1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26#include "slirp.h"
27
28#include <sys/types.h>
29#include <sys/stat.h>
30#include <fcntl.h>
31
32static inline int tftp_session_in_use(struct tftp_session *spt)
33{
34 return (spt->slirp != NULL);
35}
36
37static inline void tftp_session_update(struct tftp_session *spt)
38{
39 spt->timestamp = curtime;
40}
41
42static void tftp_session_terminate(struct tftp_session *spt)
43{
44 if (spt->fd >= 0) {
45 close(spt->fd);
46 spt->fd = -1;
47 }
48 g_free(spt->filename);
49 spt->slirp = NULL;
50}
51
52static int tftp_session_allocate(Slirp *slirp, struct sockaddr_storage *srcsas,
53 struct tftp_t *tp)
54{
55 struct tftp_session *spt;
56 int k;
57
58 for (k = 0; k < TFTP_SESSIONS_MAX; k++) {
59 spt = &slirp->tftp_sessions[k];
60
61 if (!tftp_session_in_use(spt))
62 goto found;
63
64
65 if ((int)(curtime - spt->timestamp) > 5000) {
66 tftp_session_terminate(spt);
67 goto found;
68 }
69 }
70
71 return -1;
72
73 found:
74 memset(spt, 0, sizeof(*spt));
75 memcpy(&spt->client_addr, srcsas, sockaddr_size(srcsas));
76 spt->fd = -1;
77 spt->block_size = 512;
78 spt->client_port = tp->udp.uh_sport;
79 spt->slirp = slirp;
80
81 tftp_session_update(spt);
82
83 return k;
84}
85
86static int tftp_session_find(Slirp *slirp, struct sockaddr_storage *srcsas,
87 struct tftp_t *tp)
88{
89 struct tftp_session *spt;
90 int k;
91
92 for (k = 0; k < TFTP_SESSIONS_MAX; k++) {
93 spt = &slirp->tftp_sessions[k];
94
95 if (tftp_session_in_use(spt)) {
96 if (sockaddr_equal(&spt->client_addr, srcsas)) {
97 if (spt->client_port == tp->udp.uh_sport) {
98 return k;
99 }
100 }
101 }
102 }
103
104 return -1;
105}
106
107static int tftp_read_data(struct tftp_session *spt, uint32_t block_nr,
108 uint8_t *buf, int len)
109{
110 int bytes_read = 0;
111
112 if (spt->fd < 0) {
113 spt->fd = open(spt->filename, O_RDONLY | O_BINARY);
114 }
115
116 if (spt->fd < 0) {
117 return -1;
118 }
119
120 if (len) {
121 lseek(spt->fd, block_nr * spt->block_size, SEEK_SET);
122
123 bytes_read = read(spt->fd, buf, len);
124 }
125
126 return bytes_read;
127}
128
129static struct tftp_t *tftp_prep_mbuf_data(struct tftp_session *spt,
130 struct mbuf *m)
131{
132 struct tftp_t *tp;
133
134 memset(m->m_data, 0, m->m_size);
135
136 m->m_data += IF_MAXLINKHDR;
137 if (spt->client_addr.ss_family == AF_INET6) {
138 m->m_data += sizeof(struct ip6);
139 } else {
140 m->m_data += sizeof(struct ip);
141 }
142 tp = (void *)m->m_data;
143 m->m_data += sizeof(struct udphdr);
144
145 return tp;
146}
147
148static void tftp_udp_output(struct tftp_session *spt, struct mbuf *m,
149 struct tftp_t *recv_tp)
150{
151 if (spt->client_addr.ss_family == AF_INET6) {
152 struct sockaddr_in6 sa6, da6;
153
154 sa6.sin6_addr = spt->slirp->vhost_addr6;
155 sa6.sin6_port = recv_tp->udp.uh_dport;
156 da6.sin6_addr = ((struct sockaddr_in6 *)&spt->client_addr)->sin6_addr;
157 da6.sin6_port = spt->client_port;
158
159 udp6_output(NULL, m, &sa6, &da6);
160 } else {
161 struct sockaddr_in sa4, da4;
162
163 sa4.sin_addr = spt->slirp->vhost_addr;
164 sa4.sin_port = recv_tp->udp.uh_dport;
165 da4.sin_addr = ((struct sockaddr_in *)&spt->client_addr)->sin_addr;
166 da4.sin_port = spt->client_port;
167
168 udp_output(NULL, m, &sa4, &da4, IPTOS_LOWDELAY);
169 }
170}
171
