_duid.data,
 			       old_ia->iaid_duid.len, MDL);
+	}
 	/*
 	 * We derefenrece the subopt here as we've just removed it from
 	 * the hash table in the pool.  We need to make a copy as we
 	 * need to derefernece it again later.
 	 */
 	tmp_iasubopt = test_iasubopt;
 	iasubopt_dereference(&tmp_iasubopt, MDL);
       cleanup:
 	ia_dereference(&old_ia, MDL);
 	/*
 	 * Clean up the reference, this is in addition to the deference
 	 * above after removing the entry from the hash table
 	 */
 	iasubopt_dereference(&test_iasubopt, MDL);
 	return (status);
+}
 /*
  * Put a lease in the pool directly. This is intended to be used when
  * loading leases from the file.
  */
 isc_result_t
 add_lease6(struct ipv6_pool *pool, struct iasubopt *lease,
 	   time_t valid_lifetime_end_time) {
 	isc_result_t insert_result;
 	struct iasubopt *test_iasubopt;
 	struct iasubopt *tmp_iasubopt;
 	/* If a state was not assigned by the caller, assume active. */
 	if (lease->state == 0)
 @@ -977,70 +1179,122 @@ isc_boolean_t
 lease6_exists(const struct ipv6_pool *pool, const struct in6_addr *addr) {
 	struct iasubopt *test_iaaddr;
 	test_iaaddr = NULL;
 	if (iasubopt_hash_lookup(&test_iaaddr, pool->leases,
 				 (void *)addr, sizeof(*addr), MDL)) {
 		iasubopt_dereference(&test_iaaddr, MDL);
 		return ISC_TRUE;
 	} else {
 		return ISC_FALSE;
+	}
+}
 /*!
+ *
  * \brief Check if address is available to a lease
+ *
  * Determine if the address in the lease is available to that
  * lease.  Either the address isn't in use or it is in use
  * but by that lease.
+ *
  * \param[in] lease = lease to check
+ *
  * \return
  * ISC_TRUE  = The lease is allowed to use that address
  * ISC_FALSE = The lease isn't allowed to use that address
  */
 isc_boolean_t
 lease6_usable(struct iasubopt *lease) {
 	struct iasubopt *test_iaaddr;
 	isc_boolean_t status = ISC_TRUE;
 	test_iaaddr = NULL;
 	if (iasubopt_hash_lookup(&test_iaaddr, lease->ipv6_pool->leases,
 				 (void *)&lease->addr,
 				 sizeof(lease->addr), MDL)) {
 		if (test_iaaddr != lease) {
 			status = ISC_FALSE;
+		}
 		iasubopt_dereference(&test_iaaddr, MDL);
+	}
 	return (status);
+}
 /*
  * Put the lease on our active pool.
  */
 static isc_result_t
 move_lease_to_active(struct ipv6_pool *pool, struct iasubopt *lease) {
 	isc_result_t insert_result;
 	int old_heap_index;
 	old_heap_index = lease->heap_index;
 	insert_result = isc_heap_insert(pool->active_timeouts, lease);
 	if (insert_result == ISC_R_SUCCESS) {
        		iasubopt_hash_add(pool->leases, &lease->addr,
 				  sizeof(lease->addr), lease, MDL);
 		isc_heap_delete(pool->inactive_timeouts, old_heap_index);
 		pool->num_active++;
 		pool->num_inactive--;
 		lease->state = FTS_ACTIVE;
+	}
 	return insert_result;
+}
-/*
+/*!
- * Renew an lease in the pool.
+ * \brief Renew a lease in the pool.
+ *
  * The hard_lifetime_end_time of the lease should be set to
  * the current expiration time.
  * The soft_lifetime_end_time of the lease should be set to
  * the desired expiration time.
+ *
  * This routine will compare the two and call the correct
  * heap routine to move the lease.  If the lease is active
  * and the new expiration time is greater (the normal case)
  * then we call isc_heap_decreased() as a larger time is a
  * lower priority.  If the new expiration time is less then
  * we call isc_heap_increased().
+ *
  * If the lease is abandoned then it will be on the active list
  * and we will always call isc_heap_increased() as the previous
  * expiration would have been all 1s (as close as we can get
  * to infinite).
+ *
- * To do this, first set the new hard_lifetime_end_time for the resource,
+ * If the lease is moving to active we call that routine
- * and then invoke renew_lease6() on it.
+ * which will move it from the inactive list to the active list.
+ *
- * WARNING: lease times must only be extended, never reduced!!!
+ * \param pool a pool the lease belongs to
  * \param lease the lease to be renewed
+ *
  * \return result of the renew operation (ISC_R_SUCCESS if successful,
            ISC_R_NOMEMORY when run out of memory)
  */
 isc_result_t
 renew_lease6(struct ipv6_pool *pool, struct iasubopt *lease) {
-	/*
+	time_t old_end_time = lease->hard_lifetime_end_time;
-	 * If we're already active, then we can just move our expiration
+	lease->hard_lifetime_end_time = lease->soft_lifetime_end_time;
-	 * time down the heap.
+	lease->soft_lifetime_end_time = 0;
 	 * If we're abandoned then we are already on the active list
 	 * but we need to retag the lease and move our expiration
 	 * from infinite to the current value
 	 * Otherwise, we have to move from the inactive heap to the
 	 * active heap.
 	 */
 	if (lease->state == FTS_ACTIVE) {
-		isc_heap_decreased(pool->active_timeouts, lease->heap_index);
+		if (old_end_time <= lease->hard_lifetime_end_time) {
 			isc_heap_decreased(pool->active_timeouts,
 					   lease->heap_index);
 		} else {
 			isc_heap_increased(pool->active_timeouts,
 					   lease->heap_index);
+		}
 		return ISC_R_SUCCESS;
 	} else if (lease->state == FTS_ABANDONED) {
 		char tmp_addr[INET6_ADDRSTRLEN];
                 lease->state = FTS_ACTIVE;
                 isc_heap_increased(pool->active_timeouts, lease->heap_index);
 		log_info("Reclaiming previously abandoned address %s",
 			 inet_ntop(AF_INET6, &(lease->addr), tmp_addr,
 				   sizeof(tmp_addr)));
                 return ISC_R_SUCCESS;
 	} else {
 		return move_lease_to_active(pool, lease);
+	}
+}
 @@ -1050,27 +1304,27 @@ renew_lease6(struct ipv6_pool *pool, str
  */
 static isc_result_t
 move_lease_to_inactive(struct ipv6_pool *pool, struct iasubopt *lease,
 		       binding_state_t state) {
 	isc_result_t insert_result;
 	int old_heap_index;
 	old_heap_index = lease->heap_index;
 	insert_result = isc_heap_insert(pool->inactive_timeouts, lease);
 	if (insert_result == ISC_R_SUCCESS) {
 #if defined (NSUPDATE)
 		/* Process events upon expiration. */
 		if (pool->pool_type != D6O_IA_PD) {
-			ddns_removals(NULL, lease, NULL);
+			(void) ddns_removals(NULL, lease, NULL, ISC_FALSE);
+		}
 #endif
 		/* Binding scopes are no longer valid after expiry or
 		 * release.
