Reference count binding scopes. Align IP headers on output.

9 files changed, 271 insertions, 144 deletions

diff --git a/common/alloc.c b/common/alloc.c
index 3cb1e87b..d90a974a 100644
--- a/common/alloc.c
+++ b/common/alloc.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: alloc.c,v 1.48 2000/06/24 06:16:28 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: alloc.c,v 1.49 2000/07/27 09:02:28 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -1257,7 +1257,36 @@ int binding_scope_allocate (ptr, file, line)
 	if (!bp)
 		return 0;
 	memset (bp, 0, sizeof *bp);
+	binding_scope_reference (ptr, bp, file, line);
+	return 1;
+}
+
+int binding_scope_reference (ptr, bp, file, line)
+	struct binding_scope **ptr;
+	struct binding_scope *bp;
+	const char *file;
+	int line;
+{
+	if (!ptr) {
+		log_error ("%s(%d): null pointer", file, line);
+#if defined (POINTER_DEBUG)
+		abort ();
+#else
+		return 0;
+#endif
+	}
+	if (*ptr) {
+		log_error ("%s(%d): non-null pointer", file, line);
+#if defined (POINTER_DEBUG)
+		abort ();
+#else
+		*ptr = (struct binding_scope *)0;
+#endif
+	}
 	*ptr = bp;
+	bp -> refcnt++;
+	rc_register (file, line, ptr, bp, bp -> refcnt);
+	dmalloc_reuse (bp, file, line, 1);
 	return 1;
 }
 
diff --git a/common/bpf.c b/common/bpf.c
index a16c2e26..f55d7754 100644
--- a/common/bpf.c
+++ b/common/bpf.c
@@ -47,7 +47,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: bpf.c,v 1.40 2000/06/08 21:14:10 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: bpf.c,v 1.41 2000/07/27 09:02:29 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -359,28 +359,33 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	struct sockaddr_in *to;
 	struct hardware *hto;
 {
-	unsigned bufp = 0;
-	unsigned char buf [256];
-	struct iovec iov [2];
+	unsigned hbufp = 0, ibufp = 0;
+	double hw [4];
+	double ip [32];
+	struct iovec iov [3];
 	int result;
+	int fudge;
 
 	if (!strcmp (interface -> name, "fallback"))
 		return send_fallback (interface, packet, raw,
 				      len, from, to, hto);
 
 	/* Assemble the headers... */
-	assemble_hw_header (interface, buf, &bufp, hto);
-	assemble_udp_ip_header (interface, buf, &bufp, from.s_addr,
+	assemble_hw_header (interface, (unsigned char *)hw, &hbufp, hto);
+	assemble_udp_ip_header (interface,
+				(unsigned char *)ip, &ibufp, from.s_addr,
 				to -> sin_addr.s_addr, to -> sin_port,
 				(unsigned char *)raw, len);
 
 	/* Fire it off */
-	iov [0].iov_base = (char *)buf;
-	iov [0].iov_len = bufp;
-	iov [1].iov_base = (char *)raw;
-	iov [1].iov_len = len;
-
-	result = writev(interface -> wfdesc, iov, 2);
+	iov [0].iov_base = ((char *)hw);
+	iov [0].iov_len = hbufp;
+	iov [1].iov_base = ((char *)ip);
+	iov [1].iov_len = ibufp;
+	iov [2].iov_base = (char *)raw;
+	iov [2].iov_len = len;
+
+	result = writev(interface -> wfdesc, iov, 3);
 	if (result < 0)
 		log_error ("send_packet: %m");
 	return result;
diff --git a/common/dlpi.c b/common/dlpi.c
index 3052ad87..90a62ebd 100644
--- a/common/dlpi.c
+++ b/common/dlpi.c
@@ -84,7 +84,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: dlpi.c,v 1.21 2000/06/08 21:14:13 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: dlpi.c,v 1.22 2000/07/27 09:02:31 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -508,13 +508,17 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	struct sockaddr_in *to;
 	struct hardware *hto;
 {
+	unsigned hbufp = 0;
+	double hh [16];
+	double ih [1536 / sizeof (double)];
+	unsigned char *dbuf = (unsigned char *)ih;
 	unsigned dbuflen;
-	unsigned char dbuf [1536];
 	unsigned char sap [2];
 	unsigned char dstaddr [DLPI_MAXDLADDR];
 	unsigned addrlen;
 	int saplen;
 	int result;
+	int fudge;
 
