Merge branch 'busybox' into merge

Conflicts:
	Makefile.flags

20 files changed, 2537 insertions, 414 deletions

diff --git a/networking/Config.src b/networking/Config.src
index 8aeba0ef9..fb7dca7d4 100644
--- a/networking/Config.src
+++ b/networking/Config.src
@@ -199,14 +199,22 @@ config FEATURE_HTTPD_BASIC_AUTH
         help
           Utilizes password settings from /etc/httpd.conf for basic
           authentication on a per url basis.
+          Example for httpd.conf file:
+          /adm:toor:PaSsWd
 
 config FEATURE_HTTPD_AUTH_MD5
         bool "Support MD5 crypted passwords for http Authentication"
         default y
         depends on FEATURE_HTTPD_BASIC_AUTH
         help
-          Enables basic per URL authentication from /etc/httpd.conf
-          using md5 passwords.
+          Enables encrypted passwords, and wildcard user/passwords
+          in httpd.conf file.
+          User '*' means 'any system user name is ok',
+          password of '*' means 'use system password for this user'
+          Examples:
+          /adm:toor:$1$P/eKnWXS$aI1aPGxT.dJD5SzqAKWrF0
+          /adm:root:*
+          /wiki:*:*
 
 config FEATURE_HTTPD_CGI
         bool "Support Common Gateway Interface (CGI)"
@@ -223,8 +231,8 @@ config FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
         help
           This option enables support for running scripts through an
           interpreter. Turn this on if you want PHP scripts to work
-          properly. You need to supply an additional line in your httpd
-          config file:
+          properly. You need to supply an additional line in your
+          httpd.conf file:
           *.php:/path/to/your/php
 
 config FEATURE_HTTPD_SET_REMOTE_PORT_TO_ENV
diff --git a/networking/ftpd.c b/networking/ftpd.c
index e38138c0a..1c97df564 100644
--- a/networking/ftpd.c
+++ b/networking/ftpd.c
@@ -1179,8 +1179,7 @@ int ftpd_main(int argc UNUSED_PARAM, char **argv)
 #endif
 
         if (argv[optind]) {
-                xchdir(argv[optind]);
-                chroot(".");
+                xchroot(argv[optind]);
         }
 
         //umask(077); - admin can set umask before starting us
diff --git a/networking/ftpgetput.c b/networking/ftpgetput.c
index abdf94c45..8283366cc 100644
--- a/networking/ftpgetput.c
+++ b/networking/ftpgetput.c
@@ -16,37 +16,37 @@
 //usage:#define ftpget_trivial_usage
 //usage:       "[OPTIONS] HOST [LOCAL_FILE] REMOTE_FILE"
 //usage:#define ftpget_full_usage "\n\n"
-//usage:       "Retrieve a remote file via FTP\n"
+//usage:       "Download a file via FTP\n"
 //usage:        IF_FEATURE_FTPGETPUT_LONG_OPTIONS(
-//usage:     "\n        -c,--continue   Continue previous transfer"
-//usage:     "\n        -v,--verbose    Verbose"
-//usage:     "\n        -u,--username   Username"
-//usage:     "\n        -p,--password   Password"
-//usage:     "\n        -P,--port       Port number"
+//usage:     "\n        -c,--continue           Continue previous transfer"
+//usage:     "\n        -v,--verbose            Verbose"
+//usage:     "\n        -u,--username USER      Username"
+//usage:     "\n        -p,--password PASS      Password"
+//usage:     "\n        -P,--port NUM           Port"
 //usage:        )
 //usage:        IF_NOT_FEATURE_FTPGETPUT_LONG_OPTIONS(
 //usage:     "\n        -c      Continue previous transfer"
 //usage:     "\n        -v      Verbose"
-//usage:     "\n        -u      Username"
-//usage:     "\n        -p      Password"
-//usage:     "\n        -P      Port number"
+//usage:     "\n        -u USER Username"
+//usage:     "\n        -p PASS Password"
+//usage:     "\n        -P NUM  Port"
 //usage:        )
 //usage:
 //usage:#define ftpput_trivial_usage
 //usage:       "[OPTIONS] HOST [REMOTE_FILE] LOCAL_FILE"
 //usage:#define ftpput_full_usage "\n\n"
-//usage:       "Store a local file on a remote machine via FTP\n"
+//usage:       "Upload a file to a FTP server\n"
 //usage:        IF_FEATURE_FTPGETPUT_LONG_OPTIONS(
-//usage:     "\n        -v,--verbose    Verbose"
-//usage:     "\n        -u,--username   Username"
-//usage:     "\n        -p,--password   Password"
-//usage:     "\n        -P,--port       Port number"
+//usage:     "\n        -v,--verbose            Verbose"
+//usage:     "\n        -u,--username USER      Username"
+//usage:     "\n        -p,--password PASS      Password"
+//usage:     "\n        -P,--port NUM           Port"
 //usage:        )
 //usage:        IF_NOT_FEATURE_FTPGETPUT_LONG_OPTIONS(
 //usage:     "\n        -v      Verbose"
-//usage:     "\n        -u      Username"
-//usage:     "\n        -p      Password"
-//usage:     "\n        -P      Port number"
+//usage:     "\n        -u USER Username"
+//usage:     "\n        -p PASS Password"
+//usage:     "\n        -P NUM  Port number"
 //usage:        )
 
 #include "libbb.h"
diff --git a/networking/httpd.c b/networking/httpd.c
index 24482fe52..f233cb0ba 100644
--- a/networking/httpd.c
+++ b/networking/httpd.c
@@ -54,6 +54,8 @@
  * /cgi-bin:foo:bar  # Require user foo, pwd bar on urls starting with /cgi-bin/
  * /adm:admin:setup  # Require user admin, pwd setup on urls starting with /adm/
  * /adm:toor:PaSsWd  # or user toor, pwd PaSsWd on urls starting with /adm/
+ * /adm:root:*       # or user root, pwd from /etc/passwd on urls starting with /adm/
+ * /wiki:*:*         # or any user from /etc/passwd with according pwd on urls starting with /wiki/
  * .au:audio/basic   # additional mime type for audio.au files
  * *.php:/path/php   # run xxx.php through an interpreter
  *
@@ -123,6 +125,14 @@
 //usage:     "\n        -d STRING       URL decode STRING"
 
 #include "libbb.h"
+#if ENABLE_PAM
+/* PAM may include <locale.h>. We may need to undefine bbox's stub define: */
+# undef setlocale
+/* For some obscure reason, PAM is not in pam/xxx, but in security/xxx.
+ * Apparently they like to confuse people. */
+# include <security/pam_appl.h>
+# include <security/pam_misc.h>
+#endif
 #if ENABLE_FEATURE_HTTPD_USE_SENDFILE
 # include <sys/sendfile.h>
 #endif
@@ -338,7 +348,7 @@ struct globals {
 #define range_len         (G.range_len        )
 #else
 enum {
-        range_start = 0,
+        range_start = -1,
         range_end = MAXINT(off_t) - 1,
         range_len = MAXINT(off_t),
 };
@@ -360,6 +370,7 @@ enum {
 #define INIT_G() do { \
         SET_PTR_TO_GLOBALS(xzalloc(sizeof(G))); \
         IF_FEATURE_HTTPD_BASIC_AUTH(g_realm = "Web Server Authentication";) \
+        IF_FEATURE_HTTPD_RANGES(range_start = -1;) \
         bind_addr_or_port = "80"; \
         index_page = index_html; \
         file_size = -1; \
@@ -1255,18 +1266,21 @@ static void setenv1(const char *name, const char *value)
  *
  * Parameters:
  * const char *url              The requested URL (with leading /).
+ * const char *orig_uri         The original URI before rewriting (if any)
  * int post_len                 Length of the POST body.
  * const char *cookie           For set HTTP_COOKIE.
  * const char *content_type     For set CONTENT_TYPE.
  */
 static void send_cgi_and_exit(
                 const char *url,
+                const char *orig_uri,
                 const char *request,
                 int post_len,
                 const char *cookie,
                 const char *content_type) NORETURN;
 static void send_cgi_and_exit(
                 const char *url,
+                const char *orig_uri,
                 const char *request,
                 int post_len,
                 const char *cookie,
@@ -1274,7 +1288,7 @@ static void send_cgi_and_exit(
 {
         struct fd_pair fromCgi;  /* CGI -> httpd pipe */
         struct fd_pair toCgi;    /* httpd -> CGI pipe */
-        char *script;
+        char *script, *last_slash;
         int pid;
 
         /* Make a copy. NB: caller guarantees:
@@ -1288,22 +1302,25 @@ static void send_cgi_and_exit(
          */
 
         /* Check for [dirs/]script.cgi/PATH_INFO */
-        script = (char*)url;
+        last_slash = script = (char*)url;
         while ((script = strchr(script + 1, '/')) != NULL) {
+                int dir;
                 *script = '\0';
-                if (!is_directory(url + 1, 1, NULL)) {
+                dir = is_directory(url + 1, /*followlinks:*/ 1);
+                *script = '/';
+                if (!dir) {
                         /* not directory, found script.cgi/PATH_INFO */
-                        *script = '/';
                         break;
                 }
-                *script = '/'; /* is directory, find next '/' */
+                /* is directory, find next '/' */
+                last_slash = script;
         }
         setenv1("PATH_INFO", script);   /* set to /PATH_INFO or "" */
         setenv1("REQUEST_METHOD", request);
         if (g_query) {
-                putenv(xasprintf("%s=%s?%s", "REQUEST_URI", url, g_query));
+                putenv(xasprintf("%s=%s?%s", "REQUEST_URI", orig_uri, g_query));
         } else {
-                setenv1("REQUEST_URI", url);
+                setenv1("REQUEST_URI", orig_uri);
         }
         if (script != NULL)
                 *script = '\0';         /* cut off /PATH_INFO */
@@ -1377,7 +1394,7 @@ static void send_cgi_and_exit(
                 log_and_exit();
         }
 
-        if (!pid) {
+        if (pid == 0) {
                 /* Child process */
                 char *argv[3];
 
@@ -1393,7 +1410,7 @@ static void send_cgi_and_exit(
                 /* dup2(1, 2); */
 
                 /* Chdiring to script's dir */
-                script = strrchr(url, '/');
+                script = last_slash;
                 if (script != url) { /* paranoia */
                         *script = '\0';
                         if (chdir(url + 1) != 0) {
@@ -1573,10 +1590,10 @@ static NOINLINE void send_file_and_exit(const char *url, int what)
         if (what == SEND_BODY /* err pages and ranges don't mix */
          || content_gzip /* we are sending compressed page: can't do ranges */  ///why?
         ) {
-                range_start = 0;
+                range_start = -1;
         }
         range_len = MAXINT(off_t);
-        if (range_start) {
+        if (range_start >= 0) {
                 if (!range_end) {
                         range_end = file_size - 1;
                 }
@@ -1584,7 +1601,7 @@ static NOINLINE void send_file_and_exit(const char *url, int what)
                  || lseek(fd, range_start, SEEK_SET) != range_start
                 ) {
                         lseek(fd, 0, SEEK_SET);
-                        range_start = 0;
+                        range_start = -1;
                 } else {
                         range_len = range_end - range_start + 1;
                         send_headers(HTTP_PARTIAL_CONTENT);
@@ -1607,7 +1624,7 @@ static NOINLINE void send_file_and_exit(const char *url, int what)
                                         break; /* fall back to read/write loop */
                                 goto fin;
                         }
-                        IF_FEATURE_HTTPD_RANGES(range_len -= sz;)
+                        IF_FEATURE_HTTPD_RANGES(range_len -= count;)
                         if (count == 0 || range_len == 0)
                                 log_and_exit();
                 }
@@ -1658,6 +1675,56 @@ static int checkPermIP(void)
 }
 
 #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
+
+# if ENABLE_FEATURE_HTTPD_AUTH_MD5 && ENABLE_PAM
+struct pam_userinfo {
+        const char *name;
+        const char *pw;
+};
+
+static int pam_talker(int num_msg,
+                const struct pam_message **msg,
+                struct pam_response **resp,
+                void *appdata_ptr)
+{
+        int i;
+        struct pam_userinfo *userinfo = (struct pam_userinfo *) appdata_ptr;
+        struct pam_response *response;
+
+        if (!resp || !msg || !userinfo)
+                return PAM_CONV_ERR;
+
+        /* allocate memory to store response */
+        response = xzalloc(num_msg * sizeof(*response));
+
+        /* copy values */
+        for (i = 0; i < num_msg; i++) {
+                const char *s;
+
+                switch (msg[i]->msg_style) {
+                case PAM_PROMPT_ECHO_ON:
+                        s = userinfo->name;
+                        break;
+                case PAM_PROMPT_ECHO_OFF:
+                        s = userinfo->pw;
+                        break;
+                case PAM_ERROR_MSG:
+                case PAM_TEXT_INFO:
+                        s = "";
+                        break;
+                default:
+                        free(response);
+                        return PAM_CONV_ERR;
+                }
+                response[i].resp = xstrdup(s);
+                if (PAM_SUCCESS != 0)
+                        response[i].resp_retcode = PAM_SUCCESS;
+        }
+        *resp = response;
+        return PAM_SUCCESS;
+}
+# endif
+
 /*
  * Config file entries are of the form "/<path>:<user>:<passwd>".
  * If config file has no prefix match for path, access is allowed.
@@ -1667,7 +1734,7 @@ static int checkPermIP(void)
  *
  * Returns 1 if user_and_passwd is OK.
  */
-static int check_user_passwd(const char *path, const char *user_and_passwd)
+static int check_user_passwd(const char *path, char *user_and_passwd)
 {
         Htaccess *cur;
         const char *prev = NULL;
@@ -1675,6 +1742,7 @@ static int check_user_passwd(const char *path, const char *user_and_passwd)
         for (cur = g_auth; cur; cur = cur->next) {
                 const char *dir_prefix;
                 size_t len;
+                int r;
 
                 dir_prefix = cur->before_colon;
 
@@ -1690,7 +1758,8 @@ static int check_user_passwd(const char *path, const char *user_and_passwd)
                 len = strlen(dir_prefix);
                 if (len != 1 /* dir_prefix "/" matches all, don't need to check */
                  && (strncmp(dir_prefix, path, len) != 0
-                    || (path[len] != '/' && path[len] != '\0'))
+                    || (path[len] != '/' && path[len] != '\0')
+                    )
                 ) {
                         continue;
                 }
@@ -1699,38 +1768,103 @@ static int check_user_passwd(const char *path, const char *user_and_passwd)
                 prev = dir_prefix;
 
                 if (ENABLE_FEATURE_HTTPD_AUTH_MD5) {
-                        char *md5_passwd;
+                        char *colon_after_user;
+                        const char *passwd;
+# if ENABLE_FEATURE_SHADOWPASSWDS && !ENABLE_PAM
+                        char sp_buf[256];
+# endif
 
-                        md5_passwd = strchr(cur->after_colon, ':');
-                        if (md5_passwd && md5_passwd[1] == '$' && md5_passwd[2] == '1'
-                         && md5_passwd[3] == '$' && md5_passwd[4]
-                        ) {
-                                char *encrypted;
-                                int r, user_len_p1;
+                        colon_after_user = strchr(user_and_passwd, ':');
+                        if (!colon_after_user)
+                                goto bad_input;
 
-                                md5_passwd++;
-                                user_len_p1 = md5_passwd - cur->after_colon;
-                                /* comparing "user:" */
-                                if (strncmp(cur->after_colon, user_and_passwd, user_len_p1) != 0) {
+                        /* compare "user:" */
+                        if (cur->after_colon[0] != '*'
+                         && strncmp(cur->after_colon, user_and_passwd,
+                                        colon_after_user - user_and_passwd + 1) != 0
+                        ) {
+                                continue;
+                        }
+                        /* this cfg entry is '*' or matches username from peer */
+
+                        passwd = strchr(cur->after_colon, ':');
+                        if (!passwd)
+                                goto bad_input;
+                        passwd++;
+                        if (passwd[0] == '*') {
+# if ENABLE_PAM
+                                struct pam_userinfo userinfo;
+                                struct pam_conv conv_info = { &pam_talker, (void *) &userinfo };
+                                pam_handle_t *pamh;
+
+                                *colon_after_user = '\0';
+                                userinfo.name = user_and_passwd;
+                                userinfo.pw = colon_after_user + 1;
+                                r = pam_start("httpd", user_and_passwd, &conv_info, &pamh) != PAM_SUCCESS;
+                                if (r == 0) {
+                                        r = pam_authenticate(pamh, PAM_DISALLOW_NULL_AUTHTOK) != PAM_SUCCESS
+                                         || pam_acct_mgmt(pamh, PAM_DISALLOW_NULL_AUTHTOK)    != PAM_SUCCESS
+                                        ;
+                                        pam_end(pamh, PAM_SUCCESS);
+                                }
+                                *colon_after_user = ':';
+                                goto end_check_passwd;
+# else
+#  if ENABLE_FEATURE_SHADOWPASSWDS
+                                /* Using _r function to avoid pulling in static buffers */
+                                struct spwd spw;
+#  endif
+                                struct passwd *pw;
+
+                                *colon_after_user = '\0';
+                                pw = getpwnam(user_and_passwd);
+                                *colon_after_user = ':';
+                                if (!pw || !pw->pw_passwd)
                                         continue;
+                                passwd = pw->pw_passwd;
+#  if ENABLE_FEATURE_SHADOWPASSWDS
+                                if ((passwd[0] == 'x' || passwd[0] == '*') && !passwd[1]) {
+                                        /* getspnam_r may return 0 yet set result to NULL.
+                                         * At least glibc 2.4 does this. Be extra paranoid here. */
+                                        struct spwd *result = NULL;
+                                        r = getspnam_r(pw->pw_name, &spw, sp_buf, sizeof(sp_buf), &result);
+                                        if (r == 0 && result)
+                                                passwd = result->sp_pwdp;
                                 }
+#  endif
+                                /* In this case, passwd is ALWAYS encrypted:
+                                 * it came from /etc/passwd or /etc/shadow!
+                                 */
+                                goto check_encrypted;
+# endif /* ENABLE_PAM */
+                        }
+                        /* Else: passwd is from httpd.conf, it is either plaintext or encrypted */
 
+                        if (passwd[0] == '$' && isdigit(passwd[1])) {
+                                char *encrypted;
+ check_encrypted:
+                                /* encrypt pwd from peer and check match with local one */
                                 encrypted = pw_encrypt(
-                                        user_and_passwd + user_len_p1 /* cleartext pwd from user */,
-                                        md5_passwd /*salt */, 1 /* cleanup */);
-                                r = strcmp(encrypted, md5_passwd);
+                                        /* pwd (from peer): */  colon_after_user + 1,
+                                        /* salt: */ passwd,
+                                        /* cleanup: */ 0
+                                );
+                                r = strcmp(encrypted, passwd);
                                 free(encrypted);
-                                if (r == 0)
-                                        goto set_remoteuser_var; /* Ok */
-                                continue;
+                        } else {
+                                /* local passwd is from httpd.conf and it's plaintext */
+                                r = strcmp(colon_after_user + 1, passwd);
                         }
+                        goto end_check_passwd;
                 }
-
+ bad_input:
                 /* Comparing plaintext "user:pass" in one go */
-                if (strcmp(cur->after_colon, user_and_passwd) == 0) {
- set_remoteuser_var:
+                r = strcmp(cur->after_colon, user_and_passwd);
+ end_check_passwd:
+                if (r == 0) {
                         remoteuser = xstrndup(user_and_passwd,
-                                        strchrnul(user_and_passwd, ':') - user_and_passwd);
+                                strchrnul(user_and_passwd, ':') - user_and_passwd
+                        );
                         return 1; /* Ok */
                 }
         } /* for */
@@ -1869,7 +2003,7 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
         /* NB: urlcopy ptr is never changed after this */
 
         /* Extract url args if present */
-        g_query = NULL;
+        /* g_query = NULL; - already is */
         tptr = strchr(urlcopy, '?');
         if (tptr) {
                 *tptr++ = '\0';
@@ -1889,34 +2023,40 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
         /* Algorithm stolen from libbb bb_simplify_path(),
          * but don't strdup, retain trailing slash, protect root */
         urlp = tptr = urlcopy;
-        do {
+        for (;;) {
                 if (*urlp == '/') {
                         /* skip duplicate (or initial) slash */
                         if (*tptr == '/') {
-                                continue;
+                                goto next_char;
                         }
                         if (*tptr == '.') {
-                                /* skip extra "/./" */
-                                if (tptr[1] == '/' || !tptr[1]) {
-                                        continue;
-                                }
-                                /* "..": be careful */
-                                if (tptr[1] == '.' && (tptr[2] == '/' || !tptr[2])) {
-                                        ++tptr;
-                                        if (urlp == urlcopy) /* protect root */
+                                if (tptr[1] == '.' && (tptr[2] == '/' || tptr[2] == '\0')) {
+                                        /* "..": be careful */
+                                        /* protect root */
+                                        if (urlp == urlcopy)
                                                 send_headers_and_exit(HTTP_BAD_REQUEST);
-                                        while (*--urlp != '/') /* omit previous dir */;
+                                        /* omit previous dir */
+                                        while (*--urlp != '/')
                                                 continue;
+                                        /* skip to "./" or ".<NUL>" */
+                                        tptr++;
+                                }
+                                if (tptr[1] == '/' || tptr[1] == '\0') {
+                                        /* skip extra "/./" */
+                                        goto next_char;
                                 }
                         }
                 }
                 *++urlp = *tptr;
-        } while (*++tptr);
-        *++urlp = '\0';       /* terminate after last character */
+                if (*urlp == '\0')
+                        break;
+ next_char:
+                tptr++;
+        }
 
         /* If URL is a directory, add '/' */
         if (urlp[-1] != '/') {
-                if (is_directory(urlcopy + 1, 1, NULL)) {
+                if (is_directory(urlcopy + 1, /*followlinks:*/ 1)) {
                         found_moved_temporarily = urlcopy;
                 }
         }
@@ -1930,7 +2070,7 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
         while (ip_allowed && (tptr = strchr(tptr + 1, '/')) != NULL) {
                 /* have path1/path2 */
                 *tptr = '\0';
-                if (is_directory(urlcopy + 1, 1, NULL)) {
+                if (is_directory(urlcopy + 1, /*followlinks:*/ 1)) {
                         /* may have subdir config */
                         parse_conf(urlcopy + 1, SUBDIR_PARSE);
                         ip_allowed = checkPermIP();
@@ -2029,11 +2169,11 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
                                         s += sizeof("bytes=")-1;
                                         range_start = BB_STRTOOFF(s, &s, 10);
                                         if (s[0] != '-' || range_start < 0) {
-                                                range_start = 0;
+                                                range_start = -1;
                                         } else if (s[1]) {
                                                 range_end = BB_STRTOOFF(s+1, NULL, 10);
                                                 if (errno || range_end < range_start)
-                                                        range_start = 0;
+                                                        range_start = -1;
                                         }
                                 }
                         }
@@ -2067,10 +2207,10 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
         }
 