 		 */
 		if (lease->scope != NULL) {
 			binding_scope_dereference(&lease->scope, MDL);
+		}
 		iasubopt_hash_delete(pool->leases,
 				     &lease->addr, sizeof(lease->addr), MDL);
 		isc_heap_delete(pool->active_timeouts, old_heap_index);
 @@ -1458,53 +1712,53 @@ cleanup_old_expired(struct ipv6_pool *po
 static void
 lease_timeout_support(void *vpool) {
 	struct ipv6_pool *pool;
 	struct iasubopt *lease;
 	pool = (struct ipv6_pool *)vpool;
 	for (;;) {
 		/*
 		 * Get the next lease scheduled to expire.
+		 *
 		 * Note that if there are no leases in the pool,
 		 * expire_lease6() will return ISC_R_SUCCESS with
 		 * a NULL lease.
+		 *
 		 * expire_lease6() will call move_lease_to_inactive() which
 		 * calls ddns_removals() do we want that on the standard
 		 * expiration timer or a special 'depref' timer?  Original
 		 * query from DH, moved here by SAR.
 		 */
 		lease = NULL;
 		if (expire_lease6(&lease, pool, cur_time) != ISC_R_SUCCESS) {
 			break;
+		}
 		if (lease == NULL) {
 			break;
+		}
 		/* Look to see if there were ddns updates, and if
 		 * so, drop them.
 		 * DH: Do we want to do this on a special 'depref'
 		 * timer rather than expiration timer?
 		 */
 #if defined (NSUPDATE)
 		if (pool->pool_type != D6O_IA_PD) {
 			ddns_removals(NULL, lease, NULL);
 #endif
 		write_ia(lease->ia);
 		iasubopt_dereference(&lease, MDL);
+	}
 	/*
 	 * If appropriate commit and rotate the lease file
 	 * As commit_leases_timed() checks to see if we've done any writes
 	 * we don't bother tracking if this function called write _ia
 	 */
 	(void) commit_leases_timed();
 	/*
 	 * Do some cleanup of our expired leases.
 	 */
 	cleanup_old_expired(pool);
 	/*
 	 * Schedule next round of expirations.
 	 */
 	schedule_lease_timeout(pool);
+}
 /*
  * For a given pool, add a timer that will remove the next
  * lease to expire.
 @@ -1683,29 +1937,28 @@ change_leases(struct ia_xx *ia,
 			renew_retval = change_func(pool, ia->iasubopt[i]);
 			if (renew_retval != ISC_R_SUCCESS) {
 				retval = renew_retval;
+			}
+		}
 		/* XXXsk: should we warn if we don't find a pool? */
+	}
 	return retval;
+}
 /*
  * Renew all leases in an IA from all pools.
+ *
- * The new hard_lifetime_end_time should be updated for the addresses/prefixes.
+ * The new lifetime should be in the soft_lifetime_end_time
  * and will be moved to hard_lifetime_end_time by renew_lease6.
  * WARNING: lease times must only be extended, never reduced!!!
  */
 isc_result_t
 renew_leases(struct ia_xx *ia) {
 	return change_leases(ia, renew_lease6);
+}
 /*
  * Release all leases in an IA from all pools.
  */
 isc_result_t
 release_leases(struct ia_xx *ia) {
 	return change_leases(ia, release_lease6);
+}
 @@ -1883,675 +2136,14 @@ mark_interfaces_unavailable(void) {
 				ipv6_pool_dereference(&p, MDL);
+			}
 			if (find_ipv6_pool(&p, D6O_IA_TA, &ip->v6addresses[i])
 							== ISC_R_SUCCESS) {
 				mark_lease_unavailable(p,
 						       &ip->v6addresses[i]);
 				ipv6_pool_dereference(&p, MDL);
+			}
+		}
 		ip = ip->next;
+	}
+}
 /* unittest moved to server/tests/mdb6_unittest.c */
 #ifdef UNIT_TEST
 #include <stdlib.h>
 int
 main(int argc, char *argv[]) {
 	struct iasubopt *iaaddr;
 	struct iasubopt *iaaddr_copy;
 	u_int32_t iaid;
 	struct ia_xx *ia_na;
 	struct ia_xx *ia_na_copy;
 	int i;
 	struct in6_addr addr;
 	struct ipv6_pool *pool;
 	struct ipv6_pool *pool_copy;
 	char addr_buf[INET6_ADDRSTRLEN];
 	char *uid;
 	struct data_string ds;
 	struct iasubopt *expired_iaaddr;
 	unsigned int attempts;
 	/*
 	 * Test 0: Basic iaaddr manipulation.
 	 */
 	iaaddr = NULL;
 	if (iasubopt_allocate(&iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_allocate() %s:%d\n", MDL);
 		return 1;
 	if (iaaddr->state != FTS_FREE) {
 		printf("ERROR: bad state %s:%d\n", MDL);
 		return 1;
 	if (iaaddr->heap_index != -1) {
 		printf("ERROR: bad heap_index %s:%d\n", MDL);
 		return 1;
 	iaaddr_copy = NULL;
 	if (iasubopt_reference(&iaaddr_copy, iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_reference() %s:%d\n", MDL);
 		return 1;
 	if (iasubopt_dereference(&iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_reference() %s:%d\n", MDL);
 		return 1;
 	if (iasubopt_dereference(&iaaddr_copy, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_reference() %s:%d\n", MDL);
 		return 1;
 	/*
 	 * Test 1: Error iaaddr manipulation.
