tftpd.c 7.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449
  1. #include <u.h>
  2. #include <libc.h>
  3. #include <auth.h>
  4. #include <bio.h>
  5. #include <ip.h>
  6. #include <ndb.h>
  7. enum
  8. {
  9. Maxpath= 128,
  10. Maxerr= 256,
  11. };
  12. int dbg;
  13. int restricted;
  14. void sendfile(int, char*, char*);
  15. void recvfile(int, char*, char*);
  16. void nak(int, int, char*);
  17. void ack(int, ushort);
  18. void clrcon(void);
  19. void setuser(void);
  20. char* sunkernel(char*);
  21. void remoteaddr(char*, char*, int);
  22. void doserve(int);
  23. char bigbuf[32768];
  24. char raddr[64];
  25. char *dir = "/lib/tftpd";
  26. char *dirsl;
  27. int dirsllen;
  28. char flog[] = "ipboot";
  29. char net[Maxpath];
  30. enum
  31. {
  32. Tftp_READ = 1,
  33. Tftp_WRITE = 2,
  34. Tftp_DATA = 3,
  35. Tftp_ACK = 4,
  36. Tftp_ERROR = 5,
  37. Segsize = 512,
  38. };
  39. void
  40. usage(void)
  41. {
  42. fprint(2, "usage: %s [-dr] [-h homedir] [-s svc] [-x netmtpt]\n",
  43. argv0);
  44. exits("usage");
  45. }
  46. void
  47. main(int argc, char **argv)
  48. {
  49. char buf[64];
  50. char adir[64], ldir[64];
  51. int cfd, lcfd, dfd;
  52. char *p, *svc = "69";
  53. setnetmtpt(net, sizeof(net), nil);
  54. ARGBEGIN{
  55. case 'd':
  56. dbg++;
  57. break;
  58. case 'h':
  59. dir = ARGF();
  60. break;
  61. case 'r':
  62. restricted = 1;
  63. break;
  64. case 's':
  65. svc = EARGF(usage());
  66. break;
  67. case 'x':
  68. p = ARGF();
  69. if(p == nil)
  70. usage();
  71. setnetmtpt(net, sizeof(net), p);
  72. break;
  73. default:
  74. usage();
  75. }ARGEND
  76. snprint(buf, sizeof buf, "%s/", dir);
  77. dirsl = strdup(buf);
  78. dirsllen = strlen(dirsl);
  79. fmtinstall('E', eipfmt);
  80. fmtinstall('I', eipfmt);
  81. if(chdir(dir) < 0)
  82. sysfatal("can't get to directory %s: %r", dir);
  83. if(!dbg)
  84. switch(rfork(RFNOTEG|RFPROC|RFFDG)) {
  85. case -1:
  86. sysfatal("fork: %r");
  87. case 0:
  88. break;
  89. default:
  90. exits(0);
  91. }
  92. snprint(buf, sizeof buf, "%s/udp!*!%s", net, svc);
  93. cfd = announce(buf, adir);
  94. if (cfd < 0)
  95. sysfatal("announcing on %s: %r", buf);
  96. syslog(dbg, flog, "tftpd started on %s dir %s", buf, adir);
  97. setuser();
  98. for(;;) {
  99. lcfd = listen(adir, ldir);
  100. if(lcfd < 0)
  101. sysfatal("listening on %s: %r", adir);
  102. switch(fork()) {
  103. case -1:
  104. sysfatal("fork: %r");
  105. case 0:
  106. dfd = accept(lcfd, ldir);
  107. if(dfd < 0)
  108. exits(0);
  109. remoteaddr(ldir, raddr, sizeof(raddr));
  110. syslog(0, flog, "tftp connection from %s dir %s",
  111. raddr, ldir);
  112. doserve(dfd);
  113. exits("done");
  114. break;
  115. default:
  116. close(lcfd);
  117. continue;
  118. }
  119. }
  120. }
  121. void
  122. doserve(int fd)
  123. {
  124. int dlen;
  125. char *mode, *p;
  126. short op;
  127. dlen = read(fd, bigbuf, sizeof(bigbuf));
  128. if(dlen < 0)
  129. sysfatal("listen read: %r");
  130. op = (bigbuf[0]<<8) | bigbuf[1];
  131. dlen -= 2;
  132. mode = bigbuf+2;
  133. while(*mode != '\0' && dlen--)
  134. mode++;
  135. mode++;
  136. p = mode;
  137. while(*p && dlen--)
  138. p++;
  139. if(dlen == 0) {