 #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
-        /* Case: no "Authorization:" was seen, but page does require passwd.
+        /* Case: no "Authorization:" was seen, but page might require passwd.
          * Check that with dummy user:pass */
         if (authorized < 0)
-                authorized = check_user_passwd(urlcopy, ":");
+                authorized = check_user_passwd(urlcopy, (char *) "");
         if (!authorized)
                 send_headers_and_exit(HTTP_UNAUTHORIZED);
 #endif
@@ -2116,12 +2256,20 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
                         /* protect listing "cgi-bin/" */
                         send_headers_and_exit(HTTP_FORBIDDEN);
                 }
-                send_cgi_and_exit(urlcopy, prequest, length, cookie, content_type);
+                send_cgi_and_exit(urlcopy, urlcopy, prequest, length, cookie, content_type);
         }
 #endif
 
-        if (urlp[-1] == '/')
+        if (urlp[-1] == '/') {
+                /* When index_page string is appended to <dir>/ URL, it overwrites
+                 * the query string. If we fall back to call /cgi-bin/index.cgi,
+                 * query string would be lost and not available to the CGI.
+                 * Work around it by making a deep copy.
+                 */
+                if (ENABLE_FEATURE_HTTPD_CGI)
+                        g_query = xstrdup(g_query); /* ok for NULL too */
                 strcpy(urlp, index_page);
+        }
         if (stat(tptr, &sb) == 0) {
 #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
                 char *suffix = strrchr(tptr, '.');
@@ -2129,7 +2277,7 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
                         Htaccess *cur;
                         for (cur = script_i; cur; cur = cur->next) {
                                 if (strcmp(cur->before_colon + 1, suffix) == 0) {
-                                        send_cgi_and_exit(urlcopy, prequest, length, cookie, content_type);
+                                        send_cgi_and_exit(urlcopy, urlcopy, prequest, length, cookie, content_type);
                                 }
                         }
                 }
@@ -2142,9 +2290,8 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
                 /* It's a dir URL and there is no index.html
                  * Try cgi-bin/index.cgi */
                 if (access("/cgi-bin/index.cgi"+1, X_OK) == 0) {
-                        urlp[0] = '\0';
-                        g_query = urlcopy;
-                        send_cgi_and_exit("/cgi-bin/index.cgi", prequest, length, cookie, content_type);
+                        urlp[0] = '\0'; /* remove index_page */
+                        send_cgi_and_exit("/cgi-bin/index.cgi", urlcopy, prequest, length, cookie, content_type);
                 }
         }
         /* else fall through to send_file, it errors out if open fails: */
@@ -2243,6 +2390,7 @@ static void mini_httpd_nommu(int server_socket, int argc, char **argv)
                         /* Run a copy of ourself in inetd mode */
                         re_exec(argv_copy);
                 }
+                argv_copy[0][0] &= 0x7f;
                 /* parent, or vfork failed */
                 close(n);
         } /* while (1) */
@@ -2352,7 +2500,7 @@ int httpd_main(int argc UNUSED_PARAM, char **argv)
                 salt[1] = '1';
                 salt[2] = '$';
                 crypt_make_salt(salt + 3, 4);
-                puts(pw_encrypt(pass, salt, 1));
+                puts(pw_encrypt(pass, salt, /*cleanup:*/ 0));
                 return 0;
         }
 #endif
diff --git a/networking/httpd_indexcgi.c b/networking/httpd_indexcgi.c
index 7e0225e19..d732cd4f8 100644
--- a/networking/httpd_indexcgi.c
+++ b/networking/httpd_indexcgi.c
@@ -221,20 +221,25 @@ int main(int argc, char *argv[])
         unsigned long long size_total;
         int odd;
         DIR *dirp;
-        char *QUERY_STRING;
-
-        QUERY_STRING = getenv("QUERY_STRING");
-        if (!QUERY_STRING
-         || QUERY_STRING[0] != '/'
-         || strstr(QUERY_STRING, "//")
-         || strstr(QUERY_STRING, "/../")
-         || strcmp(strrchr(QUERY_STRING, '/'), "/..") == 0
+        char *location;
+
+        location = getenv("REQUEST_URI");
+        if (!location)
+                return 1;
+
+        /* drop URL arguments if any */
+        strchrnul(location, '?')[0] = '\0';
+
+        if (location[0] != '/'
+         || strstr(location, "//")
+         || strstr(location, "/../")
+         || strcmp(strrchr(location, '/'), "/..") == 0
         ) {
                 return 1;
         }
 
         if (chdir("..")
-         || (QUERY_STRING[1] && chdir(QUERY_STRING + 1))
+         || (location[1] && chdir(location + 1))
         ) {
                 return 1;
         }
@@ -271,14 +276,14 @@ int main(int argc, char *argv[])
                 "\r\n" /* Mandatory empty line after headers */
                 "<html><head><title>Index of ");
         /* Guard against directories with &, > etc */
-        fmt_html(QUERY_STRING);
+        fmt_html(location);
         fmt_str(
                 "</title>\n"
                 STYLE_STR
                 "</head>" "\n"
                 "<body>" "\n"
                 "<h1>Index of ");
-        fmt_html(QUERY_STRING);
+        fmt_html(location);
         fmt_str(
                 "</h1>" "\n"
                 "<table>" "\n"
diff --git a/networking/ifupdown.c b/networking/ifupdown.c
index 5946323d0..dfda20670 100644
--- a/networking/ifupdown.c
+++ b/networking/ifupdown.c
@@ -403,11 +403,11 @@ static int FAST_FUNC static_up6(struct interface_defn_t *ifd, execfn *exec)
         result = execute("ip addr add %address%/%netmask% dev %iface%[[ label %label%]]", ifd, exec);
         result += execute("ip link set[[ mtu %mtu%]][[ addr %hwaddress%]] %iface% up", ifd, exec);
         /* Was: "[[ ip ....%gateway% ]]". Removed extra spaces w/o checking */
-        result += execute("[[ip route add ::/0 via %gateway%]]", ifd, exec);
+        result += execute("[[ip route add ::/0 via %gateway%]][[ prio %metric%]]", ifd, exec);
 # else
         result = execute("ifconfig %iface%[[ media %media%]][[ hw %hwaddress%]][[ mtu %mtu%]] up", ifd, exec);
         result += execute("ifconfig %iface% add %address%/%netmask%", ifd, exec);
-        result += execute("[[route -A inet6 add ::/0 gw %gateway%]]", ifd, exec);
+        result += execute("[[route -A inet6 add ::/0 gw %gateway%[[ metric %metric%]]]]", ifd, exec);
 # endif
         return ((result == 3) ? 3 : 0);
 }
@@ -490,7 +490,7 @@ static int FAST_FUNC static_up(struct interface_defn_t *ifd, execfn *exec)
         result = execute("ip addr add %address%/%bnmask%[[ broadcast %broadcast%]] "
                         "dev %iface%[[ peer %pointopoint%]][[ label %label%]]", ifd, exec);
         result += execute("ip link set[[ mtu %mtu%]][[ addr %hwaddress%]] %iface% up", ifd, exec);
-        result += execute("[[ip route add default via %gateway% dev %iface%]]", ifd, exec);
+        result += execute("[[ip route add default via %gateway% dev %iface%[[ prio %metric%]]]]", ifd, exec);
         return ((result == 3) ? 3 : 0);
 # else
         /* ifconfig said to set iface up before it processes hw %hwaddress%,
@@ -500,7 +500,7 @@ static int FAST_FUNC static_up(struct interface_defn_t *ifd, execfn *exec)
         result += execute("ifconfig %iface% %address% netmask %netmask%"
                                 "[[ broadcast %broadcast%]][[ pointopoint %pointopoint%]] ",
                                 ifd, exec);
-        result += execute("[[route add default gw %gateway% %iface%]]", ifd, exec);
+        result += execute("[[route add default gw %gateway%[[ metric %metric%]] %iface%]]", ifd, exec);
         return ((result == 3) ? 3 : 0);
 # endif
 }
@@ -1311,9 +1311,9 @@ int ifupdown_main(int argc UNUSED_PARAM, char **argv)
                         llist_t *state_list = read_iface_state();
                         llist_t *iface_state = find_iface_state(state_list, iface);
 
-                        if (cmds == iface_up) {
-                                char * const newiface = xasprintf("%s=%s", iface, liface);
-                                if (iface_state == NULL) {
+                        if (cmds == iface_up && !any_failures) {
+                                char *newiface = xasprintf("%s=%s", iface, liface);
+                                if (!iface_state) {
                                         llist_add_to_end(&state_list, newiface);
                                 } else {
                                         free(iface_state->data);
diff --git a/networking/ip.c b/networking/ip.c
index fb2f5e2da..98fe621b1 100644
--- a/networking/ip.c
+++ b/networking/ip.c
@@ -50,16 +50,15 @@
 //usage:       "iplink show [DEVICE]"
 //usage:
 //usage:#define iproute_trivial_usage
-//usage:       "{ list | flush | { add | del | change | append |\n"
-//usage:       "                replace | monitor } ROUTE }"
+//usage:       "{ list | flush | add | del | change | append |\n"
+//usage:       "                replace | test } ROUTE"
 //usage:#define iproute_full_usage "\n\n"
 //usage:       "iproute { list | flush } SELECTOR\n"
 //usage:       "iproute get ADDRESS [from ADDRESS iif STRING]\n"
-//usage:       "                        [oif STRING] [tos TOS]\n"
-//usage:       "iproute { add | del | change | append | replace | monitor } ROUTE\n"
-//usage:       "                        SELECTOR := [root PREFIX] [match PREFIX] [proto RTPROTO]\n"
-//usage:       "                        ROUTE := [TYPE] PREFIX [tos TOS] [proto RTPROTO]\n"
-//usage:       "                                [metric METRIC]"
+//usage:       "        [oif STRING] [tos TOS]\n"
+//usage:       "iproute { add | del | change | append | replace | test } ROUTE\n"
+//usage:       "        SELECTOR := [root PREFIX] [match PREFIX] [proto RTPROTO]\n"
+//usage:       "        ROUTE := [TYPE] PREFIX [tos TOS] [proto RTPROTO] [metric METRIC]"
 //usage:
 //usage:#define iprule_trivial_usage
 //usage:       "{[list | add | del] RULE}"
diff --git a/networking/nc_bloaty.c b/networking/nc_bloaty.c
index d184f689b..62a025116 100644
--- a/networking/nc_bloaty.c
+++ b/networking/nc_bloaty.c
@@ -115,6 +115,7 @@ struct globals {
         unsigned wrote_out;          /* total stdout bytes */
         unsigned wrote_net;          /* total net bytes */
 #endif
+        char *proggie0saved;
         /* ouraddr is never NULL and goes through three states as we progress:
          1 - local address before bind (IP/port possibly zero)
          2 - local address after bind (port is nonzero)
@@ -127,7 +128,6 @@ struct globals {
 
         jmp_buf jbuf;                /* timer crud */
 
-        /* will malloc up the following globals: */
         fd_set ding1;                /* for select loop */
         fd_set ding2;
         char bigbuf_in[BIGSIZ];      /* data buffers */
@@ -159,17 +159,16 @@ struct globals {
 
 /* Must match getopt32 call! */
 enum {
-        OPT_h = (1 << 0),
-        OPT_n = (1 << 1),
-        OPT_p = (1 << 2),
-        OPT_s = (1 << 3),
-        OPT_u = (1 << 4),
-        OPT_v = (1 << 5),
-        OPT_w = (1 << 6),
-        OPT_l = (1 << 7) * ENABLE_NC_SERVER,
-        OPT_i = (1 << (7+ENABLE_NC_SERVER)) * ENABLE_NC_EXTRA,
-        OPT_o = (1 << (8+ENABLE_NC_SERVER)) * ENABLE_NC_EXTRA,
-        OPT_z = (1 << (9+ENABLE_NC_SERVER)) * ENABLE_NC_EXTRA,
+        OPT_n = (1 << 0),
+        OPT_p = (1 << 1),
+        OPT_s = (1 << 2),
+        OPT_u = (1 << 3),
+        OPT_v = (1 << 4),
+        OPT_w = (1 << 5),
+        OPT_l = (1 << 6) * ENABLE_NC_SERVER,
+        OPT_i = (1 << (6+ENABLE_NC_SERVER)) * ENABLE_NC_EXTRA,
+        OPT_o = (1 << (7+ENABLE_NC_SERVER)) * ENABLE_NC_EXTRA,
+        OPT_z = (1 << (8+ENABLE_NC_SERVER)) * ENABLE_NC_EXTRA,
 };
 
 #define o_nflag   (option_mask32 & OPT_n)
@@ -263,6 +262,8 @@ Debug("findline returning whole thing: %d", siz);
 static int doexec(char **proggie) NORETURN;
 static int doexec(char **proggie)
 {
+        if (G.proggie0saved)
+                proggie[0] = G.proggie0saved;
         xmove_fd(netfd, 0);
         dup2(0, 1);
         /* dup2(0, 2); - do we *really* want this? NO!
@@ -726,7 +727,7 @@ int nc_main(int argc UNUSED_PARAM, char **argv)
 {
         char *str_p, *str_s;
         IF_NC_EXTRA(char *str_i, *str_o;)
-        char *themdotted = themdotted; /* gcc */
+        char *themdotted = themdotted; /* for compiler */
         char **proggie;
         int x;
         unsigned o_lport = 0;
@@ -754,13 +755,27 @@ int nc_main(int argc UNUSED_PARAM, char **argv)
                         proggie++;
                         goto e_found;
                 }
+                /* -<other_opts>e PROG [ARGS] ? */
+                /* (aboriginal linux uses this form) */
+                if (proggie[0][0] == '-') {
+                        char *optpos = *proggie + 1;
+                        /* Skip all valid opts w/o params */
+                        optpos = optpos + strspn(optpos, "nuv"IF_NC_SERVER("l")IF_NC_EXTRA("z"));
+                        if (*optpos == 'e' && !optpos[1]) {
+                                *optpos = '\0';
+                                proggie++;
+                                G.proggie0saved = *proggie;
+                                *proggie = NULL; /* terminate argv for getopt32 */
+                                goto e_found;
+                        }
+                }
         }
         proggie = NULL;
  e_found:
 
         // -g -G -t -r deleted, unimplemented -a deleted too
         opt_complementary = "?2:vv:w+"; /* max 2 params; -v is a counter; -w N */
-        getopt32(argv, "hnp:s:uvw:" IF_NC_SERVER("l")
+        getopt32(argv, "np:s:uvw:" IF_NC_SERVER("l")
                         IF_NC_EXTRA("i:o:z"),
                         &str_p, &str_s, &o_wait
                         IF_NC_EXTRA(, &str_i, &str_o), &o_verbose);
diff --git a/networking/ntpd.c b/networking/ntpd.c
index 206af00c7..4d939458c 100644
--- a/networking/ntpd.c
+++ b/networking/ntpd.c
@@ -107,12 +107,15 @@
 #define FREQ_TOLERANCE  0.000015 /* frequency tolerance (15 PPM) */
 #define BURSTPOLL       0       /* initial poll */
 #define MINPOLL         5       /* minimum poll interval. std ntpd uses 6 (6: 64 sec) */
-#define BIGPOLL         10      /* drop to lower poll at any trouble (10: 17 min) */
+/* If offset > discipline_jitter * POLLADJ_GATE, and poll interval is >= 2^BIGPOLL,
+ * then it is decreased _at once_. (If < 2^BIGPOLL, it will be decreased _eventually_).
+ */
+#define BIGPOLL         10      /* 2^10 sec ~= 17 min */
 #define MAXPOLL         12      /* maximum poll interval (12: 1.1h, 17: 36.4h). std ntpd uses 17 */
 /* Actively lower poll when we see such big offsets.
  * With STEP_THRESHOLD = 0.125, it means we try to sync more aggressively
- * if offset increases over 0.03 sec */
-#define POLLDOWN_OFFSET (STEP_THRESHOLD / 4)
+ * if offset increases over ~0.04 sec */
+#define POLLDOWN_OFFSET (STEP_THRESHOLD / 3)
 #define MINDISP         0.01    /* minimum dispersion (sec) */
 #define MAXDISP         16      /* maximum dispersion (sec) */
 #define MAXSTRAT        16      /* maximum stratum (infinity metric) */
@@ -124,17 +127,18 @@
 
 /* Poll-adjust threshold.
  * When we see that offset is small enough compared to discipline jitter,
- * we grow a counter: += MINPOLL. When it goes over POLLADJ_LIMIT,
+ * we grow a counter: += MINPOLL. When counter goes over POLLADJ_LIMIT,
  * we poll_exp++. If offset isn't small, counter -= poll_exp*2,
- * and when it goes below -POLLADJ_LIMIT, we poll_exp--
- * (bumped from 30 to 36 since otherwise I often see poll_exp going *2* steps down)
+ * and when it goes below -POLLADJ_LIMIT, we poll_exp--.
+ * (Bumped from 30 to 40 since otherwise I often see poll_exp going *2* steps down)
  */
-#define POLLADJ_LIMIT   36
-/* If offset < POLLADJ_GATE * discipline_jitter, then we can increase
+#define POLLADJ_LIMIT   40
+/* If offset < discipline_jitter * POLLADJ_GATE, then we decide to increase
  * poll interval (we think we can't improve timekeeping
  * by staying at smaller poll).
  */
 #define POLLADJ_GATE    4
+#define TIMECONST_HACK_GATE 2
 /* Compromise Allan intercept (sec). doc uses 1500, std ntpd uses 512 */
 #define ALLAN           512
 /* PLL loop gain */
@@ -208,8 +212,8 @@ typedef struct {
 } msg_t;
 
 typedef struct {
-        double d_recv_time;
         double d_offset;
+        double d_recv_time;
         double d_dispersion;
 } datapoint_t;
 
@@ -255,7 +259,7 @@ enum {
         OPT_S = (1 << 6),
         OPT_l = (1 << 7) * ENABLE_FEATURE_NTPD_SERVER,
         /* We hijack some bits for other purposes */
-        OPT_qq = (1 << 8),
+        OPT_qq = (1 << 31),
 };
 
 struct globals {
@@ -276,11 +280,12 @@ struct globals {
         unsigned verbose;
         unsigned peer_cnt;
         /* refid: 32-bit code identifying the particular server or reference clock
-         *  in stratum 0 packets this is a four-character ASCII string,
-         *  called the kiss code, used for debugging and monitoring
-         *  in stratum 1 packets this is a four-character ASCII string
-         *  assigned to the reference clock by IANA. Example: "GPS "
-         *  in stratum 2+ packets, it's IPv4 address or 4 first bytes of MD5 hash of IPv6
+         * in stratum 0 packets this is a four-character ASCII string,
+         * called the kiss code, used for debugging and monitoring
+         * in stratum 1 packets this is a four-character ASCII string
+         * assigned to the reference clock by IANA. Example: "GPS "
+         * in stratum 2+ packets, it's IPv4 address or 4 first bytes
+         * of MD5 hash of IPv6
          */
         uint32_t refid;
         uint8_t  ntp_status;
@@ -289,27 +294,35 @@ struct globals {
          * mains-frequency clock incrementing at 60 Hz is 16 ms, even when the
          * system clock hardware representation is to the nanosecond.
          *
-         * Delays, jitters of various kinds are clamper down to precision.
+         * Delays, jitters of various kinds are clamped down to precision.
          *
          * If precision_sec is too large, discipline_jitter gets clamped to it
-         * and if offset is much smaller than discipline_jitter, poll interval
-         * grows even though we really can benefit from staying at smaller one,
-         * collecting non-lagged datapoits and correcting the offset.
+         * and if offset is smaller than discipline_jitter * POLLADJ_GATE, poll
+         * interval grows even though we really can benefit from staying at
+         * smaller one, collecting non-lagged datapoits and correcting offset.
          * (Lagged datapoits exist when poll_exp is large but we still have
          * systematic offset error - the time distance between datapoints
-         * is significat and older datapoints have smaller offsets.
+         * is significant and older datapoints have smaller offsets.
          * This makes our offset estimation a bit smaller than reality)
          * Due to this effect, setting G_precision_sec close to
          * STEP_THRESHOLD isn't such a good idea - offsets may grow
          * too big and we will step. I observed it with -6.
          *
-         * OTOH, setting precision too small would result in futile attempts
-         * to syncronize to the unachievable precision.
+         * OTOH, setting precision_sec far too small would result in futile
+         * attempts to syncronize to an unachievable precision.
          *
          * -6 is 1/64 sec, -7 is 1/128 sec and so on.
+         * -8 is 1/256 ~= 0.003906 (worked well for me --vda)
+         * -9 is 1/512 ~= 0.001953 (let's try this for some time)
          */
-#define G_precision_exp  -8
-#define G_precision_sec  (1.0 / (1 << (- G_precision_exp)))
+#define G_precision_exp  -9
+        /*
+         * G_precision_exp is used only for construction outgoing packets.
+         * It's ok to set G_precision_sec to a slightly different value
+         * (One which is "nicer looking" in logs).
+         * Exact value would be (1.0 / (1 << (- G_precision_exp))):
+         */
+#define G_precision_sec  0.002
         uint8_t  stratum;
         /* Bool. After set to 1, never goes back to 0: */
         smallint initial_poll_complete;
@@ -327,6 +340,10 @@ struct globals {
         double   last_update_offset;    // c.last
         double   last_update_recv_time; // s.t
         double   discipline_jitter;     // c.jitter
+        /* Since we only compare it with ints, can simplify code
+         * by not making this variable floating point:
+         */
+        unsigned offset_to_jitter_ratio;
         //double   cluster_offset;        // s.offset
         //double   cluster_jitter;        // s.jitter
 #if !USING_KERNEL_PLL_LOOP
@@ -500,23 +517,34 @@ static void
 filter_datapoints(peer_t *p)
 {
         int i, idx;
+        double sum, wavg;
+        datapoint_t *fdp;
+
+#if 0
+/* Simulations have shown that use of *averaged* offset for p->filter_offset
+ * is in fact worse than simply using last received one: with large poll intervals
+ * (>= 2048) averaging code uses offset values which are outdated by hours,
+ * and time/frequency correction goes totally wrong when fed essentially bogus offsets.
+ */
         int got_newest;
-        double minoff, maxoff, wavg, sum, w;
+        double minoff, maxoff, w;
         double x = x; /* for compiler */
         double oldest_off = oldest_off;
         double oldest_age = oldest_age;
         double newest_off = newest_off;
         double newest_age = newest_age;
 
