1 | /*
|
---|
2 | * tftp.c - a simple, read-only tftp server for qemu
|
---|
3 | *
|
---|
4 | * Copyright (c) 2004 Magnus Damm <[email protected]>
|
---|
5 | *
|
---|
6 | * Permission is hereby granted, free of charge, to any person obtaining a copy
|
---|
7 | * of this software and associated documentation files (the "Software"), to deal
|
---|
8 | * in the Software without restriction, including without limitation the rights
|
---|
9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
---|
10 | * copies of the Software, and to permit persons to whom the Software is
|
---|
11 | * furnished to do so, subject to the following conditions:
|
---|
12 | *
|
---|
13 | * The above copyright notice and this permission notice shall be included in
|
---|
14 | * all copies or substantial portions of the Software.
|
---|
15 | *
|
---|
16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
---|
17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
---|
18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
---|
19 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
---|
20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
---|
21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
---|
22 | * THE SOFTWARE.
|
---|
23 | */
|
---|
24 |
|
---|
25 | #include <slirp.h>
|
---|
26 |
|
---|
27 | struct tftp_session {
|
---|
28 | int in_use;
|
---|
29 | unsigned char filename[TFTP_FILENAME_MAX];
|
---|
30 |
|
---|
31 | struct in_addr client_ip;
|
---|
32 | u_int16_t client_port;
|
---|
33 |
|
---|
34 | int timestamp;
|
---|
35 | };
|
---|
36 |
|
---|
37 | struct tftp_session tftp_sessions[TFTP_SESSIONS_MAX];
|
---|
38 |
|
---|
39 | const char *tftp_prefix;
|
---|
40 |
|
---|
41 | static void tftp_session_update(struct tftp_session *spt)
|
---|
42 | {
|
---|
43 | spt->timestamp = curtime;
|
---|
44 | spt->in_use = 1;
|
---|
45 | }
|
---|
46 |
|
---|
47 | static void tftp_session_terminate(struct tftp_session *spt)
|
---|
48 | {
|
---|
49 | spt->in_use = 0;
|
---|
50 | }
|
---|
51 |
|
---|
52 | static int tftp_session_allocate(struct tftp_t *tp)
|
---|
53 | {
|
---|
54 | struct tftp_session *spt;
|
---|
55 | int k;
|
---|
56 |
|
---|
57 | for (k = 0; k < TFTP_SESSIONS_MAX; k++) {
|
---|
58 | spt = &tftp_sessions[k];
|
---|
59 |
|
---|
60 | if (!spt->in_use)
|
---|
61 | goto found;
|
---|
62 |
|
---|
63 | /* sessions time out after 5 inactive seconds */
|
---|
64 | if ((int)(curtime - spt->timestamp) > 5000)
|
---|
65 | goto found;
|
---|
66 | }
|
---|
67 |
|
---|
68 | return -1;
|
---|
69 |
|
---|
70 | found:
|
---|
71 | memset(spt, 0, sizeof(*spt));
|
---|
72 | memcpy(&spt->client_ip, &tp->ip.ip_src, sizeof(spt->client_ip));
|
---|
73 | spt->client_port = tp->udp.uh_sport;
|
---|
74 |
|
---|
