CVE-2022-29859 (C, published 2022-04-27T23:15Z)
Description: value: component/common/network/dhcp/dhcps.c in ambiot amb1_sdk (aka SDK for Ameba1) before 2022-03-11 mishandles data structures for DHCP packet data.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ambiot/amb1_sdk
Files changed:
component/common/network/dhcp/dhcps.c
component/common/network/dhcp/dhcps.h
Commit message: [dhcps] update dhcps


Vulnerable code:

		ip_table.ip_range[4] = MARK_RANGE5_IP_BIT(ip_table, d);	
	
	printf("\r\n%s: ip %d.%d.%d.%d, hwaddr %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n", __func__,
#endif	
  * @retval the addr represent to add the end of option.
static void add_offer_options(uint8_t *option_start_address)
	uint8_t *temp_option_addr;
	temp_option_addr = fill_one_option_content(option_start_address,
			DHCP_OPTION_CODE_SUBNET_MASK, DHCP_OPTION_LENGTH_FOUR,
					(void *)&dhcps_local_mask);
	temp_option_addr = fill_one_option_content(temp_option_addr,
			DHCP_OPTION_CODE_ROUTER, DHCP_OPTION_LENGTH_FOUR,
					(void *)&dhcps_local_address);
	temp_option_addr = fill_one_option_content(temp_option_addr,
			DHCP_OPTION_CODE_DNS_SERVER, DHCP_OPTION_LENGTH_FOUR,
					(void *)&dhcps_local_address);	
	temp_option_addr = fill_one_option_content(temp_option_addr,
			DHCP_OPTION_CODE_LEASE_TIME, DHCP_OPTION_LENGTH_FOUR,
					(void *)&dhcp_option_lease_time);
	temp_option_addr = fill_one_option_content(temp_option_addr,
			DHCP_OPTION_CODE_SERVER_ID, DHCP_OPTION_LENGTH_FOUR,
				(void *)&dhcps_local_address);
	temp_option_addr = fill_one_option_content(temp_option_addr,
		DHCP_OPTION_CODE_BROADCAST_ADDRESS, DHCP_OPTION_LENGTH_FOUR,
				(void *)&dhcps_subnet_broadcast);
	temp_option_addr = fill_one_option_content(temp_option_addr,
		DHCP_OPTION_CODE_INTERFACE_MTU, DHCP_OPTION_LENGTH_TWO,
					(void *) &dhcp_option_interface_mtu);//dhcp_option_interface_mtu_576);
	temp_option_addr = fill_one_option_content(temp_option_addr,
		DHCP_OPTION_CODE_PERFORM_ROUTER_DISCOVERY, DHCP_OPTION_LENGTH_ONE,
								NULL);
        dhcp_message_repository->flags = htons(BOOTP_BROADCAST);         
	dhcp_message_repository = (struct dhcp_msg *)packet_buffer->payload;	
#if (!IS_USE_FIXED_IP) 	
	printf("\n\r[%d]DHCP assign ip = %d.%d.%d.%d\n", xTaskGetTickCount(), ip4_addr1(&dhcps_network_id),ip4_addr2(&dhcps_network_id),ip4_addr3(&dhcps_network_id),temp_ip);
	add_offer_options(add_msg_type(&dhcp_message_repository->options[4],
			DHCP_MESSAGE_TYPE_OFFER));
	udp_sendto_if(dhcps_pcb, packet_buffer,
			&dhcps_send_broadcast_address, DHCP_CLIENT_PORT, dhcps_netif);
	dhcp_message_repository = (struct dhcp_msg *)packet_buffer->payload;
	add_offer_options(add_msg_type(&dhcp_message_repository->options[4],
			      			DHCP_MESSAGE_TYPE_ACK));
	udp_sendto_if(dhcps_pcb, packet_buffer,
		   &dhcps_send_broadcast_address, DHCP_CLIENT_PORT, dhcps_netif);
			if (ip4_addr4(&dhcps_allocated_client_address) != 0) { 
				if (memcmp((void *)&dhcps_allocated_client_address, (void *)&client_request_ip, 4) == 0) {  	
			uint8_t ip_addr4 = check_client_request_ip(&client_request_ip, client_addr);
			if(ip_addr4 > 0){
			mark_ip_in_table((uint8_t)ip4_addr4(&dhcps_allocated_client_address)); 			
	}		