-        minoff = maxoff = p->filter_datapoint[0].d_offset;
+        fdp = p->filter_datapoint;
+
+        minoff = maxoff = fdp[0].d_offset;
         for (i = 1; i < NUM_DATAPOINTS; i++) {
-                if (minoff > p->filter_datapoint[i].d_offset)
-                        minoff = p->filter_datapoint[i].d_offset;
-                if (maxoff < p->filter_datapoint[i].d_offset)
-                        maxoff = p->filter_datapoint[i].d_offset;
+                if (minoff > fdp[i].d_offset)
+                        minoff = fdp[i].d_offset;
+                if (maxoff < fdp[i].d_offset)
+                        maxoff = fdp[i].d_offset;
         }
 
-        idx = p->datapoint_idx; /* most recent datapoint */
+        idx = p->datapoint_idx; /* most recent datapoint's index */
         /* Average offset:
          * Drop two outliers and take weighted average of the rest:
          * most_recent/2 + older1/4 + older2/8 ... + older5/32 + older6/32
@@ -538,24 +566,24 @@ filter_datapoints(peer_t *p)
                 VERB4 {
                         bb_error_msg("datapoint[%d]: off:%f disp:%f(%f) age:%f%s",
                                 i,
-                                p->filter_datapoint[idx].d_offset,
-                                p->filter_datapoint[idx].d_dispersion, dispersion(&p->filter_datapoint[idx]),
-                                G.cur_time - p->filter_datapoint[idx].d_recv_time,
-                                (minoff == p->filter_datapoint[idx].d_offset || maxoff == p->filter_datapoint[idx].d_offset)
+                                fdp[idx].d_offset,
+                                fdp[idx].d_dispersion, dispersion(&fdp[idx]),
+                                G.cur_time - fdp[idx].d_recv_time,
+                                (minoff == fdp[idx].d_offset || maxoff == fdp[idx].d_offset)
                                         ? " (outlier by offset)" : ""
                         );
                 }
 
-                sum += dispersion(&p->filter_datapoint[idx]) / (2 << i);
+                sum += dispersion(&fdp[idx]) / (2 << i);
 
-                if (minoff == p->filter_datapoint[idx].d_offset) {
+                if (minoff == fdp[idx].d_offset) {
                         minoff -= 1; /* so that we don't match it ever again */
                 } else
-                if (maxoff == p->filter_datapoint[idx].d_offset) {
+                if (maxoff == fdp[idx].d_offset) {
                         maxoff += 1;
                 } else {
-                        oldest_off = p->filter_datapoint[idx].d_offset;
-                        oldest_age = G.cur_time - p->filter_datapoint[idx].d_recv_time;
+                        oldest_off = fdp[idx].d_offset;
+                        oldest_age = G.cur_time - fdp[idx].d_recv_time;
                         if (!got_newest) {
                                 got_newest = 1;
                                 newest_off = oldest_off;
@@ -588,6 +616,32 @@ filter_datapoints(peer_t *p)
         }
         p->filter_offset = wavg;
 
+#else
+
+        fdp = p->filter_datapoint;
+        idx = p->datapoint_idx; /* most recent datapoint's index */
+
+        /* filter_offset: simply use the most recent value */
+        p->filter_offset = fdp[idx].d_offset;
+
+        /*                     n-1
+         *                     ---    dispersion(i)
+         * filter_dispersion =  \     -------------
+         *                      /       (i+1)
+         *                     ---     2
+         *                     i=0
+         */
+        wavg = 0;
+        sum = 0;
+        for (i = 0; i < NUM_DATAPOINTS; i++) {
+                sum += dispersion(&fdp[idx]) / (2 << i);
+                wavg += fdp[idx].d_offset;
+                idx = (idx - 1) & (NUM_DATAPOINTS - 1);
+        }
+        wavg /= NUM_DATAPOINTS;
+        p->filter_dispersion = sum;
+#endif
+
         /*                  +-----                 -----+ ^ 1/2
          *                  |       n-1                 |
          *                  |       ---                 |
@@ -601,13 +655,13 @@ filter_datapoints(peer_t *p)
          */
         sum = 0;
         for (i = 0; i < NUM_DATAPOINTS; i++) {
-                sum += SQUARE(wavg - p->filter_datapoint[i].d_offset);
+                sum += SQUARE(wavg - fdp[i].d_offset);
         }
         sum = SQRT(sum / NUM_DATAPOINTS);
         p->filter_jitter = sum > G_precision_sec ? sum : G_precision_sec;
 
-        VERB3 bb_error_msg("filter offset:%f(corr:%e) disp:%f jitter:%f",
-                        p->filter_offset, x,
+        VERB3 bb_error_msg("filter offset:%+f disp:%f jitter:%f",
+                        p->filter_offset,
                         p->filter_dispersion,
                         p->filter_jitter);
 }
@@ -622,7 +676,11 @@ reset_peer_stats(peer_t *p, double offset)
                 if (small_ofs) {
                         p->filter_datapoint[i].d_recv_time += offset;
                         if (p->filter_datapoint[i].d_offset != 0) {
-                                p->filter_datapoint[i].d_offset += offset;
+                                p->filter_datapoint[i].d_offset -= offset;
+                                //bb_error_msg("p->filter_datapoint[%d].d_offset %f -> %f",
+                                //      i,
+                                //      p->filter_datapoint[i].d_offset + offset,
+                                //      p->filter_datapoint[i].d_offset);
                         }
                 } else {
                         p->filter_datapoint[i].d_recv_time  = G.cur_time;
@@ -719,6 +777,12 @@ send_query_to_peer(peer_t *p)
                 free(local_lsa);
         }
 
+        /* Emit message _before_ attempted send. Think of a very short
+         * roundtrip networks: we need to go back to recv loop ASAP,
+         * to reduce delay. Printing messages after send works against that.
+         */
+        VERB1 bb_error_msg("sending query to %s", p->p_dotted);
+
         /*
          * Send out a random 64-bit number as our transmit time.  The NTP
          * server will copy said number into the originate field on the
@@ -746,7 +810,6 @@ send_query_to_peer(peer_t *p)
         }
 
         p->reachable_bits <<= 1;
-        VERB1 bb_error_msg("sent query to %s", p->p_dotted);
         set_next(p, RESPONSE_INTERVAL);
 }
 
@@ -808,22 +871,24 @@ step_time(double offset)
 {
         llist_t *item;
         double dtime;
-        struct timeval tv;
-        char buf[80];
+        struct timeval tvc, tvn;
+        char buf[sizeof("yyyy-mm-dd hh:mm:ss") + /*paranoia:*/ 4];
         time_t tval;
 
-        gettimeofday(&tv, NULL); /* never fails */
-        dtime = offset + tv.tv_sec;
-        dtime += 1.0e-6 * tv.tv_usec;
-        d_to_tv(dtime, &tv);
-
-        if (settimeofday(&tv, NULL) == -1)
+        gettimeofday(&tvc, NULL); /* never fails */
+        dtime = tvc.tv_sec + (1.0e-6 * tvc.tv_usec) + offset;
+        d_to_tv(dtime, &tvn);
+        if (settimeofday(&tvn, NULL) == -1)
                 bb_perror_msg_and_die("settimeofday");
 
-        tval = tv.tv_sec;
-        strftime(buf, sizeof(buf), "%a %b %e %H:%M:%S %Z %Y", localtime(&tval));
-
-        bb_error_msg("setting clock to %s (offset %fs)", buf, offset);
+        VERB2 {
+                tval = tvc.tv_sec;
+                strftime(buf, sizeof(buf), "%Y-%m-%d %H:%M:%S", localtime(&tval));
+                bb_error_msg("current time is %s.%06u", buf, (unsigned)tvc.tv_usec);
+        }
+        tval = tvn.tv_sec;
+        strftime(buf, sizeof(buf), "%Y-%m-%d %H:%M:%S", localtime(&tval));
+        bb_error_msg("setting time to %s.%06u (offset %+fs)", buf, (unsigned)tvn.tv_usec, offset);
 
         /* Correct various fields which contain time-relative values: */
 
@@ -831,7 +896,7 @@ step_time(double offset)
         for (item = G.ntp_peers; item != NULL; item = item->link) {
                 peer_t *pp = (peer_t *) item->data;
                 reset_peer_stats(pp, offset);
-                //bb_error_msg("offset:%f pp->next_action_time:%f -> %f",
+                //bb_error_msg("offset:%+f pp->next_action_time:%f -> %f",
                 //      offset, pp->next_action_time, pp->next_action_time + offset);
                 pp->next_action_time += offset;
         }
@@ -1167,7 +1232,7 @@ select_and_cluster(void)
         }
         G.last_update_peer = p;
  keep_old:
-        VERB3 bb_error_msg("selected peer %s filter_offset:%f age:%f",
+        VERB3 bb_error_msg("selected peer %s filter_offset:%+f age:%f",
                         p->p_dotted,
                         p->filter_offset,
                         G.cur_time - p->lastpkt_recv_time
@@ -1258,7 +1323,7 @@ update_local_clock(peer_t *p)
                 switch (G.discipline_state) {
                 case STATE_SYNC:
                         /* The first outlyer: ignore it, switch to SPIK state */
-                        VERB3 bb_error_msg("offset:%f - spike detected", offset);
+                        VERB3 bb_error_msg("offset:%+f - spike detected", offset);
                         G.discipline_state = STATE_SPIK;
                         return -1; /* "decrease poll interval" */
 
@@ -1295,7 +1360,7 @@ update_local_clock(peer_t *p)
                  * is always suppressed, even at the longer poll
                  * intervals.
                  */
-                VERB3 bb_error_msg("stepping time by %f; poll_exp=MINPOLL", offset);
+                VERB3 bb_error_msg("stepping time by %+f; poll_exp=MINPOLL", offset);
                 step_time(offset);
                 if (option_mask32 & OPT_q) {
                         /* We were only asked to set time once. Done. */
@@ -1314,12 +1379,13 @@ update_local_clock(peer_t *p)
                         return 1; /* "ok to increase poll interval" */
                 }
 #endif
-                set_new_values(STATE_SYNC, /*offset:*/ 0, recv_time);
+                abs_offset = offset = 0;
+                set_new_values(STATE_SYNC, offset, recv_time);
 
         } else { /* abs_offset <= STEP_THRESHOLD */
 
                 if (G.poll_exp < MINPOLL && G.initial_poll_complete) {
-                        VERB3 bb_error_msg("small offset:%f, disabling burst mode", offset);
+                        VERB3 bb_error_msg("small offset:%+f, disabling burst mode", offset);
                         G.polladj_count = 0;
                         G.poll_exp = MINPOLL;
                 }
@@ -1328,9 +1394,8 @@ update_local_clock(peer_t *p)
                  * weighted offset differences. Used by the poll adjust code.
                  */
                 etemp = SQUARE(G.discipline_jitter);
-                dtemp = SQUARE(MAXD(fabs(offset - G.last_update_offset), G_precision_sec));
+                dtemp = SQUARE(offset - G.last_update_offset);
                 G.discipline_jitter = SQRT(etemp + (dtemp - etemp) / AVG);
-                VERB3 bb_error_msg("discipline jitter=%f", G.discipline_jitter);
 
                 switch (G.discipline_state) {
                 case STATE_NSET:
@@ -1407,6 +1472,10 @@ update_local_clock(peer_t *p)
                 }
         }
 
+        if (G.discipline_jitter < G_precision_sec)
+                G.discipline_jitter = G_precision_sec;
+        G.offset_to_jitter_ratio = abs_offset / G.discipline_jitter;
+
         G.reftime = G.cur_time;
         G.ntp_status = p->lastpkt_status;
         G.refid = p->lastpkt_refid;
@@ -1418,7 +1487,7 @@ update_local_clock(peer_t *p)
 
         /* We are in STATE_SYNC now, but did not do adjtimex yet.
          * (Any other state does not reach this, they all return earlier)
-         * By this time, freq_drift and G.last_update_offset are set
+         * By this time, freq_drift and offset are set
          * to values suitable for adjtimex.
          */
 #if !USING_KERNEL_PLL_LOOP
@@ -1444,8 +1513,8 @@ update_local_clock(peer_t *p)
                 memset(&tmx, 0, sizeof(tmx));
                 if (adjtimex(&tmx) < 0)
                         bb_perror_msg_and_die("adjtimex");
-                VERB3 bb_error_msg("p adjtimex freq:%ld offset:%ld constant:%ld status:0x%x",
-                                tmx.freq, tmx.offset, tmx.constant, tmx.status);
+                bb_error_msg("p adjtimex freq:%ld offset:%+ld status:0x%x tc:%ld",
+                                tmx.freq, tmx.offset, tmx.status, tmx.constant);
         }
 
         memset(&tmx, 0, sizeof(tmx));
@@ -1457,40 +1526,42 @@ update_local_clock(peer_t *p)
         tmx.modes = ADJ_FREQUENCY | ADJ_OFFSET;
         /* 65536 is one ppm */
         tmx.freq = G.discipline_freq_drift * 65536e6;
-        tmx.offset = G.last_update_offset * 1000000; /* usec */
 #endif
         tmx.modes = ADJ_OFFSET | ADJ_STATUS | ADJ_TIMECONST;// | ADJ_MAXERROR | ADJ_ESTERROR;
-        tmx.offset = (G.last_update_offset * 1000000); /* usec */
-                        /* + (G.last_update_offset < 0 ? -0.5 : 0.5) - too small to bother */
+        tmx.offset = (offset * 1000000); /* usec */
         tmx.status = STA_PLL;
         if (G.ntp_status & LI_PLUSSEC)
                 tmx.status |= STA_INS;
         if (G.ntp_status & LI_MINUSSEC)
                 tmx.status |= STA_DEL;
+
         tmx.constant = G.poll_exp - 4;
-        //tmx.esterror = (u_int32)(clock_jitter * 1e6);
-        //tmx.maxerror = (u_int32)((sys_rootdelay / 2 + sys_rootdisp) * 1e6);
+        /* EXPERIMENTAL.
+         * The below if statement should be unnecessary, but...
+         * It looks like Linux kernel's PLL is far too gentle in changing
+         * tmx.freq in response to clock offset. Offset keeps growing
+         * and eventually we fall back to smaller poll intervals.
+         * We can make correction more agressive (about x2) by supplying
+         * PLL time constant which is one less than the real one.
+         * To be on a safe side, let's do it only if offset is significantly
+         * larger than jitter.
+         */
+        if (tmx.constant > 0 && G.offset_to_jitter_ratio >= TIMECONST_HACK_GATE)
+                tmx.constant--;
+
+        //tmx.esterror = (uint32_t)(clock_jitter * 1e6);
+        //tmx.maxerror = (uint32_t)((sys_rootdelay / 2 + sys_rootdisp) * 1e6);
         rc = adjtimex(&tmx);
         if (rc < 0)
                 bb_perror_msg_and_die("adjtimex");
         /* NB: here kernel returns constant == G.poll_exp, not == G.poll_exp - 4.
          * Not sure why. Perhaps it is normal.
          */
-        VERB3 bb_error_msg("adjtimex:%d freq:%ld offset:%ld constant:%ld status:0x%x",
-                                rc, tmx.freq, tmx.offset, tmx.constant, tmx.status);
-#if 0
-        VERB3 {
-                /* always gives the same output as above msg */
-                memset(&tmx, 0, sizeof(tmx));
-                if (adjtimex(&tmx) < 0)
-                        bb_perror_msg_and_die("adjtimex");
-                VERB3 bb_error_msg("c adjtimex freq:%ld offset:%ld constant:%ld status:0x%x",
-                                tmx.freq, tmx.offset, tmx.constant, tmx.status);
-        }
-#endif
+        VERB3 bb_error_msg("adjtimex:%d freq:%ld offset:%+ld status:0x%x",
+                                rc, tmx.freq, tmx.offset, tmx.status);
         G.kernel_freq_drift = tmx.freq / 65536;
-        VERB2 bb_error_msg("update peer:%s, offset:%f, clock drift:%ld ppm",
-                        p->p_dotted, G.last_update_offset, G.kernel_freq_drift);
+        VERB2 bb_error_msg("update from:%s offset:%+f jitter:%f clock drift:%+.3fppm tc:%d",
+                        p->p_dotted, offset, G.discipline_jitter, (double)tmx.freq / 65536, (int)tmx.constant);
 
         return 1; /* "ok to increase poll interval" */
 }
@@ -1626,22 +1697,22 @@ recv_and_process_peer_pkt(peer_t *p)
         if (!p->reachable_bits) {
                 /* 1st datapoint ever - replicate offset in every element */
                 int i;
-                for (i = 1; i < NUM_DATAPOINTS; i++) {
+                for (i = 0; i < NUM_DATAPOINTS; i++) {
                         p->filter_datapoint[i].d_offset = datapoint->d_offset;
                 }
         }
 
         p->reachable_bits |= 1;
         if ((MAX_VERBOSE && G.verbose) || (option_mask32 & OPT_w)) {
-                bb_error_msg("reply from %s: reach 0x%02x offset %f delay %f status 0x%02x strat %d refid 0x%08x rootdelay %f",
+                bb_error_msg("reply from %s: offset:%+f delay:%f status:0x%02x strat:%d refid:0x%08x rootdelay:%f reach:0x%02x",
                         p->p_dotted,
-                        p->reachable_bits,
                         datapoint->d_offset,
                         p->lastpkt_delay,
                         p->lastpkt_status,
                         p->lastpkt_stratum,
                         p->lastpkt_refid,
-                        p->lastpkt_rootdelay
+                        p->lastpkt_rootdelay,
+                        p->reachable_bits
                         /* not shown: m_ppoll, m_precision_exp, m_rootdisp,
                          * m_reftime, m_orgtime, m_rectime, m_xmttime
                          */
@@ -1660,7 +1731,7 @@ recv_and_process_peer_pkt(peer_t *p)
                          * drop poll interval one step down.
                          */
                         if (fabs(q->filter_offset) >= POLLDOWN_OFFSET) {
-                                VERB3 bb_error_msg("offset:%f > POLLDOWN_OFFSET", q->filter_offset);
+                                VERB3 bb_error_msg("offset:%+f > POLLDOWN_OFFSET", q->filter_offset);
                                 goto poll_down;
                         }
                 }
@@ -1674,14 +1745,7 @@ recv_and_process_peer_pkt(peer_t *p)
                  * is increased, otherwise it is decreased. A bit of hysteresis
                  * helps calm the dance. Works best using burst mode.
                  */
-                VERB4 if (rc > 0) {
-                        bb_error_msg("offset:%f POLLADJ_GATE*discipline_jitter:%f poll:%s",
-                                q->filter_offset, POLLADJ_GATE * G.discipline_jitter,
-                                fabs(q->filter_offset) < POLLADJ_GATE * G.discipline_jitter
-                                        ? "grows" : "falls"
-                        );
-                }
-                if (rc > 0 && fabs(q->filter_offset) < POLLADJ_GATE * G.discipline_jitter) {
+                if (rc > 0 && G.offset_to_jitter_ratio <= POLLADJ_GATE) {
                         /* was += G.poll_exp but it is a bit
                          * too optimistic for my taste at high poll_exp's */
                         G.polladj_count += MINPOLL;
@@ -2060,8 +2124,23 @@ int ntpd_main(int argc UNUSED_PARAM, char **argv)
                 timeout++; /* (nextaction - G.cur_time) rounds down, compensating */
 