 	 */
 	/* bogus allocate arguments */
 	if (iasubopt_allocate(NULL, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: iasubopt_allocate() %s:%d\n", MDL);
 		return 1;
 	iaaddr = (struct iasubopt *)1;
 	if (iasubopt_allocate(&iaaddr, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: iasubopt_allocate() %s:%d\n", MDL);
 		return 1;
 	/* bogus reference arguments */
 	iaaddr = NULL;
 	if (iasubopt_allocate(&iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_allocate() %s:%d\n", MDL);
 		return 1;
 	if (iasubopt_reference(NULL, iaaddr, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: iasubopt_reference() %s:%d\n", MDL);
 		return 1;
 	iaaddr_copy = (struct iasubopt *)1;
 	if (iasubopt_reference(&iaaddr_copy, iaaddr,
 			       MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: iasubopt_reference() %s:%d\n", MDL);
 		return 1;
 	iaaddr_copy = NULL;
 	if (iasubopt_reference(&iaaddr_copy, NULL, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: iasubopt_reference() %s:%d\n", MDL);
 		return 1;
 	if (iasubopt_dereference(&iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_reference() %s:%d\n", MDL);
 		return 1;
 	/* bogus dereference arguments */
 	if (iasubopt_dereference(NULL, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: iasubopt_dereference() %s:%d\n", MDL);
 		return 1;
 	iaaddr = NULL;
 	if (iasubopt_dereference(&iaaddr, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: iasubopt_dereference() %s:%d\n", MDL);
 		return 1;
 	/*
 	 * Test 2: Basic ia_na manipulation.
 	 */
 	iaid = 666;
 	ia_na = NULL;
 	if (ia_allocate(&ia_na, iaid, "TestDUID", 8, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_allocate() %s:%d\n", MDL);
 		return 1;
 	if (memcmp(ia_na->iaid_duid.data, &iaid, sizeof(iaid)) != 0) {
 		printf("ERROR: bad IAID_DUID %s:%d\n", MDL);
 		return 1;
 	if (memcmp(ia_na->iaid_duid.data+sizeof(iaid), "TestDUID", 8) != 0) {
 		printf("ERROR: bad IAID_DUID %s:%d\n", MDL);
 		return 1;
 	if (ia_na->num_iasubopt != 0) {
 		printf("ERROR: bad num_iasubopt %s:%d\n", MDL);
 		return 1;
 	ia_na_copy = NULL;
 	if (ia_reference(&ia_na_copy, ia_na, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_reference() %s:%d\n", MDL);
 		return 1;
 	iaaddr = NULL;
 	if (iasubopt_allocate(&iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_allocate() %s:%d\n", MDL);
 		return 1;
 	if (ia_add_iasubopt(ia_na, iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_add_iasubopt() %s:%d\n", MDL);
 		return 1;
 	ia_remove_iasubopt(ia_na, iaaddr, MDL);
 	if (iasubopt_dereference(&iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_reference() %s:%d\n", MDL);
 		return 1;
 	if (ia_dereference(&ia_na, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_dereference() %s:%d\n", MDL);
 		return 1;
 	if (ia_dereference(&ia_na_copy, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_dereference() %s:%d\n", MDL);
 		return 1;
 	/*
 	 * Test 3: lots of iaaddr in our ia_na
 	 */
 	/* lots of iaaddr that we delete */
 	iaid = 666;
 	ia_na = NULL;
 	if (ia_allocate(&ia_na, iaid, "TestDUID", 8, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_allocate() %s:%d\n", MDL);
 		return 1;
 	for (i=0; i<100; i++) {
 		iaaddr = NULL;
 		if (iasubopt_allocate(&iaaddr, MDL) != ISC_R_SUCCESS) {
 			printf("ERROR: iasubopt_allocate() %s:%d\n", MDL);
 			return 1;
 		if (ia_add_iasubopt(ia_na, iaaddr, MDL) != ISC_R_SUCCESS) {
 			printf("ERROR: ia_add_iasubopt() %s:%d\n", MDL);
 			return 1;
 		if (iasubopt_dereference(&iaaddr, MDL) != ISC_R_SUCCESS) {
 			printf("ERROR: iasubopt_reference() %s:%d\n", MDL);
 			return 1;
 	for (i=0; i<100; i++) {
 		iaaddr = ia_na->iasubopt[random() % ia_na->num_iasubopt];
 		ia_remove_iasubopt(ia_na, iaaddr, MDL);
 	if (ia_dereference(&ia_na, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_dereference() %s:%d\n", MDL);
 		return 1;
 	/* lots of iaaddr, let dereference cleanup */
 	iaid = 666;
 	ia_na = NULL;
 	if (ia_allocate(&ia_na, iaid, "TestDUID", 8, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_allocate() %s:%d\n", MDL);
 		return 1;
 	for (i=0; i<100; i++) {
 		iaaddr = NULL;
 		if (iasubopt_allocate(&iaaddr, MDL) != ISC_R_SUCCESS) {
 			printf("ERROR: iasubopt_allocate() %s:%d\n", MDL);
 			return 1;
 		if (ia_add_iasubopt(ia_na, iaaddr, MDL) != ISC_R_SUCCESS) {
 			printf("ERROR: ia_add_iasubopt() %s:%d\n", MDL);
 			return 1;
 		if (iasubopt_dereference(&iaaddr, MDL) != ISC_R_SUCCESS) {
 			printf("ERROR: iasubopt_reference() %s:%d\n", MDL);
 			return 1;
 	if (ia_dereference(&ia_na, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_dereference() %s:%d\n", MDL);
 		return 1;
 	/*
 	 * Test 4: Errors in ia_na.
