From: Ted Lemon <source@isc.org>
Date: Thu, 27 Jul 2000 09:03:08 +0000 (+0000)
Subject: Reference count binding scopes.   Align IP headers on output.
X-Git-Tag: V3-BETA-2-PATCH-1~64
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6ceb9118e9b730eb4aebf3bfe9e5bb2c3daa091e;p=thirdparty%2Fdhcp.git

Reference count binding scopes.   Align IP headers on output.
---

diff --git a/client/dhclient.c b/client/dhclient.c
index b19598832..2af3e9679 100644
--- a/client/dhclient.c
+++ b/client/dhclient.c
@@ -41,7 +41,7 @@
 
 #ifndef lint
 static char ocopyright[] =
-"$Id: dhclient.c,v 1.109 2000/07/20 03:21:23 mellon Exp $ Copyright (c) 1995, 1996, 1997, 1998, 1999 Internet Software Consortium.  All rights reserved.\n";
+"$Id: dhclient.c,v 1.110 2000/07/27 09:02:23 mellon Exp $ Copyright (c) 1995, 1996, 1997, 1998, 1999 Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -65,8 +65,6 @@ struct in_addr inaddr_any;
 struct sockaddr_in sockaddr_broadcast;
 struct in_addr giaddr;
 
-struct binding_scope global_scope;
-
 /* ASSERT_STATE() does nothing now; it used to be
    assert (state_is == state_shouldbe). */
 #define ASSERT_STATE(state_is, state_shouldbe) {}
@@ -74,8 +72,7 @@ struct binding_scope global_scope;
 static char copyright[] = "Copyright 1995-2000 Internet Software Consortium.";
 static char arr [] = "All rights reserved.";
 static char message [] = "Internet Software Consortium DHCP Client";
-static char contrib [] = "\nPlease contribute if you find this software useful.";
-static char url [] = "For info, please visit http://www.isc.org/dhcp-contrib.html\n";
+static char url [] = "For info, please visit http://www.isc.org/dhcp-contrib.html";
 
 u_int16_t local_port;
 u_int16_t remote_port;
@@ -229,7 +226,6 @@ int main (argc, argv, envp)
 		log_info ("%s %s", message, DHCP_VERSION);
 		log_info (copyright);
 		log_info (arr);
-		log_info (contrib);
 		log_info (url);
 	} else
 		log_perror = 0;
@@ -661,7 +657,7 @@ void dhcpack (packet)
 
 	log_info ("DHCPACK from %s", piaddr (packet -> client_addr));
 
-	lease = packet_to_lease (packet);
+	lease = packet_to_lease (packet, client);
 	if (!lease) {
 		log_info ("packet_to_lease failed.");
 		return;
@@ -1010,7 +1006,7 @@ void dhcpoffer (packet)
 		}
 	}
 
-	lease = packet_to_lease (packet);
+	lease = packet_to_lease (packet, client);
 	if (!lease) {
 		log_info ("packet_to_lease failed.");
 		return;
@@ -1063,8 +1059,9 @@ void dhcpoffer (packet)
 /* Allocate a client_lease structure and initialize it from the parameters
    in the specified packet. */
 
-struct client_lease *packet_to_lease (packet)
+struct client_lease *packet_to_lease (packet, client)
 	struct packet *packet;
+	struct client_state *client;
 {
 	struct client_lease *lease;
 	int i;
@@ -2370,7 +2367,7 @@ void client_envadd (struct client_state *client,
 
 int dhcp_option_ev_name (buf, buflen, option)
 	char *buf;
-	unsigned buflen;
+	size_t buflen;
 	struct option *option;
 {
 	int i;
diff --git a/common/alloc.c b/common/alloc.c
index 3cb1e87bb..d90a974ad 100644
--- a/common/alloc.c
+++ b/common/alloc.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: alloc.c,v 1.48 2000/06/24 06:16:28 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: alloc.c,v 1.49 2000/07/27 09:02:28 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -1257,7 +1257,36 @@ int binding_scope_allocate (ptr, file, line)
 	if (!bp)
 		return 0;
 	memset (bp, 0, sizeof *bp);
+	binding_scope_reference (ptr, bp, file, line);
+	return 1;
+}
+
+int binding_scope_reference (ptr, bp, file, line)
+	struct binding_scope **ptr;
+	struct binding_scope *bp;
+	const char *file;
+	int line;
+{
+	if (!ptr) {
+		log_error ("%s(%d): null pointer", file, line);
+#if defined (POINTER_DEBUG)
+		abort ();
+#else
+		return 0;
+#endif
+	}
+	if (*ptr) {
+		log_error ("%s(%d): non-null pointer", file, line);
+#if defined (POINTER_DEBUG)
+		abort ();
+#else
+		*ptr = (struct binding_scope *)0;
+#endif
+	}
 	*ptr = bp;
+	bp -> refcnt++;
+	rc_register (file, line, ptr, bp, bp -> refcnt);
+	dmalloc_reuse (bp, file, line, 1);
 	return 1;
 }
 
diff --git a/common/bpf.c b/common/bpf.c
index a16c2e269..f55d7754f 100644
--- a/common/bpf.c
+++ b/common/bpf.c
@@ -47,7 +47,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: bpf.c,v 1.40 2000/06/08 21:14:10 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: bpf.c,v 1.41 2000/07/27 09:02:29 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -359,28 +359,33 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	struct sockaddr_in *to;
 	struct hardware *hto;
 {
-	unsigned bufp = 0;
-	unsigned char buf [256];
-	struct iovec iov [2];
+	unsigned hbufp = 0, ibufp = 0;
+	double hw [4];
+	double ip [32];
+	struct iovec iov [3];
 	int result;
+	int fudge;
 
 	if (!strcmp (interface -> name, "fallback"))
 		return send_fallback (interface, packet, raw,
 				      len, from, to, hto);
 
 	/* Assemble the headers... */
-	assemble_hw_header (interface, buf, &bufp, hto);
-	assemble_udp_ip_header (interface, buf, &bufp, from.s_addr,
+	assemble_hw_header (interface, (unsigned char *)hw, &hbufp, hto);
+	assemble_udp_ip_header (interface,
+				(unsigned char *)ip, &ibufp, from.s_addr,
 				to -> sin_addr.s_addr, to -> sin_port,
 				(unsigned char *)raw, len);
 
