1 | /* $Id: proxy_tftpd.c 63279 2016-08-10 14:41:40Z vboxsync $ */
|
---|
2 | /** @file
|
---|
3 | * NAT Network - TFTP server.
|
---|
4 | */
|
---|
5 |
|
---|
6 | /*
|
---|
7 | * Copyright (C) 2013-2016 Oracle Corporation
|
---|
8 | *
|
---|
9 | * This file is part of VirtualBox Open Source Edition (OSE), as
|
---|
10 | * available from http://www.virtualbox.org. This file is free software;
|
---|
11 | * you can redistribute it and/or modify it under the terms of the GNU
|
---|
12 | * General Public License (GPL) as published by the Free Software
|
---|
13 | * Foundation, in version 2 as it comes in the "COPYING" file of the
|
---|
14 | * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
|
---|
15 | * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
|
---|
16 | */
|
---|
17 |
|
---|
18 | #define LOG_GROUP LOG_GROUP_NAT_SERVICE
|
---|
19 |
|
---|
20 | #include "winutils.h"
|
---|
21 |
|
---|
22 | #include "proxy.h"
|
---|
23 | #include "tftp.h"
|
---|
24 |
|
---|
25 | #ifndef RT_OS_WINDOWS
|
---|
26 | #include <sys/types.h>
|
---|
27 | #include <sys/stat.h>
|
---|
28 | #include <errno.h>
|
---|
29 | #include <fcntl.h>
|
---|
30 | #include <stdarg.h>
|
---|
31 | #include <stdio.h>
|
---|
32 | #include <string.h>
|
---|
33 | #include <unistd.h>
|
---|
34 | #else
|
---|
35 | #include <sys/types.h>
|
---|
36 | #include <sys/stat.h>
|
---|
37 | #include <errno.h>
|
---|
38 | #include <fcntl.h>
|
---|
39 | #include <io.h>
|
---|
40 | #include <stdarg.h>
|
---|
41 | #include <stdio.h>
|
---|
42 | #include <string.h>
|
---|
43 |
|
---|
44 | # define O_RDONLY _O_RDONLY
|
---|
45 | # define S_ISREG(x) ((x) & _S_IFREG)
|
---|
46 | #endif
|
---|
47 |
|
---|
48 | #include "lwip/timers.h"
|
---|
49 | #include "lwip/udp.h"
|
---|
50 |
|
---|
51 | #include <iprt/string.h>
|
---|
52 |
|
---|
53 | struct xfer {
|
---|
54 | struct udp_pcb *pcb;
|
---|
55 | int fd;
|
---|
56 | unsigned int ack;
|
---|
57 | struct pbuf *pbuf;
|
---|
58 |
|
---|
59 | struct pbuf *oack;
|
---|
60 |
|
---|
61 | int rexmit;
|
---|
62 |
|
---|
63 | ipX_addr_t peer_ip;
|
---|
64 | u16_t peer_port;
|
---|
65 |
|
---|
66 | char *filename;
|
---|
67 | int octet;
|
---|
68 |
|
---|
69 | /* options */
|
---|
70 | unsigned int blksize;
|
---|
71 | int blksize_from_opt;
|
---|
72 |
|
---|
73 | unsigned int timeout;
|
---|
74 | int timeout_from_opt;
|
---|
75 |
|
---|
76 | off_t tsize;
|
---|
77 | int tsize_from_opt;
|
---|
78 | };
|
---|
79 |
|
---|
80 | struct tftpd {
|
---|
81 | struct udp_pcb *pcb;
|
---|
82 | char *root;
|
---|
83 |
|
---|
84 | #define TFTP_MAX_XFERS 3
|
---|
85 | struct xfer xfers[TFTP_MAX_XFERS];
|
---|
86 | };
|
---|
87 |
|
---|
88 | struct tftp_option {
|
---|
89 | const char *name;
|
---|
90 | int (*getopt)(struct xfer *, const char *);
|
---|
91 | int (*ackopt)(struct xfer *, char **, size_t *);
|
---|
92 | };
|
---|
93 |
|
---|
94 |
|
---|
95 | static void tftpd_recv(void *, struct udp_pcb *, struct pbuf *, ip_addr_t *, u16_t);
|
---|
96 |
|
---|
97 | static void tftpd_rrq(struct pbuf *, ip_addr_t *, u16_t);
|
---|
98 |
|
---|
99 | static void tftp_xfer_recv(void *, struct udp_pcb *, struct pbuf *, ip_addr_t *, u16_t);
|
---|
100 |
|
---|
101 | static void tftp_recv_ack(struct xfer *, u16_t);
|
---|
102 | static void tftp_fillbuf(struct xfer *);
|
---|
103 | static void tftp_send(struct xfer *);
|
---|
104 | static void tftp_timeout(void *);
|
---|
105 |
|
---|
106 | static struct xfer *tftp_xfer_alloc(ip_addr_t *, u16_t);
|
---|
107 | static int tftp_xfer_create_pcb(struct xfer *);
|
---|
108 | static void tftp_xfer_free(struct xfer *);
|
---|
109 |
|
---|
110 | static int tftp_parse_filename(struct xfer *, char **, size_t *);
|
---|
111 | static int tftp_parse_mode(struct xfer *, char **, size_t *);
|
---|
112 | static int tftp_parse_option(struct xfer *, char **, size_t *);
|
---|
113 |
|
---|