                 /* Here we may block */
-                VERB2 bb_error_msg("poll %us, sockets:%u, poll interval:%us", timeout, i, 1 << G.poll_exp);
+                VERB2 {
+                        if (i > (ENABLE_FEATURE_NTPD_SERVER && G.listen_fd != -1)) {
+                                /* We wait for at least one reply.
+                                 * Poll for it, without wasting time for message.
+                                 * Since replies often come under 1 second, this also
+                                 * reduces clutter in logs.
+                                 */
+                                nfds = poll(pfd, i, 1000);
+                                if (nfds != 0)
+                                        goto did_poll;
+                                if (--timeout <= 0)
+                                        goto did_poll;
+                        }
+                        bb_error_msg("poll:%us sockets:%u interval:%us", timeout, i, 1 << G.poll_exp);
+                }
                 nfds = poll(pfd, i, timeout * 1000);
+ did_poll:
                 gettime1900d(); /* sets G.cur_time */
                 if (nfds <= 0) {
                         if (G.script_name && G.cur_time - G.last_script_run > 11*60) {
diff --git a/networking/tftp.c b/networking/tftp.c
index 043b879af..ce48a1edd 100644
--- a/networking/tftp.c
+++ b/networking/tftp.c
@@ -789,8 +789,9 @@ int tftpd_main(int argc UNUSED_PARAM, char **argv)
                 openlog(applet_name, LOG_PID, LOG_DAEMON);
                 logmode = LOGMODE_SYSLOG;
         }
-        if (argv[0])
-                xchdir(argv[0]);
+        if (argv[0]) {
+                xchroot(argv[0]);
+        }
 
         result = recv_from_to(STDIN_FILENO, block_buf, sizeof(block_buf),
                         0 /* flags */,
diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c
index 2e6113627..ae0e0d306 100644
--- a/networking/udhcp/common.c
+++ b/networking/udhcp/common.c
@@ -29,9 +29,9 @@ const struct dhcp_optflag dhcp_optflags[] = {
 //      { OPTION_IP | OPTION_LIST                 , 0x07 }, /* DHCP_LOG_SERVER    */
 //      { OPTION_IP | OPTION_LIST                 , 0x08 }, /* DHCP_COOKIE_SERVER */
         { OPTION_IP | OPTION_LIST                 , 0x09 }, /* DHCP_LPR_SERVER    */
-        { OPTION_STRING               | OPTION_REQ, 0x0c }, /* DHCP_HOST_NAME     */
+        { OPTION_STRING_HOST          | OPTION_REQ, 0x0c }, /* DHCP_HOST_NAME     */
         { OPTION_U16                              , 0x0d }, /* DHCP_BOOT_SIZE     */
-        { OPTION_STRING               | OPTION_REQ, 0x0f }, /* DHCP_DOMAIN_NAME   */
+        { OPTION_STRING_HOST          | OPTION_REQ, 0x0f }, /* DHCP_DOMAIN_NAME   */
         { OPTION_IP                               , 0x10 }, /* DHCP_SWAP_SERVER   */
         { OPTION_STRING                           , 0x11 }, /* DHCP_ROOT_PATH     */
         { OPTION_U8                               , 0x17 }, /* DHCP_IP_TTL        */
@@ -41,7 +41,7 @@ const struct dhcp_optflag dhcp_optflags[] = {
 //server would let us know anyway?
         { OPTION_IP                   | OPTION_REQ, 0x1c }, /* DHCP_BROADCAST     */
         { OPTION_IP_PAIR | OPTION_LIST            , 0x21 }, /* DHCP_ROUTES        */
-        { OPTION_STRING                           , 0x28 }, /* DHCP_NIS_DOMAIN    */
+        { OPTION_STRING_HOST                      , 0x28 }, /* DHCP_NIS_DOMAIN    */
         { OPTION_IP | OPTION_LIST                 , 0x29 }, /* DHCP_NIS_SERVER    */
         { OPTION_IP | OPTION_LIST     | OPTION_REQ, 0x2a }, /* DHCP_NTP_SERVER    */
         { OPTION_IP | OPTION_LIST                 , 0x2c }, /* DHCP_WINS_SERVER   */
@@ -49,7 +49,7 @@ const struct dhcp_optflag dhcp_optflags[] = {
         { OPTION_IP                               , 0x36 }, /* DHCP_SERVER_ID     */
         { OPTION_STRING                           , 0x38 }, /* DHCP_ERR_MESSAGE   */
 //TODO: must be combined with 'sname' and 'file' handling:
-        { OPTION_STRING                           , 0x42 }, /* DHCP_TFTP_SERVER_NAME */
+        { OPTION_STRING_HOST                      , 0x42 }, /* DHCP_TFTP_SERVER_NAME */
         { OPTION_STRING                           , 0x43 }, /* DHCP_BOOT_FILE     */
 //TODO: not a string, but a set of LASCII strings:
 //      { OPTION_STRING                           , 0x4D }, /* DHCP_USER_CLASS    */
@@ -57,13 +57,13 @@ const struct dhcp_optflag dhcp_optflags[] = {
         { OPTION_DNS_STRING | OPTION_LIST         , 0x77 }, /* DHCP_DOMAIN_SEARCH */
         { OPTION_SIP_SERVERS                      , 0x78 }, /* DHCP_SIP_SERVERS   */
 #endif
-        { OPTION_STATIC_ROUTES                    , 0x79 }, /* DHCP_STATIC_ROUTES */
+        { OPTION_STATIC_ROUTES | OPTION_LIST      , 0x79 }, /* DHCP_STATIC_ROUTES */
 #if ENABLE_FEATURE_UDHCP_8021Q
         { OPTION_U16                              , 0x84 }, /* DHCP_VLAN_ID       */
         { OPTION_U8                               , 0x85 }, /* DHCP_VLAN_PRIORITY */
 #endif
         { OPTION_6RD                              , 0xd4 }, /* DHCP_6RD           */
-        { OPTION_STATIC_ROUTES                    , 0xf9 }, /* DHCP_MS_STATIC_ROUTES */
+        { OPTION_STATIC_ROUTES | OPTION_LIST      , 0xf9 }, /* DHCP_MS_STATIC_ROUTES */
         { OPTION_STRING                           , 0xfc }, /* DHCP_WPAD          */
 
         /* Options below have no match in dhcp_option_strings[],
@@ -123,8 +123,6 @@ const char dhcp_option_strings[] ALIGN1 =
 // is not handled yet by "string->option" conversion code:
         "sipsrv" "\0"      /* DHCP_SIP_SERVERS    */
 #endif
-// doesn't work in udhcpd.conf since OPTION_STATIC_ROUTES
-// is not handled yet by "string->option" conversion code:
         "staticroutes" "\0"/* DHCP_STATIC_ROUTES  */
 #if ENABLE_FEATURE_UDHCP_8021Q
         "vlanid" "\0"      /* DHCP_VLAN_ID        */
@@ -148,6 +146,7 @@ const uint8_t dhcp_option_lengths[] ALIGN1 = {
         [OPTION_IP_PAIR] = 8,
 //      [OPTION_BOOLEAN] = 1,
         [OPTION_STRING] =  1,  /* ignored by udhcp_str2optset */
+        [OPTION_STRING_HOST] = 1,  /* ignored by udhcp_str2optset */
 #if ENABLE_FEATURE_UDHCP_RFC3397
         [OPTION_DNS_STRING] = 1,  /* ignored by both udhcp_str2optset and xmalloc_optname_optval */
         [OPTION_SIP_SERVERS] = 1,
@@ -337,7 +336,8 @@ int FAST_FUNC udhcp_str2nip(const char *str, void *arg)
         lsa = host_and_af2sockaddr(str, 0, AF_INET);
         if (!lsa)
                 return 0;
-        *(uint32_t*)arg = lsa->u.sin.sin_addr.s_addr;
+        /* arg maybe unaligned */
+        move_to_unaligned32((uint32_t*)arg, lsa->u.sin.sin_addr.s_addr);
         free(lsa);
         return 1;
 }
@@ -417,7 +417,9 @@ static NOINLINE void attach_option(
                         /* actually 255 is ok too, but adding a space can overlow it */
 
                         existing->data = xrealloc(existing->data, OPT_DATA + 1 + old_len + length);
-                        if ((optflag->flags & OPTION_TYPE_MASK) == OPTION_STRING) {
+                        if ((optflag->flags & OPTION_TYPE_MASK) == OPTION_STRING
+                         || (optflag->flags & OPTION_TYPE_MASK) == OPTION_STRING_HOST
+                        ) {
                                 /* add space separator between STRING options in a list */
                                 existing->data[OPT_DATA + old_len] = ' ';
                                 old_len++;
@@ -434,13 +436,14 @@ static NOINLINE void attach_option(
 int FAST_FUNC udhcp_str2optset(const char *const_str, void *arg)
 {
         struct option_set **opt_list = arg;
-        char *opt, *val, *endptr;
+        char *opt, *val;
         char *str;
         const struct dhcp_optflag *optflag;
         struct dhcp_optflag bin_optflag;
         unsigned optcode;
         int retval, length;
-        char buffer[8] ALIGNED(4);
+        /* IP_PAIR needs 8 bytes, STATIC_ROUTES needs 9 max */
+        char buffer[9] ALIGNED(4);
         uint16_t *result_u16 = (uint16_t *) buffer;
         uint32_t *result_u32 = (uint32_t *) buffer;
 
@@ -481,6 +484,7 @@ int FAST_FUNC udhcp_str2optset(const char *const_str, void *arg)
                                 retval = udhcp_str2nip(val, buffer + 4);
                         break;
                 case OPTION_STRING:
+                case OPTION_STRING_HOST:
 #if ENABLE_FEATURE_UDHCP_RFC3397
                 case OPTION_DNS_STRING:
 #endif
@@ -497,34 +501,53 @@ int FAST_FUNC udhcp_str2optset(const char *const_str, void *arg)
 //                      break;
 //              }
                 case OPTION_U8:
-                        buffer[0] = strtoul(val, &endptr, 0);
-                        retval = (endptr[0] == '\0');
+                        buffer[0] = bb_strtou32(val, NULL, 0);
+                        retval = (errno == 0);
                         break;
                 /* htonX are macros in older libc's, using temp var
                  * in code below for safety */
                 /* TODO: use bb_strtoX? */
                 case OPTION_U16: {
-                        unsigned long tmp = strtoul(val, &endptr, 0);
+                        uint32_t tmp = bb_strtou32(val, NULL, 0);
                         *result_u16 = htons(tmp);
-                        retval = (endptr[0] == '\0' /*&& tmp < 0x10000*/);
+                        retval = (errno == 0 /*&& tmp < 0x10000*/);
                         break;
                 }
 //              case OPTION_S16: {
-//                      long tmp = strtol(val, &endptr, 0);
+//                      long tmp = bb_strtoi32(val, NULL, 0);
 //                      *result_u16 = htons(tmp);
-//                      retval = (endptr[0] == '\0');
+//                      retval = (errno == 0);
 //                      break;
 //              }
                 case OPTION_U32: {
-                        unsigned long tmp = strtoul(val, &endptr, 0);
+                        uint32_t tmp = bb_strtou32(val, NULL, 0);
                         *result_u32 = htonl(tmp);
-                        retval = (endptr[0] == '\0');
+                        retval = (errno == 0);
                         break;
                 }
                 case OPTION_S32: {
-                        long tmp = strtol(val, &endptr, 0);
+                        int32_t tmp = bb_strtoi32(val, NULL, 0);
                         *result_u32 = htonl(tmp);
-                        retval = (endptr[0] == '\0');
+                        retval = (errno == 0);
+                        break;
+                }
+                case OPTION_STATIC_ROUTES: {
+                        /* Input: "a.b.c.d/m" */
+                        /* Output: mask(1 byte),pfx(0-4 bytes),gw(4 bytes) */
+                        unsigned mask;
+                        char *slash = strchr(val, '/');
+                        if (slash) {
+                                *slash = '\0';
+                                retval = udhcp_str2nip(val, buffer + 1);
+                                buffer[0] = mask = bb_strtou(slash + 1, NULL, 10);
+                                val = strtok(NULL, ", \t/-");
+                                if (!val || mask > 32 || errno)
+                                        retval = 0;
+                                if (retval) {
+                                        length = ((mask + 7) >> 3) + 5;
+                                        retval = udhcp_str2nip(val, buffer + (length - 4));
+                                }
+                        }
                         break;
                 }
                 case OPTION_BIN: /* handled in attach_option() */
@@ -535,7 +558,26 @@ int FAST_FUNC udhcp_str2optset(const char *const_str, void *arg)
                 }
                 if (retval)
                         attach_option(opt_list, optflag, opt, length);
-        } while (retval && optflag->flags & OPTION_LIST);
+        } while (retval && (optflag->flags & OPTION_LIST));
 
         return retval;
 }
+
+/* note: ip is a pointer to an IPv6 in network order, possibly misaliged */
+int FAST_FUNC sprint_nip6(char *dest, /*const char *pre,*/ const uint8_t *ip)
+{
+        char hexstrbuf[16 * 2];
+        bin2hex(hexstrbuf, (void*)ip, 16);
+        return sprintf(dest, /* "%s" */
+                "%.4s:%.4s:%.4s:%.4s:%.4s:%.4s:%.4s:%.4s",
+                /* pre, */
+                hexstrbuf + 0 * 4,
+                hexstrbuf + 1 * 4,
+                hexstrbuf + 2 * 4,
+                hexstrbuf + 3 * 4,
+                hexstrbuf + 4 * 4,
+                hexstrbuf + 5 * 4,
+                hexstrbuf + 6 * 4,
+                hexstrbuf + 7 * 4
+        );
+}
diff --git a/networking/udhcp/common.h b/networking/udhcp/common.h
index a7f9395b8..cfd58679a 100644
--- a/networking/udhcp/common.h
+++ b/networking/udhcp/common.h
@@ -80,6 +80,9 @@ enum {
         OPTION_IP = 1,
         OPTION_IP_PAIR,
         OPTION_STRING,
+        /* Opts of STRING_HOST type will be sanitized before they are passed
+         * to udhcpc script's environment: */
+        OPTION_STRING_HOST,
 //      OPTION_BOOLEAN,
         OPTION_U8,
         OPTION_U16,
@@ -308,6 +311,9 @@ int arpping(uint32_t test_nip,
                 uint8_t *from_mac,
                 const char *interface) FAST_FUNC;
 
+/* note: ip is a pointer to an IPv6 in network order, possibly misaliged */
+int sprint_nip6(char *dest, /*const char *pre,*/ const uint8_t *ip) FAST_FUNC;
+
 POP_SAVED_FUNCTION_VISIBILITY
 