 	/* Fire it off */
-	iov [0].iov_base = (char *)buf;
-	iov [0].iov_len = bufp;
-	iov [1].iov_base = (char *)raw;
-	iov [1].iov_len = len;
-
-	result = writev(interface -> wfdesc, iov, 2);
+	iov [0].iov_base = ((char *)hw);
+	iov [0].iov_len = hbufp;
+	iov [1].iov_base = ((char *)ip);
+	iov [1].iov_len = ibufp;
+	iov [2].iov_base = (char *)raw;
+	iov [2].iov_len = len;
+
+	result = writev(interface -> wfdesc, iov, 3);
 	if (result < 0)
 		log_error ("send_packet: %m");
 	return result;
diff --git a/common/dlpi.c b/common/dlpi.c
index 3052ad871..90a62ebda 100644
--- a/common/dlpi.c
+++ b/common/dlpi.c
@@ -84,7 +84,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: dlpi.c,v 1.21 2000/06/08 21:14:13 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: dlpi.c,v 1.22 2000/07/27 09:02:31 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -508,13 +508,17 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	struct sockaddr_in *to;
 	struct hardware *hto;
 {
+	unsigned hbufp = 0;
+	double hh [16];
+	double ih [1536 / sizeof (double)];
+	unsigned char *dbuf = (unsigned char *)ih;
 	unsigned dbuflen;
-	unsigned char dbuf [1536];
 	unsigned char sap [2];
 	unsigned char dstaddr [DLPI_MAXDLADDR];
 	unsigned addrlen;
 	int saplen;
 	int result;
+	int fudge;
 
 	if (!strcmp (interface -> name, "fallback"))
 		return send_fallback (interface, packet, raw,
@@ -524,7 +528,11 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 
 	/* Assemble the headers... */
 #ifdef USE_DLPI_RAW
-	assemble_hw_header (interface, dbuf, &dbuflen, hto);
+	assemble_hw_header (interface, (unsigned char *)hh, &dbuflen, hto);
+	fudge = dbuflen % 4; /* IP header must be word-aligned. */
+	memcpy (dbuf + fudge, (unsigned char *)hh, dbuflen);
+#else
+	fudge = 0;
 #endif
 	assemble_udp_ip_header (interface, dbuf, &dbuflen, from.s_addr,
 				to -> sin_addr.s_addr, to -> sin_port,
@@ -535,7 +543,7 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	dbuflen += len;
 
 #ifdef USE_DLPI_RAW
-	result = write (interface -> wfdesc, dbuf, dbuflen);
+	result = write (interface -> wfdesc, dbuf + fudge, dbuflen - fudge);
 #else
 	/* XXX: Assumes ethernet, with two byte SAP */
 	sap [0] = 0x08;		/* ETHERTYPE_IP, high byte */
diff --git a/common/execute.c b/common/execute.c
index 7b97bef43..e1c18c4b2 100644
--- a/common/execute.c
+++ b/common/execute.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: execute.c,v 1.35 2000/07/06 22:42:22 mellon Exp $ Copyright (c) 1998-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: execute.c,v 1.36 2000/07/27 09:02:32 mellon Exp $ Copyright (c) 1998-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -55,7 +55,7 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *out_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct executable_statement *statements;
 {
 	struct executable_statement *r, *e, *next;
@@ -163,9 +163,9 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 			break;
 
 		      case if_statement:
-			status = evaluate_boolean_expression
-				(&result, packet, lease, in_options,
-				 out_options, scope, r -> data.ie.expr);
+			status = (evaluate_boolean_expression
+				  (&result, packet, lease, in_options,
+				   out_options, scope, r -> data.ie.expr));
 			
 #if defined (DEBUG_EXPRESSIONS)
 			log_debug ("exec: if %s", (status
@@ -244,7 +244,21 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 			break;
 
 		      case set_statement:
-			binding = find_binding (scope, r -> data.set.name);
+			if (!scope) {
+				log_error ("set %s: no scope",
+					   r -> data.set.name);
+				status = 0;
+				break;
+			}
+			if (!*scope) {
+			    if (!binding_scope_allocate (scope, MDL)) {
+				log_error ("set %s: can't allocate scope",
+					   r -> data.set.name);
+				status = 0;
+				break;
+			    }
+			}
+			binding = find_binding (*scope, r -> data.set.name);
 #if defined (DEBUG_EXPRESSIONS)
 			log_debug ("exec: set %s", r -> data.set.name);
 #endif
@@ -261,12 +275,9 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 						r -> data.set.name);
 					if (lease) {
 					    binding -> next =
-						    lease -> scope.bindings;
-					    lease -> scope.bindings = binding;
-					} else {
-					    binding -> next =
-						    global_scope.bindings;
-					    global_scope.bindings = binding;
+						    lease -> scope -> bindings;
+					    lease -> scope -> bindings =
+						    binding;
 					}
 				    } else {
 				       badalloc:
@@ -291,7 +302,11 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 			break;
 
 		      case unset_statement:
-			binding = find_binding (scope, r -> data.unset);
+			if (!scope || !*scope) {
+				status = 0;
+				break;
+			}
+			binding = find_binding (*scope, r -> data.unset);
 #if defined (DEBUG_EXPRESSIONS)
 			log_debug ("exec: unset %s", r -> data.unset);
 #endif
@@ -357,10 +372,12 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 				e = e -> data.let.statements;
 				goto next_let;
 			} else if (ns) {
-				ns -> outer = scope;
+				if (scope && *scope)
+				    	binding_scope_reference (&ns -> outer,
+								 *scope, MDL);
 				execute_statements
 				      (packet, lease, in_options, out_options,
-				       ns, e -> data.let.statements);
+				       &ns, e -> data.let.statements);
 			}
 			if (ns)
 				binding_scope_dereference (&ns, MDL);
@@ -392,7 +409,7 @@ void execute_statements_in_scope (packet, lease, in_options, out_options,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *out_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct group *group;
 	struct group *limiting_group;
 {
@@ -771,7 +788,7 @@ int find_matching_case (struct executable_statement **ep,
 			struct packet *packet, struct lease *lease,
 			struct option_state *in_options,
 			struct option_state *out_options,
-			struct binding_scope *scope,
+			struct binding_scope **scope,
 			struct expression *expr,
 			struct executable_statement *stmt)
 {
diff --git a/common/lpf.c b/common/lpf.c
index bdbc07547..21a2fa93d 100644
--- a/common/lpf.c
+++ b/common/lpf.c
@@ -37,7 +37,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: lpf.c,v 1.25 2000/06/08 21:14:14 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: lpf.c,v 1.26 2000/07/27 09:02:33 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -83,14 +83,18 @@ int if_register_lpf (info)
 	struct sockaddr sa;
 
 	/* Make an LPF socket. */
-	if ((sock = socket(PF_PACKET, SOCK_PACKET, htons(ETH_P_ALL))) < 0) {
+	if ((sock = socket(PF_PACKET, SOCK_PACKET,
+			   htons((short)ETH_P_ALL))) < 0) {
 		if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
 		    errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
-		    errno == EAFNOSUPPORT || errno == EINVAL)
-			log_fatal ("socket: %m - make sure %s %s %s!",
-				   "CONFIG_PACKET (Packet socket)"
-				   "and CONFIG_FILTER (Socket Filtering) are",
-				   "enabled in your kernel configuration");
+		    errno == EAFNOSUPPORT || errno == EINVAL) {
+			log_error ("socket: %m - make sure");
+			log_error ("CONFIG_PACKET (Packet socket) %s",
+				   "and CONFIG_FILTER");
+			log_error ("(Socket Filtering) are enabled %s",
+				   "in your kernel");
+			log_fatal ("configuration!");
+		}
 		log_fatal ("Open a socket for LPF: %m");
 	}
 
@@ -101,11 +105,14 @@ int if_register_lpf (info)
 	if (bind (sock, &sa, sizeof sa)) {
 		if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
 		    errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
-		    errno == EAFNOSUPPORT || errno == EINVAL)
-			log_fatal ("socket: %m - make sure %s %s %s!",
-				   "CONFIG_PACKET (Packet socket)"
-				   "and CONFIG_FILTER (Socket Filtering) are",
-				   "enabled in your kernel configuration");
+		    errno == EAFNOSUPPORT || errno == EINVAL) {
+			log_error ("socket: %m - make sure");
+			log_error ("CONFIG_PACKET (Packet socket) %s",
+				   "and CONFIG_FILTER");
+			log_error ("(Socket Filtering) are enabled %s",
+				   "in your kernel");
+			log_fatal ("configuration!");
+		}
 		log_fatal ("Bind socket to interface: %m");
 	}
 