 	 */
 	/* bogus allocate arguments */
 	if (ia_allocate(NULL, 123, "", 0, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ia_allocate() %s:%d\n", MDL);
 		return 1;
 	ia_na = (struct ia_na *)1;
 	if (ia_allocate(&ia_na, 456, "", 0, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ia_allocate() %s:%d\n", MDL);
 		return 1;
 	/* bogus reference arguments */
 	iaid = 666;
 	ia_na = NULL;
 	if (ia_allocate(&ia_na, iaid, "TestDUID", 8, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_allocate() %s:%d\n", MDL);
 		return 1;
 	if (ia_reference(NULL, ia_na, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ia_reference() %s:%d\n", MDL);
 		return 1;
 	ia_na_copy = (struct ia_na *)1;
 	if (ia_reference(&ia_na_copy, ia_na, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ia_reference() %s:%d\n", MDL);
 		return 1;
 	ia_na_copy = NULL;
 	if (ia_reference(&ia_na_copy, NULL, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ia_reference() %s:%d\n", MDL);
 		return 1;
 	if (ia_dereference(&ia_na, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_dereference() %s:%d\n", MDL);
 		return 1;
 	/* bogus dereference arguments */
 	if (ia_dereference(NULL, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ia_dereference() %s:%d\n", MDL);
 		return 1;
 	/* bogus remove */
 	iaid = 666;
 	ia_na = NULL;
 	if (ia_allocate(&ia_na, iaid, "TestDUID", 8, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_allocate() %s:%d\n", MDL);
 		return 1;
 	ia_remove_iasubopt(ia_na, NULL, MDL);
 	if (ia_dereference(&ia_na, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_dereference() %s:%d\n", MDL);
 		return 1;
 	/*
 	 * Test 5: Basic ipv6_pool manipulation.
 	 */
 	/* allocate, reference */
 	inet_pton(AF_INET6, "1:2:3:4::", &addr);
 	pool = NULL;
 	if (ipv6_pool_allocate(&pool, 0, &addr, 64, 128, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ipv6_pool_allocate() %s:%d\n", MDL);
 		return 1;
 	if (pool->num_active != 0) {
 		printf("ERROR: bad num_active %s:%d\n", MDL);
 		return 1;
 	if (pool->bits != 64) {
 		printf("ERROR: bad bits %s:%d\n", MDL);
 		return 1;
 	inet_ntop(AF_INET6, &pool->start_addr, addr_buf, sizeof(addr_buf));
 	if (strcmp(inet_ntop(AF_INET6, &pool->start_addr, addr_buf,
 			     sizeof(addr_buf)), "1:2:3:4::") != 0) {
 		printf("ERROR: bad start_addr %s:%d\n", MDL);
 		return 1;
 	pool_copy = NULL;
 	if (ipv6_pool_reference(&pool_copy, pool, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ipv6_pool_reference() %s:%d\n", MDL);
 		return 1;
 	/* create_lease6, renew_lease6, expire_lease6 */
 	uid = "client0";
 	memset(&ds, 0, sizeof(ds));
 	ds.len = strlen(uid);
 	if (!buffer_allocate(&ds.buffer, ds.len, MDL)) {
 		printf("Out of memory\n");
 		return 1;
 	ds.data = ds.buffer->data;
 	memcpy((char *)ds.data, uid, ds.len);
 	if (create_lease6(pool, &iaaddr,
 			  &attempts, &ds, 1) != ISC_R_SUCCESS) {
 		printf("ERROR: create_lease6() %s:%d\n", MDL);
 		return 1;
 	if (pool->num_inactive != 1) {
 		printf("ERROR: bad num_inactive %s:%d\n", MDL);
 		return 1;
 	if (renew_lease6(pool, iaaddr) != ISC_R_SUCCESS) {
 		printf("ERROR: renew_lease6() %s:%d\n", MDL);
 		return 1;
 	if (pool->num_active != 1) {
 		printf("ERROR: bad num_active %s:%d\n", MDL);
 		return 1;
 	expired_iaaddr = NULL;
 	if (expire_lease6(&expired_iaaddr, pool, 0) != ISC_R_SUCCESS) {
 		printf("ERROR: expire_lease6() %s:%d\n", MDL);
 		return 1;
 	if (expired_iaaddr != NULL) {
 		printf("ERROR: should not have expired a lease %s:%d\n", MDL);
 		return 1;
 	if (pool->num_active != 1) {
 		printf("ERROR: bad num_active %s:%d\n", MDL);
 		return 1;
 	if (expire_lease6(&expired_iaaddr, pool, 1000) != ISC_R_SUCCESS) {
 		printf("ERROR: expire_lease6() %s:%d\n", MDL);
 		return 1;
 	if (expired_iaaddr == NULL) {
 		printf("ERROR: should have expired a lease %s:%d\n", MDL);
 		return 1;
 	if (iasubopt_dereference(&expired_iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_dereference() %s:%d\n", MDL);
 		return 1;
 	if (pool->num_active != 0) {
 		printf("ERROR: bad num_active %s:%d\n", MDL);
 		return 1;
 	if (iasubopt_dereference(&iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_dereference() %s:%d\n", MDL);
 		return 1;
 	/* release_lease6, decline_lease6 */
 	if (create_lease6(pool, &iaaddr, &attempts,
 			  &ds, 1) != ISC_R_SUCCESS) {
 		printf("ERROR: create_lease6() %s:%d\n", MDL);
 		return 1;
 	if (renew_lease6(pool, iaaddr) != ISC_R_SUCCESS) {
 		printf("ERROR: renew_lease6() %s:%d\n", MDL);
 		return 1;
 	if (pool->num_active != 1) {
 		printf("ERROR: bad num_active %s:%d\n", MDL);
 		return 1;
 	if (release_lease6(pool, iaaddr) != ISC_R_SUCCESS) {
 		printf("ERROR: decline_lease6() %s:%d\n", MDL);
 		return 1;
 	if (pool->num_active != 0) {
 		printf("ERROR: bad num_active %s:%d\n", MDL);
 		return 1;
 	if (iasubopt_dereference(&iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_dereference() %s:%d\n", MDL);
 		return 1;
 	if (create_lease6(pool, &iaaddr, &attempts,
 			  &ds, 1) != ISC_R_SUCCESS) {
 		printf("ERROR: create_lease6() %s:%d\n", MDL);
 		return 1;
 	if (renew_lease6(pool, iaaddr) != ISC_R_SUCCESS) {
 		printf("ERROR: renew_lease6() %s:%d\n", MDL);