Fixed code:
#include "wifi_constants.h"
extern rtw_mode_t wifi_mode;
static struct udp_pcb *dns_server_pcb;
static struct eth_addr dhcps_allocated_client_ethaddr;
		ip_table.ip_range[4] = MARK_RANGE5_IP_BIT(ip_table, (d - 128));	
#if LWIP_VERSION_MAJOR >= 2
	uint8_t d = (uint8_t)ip4_addr4(ip_2_ip4(client_ip));
#else
#endif
#if LWIP_VERSION_MAJOR >= 2
	printf("\r\n%s: ip %d.%d.%d.%d, hwaddr 0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n", __func__,
		ip4_addr1(ip_2_ip4(client_ip)), ip4_addr2(ip_2_ip4(client_ip)), ip4_addr3(ip_2_ip4(client_ip)), ip4_addr4(ip_2_ip4(client_ip)),
		hwaddr[0], hwaddr[1], hwaddr[2], hwaddr[3], hwaddr[4], hwaddr[5]);
#else
	printf("\r\n%s: ip %d.%d.%d.%d, hwaddr 0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n", __func__,
#endif
#endif

static uint8_t check_client_direct_request_ip(struct ip_addr *client_req_ip, uint8_t *hwaddr)
{
	int ip_addr4 = 0, i;

#if (debug_dhcps)	
#if LWIP_VERSION_MAJOR >= 2
	printf("\r\n%s: ip %d.%d.%d.%d, hwaddr 0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n", __func__,
			ip4_addr1(ip_2_ip4(client_req_ip)), ip4_addr2(ip_2_ip4(client_req_ip)), ip4_addr3(ip_2_ip4(client_req_ip)), ip4_addr4(ip_2_ip4(client_req_ip)),
			hwaddr[0], hwaddr[1], hwaddr[2], hwaddr[3], hwaddr[4], hwaddr[5]);
#else
	printf("\r\n%s: ip %d.%d.%d.%d, hwaddr 0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n", __func__,
			ip4_addr1(client_req_ip), ip4_addr2(client_req_ip), ip4_addr3(client_req_ip), ip4_addr4(client_req_ip),
			hwaddr[0], hwaddr[1], hwaddr[2], hwaddr[3], hwaddr[4], hwaddr[5]);
#endif	
#endif

#if LWIP_VERSION_MAJOR >= 2
	if( (ip4_addr1(ip_2_ip4(&dhcps_network_id)) != ip4_addr1(ip_2_ip4(client_req_ip))) ||
		(ip4_addr2(ip_2_ip4(&dhcps_network_id)) != ip4_addr2(ip_2_ip4(client_req_ip))) ||
		(ip4_addr3(ip_2_ip4(&dhcps_network_id)) != ip4_addr3(ip_2_ip4(client_req_ip))))
#else
	if( (ip4_addr1(&dhcps_network_id) != ip4_addr1(client_req_ip)) ||
		(ip4_addr2(&dhcps_network_id) != ip4_addr2(client_req_ip)) ||
		(ip4_addr3(&dhcps_network_id) != ip4_addr3(client_req_ip)))
#endif