  140. nak(fd, 0, "bad tftpmode");
  141. close(fd);
  142. syslog(dbg, flog, "bad mode from %s", raddr);
  143. return;
  144. }
  145. if(op != Tftp_READ && op != Tftp_WRITE) {
  146. nak(fd, 4, "Illegal TFTP operation");
  147. close(fd);
  148. syslog(dbg, flog, "bad request %d %s", op, raddr);
  149. return;
  150. }
  151. if(restricted){
  152. if(bigbuf[2] == '#' ||
  153. strncmp(bigbuf+2, "../", 3)==0 || strstr(bigbuf+2, "/../") ||
  154. (bigbuf[2] == '/' && strncmp(bigbuf+2, dirsl, dirsllen)!=0)){
  155. nak(fd, 4, "Permission denied");
  156. close(fd);
  157. syslog(dbg, flog, "bad request %d from %s file %s", op, raddr, bigbuf+2);
  158. return;
  159. }
  160. }
  161. if(op == Tftp_READ)
  162. sendfile(fd, bigbuf+2, mode);
  163. else
  164. recvfile(fd, bigbuf+2, mode);
  165. }
  166. void
  167. catcher(void *junk, char *msg)
  168. {
  169. USED(junk);
  170. if(strncmp(msg, "exit", 4) == 0)
  171. noted(NDFLT);
  172. noted(NCONT);
  173. }
  174. void
  175. sendfile(int fd, char *name, char *mode)
  176. {
  177. int file;
  178. uchar buf[Segsize+4];
  179. uchar ack[1024];
  180. char errbuf[Maxerr];
  181. int ackblock, block, ret;
  182. int rexmit, n, al, txtry, rxl;
  183. short op;
  184. syslog(dbg, flog, "send file '%s' %s to %s", name, mode, raddr);
  185. name = sunkernel(name);
  186. if(name == 0){
  187. nak(fd, 0, "not in our database");
  188. return;
  189. }
  190. notify(catcher);
  191. file = open(name, OREAD);
  192. if(file < 0) {
  193. errstr(errbuf, sizeof errbuf);
  194. nak(fd, 0, errbuf);
  195. return;
  196. }
  197. block = 0;
  198. rexmit = 0;
  199. n = 0;
  200. for(txtry = 0; txtry < 5;) {
  201. if(rexmit == 0) {
  202. block++;
  203. buf[0] = 0;
  204. buf[1] = Tftp_DATA;
  205. buf[2] = block>>8;
  206. buf[3] = block;
  207. n = read(file, buf+4, Segsize);
  208. if(n < 0) {
  209. errstr(errbuf, sizeof errbuf);
  210. nak(fd, 0, errbuf);
  211. return;
  212. }
  213. txtry = 0;
  214. }
  215. else {
  216. syslog(dbg, flog, "rexmit %d %s:%d to %s", 4+n, name, block, raddr);
  217. txtry++;
  218. }
  219. ret = write(fd, buf, 4+n);
  220. if(ret < 0)
  221. sysfatal("tftpd: network write error: %r");
  222. for(rxl = 0; rxl < 10; rxl++) {
  223. rexmit = 0;
  224. alarm(500);
  225. al = read(fd, ack, sizeof(ack));
  226. alarm(0);
  227. if(al < 0) {
  228. rexmit = 1;
  229. break;
  230. }
  231. op = ack[0]<<8|ack[1];
  232. if(op == Tftp_ERROR)
  233. goto error;
  234. ackblock = ack[2]<<8|ack[3];
  235. if(ackblock == block)
  236. break;
  237. if(ackblock == 0xffff) {
  238. rexmit = 1;
  239. break;
  240. }
  241. }
  242. if(ret != Segsize+4 && rexmit == 0)
  243. break;
  244. }
  245. error:
  246. close(fd);
  247. close(file);
  248. }
  249. void
  250. recvfile(int fd, char *name, char *mode)
  251. {
  252. ushort op, block, inblock;
  253. uchar buf[Segsize+8];
  254. char errbuf[Maxerr];
  255. int n, ret, file;
  256. syslog(dbg, flog, "receive file '%s' %s from %s", name, mode, raddr);
  257. file = create(name, OWRITE, 0666);
  258. if(file < 0) {
  259. errstr(errbuf, sizeof errbuf);
  260. nak(fd, 0, errbuf);
  261. return;
  262. }
  263. block = 0;
  264. ack(fd, block);
  265. block++;
  266. for(;;) {