 		return 1;
 	if (pool->num_active != 1) {
 		printf("ERROR: bad num_active %s:%d\n", MDL);
 		return 1;
 	if (decline_lease6(pool, iaaddr) != ISC_R_SUCCESS) {
 		printf("ERROR: decline_lease6() %s:%d\n", MDL);
 		return 1;
 	if (pool->num_active != 1) {
 		printf("ERROR: bad num_active %s:%d\n", MDL);
 		return 1;
 	if (iasubopt_dereference(&iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_dereference() %s:%d\n", MDL);
 		return 1;
 	/* dereference */
 	if (ipv6_pool_dereference(&pool, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ipv6_pool_reference() %s:%d\n", MDL);
 		return 1;
 	if (ipv6_pool_dereference(&pool_copy, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ipv6_pool_reference() %s:%d\n", MDL);
 		return 1;
 	/*
 	 * Test 6: Error ipv6_pool manipulation
 	 */
 	if (ipv6_pool_allocate(NULL, 0, &addr,
 , 128, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ipv6_pool_allocate() %s:%d\n", MDL);
 		return 1;
 	pool = (struct ipv6_pool *)1;
 	if (ipv6_pool_allocate(&pool, 0, &addr,
 , 128, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ipv6_pool_allocate() %s:%d\n", MDL);
 		return 1;
 	if (ipv6_pool_reference(NULL, pool, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ipv6_pool_reference() %s:%d\n", MDL);
 		return 1;
 	pool_copy = (struct ipv6_pool *)1;
 	if (ipv6_pool_reference(&pool_copy, pool, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ipv6_pool_reference() %s:%d\n", MDL);
 		return 1;
 	pool_copy = NULL;
 	if (ipv6_pool_reference(&pool_copy, NULL, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ipv6_pool_reference() %s:%d\n", MDL);
 		return 1;
 	if (ipv6_pool_dereference(NULL, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ipv6_pool_dereference() %s:%d\n", MDL);
 		return 1;
 	if (ipv6_pool_dereference(&pool_copy, MDL) != DHCP_R_INVALIDARG) {
 		printf("ERROR: ipv6_pool_dereference() %s:%d\n", MDL);
 		return 1;
 	/*
 	 * Test 7: order of expiration
 	 */
 	pool = NULL;
 	if (ipv6_pool_allocate(&pool, 0, &addr, 64, 128, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ipv6_pool_allocate() %s:%d\n", MDL);
 		return 1;
 	for (i=10; i<100; i+=10) {
 		if (create_lease6(pool, &iaaddr, &attempts,
 				  &ds, i) != ISC_R_SUCCESS) {
 			printf("ERROR: create_lease6() %s:%d\n", MDL);
 			return 1;
 		if (renew_lease6(pool, iaaddr) != ISC_R_SUCCESS) {
 			printf("ERROR: renew_lease6() %s:%d\n", MDL);
 			return 1;
 		if (iasubopt_dereference(&iaaddr, MDL) != ISC_R_SUCCESS) {
 			printf("ERROR: iasubopt_dereference() %s:%d\n", MDL);
 			return 1;
 		if (pool->num_active != (i / 10)) {
 			printf("ERROR: bad num_active %s:%d\n", MDL);
 			return 1;
 	if (pool->num_active != 9) {
 		printf("ERROR: bad num_active %s:%d\n", MDL);
 		return 1;
 	for (i=10; i<100; i+=10) {
 		if (expire_lease6(&expired_iaaddr,
 				  pool, 1000) != ISC_R_SUCCESS) {
 			printf("ERROR: expire_lease6() %s:%d\n", MDL);
 			return 1;
 		if (expired_iaaddr == NULL) {
 			printf("ERROR: should have expired a lease %s:%d\n",
 			       MDL);
 			return 1;
 		if (pool->num_active != (9 - (i / 10))) {
 			printf("ERROR: bad num_active %s:%d\n", MDL);
 			return 1;
 		if (expired_iaaddr->hard_lifetime_end_time != i) {
 			printf("ERROR: bad hard_lifetime_end_time %s:%d\n",
 			       MDL);
 			return 1;
 		if (iasubopt_dereference(&expired_iaaddr, MDL) !=
 				ISC_R_SUCCESS) {
 			printf("ERROR: iasubopt_dereference() %s:%d\n", MDL);
 			return 1;
 	if (pool->num_active != 0) {
 		printf("ERROR: bad num_active %s:%d\n", MDL);
 		return 1;
 	expired_iaaddr = NULL;
 	if (expire_lease6(&expired_iaaddr, pool, 1000) != ISC_R_SUCCESS) {
 		printf("ERROR: expire_lease6() %s:%d\n", MDL);
 		return 1;
 	if (ipv6_pool_dereference(&pool, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ipv6_pool_dereference() %s:%d\n", MDL);
 		return 1;
 	/*
 	 * Test 8: small pool
 	 */
 	pool = NULL;
 	addr.s6_addr[14] = 0x81;
 	if (ipv6_pool_allocate(&pool, 0, &addr, 127, 128, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ipv6_pool_allocate() %s:%d\n", MDL);
 		return 1;
 	if (create_lease6(pool, &iaaddr, &attempts,
 			  &ds, 42) != ISC_R_SUCCESS) {
 		printf("ERROR: create_lease6() %s:%d\n", MDL);
 		return 1;
 	if (renew_lease6(pool, iaaddr) != ISC_R_SUCCESS) {
 		printf("ERROR: renew_lease6() %s:%d\n", MDL);
 		return 1;
 	if (iasubopt_dereference(&iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_dereference() %s:%d\n", MDL);
 		return 1;
 	if (create_lease6(pool, &iaaddr, &attempts,
 			  &ds, 11) != ISC_R_SUCCESS) {
 		printf("ERROR: create_lease6() %s:%d\n", MDL);
 		return 1;
 	if (renew_lease6(pool, iaaddr) != ISC_R_SUCCESS) {
 		printf("ERROR: renew_lease6() %s:%d\n", MDL);
 		return 1;
 	if (iasubopt_dereference(&iaaddr, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: iasubopt_dereference() %s:%d\n", MDL);
 		return 1;
 	if (create_lease6(pool, &iaaddr, &attempts,
 			  &ds, 11) != ISC_R_NORESOURCES) {
 		printf("ERROR: create_lease6() %s:%d\n", MDL);
 		return 1;
 	if (ipv6_pool_dereference(&pool, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ipv6_pool_dereference() %s:%d\n", MDL);
 		return 1;
 	addr.s6_addr[14] = 0;
