loophole with limiting leases per client

[Ted Lemon]

> Or how about, even simpler, a switch which tells
> the server to only consider hardware addresses when searching for and
> assigning leases?

I really don't like this as a global modification, although it would
probably be safe in your situation.   The correct thing would be to
simply not let a host declaration with a hardware address ever match a
client that send a client identifier.   Of course, this would cause
major breakage, since it's quite common for people to use the hardware
statement even for clients that *do* send client identifiers.   :'(

I'll have to think about how to solve this.   I think it's doable, but
it will require some thought.

			       _MelloN_