114 | static int tftp_opt_blksize(struct xfer *, const char *);
|
---|
115 | static int tftp_opt_timeout(struct xfer *, const char *);
|
---|
116 | static int tftp_opt_tsize(struct xfer *, const char *);
|
---|
117 |
|
---|
118 | static char *tftp_getstr(struct xfer *, const char *, char **, size_t *);
|
---|
119 |
|
---|
120 | static int tftp_ack_blksize(struct xfer *, char **, size_t *);
|
---|
121 | static int tftp_ack_timeout(struct xfer *, char **, size_t *);
|
---|
122 | static int tftp_ack_tsize(struct xfer *, char **, size_t *);
|
---|
123 |
|
---|
124 | static int tftp_add_oack(char **, size_t *, const char *, const char *, ...) __attribute__((format(printf, 4, 5)));
|
---|
125 |
|
---|
126 | static ssize_t tftp_strnlen(char *, size_t);
|
---|
127 |
|
---|
128 | static int tftp_internal_error(struct xfer *);
|
---|
129 | static int tftp_error(struct xfer *, u16_t, const char *, ...) __attribute__((format(printf, 3, 4)));
|
---|
130 | static void tftpd_error(ip_addr_t *, u16_t, u16_t, const char *, ...) __attribute__((format(printf, 4, 5)));
|
---|
131 | static struct pbuf *tftp_verror(u16_t, const char *, va_list);
|
---|
132 |
|
---|
133 |
|
---|
134 | /* const */ int report_transient_errors = 1;
|
---|
135 | static struct tftpd tftpd;
|
---|
136 |
|
---|
137 | static struct tftp_option tftp_options[] = {
|
---|
138 | { "blksize", tftp_opt_blksize, tftp_ack_blksize }, /* RFC 2348 */
|
---|
139 | { "timeout", tftp_opt_timeout, tftp_ack_timeout }, /* RFC 2349 */
|
---|
140 | { "tsize", tftp_opt_tsize, tftp_ack_tsize }, /* RFC 2349 */
|
---|
141 | { NULL, NULL, NULL }
|
---|
142 | };
|
---|
143 |
|
---|
144 |
|
---|
145 | err_t
|
---|
146 | tftpd_init(struct netif *proxy_netif, const char *tftproot)
|
---|
147 | {
|
---|
148 | size_t len;
|
---|
149 | err_t error;
|
---|
150 |
|
---|
151 | tftpd.root = strdup(tftproot);
|
---|
152 | if (tftpd.root == NULL) {
|
---|
153 | DPRINTF0(("%s: failed to allocate tftpd.root\n", __func__));
|
---|
154 | return ERR_MEM;
|
---|
155 | }
|
---|
156 |
|
---|
157 | len = strlen(tftproot);
|
---|
158 | if (tftpd.root[len - 1] == '/') {
|
---|
159 | tftpd.root[len - 1] = '\0';
|
---|
160 | }
|
---|
161 |
|
---|
162 | tftpd.pcb = udp_new();
|
---|
163 | if (tftpd.pcb == NULL) {
|
---|
164 | DPRINTF0(("%s: failed to allocate PCB\n", __func__));
|
---|
165 | return ERR_MEM;
|
---|
166 | }
|
---|
167 |
|
---|
168 | udp_recv(tftpd.pcb, tftpd_recv, NULL);
|
---|
169 |
|
---|
170 | error = udp_bind(tftpd.pcb, &proxy_netif->ip_addr, TFTP_SERVER_PORT);
|
---|
171 | if (error != ERR_OK) {
|
---|
172 | DPRINTF0(("%s: failed to bind PCB\n", __func__));
|
---|
173 | return error;
|
---|
174 | }
|
---|
175 |
|
---|
176 | return ERR_OK;
|
---|
177 | }
|
---|
178 |
|
---|
179 |
|
---|
180 | static void
|
---|
181 | tftpd_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p,
|
---|
182 | ip_addr_t *addr, u16_t port)
|
---|
183 | {
|
---|
184 | u16_t op;
|
---|
185 |
|
---|
186 | LWIP_ASSERT1(pcb == tftpd.pcb);
|
---|
187 |
|
---|
188 | LWIP_UNUSED_ARG(pcb); /* only in assert */
|
---|
189 | LWIP_UNUSED_ARG(arg);
|
---|
190 |
|
---|
191 | if (pbuf_clen(p) > 1) { /* this code assumes contiguous aligned payload */
|
---|
192 | pbuf_free(p);
|
---|
193 | return;
|
---|
194 | }
|
---|
195 |
|
---|
196 | op = ntohs(*(u16_t *)p->payload);
|
---|
197 | switch (op) {
|
---|
198 | case TFTP_RRQ:
|
---|
199 | tftpd_rrq(p, addr, port);
|
---|
200 | break;
|
---|
201 |
|
---|
202 | case TFTP_WRQ:
|
---|
203 | tftpd_error(addr, port, TFTP_EACCESS, "Permission denied");
|
---|
204 | break;
|
---|
205 |
|
---|
206 | default:
|
---|
207 | tftpd_error(addr, port, TFTP_ENOSYS, "Bad opcode %d", op);
|
---|
208 | break;
|
---|
209 | }
|
---|
210 |
|
---|
211 | pbuf_free(p);
|
---|
212 | }
|
---|
213 |
|
---|
214 |
|
---|
215 | /**
|
---|
216 | * Parse Read Request packet and start new transfer.