	{
		ip_addr4 = 0;
		goto Exit;
	}

	// check if the requested ip is available
#if LWIP_VERSION_MAJOR >= 2
	ip_addr4 = ip4_addr4(ip_2_ip4(client_req_ip));
#else
	ip_addr4 = ip4_addr4(client_req_ip);
#endif

	if (ip_addr4 < DHCP_POOL_START || ip_addr4 > DHCP_POOL_END) {
		ip_addr4 = 0;
		goto Exit;
	}
	xSemaphoreTake(dhcps_ip_table_semaphore, portMAX_DELAY);
	printf("ip_table[%d] = %x,%x,%x,%x,%x,%x\n",ip_addr4,ip_table.client_mac[ip_addr4][0],
										  			     ip_table.client_mac[ip_addr4][1],
										  				 ip_table.client_mac[ip_addr4][2],
										  				 ip_table.client_mac[ip_addr4][3],
										  				 ip_table.client_mac[ip_addr4][4],
										  				 ip_table.client_mac[ip_addr4][5]);
	if(	(	ip_table.client_mac[ip_addr4][0] == 0 &&
			ip_table.client_mac[ip_addr4][1] == 0 &&
			ip_table.client_mac[ip_addr4][2] == 0 &&
			ip_table.client_mac[ip_addr4][3] == 0 &&
			ip_table.client_mac[ip_addr4][4] == 0 &&
			ip_table.client_mac[ip_addr4][5] == 0) ||
		(	ip_table.client_mac[ip_addr4][0] == hwaddr[0] &&
			ip_table.client_mac[ip_addr4][1] == hwaddr[1] &&
			ip_table.client_mac[ip_addr4][2] == hwaddr[2] &&
			ip_table.client_mac[ip_addr4][3] == hwaddr[3] &&
			ip_table.client_mac[ip_addr4][4] == hwaddr[4] &&
			ip_table.client_mac[ip_addr4][5] == hwaddr[5]))
	{
		// the ip is available or already allocated to this client
	}
	else
	{
		ip_addr4 = 0; // the ip is used
	}
	
	xSemaphoreGive(dhcps_ip_table_semaphore);

Exit:
	return ip_addr4;
}

#if LWIP_VERSION_MAJOR >= 2
		start = (uint8_t)ip4_addr4(ip_2_ip4(&dhcps_addr_pool_start));
		end = (uint8_t)ip4_addr4(ip_2_ip4(&dhcps_addr_pool_end));
#else
#endif

  * @retval	0, add ok
  *			-1, add fail
static int8_t add_offer_options(uint8_t *option_start_address)
	// Total minimum len = 6+6+6+6+6+6+4+3+1 = 44
	uint8_t *temp_option_addr = option_start_address;
	int max_addable_option_len = dhcp_message_total_options_lenth - 4 - 3;	// -magic-type

	if(option_start_address == NULL)
		goto ERROR;

	if(temp_option_addr + 6 -option_start_address <= max_addable_option_len) {
		temp_option_addr = fill_one_option_content(option_start_address, DHCP_OPTION_CODE_SUBNET_MASK,
						DHCP_OPTION_LENGTH_FOUR,(void *)&dhcps_local_mask);
	}else{
		goto ERROR;
	}
        if(temp_option_addr + 6 -option_start_address <= max_addable_option_len) {
		temp_option_addr = fill_one_option_content(temp_option_addr, DHCP_OPTION_CODE_ROUTER,
						DHCP_OPTION_LENGTH_FOUR, (void *)&dhcps_local_address);
	}else{
		goto ERROR;
	}
	 if(temp_option_addr + 6 -option_start_address <= max_addable_option_len) {
	 	temp_option_addr = fill_one_option_content(temp_option_addr, DHCP_OPTION_CODE_DNS_SERVER,
						DHCP_OPTION_LENGTH_FOUR, (void *)&dhcps_local_address);	
	}else{
		goto ERROR;
	}
	
	 if(temp_option_addr + 6 -option_start_address <= max_addable_option_len) {
		temp_option_addr = fill_one_option_content(temp_option_addr, DHCP_OPTION_CODE_LEASE_TIME,
						DHCP_OPTION_LENGTH_FOUR, (void *)&dhcp_option_lease_time);
	}else{
		goto ERROR;
	}
	