75 | tftp_session_update(spt);
|
---|
76 |
|
---|
77 | return k;
|
---|
78 | }
|
---|
79 |
|
---|
80 | static int tftp_session_find(struct tftp_t *tp)
|
---|
81 | {
|
---|
82 | struct tftp_session *spt;
|
---|
83 | int k;
|
---|
84 |
|
---|
85 | for (k = 0; k < TFTP_SESSIONS_MAX; k++) {
|
---|
86 | spt = &tftp_sessions[k];
|
---|
87 |
|
---|
88 | if (spt->in_use) {
|
---|
89 | if (!memcmp(&spt->client_ip, &tp->ip.ip_src, sizeof(spt->client_ip))) {
|
---|
90 | if (spt->client_port == tp->udp.uh_sport) {
|
---|
91 | return k;
|
---|
92 | }
|
---|
93 | }
|
---|
94 | }
|
---|
95 | }
|
---|
96 |
|
---|
97 | return -1;
|
---|
98 | }
|
---|
99 |
|
---|
100 | static int tftp_read_data(struct tftp_session *spt, u_int16_t block_nr,
|
---|
101 | u_int8_t *buf, int len)
|
---|
102 | {
|
---|
103 | int fd;
|
---|
104 | int bytes_read = 0;
|
---|
105 | char buffer[1024];
|
---|
106 | int n;
|
---|
107 |
|
---|
108 | #ifndef VBOX
|
---|
109 | n = snprintf(buffer, sizeof(buffer), "%s/%s",
|
---|
110 | tftp_prefix, spt->filename);
|
---|
111 | #else
|
---|
112 | n = RTStrPrintf(buffer, sizeof(buffer), "%s/%s",
|
---|
113 | tftp_prefix, spt->filename);
|
---|
114 | #endif
|
---|
115 | if (n >= sizeof(buffer))
|
---|
116 | return -1;
|
---|
117 |
|
---|
118 | fd = open(buffer, O_RDONLY | O_BINARY);
|
---|
119 |
|
---|
120 | if (fd < 0) {
|
---|
121 | return -1;
|
---|
122 | }
|
---|
123 |
|
---|
124 | if (len) {
|
---|
125 | lseek(fd, block_nr * 512, SEEK_SET);
|
---|
126 |
|
---|
127 | bytes_read = read(fd, buf, len);
|
---|
128 | }
|
---|
129 |
|
---|
130 | close(fd);
|
---|
131 |
|
---|
132 | return bytes_read;
|
---|
133 | }
|
---|
134 |
|
---|
135 | static int tftp_send_oack(struct tftp_session *spt,
|
---|
136 | const char *key, uint32_t value,
|
---|
137 | struct tftp_t *recv_tp)
|
---|
138 | {
|
---|
139 | struct sockaddr_in saddr, daddr;
|
---|
140 | struct mbuf *m;
|
---|
141 | struct tftp_t *tp;
|
---|
142 | int n = 0;
|
---|
143 |
|
---|
144 | m = m_get();
|
---|
145 |
|
---|
146 | if (!m)
|
---|
147 | return -1;
|
---|
148 |
|
---|
149 | memset(m->m_data, 0, m->m_size);
|
---|
150 |
|
---|
151 | m->m_data += if_maxlinkhdr;
|
---|
152 | tp = (void *)m->m_data;
|
---|
153 | m->m_data += sizeof(struct udpiphdr);
|
---|
154 |
|
---|
155 | tp->tp_op = htons(TFTP_OACK);
|
---|
156 | n += sprintf(tp->x.tp_buf + n, "%s", key) + 1;
|
---|
157 | n += sprintf(tp->x.tp_buf + n, "%u", value) + 1;
|
---|
158 |
|
---|
159 | saddr.sin_addr = recv_tp->ip.ip_dst;
|
---|
160 | saddr.sin_port = recv_tp->udp.uh_dport;
|
---|
161 |
|
---|
162 | daddr.sin_addr = spt->client_ip;
|
---|
163 | daddr.sin_port = spt->client_port;
|
---|
164 |
|
---|
165 | m->m_len = sizeof(struct tftp_t) - 514 + n -
|
---|
166 | sizeof(struct ip) - sizeof(struct udphdr);