 #endif
diff --git a/networking/udhcp/d6_common.h b/networking/udhcp/d6_common.h
new file mode 100644
index 000000000..4dd7e621e
--- /dev/null
+++ b/networking/udhcp/d6_common.h
@@ -0,0 +1,123 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Copyright (C) 2011 Denys Vlasenko.
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+#ifndef UDHCP_D6_COMMON_H
+#define UDHCP_D6_COMMON_H 1
+
+#include <netinet/ip6.h>
+
+PUSH_AND_SET_FUNCTION_VISIBILITY_TO_HIDDEN
+
+
+/*** DHCPv6 packet ***/
+
+/* DHCPv6 protocol. See RFC 3315 */
+#define D6_MSG_SOLICIT              1
+#define D6_MSG_ADVERTISE            2
+#define D6_MSG_REQUEST              3
+#define D6_MSG_CONFIRM              4
+#define D6_MSG_RENEW                5
+#define D6_MSG_REBIND               6
+#define D6_MSG_REPLY                7
+#define D6_MSG_RELEASE              8
+#define D6_MSG_DECLINE              9
+#define D6_MSG_RECONFIGURE         10
+#define D6_MSG_INFORMATION_REQUEST 11
+#define D6_MSG_RELAY_FORW          12
+#define D6_MSG_RELAY_REPL          13
+
+struct d6_packet {
+        union {
+                uint8_t d6_msg_type;
+                uint32_t d6_xid32;
+        } d6_u;
+        uint8_t d6_options[576 - sizeof(struct iphdr) - sizeof(struct udphdr) - 4
+                        + CONFIG_UDHCPC_SLACK_FOR_BUGGY_SERVERS];
+} PACKED;
+#define d6_msg_type d6_u.d6_msg_type
+#define d6_xid32    d6_u.d6_xid32
+
+struct ip6_udp_d6_packet {
+        struct ip6_hdr ip6;
+        struct udphdr udp;
+        struct d6_packet data;
+} PACKED;
+
+struct udp_d6_packet {
+        struct udphdr udp;
+        struct d6_packet data;
+} PACKED;
+
+/*** Options ***/
+
+struct d6_option {
+        uint8_t code_hi;
+        uint8_t code;
+        uint8_t len_hi;
+        uint8_t len;
+        uint8_t data[1];
+} PACKED;
+
+#define D6_OPT_CLIENTID       1
+#define D6_OPT_SERVERID       2
+#define D6_OPT_IA_NA          3
+#define D6_OPT_IA_TA          4
+#define D6_OPT_IAADDR         5
+#define D6_OPT_ORO            6
+#define D6_OPT_PREFERENCE     7
+#define D6_OPT_ELAPSED_TIME   8
+#define D6_OPT_RELAY_MSG      9
+#define D6_OPT_AUTH          11
+#define D6_OPT_UNICAST       12
+#define D6_OPT_STATUS_CODE   13
+#define D6_OPT_RAPID_COMMIT  14
+#define D6_OPT_USER_CLASS    15
+#define D6_OPT_VENDOR_CLASS  16
+#define D6_OPT_VENDOR_OPTS   17
+#define D6_OPT_INTERFACE_ID  18
+#define D6_OPT_RECONF_MSG    19
+#define D6_OPT_RECONF_ACCEPT 20
+
+#define D6_OPT_IA_PD         25
+#define D6_OPT_IAPREFIX      26
+
+/*** Other shared functions ***/
+
+struct client6_data_t {
+        struct d6_option *server_id;
+        struct d6_option *ia_na;
+        char **env_ptr;
+        unsigned env_idx;
+};
+
+#define client6_data (*(struct client6_data_t*)(&bb_common_bufsiz1[COMMON_BUFSIZE - sizeof(struct client6_data_t)]))
+
+int FAST_FUNC d6_listen_socket(int port, const char *inf);
+
+int FAST_FUNC d6_recv_kernel_packet(
+                struct in6_addr *peer_ipv6,
+                struct d6_packet *packet, int fd
+);
+
+int FAST_FUNC d6_send_raw_packet(
+                struct d6_packet *d6_pkt, unsigned d6_pkt_size,
+                struct in6_addr *src_ipv6, int source_port,
+                struct in6_addr *dst_ipv6, int dest_port, const uint8_t *dest_arp,
+                int ifindex
+);
+
+int FAST_FUNC d6_send_kernel_packet(
+                struct d6_packet *d6_pkt, unsigned d6_pkt_size,
+                struct in6_addr *src_ipv6, int source_port,
+                struct in6_addr *dst_ipv6, int dest_port
+);
+
+void FAST_FUNC d6_dump_packet(struct d6_packet *packet);
+
+
+POP_SAVED_FUNCTION_VISIBILITY
+
+#endif
diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c
new file mode 100644
index 000000000..23e6862dc
--- /dev/null
+++ b/networking/udhcp/d6_dhcpc.c
@@ -0,0 +1,1483 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * DHCPv6 client.
+ *
+ * 2011-11.
+ * WARNING: THIS CODE IS INCOMPLETE. IT IS NOWHERE NEAR
+ * TO BE READY FOR PRODUCTION USE.
+ *
+ * Copyright (C) 2011 Denys Vlasenko.
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+
+//config:config UDHCPC6
+//config:       bool "udhcp client for DHCPv6 (udhcpc6)"
+//config:       default n  # not yet ready
+//config:       help
+//config:         udhcpc6 is a DHCPv6 client
+
+//applet:IF_UDHCPC6(APPLET(udhcpc6, BB_DIR_USR_BIN, BB_SUID_DROP))
+
+//kbuild:lib-$(CONFIG_UDHCPC6) += d6_dhcpc.o d6_packet.o d6_socket.o common.o
+
+
+#include <syslog.h>
+/* Override ENABLE_FEATURE_PIDFILE - ifupdown needs our pidfile to always exist */
+#define WANT_PIDFILE 1
+#include "common.h"
+#include "dhcpd.h"
+#include "dhcpc.h"
+#include "d6_common.h"
+
+#include <netinet/if_ether.h>
+#include <netpacket/packet.h>
+#include <linux/filter.h>
+
+/* "struct client_config_t client_config" is in bb_common_bufsiz1 */
+
+
+#if ENABLE_LONG_OPTS
+static const char udhcpc6_longopts[] ALIGN1 =
+        "interface\0"      Required_argument "i"
+        "now\0"            No_argument       "n"
+        "pidfile\0"        Required_argument "p"
+        "quit\0"           No_argument       "q"
+        "release\0"        No_argument       "R"
+        "request\0"        Required_argument "r"
+        "script\0"         Required_argument "s"
+        "timeout\0"        Required_argument "T"
+        "retries\0"        Required_argument "t"
+        "tryagain\0"       Required_argument "A"
+        "syslog\0"         No_argument       "S"
+        "request-option\0" Required_argument "O"
+        "no-default-options\0" No_argument   "o"
+        "foreground\0"     No_argument       "f"
+        "background\0"     No_argument       "b"
+///     IF_FEATURE_UDHCPC_ARPING("arping\0"     No_argument       "a")
+        IF_FEATURE_UDHCP_PORT("client-port\0"   Required_argument "P")
+        ;
+#endif
+/* Must match getopt32 option string order */
+enum {
+        OPT_i = 1 << 0,
+        OPT_n = 1 << 1,
+        OPT_p = 1 << 2,
+        OPT_q = 1 << 3,
+        OPT_R = 1 << 4,
+        OPT_r = 1 << 5,
+        OPT_s = 1 << 6,
+        OPT_T = 1 << 7,
+        OPT_t = 1 << 8,
+        OPT_S = 1 << 9,
+        OPT_A = 1 << 10,
+        OPT_O = 1 << 11,
+        OPT_o = 1 << 12,
+        OPT_x = 1 << 13,
+        OPT_f = 1 << 14,
+/* The rest has variable bit positions, need to be clever */
+        OPTBIT_f = 14,
+        USE_FOR_MMU(             OPTBIT_b,)
+        ///IF_FEATURE_UDHCPC_ARPING(OPTBIT_a,)
+        IF_FEATURE_UDHCP_PORT(   OPTBIT_P,)
+        USE_FOR_MMU(             OPT_b = 1 << OPTBIT_b,)
+        ///IF_FEATURE_UDHCPC_ARPING(OPT_a = 1 << OPTBIT_a,)
+        IF_FEATURE_UDHCP_PORT(   OPT_P = 1 << OPTBIT_P,)
+};
+
+
+/*** Utility functions ***/
+
+static void *d6_find_option(uint8_t *option, uint8_t *option_end, unsigned code)
+{
+        /* "length minus 4" */
+        int len_m4 = option_end - option - 4;
+        while (len_m4 >= 0) {
+                /* Next option's len is too big? */
+                if (option[3] > len_m4)
+                        return NULL; /* yes. bogus packet! */
+                /* So far we treat any opts with code >255
+                 * or len >255 as bogus, and stop at once.
+                 * This simplifies big-endian handling.
+                 */
+                if (option[0] != 0 || option[2] != 0)
+                        return NULL;
+                /* Option seems to be valid */
+                /* Does its code match? */
+                if (option[1] == code)
+                        return option; /* yes! */
+                option += option[3] + 4;
+                len_m4 -= option[3] + 4;
+        }
+        return NULL;
+}
+
+static void *d6_copy_option(uint8_t *option, uint8_t *option_end, unsigned code)
+{
+        uint8_t *opt = d6_find_option(option, option_end, code);
+        if (!opt)
+                return opt;
+        return memcpy(xmalloc(opt[3] + 4), opt, opt[3] + 4);
+}
+
+static void *d6_store_blob(void *dst, const void *src, unsigned len)
+{
+        memcpy(dst, src, len);
+        return dst + len;
+}
+
+
+/*** Script execution code ***/
+
+static char** new_env(void)
+{
+        client6_data.env_ptr = xrealloc_vector(client6_data.env_ptr, 3, client6_data.env_idx);
+        return &client6_data.env_ptr[client6_data.env_idx++];
+}
+
+/* put all the parameters into the environment */
+static void option_to_env(uint8_t *option, uint8_t *option_end)
+{
+        /* "length minus 4" */
+        int len_m4 = option_end - option - 4;
+        while (len_m4 >= 0) {
+                uint32_t v32;
+                char ipv6str[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff")];
+
+                if (option[0] != 0 || option[2] != 0)
+                        break;
+
+                switch (option[1]) {
+                //case D6_OPT_CLIENTID:
+                //case D6_OPT_SERVERID:
+                case D6_OPT_IA_NA:
+                case D6_OPT_IA_PD:
+                        option_to_env(option + 16, option + 4 + option[3]);
+                        break;
+                //case D6_OPT_IA_TA:
+                case D6_OPT_IAADDR:
+/*   0                   1                   2                   3
+ *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |          OPTION_IAADDR        |          option-len           |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                                                               |
+ * |                         IPv6 address                          |
+ * |                                                               |
+ * |                                                               |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                      preferred-lifetime                       |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                        valid-lifetime                         |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ */
+                        sprint_nip6(ipv6str, option + 4);
+                        *new_env() = xasprintf("ipv6=%s", ipv6str);
+
+                        move_from_unaligned32(v32, option + 4 + 16 + 4);
+                        *new_env() = xasprintf("lease=%u", (unsigned)v32);
+                        break;
+
+                //case D6_OPT_ORO:
+                //case D6_OPT_PREFERENCE:
+                //case D6_OPT_ELAPSED_TIME:
+                //case D6_OPT_RELAY_MSG:
+                //case D6_OPT_AUTH:
+                //case D6_OPT_UNICAST:
+                //case D6_OPT_STATUS_CODE:
+                //case D6_OPT_RAPID_COMMIT:
+                //case D6_OPT_USER_CLASS:
+                //case D6_OPT_VENDOR_CLASS:
+                //case D6_OPT_VENDOR_OPTS:
+                //case D6_OPT_INTERFACE_ID:
+                //case D6_OPT_RECONF_MSG:
+                //case D6_OPT_RECONF_ACCEPT:
+
+                case D6_OPT_IAPREFIX:
+/*  0                   1                   2                   3
+ *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |        OPTION_IAPREFIX        |         option-length         |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                      preferred-lifetime                       |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                        valid-lifetime                         |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * | prefix-length |                                               |
+ * +-+-+-+-+-+-+-+-+          IPv6 prefix                          |
+ * |                           (16 octets)                         |
+ * |                                                               |
+ * |               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |               |
+ * +-+-+-+-+-+-+-+-+
+ */
+                        //move_from_unaligned32(v32, option + 4 + 4);
+                        //*new_env() = xasprintf("lease=%u", (unsigned)v32);
+
+                        sprint_nip6(ipv6str, option + 4 + 4 + 1);
+                        *new_env() = xasprintf("ipv6prefix=%s/%u", ipv6str, (unsigned)(option[4 + 4]));
+                }
+                option += 4 + option[3];
+                len_m4 -= 4 + option[3];
+        }
+}
+
+static char **fill_envp(struct d6_packet *packet)
+{
+        char **envp, **curr;
+
+        client6_data.env_ptr = NULL;
+        client6_data.env_idx = 0;
+
+        *new_env() = xasprintf("interface=%s", client_config.interface);
+
+        if (packet)
+                option_to_env(packet->d6_options, packet->d6_options + sizeof(packet->d6_options));
+
+        envp = curr = client6_data.env_ptr;
+        while (*curr)
+                putenv(*curr++);
+
+        return envp;
+}
+
+/* Call a script with a par file and env vars */
+static void d6_run_script(struct d6_packet *packet, const char *name)
+{
+        char **envp, **curr;
+        char *argv[3];
+
+        envp = fill_envp(packet);
+
+        /* call script */
+        log1("Executing %s %s", client_config.script, name);
+        argv[0] = (char*) client_config.script;
+        argv[1] = (char*) name;
+        argv[2] = NULL;
+        spawn_and_wait(argv);
+
+        for (curr = envp; *curr; curr++) {
+                log2(" %s", *curr);
+                bb_unsetenv_and_free(*curr);
+        }
+        free(envp);
+}
+
+
+/*** Sending/receiving packets ***/
+
+static ALWAYS_INLINE uint32_t random_xid(void)
+{
+        uint32_t t = rand() & htonl(0x00ffffff);
+        return t;
+}
+
+/* Initialize the packet with the proper defaults */
+static uint8_t *init_d6_packet(struct d6_packet *packet, char type, uint32_t xid)
+{
+        struct d6_option *clientid;
+
+        memset(packet, 0, sizeof(*packet));
+
+        packet->d6_xid32 = xid;
+        packet->d6_msg_type = type;
+
+        clientid = (void*)client_config.clientid;
+        return d6_store_blob(packet->d6_options, clientid, clientid->len + 2+2);
+}
+
+static uint8_t *add_d6_client_options(uint8_t *ptr)
+{
+        return ptr;
+        //uint8_t c;
+        //int i, end, len;
+
+        /* Add a "param req" option with the list of options we'd like to have
+         * from stubborn DHCP servers. Pull the data from the struct in common.c.
+         * No bounds checking because it goes towards the head of the packet. */
+        //...
+
+        /* Add -x options if any */
+        //...
+}
+
+static int d6_mcast_from_client_config_ifindex(struct d6_packet *packet, uint8_t *end)
+{
+        static const uint8_t FF02__1_2[16] = {
+                0xFF, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x02,
+        };
+
+        return d6_send_raw_packet(
+                packet, (end - (uint8_t*) packet),
+                /*src*/ NULL, CLIENT_PORT,
+                /*dst*/ (struct in6_addr*)FF02__1_2, SERVER_PORT, MAC_BCAST_ADDR,
+                client_config.ifindex
+        );
+}
+
+/* Milticast a DHCPv6 Solicit packet to the network, with an optionally requested IP.
+ *
+ * RFC 3315 17.1.1. Creation of Solicit Messages
+ *
+ * The client MUST include a Client Identifier option to identify itself
+ * to the server.  The client includes IA options for any IAs to which
+ * it wants the server to assign addresses.  The client MAY include
+ * addresses in the IAs as a hint to the server about addresses for
+ * which the client has a preference. ...
+ *
+ * The client uses IA_NA options to request the assignment of non-
+ * temporary addresses and uses IA_TA options to request the assignment
+ * of temporary addresses.  Either IA_NA or IA_TA options, or a
+ * combination of both, can be included in DHCP messages.
+ *
+ * The client SHOULD include an Option Request option (see section 22.7)
+ * to indicate the options the client is interested in receiving.  The
+ * client MAY additionally include instances of those options that are
+ * identified in the Option Request option, with data values as hints to
+ * the server about parameter values the client would like to have
+ * returned.
+ *
+ * The client includes a Reconfigure Accept option (see section 22.20)
+ * if the client is willing to accept Reconfigure messages from the
+ * server.
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |        OPTION_CLIENTID        |          option-len           |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      .                                                               .
+      .                              DUID                             .
+      .                        (variable length)                      .
+      .                                                               .
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |          OPTION_IA_NA         |          option-len           |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |                        IAID (4 octets)                        |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |                              T1                               |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |                              T2                               |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |                                                               |
+      .                         IA_NA-options                         .
+      .                                                               .
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |          OPTION_IAADDR        |          option-len           |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |                                                               |
+      |                         IPv6 address                          |
+      |                                                               |
+      |                                                               |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |                      preferred-lifetime                       |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |                        valid-lifetime                         |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      .                                                               .
+      .                        IAaddr-options                         .
+      .                                                               .
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |           OPTION_ORO          |           option-len          |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |    requested-option-code-1    |    requested-option-code-2    |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |                              ...                              |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |     OPTION_RECONF_ACCEPT      |               0               |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ */
+/* NOINLINE: limit stack usage in caller */
+static NOINLINE int send_d6_discover(uint32_t xid, struct in6_addr *requested_ipv6)
+{
+        struct d6_packet packet;
+        uint8_t *opt_ptr;
+        unsigned len;
+
+        /* Fill in: msg type, client id */
+        opt_ptr = init_d6_packet(&packet, D6_MSG_SOLICIT, xid);
+
+        /* Create new IA_NA, optionally with included IAADDR with requested IP */
+        free(client6_data.ia_na);
+        len = requested_ipv6 ? 2+2+4+4+4 + 2+2+16+4+4 : 2+2+4+4+4;
+        client6_data.ia_na = xzalloc(len);
+        client6_data.ia_na->code = D6_OPT_IA_NA;
+        client6_data.ia_na->len = len - 4;
+        *(uint32_t*)client6_data.ia_na->data = rand(); /* IAID */
+        if (requested_ipv6) {
+                struct d6_option *iaaddr = (void*)(client6_data.ia_na->data + 4+4+4);
+                iaaddr->code = D6_OPT_IAADDR;
+                iaaddr->len = 16+4+4;
+                memcpy(iaaddr->data, requested_ipv6, 16);
+        }
+        opt_ptr = d6_store_blob(opt_ptr, client6_data.ia_na, len);
+
+        /* Add options:
+         * "param req" option according to -O, options specified with -x
+         */
+        opt_ptr = add_d6_client_options(opt_ptr);
+
+        bb_info_msg("Sending discover...");
+        return d6_mcast_from_client_config_ifindex(&packet, opt_ptr);
+}
+
+/* Multicast a DHCPv6 request message
+ *
+ * RFC 3315 18.1.1. Creation and Transmission of Request Messages
+ *
+ * The client uses a Request message to populate IAs with addresses and
+ * obtain other configuration information.  The client includes one or
+ * more IA options in the Request message.  The server then returns
+ * addresses and other information about the IAs to the client in IA
+ * options in a Reply message.
+ *
+ * The client generates a transaction ID and inserts this value in the
+ * "transaction-id" field.
+ *
+ * The client places the identifier of the destination server in a
+ * Server Identifier option.
+ *
+ * The client MUST include a Client Identifier option to identify itself
+ * to the server.  The client adds any other appropriate options,
+ * including one or more IA options (if the client is requesting that
+ * the server assign it some network addresses).
+ *
+ * The client MUST include an Option Request option (see section 22.7)
+ * to indicate the options the client is interested in receiving.  The
+ * client MAY include options with data values as hints to the server
+ * about parameter values the client would like to have returned.
+ *
+ * The client includes a Reconfigure Accept option (see section 22.20)
+ * indicating whether or not the client is willing to accept Reconfigure
+ * messages from the server.
+ */
+/* NOINLINE: limit stack usage in caller */
+static NOINLINE int send_d6_select(uint32_t xid)
+{
+        struct d6_packet packet;
+        uint8_t *opt_ptr;
+
+        /* Fill in: msg type, client id */
+        opt_ptr = init_d6_packet(&packet, D6_MSG_REQUEST, xid);
+
+        /* server id */
+        opt_ptr = d6_store_blob(opt_ptr, client6_data.server_id, client6_data.server_id->len + 2+2);
+        /* IA NA (contains requested IP) */
+        opt_ptr = d6_store_blob(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
+
+        /* Add options:
+         * "param req" option according to -O, options specified with -x
+         */
+        opt_ptr = add_d6_client_options(opt_ptr);
+
+        bb_info_msg("Sending select...");
+        return d6_mcast_from_client_config_ifindex(&packet, opt_ptr);
+}
+
+/* Unicast or broadcast a DHCP renew message
+ *
+ * RFC 3315 18.1.3. Creation and Transmission of Renew Messages
+ *
+ * To extend the valid and preferred lifetimes for the addresses
+ * associated with an IA, the client sends a Renew message to the server
+ * from which the client obtained the addresses in the IA containing an
+ * IA option for the IA.  The client includes IA Address options in the
+ * IA option for the addresses associated with the IA.  The server
+ * determines new lifetimes for the addresses in the IA according to the
+ * administrative configuration of the server.  The server may also add
+ * new addresses to the IA.  The server may remove addresses from the IA
+ * by setting the preferred and valid lifetimes of those addresses to
+ * zero.
+ *
+ * The server controls the time at which the client contacts the server
+ * to extend the lifetimes on assigned addresses through the T1 and T2
+ * parameters assigned to an IA.
+ *
+ * At time T1 for an IA, the client initiates a Renew/Reply message
+ * exchange to extend the lifetimes on any addresses in the IA.  The
+ * client includes an IA option with all addresses currently assigned to
+ * the IA in its Renew message.
+ *
+ * If T1 or T2 is set to 0 by the server (for an IA_NA) or there are no
+ * T1 or T2 times (for an IA_TA), the client may send a Renew or Rebind
+ * message, respectively, at the client's discretion.
+ *
+ * The client sets the "msg-type" field to RENEW.  The client generates
+ * a transaction ID and inserts this value in the "transaction-id"
+ * field.
+ *
+ * The client places the identifier of the destination server in a
+ * Server Identifier option.
+ *
+ * The client MUST include a Client Identifier option to identify itself
+ * to the server.  The client adds any appropriate options, including
+ * one or more IA options.  The client MUST include the list of
+ * addresses the client currently has associated with the IAs in the
+ * Renew message.
+ *
+ * The client MUST include an Option Request option (see section 22.7)
+ * to indicate the options the client is interested in receiving.  The
+ * client MAY include options with data values as hints to the server
+ * about parameter values the client would like to have returned.
+ */
+/* NOINLINE: limit stack usage in caller */
+static NOINLINE int send_d6_renew(uint32_t xid, struct in6_addr *server_ipv6, struct in6_addr *our_cur_ipv6)
+{
+        struct d6_packet packet;
+        uint8_t *opt_ptr;
+
+        /* Fill in: msg type, client id */
+        opt_ptr = init_d6_packet(&packet, DHCPREQUEST, xid);
+
+        /* server id */
+        opt_ptr = d6_store_blob(opt_ptr, client6_data.server_id, client6_data.server_id->len + 2+2);
+        /* IA NA (contains requested IP) */
+        opt_ptr = d6_store_blob(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
+
+        /* Add options:
+         * "param req" option according to -O, options specified with -x
+         */
+        opt_ptr = add_d6_client_options(opt_ptr);
+
+        bb_info_msg("Sending renew...");
+        if (server_ipv6)
+                return d6_send_kernel_packet(
+                        &packet, (opt_ptr - (uint8_t*) &packet),
+                        our_cur_ipv6, CLIENT_PORT,
+                        server_ipv6, SERVER_PORT
+                );
+        return d6_mcast_from_client_config_ifindex(&packet, opt_ptr);
+}
+
+/* Unicast a DHCP release message */
+static int send_d6_release(struct in6_addr *server_ipv6, struct in6_addr *our_cur_ipv6)
+{
+        struct d6_packet packet;
+        uint8_t *opt_ptr;
+
+        /* Fill in: msg type, client id */
+        opt_ptr = init_d6_packet(&packet, D6_MSG_RELEASE, random_xid());
+        /* server id */
+        opt_ptr = d6_store_blob(opt_ptr, client6_data.server_id, client6_data.server_id->len + 2+2);
+        /* IA NA (contains our current IP) */
+        opt_ptr = d6_store_blob(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
+
+        bb_info_msg("Sending release...");
+        return d6_send_kernel_packet(
+                &packet, (opt_ptr - (uint8_t*) &packet),
+                our_cur_ipv6, CLIENT_PORT,
+                server_ipv6, SERVER_PORT
+        );
+}
+
+/* Returns -1 on errors that are fatal for the socket, -2 for those that aren't */
+/* NOINLINE: limit stack usage in caller */
+static NOINLINE int d6_recv_raw_packet(struct in6_addr *peer_ipv6
+        UNUSED_PARAM
+        , struct d6_packet *d6_pkt, int fd)
+{
+        int bytes;
+        struct ip6_udp_d6_packet packet;
+
+        bytes = safe_read(fd, &packet, sizeof(packet));
+        if (bytes < 0) {
+                log1("Packet read error, ignoring");
+                /* NB: possible down interface, etc. Caller should pause. */
+                return bytes; /* returns -1 */
+        }
+
+        if (bytes < (int) (sizeof(packet.ip6) + sizeof(packet.udp))) {
+                log1("Packet is too short, ignoring");
+                return -2;
+        }
+
+        if (bytes < sizeof(packet.ip6) + ntohs(packet.ip6.ip6_plen)) {
+                /* packet is bigger than sizeof(packet), we did partial read */
+                log1("Oversized packet, ignoring");
+                return -2;
+        }
+
+        /* ignore any extra garbage bytes */
+        bytes = sizeof(packet.ip6) + ntohs(packet.ip6.ip6_plen);
+
+        /* make sure its the right packet for us, and that it passes sanity checks */
+        if (packet.ip6.ip6_nxt != IPPROTO_UDP
+         || (packet.ip6.ip6_vfc >> 4) != 6
+         || packet.udp.dest != htons(CLIENT_PORT)
+        /* || bytes > (int) sizeof(packet) - can't happen */
+         || packet.udp.len != packet.ip6.ip6_plen
+        ) {
+                log1("Unrelated/bogus packet, ignoring");
+                return -2;
+        }
+
+//How to do this for ipv6?
+//      /* verify UDP checksum. IP header has to be modified for this */
+//      memset(&packet.ip, 0, offsetof(struct iphdr, protocol));
+//      /* ip.xx fields which are not memset: protocol, check, saddr, daddr */
+//      packet.ip.tot_len = packet.udp.len; /* yes, this is needed */
+//      check = packet.udp.check;
+//      packet.udp.check = 0;
+//      if (check && check != inet_cksum((uint16_t *)&packet, bytes)) {
+//              log1("Packet with bad UDP checksum received, ignoring");
+//              return -2;
+//      }
+
+        log1("Received a packet");
+        d6_dump_packet(&packet.data);
+
+        bytes -= sizeof(packet.ip6) + sizeof(packet.udp);
+        memcpy(d6_pkt, &packet.data, bytes);
+        return bytes;
+}
+
+
+/*** Main ***/
+
+static int sockfd = -1;
+
+#define LISTEN_NONE   0
+#define LISTEN_KERNEL 1
+#define LISTEN_RAW    2
+static smallint listen_mode;
+
+/* initial state: (re)start DHCP negotiation */
+#define INIT_SELECTING  0
+/* discover was sent, DHCPOFFER reply received */
+#define REQUESTING      1
+/* select/renew was sent, DHCPACK reply received */
+#define BOUND           2
+/* half of lease passed, want to renew it by sending unicast renew requests */
+#define RENEWING        3
+/* renew requests were not answered, lease is almost over, send broadcast renew */
+#define REBINDING       4
+/* manually requested renew (SIGUSR1) */
+#define RENEW_REQUESTED 5
+/* release, possibly manually requested (SIGUSR2) */
+#define RELEASED        6
+static smallint state;
+
+static int d6_raw_socket(int ifindex)
+{
+        int fd;
+        struct sockaddr_ll sock;
+
+        /*
+         * Comment:
+         *
+         *      I've selected not to see LL header, so BPF doesn't see it, too.
+         *      The filter may also pass non-IP and non-ARP packets, but we do
+         *      a more complete check when receiving the message in userspace.
+         *
+         * and filter shamelessly stolen from:
+         *
+         *      http://www.flamewarmaster.de/software/dhcpclient/
+         *
+         * There are a few other interesting ideas on that page (look under
+         * "Motivation").  Use of netlink events is most interesting.  Think
+         * of various network servers listening for events and reconfiguring.
+         * That would obsolete sending HUP signals and/or make use of restarts.
+         *
+         * Copyright: 2006, 2007 Stefan Rompf <sux@loplof.de>.
+         * License: GPL v2.
+         *
+         * TODO: make conditional?
+         */
+#if 0
+        static const struct sock_filter filter_instr[] = {
+                /* load 9th byte (protocol) */
+                BPF_STMT(BPF_LD|BPF_B|BPF_ABS, 9),
+                /* jump to L1 if it is IPPROTO_UDP, else to L4 */
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, IPPROTO_UDP, 0, 6),
+                /* L1: load halfword from offset 6 (flags and frag offset) */
+                BPF_STMT(BPF_LD|BPF_H|BPF_ABS, 6),
+                /* jump to L4 if any bits in frag offset field are set, else to L2 */
+                BPF_JUMP(BPF_JMP|BPF_JSET|BPF_K, 0x1fff, 4, 0),
+                /* L2: skip IP header (load index reg with header len) */
+                BPF_STMT(BPF_LDX|BPF_B|BPF_MSH, 0),
+                /* load udp destination port from halfword[header_len + 2] */
+                BPF_STMT(BPF_LD|BPF_H|BPF_IND, 2),
+                /* jump to L3 if udp dport is CLIENT_PORT, else to L4 */
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 68, 0, 1),
+                /* L3: accept packet */
+                BPF_STMT(BPF_RET|BPF_K, 0xffffffff),
+                /* L4: discard packet */
+                BPF_STMT(BPF_RET|BPF_K, 0),
+        };
+        static const struct sock_fprog filter_prog = {
+                .len = sizeof(filter_instr) / sizeof(filter_instr[0]),
+                /* casting const away: */
+                .filter = (struct sock_filter *) filter_instr,
+        };
+#endif
+
+        log1("Opening raw socket on ifindex %d", ifindex); //log2?
+
+        fd = xsocket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IPV6));
+        log1("Got raw socket fd %d", fd); //log2?
+
+        sock.sll_family = AF_PACKET;
+        sock.sll_protocol = htons(ETH_P_IPV6);
+        sock.sll_ifindex = ifindex;
+        xbind(fd, (struct sockaddr *) &sock, sizeof(sock));
+
+#if 0
+        if (CLIENT_PORT == 68) {
+                /* Use only if standard port is in use */
+                /* Ignoring error (kernel may lack support for this) */
+                if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter_prog,
+                                sizeof(filter_prog)) >= 0)
+                        log1("Attached filter to raw socket fd %d", fd); // log?
+        }
+#endif
+
+        log1("Created raw socket");
+
+        return fd;
+}
+
+static void change_listen_mode(int new_mode)
+{
+        log1("Entering listen mode: %s",
+                new_mode != LISTEN_NONE
+                        ? (new_mode == LISTEN_KERNEL ? "kernel" : "raw")
+                        : "none"
+        );
+
+        listen_mode = new_mode;
+        if (sockfd >= 0) {
+                close(sockfd);
+                sockfd = -1;
+        }
+        if (new_mode == LISTEN_KERNEL)
+                sockfd = udhcp_listen_socket(/*INADDR_ANY,*/ CLIENT_PORT, client_config.interface);
+        else if (new_mode != LISTEN_NONE)
+                sockfd = d6_raw_socket(client_config.ifindex);
+        /* else LISTEN_NONE: sockfd stays closed */
+}
+
+/* Called only on SIGUSR1 */
+static void perform_renew(void)
+{
+        bb_info_msg("Performing a DHCP renew");
+        switch (state) {
+        case BOUND:
+                change_listen_mode(LISTEN_KERNEL);
+        case RENEWING:
+        case REBINDING:
+                state = RENEW_REQUESTED;
+                break;
+        case RENEW_REQUESTED: /* impatient are we? fine, square 1 */
+                d6_run_script(NULL, "deconfig");
+        case REQUESTING:
+        case RELEASED:
+                change_listen_mode(LISTEN_RAW);
+                state = INIT_SELECTING;
+                break;
+        case INIT_SELECTING:
+                break;
+        }
+}
+
+static void perform_d6_release(struct in6_addr *server_ipv6, struct in6_addr *our_cur_ipv6)
+{
+        /* send release packet */
+        if (state == BOUND || state == RENEWING || state == REBINDING) {
+                bb_info_msg("Unicasting a release");
+                send_d6_release(server_ipv6, our_cur_ipv6); /* unicast */
+                d6_run_script(NULL, "deconfig");
+        }
+        bb_info_msg("Entering released state");
+
+        change_listen_mode(LISTEN_NONE);
+        state = RELEASED;
+}
+
+///static uint8_t* alloc_dhcp_option(int code, const char *str, int extra)
+///{
+///     uint8_t *storage;
+///     int len = strnlen(str, 255);
+///     storage = xzalloc(len + extra + OPT_DATA);
+///     storage[OPT_CODE] = code;
+///     storage[OPT_LEN] = len + extra;
+///     memcpy(storage + extra + OPT_DATA, str, len);
+///     return storage;
+///}
+
+#if BB_MMU
+static void client_background(void)
+{
+        bb_daemonize(0);
+        logmode &= ~LOGMODE_STDIO;
+        /* rewrite pidfile, as our pid is different now */
+        write_pidfile(client_config.pidfile);
+}
+#endif
+
+//usage:#if defined CONFIG_UDHCP_DEBUG && CONFIG_UDHCP_DEBUG >= 1
+//usage:# define IF_UDHCP_VERBOSE(...) __VA_ARGS__
+//usage:#else
+//usage:# define IF_UDHCP_VERBOSE(...)
+//usage:#endif
+//usage:#define udhcpc6_trivial_usage
+//usage:       "[-fbnq"IF_UDHCP_VERBOSE("v")"oR] [-i IFACE] [-r IP] [-s PROG] [-p PIDFILE]\n"
+//usage:       "        [-x OPT:VAL]... [-O OPT]..." IF_FEATURE_UDHCP_PORT(" [-P N]")
+//usage:#define udhcpc6_full_usage "\n"
+//usage:        IF_LONG_OPTS(
+//usage:     "\n        -i,--interface IFACE    Interface to use (default eth0)"
+//usage:     "\n        -p,--pidfile FILE       Create pidfile"
+//usage:     "\n        -s,--script PROG        Run PROG at DHCP events (default "CONFIG_UDHCPC_DEFAULT_SCRIPT")"
+//usage:     "\n        -B,--broadcast          Request broadcast replies"
+//usage:     "\n        -t,--retries N          Send up to N discover packets"
+//usage:     "\n        -T,--timeout N          Pause between packets (default 3 seconds)"
+//usage:     "\n        -A,--tryagain N         Wait N seconds after failure (default 20)"
+//usage:     "\n        -f,--foreground         Run in foreground"
+//usage:        USE_FOR_MMU(
+//usage:     "\n        -b,--background         Background if lease is not obtained"
+//usage:        )
+//usage:     "\n        -n,--now                Exit if lease is not obtained"
+//usage:     "\n        -q,--quit               Exit after obtaining lease"
+//usage:     "\n        -R,--release            Release IP on exit"
+//usage:     "\n        -S,--syslog             Log to syslog too"
+//usage:        IF_FEATURE_UDHCP_PORT(
+//usage:     "\n        -P,--client-port N      Use port N (default 546)"
+//usage:        )
+////usage:      IF_FEATURE_UDHCPC_ARPING(
+////usage:     "\n      -a,--arping             Use arping to validate offered address"
+////usage:      )
+//usage:     "\n        -O,--request-option OPT Request option OPT from server (cumulative)"
+//usage:     "\n        -o,--no-default-options Don't request any options (unless -O is given)"
+//usage:     "\n        -r,--request IP         Request this IP address"
+//usage:     "\n        -x OPT:VAL              Include option OPT in sent packets (cumulative)"
+//usage:     "\n                                Examples of string, numeric, and hex byte opts:"
+//usage:     "\n                                -x hostname:bbox - option 12"
+//usage:     "\n                                -x lease:3600 - option 51 (lease time)"
+//usage:     "\n                                -x 0x3d:0100BEEFC0FFEE - option 61 (client id)"
+//usage:        IF_UDHCP_VERBOSE(
+//usage:     "\n        -v                      Verbose"
+//usage:        )
+//usage:        )
+//usage:        IF_NOT_LONG_OPTS(
+//usage:     "\n        -i IFACE        Interface to use (default eth0)"
+//usage:     "\n        -p FILE         Create pidfile"
+//usage:     "\n        -s PROG         Run PROG at DHCP events (default "CONFIG_UDHCPC_DEFAULT_SCRIPT")"
+//usage:     "\n        -B              Request broadcast replies"
+//usage:     "\n        -t N            Send up to N discover packets"
+//usage:     "\n        -T N            Pause between packets (default 3 seconds)"