	 if(temp_option_addr + 6 -option_start_address <= max_addable_option_len) {
		temp_option_addr = fill_one_option_content(temp_option_addr, DHCP_OPTION_CODE_SERVER_ID,
						DHCP_OPTION_LENGTH_FOUR, (void *)&dhcps_local_address);
	}else{
		goto ERROR;
	}
	
	if(temp_option_addr + 6 -option_start_address <= max_addable_option_len) {
		temp_option_addr = fill_one_option_content(temp_option_addr, DHCP_OPTION_CODE_BROADCAST_ADDRESS,
						DHCP_OPTION_LENGTH_FOUR, (void *)&dhcps_subnet_broadcast);
	}else{
		goto ERROR;
	}
	
	if(temp_option_addr + 4 -option_start_address <= max_addable_option_len) {
		temp_option_addr = fill_one_option_content(temp_option_addr, DHCP_OPTION_CODE_INTERFACE_MTU,
						DHCP_OPTION_LENGTH_TWO, (void *) &dhcp_option_interface_mtu);//dhcp_option_interface_mtu_576);
	}else{
		goto ERROR;
	}
	
	if(temp_option_addr + 3 -option_start_address <= max_addable_option_len) {
		temp_option_addr = fill_one_option_content(temp_option_addr, DHCP_OPTION_CODE_PERFORM_ROUTER_DISCOVERY,
						DHCP_OPTION_LENGTH_ONE,	NULL);
	}else{
		goto ERROR;
	}

	// END
	if(temp_option_addr + 1 -option_start_address <= max_addable_option_len) {
	}else{
		goto ERROR;
	}
	return 0;
ERROR:
	printf("\r\n[%s] error: add options fail !!", __func__);
	return -1;
	struct pbuf *newly_malloc_packet_buffer = NULL;

	// newly malloc a longer pbuf for dhcp offer rather than using the short pbuf from dhcp discover
	newly_malloc_packet_buffer = pbuf_alloc(PBUF_TRANSPORT, DHCP_MSG_LEN + DHCP_OPTION_TOTAL_LENGTH_MAX, PBUF_RAM);
	if(newly_malloc_packet_buffer == NULL)
	{
		printf("\r\n[%s] error:  pbuf alloc fail !", __func__);
		return;
	}
	if(pbuf_copy(newly_malloc_packet_buffer, packet_buffer) != ERR_OK)
	{
		printf("\r\n[%s] error:  pbuf copy fail !", __func__);
		pbuf_free(newly_malloc_packet_buffer);	
		return;
	}	
	dhcp_message_total_options_lenth = DHCP_OPTION_TOTAL_LENGTH_MAX;
	dhcp_message_repository = (struct dhcp_msg *)newly_malloc_packet_buffer->payload;	
#if (!IS_USE_FIXED_IP) 
#ifdef CONFIG_DHCPS_KEPT_CLIENT_INFO
#endif
#if LWIP_VERSION_MAJOR >= 2
	printf("\n\r[%d]DHCP assign ip = %d.%d.%d.%d, hwaddr 0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n", \
			xTaskGetTickCount(), ip4_addr1(ip_2_ip4(&dhcps_network_id)), \
			ip4_addr2(ip_2_ip4(&dhcps_network_id)), \
			ip4_addr3(ip_2_ip4(&dhcps_network_id)), temp_ip, \
			client_addr[0], client_addr[1], client_addr[2], \
			client_addr[3], client_addr[4], client_addr[5]);
	IP4_ADDR(ip_2_ip4(&dhcps_allocated_client_address), (ip4_addr1(ip_2_ip4(&dhcps_network_id))),
			ip4_addr2(ip_2_ip4(&dhcps_network_id)), ip4_addr3(ip_2_ip4(&dhcps_network_id)), temp_ip);
#else
	printf("\n\r[%d]DHCP assign ip = %d.%d.%d.%d, hwaddr 0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n", \
			xTaskGetTickCount(), ip4_addr1(&dhcps_network_id), \
			ip4_addr2(&dhcps_network_id), ip4_addr3(&dhcps_network_id), temp_ip, \
			client_addr[0], client_addr[1], client_addr[2], \
			client_addr[3], client_addr[4], client_addr[5]);
#endif