 	/*
  	 * Test 9: functions across all pools
 	 */
 	pool = NULL;
 	if (ipv6_pool_allocate(&pool, 0, &addr, 64, 128, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ipv6_pool_allocate() %s:%d\n", MDL);
 		return 1;
 	if (add_ipv6_pool(pool) != ISC_R_SUCCESS) {
 		printf("ERROR: add_ipv6_pool() %s:%d\n", MDL);
 		return 1;
 	if (ipv6_pool_dereference(&pool, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ipv6_pool_dereference() %s:%d\n", MDL);
 		return 1;
 	pool = NULL;
 	if (find_ipv6_pool(&pool, 0, &addr) != ISC_R_SUCCESS) {
 		printf("ERROR: find_ipv6_pool() %s:%d\n", MDL);
 		return 1;
 	if (ipv6_pool_dereference(&pool, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ipv6_pool_dereference() %s:%d\n", MDL);
 		return 1;
 	inet_pton(AF_INET6, "1:2:3:4:ffff:ffff:ffff:ffff", &addr);
 	pool = NULL;
 	if (find_ipv6_pool(&pool, 0, &addr) != ISC_R_SUCCESS) {
 		printf("ERROR: find_ipv6_pool() %s:%d\n", MDL);
 		return 1;
 	if (ipv6_pool_dereference(&pool, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ipv6_pool_dereference() %s:%d\n", MDL);
 		return 1;
 	inet_pton(AF_INET6, "1:2:3:5::", &addr);
 	pool = NULL;
 	if (find_ipv6_pool(&pool, 0, &addr) != ISC_R_NOTFOUND) {
 		printf("ERROR: find_ipv6_pool() %s:%d\n", MDL);
 		return 1;
 	inet_pton(AF_INET6, "1:2:3:3:ffff:ffff:ffff:ffff", &addr);
 	pool = NULL;
 	if (find_ipv6_pool(&pool, 0, &addr) != ISC_R_NOTFOUND) {
 		printf("ERROR: find_ipv6_pool() %s:%d\n", MDL);
 		return 1;
 /*	iaid = 666;
 	ia_na = NULL;
 	if (ia_allocate(&ia_na, iaid, "TestDUID", 8, MDL) != ISC_R_SUCCESS) {
 		printf("ERROR: ia_allocate() %s:%d\n", MDL);
 		return 1;
 	}*/
 		struct in6_addr r;
 		struct data_string ds;
 		u_char data[16];
 		char buf[64];
 		int i, j;
 		memset(&ds, 0, sizeof(ds));
 		memset(data, 0xaa, sizeof(data));
 		ds.len = 16;
 		ds.data = data;
 		inet_pton(AF_INET6, "3ffe:501:ffff:100::", &addr);
 		for (i = 32; i < 42; i++)
 			for (j = i + 1; j < 49; j++) {
 				memset(&r, 0, sizeof(r));
 				memset(buf, 0, 64);
 				build_prefix6(&r, &addr, i, j, &ds);
 				inet_ntop(AF_INET6, &r, buf, 64);
 				printf("%d,%d-> %s/%d\n", i, j, buf, j);
 	printf("SUCCESS: all tests passed (ignore any warning messages)\n");
 	return 0;
 #endif

 @@ -1,36 +1,36 @@
-# $NetBSD: Makefile.inc,v 1.2 2013/03/24 22:21:21 christos Exp $
+# $NetBSD: Makefile.inc,v 1.3 2013/03/24 23:03:05 christos Exp $
 WARNS?=	1	# XXX -Wshadow -Wcast-qual -Wsign-compare
 .include <bsd.own.mk>
 USE_FORT?= yes	# network client/server
 CWARNFLAGS.clang+=	-Wno-tautological-compare \
 			-Wno-conversion -Wno-constant-logical-operand \
 			-Wno-format-security
 DIST:=	${.PARSEDIR}/dist
 BIND:=	${.PARSEDIR}/../bind/dist
 .PATH:	${DIST}/${DHCPSRCDIR}
 COBJDIR!=cd ${.PARSEDIR}/lib/common && ${PRINTOBJDIR}
 OMOBJDIR!=cd ${.PARSEDIR}/lib/omapip && ${PRINTOBJDIR}
 DSTOBJDIR!=cd ${.PARSEDIR}/lib/dst && ${PRINTOBJDIR}
 .if (${USE_INET6} != "no")
 CPPFLAGS+=	-DDHCPv6
 .endif
-CPPFLAGS+= -DISC_PLATFORM_USETHREADS
+CPPFLAGS+= -DISC_PLATFORM_USETHREADS -DHAVE_CONFIG_H
 CPPFLAGS+= -I${DIST} -I${DIST}/includes -I${DIST}/../include
 CPPFLAGS+= -I${BIND} -I${BIND}/includes -I${BIND}/../include
 .for dir in isc dns
 CPPFLAGS+= -I${BIND}/lib/${dir}/include
 CPPFLAGS+= -I${BIND}/lib/${dir}/unix/include
 CPPFLAGS+= -I${BIND}/lib/${dir}/pthreads/include
 .endfor
 CPPFLAGS+= -DLOCALSTATEDIR='"/var"'
 LDADD+= ${COBJDIR}/libdhcp.a
 LDADD+= ${OMOBJDIR}/libomapi.a ${DSTOBJDIR}/libdst.a
 .if defined(PROG) && ${PROG} == "dhclient"
 LDADD+=--static
 .endif

 @@ -1,14 +1,14 @@
-/*	$NetBSD: dst_api.c,v 1.1.1.2 2013/03/24 22:50:33 christos Exp $	*/
+/*	$NetBSD: dst_api.c,v 1.2 2013/03/24 23:03:06 christos Exp $	*/
 #ifndef LINT
 static const char rcsid[] = "Header: /tmp/cvstest/DHCP/dst/dst_api.c,v 1.9.6.1 2012/04/11 15:43:55 sar Exp ";
 #endif
 /*
  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
  * Portions Copyright (c) 2007,2009 by Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (c) 2012 by Internet Systems Consortium, Inc. ("ISC")
+ *
  * Permission to use, copy modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
 @@ -1007,27 +1007,27 @@ DST_KEY *
 dst_free_key(DST_KEY *f_key)
+{
 	if (f_key == NULL)
 		return (f_key);
 	if (f_key->dk_func && f_key->dk_func->destroy)
 		f_key->dk_KEY_struct =
 			f_key->dk_func->destroy(f_key->dk_KEY_struct);
 	else {
 		EREPORT(("dst_free_key(): Unknown key alg %d\n",
 			 f_key->dk_alg));
+	}
 	if (f_key->dk_KEY_struct) {
-		SAFE_FREE(f_key->dk_KEY_struct);
+		SAFE_FREE2(f_key->dk_KEY_struct, 0);
+	}
 	if (f_key->dk_key_name)
 		SAFE_FREE(f_key->dk_key_name);
 	SAFE_FREE(f_key);
 	return (NULL);
+}
 /*
  * dst_sig_size
  *	Return the maximum size of signature from the key specified in bytes
  * Parameters
  *      key
  * Returns

 @@ -1,16 +1,17 @@
-/*	$NetBSD: dhcpleasequery.c,v 1.2 2013/03/24 15:53:59 christos Exp $	*/
+/*	$NetBSD: dhcpleasequery.c,v 1.3 2013/03/24 23:03:06 christos Exp $	*/
 /*
  * Copyright (C) 2011-2012 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2006-2007,2009 by Internet Systems Consortium, Inc. ("ISC")
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  * PERFORMANCE OF THIS SOFTWARE.
