1 /*

     2  * tftp.c - a simple, read-only tftp server for qemu

     3  *

     4  * Copyright (c) 2004 Magnus Damm <damm@opensource.se>

     5  *

     6  * Permission is hereby granted, free of charge, to any person obtaining a copy

     7  * of this software and associated documentation files (the "Software"), to deal

     8  * in the Software without restriction, including without limitation the rights

     9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

    10  * copies of the Software, and to permit persons to whom the Software is

    11  * furnished to do so, subject to the following conditions:

    12  *

    13  * The above copyright notice and this permission notice shall be included in

    14  * all copies or substantial portions of the Software.

    15  *

    16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

    17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

    18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL

    19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

    20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

    21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

    22  * THE SOFTWARE.

    23  */

    24 

    25 #include <slirp.h>

    26 #include "qemu-common.h" // for pstrcpy

    27 

    28 struct tftp_session {

    29     int in_use;

    30     unsigned char filename[TFTP_FILENAME_MAX];

    31 

    32     struct in_addr client_ip;

    33     u_int16_t client_port;

    34 

    35     int timestamp;

    36 };

    37 

    38 static struct tftp_session tftp_sessions[TFTP_SESSIONS_MAX];

    39 

    40 const char *tftp_prefix;

    41 

    42 static void tftp_session_update(struct tftp_session *spt)

    43 {

    44     spt->timestamp = curtime;

    45     spt->in_use = 1;

    46 }

    47 

    48 static void tftp_session_terminate(struct tftp_session *spt)

    49 {

    50   spt->in_use = 0;

    51 }

    52 

    53 static int tftp_session_allocate(struct tftp_t *tp)

    54 {

    55   struct tftp_session *spt;

    56   int k;

    57 

    58   for (k = 0; k < TFTP_SESSIONS_MAX; k++) {

    59     spt = &tftp_sessions[k];

    60 

    61     if (!spt->in_use)

    62         goto found;

    63 

    64     /* sessions time out after 5 inactive seconds */

    65     if ((int)(curtime - spt->timestamp) > 5000)

    66         goto found;

    67   }

    68 

    69   return -1;

    70 

    71  found:

    72   memset(spt, 0, sizeof(*spt));

    73   memcpy(&spt->client_ip, &tp->ip.ip_src, sizeof(spt->client_ip));

    74   spt->client_port = tp->udp.uh_sport;

    75 

    76   tftp_session_update(spt);

    77 

    78   return k;

    79 }

    80 

    81 static int tftp_session_find(struct tftp_t *tp)

    82 {

    83   struct tftp_session *spt;

    84   int k;

    85 

    86   for (k = 0; k < TFTP_SESSIONS_MAX; k++) {

    87     spt = &tftp_sessions[k];

    88 

    89     if (spt->in_use) {

    90       if (!memcmp(&spt->client_ip, &tp->ip.ip_src, sizeof(spt->client_ip))) {

    91 	if (spt->client_port == tp->udp.uh_sport) {

    92 	  return k;

    93 	}

    94       }

    95     }

    96   }

    97 

    98   return -1;

    99 }

   100 

   101 static int tftp_read_data(struct tftp_session *spt, u_int16_t block_nr,

   102 			  u_int8_t *buf, int len)

   103 {

   104   int fd;

   105   int bytes_read = 0;

   106   char buffer[1024];

   107   int n;

   108 

   109   n = snprintf(buffer, sizeof(buffer), "%s/%s",

   110 	       tftp_prefix, spt->filename);

   111   if (n >= sizeof(buffer))

   112     return -1;

   113 

   114   fd = open(buffer, O_RDONLY | O_BINARY);

   115 

   116   if (fd < 0) {

   117     return -1;

   118   }

   119 

   120   if (len) {

   121     lseek(fd, block_nr * 512, SEEK_SET);

   122 

   123     bytes_read = read(fd, buf, len);

   124   }

   125 

   126   close(fd);

   127 

   128   return bytes_read;

   129 }

   130 

   131 static int tftp_send_oack(struct tftp_session *spt,

   132                           const char *key, uint32_t value,

   133                           struct tftp_t *recv_tp)

   134 {

   135     struct sockaddr_in saddr, daddr;

   136     struct mbuf *m;

   137     struct tftp_t *tp;

   138     int n = 0;

   139 

   140     m = m_get();

   141 

   142     if (!m)

   143 	return -1;

   144 

   145     memset(m->m_data, 0, m->m_size);