|
---|
217 | */
|
---|
218 | static void
|
---|
219 | tftpd_rrq(struct pbuf *p, ip_addr_t *addr, u16_t port)
|
---|
220 | {
|
---|
221 | struct xfer *xfer;
|
---|
222 | char *s;
|
---|
223 | size_t len;
|
---|
224 | int has_options;
|
---|
225 | int status;
|
---|
226 |
|
---|
227 | xfer = tftp_xfer_alloc(addr, port);
|
---|
228 | if (xfer == NULL) {
|
---|
229 | return;
|
---|
230 | }
|
---|
231 |
|
---|
232 | /* skip opcode */
|
---|
233 | s = (char *)p->payload + sizeof(u16_t);
|
---|
234 | len = p->len - sizeof(u16_t);
|
---|
235 |
|
---|
236 |
|
---|
237 | /*
|
---|
238 | * Parse RRQ:
|
---|
239 | * filename, mode, [opt1, value1, [...] ]
|
---|
240 | */
|
---|
241 | status = tftp_parse_filename(xfer, &s, &len);
|
---|
242 | if (status < 0) {
|
---|
243 | goto terminate;
|
---|
244 | }
|
---|
245 |
|
---|
246 | status = tftp_parse_mode(xfer, &s, &len);
|
---|
247 | if (status < 0) {
|
---|
248 | goto terminate;
|
---|
249 | }
|
---|
250 |
|
---|
251 | has_options = 0;
|
---|
252 | while (len > 0) {
|
---|
253 | status = tftp_parse_option(xfer, &s, &len);
|
---|
254 | if (status < 0) {
|
---|
255 | goto terminate;
|
---|
256 | }
|
---|
257 | has_options += status;
|
---|
258 | }
|
---|
259 |
|
---|
260 |
|
---|
261 | /*
|
---|
262 | * Create OACK packet if necessary.
|
---|
263 | */
|
---|
264 | if (has_options) {
|
---|
265 | xfer->oack = pbuf_alloc(PBUF_RAW, 128, PBUF_RAM);
|
---|
266 | if (xfer->oack != NULL) {
|
---|
267 | struct tftp_option *o;
|
---|
268 |
|
---|
269 | ((u16_t *)xfer->oack->payload)[0] = PP_HTONS(TFTP_OACK);
|
---|
270 |
|
---|
271 | s = (char *)xfer->oack->payload + sizeof(u16_t);
|
---|
272 | len = xfer->oack->len - sizeof(u16_t);
|
---|
273 |
|
---|
274 | for (o = &tftp_options[0]; o->name != NULL; ++o) {
|
---|
275 | status = (*o->ackopt)(xfer, &s, &len);
|
---|
276 | if (status < 0) {
|
---|
277 | pbuf_free(xfer->oack);
|
---|
278 | xfer->oack = NULL;
|
---|
279 | break;
|
---|
280 | }
|
---|
281 | }
|
---|
282 |
|
---|
283 | if (xfer->oack != NULL) {
|
---|
284 | Assert((u16_t)(xfer->oack->len - len) == xfer->oack->len - len);
|
---|
285 | pbuf_realloc(xfer->oack, (u16_t)(xfer->oack->len - len));
|
---|
286 | }
|
---|
287 | }
|
---|
288 | }
|
---|
289 |
|
---|
290 |
|
---|
291 | /*
|
---|
292 | * Create static pbuf that will be used for all data packets.
|
---|
293 | */
|
---|
294 | xfer->pbuf = pbuf_alloc(PBUF_RAW, xfer->blksize + 4, PBUF_RAM);
|
---|
295 | if (xfer->pbuf == NULL) {
|
---|
296 | tftp_internal_error(xfer);
|
---|
297 | goto terminate;
|
---|
298 | }
|
---|
299 | ((u16_t *)xfer->pbuf->payload)[0] = PP_HTONS(TFTP_DATA);
|
---|
300 |
|
---|
301 |
|
---|
302 | /*
|
---|
303 | * Finally, create PCB. Before this point any error was reported
|
---|
304 | * from the server port (see tftp_error() for the reason).
|
---|
305 | */
|
---|
306 | status = tftp_xfer_create_pcb(xfer);
|
---|
307 | if (status < 0) {
|
---|
308 | goto terminate;
|
---|
309 | }
|
---|
310 |
|
---|
311 | if (xfer->oack) {
|
---|
312 | tftp_send(xfer);
|
---|
313 | }
|
---|
314 | else {
|
---|
315 | /* trigger send of the first data packet */
|
---|
316 | tftp_recv_ack(xfer, 0);
|
---|
317 | }
|
---|
318 |
|
---|
319 | return;
|
---|
320 |
|
---|
321 | terminate:
|
---|
322 | DPRINTF(("%s: terminated", __func__));
|
---|
323 | tftp_xfer_free(xfer);
|
---|
324 | }
|
---|
325 |
|
---|
326 |
|
---|
327 | static void
|
---|
328 | tftp_xfer_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p,
|
---|
329 | ip_addr_t *addr, u16_t port)
|
---|
330 | {
|
---|
331 | struct xfer *xfer = (struct xfer *)arg;
|
---|
332 | u16_t op;
|
---|
333 |
|
---|
334 | LWIP_UNUSED_ARG(pcb); /* assert only */
|
---|
335 | LWIP_UNUSED_ARG(addr);
|
---|
336 | LWIP_UNUSED_ARG(port);
|
---|
337 |
|
---|
338 | LWIP_ASSERT1(xfer->pcb == pcb);
|
---|
339 |
|
---|
340 | if (p->len < 2) {
|
---|
341 | tftp_error(xfer, TFTP_ENOSYS, "Short packet");
|
---|
342 | tftp_xfer_free(xfer);
|
---|
