Comment 6 for bug 270010

ok, so I found the problem. The pcap that wyatt earp attached (excellent info, thanks wyatt) shows the same scenario I'm seeing at home, where the DHCP server's DHCPACK message includes two (identical) "subnet mask" options.

Now, I'm no DHCP expert, but RFC 2131, Page 23 says
"Options may appear only once, unless otherwise specified in the options document. The client concatenates the values of multiple instances of the same option into a single parameter list for configuration."

The subnet mask option documentation does not specify that it can occur more than once, and tables.c (lines 101-102) show that dhclient only expects a single value:

static struct option dhcp_options[] = {
 { "subnet-mask", "I", &dhcp_universe, 1, 1 },

The problem ends up being that dhclient appends the second subnet-mask value to the first, giving it a length of 8, rather than 4. So, dhcpack function calls bind_lease function, which calls the script_write_params function.

The script_write_params function tries to find the network number using the netmask acquired from DHCPACK message. At this point, netmask.iabuf looks like this:

len

iabuf 0xbfffdf4c
 iabuf[0] 0xff
 iabuf[1] 0xff
 iabuf[2] 0xff
 iabuf[3] 0
 iabuf[4] 0xff
 iabuf[5] 0xff
 iabuf[6] 0xff
 iabuf[7] 0

script_write_params function calls subnet_number, which sees that the netmask

So it would seem that the server is wrong in sending two subnet mask options, but IMHO, dhclient could be more lenient in the case where the two are identical. After all, other dhcp clients connecting to my