	if(add_offer_options(add_msg_type(&dhcp_message_repository->options[4], DHCP_MESSAGE_TYPE_OFFER)) == 0){
		if(dhcp_message_repository->flags == 0x0){
			// unicast
			for(int i=0;i<6;i++)
				dhcps_allocated_client_ethaddr.addr[i] = dhcp_message_repository->chaddr[i];
#if ETHARP_SUPPORT_STATIC_ENTRIES
#if LWIP_VERSION_MAJOR >= 2
				etharp_add_static_entry(ip_2_ip4(&dhcps_allocated_client_address), &dhcps_allocated_client_ethaddr);
#else
				etharp_add_static_entry(&dhcps_allocated_client_address, &dhcps_allocated_client_ethaddr);
#endif
#endif
				udp_sendto_if(dhcps_pcb, newly_malloc_packet_buffer, &dhcps_allocated_client_address, DHCP_CLIENT_PORT, dhcps_netif);
#if ETHARP_SUPPORT_STATIC_ENTRIES	
#if LWIP_VERSION_MAJOR >= 2
				etharp_remove_static_entry(ip_2_ip4(&dhcps_allocated_client_address));
#else
				etharp_remove_static_entry(&dhcps_allocated_client_address);
#endif
#endif

		}
		else
			// broadcast
			udp_sendto_if(dhcps_pcb, newly_malloc_packet_buffer, &dhcps_send_broadcast_address, DHCP_CLIENT_PORT, dhcps_netif);
	}

	pbuf_free(newly_malloc_packet_buffer);	
	struct pbuf *newly_malloc_packet_buffer = NULL;

	// newly malloc a longer pbuf for dhcp ack rather than using the short pbuf from dhcp request
	newly_malloc_packet_buffer = pbuf_alloc(PBUF_TRANSPORT, DHCP_MSG_LEN + DHCP_OPTION_TOTAL_LENGTH_MAX, PBUF_RAM);
	if(newly_malloc_packet_buffer == NULL)
	{
		printf("\r\n[%s] error:  pbuf alloc fail !", __func__);
		return;
	}
	if(pbuf_copy(newly_malloc_packet_buffer, packet_buffer) != ERR_OK)
	{
		printf("\r\n[%s] error:  pbuf copy fail !", __func__);
		pbuf_free(newly_malloc_packet_buffer);	
		return;
	}	
	dhcp_message_total_options_lenth = DHCP_OPTION_TOTAL_LENGTH_MAX;
	dhcp_message_repository = (struct dhcp_msg *)newly_malloc_packet_buffer->payload;
	if(add_offer_options(add_msg_type(&dhcp_message_repository->options[4], DHCP_MESSAGE_TYPE_ACK)) == 0){
		if(dhcp_message_repository->flags == 0x0){
			// unicast
			for(int i=0;i<6;i++)
				dhcps_allocated_client_ethaddr.addr[i] = dhcp_message_repository->chaddr[i];
#if ETHARP_SUPPORT_STATIC_ENTRIES
#if LWIP_VERSION_MAJOR >= 2
			etharp_add_static_entry(ip_2_ip4(&dhcps_allocated_client_address), &dhcps_allocated_client_ethaddr);
#else
			etharp_add_static_entry(&dhcps_allocated_client_address, &dhcps_allocated_client_ethaddr);
#endif
#endif
			udp_sendto_if(dhcps_pcb, newly_malloc_packet_buffer, &dhcps_allocated_client_address, DHCP_CLIENT_PORT, dhcps_netif);
#if ETHARP_SUPPORT_STATIC_ENTRIES	
#if LWIP_VERSION_MAJOR >= 2
			etharp_remove_static_entry(ip_2_ip4(&dhcps_allocated_client_address));
#else
			etharp_remove_static_entry(&dhcps_allocated_client_address);
#endif
#endif
		}
		else
			// broadcast
			udp_sendto_if(dhcps_pcb, newly_malloc_packet_buffer, &dhcps_send_broadcast_address, DHCP_CLIENT_PORT, dhcps_netif);
	}
	pbuf_free(newly_malloc_packet_buffer);
#if LWIP_VERSION_MAJOR >= 2
		printf("\r\ndhcps_allocated_client_address=%d.%d.%d.%d", 
				ip4_addr1(ip_2_ip4(&dhcps_allocated_client_address)),
				ip4_addr2(ip_2_ip4(&dhcps_allocated_client_address)),
				ip4_addr3(ip_2_ip4(&dhcps_allocated_client_address)),
				ip4_addr4(ip_2_ip4(&dhcps_allocated_client_address)));
		printf("\r\nclient_request_ip=%d.%d.%d.%d\n", 
				ip4_addr1(ip_2_ip4(&client_request_ip)),
				ip4_addr2(ip_2_ip4(&client_request_ip)),
				ip4_addr3(ip_2_ip4(&client_request_ip)),
				ip4_addr4(ip_2_ip4(&client_request_ip)));
#else
#endif