@@ -222,17 +229,20 @@ static void lpf_gen_filter_setup (info)
         /* Patch the server port into the LPF  program...
 	   XXX changes to filter program may require changes
 	   to the insn number(s) used below! XXX */
-	dhcp_bpf_filter [8].k = ntohs (local_port);
+	dhcp_bpf_filter [8].k = ntohs ((short)local_port);
 
 	if (setsockopt (info -> rfdesc, SOL_SOCKET, SO_ATTACH_FILTER, &p,
 			sizeof p) < 0) {
 		if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
 		    errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
-		    errno == EAFNOSUPPORT)
-			log_fatal ("socket: %m - make sure %s %s %s!",
-				   "CONFIG_PACKET (Packet socket)"
-				   "and CONFIG_FILTER (Socket Filtering) are",
-				   "enabled in your kernel configuration");
+		    errno == EAFNOSUPPORT) {
+			log_error ("socket: %m - make sure");
+			log_error ("CONFIG_PACKET (Packet socket) %s",
+				   "and CONFIG_FILTER");
+			log_error ("(Socket Filtering) are enabled %s",
+				   "in your kernel");
+			log_fatal ("configuration!");
+		}
 		log_fatal ("Can't install packet filter program: %m");
 	}
 }
@@ -258,11 +268,14 @@ static void lpf_tr_filter_setup (info)
 			sizeof p) < 0) {
 		if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
 		    errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
-		    errno == EAFNOSUPPORT)
-			log_fatal ("socket: %m - make sure %s %s %s!",
-				   "CONFIG_PACKET (Packet socket)"
-				   "and CONFIG_FILTER (Socket Filtering) are",
-				   "enabled in your kernel configuration");
+		    errno == EAFNOSUPPORT) {
+			log_error ("socket: %m - make sure");
+			log_error ("CONFIG_PACKET (Packet socket) %s",
+				   "and CONFIG_FILTER");
+			log_error ("(Socket Filtering) are enabled %s",
+				   "in your kernel");
+			log_fatal ("configuration!");
+		}
 		log_fatal ("Can't install packet filter program: %m");
 	}
 }
@@ -278,21 +291,27 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	struct sockaddr_in *to;
 	struct hardware *hto;
 {
-	unsigned bufp = 0;
-	unsigned char buf [1500];
+	unsigned hbufp = 0, ibufp = 0;
+	double hh [16];
+	double ih [1536 / sizeof (double)];
+	unsigned char *buf = (unsigned char *)ih;
 	struct sockaddr sa;
 	int result;
+	int fudge;
 
 	if (!strcmp (interface -> name, "fallback"))
 		return send_fallback (interface, packet, raw,
 				      len, from, to, hto);
 
 	/* Assemble the headers... */
-	assemble_hw_header (interface, buf, &bufp, hto);
-	assemble_udp_ip_header (interface, buf, &bufp, from.s_addr,
+	assemble_hw_header (interface, (unsigned char *)hh, &hbufp, hto);
+	fudge = hbufp % 4;	/* IP header must be word-aligned. */
+	memcpy (buf + fudge, (unsigned char *)hh, hbufp);
+	ibufp = hbufp + fudge;
+	assemble_udp_ip_header (interface, buf, &ibufp, from.s_addr,
 				to -> sin_addr.s_addr, to -> sin_port,
 				(unsigned char *)raw, len);
-	memcpy (buf + bufp, raw, len);
+	memcpy (buf + ibufp, raw, len);
 
 	/* For some reason, SOCK_PACKET sockets can't be connected,
 	   so we have to do a sentdo every time. */
@@ -301,8 +320,8 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	strncpy (sa.sa_data,
 		 (const char *)interface -> ifp, sizeof sa.sa_data);
 
-	result = sendto (interface -> wfdesc, buf, bufp + len, 0,
-			 &sa, sizeof sa);
+	result = sendto (interface -> wfdesc,
+			 buf + fudge, ibufp + len - fudge, 0, &sa, sizeof sa);
 	if (result < 0)
 		log_error ("send_packet: %m");
 	return result;
@@ -321,7 +340,7 @@ ssize_t receive_packet (interface, buf, len, from, hfrom)
 	int length = 0;
 	int offset = 0;
 	unsigned char ibuf [1500];
-	int bufix = 0;
+	unsigned bufix = 0;
 
 	length = read (interface -> rfdesc, ibuf, sizeof ibuf);
 	if (length <= 0)
@@ -342,8 +361,8 @@ ssize_t receive_packet (interface, buf, len, from, hfrom)
 	length -= offset;
 
 	/* Decode the IP and UDP headers... */
-	offset = decode_udp_ip_header (interface, ibuf, bufix,
-				       from, (unsigned char *)0, length);
+	offset = decode_udp_ip_header (interface, ibuf, bufix, from,
+				       (unsigned char *)0, (unsigned)length);
 
 	/* If the IP or UDP checksum was bad, skip the packet... */
 	if (offset < 0)
diff --git a/common/nit.c b/common/nit.c
index 569065f8e..c42be38bd 100644
--- a/common/nit.c
+++ b/common/nit.c
@@ -44,7 +44,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: nit.c,v 1.30 2000/06/08 21:14:15 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: nit.c,v 1.31 2000/07/27 09:02:34 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -299,11 +299,12 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	struct sockaddr_in *to;
 	struct hardware *hto;
 {
-	unsigned bufp;
-	unsigned char buf [1536 + sizeof (struct sockaddr)];
+	unsigned hbufp, ibufp;
+	double hh [16];
+	double ih [1536 / sizeof (double)];
+	unsigned char *buf = (unsigned char *)ih;
 	struct sockaddr *junk;
 	struct strbuf ctl, data;
-	int hw_end;
 	struct sockaddr_in foo;
 	int result;
 
@@ -312,34 +313,30 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 				      len, from, to, hto);
 
 	/* Start with the sockaddr struct... */
-	junk = (struct sockaddr *)&buf [0];
-	bufp = ((unsigned char *)&junk -> sa_data [0]) - &buf [0];
+	junk = (struct sockaddr *)&hh [0];
+	hbufp = ((unsigned char *)&junk -> sa_data [0]) - &buf [0];
+	ibufp = 0;
 
 	/* Assemble the headers... */
-	assemble_hw_header (interface, buf, &bufp, hto);
-	hw_end = bufp;
-	assemble_udp_ip_header (interface, buf, &bufp, from.s_addr,
-				to -> sin_addr.s_addr, to -> sin_port,
-				raw, len);
+	assemble_hw_header (interface, (unsigned char *)junk, &hbufp, hto);
+	assemble_udp_ip_header (interface, buf, &ibufp,
+				from.s_addr, to -> sin_addr.s_addr,
+				to -> sin_port, raw, len);
 
 	/* Copy the data into the buffer (yuk). */
 	memcpy (buf + bufp, raw, len);
 
 	/* Set up the sockaddr structure... */
 #if USE_SIN_LEN
-	junk -> sa_len = hw_end - 2; /* XXX */
+	junk -> sa_len = hbufp - 2; /* XXX */
 #endif
 	junk -> sa_family = AF_UNSPEC;
 