   146 

   147     m->m_data += IF_MAXLINKHDR;

   148     tp = (void *)m->m_data;

   149     m->m_data += sizeof(struct udpiphdr);

   150 

   151     tp->tp_op = htons(TFTP_OACK);

   152     n += snprintf((char *)tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%s",

   153                   key) + 1;

   154     n += snprintf((char *)tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%u",

   155                   value) + 1;

   156 

   157     saddr.sin_addr = recv_tp->ip.ip_dst;

   158     saddr.sin_port = recv_tp->udp.uh_dport;

   159 

   160     daddr.sin_addr = spt->client_ip;

   161     daddr.sin_port = spt->client_port;

   162 

   163     m->m_len = sizeof(struct tftp_t) - 514 + n -

   164         sizeof(struct ip) - sizeof(struct udphdr);

   165     udp_output2(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY);

   166 

   167     return 0;

   168 }

   169 

   170 

   171 

   172 static int tftp_send_error(struct tftp_session *spt,

   173 			   u_int16_t errorcode, const char *msg,

   174 			   struct tftp_t *recv_tp)

   175 {

   176   struct sockaddr_in saddr, daddr;

   177   struct mbuf *m;

   178   struct tftp_t *tp;

   179   int nobytes;

   180 

   181   m = m_get();

   182 

   183   if (!m) {

   184     return -1;

   185   }

   186 

   187   memset(m->m_data, 0, m->m_size);

   188 

   189   m->m_data += IF_MAXLINKHDR;

   190   tp = (void *)m->m_data;

   191   m->m_data += sizeof(struct udpiphdr);

   192 

   193   tp->tp_op = htons(TFTP_ERROR);

   194   tp->x.tp_error.tp_error_code = htons(errorcode);

   195   pstrcpy((char *)tp->x.tp_error.tp_msg, sizeof(tp->x.tp_error.tp_msg), msg);

   196 

   197   saddr.sin_addr = recv_tp->ip.ip_dst;

   198   saddr.sin_port = recv_tp->udp.uh_dport;

   199 

   200   daddr.sin_addr = spt->client_ip;

   201   daddr.sin_port = spt->client_port;

   202 

   203   nobytes = 2;

   204 

   205   m->m_len = sizeof(struct tftp_t) - 514 + 3 + strlen(msg) -

   206         sizeof(struct ip) - sizeof(struct udphdr);

   207 

   208   udp_output2(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY);

   209 

   210   tftp_session_terminate(spt);

   211 

   212   return 0;

   213 }

   214 

   215 static int tftp_send_data(struct tftp_session *spt,

   216 			  u_int16_t block_nr,

   217 			  struct tftp_t *recv_tp)

   218 {

   219   struct sockaddr_in saddr, daddr;

   220   struct mbuf *m;

   221   struct tftp_t *tp;

   222   int nobytes;

   223 

   224   if (block_nr < 1) {

   225     return -1;

   226   }

   227 

   228   m = m_get();

   229 

   230   if (!m) {

   231     return -1;

   232   }

   233 

   234   memset(m->m_data, 0, m->m_size);

   235 

   236   m->m_data += IF_MAXLINKHDR;

   237   tp = (void *)m->m_data;

   238   m->m_data += sizeof(struct udpiphdr);

   239 

   240   tp->tp_op = htons(TFTP_DATA);

   241   tp->x.tp_data.tp_block_nr = htons(block_nr);

   242 

   243   saddr.sin_addr = recv_tp->ip.ip_dst;

   244   saddr.sin_port = recv_tp->udp.uh_dport;

   245 

   246   daddr.sin_addr = spt->client_ip;

   247   daddr.sin_port = spt->client_port;

   248 

   249   nobytes = tftp_read_data(spt, block_nr - 1, tp->x.tp_data.tp_buf, 512);

   250 

   251   if (nobytes < 0) {

   252     m_free(m);

   253 

   254     /* send "file not found" error back */

   255 

   256     tftp_send_error(spt, 1, "File not found", tp);

   257 

   258     return -1;

   259   }

   260 

   261   m->m_len = sizeof(struct tftp_t) - (512 - nobytes) -

   262         sizeof(struct ip) - sizeof(struct udphdr);

   263 

   264   udp_output2(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY);

   265 

   266   if (nobytes == 512) {

   267     tftp_session_update(spt);

   268   }

   269   else {

   270     tftp_session_terminate(spt);

   271   }

   272 

   273   return 0;

   274 }

   275 

   276 static void tftp_handle_rrq(struct tftp_t *tp, int pktlen)

