dhclient 3.0.6 refuses valid offer

Thank you for taking the time to report this bug and helping to make Ubuntu better. The issue that you reported is one that should be reproducible with the live environment of the Desktop CD of the development release - Karmic Koala. It would help us greatly if you could test with it so we can work on getting it fixed in the next release of Ubuntu. You can find out more about the development release at http://www.ubuntu.com/testing/. Thanks again and we appreciate your help.

We'd like to figure out what's causing this bug for you, but we haven't heard back from you in a while. Could you please provide the requested information? Thanks!

I am having this issue as well with 9.10. Happens only at home connecting with my ISP. Works fine at the office. I am a programmer, and am willing to help debug this, but I don't know anything about dhclient. Please let me know how I can help. Meantime, I'll start digging myself.

Sorry, just found the "Helping With Bugs" page on the Wiki. I'll get up to speed and start helping out with this one, since it's affecting me. Thanks.

ok, so I found the problem. The pcap that wyatt earp attached (excellent info, thanks wyatt) shows the same scenario I'm seeing at home, where the DHCP server's DHCPACK message includes two (identical) "subnet mask" options.

Now, I'm no DHCP expert, but RFC 2131, Page 23 says
"Options may appear only once, unless otherwise specified in the options document. The client concatenates the values of multiple instances of the same option into a single parameter list for configuration."

The subnet mask option documentation does not specify that it can occur more than once, and tables.c (lines 101-102) show that dhclient only expects a single value:

static struct option dhcp_options[] = {
 { "subnet-mask", "I", &dhcp_universe, 1, 1 },

The problem ends up being that dhclient appends the second subnet-mask value to the first, giving it a length of 8, rather than 4. So, dhcpack function calls bind_lease function, which calls the script_write_params function.

The script_write_params function tries to find the network number using the netmask acquired from DHCPACK message. At this point, netmask.iabuf looks like this:

len

iabuf 0xbfffdf4c
 iabuf[0] 0xff
 iabuf[1] 0xff
 iabuf[2] 0xff
 iabuf[3] 0
 iabuf[4] 0xff
 iabuf[5] 0xff
 iabuf[6] 0xff
 iabuf[7] 0

script_write_params function calls subnet_number, which sees that the netmask

So it would seem that the server is wrong in sending two subnet mask options, but IMHO, dhclient could be more lenient in the case where the two are identical. After all, other dhcp clients connecting to my

ugh, accidentally posted that message in the middle of editing it.

So, the subnet_number function sees an address of 4 bytes, but a netmask of 8 bytes and fails.

Where I was headed is that I think dhclient should be modified to ignore duplicate options sent by the server.

I think importance should be set high because this problem "Has a severe impact on a small portion of Ubuntu users." Anyone with certain ISPs can't connect at all.