172static int tftp_send_oack(struct tftp_session *spt,
173 const char *keys[], uint32_t values[], int nb,
174 struct tftp_t *recv_tp)
175{
176 struct mbuf *m;
177 struct tftp_t *tp;
178 int i, n = 0;
179
180 m = m_get(spt->slirp);
181
182 if (!m)
183 return -1;
184
185 tp = tftp_prep_mbuf_data(spt, m);
186
187 tp->tp_op = htons(TFTP_OACK);
188 for (i = 0; i < nb; i++) {
189 n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%s",
190 keys[i]) + 1;
191 n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%u",
192 values[i]) + 1;
193 }
194
195 m->m_len = sizeof(struct tftp_t) - (TFTP_BLOCKSIZE_MAX + 2) + n
196 - sizeof(struct udphdr);
197 tftp_udp_output(spt, m, recv_tp);
198
199 return 0;
200}
201
202static void tftp_send_error(struct tftp_session *spt,
203 uint16_t errorcode, const char *msg,
204 struct tftp_t *recv_tp)
205{
206 struct mbuf *m;
207 struct tftp_t *tp;
208
209 DEBUG_TFTP("tftp error msg: %s", msg);
210
211 m = m_get(spt->slirp);
212
213 if (!m) {
214 goto out;
215 }
216
217 tp = tftp_prep_mbuf_data(spt, m);
218
219 tp->tp_op = htons(TFTP_ERROR);
220 tp->x.tp_error.tp_error_code = htons(errorcode);
221 slirp_pstrcpy((char *)tp->x.tp_error.tp_msg, sizeof(tp->x.tp_error.tp_msg), msg);
222
223 m->m_len = sizeof(struct tftp_t) - (TFTP_BLOCKSIZE_MAX + 2) + 3 + strlen(msg)
224 - sizeof(struct udphdr);
225 tftp_udp_output(spt, m, recv_tp);
226
227out:
228 tftp_session_terminate(spt);
229}
230
231static void tftp_send_next_block(struct tftp_session *spt,
232 struct tftp_t *recv_tp)
233{
234 struct mbuf *m;
235 struct tftp_t *tp;
236 int nobytes;
237
238 m = m_get(spt->slirp);
239
240 if (!m) {
241 return;
242 }
243
244 tp = tftp_prep_mbuf_data(spt, m);
245
246 tp->tp_op = htons(TFTP_DATA);
247 tp->x.tp_data.tp_block_nr = htons((spt->block_nr + 1) & 0xffff);
248
249 nobytes = tftp_read_data(spt, spt->block_nr, tp->x.tp_data.tp_buf,
250 spt->block_size);
251
252 if (nobytes < 0) {
253 m_free(m);
254
255
256
257 tftp_send_error(spt, 1, "File not found", tp);
258
259 return;
260 }
261
262 m->m_len = sizeof(struct tftp_t) - (TFTP_BLOCKSIZE_MAX - nobytes)
263 - sizeof(struct udphdr);
264 tftp_udp_output(spt, m, recv_tp);
265
266 if (nobytes == spt->block_size) {
267 tftp_session_update(spt);
268 }
269 else {
270 tftp_session_terminate(spt);
271 }
272
273 spt->block_nr++;
274}
275
276static void tftp_handle_rrq(Slirp *slirp, struct sockaddr_storage *srcsas,
277 struct tftp_t *tp, int pktlen)
278{
279 struct tftp_session *spt;
280 int s, k;
281 size_t prefix_len;
282 char *req_fname;
283 const char *option_name[2];
284 uint32_t option_value[2];
285 int nb_options = 0;
286
287
288 s = tftp_session_find(slirp, srcsas, tp);
289 if (s >= 0) {
290 tftp_session_terminate(&slirp->tftp_sessions[s]);
291 }
292
293 s = tftp_session_allocate(slirp, srcsas, tp);
294
295 if (s < 0) {
296 return;
297 }
298
299 spt = &slirp->tftp_sessions[s];
300
301
302 if (!slirp->tftp_prefix) {
303 tftp_send_error(spt, 2, "Access violation", tp);
304 return;
305 }
306
307
308 k = 0;
309 pktlen -= offsetof(struct tftp_t, x.tp_buf);
310
311
312 prefix_len = strlen(slirp->tftp_prefix);
313 spt->filename = g_malloc(prefix_len + TFTP_FILENAME_MAX + 2);
314 memcpy(spt->filename, slirp->tftp_prefix, prefix_len);
315 spt->filename[prefix_len] = '/';
316