 	if (!strcmp (interface -> name, "fallback"))
 		return send_fallback (interface, packet, raw,
@@ -524,7 +528,11 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 
 	/* Assemble the headers... */
 #ifdef USE_DLPI_RAW
-	assemble_hw_header (interface, dbuf, &dbuflen, hto);
+	assemble_hw_header (interface, (unsigned char *)hh, &dbuflen, hto);
+	fudge = dbuflen % 4; /* IP header must be word-aligned. */
+	memcpy (dbuf + fudge, (unsigned char *)hh, dbuflen);
+#else
+	fudge = 0;
 #endif
 	assemble_udp_ip_header (interface, dbuf, &dbuflen, from.s_addr,
 				to -> sin_addr.s_addr, to -> sin_port,
@@ -535,7 +543,7 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	dbuflen += len;
 
 #ifdef USE_DLPI_RAW
-	result = write (interface -> wfdesc, dbuf, dbuflen);
+	result = write (interface -> wfdesc, dbuf + fudge, dbuflen - fudge);
 #else
 	/* XXX: Assumes ethernet, with two byte SAP */
 	sap [0] = 0x08;		/* ETHERTYPE_IP, high byte */
diff --git a/common/execute.c b/common/execute.c
index 7b97bef4..e1c18c4b 100644
--- a/common/execute.c
+++ b/common/execute.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: execute.c,v 1.35 2000/07/06 22:42:22 mellon Exp $ Copyright (c) 1998-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: execute.c,v 1.36 2000/07/27 09:02:32 mellon Exp $ Copyright (c) 1998-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -55,7 +55,7 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *out_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct executable_statement *statements;
 {
 	struct executable_statement *r, *e, *next;
@@ -163,9 +163,9 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 			break;
 
 		      case if_statement:
-			status = evaluate_boolean_expression
-				(&result, packet, lease, in_options,
-				 out_options, scope, r -> data.ie.expr);
+			status = (evaluate_boolean_expression
+				  (&result, packet, lease, in_options,
+				   out_options, scope, r -> data.ie.expr));
 			
 #if defined (DEBUG_EXPRESSIONS)
 			log_debug ("exec: if %s", (status
@@ -244,7 +244,21 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 			break;
 
 		      case set_statement:
-			binding = find_binding (scope, r -> data.set.name);
+			if (!scope) {
+				log_error ("set %s: no scope",
+					   r -> data.set.name);
+				status = 0;
+				break;
+			}
+			if (!*scope) {
+			    if (!binding_scope_allocate (scope, MDL)) {
+				log_error ("set %s: can't allocate scope",
+					   r -> data.set.name);
+				status = 0;
+				break;
+			    }
+			}
+			binding = find_binding (*scope, r -> data.set.name);
 #if defined (DEBUG_EXPRESSIONS)
 			log_debug ("exec: set %s", r -> data.set.name);
 #endif
@@ -261,12 +275,9 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 						r -> data.set.name);
 					if (lease) {
 					    binding -> next =
-						    lease -> scope.bindings;
-					    lease -> scope.bindings = binding;
-					} else {
-					    binding -> next =
-						    global_scope.bindings;
-					    global_scope.bindings = binding;
+						    lease -> scope -> bindings;
+					    lease -> scope -> bindings =
+						    binding;
 					}
 				    } else {
 				       badalloc:
@@ -291,7 +302,11 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 			break;
 