   277 {

   278   struct tftp_session *spt;

   279   int s, k, n;

   280   u_int8_t *src, *dst;

   281 

   282   s = tftp_session_allocate(tp);

   283 

   284   if (s < 0) {

   285     return;

   286   }

   287 

   288   spt = &tftp_sessions[s];

   289 

   290   src = tp->x.tp_buf;

   291   dst = spt->filename;

   292   n = pktlen - ((uint8_t *)&tp->x.tp_buf[0] - (uint8_t *)tp);

   293 

   294   /* get name */

   295 

   296   for (k = 0; k < n; k++) {

   297     if (k < TFTP_FILENAME_MAX) {

   298       dst[k] = src[k];

   299     }

   300     else {

   301       return;

   302     }

   303 

   304     if (src[k] == '\0') {

   305       break;

   306     }

   307   }

   308 

   309   if (k >= n) {

   310     return;

   311   }

   312 

   313   k++;

   314 

   315   /* check mode */

   316   if ((n - k) < 6) {

   317     return;

   318   }

   319 

   320   if (memcmp(&src[k], "octet\0", 6) != 0) {

   321       tftp_send_error(spt, 4, "Unsupported transfer mode", tp);

   322       return;

   323   }

   324 

   325   k += 6; /* skipping octet */

   326 

   327   /* do sanity checks on the filename */

   328 

   329   if ((spt->filename[0] != '/')

   330       || (spt->filename[strlen((char *)spt->filename) - 1] == '/')

   331       ||  strstr((char *)spt->filename, "/../")) {

   332       tftp_send_error(spt, 2, "Access violation", tp);

   333       return;

   334   }

   335 

   336   /* only allow exported prefixes */

   337 

   338   if (!tftp_prefix) {

   339       tftp_send_error(spt, 2, "Access violation", tp);

   340       return;

   341   }

   342 

   343   /* check if the file exists */

   344 

   345   if (tftp_read_data(spt, 0, spt->filename, 0) < 0) {

   346       tftp_send_error(spt, 1, "File not found", tp);

   347       return;

   348   }

   349 

   350   if (src[n - 1] != 0) {

   351       tftp_send_error(spt, 2, "Access violation", tp);

   352       return;

   353   }

   354 

   355   while (k < n) {

   356       const char *key, *value;

   357 

   358       key = (char *)src + k;

   359       k += strlen(key) + 1;

   360 

   361       if (k >= n) {

   362 	  tftp_send_error(spt, 2, "Access violation", tp);

   363 	  return;

   364       }

   365 

   366       value = (char *)src + k;

   367       k += strlen(value) + 1;

   368 

   369       if (strcmp(key, "tsize") == 0) {

   370 	  int tsize = atoi(value);

   371 	  struct stat stat_p;

   372 

   373 	  if (tsize == 0 && tftp_prefix) {

   374 	      char buffer[1024];

   375 	      int len;

   376 

   377 	      len = snprintf(buffer, sizeof(buffer), "%s/%s",

   378 			     tftp_prefix, spt->filename);

   379 

   380 	      if (stat(buffer, &stat_p) == 0)

   381 		  tsize = stat_p.st_size;

   382 	      else {

   383 		  tftp_send_error(spt, 1, "File not found", tp);

   384 		  return;

   385 	      }

   386 	  }

   387 

   388 	  tftp_send_oack(spt, "tsize", tsize, tp);

   389       }

   390   }

   391 

   392   tftp_send_data(spt, 1, tp);

   393 }

   394 

   395 static void tftp_handle_ack(struct tftp_t *tp, int pktlen)

   396 {

   397   int s;

   398 

   399   s = tftp_session_find(tp);

   400 

   401   if (s < 0) {

   402     return;

   403   }

   404 

   405   if (tftp_send_data(&tftp_sessions[s],

   406 		     ntohs(tp->x.tp_data.tp_block_nr) + 1,

   407 		     tp) < 0) {

   408     return;

   409   }

   410 }

   411 

   412 void tftp_input(struct mbuf *m)

   413 {

   414   struct tftp_t *tp = (struct tftp_t *)m->m_data;

   415 

   416   switch(ntohs(tp->tp_op)) {

   417   case TFTP_RRQ:

   418     tftp_handle_rrq(tp, m->m_len);

   419     break;

   420 

   421   case TFTP_ACK:

   422     tftp_handle_ack(tp, m->m_len);

   423     break;

   424   }

   425 }