317
318 req_fname = spt->filename + prefix_len + 1;
319
320 while (1) {
321 if (k >= TFTP_FILENAME_MAX || k >= pktlen) {
322 tftp_send_error(spt, 2, "Access violation", tp);
323 return;
324 }
325 req_fname[k] = tp->x.tp_buf[k];
326 if (req_fname[k++] == '\0') {
327 break;
328 }
329 }
330
331 DEBUG_TFTP("tftp rrq file: %s", req_fname);
332
333
334 if ((pktlen - k) < 6) {
335 tftp_send_error(spt, 2, "Access violation", tp);
336 return;
337 }
338
339 if (strcasecmp(&tp->x.tp_buf[k], "octet") != 0) {
340 tftp_send_error(spt, 4, "Unsupported transfer mode", tp);
341 return;
342 }
343
344 k += 6;
345
346
347 if (!strncmp(req_fname, "../", 3) ||
348 req_fname[strlen(req_fname) - 1] == '/' ||
349 strstr(req_fname, "/../")) {
350 tftp_send_error(spt, 2, "Access violation", tp);
351 return;
352 }
353
354
355 if (tftp_read_data(spt, 0, NULL, 0) < 0) {
356 tftp_send_error(spt, 1, "File not found", tp);
357 return;
358 }
359
360 if (tp->x.tp_buf[pktlen - 1] != 0) {
361 tftp_send_error(spt, 2, "Access violation", tp);
362 return;
363 }
364
365 while (k < pktlen && nb_options < G_N_ELEMENTS(option_name)) {
366 const char *key, *value;
367
368 key = &tp->x.tp_buf[k];
369 k += strlen(key) + 1;
370
371 if (k >= pktlen) {
372 tftp_send_error(spt, 2, "Access violation", tp);
373 return;
374 }
375
376 value = &tp->x.tp_buf[k];
377 k += strlen(value) + 1;
378
379 if (strcasecmp(key, "tsize") == 0) {
380 int tsize = atoi(value);
381 struct stat stat_p;
382
383 if (tsize == 0) {
384 if (stat(spt->filename, &stat_p) == 0)
385 tsize = stat_p.st_size;
386 else {
387 tftp_send_error(spt, 1, "File not found", tp);
388 return;
389 }
390 }
391
392 option_name[nb_options] = "tsize";
393 option_value[nb_options] = tsize;
394 nb_options++;
395 } else if (strcasecmp(key, "blksize") == 0) {
396 int blksize = atoi(value);
397
398
399 if (blksize > 0) {
400 spt->block_size = MIN(blksize, TFTP_BLOCKSIZE_MAX);
401 option_name[nb_options] = "blksize";
402 option_value[nb_options] = spt->block_size;
403 nb_options++;
404 }
405 }
406 }
407
408 if (nb_options > 0) {
409 assert(nb_options <= G_N_ELEMENTS(option_name));
410 tftp_send_oack(spt, option_name, option_value, nb_options, tp);
411 return;
412 }
413
414 spt->block_nr = 0;
415 tftp_send_next_block(spt, tp);
416}
417
418static void tftp_handle_ack(Slirp *slirp, struct sockaddr_storage *srcsas,
419 struct tftp_t *tp, int pktlen)
420{
421 int s;
422
423 s = tftp_session_find(slirp, srcsas, tp);
424
425 if (s < 0) {
426 return;
427 }
428
429 tftp_send_next_block(&slirp->tftp_sessions[s], tp);
430}
431
432static void tftp_handle_error(Slirp *slirp, struct sockaddr_storage *srcsas,
433 struct tftp_t *tp, int pktlen)
434{
435 int s;
436
437 s = tftp_session_find(slirp, srcsas, tp);
438
439 if (s < 0) {
440 return;
441 }
442
443 tftp_session_terminate(&slirp->tftp_sessions[s]);
444}
445
446void tftp_input(struct sockaddr_storage *srcsas, struct mbuf *m)
447{
448 struct tftp_t *tp = (struct tftp_t *)m->m_data;
449
450 switch(ntohs(tp->tp_op)) {
451 case TFTP_RRQ:
452 tftp_handle_rrq(m->slirp, srcsas, tp, m->m_len);
453 break;
454
455 case TFTP_ACK:
456 tftp_handle_ack(m->slirp, srcsas, tp, m->m_len);
457 break;
458
459 case TFTP_ERROR:
460 tftp_handle_error(m->slirp, srcsas, tp, m->m_len);
461 break;
462 }
463}
464