 @@ -446,30 +447,27 @@ dhcpleasequery(struct packet *packet, in
 		 * These seem to be hard-coded in ISC DHCP, to 0.5 and
 		 * 0.875 of the lease time.
 		 */
 		lease_duration = lease->ends - lease->starts;
 		time_renewal = lease->starts +
 			(lease_duration / 2);
 		time_rebinding = lease->starts +
 			(lease_duration / 2) +
 			(lease_duration / 4) +
 			(lease_duration / 8);
 		if (time_renewal > cur_time) {
-			if (time_renewal < cur_time)
+			time_renewal = htonl(time_renewal - cur_time);
 				time_renewal = 0;
 			else
 				time_renewal = htonl(time_renewal - cur_time);
 			if (!add_option(options,
 					DHO_DHCP_RENEWAL_TIME,
 					&time_renewal,
 					sizeof(time_renewal))) {
 				option_state_dereference(&options, MDL);
 				lease_dereference(&lease, MDL);
 				log_info("%s: out of memory, no reply sent",
 					 msgbuf);
 				return;
+			}
+		}
 @@ -479,35 +477,28 @@ dhcpleasequery(struct packet *packet, in
 			if (!add_option(options,
 					DHO_DHCP_REBINDING_TIME,
 					&time_rebinding,
 					sizeof(time_rebinding))) {
 				option_state_dereference(&options, MDL);
 				lease_dereference(&lease, MDL);
 				log_info("%s: out of memory, no reply sent",
 					 msgbuf);
 				return;
+			}
+		}
 		if (lease->ends > cur_time) {
 			if (time_expiry < cur_time) {
 				log_error("Impossible condition at %s:%d.",
 					  MDL);
 				option_state_dereference(&options, MDL);
 				lease_dereference(&lease, MDL);
 				return;
 			time_expiry = htonl(lease->ends - cur_time);
 			if (!add_option(options,
 					DHO_DHCP_LEASE_TIME,
 					&time_expiry,
 					sizeof(time_expiry))) {
 				option_state_dereference(&options, MDL);
 				lease_dereference(&lease, MDL);
 				log_info("%s: out of memory, no reply sent",
 					 msgbuf);
 				return;
+			}
+		}
 		/* Supply the Vendor-Class-Identifier. */
 @@ -617,27 +608,27 @@ dhcpleasequery(struct packet *packet, in
 		lease_dereference(&lease, MDL);
 		log_info("%s: error adding option, no reply sent", msgbuf);
 		return;
+	}
 	/*
 	 * Log the message we've received.
 	 */
 	log_info("%s", msgbuf);
 	/*
 	 * Figure out which address to use to send from.
 	 */
-	get_server_source_address(&siaddr, options, packet);
+	get_server_source_address(&siaddr, options, options, packet);
 	/*
 	 * Set up the option buffer.
 	 */
 	memset(&prl, 0, sizeof(prl));
 	oc = lookup_option(&dhcp_universe, options,
 			   DHO_DHCP_PARAMETER_REQUEST_LIST);
 	if (oc != NULL) {
 		evaluate_option_cache(&prl,
 				      packet,
 				      NULL,
 				      NULL,

 @@ -3,51 +3,51 @@
 /* Define to compile debug-only DHCP software. */
 /* #undef DEBUG */
 /* Define to queue multiple DHCPACK replies per fsync. */
 /* #undef DELAYED_ACK */
 /* Define to BIG_ENDIAN for MSB (Motorola or SPARC CPUs) or LITTLE_ENDIAN for
    LSB (Intel CPUs). */
 #include <sys/endian.h>
 #define DHCP_BYTE_ORDER _BYTE_ORDER
 #if 0
 /* Define to 1 to include DHCPv6 support. */
 /* From the Makefile */
 /* Define to 1 to include DHCPv6 support. */
 #define DHCPv6 1
 #endif
 /* Define to any value to chroot() prior to loading config. */
 /* #undef EARLY_CHROOT */
 /* Define to include execute() config language support. */
 #define ENABLE_EXECUTE 1
 /* Define to include Failover Protocol support. */
 #define FAILOVER_PROTOCOL 1
 /* Define to nothing if C supports flexible array members, and to 1 if it does
    not. That way, with a declaration like `struct s { int n; double
    d[FLEXIBLE_ARRAY_MEMBER]; };', the struct hack can be used with pre-C99
    compilers. When computing the size of such an object, don't use 'sizeof
    (struct s)' as it overestimates the size. Use 'offsetof (struct s, d)'
    instead. Don't use 'offsetof (struct s, d[0])', as this doesn't work with
    MSVC and with C++ compilers. */
 #define FLEXIBLE_ARRAY_MEMBER
 /* Define to 1 to use the Berkeley Packet Filter interface code. */
-#define HAVE_BPF ""
+#define HAVE_BPF 1
 /* Define to 1 if you have the /dev/random file. */
 #define HAVE_DEV_RANDOM 1
 /* Define to 1 to use DLPI interface code. */
 /* #undef HAVE_DLPI */
 /* Define to 1 if you have the <ifaddrs.h> header file. */
 #define HAVE_IFADDRS_H 1
 /* Define to 1 if you have the <inttypes.h> header file. */
 #define HAVE_INTTYPES_H 1
 @@ -86,76 +86,82 @@
 /* Define to 1 if you have the <sys/socket.h> header file. */
 #define HAVE_SYS_SOCKET_H 1
 /* Define to 1 if you have the <sys/stat.h> header file. */
 #define HAVE_SYS_STAT_H 1
 /* Define to 1 if you have the <sys/types.h> header file. */
 #define HAVE_SYS_TYPES_H 1
 /* Define to 1 if you have the <unistd.h> header file. */
 #define HAVE_UNISTD_H 1
 /* Define to the string for a noreturn attribute. */
 #define ISC_DHCP_NORETURN __attribute__((noreturn))
 /* Define to 1 if the system has 'struct if_laddrconf'. */
 /* #undef ISC_PLATFORM_HAVEIF_LADDRCONF */
 /* Define to 1 if the system has 'struct if_laddrreq'. */
 /* #undef ISC_PLATFORM_HAVEIF_LADDRREQ */
 /* Define to 1 if the system has 'struct lifnum'. */
 /* #undef ISC_PLATFORM_HAVELIFNUM */
 /* Define to 1 if the inet_aton() function is missing. */
 /* #undef NEED_INET_ATON */