343 | pbuf_free(p);
|
---|
344 | return;
|
---|
345 | }
|
---|
346 |
|
---|
347 | op = ntohs(*(u16_t *)p->payload);
|
---|
348 | if (op == TFTP_ACK) {
|
---|
349 | u16_t ack;
|
---|
350 |
|
---|
351 | if (p->len < 4) {
|
---|
352 | tftp_error(xfer, TFTP_ENOSYS, "Short packet");
|
---|
353 | tftp_xfer_free(xfer);
|
---|
354 | pbuf_free(p);
|
---|
355 | return;
|
---|
356 | }
|
---|
357 |
|
---|
358 | ack = ntohs(((u16_t *)p->payload)[1]);
|
---|
359 | tftp_recv_ack(xfer, ack);
|
---|
360 | }
|
---|
361 | else if (op == TFTP_ERROR) {
|
---|
362 | tftp_xfer_free(xfer);
|
---|
363 | }
|
---|
364 | else {
|
---|
365 | tftp_error(xfer, TFTP_ENOSYS, "Unexpected opcode %d", op);
|
---|
366 | tftp_xfer_free(xfer);
|
---|
367 | }
|
---|
368 |
|
---|
369 | pbuf_free(p);
|
---|
370 | }
|
---|
371 |
|
---|
372 |
|
---|
373 | static void
|
---|
374 | tftp_recv_ack(struct xfer *xfer, u16_t ack)
|
---|
375 | {
|
---|
376 | if (ack != (u16_t)xfer->ack) {
|
---|
377 | DPRINTF2(("%s: expect %u (%u), got %u\n",
|
---|
378 | __func__, (u16_t)xfer->ack, xfer->ack, ack));
|
---|
379 | return;
|
---|
380 | }
|
---|
381 |
|
---|
382 | sys_untimeout(tftp_timeout, xfer);
|
---|
383 | xfer->rexmit = 0;
|
---|
384 |
|
---|
385 | if (xfer->pbuf->len < xfer->blksize) {
|
---|
386 | DPRINTF(("%s: got final ack %u (%u)\n",
|
---|
387 | __func__, (u16_t)xfer->ack, xfer->ack));
|
---|
388 | tftp_xfer_free(xfer);
|
---|
389 | return;
|
---|
390 | }
|
---|
391 |
|
---|
392 | if (xfer->oack != NULL) {
|
---|
393 | pbuf_free(xfer->oack);
|
---|
394 | xfer->oack = NULL;
|
---|
395 | }
|
---|
396 |
|
---|
397 | ++xfer->ack;
|
---|
398 | tftp_fillbuf(xfer);
|
---|
399 | tftp_send(xfer);
|
---|
400 | }
|
---|
401 |
|
---|
402 |
|
---|
403 | static void
|
---|
404 | tftp_send(struct xfer *xfer)
|
---|
405 | {
|
---|
406 | struct pbuf *pbuf;
|
---|
407 |
|
---|
408 | pbuf = xfer->oack ? xfer->oack : xfer->pbuf;
|
---|
409 | udp_send(xfer->pcb, pbuf);
|
---|
410 | sys_timeout(xfer->timeout * 1000, tftp_timeout, xfer);
|
---|
411 | }
|
---|
412 |
|
---|
413 |
|
---|
414 | static void
|
---|
415 | tftp_timeout(void *arg)
|
---|
416 | {
|
---|
417 | struct xfer *xfer = (struct xfer *)arg;
|
---|
418 | int maxrexmit;
|
---|
419 |
|
---|
420 | maxrexmit = xfer->timeout < 60 ? 5 : 3;
|
---|
421 | if (++xfer->rexmit < maxrexmit) {
|
---|
422 | tftp_send(xfer);
|
---|
423 | }
|
---|
424 | else {
|
---|
425 | tftp_xfer_free(xfer);
|
---|
426 | }
|
---|
427 | }
|
---|
428 |
|
---|
429 |
|
---|
430 | static void
|
---|
431 | tftp_fillbuf(struct xfer *xfer)
|
---|
432 | {
|
---|
433 | ssize_t nread;
|
---|
434 |
|
---|
435 | DPRINTF2(("%s: reading block %u\n", __func__, xfer->ack));
|
---|
436 |
|
---|
437 | ((u16_t *)xfer->pbuf->payload)[1] = htons(xfer->ack);
|
---|
438 | nread = read(xfer->fd, (char *)xfer->pbuf->payload + 4, xfer->blksize);
|
---|
439 |
|
---|
440 | if (nread < 0) {
|
---|
441 | tftp_error(xfer, TFTP_EUNDEF, "Read failed");
|
---|
442 | return;
|
---|
443 | }
|
---|
444 |
|
---|
445 | pbuf_realloc(xfer->pbuf, nread + 4);
|
---|
446 | }
|
---|
447 |
|
---|
448 |
|
---|
449 | /**
|
---|
450 | * Find a free transfer slot (without a pcb). Record peer's IP
|
---|
451 | * address and port, but don't allocate a pcb yet.
|
---|
452 | *
|
---|
453 | * We delay creation of the pcb in response to the original request
|
---|
454 | * until the request is verified and accepted. This makes using
|
---|
455 | * tcpdump(8) easier, since tcpdump does not track TFTP transfers, so
|
---|
456 | * an error reply from a new pcb is not recognized as such and is not
|
---|
457 | * decoded as TFTP (see tftp_error()).
|
---|
458 | *
|
---|
459 | * If the request is rejected, the pcb remains NULL and the transfer
|
---|
460 | * slot remains unallocated. Since all TFTP processing happens on the
|
---|
461 | * lwIP thread, there's no concurrent processing, so we don't need to
|
---|
462 | * "lock" the transfer slot until the pcb is allocated.