+//usage:     "\n        -A N            Wait N seconds (default 20) after failure"
+//usage:     "\n        -f              Run in foreground"
+//usage:        USE_FOR_MMU(
+//usage:     "\n        -b              Background if lease is not obtained"
+//usage:        )
+//usage:     "\n        -n              Exit if lease is not obtained"
+//usage:     "\n        -q              Exit after obtaining lease"
+//usage:     "\n        -R              Release IP on exit"
+//usage:     "\n        -S              Log to syslog too"
+//usage:        IF_FEATURE_UDHCP_PORT(
+//usage:     "\n        -P N            Use port N (default 546)"
+//usage:        )
+////usage:      IF_FEATURE_UDHCPC_ARPING(
+////usage:     "\n      -a              Use arping to validate offered address"
+////usage:      )
+//usage:     "\n        -O OPT          Request option OPT from server (cumulative)"
+//usage:     "\n        -o              Don't request any options (unless -O is given)"
+//usage:     "\n        -r IP           Request this IP address"
+//usage:     "\n        -x OPT:VAL      Include option OPT in sent packets (cumulative)"
+//usage:     "\n                        Examples of string, numeric, and hex byte opts:"
+//usage:     "\n                        -x hostname:bbox - option 12"
+//usage:     "\n                        -x lease:3600 - option 51 (lease time)"
+//usage:     "\n                        -x 0x3d:0100BEEFC0FFEE - option 61 (client id)"
+//usage:        IF_UDHCP_VERBOSE(
+//usage:     "\n        -v              Verbose"
+//usage:        )
+//usage:        )
+//usage:     "\nSignals:"
+//usage:     "\n        USR1    Renew lease"
+//usage:     "\n        USR2    Release lease"
+
+
+int udhcpc6_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
+int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
+{
+        const char *str_r;
+        IF_FEATURE_UDHCP_PORT(char *str_P;)
+        void *clientid_mac_ptr;
+        llist_t *list_O = NULL;
+        llist_t *list_x = NULL;
+        int tryagain_timeout = 20;
+        int discover_timeout = 3;
+        int discover_retries = 3;
+        struct in6_addr srv6_buf;
+        struct in6_addr ipv6_buf;
+        struct in6_addr *requested_ipv6;
+        uint32_t xid = 0;
+        int packet_num;
+        int timeout; /* must be signed */
+        unsigned already_waited_sec;
+        unsigned opt;
+        int max_fd;
+        int retval;
+        fd_set rfds;
+
+        /* Default options */
+        IF_FEATURE_UDHCP_PORT(SERVER_PORT = 547;)
+        IF_FEATURE_UDHCP_PORT(CLIENT_PORT = 546;)
+        client_config.interface = "eth0";
+        client_config.script = CONFIG_UDHCPC_DEFAULT_SCRIPT;
+
+        /* Parse command line */
+        /* O,x: list; -T,-t,-A take numeric param */
+        opt_complementary = "O::x::T+:t+:A+" IF_UDHCP_VERBOSE(":vv") ;
+        IF_LONG_OPTS(applet_long_options = udhcpc6_longopts;)
+        opt = getopt32(argv, "i:np:qRr:s:T:t:SA:O:ox:f"
+                USE_FOR_MMU("b")
+                ///IF_FEATURE_UDHCPC_ARPING("a")
+                IF_FEATURE_UDHCP_PORT("P:")
+                "v"
+                , &client_config.interface, &client_config.pidfile, &str_r /* i,p */
+                , &client_config.script /* s */
+                , &discover_timeout, &discover_retries, &tryagain_timeout /* T,t,A */
+                , &list_O
+                , &list_x
+                IF_FEATURE_UDHCP_PORT(, &str_P)
+                IF_UDHCP_VERBOSE(, &dhcp_verbose)
+        );
+        requested_ipv6 = NULL;
+        if (opt & OPT_r) {
+                if (inet_pton(AF_INET6, str_r, &ipv6_buf) <= 0)
+                        bb_error_msg_and_die("bad IPv6 address '%s'", str_r);
+                requested_ipv6 = &ipv6_buf;
+        }
+#if ENABLE_FEATURE_UDHCP_PORT
+        if (opt & OPT_P) {
+                CLIENT_PORT = xatou16(str_P);
+                SERVER_PORT = CLIENT_PORT - 1;
+        }
+#endif
+        if (opt & OPT_o)
+                client_config.no_default_options = 1;
+        while (list_O) {
+                char *optstr = llist_pop(&list_O);
+                unsigned n = bb_strtou(optstr, NULL, 0);
+                if (errno || n > 254) {
+                        n = udhcp_option_idx(optstr);
+                        n = dhcp_optflags[n].code;
+                }
+                client_config.opt_mask[n >> 3] |= 1 << (n & 7);
+        }
+        while (list_x) {
+                char *optstr = llist_pop(&list_x);
+                char *colon = strchr(optstr, ':');
+                if (colon)
+                        *colon = ' ';
+                /* now it looks similar to udhcpd's config file line:
+                 * "optname optval", using the common routine: */
+                udhcp_str2optset(optstr, &client_config.options);
+        }
+
+        if (udhcp_read_interface(client_config.interface,
+                        &client_config.ifindex,
+                        NULL,
+                        client_config.client_mac)
+        ) {
+                return 1;
+        }
+
+        /* Create client ID based on mac, set clientid_mac_ptr */
+        {
+                struct d6_option *clientid;
+                clientid = xzalloc(2+2+2+2+6);
+                clientid->code = D6_OPT_CLIENTID;
+                clientid->len = 2+2+6;
+                clientid->data[1] = 3; /* DUID-LL */
+                clientid->data[3] = 1; /* ethernet */
+                clientid_mac_ptr = clientid->data + 2+2;
+                memcpy(clientid_mac_ptr, client_config.client_mac, 6);
+                client_config.clientid = (void*)clientid;
+        }
+
+#if !BB_MMU
+        /* on NOMMU reexec (i.e., background) early */
+        if (!(opt & OPT_f)) {
+                bb_daemonize_or_rexec(0 /* flags */, argv);
+                logmode = LOGMODE_NONE;
+        }
+#endif
+        if (opt & OPT_S) {
+                openlog(applet_name, LOG_PID, LOG_DAEMON);
+                logmode |= LOGMODE_SYSLOG;
+        }
+
+        /* Make sure fd 0,1,2 are open */
+        bb_sanitize_stdio();
+        /* Equivalent of doing a fflush after every \n */
+        setlinebuf(stdout);
+        /* Create pidfile */
+        write_pidfile(client_config.pidfile);
+        /* Goes to stdout (unless NOMMU) and possibly syslog */
+        bb_info_msg("%s (v"BB_VER") started", applet_name);
+        /* Set up the signal pipe */
+        udhcp_sp_setup();
+        /* We want random_xid to be random... */
+        srand(monotonic_us());
+
+        state = INIT_SELECTING;
+        d6_run_script(NULL, "deconfig");
+        change_listen_mode(LISTEN_RAW);
+        packet_num = 0;
+        timeout = 0;
+        already_waited_sec = 0;
+
+        /* Main event loop. select() waits on signal pipe and possibly
+         * on sockfd.
+         * "continue" statements in code below jump to the top of the loop.
+         */
+        for (;;) {
+                struct timeval tv;
+                struct d6_packet packet;
+                uint8_t *packet_end;
+                /* silence "uninitialized!" warning */
+                unsigned timestamp_before_wait = timestamp_before_wait;
+
+                //bb_error_msg("sockfd:%d, listen_mode:%d", sockfd, listen_mode);
+
+                /* Was opening raw or udp socket here
+                 * if (listen_mode != LISTEN_NONE && sockfd < 0),
+                 * but on fast network renew responses return faster
+                 * than we open sockets. Thus this code is moved
+                 * to change_listen_mode(). Thus we open listen socket
+                 * BEFORE we send renew request (see "case BOUND:"). */
+
+                max_fd = udhcp_sp_fd_set(&rfds, sockfd);
+
+                tv.tv_sec = timeout - already_waited_sec;
+                tv.tv_usec = 0;
+                retval = 0;
+                /* If we already timed out, fall through with retval = 0, else... */
+                if ((int)tv.tv_sec > 0) {
+                        timestamp_before_wait = (unsigned)monotonic_sec();
+                        log1("Waiting on select...");
+                        retval = select(max_fd + 1, &rfds, NULL, NULL, &tv);
+                        if (retval < 0) {
+                                /* EINTR? A signal was caught, don't panic */
+                                if (errno == EINTR) {
+                                        already_waited_sec += (unsigned)monotonic_sec() - timestamp_before_wait;
+                                        continue;
+                                }
+                                /* Else: an error occured, panic! */
+                                bb_perror_msg_and_die("select");
+                        }
+                }
+
+                /* If timeout dropped to zero, time to become active:
+                 * resend discover/renew/whatever
+                 */
+                if (retval == 0) {
+                        /* When running on a bridge, the ifindex may have changed
+                         * (e.g. if member interfaces were added/removed
+                         * or if the status of the bridge changed).
+                         * Refresh ifindex and client_mac:
+                         */
+                        if (udhcp_read_interface(client_config.interface,
+                                        &client_config.ifindex,
+                                        NULL,
+                                        client_config.client_mac)
+                        ) {
+                                goto ret0; /* iface is gone? */
+                        }
+                        memcpy(clientid_mac_ptr, client_config.client_mac, 6);
+
+                        /* We will restart the wait in any case */
+                        already_waited_sec = 0;
+
+                        switch (state) {
+                        case INIT_SELECTING:
+                                if (packet_num < discover_retries) {
+                                        if (packet_num == 0)
+                                                xid = random_xid();
+                                        /* multicast */
+                                        send_d6_discover(xid, requested_ipv6);
+                                        timeout = discover_timeout;
+                                        packet_num++;
+                                        continue;
+                                }
+ leasefail:
+                                d6_run_script(NULL, "leasefail");
+#if BB_MMU /* -b is not supported on NOMMU */
+                                if (opt & OPT_b) { /* background if no lease */
+                                        bb_info_msg("No lease, forking to background");
+                                        client_background();
+                                        /* do not background again! */
+                                        opt = ((opt & ~OPT_b) | OPT_f);
+                                } else
+#endif
+                                if (opt & OPT_n) { /* abort if no lease */
+                                        bb_info_msg("No lease, failing");
+                                        retval = 1;
+                                        goto ret;
+                                }
+                                /* wait before trying again */
+                                timeout = tryagain_timeout;
+                                packet_num = 0;
+                                continue;
+                        case REQUESTING:
+                                if (packet_num < discover_retries) {
+                                        /* send multicast select packet */
+                                        send_d6_select(xid);
+                                        timeout = discover_timeout;
+                                        packet_num++;
+                                        continue;
+                                }
+                                /* Timed out, go back to init state.
+                                 * "discover...select...discover..." loops
+                                 * were seen in the wild. Treat them similarly
+                                 * to "no response to discover" case */
+                                change_listen_mode(LISTEN_RAW);
+                                state = INIT_SELECTING;
+                                goto leasefail;
+                        case BOUND:
+                                /* 1/2 lease passed, enter renewing state */
+                                state = RENEWING;
+                                client_config.first_secs = 0; /* make secs field count from 0 */
+                                change_listen_mode(LISTEN_KERNEL);
+                                log1("Entering renew state");
+                                /* fall right through */
+                        case RENEW_REQUESTED: /* manual (SIGUSR1) renew */
+                        case_RENEW_REQUESTED:
+                        case RENEWING:
+                                if (timeout > 60) {
+                                        /* send an unicast renew request */
+                        /* Sometimes observed to fail (EADDRNOTAVAIL) to bind
+                         * a new UDP socket for sending inside send_renew.
+                         * I hazard to guess existing listening socket
+                         * is somehow conflicting with it, but why is it
+                         * not deterministic then?! Strange.
+                         * Anyway, it does recover by eventually failing through
+                         * into INIT_SELECTING state.
+                         */
+                                        send_d6_renew(xid, &srv6_buf, requested_ipv6);
+                                        timeout >>= 1;
+                                        continue;
+                                }
+                                /* Timed out, enter rebinding state */
+                                log1("Entering rebinding state");
+                                state = REBINDING;
+                                /* fall right through */
+                        case REBINDING:
+                                /* Switch to bcast receive */
+                                change_listen_mode(LISTEN_RAW);
+                                /* Lease is *really* about to run out,
+                                 * try to find DHCP server using broadcast */
+                                if (timeout > 0) {
+                                        /* send a broadcast renew request */
+                                        send_d6_renew(xid, /*server_ipv6:*/ NULL, requested_ipv6);
+                                        timeout >>= 1;
+                                        continue;
+                                }
+                                /* Timed out, enter init state */
+                                bb_info_msg("Lease lost, entering init state");
+                                d6_run_script(NULL, "deconfig");
+                                state = INIT_SELECTING;
+                                client_config.first_secs = 0; /* make secs field count from 0 */
+                                /*timeout = 0; - already is */
+                                packet_num = 0;
+                                continue;
+                        /* case RELEASED: */
+                        }
+                        /* yah, I know, *you* say it would never happen */
+                        timeout = INT_MAX;
+                        continue; /* back to main loop */
+                } /* if select timed out */
+
+                /* select() didn't timeout, something happened */
+
+                /* Is it a signal? */
+                /* note: udhcp_sp_read checks FD_ISSET before reading */
+                switch (udhcp_sp_read(&rfds)) {
+                case SIGUSR1:
+                        client_config.first_secs = 0; /* make secs field count from 0 */
+                        already_waited_sec = 0;
+                        perform_renew();
+                        if (state == RENEW_REQUESTED) {
+                                /* We might be either on the same network
+                                 * (in which case renew might work),
+                                 * or we might be on a completely different one
+                                 * (in which case renew won't ever succeed).
+                                 * For the second case, must make sure timeout
+                                 * is not too big, or else we can send
+                                 * futile renew requests for hours.
+                                 * (Ab)use -A TIMEOUT value (usually 20 sec)
+                                 * as a cap on the timeout.
+                                 */
+                                if (timeout > tryagain_timeout)
+                                        timeout = tryagain_timeout;
+                                goto case_RENEW_REQUESTED;
+                        }
+                        /* Start things over */
+                        packet_num = 0;
+                        /* Kill any timeouts, user wants this to hurry along */
+                        timeout = 0;
+                        continue;
+                case SIGUSR2:
+                        perform_d6_release(&srv6_buf, requested_ipv6);
+                        timeout = INT_MAX;
+                        continue;
+                case SIGTERM:
+                        bb_info_msg("Received SIGTERM");
+                        goto ret0;
+                }
+
+                /* Is it a packet? */
+                if (listen_mode == LISTEN_NONE || !FD_ISSET(sockfd, &rfds))
+                        continue; /* no */
+
+                {
+                        int len;
+
+                        /* A packet is ready, read it */
+                        if (listen_mode == LISTEN_KERNEL)
+                                len = d6_recv_kernel_packet(&srv6_buf, &packet, sockfd);
+                        else
+                                len = d6_recv_raw_packet(&srv6_buf, &packet, sockfd);
+                        if (len == -1) {
+                                /* Error is severe, reopen socket */
+                                bb_info_msg("Read error: %s, reopening socket", strerror(errno));
+                                sleep(discover_timeout); /* 3 seconds by default */
+                                change_listen_mode(listen_mode); /* just close and reopen */
+                        }
+                        /* If this packet will turn out to be unrelated/bogus,
+                         * we will go back and wait for next one.
+                         * Be sure timeout is properly decreased. */
+                        already_waited_sec += (unsigned)monotonic_sec() - timestamp_before_wait;
+                        if (len < 0)
+                                continue;
+                        packet_end = (uint8_t*)&packet + len;
+                }
+
+                if ((packet.d6_xid32 & htonl(0x00ffffff)) != xid) {
+                        log1("xid %x (our is %x), ignoring packet",
+                                (unsigned)(packet.d6_xid32 & htonl(0x00ffffff)), (unsigned)xid);
+                        continue;
+                }
+
+                switch (state) {
+                case INIT_SELECTING:
+                        if (packet.d6_msg_type == D6_MSG_ADVERTISE)
+                                goto type_is_ok;
+                        /* DHCPv6 has "Rapid Commit", when instead of Advertise,
+                         * server sends Reply right away.
+                         * Fall through to check for this case.
+                         */
+                case REQUESTING:
+                case RENEWING:
+                case RENEW_REQUESTED:
+                case REBINDING:
+                        if (packet.d6_msg_type == D6_MSG_REPLY) {
+                                uint32_t lease_seconds;
+                                struct d6_option *option, *iaaddr;
+ type_is_ok:
+                                option = d6_find_option(packet.d6_options, packet_end, D6_OPT_STATUS_CODE);
+                                if (option && option->data[4] != 0) {
+                                        /* return to init state */
+                                        bb_info_msg("Received DHCP NAK (%u)", option->data[4]);
+                                        d6_run_script(&packet, "nak");
+                                        if (state != REQUESTING)
+                                                d6_run_script(NULL, "deconfig");
+                                        change_listen_mode(LISTEN_RAW);
+                                        sleep(3); /* avoid excessive network traffic */
+                                        state = INIT_SELECTING;
+                                        client_config.first_secs = 0; /* make secs field count from 0 */
+                                        requested_ipv6 = NULL;
+                                        timeout = 0;
+                                        packet_num = 0;
+                                        already_waited_sec = 0;
+                                        continue;
+                                }
+                                option = d6_copy_option(packet.d6_options, packet_end, D6_OPT_SERVERID);
+                                if (!option) {
+                                        bb_error_msg("no server ID, ignoring packet");
+                                        continue;
+                                        /* still selecting - this server looks bad */
+                                }
+//Note: we do not bother comparing server IDs in Advertise and Reply msgs.
+//server_id variable is used solely for creation of proper server_id option
+//in outgoing packets. (why DHCPv6 even introduced it is a mystery).
+                                free(client6_data.server_id);
+                                client6_data.server_id = option;
+                                if (packet.d6_msg_type == D6_MSG_ADVERTISE) {
+                                        /* enter requesting state */
+                                        state = REQUESTING;
+                                        timeout = 0;
+                                        packet_num = 0;
+                                        already_waited_sec = 0;
+                                        continue;
+                                }
+                                /* It's a D6_MSG_REPLY */
+/*
+ * RFC 3315 18.1.8. Receipt of Reply Messages
+ *
+ * Upon the receipt of a valid Reply message in response to a Solicit
+ * (with a Rapid Commit option), Request, Confirm, Renew, Rebind or
+ * Information-request message, the client extracts the configuration
+ * information contained in the Reply.  The client MAY choose to report
+ * any status code or message from the status code option in the Reply
+ * message.
+ *
+ * The client SHOULD perform duplicate address detection [17] on each of
+ * the addresses in any IAs it receives in the Reply message before
+ * using that address for traffic.  If any of the addresses are found to
+ * be in use on the link, the client sends a Decline message to the
+ * server as described in section 18.1.7.
+ *
+ * If the Reply was received in response to a Solicit (with a Rapid
+ * Commit option), Request, Renew or Rebind message, the client updates
+ * the information it has recorded about IAs from the IA options
+ * contained in the Reply message:
+ *
+ * -  Record T1 and T2 times.
+ *
+ * -  Add any new addresses in the IA option to the IA as recorded by
+ *    the client.
+ *
+ * -  Update lifetimes for any addresses in the IA option that the
+ *    client already has recorded in the IA.
+ *
+ * -  Discard any addresses from the IA, as recorded by the client, that
+ *    have a valid lifetime of 0 in the IA Address option.
+ *
+ * -  Leave unchanged any information about addresses the client has
+ *    recorded in the IA but that were not included in the IA from the
+ *    server.
+ *
+ * Management of the specific configuration information is detailed in
+ * the definition of each option in section 22.
+ *
+ * If the client receives a Reply message with a Status Code containing
+ * UnspecFail, the server is indicating that it was unable to process
+ * the message due to an unspecified failure condition.  If the client
+ * retransmits the original message to the same server to retry the
+ * desired operation, the client MUST limit the rate at which it
+ * retransmits the message and limit the duration of the time during
+ * which it retransmits the message.
+ *
+ * When the client receives a Reply message with a Status Code option
+ * with the value UseMulticast, the client records the receipt of the
+ * message and sends subsequent messages to the server through the
+ * interface on which the message was received using multicast.  The
+ * client resends the original message using multicast.
+ *
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |          OPTION_IA_NA         |          option-len           |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                        IAID (4 octets)                        |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                              T1                               |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                              T2                               |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                                                               |
+ * .                         IA_NA-options                         .
+ * .                                                               .
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *
+ *
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |          OPTION_IAADDR        |          option-len           |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                                                               |
+ * |                         IPv6 address                          |
+ * |                                                               |
+ * |                                                               |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                      preferred-lifetime                       |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                        valid-lifetime                         |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * .                                                               .
+ * .                        IAaddr-options                         .
+ * .                                                               .
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ */
+                                free(client6_data.ia_na);
+                                client6_data.ia_na = d6_copy_option(packet.d6_options, packet_end, D6_OPT_IA_NA);
+                                if (!client6_data.ia_na) {
+                                        bb_error_msg("no %s option, ignoring packet", "IA_NA");
+                                        continue;
+                                }
+                                if (client6_data.ia_na->len < (4 + 4 + 4) + (2 + 2 + 16 + 4 + 4)) {
+                                        bb_error_msg("IA_NA option is too short:%d bytes", client6_data.ia_na->len);
+                                        continue;
+                                }
+                                iaaddr = d6_find_option(client6_data.ia_na->data + 4 + 4 + 4,
+                                                client6_data.ia_na->data + client6_data.ia_na->len,
+                                                D6_OPT_IAADDR
+                                );
+                                if (!iaaddr) {
+                                        bb_error_msg("no %s option, ignoring packet", "IAADDR");
+                                        continue;
+                                }
+                                if (iaaddr->len < (16 + 4 + 4)) {
+                                        bb_error_msg("IAADDR option is too short:%d bytes", iaaddr->len);
+                                        continue;
+                                }
+                                /* Note: the address is sufficiently aligned for cast:
+                                 * we _copied_ IA-NA, and copy is always well-aligned.
+                                 */
+                                requested_ipv6 = (struct in6_addr*) iaaddr->data;
+                                move_from_unaligned32(lease_seconds, iaaddr->data + 16 + 4);
+                                lease_seconds = ntohl(lease_seconds);
+                                /* paranoia: must not be too small and not prone to overflows */
+                                if (lease_seconds < 0x10)
+                                        lease_seconds = 0x10;
+/// TODO: check for 0 lease time?
+                                if (lease_seconds >= 0x10000000)
+                                        lease_seconds = 0x0fffffff;
+                                /* enter bound state */
+                                timeout = lease_seconds / 2;
+                                bb_info_msg("Lease obtained, lease time %u",
+                                        /*inet_ntoa(temp_addr),*/ (unsigned)lease_seconds);
+                                d6_run_script(&packet, state == REQUESTING ? "bound" : "renew");
+
+                                state = BOUND;
+                                change_listen_mode(LISTEN_NONE);
+                                if (opt & OPT_q) { /* quit after lease */
+                                        goto ret0;
+                                }
+                                /* future renew failures should not exit (JM) */
+                                opt &= ~OPT_n;
+#if BB_MMU /* NOMMU case backgrounded earlier */
+                                if (!(opt & OPT_f)) {
+                                        client_background();
+                                        /* do not background again! */
+                                        opt = ((opt & ~OPT_b) | OPT_f);
+                                }
+#endif
+                                already_waited_sec = 0;
+                                continue; /* back to main loop */
+                        }
+                        continue;
+                /* case BOUND: - ignore all packets */
+                /* case RELEASED: - ignore all packets */
+                }
+                /* back to main loop */
+        } /* for (;;) - main loop ends */
+
+ ret0:
+        if (opt & OPT_R) /* release on quit */
+                perform_d6_release(&srv6_buf, requested_ipv6);
+        retval = 0;
+ ret:
+        /*if (client_config.pidfile) - remove_pidfile has its own check */
+                remove_pidfile(client_config.pidfile);
+        return retval;
+}
diff --git a/networking/udhcp/d6_packet.c b/networking/udhcp/d6_packet.c
new file mode 100644
index 000000000..79b2946ef
--- /dev/null
+++ b/networking/udhcp/d6_packet.c
@@ -0,0 +1,172 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Copyright (C) 2011 Denys Vlasenko.
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+#include "common.h"
+#include "d6_common.h"
+#include "dhcpd.h"
+#include <netinet/in.h>
+#include <netinet/if_ether.h>
+#include <netpacket/packet.h>
+
+#if defined CONFIG_UDHCP_DEBUG && CONFIG_UDHCP_DEBUG >= 2
+void FAST_FUNC d6_dump_packet(struct d6_packet *packet)
+{
+        if (dhcp_verbose < 2)
+                return;
+
+        bb_info_msg(
+                " xid %x"
+                , packet->d6_xid32
+        );
+        //*bin2hex(buf, (void *) packet->chaddr, sizeof(packet->chaddr)) = '\0';
+        //bb_info_msg(" chaddr %s", buf);
+}
+#endif
+
+int FAST_FUNC d6_recv_kernel_packet(struct in6_addr *peer_ipv6
+        UNUSED_PARAM
+        , struct d6_packet *packet, int fd)
+{
+        int bytes;
+
+        memset(packet, 0, sizeof(*packet));
+        bytes = safe_read(fd, packet, sizeof(*packet));
+        if (bytes < 0) {
+                log1("Packet read error, ignoring");
+                return bytes; /* returns -1 */
+        }
+
+        if (bytes < offsetof(struct d6_packet, d6_options)) {
+                bb_info_msg("Packet with bad magic, ignoring");
+                return -2;
+        }
+        log1("Received a packet");
+        d6_dump_packet(packet);
+
+        return bytes;
+}
+
+/* Construct a ipv6+udp header for a packet, send packet */
+int FAST_FUNC d6_send_raw_packet(
+                struct d6_packet *d6_pkt, unsigned d6_pkt_size,
+                struct in6_addr *src_ipv6, int source_port,
+                struct in6_addr *dst_ipv6, int dest_port, const uint8_t *dest_arp,
+                int ifindex)
+{
+        struct sockaddr_ll dest_sll;
+        struct ip6_udp_d6_packet packet;
+        int fd;
+        int result = -1;
+        const char *msg;
+
+        fd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IPV6));
+        if (fd < 0) {
+                msg = "socket(%s)";
+                goto ret_msg;
+        }
+
+        memset(&dest_sll, 0, sizeof(dest_sll));
+        memset(&packet, 0, offsetof(struct ip6_udp_d6_packet, data));
+        packet.data = *d6_pkt; /* struct copy */
+
+        dest_sll.sll_family = AF_PACKET;
+        dest_sll.sll_protocol = htons(ETH_P_IPV6);
+        dest_sll.sll_ifindex = ifindex;
+        dest_sll.sll_halen = 6;
+        memcpy(dest_sll.sll_addr, dest_arp, 6);
+
+        if (bind(fd, (struct sockaddr *)&dest_sll, sizeof(dest_sll)) < 0) {
+                msg = "bind(%s)";
+                goto ret_close;
+        }
+
+        packet.ip6.ip6_vfc = (6 << 4); /* 4 bits version, top 4 bits of tclass */
+        if (src_ipv6)
+                packet.ip6.ip6_src = *src_ipv6; /* struct copy */
+        packet.ip6.ip6_dst = *dst_ipv6; /* struct copy */
+        packet.udp.source = htons(source_port);
+        packet.udp.dest = htons(dest_port);
+        /* size, excluding IP header: */
+        packet.udp.len = htons(sizeof(struct udphdr) + d6_pkt_size);
+        packet.ip6.ip6_plen = packet.udp.len;
+        /*
+         * Someone was smoking weed (at least) while inventing UDP checksumming:
+         * UDP checksum skips first four bytes of IPv6 header.
+         * 'next header' field should be summed as if it is one more byte
+         * to the right, therefore we write its value (IPPROTO_UDP)
+         * into ip6_hlim, and its 'real' location remains zero-filled for now.
+         */
+        packet.ip6.ip6_hlim = IPPROTO_UDP;
+        packet.udp.check = inet_cksum(
+                                (uint16_t *)&packet + 2,
+                                offsetof(struct ip6_udp_d6_packet, data) - 4 + d6_pkt_size
+        );
+        /* fix 'hop limit' and 'next header' after UDP checksumming */
+        packet.ip6.ip6_hlim = 1; /* observed Windows machines to use hlim=1 */
+        packet.ip6.ip6_nxt = IPPROTO_UDP;
+
+        d6_dump_packet(d6_pkt);
+        result = sendto(fd, &packet, offsetof(struct ip6_udp_d6_packet, data) + d6_pkt_size,
+                        /*flags:*/ 0,
+                        (struct sockaddr *) &dest_sll, sizeof(dest_sll)
+        );
+        msg = "sendto";
+ ret_close:
+        close(fd);
+        if (result < 0) {
+ ret_msg:
+                bb_perror_msg(msg, "PACKET");
+        }
+        return result;
+}
+
+/* Let the kernel do all the work for packet generation */
+int FAST_FUNC d6_send_kernel_packet(
+                struct d6_packet *d6_pkt, unsigned d6_pkt_size,
+                struct in6_addr *src_ipv6, int source_port,
+                struct in6_addr *dst_ipv6, int dest_port)
+{
+        struct sockaddr_in6 sa;
+        int fd;
+        int result = -1;
+        const char *msg;
+
+        fd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_UDP);
+        if (fd < 0) {
+                msg = "socket(%s)";
+                goto ret_msg;
+        }
+        setsockopt_reuseaddr(fd);
+
+        memset(&sa, 0, sizeof(sa));
+        sa.sin6_family = AF_INET6;
+        sa.sin6_port = htons(source_port);
+        sa.sin6_addr = *src_ipv6; /* struct copy */
+        if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) == -1) {
+                msg = "bind(%s)";
+                goto ret_close;
+        }
+
+        memset(&sa, 0, sizeof(sa));
+        sa.sin6_family = AF_INET6;
+        sa.sin6_port = htons(dest_port);
+        sa.sin6_addr = *dst_ipv6; /* struct copy */
+        if (connect(fd, (struct sockaddr *)&sa, sizeof(sa)) == -1) {
+                msg = "connect";
+                goto ret_close;
+        }
+
+        d6_dump_packet(d6_pkt);
+        result = safe_write(fd, d6_pkt, d6_pkt_size);
+        msg = "write";
+ ret_close:
+        close(fd);
+        if (result < 0) {
+ ret_msg:
+                bb_perror_msg(msg, "UDP");
+        }
+        return result;
+}
diff --git a/networking/udhcp/d6_socket.c b/networking/udhcp/d6_socket.c
new file mode 100644
index 000000000..56f69f6a1
--- /dev/null
+++ b/networking/udhcp/d6_socket.c
@@ -0,0 +1,34 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Copyright (C) 2011 Denys Vlasenko.
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+#include "common.h"
+#include "d6_common.h"
+#include <net/if.h>
+
+int FAST_FUNC d6_listen_socket(int port, const char *inf)
+{
+        int fd;
+        struct sockaddr_in6 addr;
+
+        log1("Opening listen socket on *:%d %s", port, inf);
+        fd = xsocket(PF_INET6, SOCK_DGRAM, IPPROTO_UDP);
+
+        setsockopt_reuseaddr(fd);
+        if (setsockopt_broadcast(fd) == -1)
+                bb_perror_msg_and_die("SO_BROADCAST");
+
+        /* NB: bug 1032 says this doesn't work on ethernet aliases (ethN:M) */
+        if (setsockopt_bindtodevice(fd, inf))
+                xfunc_die(); /* warning is already printed */
+
+        memset(&addr, 0, sizeof(addr));
+        addr.sin6_family = AF_INET6;
+        addr.sin6_port = htons(port);
+        /* addr.sin6_addr is all-zeros */
+        xbind(fd, (struct sockaddr *)&addr, sizeof(addr));
+
+        return fd;
+}
diff --git a/networking/udhcp/dhcpc.c b/networking/udhcp/dhcpc.c
index 3d4c397ff..2f2016cd5 100644
--- a/networking/udhcp/dhcpc.c
+++ b/networking/udhcp/dhcpc.c
@@ -29,7 +29,7 @@
 #include <netpacket/packet.h>
 #include <linux/filter.h>
 