|
---|
167 | udp_output2(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY);
|
---|
168 |
|
---|
169 | return 0;
|
---|
170 | }
|
---|
171 |
|
---|
172 |
|
---|
173 |
|
---|
174 | static int tftp_send_error(struct tftp_session *spt,
|
---|
175 | u_int16_t errorcode, const char *msg,
|
---|
176 | struct tftp_t *recv_tp)
|
---|
177 | {
|
---|
178 | struct sockaddr_in saddr, daddr;
|
---|
179 | struct mbuf *m;
|
---|
180 | struct tftp_t *tp;
|
---|
181 | int nobytes;
|
---|
182 |
|
---|
183 | m = m_get();
|
---|
184 |
|
---|
185 | if (!m) {
|
---|
186 | return -1;
|
---|
187 | }
|
---|
188 |
|
---|
189 | memset(m->m_data, 0, m->m_size);
|
---|
190 |
|
---|
191 | m->m_data += if_maxlinkhdr;
|
---|
192 | tp = (void *)m->m_data;
|
---|
193 | m->m_data += sizeof(struct udpiphdr);
|
---|
194 |
|
---|
195 | tp->tp_op = htons(TFTP_ERROR);
|
---|
196 | tp->x.tp_error.tp_error_code = htons(errorcode);
|
---|
197 | #ifndef VBOX
|
---|
198 | strcpy(tp->x.tp_error.tp_msg, msg);
|
---|
199 | #else /* VBOX */
|
---|
200 | strcpy((char *)tp->x.tp_error.tp_msg, msg);
|
---|
201 | #endif /* VBOX */
|
---|
202 |
|
---|
203 | saddr.sin_addr = recv_tp->ip.ip_dst;
|
---|
204 | saddr.sin_port = recv_tp->udp.uh_dport;
|
---|
205 |
|
---|
206 | daddr.sin_addr = spt->client_ip;
|
---|
207 | daddr.sin_port = spt->client_port;
|
---|
208 |
|
---|
209 | nobytes = 2;
|
---|
210 |
|
---|
211 | m->m_len = sizeof(struct tftp_t) - 514 + 3 + strlen(msg) -
|
---|
212 | sizeof(struct ip) - sizeof(struct udphdr);
|
---|
213 |
|
---|
214 | udp_output2(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY);
|
---|
215 |
|
---|
216 | tftp_session_terminate(spt);
|
---|
217 |
|
---|
218 | return 0;
|
---|
219 | }
|
---|
220 |
|
---|
221 | static int tftp_send_data(struct tftp_session *spt,
|
---|
222 | u_int16_t block_nr,
|
---|
223 | struct tftp_t *recv_tp)
|
---|
224 | {
|
---|
225 | struct sockaddr_in saddr, daddr;
|
---|
226 | struct mbuf *m;
|
---|
227 | struct tftp_t *tp;
|
---|
228 | int nobytes;
|
---|
229 |
|
---|
230 | if (block_nr < 1) {
|
---|
231 | return -1;
|
---|
232 | }
|
---|
233 |
|
---|
234 | m = m_get();
|
---|
235 |
|
---|
236 | if (!m) {
|
---|
237 | return -1;
|
---|
238 | }
|
---|
239 |
|
---|
240 | memset(m->m_data, 0, m->m_size);
|
---|
241 |
|
---|
242 | m->m_data += if_maxlinkhdr;
|
---|
243 | tp = (void *)m->m_data;
|
---|
244 | m->m_data += sizeof(struct udpiphdr);
|
---|
245 |
|
---|
246 | tp->tp_op = htons(TFTP_DATA);
|
---|
247 | tp->x.tp_data.tp_block_nr = htons(block_nr);
|
---|
248 |
|
---|
249 | saddr.sin_addr = recv_tp->ip.ip_dst;
|
---|
250 | saddr.sin_port = recv_tp->udp.uh_dport;
|
---|
251 |
|
---|
252 | daddr.sin_addr = spt->client_ip;
|
---|
253 | daddr.sin_port = spt->client_port;