		// for renew
		if((*(uint32_t *) dhcp_message_repository->ciaddr != 0) && (*(uint32_t *)&client_request_ip == 0)) {
			memcpy(&client_request_ip, dhcp_message_repository->ciaddr, sizeof(client_request_ip));
		}

			uint8_t ip_addr4 = check_client_direct_request_ip(&client_request_ip, client_addr);

			if(ip_addr4 > 0){
#if LWIP_VERSION_MAJOR >= 2
				printf("\n\r[%d] DHCP assign ip = %d.%d.%d.%d\n", xTaskGetTickCount(), ip4_addr1(ip_2_ip4(&dhcps_network_id)),ip4_addr2(ip_2_ip4(&dhcps_network_id)),ip4_addr3(ip_2_ip4(&dhcps_network_id)),ip_addr4);
				IP4_ADDR(ip_2_ip4(&dhcps_allocated_client_address), (ip4_addr1(ip_2_ip4(&dhcps_network_id))),
						ip4_addr2(ip_2_ip4(&dhcps_network_id)), ip4_addr3(ip_2_ip4(&dhcps_network_id)), ip_addr4);
#else
				printf("\n\r[%d] DHCP assign ip = %d.%d.%d.%d\n", xTaskGetTickCount(), ip4_addr1(&dhcps_network_id),ip4_addr2(&dhcps_network_id),ip4_addr3(&dhcps_network_id),ip_addr4);
				IP4_ADDR(&dhcps_allocated_client_address, (ip4_addr1(&dhcps_network_id)),
						ip4_addr2(&dhcps_network_id), ip4_addr3(&dhcps_network_id), ip_addr4);
#endif
				dhcp_server_state_machine = DHCP_SERVER_STATE_ACK;
				break;
			}

#if LWIP_VERSION_MAJOR >= 2
			if (ip4_addr4(ip_2_ip4(&dhcps_allocated_client_address)) != 0) 
#else
			if (ip4_addr4(&dhcps_allocated_client_address) != 0) 
#endif 
			{ 
				if (memcmp((void *)&dhcps_allocated_client_address, (void *)&client_request_ip, 4) == 0) {  
#if LWIP_VERSION_MAJOR >= 2
					printf("\n\r[%d] DHCP assign ip = %d.%d.%d.%d\n", xTaskGetTickCount(), ip4_addr1(ip_2_ip4(&dhcps_network_id)),ip4_addr2(ip_2_ip4(&dhcps_network_id)),ip4_addr3(ip_2_ip4(&dhcps_network_id)),ip4_addr4(ip_2_ip4(&dhcps_allocated_client_address)));
#else
					printf("\n\r[%d] DHCP assign ip = %d.%d.%d.%d\n", xTaskGetTickCount(), ip4_addr1(&dhcps_network_id),ip4_addr2(&dhcps_network_id),ip4_addr3(&dhcps_network_id),ip4_addr4(&dhcps_allocated_client_address));
#endif
#ifdef CONFIG_DHCPS_KEPT_CLIENT_INFO
			uint8_t ip_addr4 = check_client_direct_request_ip(&client_request_ip, client_addr);