 /* Name of package */
 #define PACKAGE "dhcp"
 /* Define to the address where bug reports for this package should be sent. */
 #define PACKAGE_BUGREPORT "dhcp-users@isc.org"
 /* Define to the full name of this package. */
 #define PACKAGE_NAME "DHCP"
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "DHCP 4.2.3"
+#define PACKAGE_STRING "DHCP 4.2.5"
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "dhcp"
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "4.2.3"
+#define PACKAGE_VERSION "4.2.5"
 /* Define to any value to include Ari's PARANOIA patch. */
 /* #undef PARANOIA */
 /* Define to correct bad byteorders in secs field. */
 /* #undef SECS_BYTEORDER */
 /* The size of `struct iaddr *', as computed by sizeof. */
 #define SIZEOF_STRUCT_IADDR_P 8
 /* Define to 1 if you have the ANSI C header files. */
 #define STDC_HEADERS 1
 /* Define to include server activity tracing support. */
 #define TRACING 1
 /* Define to 1 to use the standard BSD socket API. */
 /* #undef USE_SOCKETS */
 /* Define to 1 to enable IPv4 packet info support. */
 /* #undef USE_V4_PKTINFO */
 /* Version number of package */
-#define VERSION "4.2.3"
+#define VERSION "4.2.5"
 /* Define to 1 if on AIX 3.
    System headers sometimes define this.
    We just want to avoid a redefinition error message.  */
 #ifndef _ALL_SOURCE
 /* # undef _ALL_SOURCE */
 #endif
 /* Enable GNU extensions on systems that have them.  */
 #ifndef _GNU_SOURCE
 # define _GNU_SOURCE 1
 #endif

 @@ -1,14 +1,14 @@
-/*	$NetBSD: base64.c,v 1.3 2013/03/24 16:27:58 christos Exp $	*/
+/*	$NetBSD: base64.c,v 1.4 2013/03/24 23:03:06 christos Exp $	*/
 /*
  * Copyright (c) 2004,2009 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 1996-2003 by Internet Software Consortium
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 @@ -39,27 +39,27 @@
  * the extent that such products are used for performing Domain Name System
  * dynamic updates in TCP/IP networks by means of the Software.  No immunity is
  * granted for any product per se or for any other function of any product.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES,
  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
  * PARTICULAR PURPOSE.  IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL,
  * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING
  * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN
  * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
  */
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "Id: base64.c,v 1.5.6.1 2009-11-20 01:49:01 sar Exp ";
+static const char rcsid[] = "Id: base64.c,v 1.5.6.1 2009/11/20 01:49:01 sar Exp ";
 #endif /* not lint */
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <ctype.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>

 @@ -1,14 +1,14 @@
-/*	$NetBSD: dispatch.c,v 1.2 2013/03/24 15:53:59 christos Exp $	*/
+/*	$NetBSD: dispatch.c,v 1.3 2013/03/24 23:03:06 christos Exp $	*/
 /* dispatch.c
    I/O dispatcher. */
 /*
  * Copyright (c) 2004,2007-2009 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 1999-2003 by Internet Software Consortium
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
 @@ -25,27 +25,27 @@
  *   Redwood City, CA 94063
  *   <info@isc.org>
  *   https://www.isc.org/
+ *
  * This software has been written for Internet Systems Consortium
  * by Ted Lemon in cooperation with Vixie Enterprises and Nominum, Inc.
  * To learn more about Internet Systems Consortium, see
  * ``https://www.isc.org/''.  To learn more about Vixie Enterprises,
  * see ``http://www.vix.com''.   To learn more about Nominum, Inc., see
  * ``http://www.nominum.com''.
  */
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: dispatch.c,v 1.2 2013/03/24 15:53:59 christos Exp $");
+__RCSID("$NetBSD: dispatch.c,v 1.3 2013/03/24 23:03:06 christos Exp $");
 #include "dhcpd.h"
 #include <omapip/omapip_p.h>
 #include <sys/time.h>
 static omapi_io_object_t omapi_io_states;
 struct timeval cur_tv;
 struct eventqueue *rw_queue_empty;
 OMAPI_OBJECT_ALLOC (omapi_io,
 		    omapi_io_object_t, omapi_type_io_object)
 @@ -166,28 +166,35 @@ omapi_iscsock_cb(isc_task_t   *task,
 	 * anything just indicate that we don't want any more.
+	 *
 	 * This should be a temporary fix until we arrange to properly
 	 * close the socket.
 	 */
 	if (obj->closed == ISC_TRUE) {
 		return(0);
+	}
 #endif
 	if ((flags == ISC_SOCKFDWATCH_READ) &&
 	    (obj->reader != NULL) &&
 	    (obj->inner != NULL)) {
-		obj->reader(obj->inner);
+		status = obj->reader(obj->inner);
-		/* We always ask for more when reading */
+		/*
 		 * If we are shutting down (basically tried to
 		 * read and got no bytes) we don't need to try
 		 * again.
 		 */
 		if (status == ISC_R_SHUTTINGDOWN)
 			return (0);
 		/* Otherwise We always ask for more when reading */
 		return (1);
 	} else if ((flags == ISC_SOCKFDWATCH_WRITE) &&
 		 (obj->writer != NULL) &&
 		 (obj->inner != NULL)) {
 		status = obj->writer(obj->inner);
 		/* If the writer has more to write they should return
 		 * ISC_R_INPROGRESS */
 		if (status == ISC_R_INPROGRESS) {
 			return (1);
+		}
+	}
 	/*