-#if 0 /* Already done. */
-	memcpy (junk.sa_data, buf, hw_len);
-#endif
-
 	/* Set up the msg_buf structure... */
-	ctl.buf = (char *)&buf [0];
-	ctl.maxlen = ctl.len = hw_end;
-	data.buf = (char *)&buf [hw_end];
-	data.maxlen = data.len = bufp + len - hw_end;
+	ctl.buf = (char *)&hh [0];
+	ctl.maxlen = ctl.len = hbufp;
+	data.buf = (char *)&ih [0];
+	data.maxlen = data.len = ibufp + len;
 
 	result = putmsg (interface -> wfdesc, &ctl, &data, 0);
 	if (result < 0)
diff --git a/common/options.c b/common/options.c
index fdc8d4bb0..8757eb830 100644
--- a/common/options.c
+++ b/common/options.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: options.c,v 1.62 2000/06/28 23:35:22 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: options.c,v 1.63 2000/07/27 09:02:35 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #define DHCP_OPTION_DATA
@@ -205,7 +205,7 @@ int cons_options (inpacket, outpacket, lease, mms, in_options, cfg_options,
 	int mms;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	int overload;	/* Overload flags that may be set. */
 	int terminate;
 	int bootpp;
@@ -420,7 +420,7 @@ int store_options (buffer, buflen, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	unsigned *priority_list;
 	int priority_len;
 	unsigned first_cutoff, second_cutoff;
@@ -751,7 +751,7 @@ int hashed_option_get (result, universe, packet, lease,
 	struct option_state *in_options;
 	struct option_state *cfg_options;
 	struct option_state *options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	unsigned code;
 {
 	struct option_cache *oc;
@@ -776,7 +776,7 @@ int agent_option_get (result, universe, packet, lease,
 	struct option_state *in_options;
 	struct option_state *cfg_options;
 	struct option_state *options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	unsigned code;
 {
 	struct agent_options *ao;
@@ -1154,7 +1154,7 @@ int store_option (result, universe, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct option_cache *oc;
 {
 	struct data_string d1, d2;
@@ -1201,7 +1201,7 @@ int option_space_encapsulate (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct data_string *name;
 {
 	struct universe *u;
@@ -1229,7 +1229,7 @@ int hashed_option_space_encapsulate (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct universe *universe;
 {
 	pair p, *hash;
@@ -1263,7 +1263,7 @@ int nwip_option_space_encapsulate (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct universe *universe;
 {
 	pair p, *hash;
@@ -1376,7 +1376,7 @@ void do_packet (interface, packet, len, from_port, from, hfrom)
 					       (struct lease *)0,
 					       decoded_packet -> options,
 					       (struct option_state *)0,
-					       (struct binding_scope *)0,
+					       (struct binding_scope **)0,
 					       op, MDL);
 			if (dp.len > 0)
 				decoded_packet -> packet_type = dp.data [0];
diff --git a/common/tree.c b/common/tree.c
index 83bbbebe6..7361b97fb 100644
--- a/common/tree.c
+++ b/common/tree.c
@@ -43,13 +43,13 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: tree.c,v 1.84 2000/07/06 10:00:53 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: tree.c,v 1.85 2000/07/27 09:02:36 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
 #include <omapip/omapip_p.h>
 
-struct binding_scope global_scope;
+struct binding_scope *global_scope;
 
 static int do_host_lookup PROTO ((struct data_string *,
 				  struct dns_host_entry *));
@@ -430,7 +430,7 @@ int evaluate_expression (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct expression *expr;
 {
 	struct binding_value *bv;
@@ -440,7 +440,10 @@ int evaluate_expression (result, packet, lease,
 	bv = (struct binding_value *)0;
 
 	if (expr -> op == expr_variable_reference) {
-		binding = find_binding (scope, expr -> data.variable);
+		if (!scope || !*scope)
+			return 0;
+
+		binding = find_binding (*scope, expr -> data.variable);
 
 		if (binding && binding -> value) {
 			if (result)
@@ -455,7 +458,14 @@ int evaluate_expression (result, packet, lease,
 		struct expression *arg;
 		struct binding_scope *ns;
 		struct binding *nb;
-		binding = find_binding (scope, expr -> data.funcall.name);
+
+		if (!scope || !*scope) {
+			log_error ("%s: no such function.",
+				   expr -> data.funcall.name);
+			return 0;
+		}
+
+		binding = find_binding (*scope, expr -> data.funcall.name);
 
 		if (!binding || !binding -> value) {
 			log_error ("%s: no such function.",
@@ -518,9 +528,11 @@ int evaluate_expression (result, packet, lease,
 			return 0;
 		}
 
-		ns -> outer = scope;
+		if (scope && *scope)
+			binding_scope_reference (&ns -> outer, *scope, MDL);
+
 		if (execute_statements
-		    (packet, lease, in_options, cfg_options, ns,
+		    (packet, lease, in_options, cfg_options, &ns,
 		     binding -> value -> value.fundef -> statements)) {
 			if (ns -> bindings && ns -> bindings -> name) {
 			    binding_value_reference (result,
@@ -641,7 +653,7 @@ int evaluate_dns_expression (result, packet, lease, in_options,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct expression *expr;
 {
 	ns_updrec *foo;
@@ -882,7 +894,7 @@ int evaluate_boolean_expression (result, packet, lease, in_options,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct expression *expr;
 {
 	struct data_string left, right;
@@ -1067,12 +1079,15 @@ int evaluate_boolean_expression (result, packet, lease, in_options,
 		return 1;
 
 	      case expr_variable_exists:
-		binding = find_binding (scope, expr -> data.variable);
+		if (scope && *scope) {
+			binding = find_binding (*scope, expr -> data.variable);
 
-		if (binding) {
-			if (binding -> value)
-				*result = 1;
-			else
+			if (binding) {
+				if (binding -> value)
+					*result = 1;
+				else
+					*result = 0;
+			} else
 				*result = 0;
 		} else
 			*result = 0;
@@ -1083,18 +1098,22 @@ int evaluate_boolean_expression (result, packet, lease, in_options,
 		return 1;
 
 	      case expr_variable_reference:
-		binding = find_binding (scope, expr -> data.variable);
+		if (scope && *scope) {
+		    binding = find_binding (*scope, expr -> data.variable);
 
-		if (binding && binding -> value) {
-			if (binding -> value -> type == binding_boolean) {
+		    if (binding && binding -> value) {
+			if (binding -> value -> type ==
+			    binding_boolean) {
 				*result = binding -> value -> value.boolean;
-			    sleft = 1;
+				sleft = 1;
 			} else {
 				log_error ("binding type %d in %s.",
 					   binding -> value -> type,
 					   "evaluate_boolean_expression");
 				sleft = 0;
 			}
+		    } else
+			    sleft = 0;
 		} else
 			sleft = 0;
 #if defined (DEBUG_EXPRESSIONS)
@@ -1194,7 +1213,7 @@ int evaluate_data_expression (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct expression *expr;
 {
 	struct data_string data, other;
@@ -1829,23 +1848,26 @@ int evaluate_data_expression (result, packet, lease,
 		return 0;
 
 	      case expr_variable_reference:
-		binding = find_binding (scope, expr -> data.variable);
+		if (scope && *scope) {
+		    binding = find_binding (*scope, expr -> data.variable);
 