			if(ip_addr4 > 0){			
#if LWIP_VERSION_MAJOR >= 2
				printf("\n\r[%d] DHCP assign ip = %d.%d.%d.%d\n", xTaskGetTickCount(), ip4_addr1(ip_2_ip4(&dhcps_network_id)),ip4_addr2(ip_2_ip4(&dhcps_network_id)),ip4_addr3(ip_2_ip4(&dhcps_network_id)),ip_addr4);
				IP4_ADDR(ip_2_ip4(&dhcps_allocated_client_address), (ip4_addr1(ip_2_ip4(&dhcps_network_id))),
						ip4_addr2(ip_2_ip4(&dhcps_network_id)), ip4_addr3(ip_2_ip4(&dhcps_network_id)), ip_addr4);
#else
				printf("\n\r[%d] DHCP assign ip = %d.%d.%d.%d\n", xTaskGetTickCount(), ip4_addr1(&dhcps_network_id),ip4_addr2(&dhcps_network_id),ip4_addr3(&dhcps_network_id),ip_addr4);
#endif

#endif
#if LWIP_VERSION_MAJOR >= 2
		if(netif_get_idx(ip_current_input_netif()) == 0 && wifi_mode == RTW_MODE_STA_AP)
#else
		if(netif_get_idx(ip_current_netif()) == 0 && wifi_mode == RTW_MODE_STA_AP)
#endif
		{
			pbuf_free(udp_packet_buffer);
			return;
		}
			udp_packet_buffer = merged_packet_buffer;
#if LWIP_VERSION_MAJOR >= 2
			mark_ip_in_table((uint8_t)ip4_addr4(ip_2_ip4(&dhcps_allocated_client_address))); 
#else
			mark_ip_in_table((uint8_t)ip4_addr4(&dhcps_allocated_client_address)); 	
#endif			


static void dnss_receive_udp_packet_handler(void *arg, struct udp_pcb *udp_pcb,
struct pbuf *udp_packet_buffer, struct ip_addr *sender_addr, uint16_t sender_port)
{
	int ret=0;
	struct dns_hdr *dns_rsp;

/*
	printf("\n%s: Receive DNS query,ip = %d.%d.%d.%d, port = %d(%x)\n",__func__,\
			sender_addr->addr & 0xff,\
			sender_addr->addr>>8 & 0xff,\
			sender_addr->addr>>16 & 0xff,\
			sender_addr->addr>>24 & 0xff,\
			sender_port,sender_port);
*/

	dns_rsp = (struct dns_hdr*) udp_packet_buffer->payload;

	dns_rsp->flags1 |= 0x80; // 0x80 : Response;
	dns_rsp->flags2 = 0x05;  //0x05 : Reply code (Query Refused)

	ret = udp_sendto(udp_pcb, udp_packet_buffer, sender_addr, sender_port);

	/* free the UDP connection, so we can accept new clients */
	udp_disconnect(udp_pcb);

	/* Free the packet buffer */
	pbuf_free(udp_packet_buffer);
}


void dns_server_init(struct netif * pnetif)
{
	uint8_t *ip;

	if (dns_server_pcb != NULL) {
		udp_remove(dns_server_pcb);
		dns_server_pcb = NULL;
	}

	dns_server_pcb = udp_new();
	if (dns_server_pcb == NULL) {
		printf("\n\r Error!!!upd_new error \n\r");
		return;
	}

	udp_bind(dns_server_pcb, IP_ADDR_ANY, DNS_SERVER_PORT);
	udp_recv(dns_server_pcb, dnss_receive_udp_packet_handler, NULL);
}

void dns_server_deinit(void)
{
	if (dns_server_pcb != NULL) {
		udp_remove(dns_server_pcb);
		dns_server_pcb = NULL;
	}
}