|
---|
463 | */
|
---|
464 | static struct xfer *
|
---|
465 | tftp_xfer_alloc(ip_addr_t *addr, u16_t port)
|
---|
466 | {
|
---|
467 | struct xfer *xfer;
|
---|
468 | int i;
|
---|
469 |
|
---|
470 | /* Find free xfer slot */
|
---|
471 | xfer = NULL;
|
---|
472 | for (i = 0; i < TFTP_MAX_XFERS; ++i) {
|
---|
473 | if (tftpd.xfers[i].pcb == NULL) {
|
---|
474 | xfer = &tftpd.xfers[i];
|
---|
475 | break;
|
---|
476 | }
|
---|
477 | }
|
---|
478 |
|
---|
479 | if (xfer == NULL) {
|
---|
480 | if (report_transient_errors) {
|
---|
481 | tftpd_error(addr, port, TFTP_EUNDEF,
|
---|
482 | "Maximum number of simultaneous connections exceeded");
|
---|
483 | }
|
---|
484 | return NULL;
|
---|
485 | }
|
---|
486 |
|
---|
487 | ipX_addr_copy(0, xfer->peer_ip, *ip_2_ipX(addr));
|
---|
488 | xfer->peer_port = port;
|
---|
489 |
|
---|
490 | xfer->ack = 0;
|
---|
491 |
|
---|
492 | xfer->pbuf = NULL;
|
---|
493 | xfer->oack = NULL;
|
---|
494 | xfer->rexmit = 0;
|
---|
495 |
|
---|
496 | xfer->blksize = 512;
|
---|
497 | xfer->blksize_from_opt = 0;
|
---|
498 |
|
---|
499 | xfer->timeout = 1;
|
---|
500 | xfer->timeout_from_opt = 0;
|
---|
501 |
|
---|
502 | xfer->tsize = -1;
|
---|
503 | xfer->tsize_from_opt = 0;
|
---|
504 |
|
---|
505 | return xfer;
|
---|
506 | }
|
---|
507 |
|
---|
508 |
|
---|
509 | static int
|
---|
510 | tftp_xfer_create_pcb(struct xfer *xfer)
|
---|
511 | {
|
---|
512 | struct udp_pcb *pcb;
|
---|
513 | err_t error;
|
---|
514 |
|
---|
515 | pcb = udp_new();
|
---|
516 |
|
---|
517 | /* Bind */
|
---|
518 | if (pcb != NULL) {
|
---|
519 | error = udp_bind(pcb, ipX_2_ip(&tftpd.pcb->local_ip), 0);
|
---|
520 | if (error != ERR_OK) {
|
---|
521 | udp_remove(pcb);
|
---|
522 | pcb = NULL;
|
---|
523 | }
|
---|
524 | }
|
---|
525 |
|
---|
526 | /* Connect */
|
---|
527 | if (pcb != NULL) {
|
---|
528 | error = udp_connect(pcb, ipX_2_ip(&xfer->peer_ip), xfer->peer_port);
|
---|
529 | if (error != ERR_OK) {
|
---|
530 | udp_remove(pcb);
|
---|
531 | pcb = NULL;
|
---|
532 | }
|
---|
533 | }
|
---|
534 |
|
---|
535 | if (pcb == NULL) {
|
---|
536 | if (report_transient_errors) {
|
---|
537 | tftp_error(xfer, TFTP_EUNDEF, "Failed to create connection");
|
---|
538 | }
|
---|
539 | return -1;
|
---|
540 | }
|
---|
541 |
|
---|
542 | xfer->pcb = pcb;
|
---|
543 | udp_recv(xfer->pcb, tftp_xfer_recv, xfer);
|
---|
544 |
|
---|
545 | return 0;
|
---|
546 | }
|
---|
547 |
|
---|
548 |
|
---|
549 | static void
|
---|
550 | tftp_xfer_free(struct xfer *xfer)
|
---|
551 | {
|
---|
552 | sys_untimeout(tftp_timeout, xfer);
|
---|
553 |
|
---|
554 | if (xfer->pcb != NULL) {
|
---|
555 | udp_remove(xfer->pcb);
|
---|
556 | xfer->pcb = NULL;
|
---|
557 | }
|
---|
558 |
|
---|
559 | if (xfer->fd > 0) {
|
---|
560 | close(xfer->fd);
|
---|
561 | xfer->fd = -1;
|
---|
562 | }
|
---|
563 |
|
---|
564 | if (xfer->oack != NULL) {
|
---|
565 | pbuf_free(xfer->oack);
|
---|
566 | xfer->oack = NULL;
|
---|
567 | }
|
---|
568 |
|
---|
569 | if (xfer->pbuf != NULL) {
|
---|
570 | pbuf_free(xfer->pbuf);
|
---|
571 | xfer->pbuf = NULL;
|
---|
572 | }
|
---|
573 |
|
---|
574 | if (xfer->filename != NULL) {
|
---|
575 | free(xfer->filename);
|
---|
576 | xfer->filename = NULL;
|
---|
577 | }
|
---|
578 | }
|
---|
579 |
|
---|
580 |
|
---|
581 | static int
|
---|
582 | tftp_parse_filename(struct xfer *xfer, char **ps, size_t *plen)
|
---|
583 | {
|
---|
584 | const char *filename;
|
---|
585 | struct stat st;
|
---|
586 | char *pathname;
|
---|
587 | char *s;
|
---|
588 | size_t len;
|
---|
589 | int status;
|
---|
590 |
|
---|
591 | filename = tftp_getstr(xfer, "filename", ps, plen);
|
---|
592 | if (filename == NULL) {
|
---|
593 | return -1;
|
---|
594 | }
|
---|
595 |
|
---|
596 | DPRINTF(("%s: requested file name: %s\n", __func__, filename));
|
---|
597 | xfer->filename = strdup(filename);
|
---|
598 | if (xfer->filename == NULL) {
|
---|
599 | return tftp_internal_error(xfer);
|
---|
600 | }
|
---|
601 |
|
---|
602 | /* replace backslashes with forward slashes */
|
---|
603 | s = xfer->filename;
|
---|
604 | while ((s = strchr(s, '\\')) != NULL) {
|
---|
605 | *s++ = '/';
|
---|
606 | }
|
---|
607 |
|
---|