-		if (binding && binding -> value) {
-		    if (binding -> value -> type == binding_data) {
+		    if (binding && binding -> value) {
+			if (binding -> value -> type == binding_data) {
 			    data_string_copy (result,
 					      &binding -> value -> value.data,
 					      MDL);
 			    s0 = 1;
-		    } else if (binding -> value -> type != binding_data) {
+			} else if (binding -> value -> type != binding_data) {
 			    log_error ("binding type %d in %s.",
 				       binding -> value -> type,
 				       "evaluate_data_expression");
 			    s0 = 0;
-		    } else
+			} else
 			    s0 = 0;
-		} else
+		    } else
 			s0 = 0;
+		} else
+		    s0 = 0;
 #if defined (DEBUG_EXPRESSIONS)
 		log_debug ("data: %s = %s", expr -> data.variable,
 			   s0 ? print_hex_1 (result -> len,
@@ -1998,7 +2020,7 @@ int evaluate_numeric_expression (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct expression *expr;
 {
 	struct data_string data;
@@ -2172,9 +2194,10 @@ int evaluate_numeric_expression (result, packet, lease,
 #endif /* NSUPDATE */
 
 	      case expr_variable_reference:
-		binding = find_binding (scope, expr -> data.variable);
+		if (scope && *scope) {
+		    binding = find_binding (*scope, expr -> data.variable);
 
-		if (binding && binding -> value) {
+		    if (binding && binding -> value) {
 			if (binding -> value -> type == binding_numeric) {
 				*result = binding -> value -> value.intval;
 			    status = 1;
@@ -2184,8 +2207,10 @@ int evaluate_numeric_expression (result, packet, lease,
 					   "evaluate_numeric_expression");
 				status = 0;
 			}
-		} else
+		    } else
 			status = 0;
+		} else
+		    status = 0;
 #if defined (DEBUG_EXPRESSIONS)
 		log_debug ("numeric: %s = %s", expr -> data.variable,
 			   status ? *result : 0);
@@ -2350,7 +2375,7 @@ int evaluate_option_cache (result, packet, lease,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct option_cache *oc;
 	const char *file;
 	int line;
@@ -2376,7 +2401,7 @@ int evaluate_boolean_option_cache (ignorep, packet, lease, in_options,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct option_cache *oc;
 	const char *file;
 	int line;
@@ -2416,7 +2441,7 @@ int evaluate_boolean_expression_result (ignorep, packet, lease, in_options,
 	struct lease *lease;
 	struct option_state *in_options;
 	struct option_state *cfg_options;
-	struct binding_scope *scope;
+	struct binding_scope **scope;
 	struct expression *expr;
 {
 	int result;
@@ -3407,6 +3432,9 @@ int binding_scope_dereference (ptr, file, line)
 	const char *file;
 	int line;
 {
+	int i;
+	struct binding_scope *binding_scope;
+
 	if (!ptr || !*ptr) {
 		log_error ("%s(%d): null pointer", file, line);
 #if defined (POINTER_DEBUG)
@@ -3416,10 +3444,29 @@ int binding_scope_dereference (ptr, file, line)
 #endif
 	}
 
-	if ((*ptr) -> bindings)
-		free_bindings (*ptr, file, line);
-	dfree ((*ptr), file, line);
+	binding_scope = *ptr;
 	*ptr = (struct binding_scope *)0;
+	--binding_scope -> refcnt;
+	rc_register (file, line, ptr, binding_scope, binding_scope -> refcnt);
+	if (binding_scope -> refcnt > 0)
+		return 1;
+
+	if (binding_scope -> refcnt < 0) {
+		log_error ("%s(%d): negative refcnt!", file, line);
+#if defined (DEBUG_RC_HISTORY)
+		dump_rc_history ();
+#endif
+#if defined (POINTER_DEBUG)
+		abort ();
+#else
+		return 0;
+#endif
+	}
+
+	free_bindings (binding_scope, file, line);
+	if (binding_scope -> outer)
+		binding_scope_dereference (&binding_scope -> outer, MDL);
+	dfree (binding_scope, file, line);
 	return 1;
 }
 
diff --git a/common/upf.c b/common/upf.c
index 10f8f2361..78ac5b3cc 100644
--- a/common/upf.c
+++ b/common/upf.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: upf.c,v 1.19 2000/06/08 21:14:16 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: upf.c,v 1.20 2000/07/27 09:02:38 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -265,28 +265,33 @@ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
 	struct sockaddr_in *to;
 	struct hardware *hto;
 {
-	unsigned bufp = 0;
-	unsigned char buf [256];
-	struct iovec iov [2];
+	unsigned hbufp = 0, ibufp = 0;
+	double hw [4];
+	double ip [32];
+	struct iovec iov [3];
 	int result;
+	int fudge;
 
 	if (!strcmp (interface -> name, "fallback"))
 		return send_fallback (interface, packet, raw,
 				      len, from, to, hto);
 
 	/* Assemble the headers... */
-	assemble_hw_header (interface, buf, &bufp, hto);
-	assemble_udp_ip_header (interface, buf, &bufp, from.s_addr,
+	assemble_hw_header (interface, (unsigned char *)hw, &hbufp, hto);
+	assemble_udp_ip_header (interface,
+				(unsigned char *)ip, &ibufp, from.s_addr,
 				to -> sin_addr.s_addr, to -> sin_port,
 				(unsigned char *)raw, len);
 
 	/* Fire it off */
-	iov [0].iov_base = (char *)buf;
-	iov [0].iov_len = bufp;
-	iov [1].iov_base = (char *)raw;
-	iov [1].iov_len = len;
-
-	result = writev(interface -> wfdesc, iov, 2);
+	iov [0].iov_base = ((char *)hw);
+	iov [0].iov_len = hbufp;
+	iov [1].iov_base = ((char *)ip);
+	iov [1].iov_len = ibufp;
+	iov [2].iov_base = (char *)raw;
+	iov [2].iov_len = len;
+
+	result = writev(interface -> wfdesc, iov, 3);
 	if (result < 0)
 		log_error ("send_packet: %m");
 	return result;
diff --git a/includes/dhcpd.h b/includes/dhcpd.h
index 5a0bdc28a..b29161ec4 100644
--- a/includes/dhcpd.h
+++ b/includes/dhcpd.h
@@ -261,7 +261,7 @@ struct lease {
 	unsigned char uid_buf [32];
 	char *hostname;
 	char *client_hostname;
-	struct binding_scope scope;
+	struct binding_scope *scope;
 	struct host_decl *host;
 	struct subnet *subnet;
 	struct pool *pool;
@@ -892,11 +892,11 @@ int parse_options PROTO ((struct packet *));
 int parse_option_buffer PROTO ((struct packet *, unsigned char *, unsigned));
 int cons_options PROTO ((struct packet *, struct dhcp_packet *, struct lease *,
 			 int, struct option_state *, struct option_state *,
-			 struct binding_scope *,
+			 struct binding_scope **,
 			 int, int, int, struct data_string *));
 int store_options PROTO ((unsigned char *, unsigned, struct packet *,
 			  struct lease *, struct option_state *,
-			  struct option_state *, struct binding_scope *,
+			  struct option_state *, struct binding_scope **,
 			  unsigned *, int, unsigned, unsigned, int));
 const char *pretty_print_option PROTO ((unsigned int, const unsigned char *,
 					unsigned, int, int));
@@ -906,12 +906,12 @@ void do_packet PROTO ((struct interface_info *,
 int hashed_option_get PROTO ((struct data_string *, struct universe *,
 			      struct packet *, struct lease *,
 			      struct option_state *, struct option_state *,
-			      struct option_state *, struct binding_scope *,
+			      struct option_state *, struct binding_scope **,
 			      unsigned));
 int agent_option_get PROTO ((struct data_string *, struct universe *,
 			     struct packet *, struct lease *,
 			     struct option_state *, struct option_state *,
-			     struct option_state *, struct binding_scope *,
+			     struct option_state *, struct binding_scope **,
 			     unsigned));
 void hashed_option_set PROTO ((struct universe *, struct option_state *,
 			       struct option_cache *,
@@ -939,24 +939,24 @@ int agent_option_state_dereference PROTO ((struct universe *,
 int store_option PROTO ((struct data_string *,
 			 struct universe *, struct packet *, struct lease *,
 			 struct option_state *, struct option_state *,
-			 struct binding_scope *, struct option_cache *));
+			 struct binding_scope **, struct option_cache *));
 int option_space_encapsulate PROTO ((struct data_string *,
 				     struct packet *, struct lease *,
 				     struct option_state *,
 				     struct option_state *,
-				     struct binding_scope *,
+				     struct binding_scope **,
 				     struct data_string *));
 int hashed_option_space_encapsulate PROTO ((struct data_string *,
 					    struct packet *, struct lease *,
 					    struct option_state *,
 					    struct option_state *,
-					    struct binding_scope *,
+					    struct binding_scope **,
 					    struct universe *));
 int nwip_option_space_encapsulate PROTO ((struct data_string *,
 					  struct packet *, struct lease *,
 					  struct option_state *,
 					  struct option_state *,
-					  struct binding_scope *,
+					  struct binding_scope **,
 					  struct universe *));
 