 		      case unset_statement:
-			binding = find_binding (scope, r -> data.unset);
+			if (!scope || !*scope) {
+				status = 0;
+				break;
+			}
+			binding = find_binding (*scope, r -> data.unset);
 #if defined (DEBUG_EXPRESSIONS)
 			log_debug ("exec: unset %s", r -> data.unset);
 #endif
@@ -357,10 +372,12 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 				e = e -> data.let.statements;
 				goto next_let;
 			} else if (ns) {
-				ns -> outer = scope;
+				if (scope && *scope)
+				    	binding_scope_reference (&ns -> outer,
+								 *scope, MDL);
 				execute_statements
 				      (packet, lease, in_options, out_options,
-				       ns, e -> data.let.statements);
+				       &ns, e -> data.let.statements);
 			}
 			if (ns)
 				binding_scope_dereference (&ns, MDL);
@@ -392,7 +409,7 @@ void execute_statements_in_scope (packet, lease, in_options, out_options,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *out_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct group *group;
 	struct group *limiting_group;
 {
@@ -771,7 +788,7 @@ int find_matching_case (struct executable_statement **ep,
 			struct packet *packet, struct lease *lease,
 			struct option_state *in_options,
 			struct option_state *out_options,
-			struct binding_scope *scope,
+			struct binding_scope **scope,
 			struct expression *expr,
 			struct executable_statement *stmt)
 {
diff --git a/common/lpf.c b/common/lpf.c
index bdbc0754..21a2fa93 100644
--- a/common/lpf.c
+++ b/common/lpf.c
@@ -37,7 +37,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: lpf.c,v 1.25 2000/06/08 21:14:14 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: lpf.c,v 1.26 2000/07/27 09:02:33 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -83,14 +83,18 @@ int if_register_lpf (info)
 	struct sockaddr sa;
 
 	/* Make an LPF socket. */
-	if ((sock = socket(PF_PACKET, SOCK_PACKET, htons(ETH_P_ALL))) < 0) {
+	if ((sock = socket(PF_PACKET, SOCK_PACKET,
+			   htons((short)ETH_P_ALL))) < 0) {
 		if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
 		    errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
-		    errno == EAFNOSUPPORT || errno == EINVAL)
-			log_fatal ("socket: %m - make sure %s %s %s!",
-				   "CONFIG_PACKET (Packet socket)"
-				   "and CONFIG_FILTER (Socket Filtering) are",
-				   "enabled in your kernel configuration");
+		    errno == EAFNOSUPPORT || errno == EINVAL) {
+			log_error ("socket: %m - make sure");
+			log_error ("CONFIG_PACKET (Packet socket) %s",
+				   "and CONFIG_FILTER");
+			log_error ("(Socket Filtering) are enabled %s",
+				   "in your kernel");
+			log_fatal ("configuration!");
+		}
 		log_fatal ("Open a socket for LPF: %m");
 	}
 
@@ -101,11 +105,14 @@ int if_register_lpf (info)
 	if (bind (sock, &sa, sizeof sa)) {
 		if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
 		    errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
-		    errno == EAFNOSUPPORT || errno == EINVAL)
-			log_fatal ("socket: %m - make sure %s %s %s!",
-				   "CONFIG_PACKET (Packet socket)"
-				   "and CONFIG_FILTER (Socket Filtering) are",
-				   "enabled in your kernel configuration");
+		    errno == EAFNOSUPPORT || errno == EINVAL) {
+			log_error ("socket: %m - make sure");
+			log_error ("CONFIG_PACKET (Packet socket) %s",
+				   "and CONFIG_FILTER");
+			log_error ("(Socket Filtering) are enabled %s",
+				   "in your kernel");
+			log_fatal ("configuration!");
+		}
 		log_fatal ("Bind socket to interface: %m");
 	}
 
