]>
Commit | Line | Data |
---|---|---|
c7f74643 FB |
1 | /* |
2 | * tftp.c - a simple, read-only tftp server for qemu | |
5fafdf24 | 3 | * |
c7f74643 | 4 | * Copyright (c) 2004 Magnus Damm <damm@opensource.se> |
5fafdf24 | 5 | * |
c7f74643 FB |
6 | * Permission is hereby granted, free of charge, to any person obtaining a copy |
7 | * of this software and associated documentation files (the "Software"), to deal | |
8 | * in the Software without restriction, including without limitation the rights | |
9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | |
10 | * copies of the Software, and to permit persons to whom the Software is | |
11 | * furnished to do so, subject to the following conditions: | |
12 | * | |
13 | * The above copyright notice and this permission notice shall be included in | |
14 | * all copies or substantial portions of the Software. | |
15 | * | |
16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |
17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL | |
19 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |
20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | |
21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN | |
22 | * THE SOFTWARE. | |
23 | */ | |
24 | ||
25 | #include <slirp.h> | |
0d62c4cf | 26 | #include "qemu-common.h" |
c7f74643 FB |
27 | |
28 | struct tftp_session { | |
a3504c87 | 29 | int in_use; |
9367964a | 30 | char *filename; |
3b46e624 | 31 | |
a3504c87 FB |
32 | struct in_addr client_ip; |
33 | u_int16_t client_port; | |
3b46e624 | 34 | |
a3504c87 | 35 | int timestamp; |
c7f74643 FB |
36 | }; |
37 | ||
9634d903 | 38 | static struct tftp_session tftp_sessions[TFTP_SESSIONS_MAX]; |
c7f74643 | 39 | |
ad196a9d | 40 | char *tftp_prefix; |
c7f74643 FB |
41 | |
42 | static void tftp_session_update(struct tftp_session *spt) | |
43 | { | |
a3504c87 FB |
44 | spt->timestamp = curtime; |
45 | spt->in_use = 1; | |
c7f74643 FB |
46 | } |
47 | ||
48 | static void tftp_session_terminate(struct tftp_session *spt) | |
49 | { | |
9367964a | 50 | qemu_free(spt->filename); |
c7f74643 FB |
51 | spt->in_use = 0; |
52 | } | |
53 | ||
54 | static int tftp_session_allocate(struct tftp_t *tp) | |
55 | { | |
56 | struct tftp_session *spt; | |
c7f74643 FB |
57 | int k; |
58 | ||
c7f74643 FB |
59 | for (k = 0; k < TFTP_SESSIONS_MAX; k++) { |
60 | spt = &tftp_sessions[k]; | |
61 | ||
a3504c87 FB |
62 | if (!spt->in_use) |
63 | goto found; | |
c7f74643 FB |
64 | |
65 | /* sessions time out after 5 inactive seconds */ | |
9367964a JK |
66 | if ((int)(curtime - spt->timestamp) > 5000) { |
67 | qemu_free(spt->filename); | |
a3504c87 | 68 | goto found; |
9367964a | 69 | } |
c7f74643 FB |
70 | } |
71 | ||
72 | return -1; | |
73 | ||
74 | found: | |
75 | memset(spt, 0, sizeof(*spt)); | |
76 | memcpy(&spt->client_ip, &tp->ip.ip_src, sizeof(spt->client_ip)); | |
77 | spt->client_port = tp->udp.uh_sport; | |
78 | ||
79 | tftp_session_update(spt); | |
80 | ||
81 | return k; | |
82 | } | |
83 | ||
84 | static int tftp_session_find(struct tftp_t *tp) | |
85 | { | |
86 | struct tftp_session *spt; | |
87 | int k; | |
88 | ||
89 | for (k = 0; k < TFTP_SESSIONS_MAX; k++) { | |
90 | spt = &tftp_sessions[k]; | |
91 | ||
92 | if (spt->in_use) { | |