 /* dhcpd.c */
@@ -1071,7 +1071,7 @@ int parse_warn (struct parse *, const char *, ...)
 	__attribute__((__format__(__printf__,2,3)));
 
 /* tree.c */
-extern struct binding_scope global_scope;
+extern struct binding_scope *global_scope;
 pair cons PROTO ((caddr_t, pair));
 int make_const_option_cache PROTO ((struct option_cache **, struct buffer **,
 				    u_int8_t *, unsigned, struct option *,
@@ -1092,7 +1092,7 @@ int option_cache PROTO ((struct option_cache **, struct data_string *,
 			 struct expression *, struct option *));
 int evaluate_expression (struct binding_value **, struct packet *,
 			 struct lease *, struct option_state *,
-			 struct option_state *, struct binding_scope *,
+			 struct option_state *, struct binding_scope **,
 			 struct expression *);
 int binding_value_dereference (struct binding_value **, const char *, int);
 int fundef_dereference (struct fundef **, const char *, int);
@@ -1100,43 +1100,44 @@ int fundef_dereference (struct fundef **, const char *, int);
 int evaluate_dns_expression PROTO ((ns_updrec **, struct packet *,
 				    struct lease *, struct option_state *,
 				    struct option_state *,
-				    struct binding_scope *,
+				    struct binding_scope **,
 				    struct expression *));
 #endif
 int evaluate_boolean_expression PROTO ((int *,
 					struct packet *,  struct lease *,
 					struct option_state *,
 					struct option_state *,
-					struct binding_scope *,
+					struct binding_scope **,
 					struct expression *));
 int evaluate_data_expression PROTO ((struct data_string *,
 				     struct packet *, struct lease *,
 				     struct option_state *,
 				     struct option_state *,
-				     struct binding_scope *,
+				     struct binding_scope **,
 				     struct expression *));
 int evaluate_numeric_expression PROTO
 	((unsigned long *, struct packet *, struct lease *,
-	  struct option_state *, struct option_state *, struct binding_scope *,
+	  struct option_state *, struct option_state *,
+	  struct binding_scope **,
 	  struct expression *));
 int evaluate_option_cache PROTO ((struct data_string *,
 				  struct packet *, struct lease *,
 				  struct option_state *, struct option_state *,
-				  struct binding_scope *,
+				  struct binding_scope **,
 				  struct option_cache *,
 				  const char *, int));
 int evaluate_boolean_option_cache PROTO ((int *,
 					  struct packet *, struct lease *,
 					  struct option_state *,
 					  struct option_state *,
-					  struct binding_scope *,
+					  struct binding_scope **,
 					  struct option_cache *,
 					  const char *, int));
 int evaluate_boolean_expression_result PROTO ((int *,
 					       struct packet *, struct lease *,
 					       struct option_state *,
 					       struct option_state *,
-					       struct binding_scope *,
+					       struct binding_scope **,
 					       struct expression *));
 void expression_dereference PROTO ((struct expression **, const char *, int));
 int is_dns_expression PROTO ((struct expression *));
@@ -1286,6 +1287,9 @@ int packet_reference PROTO ((struct packet **,
 int packet_dereference PROTO ((struct packet **, const char *, int));
 int binding_scope_allocate PROTO ((struct binding_scope **,
 				   const char *, int));
+int binding_scope_reference PROTO ((struct binding_scope **,
+				    struct binding_scope *,
+				    const char *, int));
 int dns_zone_allocate PROTO ((struct dns_zone **, const char *, int));
 int dns_zone_reference PROTO ((struct dns_zone **,
 			       struct dns_zone *, const char *, int));
@@ -1649,7 +1653,7 @@ void client_envadd (struct client_state *,
 		    const char *, const char *, const char *, ...)
 	__attribute__((__format__(__printf__,4,5)));
 
-struct client_lease *packet_to_lease PROTO ((struct packet *));
+struct client_lease *packet_to_lease (struct packet *, struct client_state *);
 void go_daemon PROTO ((void));
 void write_client_pid_file PROTO ((void));
 void client_location_changed PROTO ((void));
@@ -1837,13 +1841,13 @@ int bill_class PROTO ((struct lease *, struct class *));
 int execute_statements PROTO ((struct packet *,
 			       struct lease *,
 			       struct option_state *, struct option_state *,
-			       struct binding_scope *,
+			       struct binding_scope **,
 			       struct executable_statement *));
 void execute_statements_in_scope PROTO ((struct packet *,
 					 struct lease *,
 					 struct option_state *,
 					 struct option_state *,
-					 struct binding_scope *,
+					 struct binding_scope **,
 					 struct group *, struct group *));
 int executable_statement_dereference PROTO ((struct executable_statement **,
 					     const char *, int));
@@ -1851,7 +1855,7 @@ void write_statements (FILE *, struct executable_statement *, int);
 int find_matching_case (struct executable_statement **,
 			struct packet *, struct lease *,
 			struct option_state *, struct option_state *,
-			struct binding_scope *,
+			struct binding_scope **,
 			struct expression *, struct executable_statement *);
 
 /* auth.c */
diff --git a/includes/site.h b/includes/site.h
index 2819c36a9..57977892f 100644
--- a/includes/site.h
+++ b/includes/site.h
@@ -75,7 +75,7 @@
 /* Define this if you want debugging output for DHCP failover protocol
    messages. */
 
-/* #define DEBUG_FAILOVER_MESSAGES */
+#define DEBUG_FAILOVER_MESSAGES
 
 /* Define this if you want debugging output for DHCP failover protocol
    lease assignment timing. */
@@ -85,7 +85,7 @@
 /* Define this if you want DHCP failover protocol support in the DHCP
    server. */
 