-/* struct client_config_t client_config is in bb_common_bufsiz1 */
+/* "struct client_config_t client_config" is in bb_common_bufsiz1 */
 
 
 #if ENABLE_LONG_OPTS
@@ -46,7 +46,6 @@ static const char udhcpc_longopts[] ALIGN1 =
         "request\0"        Required_argument "r"
         "script\0"         Required_argument "s"
         "timeout\0"        Required_argument "T"
-        "version\0"        No_argument       "v"
         "retries\0"        Required_argument "t"
         "tryagain\0"       Required_argument "A"
         "syslog\0"         No_argument       "S"
@@ -124,24 +123,6 @@ static int sprint_nip(char *dest, const char *pre, const uint8_t *ip)
         return sprintf(dest, "%s%u.%u.%u.%u", pre, ip[0], ip[1], ip[2], ip[3]);
 }
 
-static int sprint_nip6(char *dest, /*const char *pre,*/ const uint8_t *ip)
-{
-        char hexstrbuf[16 * 2];
-        bin2hex(hexstrbuf, (void*)ip, 16);
-        return sprintf(dest, /* "%s" */
-                "%.4s:%.4s:%.4s:%.4s:%.4s:%.4s:%.4s:%.4s",
-                /* pre, */
-                hexstrbuf + 0 * 4,
-                hexstrbuf + 1 * 4,
-                hexstrbuf + 2 * 4,
-                hexstrbuf + 3 * 4,
-                hexstrbuf + 4 * 4,
-                hexstrbuf + 5 * 4,
-                hexstrbuf + 6 * 4,
-                hexstrbuf + 7 * 4
-        );
-}
-
 /* really simple implementation, just count the bits */
 static int mton(uint32_t mask)
 {
@@ -154,6 +135,63 @@ static int mton(uint32_t mask)
         return i;
 }
 
+/* Check if a given label represents a valid DNS label
+ * Return pointer to the first character after the label upon success,
+ * NULL otherwise.
+ * See RFC1035, 2.3.1
+ */
+/* We don't need to be particularly anal. For example, allowing _, hyphen
+ * at the end, or leading and trailing dots would be ok, since it
+ * can't be used for attacks. (Leading hyphen can be, if someone uses
+ * cmd "$hostname"
+ * in the script: then hostname may be treated as an option)
+ */
+static const char *valid_domain_label(const char *label)
+{
+        unsigned char ch;
+        unsigned pos = 0;
+
+        for (;;) {
+                ch = *label;
+                if ((ch|0x20) < 'a' || (ch|0x20) > 'z') {
+                        if (pos == 0) {
+                                /* label must begin with letter */
+                                return NULL;
+                        }
+                        if (ch < '0' || ch > '9') {
+                                if (ch == '\0' || ch == '.')
+                                        return label;
+                                /* DNS allows only '-', but we are more permissive */
+                                if (ch != '-' && ch != '_')
+                                        return NULL;
+                        }
+                }
+                label++;
+                pos++;
+                //Do we want this?
+                //if (pos > 63) /* NS_MAXLABEL; labels must be 63 chars or less */
+                //      return NULL;
+        }
+}
+
+/* Check if a given name represents a valid DNS name */
+/* See RFC1035, 2.3.1 */
+static int good_hostname(const char *name)
+{
+        //const char *start = name;
+
+        for (;;) {
+                name = valid_domain_label(name);
+                if (!name)
+                        return 0;
+                if (!name[0])
+                        return 1;
+                        //Do we want this?
+                        //return ((name - start) < 1025); /* NS_MAXDNAME */
+                name++;
+        }
+}
+
 /* Create "opt_name=opt_value" string */
 static NOINLINE char *xmalloc_optname_optval(uint8_t *option, const struct dhcp_optflag *optflag, const char *opt_name)
 {
@@ -206,8 +244,11 @@ static NOINLINE char *xmalloc_optname_optval(uint8_t *option, const struct dhcp_
                  * the case of list of options.
                  */
                 case OPTION_STRING:
+                case OPTION_STRING_HOST:
                         memcpy(dest, option, len);
                         dest[len] = '\0';
+                        if (type == OPTION_STRING_HOST && !good_hostname(dest))
+                                safe_strncpy(dest, "bad", len);
                         return ret;
                 case OPTION_STATIC_ROUTES: {
                         /* Option binary format:
@@ -387,6 +428,7 @@ static char **fill_envp(struct dhcp_packet *packet)
         /* +1 element for each option, +2 for subnet option: */
         if (packet) {
                 /* note: do not search for "pad" (0) and "end" (255) options */
+//TODO: change logic to scan packet _once_
                 for (i = 1; i < 255; i++) {
                         temp = udhcp_get_option(packet, i);
                         if (temp) {
@@ -499,9 +541,6 @@ static void udhcp_run_script(struct dhcp_packet *packet, const char *name)
         char **envp, **curr;
         char *argv[3];
 
-        if (client_config.script == NULL)
-                return;
-
         envp = fill_envp(packet);
 
         /* call script */
@@ -598,6 +637,12 @@ static void add_client_options(struct dhcp_packet *packet)
 //              if (client_config.boot_file)
 //                      strncpy((char*)packet->file, client_config.boot_file, sizeof(packet->file) - 1);
         }
+
+        // This will be needed if we remove -V VENDOR_STR in favor of
+        // -x vendor:VENDOR_STR
+        //if (!udhcp_find_option(packet.options, DHCP_VENDOR))
+        //      /* not set, set the default vendor ID */
+        //      ...add (DHCP_VENDOR, "udhcp "BB_VER) opt...
 }
 
 /* RFC 2131
@@ -742,7 +787,7 @@ static NOINLINE int send_renew(uint32_t xid, uint32_t server, uint32_t ciaddr)
 #if ENABLE_FEATURE_UDHCPC_ARPING
 /* Broadcast a DHCP decline message */
 /* NOINLINE: limit stack usage in caller */
-static NOINLINE int send_decline(uint32_t xid, uint32_t server, uint32_t requested)
+static NOINLINE int send_decline(/*uint32_t xid,*/ uint32_t server, uint32_t requested)
 {
         struct dhcp_packet packet;
 
@@ -751,12 +796,14 @@ static NOINLINE int send_decline(uint32_t xid, uint32_t server, uint32_t request
          */
         init_packet(&packet, DHCPDECLINE);
 
+#if 0
         /* RFC 2131 says DHCPDECLINE's xid is randomly selected by client,
          * but in case the server is buggy and wants DHCPDECLINE's xid
          * to match the xid which started entire handshake,
          * we use the same xid we used in initial DHCPDISCOVER:
          */
         packet.xid = xid;
+#endif
         /* DHCPDECLINE uses "requested ip", not ciaddr, to store offered IP */
         udhcp_add_simple_option(&packet, DHCP_REQUESTED_IP, requested);
 
@@ -794,7 +841,6 @@ static NOINLINE int udhcp_recv_raw_packet(struct dhcp_packet *dhcp_pkt, int fd)
         struct ip_udp_dhcp_packet packet;
         uint16_t check;
 
-        memset(&packet, 0, sizeof(packet));
         bytes = safe_read(fd, &packet, sizeof(packet));
         if (bytes < 0) {
                 log1("Packet read error, ignoring");
@@ -852,7 +898,7 @@ static NOINLINE int udhcp_recv_raw_packet(struct dhcp_packet *dhcp_pkt, int fd)
                 return -2;
         }
 
-        log1("Got valid DHCP packet");
+        log1("Received a packet");
         udhcp_dump_packet(&packet.data);
 
         bytes -= sizeof(packet.ip) + sizeof(packet.udp);
@@ -1004,7 +1050,7 @@ static void perform_renew(void)
         }
 }
 