93 | if (!memcmp(&spt->client_ip, &tp->ip.ip_src, sizeof(spt->client_ip))) { | |
94 | if (spt->client_port == tp->udp.uh_sport) { | |
95 | return k; | |
96 | } | |
97 | } | |
98 | } | |
99 | } | |
100 | ||
101 | return -1; | |
102 | } | |
103 | ||
104 | static int tftp_read_data(struct tftp_session *spt, u_int16_t block_nr, | |
105 | u_int8_t *buf, int len) | |
106 | { | |
107 | int fd; | |
108 | int bytes_read = 0; | |
0db1137d | 109 | |
9367964a | 110 | fd = open(spt->filename, O_RDONLY | O_BINARY); |
c7f74643 FB |
111 | |
112 | if (fd < 0) { | |
113 | return -1; | |
114 | } | |
115 | ||
116 | if (len) { | |
117 | lseek(fd, block_nr * 512, SEEK_SET); | |
118 | ||
119 | bytes_read = read(fd, buf, len); | |
120 | } | |
121 | ||
122 | close(fd); | |
123 | ||
124 | return bytes_read; | |
125 | } | |
126 | ||
5fafdf24 | 127 | static int tftp_send_oack(struct tftp_session *spt, |
1f697db9 TS |
128 | const char *key, uint32_t value, |
129 | struct tftp_t *recv_tp) | |
130 | { | |
131 | struct sockaddr_in saddr, daddr; | |
132 | struct mbuf *m; | |
133 | struct tftp_t *tp; | |
134 | int n = 0; | |
135 | ||
136 | m = m_get(); | |
137 | ||
138 | if (!m) | |
139 | return -1; | |
140 | ||
141 | memset(m->m_data, 0, m->m_size); | |
142 | ||
9634d903 | 143 | m->m_data += IF_MAXLINKHDR; |
1f697db9 TS |
144 | tp = (void *)m->m_data; |
145 | m->m_data += sizeof(struct udpiphdr); | |
3b46e624 | 146 | |
1f697db9 | 147 | tp->tp_op = htons(TFTP_OACK); |
b55266b5 BS |
148 | n += snprintf((char *)tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%s", |
149 | key) + 1; | |
150 | n += snprintf((char *)tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%u", | |
151 | value) + 1; | |
1f697db9 TS |
152 | |
153 | saddr.sin_addr = recv_tp->ip.ip_dst; | |
154 | saddr.sin_port = recv_tp->udp.uh_dport; | |
3b46e624 | 155 | |
1f697db9 TS |
156 | daddr.sin_addr = spt->client_ip; |
157 | daddr.sin_port = spt->client_port; | |
158 | ||
5fafdf24 | 159 | m->m_len = sizeof(struct tftp_t) - 514 + n - |
1f697db9 TS |
160 | sizeof(struct ip) - sizeof(struct udphdr); |
161 | udp_output2(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY); | |
162 | ||
163 | return 0; | |
164 | } | |
165 | ||
ef2d54d8 JK |
166 | static void tftp_send_error(struct tftp_session *spt, |
167 | u_int16_t errorcode, const char *msg, | |
168 | struct tftp_t *recv_tp) | |
c7f74643 FB |
169 | { |
170 | struct sockaddr_in saddr, daddr; | |
171 | struct mbuf *m; | |
172 | struct tftp_t *tp; | |
173 | int nobytes; | |
174 | ||
175 | m = m_get(); | |
176 | ||
177 | if (!m) { | |
ef2d54d8 | 178 | goto out; |
c7f74643 FB |
179 | } |
180 | ||
181 | memset(m->m_data, 0, m->m_size); | |
182 | ||
9634d903 | 183 | m->m_data += IF_MAXLINKHDR; |
c7f74643 FB |
184 | tp = (void *)m->m_data; |
185 | m->m_data += sizeof(struct udpiphdr); | |
3b46e624 | 186 | |
c7f74643 FB |
187 | tp->tp_op = htons(TFTP_ERROR); |
188 | tp->x.tp_error.tp_error_code = htons(errorcode); | |
b55266b5 | 189 | pstrcpy((char *)tp->x.tp_error.tp_msg, sizeof(tp->x.tp_error.tp_msg), msg); |
c7f74643 FB |
190 | |
191 | saddr.sin_addr = recv_tp->ip.ip_dst; | |
192 | saddr.sin_port = recv_tp->udp.uh_dport; | |
193 | ||
194 | daddr.sin_addr = spt->client_ip; | |
195 | daddr.sin_port = spt->client_port; | |