608 | /* deny attempts to break out of tftp dir */
|
---|
609 | if (strncmp(xfer->filename, "../", 3) == 0
|
---|
610 | || strstr(xfer->filename, "/../") != NULL)
|
---|
611 | {
|
---|
612 | return tftp_error(xfer, TFTP_ENOENT, "Permission denied");
|
---|
613 | }
|
---|
614 |
|
---|
615 | len = strlen(tftpd.root) + 1 /*slash*/ + strlen(xfer->filename) + 1 /*nul*/;
|
---|
616 | pathname = (char *)malloc(len);
|
---|
617 | if (pathname == NULL) {
|
---|
618 | return tftp_internal_error(xfer);
|
---|
619 | }
|
---|
620 |
|
---|
621 | RTStrPrintf(pathname, len, "%s/%s", tftpd.root, xfer->filename);
|
---|
622 | /** @todo fix RTStrPrintf because this does not currently work:
|
---|
623 | * status = RTStrPrintf(pathname, len, "%s/%s", tftpd.root, xfer->filename);
|
---|
624 | * if (status < 0) {
|
---|
625 | * return tftp_internal_error(xfer);
|
---|
626 | * }
|
---|
627 | */
|
---|
628 |
|
---|
629 | DPRINTF(("%s: full pathname: %s\n", __func__, pathname));
|
---|
630 | xfer->fd = open(pathname, O_RDONLY);
|
---|
631 | if (xfer->fd < 0) {
|
---|
632 | if (errno == EPERM) {
|
---|
633 | return tftp_error(xfer, TFTP_ENOENT, "Permission denied");
|
---|
634 | }
|
---|
635 | else {
|
---|
636 | return tftp_error(xfer, TFTP_ENOENT, "File not found");
|
---|
637 | }
|
---|
638 | }
|
---|
639 |
|
---|
640 | status = fstat(xfer->fd, &st);
|
---|
641 | if (status < 0) {
|
---|
642 | return tftp_internal_error(xfer);
|
---|
643 | }
|
---|
644 |
|
---|
645 | if (!S_ISREG(st.st_mode)) {
|
---|
646 | return tftp_error(xfer, TFTP_ENOENT, "File not found");
|
---|
647 | }
|
---|
648 |
|
---|
649 | xfer->tsize = st.st_size;
|
---|
650 | return 0;
|
---|
651 | }
|
---|
652 |
|
---|
653 |
|
---|
654 | static int
|
---|
655 | tftp_parse_mode(struct xfer *xfer, char **ps, size_t *plen)
|
---|
656 | {
|
---|
657 | const char *modename;
|
---|
658 |
|
---|
659 | modename = tftp_getstr(xfer, "mode", ps, plen);
|
---|
660 | if (modename == NULL) {
|
---|
661 | return -1;
|
---|
662 | }
|
---|
663 |
|
---|
664 | if (RTStrICmp(modename, "octet") == 0) {
|
---|
665 | xfer->octet = 1;
|
---|
666 | }
|
---|
667 | else if (RTStrICmp(modename, "netascii") == 0) {
|
---|
668 | xfer->octet = 0;
|
---|
669 | /* XXX: not (yet?) */
|
---|
670 | return tftp_error(xfer, TFTP_ENOSYS, "Mode \"netascii\" not supported");
|
---|
671 | }
|
---|
672 | else if (RTStrICmp(modename, "mail") == 0) {
|
---|
673 | return tftp_error(xfer, TFTP_ENOSYS, "Mode \"mail\" not supported");
|
---|
674 | }
|
---|
675 | else {
|
---|
676 | return tftp_error(xfer, TFTP_ENOSYS, "Unknown mode \"%s\"", modename);
|
---|
677 | }
|
---|
678 |
|
---|
679 | return 0;
|
---|
680 | }
|
---|
681 |
|
---|
682 |
|
---|
683 | static int
|
---|
684 | tftp_parse_option(struct xfer *xfer, char **ps, size_t *plen)
|
---|
685 | {
|
---|
686 | const char *opt;
|
---|
687 | const char *val;
|
---|
688 | struct tftp_option *o;
|
---|
689 |
|
---|
690 | opt = tftp_getstr(xfer, "option name", ps, plen);
|
---|
691 | if (opt == NULL) {
|
---|
692 | return -1;
|
---|
693 | }
|
---|
694 |
|
---|
695 | if (*plen == 0) {
|
---|
696 | return tftp_error(xfer, TFTP_EUNDEF, "Missing option value");
|
---|
697 | }
|
---|
698 |
|
---|
699 | val = tftp_getstr(xfer, "option value", ps, plen);
|
---|
700 | if (val == NULL) {
|
---|
701 | return -1;
|
---|
702 | }
|
---|
703 |
|
---|
704 | /* handle option if known, ignore otherwise */
|
---|
705 | for (o = &tftp_options[0]; o->name != NULL; ++o) {
|
---|
706 | if (RTStrICmp(o->name, opt) == 0) {
|
---|
707 | return (*o->getopt)(xfer, val);
|
---|
708 | }
|
---|
709 | }
|
---|
710 |
|
---|
711 | return 0; /* unknown option */
|
---|
712 | }
|
---|
713 |
|
---|
714 |
|
---|
715 | static int
|
---|
716 | tftp_opt_blksize(struct xfer *xfer, const char *optval)
|
---|
717 | {
|
---|
718 | char *end;
|
---|
719 | long blksize;
|
---|
720 |
|
---|
721 | errno = 0;
|
---|
722 | blksize = strtol(optval, &end, 10);
|
---|
723 | if (errno != 0 || *end != '\0') {
|
---|
724 | return 0;
|
---|
725 | }
|
---|
726 |
|
---|
727 | if (blksize < 8) {
|
---|
728 | return 0;
|
---|
729 | }
|
---|
730 |
|
---|
731 | if (blksize > 1428) { /* exceeds ethernet mtu */
|
---|
732 | blksize = 1428;
|
---|
733 | }