#if LWIP_VERSION_MAJOR >= 2
	IP4_ADDR(ip_2_ip4(&dhcps_send_broadcast_address), 255, 255, 255, 255);
#else
#endif

#if LWIP_VERSION_MAJOR >= 2
	ip4_addr_set_u32(ip_2_ip4(&dhcps_network_id), (ip_addr_get_ip4_u32(netif_ip_addr4(pnetif))&(ip_addr_get_ip4_u32(netif_ip_netmask4(pnetif)))));
	ip4_addr_set_u32(ip_2_ip4(&dhcps_subnet_broadcast), (ip4_addr_get_u32(ip_2_ip4(&dhcps_network_id)) | ~(ip_addr_get_ip4_u32(netif_ip_netmask4(pnetif)))));
#if 1
	ip4_addr_set_u32(ip_2_ip4(&dhcps_owned_first_ip), htonl(ntohl(ip4_addr_get_u32(ip_2_ip4(&dhcps_network_id))) + 1));
	ip4_addr_set_u32(ip_2_ip4(&dhcps_owned_last_ip), htonl(ntohl(ip4_addr_get_u32(ip_2_ip4(&dhcps_subnet_broadcast))) - 1));	
	dhcps_num_of_available_ips = (ntohl(ip4_addr_get_u32(ip_2_ip4(&dhcps_owned_last_ip))) - ntohl(ip4_addr_get_u32(ip_2_ip4(&dhcps_owned_first_ip)))) + 1;
#endif
#else
#endif

#if LWIP_VERSION_MAJOR >= 2
	IP4_ADDR(ip_2_ip4(&dhcps_allocated_client_address), ip4_addr1(ip_2_ip4(&dhcps_local_address))
		, ip4_addr2(ip_2_ip4(&dhcps_local_address)), ip4_addr3(ip_2_ip4(&dhcps_local_address)),
					(ip4_addr4(ip_2_ip4(&dhcps_local_address))) + 1 );
#else
#endif

#if LWIP_VERSION_MAJOR >= 2
	mark_ip_in_table((uint8_t)ip4_addr4(ip_2_ip4(&dhcps_local_address)));
	mark_ip_in_table((uint8_t)ip4_addr4(ip_2_ip4(&dhcps_local_gateway)));
#else
#endif

#if LWIP_VERSION_MAJOR >= 2
	if(ip4_addr_get_u32(ip_2_ip4(&dhcps_addr_pool_start)) == 0 && ip4_addr_get_u32(ip_2_ip4(&dhcps_addr_pool_end)) == 0)
#else
#endif


	//DNS server init
	dns_server_init(pnetif);

	}		   
    //DNS server deinit
	dns_server_deinit();
#include "netif/etharp.h"
#define DNS_SERVER_PORT 				(53)
#ifndef DHCP_MSG_LEN
#define DHCP_MSG_LEN							236
#endif
#define DHCP_OPTION_TOTAL_LENGTH_MAX	312	//(51)= 4(magic)+3(type)+44(option code: 1,3,6,51,54,28,26,32,end)
PACK_STRUCT_BEGIN
/** DNS message header */
struct dns_hdr {
  PACK_STRUCT_FIELD(u16_t id);
  PACK_STRUCT_FIELD(u8_t flags1);
  PACK_STRUCT_FIELD(u8_t flags2);
  PACK_STRUCT_FIELD(u16_t numquestions);
  PACK_STRUCT_FIELD(u16_t numanswers);
  PACK_STRUCT_FIELD(u16_t numauthrr);
  PACK_STRUCT_FIELD(u16_t numextrarr);
} PACK_STRUCT_STRUCT;
PACK_STRUCT_END