196 | ||
197 | nobytes = 2; | |
198 | ||
5fafdf24 | 199 | m->m_len = sizeof(struct tftp_t) - 514 + 3 + strlen(msg) - |
c7f74643 FB |
200 | sizeof(struct ip) - sizeof(struct udphdr); |
201 | ||
202 | udp_output2(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY); | |
203 | ||
ef2d54d8 | 204 | out: |
c7f74643 | 205 | tftp_session_terminate(spt); |
c7f74643 FB |
206 | } |
207 | ||
5fafdf24 | 208 | static int tftp_send_data(struct tftp_session *spt, |
c7f74643 FB |
209 | u_int16_t block_nr, |
210 | struct tftp_t *recv_tp) | |
211 | { | |
212 | struct sockaddr_in saddr, daddr; | |
213 | struct mbuf *m; | |
214 | struct tftp_t *tp; | |
215 | int nobytes; | |
216 | ||
217 | if (block_nr < 1) { | |
218 | return -1; | |
219 | } | |
220 | ||
221 | m = m_get(); | |
222 | ||
223 | if (!m) { | |
224 | return -1; | |
225 | } | |
226 | ||
227 | memset(m->m_data, 0, m->m_size); | |
228 | ||
9634d903 | 229 | m->m_data += IF_MAXLINKHDR; |
c7f74643 FB |
230 | tp = (void *)m->m_data; |
231 | m->m_data += sizeof(struct udpiphdr); | |
3b46e624 | 232 | |
c7f74643 FB |
233 | tp->tp_op = htons(TFTP_DATA); |
234 | tp->x.tp_data.tp_block_nr = htons(block_nr); | |
235 | ||
236 | saddr.sin_addr = recv_tp->ip.ip_dst; | |
237 | saddr.sin_port = recv_tp->udp.uh_dport; | |
238 | ||
239 | daddr.sin_addr = spt->client_ip; | |
240 | daddr.sin_port = spt->client_port; | |
241 | ||
242 | nobytes = tftp_read_data(spt, block_nr - 1, tp->x.tp_data.tp_buf, 512); | |
243 | ||
244 | if (nobytes < 0) { | |
245 | m_free(m); | |
246 | ||
247 | /* send "file not found" error back */ | |
248 | ||
249 | tftp_send_error(spt, 1, "File not found", tp); | |
250 | ||
251 | return -1; | |
252 | } | |
253 | ||
5fafdf24 | 254 | m->m_len = sizeof(struct tftp_t) - (512 - nobytes) - |
c7f74643 FB |
255 | sizeof(struct ip) - sizeof(struct udphdr); |
256 | ||
257 | udp_output2(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY); | |
258 | ||
259 | if (nobytes == 512) { | |
260 | tftp_session_update(spt); | |
261 | } | |
262 | else { | |
263 | tftp_session_terminate(spt); | |
264 | } | |
265 | ||
266 | return 0; | |
267 | } | |
268 | ||
269 | static void tftp_handle_rrq(struct tftp_t *tp, int pktlen) | |
270 | { | |
271 | struct tftp_session *spt; | |
20c24bf2 | 272 | int s, k; |
9367964a | 273 | size_t prefix_len; |
20c24bf2 | 274 | char *req_fname; |
c7f74643 FB |
275 | |
276 | s = tftp_session_allocate(tp); | |
277 | ||
278 | if (s < 0) { | |
279 | return; | |
280 | } | |
281 | ||
282 | spt = &tftp_sessions[s]; | |
283 | ||
f8e3cbd3 JK |
284 | /* unspecifed prefix means service disabled */ |
285 | if (!tftp_prefix) { | |
286 | tftp_send_error(spt, 2, "Access violation", tp); | |
287 | return; | |
288 | } | |
289 | ||
20c24bf2 JK |
290 | /* skip header fields */ |
291 | k = 0; | |
292 | pktlen -= ((uint8_t *)&tp->x.tp_buf[0] - (uint8_t *)tp); | |
c7f74643 | 293 | |
9367964a JK |
294 | /* prepend tftp_prefix */ |
295 | prefix_len = strlen(tftp_prefix); | |
296 | spt->filename = qemu_malloc(prefix_len + TFTP_FILENAME_MAX + 1); | |
297 | memcpy(spt->filename, tftp_prefix, prefix_len); | |
298 | ||
c7f74643 | 299 | /* get name */ |
9367964a | 300 | req_fname = spt->filename + prefix_len; |
c7f74643 | 301 | |
20c24bf2 JK |
302 | while (1) { |