|
---|
254 |
|
---|
255 | nobytes = tftp_read_data(spt, block_nr - 1, tp->x.tp_data.tp_buf, 512);
|
---|
256 |
|
---|
257 | if (nobytes < 0) {
|
---|
258 | m_free(m);
|
---|
259 |
|
---|
260 | /* send "file not found" error back */
|
---|
261 |
|
---|
262 | tftp_send_error(spt, 1, "File not found", tp);
|
---|
263 |
|
---|
264 | return -1;
|
---|
265 | }
|
---|
266 |
|
---|
267 | m->m_len = sizeof(struct tftp_t) - (512 - nobytes) -
|
---|
268 | sizeof(struct ip) - sizeof(struct udphdr);
|
---|
269 |
|
---|
270 | udp_output2(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY);
|
---|
271 |
|
---|
272 | if (nobytes == 512) {
|
---|
273 | tftp_session_update(spt);
|
---|
274 | }
|
---|
275 | else {
|
---|
276 | tftp_session_terminate(spt);
|
---|
277 | }
|
---|
278 |
|
---|
279 | return 0;
|
---|
280 | }
|
---|
281 |
|
---|
282 | static void tftp_handle_rrq(struct tftp_t *tp, int pktlen)
|
---|
283 | {
|
---|
284 | struct tftp_session *spt;
|
---|
285 | int s, k, n;
|
---|
286 | u_int8_t *src, *dst;
|
---|
287 |
|
---|
288 | s = tftp_session_allocate(tp);
|
---|
289 |
|
---|
290 | if (s < 0) {
|
---|
291 | return;
|
---|
292 | }
|
---|
293 |
|
---|
294 | spt = &tftp_sessions[s];
|
---|
295 |
|
---|
296 | src = tp->x.tp_buf;
|
---|
297 | dst = spt->filename;
|
---|
298 | n = pktlen - ((uint8_t *)&tp->x.tp_buf[0] - (uint8_t *)tp);
|
---|
299 |
|
---|
300 | /* get name */
|
---|
301 |
|
---|
302 | for (k = 0; k < n; k++) {
|
---|
303 | if (k < TFTP_FILENAME_MAX) {
|
---|
304 | dst[k] = src[k];
|
---|
305 | }
|
---|
306 | else {
|
---|
307 | return;
|
---|
308 | }
|
---|
309 |
|
---|
310 | if (src[k] == '\0') {
|
---|
311 | break;
|
---|
312 | }
|
---|
313 | }
|
---|
314 |
|
---|
315 | if (k >= n) {
|
---|
316 | return;
|
---|
317 | }
|
---|
318 |
|
---|
319 | k++;
|
---|
320 |
|
---|
321 | /* check mode */
|
---|
322 | if ((n - k) < 6) {
|
---|
323 | return;
|
---|
324 | }
|
---|
325 |
|
---|
326 | if (memcmp(&src[k], "octet\0", 6) != 0) {
|
---|
327 | tftp_send_error(spt, 4, "Unsupported transfer mode", tp);
|
---|
328 | return;
|
---|
329 | }
|
---|
330 |
|
---|
331 | k += 6; /* skipping octet */
|
---|
332 |
|
---|
333 | /* do sanity checks on the filename */
|
---|
334 |
|
---|
335 | #ifndef VBOX
|
---|
336 | if ((spt->filename[0] != '/')
|
---|
337 | || (spt->filename[strlen(spt->filename) - 1] == '/')
|
---|
338 | || strstr(spt->filename, "/../")) {
|
---|
339 | #else /* VBOX */
|
---|
340 | if ((spt->filename[0] != '/')
|
---|
341 | || (spt->filename[strlen((const char *)spt->filename) - 1] == '/')
|
---|
342 | || strstr((char *)spt->filename, "/../")) {
|
---|
343 | #endif /* VBOX */
|
---|
344 | tftp_send_error(spt, 2, "Access violation", tp);
|
---|
345 | return;
|
---|