@@ -222,17 +229,20 @@ static void lpf_gen_filter_setup (info)
         /* Patch the server port into the LPF  program...
 	   XXX changes to filter program may require changes
 	   to the insn number(s) used below! XXX */
-	dhcp_bpf_filter [8].k = ntohs (local_port);
+	dhcp_bpf_filter [8].k = ntohs ((short)local_port);
 
 	if (setsockopt (info -> rfdesc, SOL_SOCKET, SO_ATTACH_FILTER, &p,
 			sizeof p) < 0) {
 		if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
 		    errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
-		    errno == EAFNOSUPPORT)
-			log_fatal ("socket: %m - make sure %s %s %s!",
-				   "CONFIG_PACKET (Packet socket)"
-				   "and CONFIG_FILTER (Socket Filtering) are",
-				   "enabled in your kernel configuration");
+		    errno == EAFNOSUPPORT) {
+			log_error ("socket: %m - make sure");
+			log_error ("CONFIG_PACKET (Packet socket) %s",
+				   "and CONFIG_FILTER");
+			log_error ("(Socket Filtering) are enabled %s",
+				   "in your kernel");
+			log_fatal ("configuration!");
+		}
 		log_fatal ("Can't install packet filter program: %m");
 	}
 }
@@ -258,11 +268,14 @@ static void lpf_tr_filter_setup (info)
 			sizeof p) < 0) {
 		if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
 		    errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
-		    errno == EAFNOSUPPORT)
-			log_fatal ("socket: %m - make sure %s %s %s!",
-				   "CONFIG_PACKET (Packet socket)"
-				   "and CONFIG_FILTER (Socket Filtering) are",
-				   "enabled in your kernel configuration");
+		    errno == EAFNOSUPPORT) {
+			log_error ("socket: %m - make sure");
+			log_error ("CONFIG_PACKET (Packet socket) %s",
+				   "and CONFIG_FILTER");
+			log_error ("(Socket Filtering) are enabled %s",
+				   "in your kernel");
+			log_fatal ("configuration!");
+		}
 		log_fatal ("Can't install packet filter program: %m");
 	}
 }
@@ -278,21 +291,27 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	struct sockaddr_in *to;
 	struct hardware *hto;
 {
-	unsigned bufp = 0;
-	unsigned char buf [1500];
+	unsigned hbufp = 0, ibufp = 0;
+	double hh [16];
+	double ih [1536 / sizeof (double)];
+	unsigned char *buf = (unsigned char *)ih;
 	struct sockaddr sa;
 	int result;
+	int fudge;
 
 	if (!strcmp (interface -> name, "fallback"))
 		return send_fallback (interface, packet, raw,
 				      len, from, to, hto);
 
 	/* Assemble the headers... */
-	assemble_hw_header (interface, buf, &bufp, hto);
-	assemble_udp_ip_header (interface, buf, &bufp, from.s_addr,
+	assemble_hw_header (interface, (unsigned char *)hh, &hbufp, hto);
+	fudge = hbufp % 4;	/* IP header must be word-aligned. */
+	memcpy (buf + fudge, (unsigned char *)hh, hbufp);
+	ibufp = hbufp + fudge;
+	assemble_udp_ip_header (interface, buf, &ibufp, from.s_addr,
 				to -> sin_addr.s_addr, to -> sin_port,
 				(unsigned char *)raw, len);
-	memcpy (buf + bufp, raw, len);
+	memcpy (buf + ibufp, raw, len);
 
 	/* For some reason, SOCK_PACKET sockets can't be connected,
 	   so we have to do a sentdo every time. */
@@ -301,8 +320,8 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	strncpy (sa.sa_data,
 		 (const char *)interface -> ifp, sizeof sa.sa_data);
 
-	result = sendto (interface -> wfdesc, buf, bufp + len, 0,
-			 &sa, sizeof sa);
+	result = sendto (interface -> wfdesc,
+			 buf + fudge, ibufp + len - fudge, 0, &sa, sizeof sa);
 	if (result < 0)
 		log_error ("send_packet: %m");
 	return result;
@@ -321,7 +340,7 @@ ssize_t receive_packet (interface, buf, len, from, hfrom)
 	int length = 0;
 	int offset = 0;
 	unsigned char ibuf [1500];
-	int bufix = 0;
+	unsigned bufix = 0;
 
 	length = read (interface -> rfdesc, ibuf, sizeof ibuf);
 	if (length <= 0)
@@ -342,8 +361,8 @@ ssize_t receive_packet (interface, buf, len, from, hfrom)
 	length -= offset;
 