|
---|
734 |
|
---|
735 | xfer->blksize = blksize;
|
---|
736 | xfer->blksize_from_opt = 1;
|
---|
737 | return 1;
|
---|
738 | }
|
---|
739 |
|
---|
740 |
|
---|
741 | static int
|
---|
742 | tftp_opt_timeout(struct xfer *xfer, const char *optval)
|
---|
743 | {
|
---|
744 | LWIP_UNUSED_ARG(xfer);
|
---|
745 | LWIP_UNUSED_ARG(optval);
|
---|
746 | return 0;
|
---|
747 | }
|
---|
748 |
|
---|
749 |
|
---|
750 | static int
|
---|
751 | tftp_opt_tsize(struct xfer *xfer, const char *optval)
|
---|
752 | {
|
---|
753 | LWIP_UNUSED_ARG(optval); /* must be "0", but we don't check it */
|
---|
754 |
|
---|
755 | if (xfer->tsize < 0) {
|
---|
756 | return 0;
|
---|
757 | }
|
---|
758 |
|
---|
759 | xfer->tsize_from_opt = 1;
|
---|
760 | return 1;
|
---|
761 | }
|
---|
762 |
|
---|
763 |
|
---|
764 | static char *
|
---|
765 | tftp_getstr(struct xfer *xfer, const char *msg, char **ps, size_t *plen)
|
---|
766 | {
|
---|
767 | char *s;
|
---|
768 | ssize_t slen;
|
---|
769 |
|
---|
770 | s = *ps;
|
---|
771 | slen = tftp_strnlen(s, *plen);
|
---|
772 | if (slen < 0) {
|
---|
773 | tftp_error(xfer, TFTP_EUNDEF, "Unterminated %s", msg);
|
---|
774 | return NULL;
|
---|
775 | }
|
---|
776 |
|
---|
777 | *ps += slen + 1;
|
---|
778 | *plen -= slen + 1;
|
---|
779 |
|
---|
780 | return s;
|
---|
781 | }
|
---|
782 |
|
---|
783 |
|
---|
784 | static int
|
---|
785 | tftp_ack_blksize(struct xfer *xfer, char **ps, size_t *plen)
|
---|
786 | {
|
---|
787 | if (!xfer->blksize_from_opt) {
|
---|
788 | return 0;
|
---|
789 | }
|
---|
790 |
|
---|
791 | return tftp_add_oack(ps, plen, "blksize", "%u", xfer->blksize);
|
---|
792 | }
|
---|
793 |
|
---|
794 |
|
---|
795 | static int
|
---|
796 | tftp_ack_timeout(struct xfer *xfer, char **ps, size_t *plen)
|
---|
797 | {
|
---|
798 | if (!xfer->timeout_from_opt) {
|
---|
799 | return 0;
|
---|
800 | }
|
---|
801 |
|
---|
802 | return tftp_add_oack(ps, plen, "timeout", "%u", xfer->timeout);
|
---|
803 | }
|
---|
804 |
|
---|
805 |
|
---|
806 | static int
|
---|
807 | tftp_ack_tsize(struct xfer *xfer, char **ps, size_t *plen)
|
---|
808 | {
|
---|
809 | if (!xfer->tsize_from_opt) {
|
---|
810 | return 0;
|
---|
811 | }
|
---|
812 |
|
---|
813 | LWIP_ASSERT1(xfer->tsize >= 0);
|
---|
814 | return tftp_add_oack(ps, plen, "tsize",
|
---|
815 | /* XXX: FIXME: want 64 bit */
|
---|
816 | "%lu", (unsigned long)xfer->tsize);
|
---|
817 | }
|
---|
818 |
|
---|
819 |
|
---|
820 | static int
|
---|
821 | tftp_add_oack(char **ps, size_t *plen,
|
---|
822 | const char *optname, const char *fmt, ...)
|
---|
823 | {
|
---|
824 | va_list ap;
|
---|
825 | int sz;
|
---|
826 |
|
---|
827 | /** @todo Fix RTStrPrintf because this doesn't really work.
|
---|
828 | * sz = RTStrPrintf(*ps, *plen, "%s", optname);
|
---|
829 | * if (sz < 0 || (size_t)sz >= *plen) {
|
---|
830 | * return -1;
|
---|
831 | * } */
|
---|
832 | sz = (int)RTStrPrintf(*ps, *plen, "%s", optname);
|
---|
833 | if (/*sz < 0 ||*/ (size_t)sz >= *plen) {
|
---|
834 | return -1;
|
---|
835 | }
|
---|
836 |
|
---|
837 | ++sz; /* for nul byte */
|
---|
838 | *ps += sz;
|
---|
839 | *plen -= sz;
|
---|
840 |
|
---|
841 | va_start(ap, fmt);
|
---|
842 | sz = vsnprintf(*ps, *plen, fmt, ap);
|
---|
843 | va_end(ap);
|
---|
844 | if (sz < 0 || (size_t)sz >= *plen) {
|
---|
845 | return -1;
|
---|
846 | }
|
---|
847 |
|
---|
848 | ++sz; /* for nul byte */
|
---|
849 | *ps += sz;
|
---|
850 | *plen -= sz;
|
---|
851 |
|
---|
852 | return 0;
|
---|
853 | }
|
---|
854 |
|
---|
855 |
|
---|
856 | static ssize_t
|
---|
857 | tftp_strnlen(char *buf, size_t bufsize)
|
---|
858 | {
|
---|
859 | void *end;
|
---|
860 |
|
---|
861 | end = memchr(buf, '\0', bufsize);
|
---|
862 | if (end == NULL) {
|
---|
863 | return -1;
|
---|
864 | }
|
---|
865 |
|
---|
866 | return (char *)end - buf;
|
---|
867 | }
|
---|
868 |
|
---|
869 |
|
---|
870 | static int
|
---|
871 | tftp_internal_error(struct xfer *xfer)
|
---|
872 | {
|
---|
873 | if (report_transient_errors) {
|
---|
874 | tftp_error(xfer, TFTP_EUNDEF, "Internal error");
|
---|
875 | }
|
---|
876 | return -1;
|
---|
877 | }
|
---|
878 |
|
---|
879 |
|
---|
880 | /**
|
---|
881 | * Send an error packet to the peer.