346 | }
|
---|
347 |
|
---|
348 | /* only allow exported prefixes */
|
---|
349 |
|
---|
350 | if (!tftp_prefix) {
|
---|
351 | tftp_send_error(spt, 2, "Access violation", tp);
|
---|
352 | return;
|
---|
353 | }
|
---|
354 |
|
---|
355 | /* check if the file exists */
|
---|
356 |
|
---|
357 | if (tftp_read_data(spt, 0, spt->filename, 0) < 0) {
|
---|
358 | tftp_send_error(spt, 1, "File not found", tp);
|
---|
359 | return;
|
---|
360 | }
|
---|
361 |
|
---|
362 | if (src[n - 1] != 0) {
|
---|
363 | tftp_send_error(spt, 2, "Access violation", tp);
|
---|
364 | return;
|
---|
365 | }
|
---|
366 |
|
---|
367 | while (k < n) {
|
---|
368 | const char *key, *value;
|
---|
369 |
|
---|
370 | key = src + k;
|
---|
371 | k += strlen(key) + 1;
|
---|
372 |
|
---|
373 | if (k >= n) {
|
---|
374 | tftp_send_error(spt, 2, "Access violation", tp);
|
---|
375 | return;
|
---|
376 | }
|
---|
377 |
|
---|
378 | value = src + k;
|
---|
379 | k += strlen(value) + 1;
|
---|
380 |
|
---|
381 | if (strcmp(key, "tsize") == 0) {
|
---|
382 | int tsize = atoi(value);
|
---|
383 | struct stat stat_p;
|
---|
384 |
|
---|
385 | if (tsize == 0 && tftp_prefix) {
|
---|
386 | char buffer[1024];
|
---|
387 | int len;
|
---|
388 |
|
---|
389 | #ifndef VBOX
|
---|
390 | len = snprintf(buffer, sizeof(buffer), "%s/%s",
|
---|
391 | tftp_prefix, spt->filename);
|
---|
392 | #else
|
---|
393 | len = RTStrPrintf(buffer, sizeof(buffer), "%s/%s",
|
---|
394 | tftp_prefix, spt->filename);
|
---|
395 | #endif
|
---|
396 |
|
---|
397 | if (stat(buffer, &stat_p) == 0)
|
---|
398 | tsize = stat_p.st_size;
|
---|
399 | else {
|
---|
400 | tftp_send_error(spt, 1, "File not found", tp);
|
---|
401 | return;
|
---|
402 | }
|
---|
403 | }
|
---|
404 |
|
---|
405 | tftp_send_oack(spt, "tsize", tsize, tp);
|
---|
406 | }
|
---|
407 | }
|
---|
408 |
|
---|
409 | tftp_send_data(spt, 1, tp);
|
---|
410 | }
|
---|
411 |
|
---|
412 | static void tftp_handle_ack(struct tftp_t *tp, int pktlen)
|
---|
413 | {
|
---|
414 | int s;
|
---|
415 |
|
---|
416 | s = tftp_session_find(tp);
|
---|
417 |
|
---|
418 | if (s < 0) {
|
---|
419 | return;
|
---|
420 | }
|
---|
421 |
|
---|
422 | if (tftp_send_data(&tftp_sessions[s],
|
---|
423 | ntohs(tp->x.tp_data.tp_block_nr) + 1,
|
---|
424 | tp) < 0) {
|
---|
425 | return;
|
---|
426 | }
|
---|
427 | }
|
---|
428 |
|
---|
429 | void tftp_input(struct mbuf *m)
|
---|
430 | {
|
---|
431 | struct tftp_t *tp = (struct tftp_t *)m->m_data;
|
---|
432 |
|
---|
433 | switch(ntohs(tp->tp_op)) {
|
---|
434 | case TFTP_RRQ:
|
---|
435 | tftp_handle_rrq(tp, m->m_len);
|
---|
436 | break;
|
---|
437 |
|
---|
438 | case TFTP_ACK:
|
---|
439 | tftp_handle_ack(tp, m->m_len);
|
---|
440 | break;
|
---|
441 | }
|
---|
442 | }
|
---|