 	/* Decode the IP and UDP headers... */
-	offset = decode_udp_ip_header (interface, ibuf, bufix,
-				       from, (unsigned char *)0, length);
+	offset = decode_udp_ip_header (interface, ibuf, bufix, from,
+				       (unsigned char *)0, (unsigned)length);
 
 	/* If the IP or UDP checksum was bad, skip the packet... */
 	if (offset < 0)
diff --git a/common/nit.c b/common/nit.c
index 569065f8..c42be38b 100644
--- a/common/nit.c
+++ b/common/nit.c
@@ -44,7 +44,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: nit.c,v 1.30 2000/06/08 21:14:15 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: nit.c,v 1.31 2000/07/27 09:02:34 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -299,11 +299,12 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	struct sockaddr_in *to;
 	struct hardware *hto;
 {
-	unsigned bufp;
-	unsigned char buf [1536 + sizeof (struct sockaddr)];
+	unsigned hbufp, ibufp;
+	double hh [16];
+	double ih [1536 / sizeof (double)];
+	unsigned char *buf = (unsigned char *)ih;
 	struct sockaddr *junk;
 	struct strbuf ctl, data;
-	int hw_end;
 	struct sockaddr_in foo;
 	int result;
 
@@ -312,34 +313,30 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 				      len, from, to, hto);
 
 	/* Start with the sockaddr struct... */
-	junk = (struct sockaddr *)&buf [0];
-	bufp = ((unsigned char *)&junk -> sa_data [0]) - &buf [0];
+	junk = (struct sockaddr *)&hh [0];
+	hbufp = ((unsigned char *)&junk -> sa_data [0]) - &buf [0];
+	ibufp = 0;
 
 	/* Assemble the headers... */
-	assemble_hw_header (interface, buf, &bufp, hto);
-	hw_end = bufp;
-	assemble_udp_ip_header (interface, buf, &bufp, from.s_addr,
-				to -> sin_addr.s_addr, to -> sin_port,
-				raw, len);
+	assemble_hw_header (interface, (unsigned char *)junk, &hbufp, hto);
+	assemble_udp_ip_header (interface, buf, &ibufp,
+				from.s_addr, to -> sin_addr.s_addr,
+				to -> sin_port, raw, len);
 
 	/* Copy the data into the buffer (yuk). */
 	memcpy (buf + bufp, raw, len);
 
 	/* Set up the sockaddr structure... */
 #if USE_SIN_LEN
-	junk -> sa_len = hw_end - 2; /* XXX */
+	junk -> sa_len = hbufp - 2; /* XXX */
 #endif
 	junk -> sa_family = AF_UNSPEC;
 
-#if 0 /* Already done. */
-	memcpy (junk.sa_data, buf, hw_len);
-#endif
-
 	/* Set up the msg_buf structure... */
-	ctl.buf = (char *)&buf [0];
-	ctl.maxlen = ctl.len = hw_end;
-	data.buf = (char *)&buf [hw_end];
-	data.maxlen = data.len = bufp + len - hw_end;
+	ctl.buf = (char *)&hh [0];
+	ctl.maxlen = ctl.len = hbufp;
+	data.buf = (char *)&ih [0];
+	data.maxlen = data.len = ibufp + len;
 