-/* #define FAILOVER_PROTOCOL */
+#define FAILOVER_PROTOCOL
 
 /* Define this if you want DNS update functionality to be available. */
 
diff --git a/includes/tree.h b/includes/tree.h
index 32191d406..238099771 100644
--- a/includes/tree.h
+++ b/includes/tree.h
@@ -120,6 +120,7 @@ struct binding {
 };
 
 struct binding_scope {
+	int refcnt;
 	struct binding_scope *outer;
 	struct binding *bindings;
 };
@@ -288,7 +289,7 @@ struct universe {
 	int (*get_func) PROTO ((struct data_string *, struct universe *,
 				struct packet *, struct lease *,
 				struct option_state *, struct option_state *,
-				struct option_state *, struct binding_scope *,
+				struct option_state *, struct binding_scope **,
 				unsigned));
 	void (*set_func) PROTO ((struct universe *, struct option_state *,
 				 struct option_cache *, enum statement_op));
@@ -301,7 +302,8 @@ struct universe {
 	int (*encapsulate) PROTO ((struct data_string *, struct packet *,
 				   struct lease *, struct option_state *,
 				   struct option_state *,
-				   struct binding_scope *, struct universe *));
+				   struct binding_scope **,
+				   struct universe *));
 	void (*store_tag) PROTO ((unsigned char *, u_int32_t));
 	void (*store_length) PROTO ((unsigned char *, u_int32_t));
 	int tag_size, length_size;
diff --git a/relay/dhcrelay.c b/relay/dhcrelay.c
index 05f6b4b82..95d2d471f 100644
--- a/relay/dhcrelay.c
+++ b/relay/dhcrelay.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char ocopyright[] =
-"$Id: dhcrelay.c,v 1.42 2000/07/17 20:56:14 mellon Exp $ Copyright (c) 1997-2000 Internet Software Consortium.  All rights reserved.\n";
+"$Id: dhcrelay.c,v 1.43 2000/07/27 09:02:59 mellon Exp $ Copyright (c) 1997-2000 Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -111,8 +111,7 @@ static char copyright [] =
 "Copyright 1997, 1998, 1999 Internet Software Consortium.";
 static char arr [] = "All rights reserved.";
 static char message [] = "Internet Software Consortium DHCP Relay Agent";
-static char contrib [] = "\nPlease contribute if you find this software useful.";
-static char url [] = "For info, please visit http://www.isc.org/dhcp-contrib.html\n";
+static char url [] = "For info, please visit http://www.isc.org/dhcp-contrib.html";
 
 int main (argc, argv, envp)
 	int argc;
@@ -223,7 +222,6 @@ int main (argc, argv, envp)
 		log_info ("%s %s", message, DHCP_VERSION);
 		log_info (copyright);
 		log_info (arr);
-		log_info (contrib);
 		log_info (url);
 	} else {
 		quiet = 0;
diff --git a/server/confpars.c b/server/confpars.c
index d80b6d8ab..9ce81c6d6 100644
--- a/server/confpars.c
+++ b/server/confpars.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: confpars.c,v 1.120 2000/07/06 10:14:31 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: confpars.c,v 1.121 2000/07/27 09:03:01 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -305,6 +305,8 @@ int parse_statement (cfile, group, type, host_decl, declaration)
 				   isc_result_totext (status));
 		if (!clone_group (&share -> group, group, MDL))
 			log_fatal ("Can't allocate group for shared net");
+		shared_network_reference (&share -> group -> shared_network,
+					  share, MDL);
 
 		parse_subnet_declaration (cfile, share);
 
@@ -1059,10 +1061,11 @@ void parse_pool_statement (cfile, group, type)
 	pool = (struct pool *)0;
 	status = pool_allocate (&pool, MDL);
 	if (status != ISC_R_SUCCESS)
-		log_fatal ("no memory for pool.");
+		log_fatal ("no memory for pool: %s",
+			   isc_result_totext (status));
 
 	if (!clone_group (&pool -> group, group, MDL))
-		log_fatal ("can't clone pool group");
+		log_fatal ("can't clone pool group.");
 
 	if (type == SUBNET_DECL)
 		shared_network_reference (&pool -> shared_network,
@@ -2547,8 +2550,15 @@ int parse_lease_declaration (struct lease **lp, struct parse *cfile)
 			
 			seenbit = 0;
 		      special_set:
-			binding = find_binding (&lease -> scope, val);
+			if (lease -> scope)
+				binding = find_binding (lease -> scope, val);
+			else
+				binding = (struct binding *)0;
 			if (!binding) {
+			    if (!lease -> scope)
+				if (!(binding_scope_allocate
+				      (&lease -> scope, MDL)))
+					log_fatal ("no memory for scope");
 				binding = dmalloc (sizeof *binding, MDL);
 				if (!binding)
 					log_fatal ("No memory for lease %s.",
@@ -2657,8 +2667,8 @@ int parse_lease_declaration (struct lease **lp, struct parse *cfile)
 			}
 				
 			if (newbinding) {
-				binding -> next = lease -> scope.bindings;
-				lease -> scope.bindings = binding;
+				binding -> next = lease -> scope -> bindings;
+				lease -> scope -> bindings = binding;
 			}
 			parse_semi (cfile);
 			break;
diff --git a/server/db.c b/server/db.c
index 0b4156c73..776028f38 100644
--- a/server/db.c
+++ b/server/db.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: db.c,v 1.53 2000/07/05 07:33:25 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: db.c,v 1.54 2000/07/27 09:03:02 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -196,7 +196,8 @@ int write_lease (lease)
 			putc (';', db_file);
 		}
 	}
-	for (b = lease -> scope.bindings; b; b = b -> next) {
+	if (lease -> scope) {
+	    for (b = lease -> scope -> bindings; b; b = b -> next) {
 		if (!b -> value)
 			continue;
 		if (b -> value -> type == binding_data) {
@@ -257,6 +258,7 @@ int write_lease (lease)
 			log_error ("%s: unknown binding type %d",
 				   b -> name, b -> value -> type);
 		}
+	    }
 	}
 	if (lease -> client_hostname &&
 	    db_printable (lease -> client_hostname)) {
diff --git a/server/dhcp.c b/server/dhcp.c
index 487ea1d19..8a148ef89 100644
--- a/server/dhcp.c
+++ b/server/dhcp.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: dhcp.c,v 1.156 2000/07/06 10:16:54 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: dhcp.c,v 1.157 2000/07/27 09:03:04 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -197,8 +197,8 @@ void dhcpdiscover (packet, ms_nulltp)
 #endif
 
 	/* If it's an expired lease, get rid of any bindings. */
-	if (lease -> ends < cur_time && lease -> scope.bindings)
-		free_bindings (&lease -> scope, MDL);
+	if (lease -> ends < cur_time && lease -> scope)
+		binding_scope_dereference (&lease -> scope, MDL);
 
 	/* Set the lease to really expire in 2 minutes, unless it has
 	   not yet expired, in which case leave its expiry time alone. */
@@ -1745,8 +1745,10 @@ void ack_lease (packet, lease, offer, when, msg, ms_nulltp)
 	}
 
 	/* Save any bindings. */
-	lt -> scope.bindings = lease -> scope.bindings;
-	lease -> scope.bindings = (struct binding *)0;
+	if (lease -> scope) {
+		binding_scope_reference (&lt -> scope, lease -> scope, MDL);
+		binding_scope_dereference (&lease -> scope, MDL);
+	}
 