303 | if (k >= TFTP_FILENAME_MAX || k >= pktlen) { | |
304 | tftp_send_error(spt, 2, "Access violation", tp); | |
c7f74643 FB |
305 | return; |
306 | } | |
20c24bf2 JK |
307 | req_fname[k] = (char)tp->x.tp_buf[k]; |
308 | if (req_fname[k++] == '\0') { | |
c7f74643 FB |
309 | break; |
310 | } | |
311 | } | |
3b46e624 | 312 | |
c7f74643 | 313 | /* check mode */ |
20c24bf2 JK |
314 | if ((pktlen - k) < 6) { |
315 | tftp_send_error(spt, 2, "Access violation", tp); | |
c7f74643 FB |
316 | return; |
317 | } | |
3b46e624 | 318 | |
20c24bf2 | 319 | if (memcmp(&tp->x.tp_buf[k], "octet\0", 6) != 0) { |
c7f74643 FB |
320 | tftp_send_error(spt, 4, "Unsupported transfer mode", tp); |
321 | return; | |
322 | } | |
323 | ||
1f697db9 TS |
324 | k += 6; /* skipping octet */ |
325 | ||
c7f74643 | 326 | /* do sanity checks on the filename */ |
9367964a JK |
327 | if (req_fname[0] != '/' || req_fname[strlen(req_fname) - 1] == '/' || |
328 | strstr(req_fname, "/../")) { | |
c7f74643 FB |
329 | tftp_send_error(spt, 2, "Access violation", tp); |
330 | return; | |
331 | } | |
332 | ||
c7f74643 | 333 | /* check if the file exists */ |
20c24bf2 | 334 | if (tftp_read_data(spt, 0, NULL, 0) < 0) { |
c7f74643 FB |
335 | tftp_send_error(spt, 1, "File not found", tp); |
336 | return; | |
337 | } | |
338 | ||
20c24bf2 | 339 | if (tp->x.tp_buf[pktlen - 1] != 0) { |
1f697db9 TS |
340 | tftp_send_error(spt, 2, "Access violation", tp); |
341 | return; | |
342 | } | |
343 | ||
20c24bf2 | 344 | while (k < pktlen) { |
1f697db9 TS |
345 | const char *key, *value; |
346 | ||
20c24bf2 | 347 | key = (const char *)&tp->x.tp_buf[k]; |
1f697db9 TS |
348 | k += strlen(key) + 1; |
349 | ||
20c24bf2 | 350 | if (k >= pktlen) { |
1f697db9 TS |
351 | tftp_send_error(spt, 2, "Access violation", tp); |
352 | return; | |
353 | } | |
354 | ||
20c24bf2 | 355 | value = (const char *)&tp->x.tp_buf[k]; |
1f697db9 TS |
356 | k += strlen(value) + 1; |
357 | ||
358 | if (strcmp(key, "tsize") == 0) { | |
359 | int tsize = atoi(value); | |
360 | struct stat stat_p; | |
361 | ||
f8e3cbd3 | 362 | if (tsize == 0) { |
9367964a | 363 | if (stat(spt->filename, &stat_p) == 0) |
1f697db9 TS |
364 | tsize = stat_p.st_size; |
365 | else { | |
366 | tftp_send_error(spt, 1, "File not found", tp); | |
367 | return; | |
368 | } | |
369 | } | |
370 | ||
371 | tftp_send_oack(spt, "tsize", tsize, tp); | |
372 | } | |
373 | } | |
374 | ||
c7f74643 FB |
375 | tftp_send_data(spt, 1, tp); |
376 | } | |
377 | ||
378 | static void tftp_handle_ack(struct tftp_t *tp, int pktlen) | |
379 | { | |
380 | int s; | |
381 | ||
382 | s = tftp_session_find(tp); | |
383 | ||
384 | if (s < 0) { | |
385 | return; | |
386 | } | |
387 | ||
5fafdf24 TS |
388 | if (tftp_send_data(&tftp_sessions[s], |
389 | ntohs(tp->x.tp_data.tp_block_nr) + 1, | |
c7f74643 FB |
390 | tp) < 0) { |
391 | return; | |
392 | } | |
393 | } | |
394 | ||
395 | void tftp_input(struct mbuf *m) | |
396 | { | |
397 | struct tftp_t *tp = (struct tftp_t *)m->m_data; | |
398 | ||
399 | switch(ntohs(tp->tp_op)) { | |
400 | case TFTP_RRQ: | |
401 | tftp_handle_rrq(tp, m->m_len); | |
402 | break; | |
403 | ||
404 | case TFTP_ACK: | |
405 | tftp_handle_ack(tp, m->m_len); | |
406 | break; | |
407 | } | |
408 | } |