  267. alarm(15000);
  268. n = read(fd, buf, sizeof(buf));
  269. alarm(0);
  270. if(n < 0)
  271. goto error;
  272. op = buf[0]<<8|buf[1];
  273. if(op == Tftp_ERROR)
  274. goto error;
  275. n -= 4;
  276. inblock = buf[2]<<8|buf[3];
  277. if(op == Tftp_DATA) {
  278. if(inblock == block) {
  279. ret = write(file, buf, n);
  280. if(ret < 0) {
  281. errstr(errbuf, sizeof errbuf);
  282. nak(fd, 0, errbuf);
  283. goto error;
  284. }
  285. ack(fd, block);
  286. block++;
  287. }
  288. ack(fd, 0xffff);
  289. }
  290. }
  291. error:
  292. close(file);
  293. }
  294. void
  295. ack(int fd, ushort block)
  296. {
  297. uchar ack[4];
  298. int n;
  299. ack[0] = 0;
  300. ack[1] = Tftp_ACK;
  301. ack[2] = block>>8;
  302. ack[3] = block;
  303. n = write(fd, ack, 4);
  304. if(n < 0)
  305. sysfatal("network write: %r");
  306. }
  307. void
  308. nak(int fd, int code, char *msg)
  309. {
  310. char buf[128];
  311. int n;
  312. buf[0] = 0;
  313. buf[1] = Tftp_ERROR;
  314. buf[2] = 0;
  315. buf[3] = code;
  316. strcpy(buf+4, msg);
  317. n = strlen(msg) + 4 + 1;
  318. n = write(fd, buf, n);
  319. if(n < 0)
  320. sysfatal("write nak: %r");
  321. }
  322. void
  323. setuser(void)
  324. {
  325. int fd;
  326. fd = open("#c/user", OWRITE);
  327. if(fd < 0 || write(fd, "none", strlen("none")) < 0)
  328. sysfatal("can't become none: %r");
  329. close(fd);
  330. if(newns("none", nil) < 0)
  331. sysfatal("can't build namespace: %r");
  332. }
  333. char*
  334. lookup(char *sattr, char *sval, char *tattr, char *tval, int len)
  335. {
  336. static Ndb *db;
  337. char *attrs[1];
  338. Ndbtuple *t;
  339. if(db == nil)
  340. db = ndbopen(0);
  341. if(db == nil)
  342. return nil;
  343. if(sattr == nil)
  344. sattr = ipattr(sval);
  345. attrs[0] = tattr;
  346. t = ndbipinfo(db, sattr, sval, attrs, 1);
  347. if(t == nil)
  348. return nil;
  349. strncpy(tval, t->val, len);
  350. tval[len-1] = 0;
  351. ndbfree(t);
  352. return tval;
  353. }
  354. /*
  355. * for sun kernel boots, replace the requested file name with
  356. * a one from our database. If the database doesn't specify a file,
  357. * don't answer.
  358. */
  359. char*
  360. sunkernel(char *name)
  361. {
  362. ulong addr;
  363. uchar v4[IPv4addrlen];
  364. uchar v6[IPaddrlen];
  365. char buf[256];
  366. char ipbuf[128];
  367. char *suffix;
  368. addr = strtoul(name, &suffix, 16);
  369. if(suffix-name != 8 || (strcmp(suffix, "") != 0 && strcmp(suffix, ".SUN") != 0))
  370. return name;
  371. v4[0] = addr>>24;
  372. v4[1] = addr>>16;
  373. v4[2] = addr>>8;
  374. v4[3] = addr;
  375. v4tov6(v6, v4);
  376. sprint(ipbuf, "%I", v6);
  377. return lookup("ip", ipbuf, "bootf", buf, sizeof buf);
  378. }
  379. void
  380. remoteaddr(char *dir, char *raddr, int len)
  381. {
  382. char buf[64];
  383. int fd, n;
  384. snprint(buf, sizeof(buf), "%s/remote", dir);
  385. fd = open(buf, OREAD);
  386. if(fd < 0){
  387. snprint(raddr, sizeof(raddr), "unknown");
  388. return;
  389. }
  390. n = read(fd, raddr, len-1);
  391. close(fd);
  392. if(n <= 0){
  393. snprint(raddr, sizeof(raddr), "unknown");
  394. return;
  395. }
  396. if(n > 0)
  397. n--;
  398. raddr[n] = 0;
  399. }