 	result = putmsg (interface -> wfdesc, &ctl, &data, 0);
 	if (result < 0)
diff --git a/common/options.c b/common/options.c
index fdc8d4bb..8757eb83 100644
--- a/common/options.c
+++ b/common/options.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: options.c,v 1.62 2000/06/28 23:35:22 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: options.c,v 1.63 2000/07/27 09:02:35 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #define DHCP_OPTION_DATA
@@ -205,7 +205,7 @@ int cons_options (inpacket, outpacket, lease, mms, in_options, cfg_options,
 	int mms;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	int overload;	/* Overload flags that may be set. */
 	int terminate;
 	int bootpp;
@@ -420,7 +420,7 @@ int store_options (buffer, buflen, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	unsigned *priority_list;
 	int priority_len;
 	unsigned first_cutoff, second_cutoff;
@@ -751,7 +751,7 @@ int hashed_option_get (result, universe, packet, lease,
 	struct option_state *in_options;
 	struct option_state *cfg_options;
 	struct option_state *options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	unsigned code;
 {
 	struct option_cache *oc;
@@ -776,7 +776,7 @@ int agent_option_get (result, universe, packet, lease,
 	struct option_state *in_options;
 	struct option_state *cfg_options;
 	struct option_state *options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	unsigned code;
 {
 	struct agent_options *ao;
@@ -1154,7 +1154,7 @@ int store_option (result, universe, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct option_cache *oc;
 {
 	struct data_string d1, d2;
@@ -1201,7 +1201,7 @@ int option_space_encapsulate (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct data_string *name;
 {
 	struct universe *u;
@@ -1229,7 +1229,7 @@ int hashed_option_space_encapsulate (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct universe *universe;
 {
 	pair p, *hash;
@@ -1263,7 +1263,7 @@ int nwip_option_space_encapsulate (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct universe *universe;
 {
 	pair p, *hash;
@@ -1376,7 +1376,7 @@ void do_packet (interface, packet, len, from_port, from, hfrom)
 					       (struct lease *)0,
 					       decoded_packet -> options,
 					       (struct option_state *)0,
-					       (struct binding_scope *)0,
+					       (struct binding_scope **)0,
 					       op, MDL);
 			if (dp.len > 0)
 				decoded_packet -> packet_type = dp.data [0];
diff --git a/common/tree.c b/common/tree.c
index 83bbbebe..7361b97f 100644
--- a/common/tree.c
+++ b/common/tree.c
@@ -43,13 +43,13 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: tree.c,v 1.84 2000/07/06 10:00:53 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: tree.c,v 1.85 2000/07/27 09:02:36 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
 #include <omapip/omapip_p.h>
 
-struct binding_scope global_scope;
+struct binding_scope *global_scope;
 
 static int do_host_lookup PROTO ((struct data_string *,
 				  struct dns_host_entry *));
@@ -430,7 +430,7 @@ int evaluate_expression (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct expression *expr;
 {
 	struct binding_value *bv;
@@ -440,7 +440,10 @@ int evaluate_expression (result, packet, lease,
 	bv = (struct binding_value *)0;
 
 	if (expr -> op == expr_variable_reference) {
-		binding = find_binding (scope, expr -> data.variable);
+		if (!scope || !*scope)
+			return 0;
+
+		binding = find_binding (*scope, expr -> data.variable);
 
 		if (binding && binding -> value) {
 			if (result)
@@ -455,7 +458,14 @@ int evaluate_expression (result, packet, lease,
 		struct expression *arg;
 		struct binding_scope *ns;
 		struct binding *nb;
-		binding = find_binding (scope, expr -> data.funcall.name);
+
+		if (!scope || !*scope) {
+			log_error ("%s: no such function.",
+				   expr -> data.funcall.name);
+			return 0;
+		}
+
+		binding = find_binding (*scope, expr -> data.funcall.name);
 
 		if (!binding || !binding -> value) {
 			log_error ("%s: no such function.",
@@ -518,9 +528,11 @@ int evaluate_expression (result, packet, lease,
 			return 0;
 		}
 
-		ns -> outer = scope;
+		if (scope && *scope)
+			binding_scope_reference (&ns -> outer, *scope, MDL);
+
 		if (execute_statements
-		    (packet, lease, in_options, cfg_options, ns,
+		    (packet, lease, in_options, cfg_options, &ns,
 		     binding -> value -> value.fundef -> statements)) {
 			if (ns -> bindings && ns -> bindings -> name) {
 			    binding_value_reference (result,
@@ -641,7 +653,7 @@ int evaluate_dns_expression (result, packet, lease, in_options,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct expression *expr;
 {
 	ns_updrec *foo;
@@ -882,7 +894,7 @@ int evaluate_boolean_expression (result, packet, lease, in_options,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct expression *expr;
 {
 	struct data_string left, right;
@@ -1067,12 +1079,15 @@ int evaluate_boolean_expression (result, packet, lease, in_options,
 		return 1;
 
 	      case expr_variable_exists:
-		binding = find_binding (scope, expr -> data.variable);
+		if (scope && *scope) {
+			binding = find_binding (*scope, expr -> data.variable);
 