|
---|
882 | *
|
---|
883 | * PCB may not be created yet in which case send the error packet from
|
---|
884 | * the TFTP server port (*).
|
---|
885 | *
|
---|
886 | * (*) We delay creation of the PCB in response to the original
|
---|
887 | * request until the request is verified and accepted. This makes
|
---|
888 | * using tcpdump(8) easier, since tcpdump does not track TFTP
|
---|
889 | * transfers, so an error reply from a new PCB is not recognized as
|
---|
890 | * such and is not decoded as TFTP.
|
---|
891 | *
|
---|
892 | * Always returns -1 for callers to reuse.
|
---|
893 | */
|
---|
894 | static int
|
---|
895 | tftp_error(struct xfer *xfer, u16_t error, const char *fmt, ...)
|
---|
896 | {
|
---|
897 | va_list ap;
|
---|
898 | struct pbuf *q;
|
---|
899 |
|
---|
900 | LWIP_ASSERT1(xfer != NULL);
|
---|
901 |
|
---|
902 | va_start(ap, fmt);
|
---|
903 | q = tftp_verror(error, fmt, ap);
|
---|
904 | va_end(ap);
|
---|
905 |
|
---|
906 | if (q == NULL) {
|
---|
907 | return -1;
|
---|
908 | }
|
---|
909 |
|
---|
910 | if (xfer->pcb != NULL) {
|
---|
911 | udp_send(xfer->pcb, q);
|
---|
912 | }
|
---|
913 | else {
|
---|
914 | udp_sendto(tftpd.pcb, q, ipX_2_ip(&xfer->peer_ip), xfer->peer_port);
|
---|
915 | }
|
---|
916 |
|
---|
917 | pbuf_free(q);
|
---|
918 | return -1;
|
---|
919 | }
|
---|
920 |
|
---|
921 |
|
---|
922 | /**
|
---|
923 | * Send an error packet from TFTP server port to the specified peer.
|
---|
924 | */
|
---|
925 | static void
|
---|
926 | tftpd_error(ip_addr_t *addr, u16_t port, u16_t error, const char *fmt, ...)
|
---|
927 | {
|
---|
928 | va_list ap;
|
---|
929 | struct pbuf *q;
|
---|
930 |
|
---|
931 | va_start(ap, fmt);
|
---|
932 | q = tftp_verror(error, fmt, ap);
|
---|
933 | va_end(ap);
|
---|
934 |
|
---|
935 | if (q != NULL) {
|
---|
936 | udp_sendto(tftpd.pcb, q, addr, port);
|
---|
937 | pbuf_free(q);
|
---|
938 | }
|
---|
939 | }
|
---|
940 |
|
---|
941 |
|
---|
942 | /**
|
---|
943 | * Create ERROR pbuf with formatted error message.
|
---|
944 | */
|
---|
945 | static struct pbuf *
|
---|
946 | tftp_verror(u16_t error, const char *fmt, va_list ap)
|
---|
947 | {
|
---|
948 | struct tftp_error {
|
---|
949 | u16_t opcode; /* TFTP_ERROR */
|
---|
950 | u16_t errcode;
|
---|
951 | char errmsg[512];
|
---|
952 | };
|
---|
953 |
|
---|
954 | struct pbuf *p;
|
---|
955 | struct tftp_error *errpkt;
|
---|
956 | int msgsz;
|
---|
957 |
|
---|
958 | p = pbuf_alloc(PBUF_TRANSPORT, sizeof(*errpkt), PBUF_RAM);
|
---|
959 | if (p == NULL) {
|
---|
960 | return NULL;
|
---|
961 | }
|
---|
962 |
|
---|
963 | errpkt = (struct tftp_error *)p->payload;
|
---|
964 | errpkt->opcode = PP_HTONS(TFTP_ERROR);
|
---|
965 | errpkt->errcode = htons(error);
|
---|
966 |
|
---|
967 | msgsz = vsnprintf(errpkt->errmsg, sizeof(errpkt->errmsg), fmt, ap);
|
---|
968 | if (msgsz < 0) {
|
---|
969 | errpkt->errmsg[0] = '\0';
|
---|
970 | msgsz = 1;
|
---|
971 | }
|
---|
972 | else if ((size_t)msgsz < sizeof(errpkt->errmsg)) {
|
---|
973 | ++msgsz; /* for nul byte */
|
---|
974 | }
|
---|
975 | else {
|
---|
976 | msgsz = sizeof(errpkt->errmsg); /* truncated, includes nul byte */
|
---|
977 | }
|
---|
978 |
|
---|
979 | pbuf_realloc(p, sizeof(*errpkt) - sizeof(errpkt->errmsg) + msgsz);
|
---|
980 | return p;
|
---|
981 | }
|
---|