-static void perform_release(uint32_t requested_ip, uint32_t server_addr)
+static void perform_release(uint32_t server_addr, uint32_t requested_ip)
 {
         char buffer[sizeof("255.255.255.255")];
         struct in_addr temp_addr;
@@ -1053,7 +1099,7 @@ static void client_background(void)
 //usage:#endif
 //usage:#define udhcpc_trivial_usage
 //usage:       "[-fbnq"IF_UDHCP_VERBOSE("v")"oCRB] [-i IFACE] [-r IP] [-s PROG] [-p PIDFILE]\n"
-//usage:       "        [-H HOSTNAME] [-V VENDOR] [-x OPT:VAL]... [-O OPT]..." IF_FEATURE_UDHCP_PORT(" [-P N]")
+//usage:       "        [-V VENDOR] [-x OPT:VAL]... [-O OPT]..." IF_FEATURE_UDHCP_PORT(" [-P N]")
 //usage:#define udhcpc_full_usage "\n"
 //usage:        IF_LONG_OPTS(
 //usage:     "\n        -i,--interface IFACE    Interface to use (default eth0)"
@@ -1086,7 +1132,6 @@ static void client_background(void)
 //usage:     "\n                                -x lease:3600 - option 51 (lease time)"
 //usage:     "\n                                -x 0x3d:0100BEEFC0FFEE - option 61 (client id)"
 //usage:     "\n        -F,--fqdn NAME          Ask server to update DNS mapping for NAME"
-//usage:     "\n        -H,-h,--hostname NAME   Send NAME as client hostname (default none)"
 //usage:     "\n        -V,--vendorclass VENDOR Vendor identifier (default 'udhcp VERSION')"
 //usage:     "\n        -C,--clientid-none      Don't send MAC as client identifier"
 //usage:        IF_UDHCP_VERBOSE(
@@ -1124,7 +1169,6 @@ static void client_background(void)
 //usage:     "\n                        -x lease:3600 - option 51 (lease time)"
 //usage:     "\n                        -x 0x3d:0100BEEFC0FFEE - option 61 (client id)"
 //usage:     "\n        -F NAME         Ask server to update DNS mapping for NAME"
-//usage:     "\n        -H,-h NAME      Send NAME as client hostname (default none)"
 //usage:     "\n        -V VENDOR       Vendor identifier (default 'udhcp VERSION')"
 //usage:     "\n        -C              Don't send MAC as client identifier"
 //usage:        IF_UDHCP_VERBOSE(
@@ -1132,8 +1176,8 @@ static void client_background(void)
 //usage:        )
 //usage:        )
 //usage:     "\nSignals:"
-//usage:     "\n        USR1    Renew current lease"
-//usage:     "\n        USR2    Release current lease"
+//usage:     "\n        USR1    Renew lease"
+//usage:     "\n        USR2    Release lease"
 
 
 int udhcpc_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
@@ -1150,16 +1194,13 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
         int discover_retries = 3;
         uint32_t server_addr = server_addr; /* for compiler */
         uint32_t requested_ip = 0;
-        uint32_t xid = 0;
-        uint32_t lease_seconds = 0; /* can be given as 32-bit quantity */
+        uint32_t xid = xid; /* for compiler */
         int packet_num;
         int timeout; /* must be signed */
         unsigned already_waited_sec;
         unsigned opt;
         int max_fd;
         int retval;
-        struct timeval tv;
-        struct dhcp_packet packet;
         fd_set rfds;
 
         /* Default options */
@@ -1186,9 +1227,12 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
                 , &list_x
                 IF_FEATURE_UDHCP_PORT(, &str_P)
                 IF_UDHCP_VERBOSE(, &dhcp_verbose)
-                );
-        if (opt & (OPT_h|OPT_H))
+        );
+        if (opt & (OPT_h|OPT_H)) {
+                //msg added 2011-11
+                bb_error_msg("option -h NAME is deprecated, use -x hostname:NAME");
                 client_config.hostname = alloc_dhcp_option(DHCP_HOST_NAME, str_h, 0);
+        }
         if (opt & OPT_F) {
                 /* FQDN option format: [0x51][len][flags][0][0]<fqdn> */
                 client_config.fqdn = alloc_dhcp_option(DHCP_FQDN, str_F, 3);
@@ -1249,8 +1293,16 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
                 clientid_mac_ptr = client_config.clientid + OPT_DATA+1;
                 memcpy(clientid_mac_ptr, client_config.client_mac, 6);
         }
-        if (str_V[0] != '\0')
+        if (str_V[0] != '\0') {
+                // can drop -V, str_V, client_config.vendorclass,
+                // but need to add "vendor" to the list of recognized
+                // string opts for this to work;
+                // and need to tweak add_client_options() too...
+                // ...so the question is, should we?
+                //bb_error_msg("option -V VENDOR is deprecated, use -x vendor:VENDOR");
                 client_config.vendorclass = alloc_dhcp_option(DHCP_VENDOR, str_V, 0);
+        }
+
 #if !BB_MMU
         /* on NOMMU reexec (i.e., background) early */
         if (!(opt & OPT_f)) {
@@ -1288,6 +1340,8 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
          * "continue" statements in code below jump to the top of the loop.
          */
         for (;;) {
+                struct timeval tv;
+                struct dhcp_packet packet;
                 /* silence "uninitialized!" warning */
                 unsigned timestamp_before_wait = timestamp_before_wait;
 
@@ -1335,7 +1389,7 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
                                         NULL,
                                         client_config.client_mac)
                         ) {
-                                return 1; /* iface is gone? */
+                                goto ret0; /* iface is gone? */
                         }
                         if (clientid_mac_ptr)
                                 memcpy(clientid_mac_ptr, client_config.client_mac, 6);
@@ -1472,13 +1526,11 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
                         timeout = 0;
                         continue;
                 case SIGUSR2:
-                        perform_release(requested_ip, server_addr);
+                        perform_release(server_addr, requested_ip);
                         timeout = INT_MAX;
                         continue;
                 case SIGTERM:
                         bb_info_msg("Received SIGTERM");
-                        if (opt & OPT_R) /* release on quit */
-                                perform_release(requested_ip, server_addr);
                         goto ret0;
                 }
 
@@ -1531,7 +1583,7 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
 
                 switch (state) {
                 case INIT_SELECTING:
-                        /* Must be a DHCPOFFER to one of our xid's */
+                        /* Must be a DHCPOFFER */
                         if (*message == DHCPOFFER) {
 /* What exactly is server's IP? There are several values.
  * Example DHCP offer captured with tchdump:
@@ -1575,6 +1627,9 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
                 case RENEW_REQUESTED:
                 case REBINDING:
                         if (*message == DHCPACK) {
+                                uint32_t lease_seconds;
+                                struct in_addr temp_addr;
+
                                 temp = udhcp_get_option(&packet, DHCP_LEASE_TIME);
                                 if (!temp) {
                                         bb_error_msg("no lease time with ACK, using 1 hour lease");
@@ -1583,9 +1638,11 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
                                         /* it IS unaligned sometimes, don't "optimize" */
                                         move_from_unaligned32(lease_seconds, temp);
                                         lease_seconds = ntohl(lease_seconds);
-                                        lease_seconds &= 0x0fffffff; /* paranoia: must not be prone to overflows */
-                                        if (lease_seconds < 10) /* and not too small */
-                                                lease_seconds = 10;
+                                        /* paranoia: must not be too small and not prone to overflows */
+                                        if (lease_seconds < 0x10)
+                                                lease_seconds = 0x10;
+                                        if (lease_seconds >= 0x10000000)
+                                                lease_seconds = 0x0fffffff;
                                 }
 #if ENABLE_FEATURE_UDHCPC_ARPING
                                 if (opt & OPT_a) {
@@ -1606,7 +1663,7 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
                                         ) {
                                                 bb_info_msg("Offered address is in use "
                                                         "(got ARP reply), declining");
-                                                send_decline(xid, server_addr, packet.yiaddr);
+                                                send_decline(/*xid,*/ server_addr, packet.yiaddr);
 
                                                 if (state != REQUESTING)
                                                         udhcp_run_script(NULL, "deconfig");
@@ -1623,20 +1680,15 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
 #endif
                                 /* enter bound state */
                                 timeout = lease_seconds / 2;
-                                {
-                                        struct in_addr temp_addr;
-                                        temp_addr.s_addr = packet.yiaddr;
-                                        bb_info_msg("Lease of %s obtained, lease time %u",
-                                                inet_ntoa(temp_addr), (unsigned)lease_seconds);
-                                }
+                                temp_addr.s_addr = packet.yiaddr;
+                                bb_info_msg("Lease of %s obtained, lease time %u",
+                                        inet_ntoa(temp_addr), (unsigned)lease_seconds);
                                 requested_ip = packet.yiaddr;
                                 udhcp_run_script(&packet, state == REQUESTING ? "bound" : "renew");
 
                                 state = BOUND;
                                 change_listen_mode(LISTEN_NONE);
                                 if (opt & OPT_q) { /* quit after lease */
-                                        if (opt & OPT_R) /* release on quit */
-                                                perform_release(requested_ip, server_addr);
                                         goto ret0;
                                 }
                                 /* future renew failures should not exit (JM) */
@@ -1648,6 +1700,8 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
                                         opt = ((opt & ~OPT_b) | OPT_f);
                                 }
 #endif
+                                /* make future renew packets use different xid */
+                                /* xid = random_xid(); ...but why bother? */
                                 already_waited_sec = 0;
                                 continue; /* back to main loop */
                         }
@@ -1674,6 +1728,8 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
         } /* for (;;) - main loop ends */
 
  ret0:
+        if (opt & OPT_R) /* release on quit */
+                perform_release(server_addr, requested_ip);
         retval = 0;
  ret:
         /*if (client_config.pidfile) - remove_pidfile has its own check */
diff --git a/networking/udhcp/packet.c b/networking/udhcp/packet.c
index 4d5ff0676..33c9585cf 100644
--- a/networking/udhcp/packet.c
+++ b/networking/udhcp/packet.c
@@ -81,7 +81,6 @@ void FAST_FUNC udhcp_dump_packet(struct dhcp_packet *packet)
 int FAST_FUNC udhcp_recv_kernel_packet(struct dhcp_packet *packet, int fd)
 {
         int bytes;
-        unsigned char *vendor;
 
         memset(packet, 0, sizeof(*packet));
         bytes = safe_read(fd, packet, sizeof(*packet));
@@ -90,42 +89,15 @@ int FAST_FUNC udhcp_recv_kernel_packet(struct dhcp_packet *packet, int fd)
                 return bytes; /* returns -1 */
         }
 
-        if (packet->cookie != htonl(DHCP_MAGIC)) {
+        if (bytes < offsetof(struct dhcp_packet, options)
+         || packet->cookie != htonl(DHCP_MAGIC)
+        ) {
                 bb_info_msg("Packet with bad magic, ignoring");
                 return -2;
         }
         log1("Received a packet");
         udhcp_dump_packet(packet);
 
-        if (packet->op == BOOTREQUEST) {
-                vendor = udhcp_get_option(packet, DHCP_VENDOR);
-                if (vendor) {
-#if 0
-                        static const char broken_vendors[][8] = {
-                                "MSFT 98",
-                                ""
-                        };
-                        int i;
-                        for (i = 0; broken_vendors[i][0]; i++) {
-                                if (vendor[OPT_LEN - OPT_DATA] == (uint8_t)strlen(broken_vendors[i])
-                                 && strncmp((char*)vendor, broken_vendors[i], vendor[OPT_LEN - OPT_DATA]) == 0
-                                ) {
-                                        log1("Broken client (%s), forcing broadcast replies",
-                                                broken_vendors[i]);
-                                        packet->flags |= htons(BROADCAST_FLAG);
-                                }
-                        }
-#else
-                        if (vendor[OPT_LEN - OPT_DATA] == (uint8_t)(sizeof("MSFT 98")-1)
-                         && memcmp(vendor, "MSFT 98", sizeof("MSFT 98")-1) == 0
-                        ) {
-                                log1("Broken client (%s), forcing broadcast replies", "MSFT 98");
-                                packet->flags |= htons(BROADCAST_FLAG);
-                        }
-#endif
-                }
-        }
-
         return bytes;
 }
 
@@ -210,7 +182,7 @@ int FAST_FUNC udhcp_send_kernel_packet(struct dhcp_packet *dhcp_pkt,
                 uint32_t source_nip, int source_port,
                 uint32_t dest_nip, int dest_port)
 {
-        struct sockaddr_in client;
+        struct sockaddr_in sa;
         unsigned padding;
         int fd;
         int result = -1;
@@ -223,26 +195,25 @@ int FAST_FUNC udhcp_send_kernel_packet(struct dhcp_packet *dhcp_pkt,
         }
         setsockopt_reuseaddr(fd);
 
-        memset(&client, 0, sizeof(client));
-        client.sin_family = AF_INET;
-        client.sin_port = htons(source_port);
-        client.sin_addr.s_addr = source_nip;
-        if (bind(fd, (struct sockaddr *)&client, sizeof(client)) == -1) {
+        memset(&sa, 0, sizeof(sa));
+        sa.sin_family = AF_INET;
+        sa.sin_port = htons(source_port);
+        sa.sin_addr.s_addr = source_nip;
+        if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) == -1) {
                 msg = "bind(%s)";
                 goto ret_close;
         }
 
-        memset(&client, 0, sizeof(client));
-        client.sin_family = AF_INET;
-        client.sin_port = htons(dest_port);
-        client.sin_addr.s_addr = dest_nip;
-        if (connect(fd, (struct sockaddr *)&client, sizeof(client)) == -1) {
+        memset(&sa, 0, sizeof(sa));
+        sa.sin_family = AF_INET;
+        sa.sin_port = htons(dest_port);
+        sa.sin_addr.s_addr = dest_nip;
+        if (connect(fd, (struct sockaddr *)&sa, sizeof(sa)) == -1) {
                 msg = "connect";
                 goto ret_close;
         }
 
         udhcp_dump_packet(dhcp_pkt);
-
         padding = DHCP_OPTIONS_BUFSIZE - 1 - udhcp_end_option(dhcp_pkt->options);
         result = safe_write(fd, dhcp_pkt, DHCP_SIZE - padding);
         msg = "write";
diff --git a/networking/vconfig.c b/networking/vconfig.c
index 48b45d9af..924b2f009 100644
--- a/networking/vconfig.c
+++ b/networking/vconfig.c
@@ -13,12 +13,12 @@
 //usage:       "COMMAND [OPTIONS]"
 //usage:#define vconfig_full_usage "\n\n"
 //usage:       "Create and remove virtual ethernet devices\n"
-//usage:     "\n        add             [interface-name] [vlan_id]"
-//usage:     "\n        rem             [vlan-name]"
-//usage:     "\n        set_flag        [interface-name] [flag-num] [0 | 1]"
-//usage:     "\n        set_egress_map  [vlan-name] [skb_priority] [vlan_qos]"
-//usage:     "\n        set_ingress_map [vlan-name] [skb_priority] [vlan_qos]"
-//usage:     "\n        set_name_type   [name-type]"
+//usage:     "\n        add             IFACE VLAN_ID"
+//usage:     "\n        rem             VLAN_NAME"
+//usage:     "\n        set_flag        IFACE 0|1 VLAN_QOS"
+//usage:     "\n        set_egress_map  VLAN_NAME SKB_PRIO VLAN_QOS"
+//usage:     "\n        set_ingress_map VLAN_NAME SKB_PRIO VLAN_QOS"
+//usage:     "\n        set_name_type   NAME_TYPE"
 
 #include "libbb.h"
 #include <net/if.h>
@@ -66,58 +66,40 @@ struct vlan_ioctl_args {
  * The return value is the last data entry for the matching string. */
 static const char *xfind_str(const char *table, const char *str)
 {
-        while (strcasecmp(str, table+1) != 0) {
-                table += table[0];
-                if (!*table) {
+        while (strcasecmp(str, table + 1) != 0) {
+                if (!table[0])
                         bb_show_usage();
-                }
+                table += table[0];
         }
         return table - 1;
 }
 
 static const char cmds[] ALIGN1 = {
         4, ADD_VLAN_CMD, 7,
-        'a', 'd', 'd', 0,
+        'a','d','d',0,
         3, DEL_VLAN_CMD, 7,
-        'r', 'e', 'm', 0,
+        'r','e','m',0,
         3, SET_VLAN_NAME_TYPE_CMD, 17,
-        's', 'e', 't', '_',
-        'n', 'a', 'm', 'e', '_',
-        't', 'y', 'p', 'e', 0,
+        's','e','t','_','n','a','m','e','_','t','y','p','e',0,
         5, SET_VLAN_FLAG_CMD, 12,
-        's', 'e', 't', '_',
-        'f', 'l', 'a', 'g', 0,
+        's','e','t','_','f','l','a','g',0,
         5, SET_VLAN_EGRESS_PRIORITY_CMD, 18,
-        's', 'e', 't', '_',
-        'e', 'g', 'r', 'e', 's', 's', '_',
-        'm', 'a', 'p', 0,
-        5, SET_VLAN_INGRESS_PRIORITY_CMD, 16,
-        's', 'e', 't', '_',
-        'i', 'n', 'g', 'r', 'e', 's', 's', '_',
-        'm', 'a', 'p', 0,
+        's','e','t','_','e','g','r','e','s','s','_','m','a','p',0,
+        5, SET_VLAN_INGRESS_PRIORITY_CMD, 0,
+        's','e','t','_','i','n','g','r','e','s','s','_','m','a','p',0,
 };
 
 static const char name_types[] ALIGN1 = {
         VLAN_NAME_TYPE_PLUS_VID, 16,
-        'V', 'L', 'A', 'N',
-        '_', 'P', 'L', 'U', 'S', '_', 'V', 'I', 'D',
-        0,
+        'V','L','A','N','_','P','L','U','S','_','V','I','D',0,
         VLAN_NAME_TYPE_PLUS_VID_NO_PAD, 22,
-        'V', 'L', 'A', 'N',
-        '_', 'P', 'L', 'U', 'S', '_', 'V', 'I', 'D',
-        '_', 'N', 'O', '_', 'P', 'A', 'D', 0,
+        'V','L','A','N','_','P','L','U','S','_','V','I','D','_','N','O','_','P','A','D',0,
         VLAN_NAME_TYPE_RAW_PLUS_VID, 15,
-        'D', 'E', 'V',
-        '_', 'P', 'L', 'U', 'S', '_', 'V', 'I', 'D',
-        0,
-        VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD, 20,
-        'D', 'E', 'V',
-        '_', 'P', 'L', 'U', 'S', '_', 'V', 'I', 'D',
-        '_', 'N', 'O', '_', 'P', 'A', 'D', 0,
+        'D','E','V','_','P','L','U','S','_','V','I','D',0,
+        VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD, 0,
+        'D','E','V','_','P','L','U','S','_','V','I','D','_','N','O','_','P','A','D',0,
 };
 
-static const char conf_file_name[] ALIGN1 = "/proc/net/vlan/config";
-
 int vconfig_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int vconfig_main(int argc, char **argv)
 {
@@ -125,25 +107,19 @@ int vconfig_main(int argc, char **argv)
         const char *p;
         int fd;
 
-        if (argc < 3) {
-                bb_show_usage();
-        }
-
-        /* Don't bother closing the filedes.  It will be closed on cleanup. */
-        /* Will die if 802.1q is not present */
-        xopen(conf_file_name, O_RDONLY);
-
         memset(&ifr, 0, sizeof(ifr));
 
         ++argv;
-        p = xfind_str(cmds+2, *argv);
+        if (!argv[0])
+                bb_show_usage();
+        p = xfind_str(cmds + 2, argv[0]);
         ifr.cmd = *p;
-        if (argc != p[-1]) {
+        if (argc != p[-1])
                 bb_show_usage();
-        }
 
-        if (ifr.cmd == SET_VLAN_NAME_TYPE_CMD) { /* set_name_type */
-                ifr.u.name_type = *xfind_str(name_types+1, argv[1]);
+        if (ifr.cmd == SET_VLAN_NAME_TYPE_CMD) {
+                /* set_name_type */
+                ifr.u.name_type = *xfind_str(name_types + 1, argv[1]);
         } else {
                 strncpy_IFNAMSIZ(ifr.device1, argv[1]);
                 p = argv[2];
@@ -152,22 +128,26 @@ int vconfig_main(int argc, char **argv)
                  * since ifr.u.flag, ifr.u.VID, and ifr.u.skb_priority are all same-sized
                  * (unsigned) int members of a unions.  But because of the range checking,
                  * doing so wouldn't save that much space and would also make maintainence
-                 * more of a pain. */
-                if (ifr.cmd == SET_VLAN_FLAG_CMD) { /* set_flag */
-                        ifr.u.flag = xatoul_range(p, 0, 1);
+                 * more of a pain.
+                 */
+                if (ifr.cmd == SET_VLAN_FLAG_CMD) {
+                        /* set_flag */
+                        ifr.u.flag = xatou_range(p, 0, 1);
                         /* DM: in order to set reorder header, qos must be set */
-                        ifr.vlan_qos = xatoul_range(argv[3], 0, 7);
-                } else if (ifr.cmd == ADD_VLAN_CMD) { /* add */
-                        ifr.u.VID = xatoul_range(p, 0, VLAN_GROUP_ARRAY_LEN-1);
-                } else if (ifr.cmd != DEL_VLAN_CMD) { /* set_{egress|ingress}_map */
+                        ifr.vlan_qos = xatou_range(argv[3], 0, 7);
+                } else if (ifr.cmd == ADD_VLAN_CMD) {
+                        /* add */
+                        ifr.u.VID = xatou_range(p, 0, VLAN_GROUP_ARRAY_LEN - 1);
+                } else if (ifr.cmd != DEL_VLAN_CMD) {
+                        /* set_{egress|ingress}_map */
                         ifr.u.skb_priority = xatou(p);
-                        ifr.vlan_qos = xatoul_range(argv[3], 0, 7);
+                        ifr.vlan_qos = xatou_range(argv[3], 0, 7);
                 }
         }
 
         fd = xsocket(AF_INET, SOCK_STREAM, 0);
         ioctl_or_perror_and_die(fd, SIOCSIFVLAN, &ifr,
-                                                "ioctl error for %s", *argv);
+                                                "ioctl error for %s", argv[0]);
 
         return 0;
 }
diff --git a/networking/wget.c b/networking/wget.c
index 4dd42de9d..ea46d1795 100644
--- a/networking/wget.c
+++ b/networking/wget.c
@@ -557,6 +557,7 @@ static void download_one_url(const char *url)
         FILE *dfp;                      /* socket to ftp server (data)      */
         char *proxy = NULL;
         char *fname_out_alloc;
+        char *redirected_path = NULL;
         struct host_info server;
         struct host_info target;
 
@@ -793,8 +794,8 @@ However, in real world it was observed that some web servers
                                         bb_error_msg_and_die("too many redirections");
                                 fclose(sfp);
                                 if (str[0] == '/') {
-                                        free(target.allocated);
-                                        target.path = target.allocated = xstrdup(str+1);
+                                        free(redirected_path);
+                                        target.path = redirected_path = xstrdup(str+1);
                                         /* lsa stays the same: it's on the same server */
                                 } else {
                                         parse_url(str, &target);
@@ -849,6 +850,7 @@ However, in real world it was observed that some web servers
         free(server.allocated);
         free(target.allocated);
         free(fname_out_alloc);
+        free(redirected_path);
 }
 
 int wget_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;