-		if (binding) {
-			if (binding -> value)
-				*result = 1;
-			else
+			if (binding) {
+				if (binding -> value)
+					*result = 1;
+				else
+					*result = 0;
+			} else
 				*result = 0;
 		} else
 			*result = 0;
@@ -1083,18 +1098,22 @@ int evaluate_boolean_expression (result, packet, lease, in_options,
 		return 1;
 
 	      case expr_variable_reference:
-		binding = find_binding (scope, expr -> data.variable);
+		if (scope && *scope) {
+		    binding = find_binding (*scope, expr -> data.variable);
 
-		if (binding && binding -> value) {
-			if (binding -> value -> type == binding_boolean) {
+		    if (binding && binding -> value) {
+			if (binding -> value -> type ==
+			    binding_boolean) {
 				*result = binding -> value -> value.boolean;
-			    sleft = 1;
+				sleft = 1;
 			} else {
 				log_error ("binding type %d in %s.",
 					   binding -> value -> type,
 					   "evaluate_boolean_expression");
 				sleft = 0;
 			}
+		    } else
+			    sleft = 0;
 		} else
 			sleft = 0;
 #if defined (DEBUG_EXPRESSIONS)
@@ -1194,7 +1213,7 @@ int evaluate_data_expression (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct expression *expr;
 {
 	struct data_string data, other;
@@ -1829,23 +1848,26 @@ int evaluate_data_expression (result, packet, lease,
 		return 0;
 
 	      case expr_variable_reference:
-		binding = find_binding (scope, expr -> data.variable);
+		if (scope && *scope) {
+		    binding = find_binding (*scope, expr -> data.variable);
 
-		if (binding && binding -> value) {
-		    if (binding -> value -> type == binding_data) {
+		    if (binding && binding -> value) {
+			if (binding -> value -> type == binding_data) {
 			    data_string_copy (result,
 					      &binding -> value -> value.data,
 					      MDL);
 			    s0 = 1;
-		    } else if (binding -> value -> type != binding_data) {
+			} else if (binding -> value -> type != binding_data) {
 			    log_error ("binding type %d in %s.",
 				       binding -> value -> type,
 				       "evaluate_data_expression");
 			    s0 = 0;
-		    } else
+			} else
 			    s0 = 0;
-		} else
+		    } else
 			s0 = 0;
+		} else
+		    s0 = 0;
 #if defined (DEBUG_EXPRESSIONS)
 		log_debug ("data: %s = %s", expr -> data.variable,
 			   s0 ? print_hex_1 (result -> len,
@@ -1998,7 +2020,7 @@ int evaluate_numeric_expression (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct expression *expr;
 {
 	struct data_string data;
@@ -2172,9 +2194,10 @@ int evaluate_numeric_expression (result, packet, lease,
 #endif /* NSUPDATE */
 
 	      case expr_variable_reference:
-		binding = find_binding (scope, expr -> data.variable);
+		if (scope && *scope) {
+		    binding = find_binding (*scope, expr -> data.variable);
 