 	/* Replace the old lease hostname with the new one, if it's changed. */
 	oc = lookup_option (&dhcp_universe, packet -> options, DHO_HOST_NAME);
@@ -3037,7 +3039,7 @@ void static_lease_dereference (lease, file, line)
 		executable_statement_dereference (&lease -> on_commit,
 						  file, line);
 	if (&lease -> scope)
-		free_bindings (&lease -> scope, file, line);
+		binding_scope_dereference (&lease -> scope, file, line);
 	if (lease -> uid != lease -> uid_buf) {
 		dfree (lease -> uid, file, line);
 		lease -> uid = (unsigned char *)0;
diff --git a/server/dhcpd.c b/server/dhcpd.c
index d234da462..4e7e57e49 100644
--- a/server/dhcpd.c
+++ b/server/dhcpd.c
@@ -43,15 +43,14 @@
 
 #ifndef lint
 static char ocopyright[] =
-"$Id: dhcpd.c,v 1.96 2000/07/17 20:56:08 mellon Exp $ Copyright 1995-2000 Internet Software Consortium.";
+"$Id: dhcpd.c,v 1.97 2000/07/27 09:03:05 mellon Exp $ Copyright 1995-2000 Internet Software Consortium.";
 #endif
 
   static char copyright[] =
 "Copyright 1995-2000 Internet Software Consortium.";
 static char arr [] = "All rights reserved.";
 static char message [] = "Internet Software Consortium DHCP Server";
-static char contrib [] = "\nPlease contribute if you find this software useful.";
-static char url [] = "For info, please visit http://www.isc.org/dhcp-contrib.html\n";
+static char url [] = "For info, please visit http://www.isc.org/dhcp-contrib.html";
 
 #include "dhcpd.h"
 #include "version.h"
@@ -60,7 +59,6 @@ static char url [] = "For info, please visit http://www.isc.org/dhcp-contrib.htm
 static void usage PROTO ((void));
 
 TIME cur_time;
-struct binding_scope global_scope;
 
 struct iaddr server_identifier;
 int server_identifier_matched;
@@ -288,7 +286,6 @@ int main (argc, argv, envp)
 		log_info ("%s %s", message, DHCP_VERSION);
 		log_info (copyright);
 		log_info (arr);
-		log_info (contrib);
 		log_info (url);
 	} else {
 		quiet = 0;
diff --git a/server/dhcpd.conf.5 b/server/dhcpd.conf.5
index bb4a44199..38f643614 100644
--- a/server/dhcpd.conf.5
+++ b/server/dhcpd.conf.5
@@ -1198,7 +1198,7 @@ from zero (Sunday) to six (Saturday).  YYYY is the year, including the
 century.  MM is the month expressed as a number from 1 to 12.  DD is
 the day of the month, counting from 1.  HH is the hour, from zero to
 23.  MM is the minute and SS is the second.  The time is always in
-Greenwich Mean Time (GMT), not local time.
+Coordinated Universal Time (UTC), not local time.
 .PP
 .B The
 .I dynamic-bootp-lease-length
diff --git a/server/mdb.c b/server/mdb.c
index a6d2e4281..d9bf52a05 100644
--- a/server/mdb.c
+++ b/server/mdb.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: mdb.c,v 1.40 2000/07/09 07:00:06 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: mdb.c,v 1.41 2000/07/27 09:03:08 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -547,11 +547,8 @@ isc_result_t dhcp_lease_free (omapi_object_t *lo,
 	if (lo -> type != dhcp_type_lease)
 		return ISC_R_INVALIDARG;
 	lease = (struct lease *)lo;
-	if (free_leases) {
-		lease_reference (&lease -> next, free_leases, file, line);
-		lease_dereference (&free_leases, file, line);
-	}
-	lease_reference (&free_leases, lease, MDL);
+	lease -> next = free_leases;
+	free_leases = lease;
 	return ISC_R_SUCCESS;
 }
 
@@ -559,15 +556,12 @@ isc_result_t dhcp_lease_get (omapi_object_t **lp,
 			     const char *file, int line)
 {
 	struct lease **lease = (struct lease **)lp;
+	struct lease *lt;
 
 	if (free_leases) {
-		lease_reference (lease, free_leases, file, line);
-		lease_dereference (&free_leases, file, line);
-		if ((*lease) -> next) {
-			lease_reference (&free_leases, (*lease) -> next,
-					 file, line);
-			lease_dereference (&(*lease) -> next, file, line);
-		}
+		lt = free_leases;
+		free_leases = lt -> next;
+		*lease = lt;
 		return ISC_R_SUCCESS;
 	}
 	return ISC_R_NOMEMORY;
@@ -861,10 +855,12 @@ int supersede_lease (comp, lease, commit, propogate, pimmediate)
 	comp -> hardware_addr = lease -> hardware_addr;
 	comp -> flags = ((lease -> flags & ~PERSISTENT_FLAGS) |
 			 (comp -> flags & ~EPHEMERAL_FLAGS));
-	if (comp -> scope.bindings)
-		free_bindings (&comp -> scope, MDL);
-	comp -> scope.bindings = lease -> scope.bindings;
-	lease -> scope.bindings = (struct binding *)0;
+	if (comp -> scope)
+		binding_scope_dereference (&comp -> scope, MDL);
+	if (lease -> scope) {
+		binding_scope_reference (&comp -> scope, lease -> scope, MDL);
+		binding_scope_dereference (&lease -> scope, MDL);
+	}
 
 	/* Record the hostname information in the lease. */
 	if (comp -> hostname)
@@ -1139,7 +1135,8 @@ int lease_copy (struct lease **lp,
 		}
 		strcpy (lt -> client_hostname, lease -> client_hostname);
 	}
-	lt -> scope = lease -> scope;
+	if (lease -> scope)
+		binding_scope_reference (&lt -> scope, lease -> scope, MDL);
 	host_reference (&lt -> host, lease -> host, file, line);
 	subnet_reference (&lt -> subnet, lease -> subnet, file, line);
 	pool_reference (&lt -> pool, lease -> pool, file, line);
@@ -1197,8 +1194,8 @@ void release_lease (lease, packet)
 							  MDL);
 
 		/* Blow away any bindings. */
-		/* XXX free them?!? */
-		lease -> scope.bindings = (struct binding *)0;
+		if (lease -> scope)
+			binding_scope_dereference (&lease -> scope, MDL);
 		lease -> ends = cur_time;
 #if defined (FAILOVER_PROTOCOL)
 		if (lease -> pool && lease -> pool -> failover_peer) {
@@ -1235,7 +1232,8 @@ void abandon_lease (lease, message)
 		executable_statement_dereference (&lease -> on_commit, MDL);
 
 	/* Blow away any bindings. */
-	lt -> scope.bindings = (struct binding *)0;
+	if (lt -> scope)
+		binding_scope_dereference (&lt -> scope, MDL);
 	lt -> ends = cur_time; /* XXX */
 	lt -> next_binding_state = FTS_ABANDONED;
 
@@ -1272,7 +1270,8 @@ void dissociate_lease (lease)
 		executable_statement_dereference (&lease -> on_commit, MDL);
 
 	/* Blow away any bindings. */
-	lt -> scope.bindings = (struct binding *)0;
+	if (lt -> scope)
+		binding_scope_dereference (&lt -> scope, MDL);
 
 #if defined (FAILOVER_PROTOCOL)
 	if (lease -> pool && lease -> pool -> failover_peer) {