-		if (binding && binding -> value) {
+		    if (binding && binding -> value) {
 			if (binding -> value -> type == binding_numeric) {
 				*result = binding -> value -> value.intval;
 			    status = 1;
@@ -2184,8 +2207,10 @@ int evaluate_numeric_expression (result, packet, lease,
 					   "evaluate_numeric_expression");
 				status = 0;
 			}
-		} else
+		    } else
 			status = 0;
+		} else
+		    status = 0;
 #if defined (DEBUG_EXPRESSIONS)
 		log_debug ("numeric: %s = %s", expr -> data.variable,
 			   status ? *result : 0);
@@ -2350,7 +2375,7 @@ int evaluate_option_cache (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct option_cache *oc;
 	const char *file;
 	int line;
@@ -2376,7 +2401,7 @@ int evaluate_boolean_option_cache (ignorep, packet, lease, in_options,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct option_cache *oc;
 	const char *file;
 	int line;
@@ -2416,7 +2441,7 @@ int evaluate_boolean_expression_result (ignorep, packet, lease, in_options,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct expression *expr;
 {
 	int result;
@@ -3407,6 +3432,9 @@ int binding_scope_dereference (ptr, file, line)
 	const char *file;
 	int line;
 {
+	int i;
+	struct binding_scope *binding_scope;
+
 	if (!ptr || !*ptr) {
 		log_error ("%s(%d): null pointer", file, line);
 #if defined (POINTER_DEBUG)
@@ -3416,10 +3444,29 @@ int binding_scope_dereference (ptr, file, line)
 #endif
 	}
 
-	if ((*ptr) -> bindings)
-		free_bindings (*ptr, file, line);
-	dfree ((*ptr), file, line);
+	binding_scope = *ptr;
 	*ptr = (struct binding_scope *)0;
+	--binding_scope -> refcnt;
+	rc_register (file, line, ptr, binding_scope, binding_scope -> refcnt);
+	if (binding_scope -> refcnt > 0)
+		return 1;
+
+	if (binding_scope -> refcnt < 0) {
+		log_error ("%s(%d): negative refcnt!", file, line);
+#if defined (DEBUG_RC_HISTORY)
+		dump_rc_history ();
+#endif
+#if defined (POINTER_DEBUG)
+		abort ();
+#else
+		return 0;
+#endif
+	}
+
+	free_bindings (binding_scope, file, line);
+	if (binding_scope -> outer)
+		binding_scope_dereference (&binding_scope -> outer, MDL);
+	dfree (binding_scope, file, line);
 	return 1;
 }
 
diff --git a/common/upf.c b/common/upf.c
index 10f8f236..78ac5b3c 100644
--- a/common/upf.c
+++ b/common/upf.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: upf.c,v 1.19 2000/06/08 21:14:16 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: upf.c,v 1.20 2000/07/27 09:02:38 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -265,28 +265,33 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	struct sockaddr_in *to;
 	struct hardware *hto;
 {
-	unsigned bufp = 0;
-	unsigned char buf [256];
-	struct iovec iov [2];
+	unsigned hbufp = 0, ibufp = 0;
+	double hw [4];
+	double ip [32];
+	struct iovec iov [3];
 	int result;
+	int fudge;
 
 	if (!strcmp (interface -> name, "fallback"))
 		return send_fallback (interface, packet, raw,
 				      len, from, to, hto);
 
 	/* Assemble the headers... */
-	assemble_hw_header (interface, buf, &bufp, hto);
-	assemble_udp_ip_header (interface, buf, &bufp, from.s_addr,
+	assemble_hw_header (interface, (unsigned char *)hw, &hbufp, hto);
+	assemble_udp_ip_header (interface,
+				(unsigned char *)ip, &ibufp, from.s_addr,
 				to -> sin_addr.s_addr, to -> sin_port,
 				(unsigned char *)raw, len);
 
 	/* Fire it off */
-	iov [0].iov_base = (char *)buf;
-	iov [0].iov_len = bufp;
-	iov [1].iov_base = (char *)raw;
-	iov [1].iov_len = len;
-
-	result = writev(interface -> wfdesc, iov, 2);
+	iov [0].iov_base = ((char *)hw);
+	iov [0].iov_len = hbufp;
+	iov [1].iov_base = ((char *)ip);
+	iov [1].iov_len = ibufp;
+	iov [2].iov_base = (char *)raw;
+	iov [2].iov_len = len;
+
+	result = writev(interface -> wfdesc, iov, 3);
 	if (result < 0)
 		log_error ("send_packet: %m");
 	return result;