2 * tftp.c - a simple, read-only tftp server for qemu
4 * Copyright (c) 2004 Magnus Damm <damm@opensource.se>
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 #include "qemu-common.h"
28 static inline int tftp_session_in_use(struct tftp_session
*spt
)
30 return (spt
->slirp
!= NULL
);
33 static inline void tftp_session_update(struct tftp_session
*spt
)
35 spt
->timestamp
= curtime
;
38 static void tftp_session_terminate(struct tftp_session
*spt
)
44 g_free(spt
->filename
);
48 static int tftp_session_allocate(Slirp
*slirp
, struct tftp_t
*tp
)
50 struct tftp_session
*spt
;
53 for (k
= 0; k
< TFTP_SESSIONS_MAX
; k
++) {
54 spt
= &slirp
->tftp_sessions
[k
];
56 if (!tftp_session_in_use(spt
))
59 /* sessions time out after 5 inactive seconds */
60 if ((int)(curtime
- spt
->timestamp
) > 5000) {
61 tftp_session_terminate(spt
);
69 memset(spt
, 0, sizeof(*spt
));
70 memcpy(&spt
->client_ip
, &tp
->ip
.ip_src
, sizeof(spt
->client_ip
));
72 spt
->client_port
= tp
->udp
.uh_sport
;
75 tftp_session_update(spt
);
80 static int tftp_session_find(Slirp
*slirp
, struct tftp_t
*tp
)
82 struct tftp_session
*spt
;
85 for (k
= 0; k
< TFTP_SESSIONS_MAX
; k
++) {
86 spt
= &slirp
->tftp_sessions
[k
];
88 if (tftp_session_in_use(spt
)) {
89 if (!memcmp(&spt
->client_ip
, &tp
->ip
.ip_src
, sizeof(spt
->client_ip
))) {
90 if (spt
->client_port
== tp
->udp
.uh_sport
) {
100 static int tftp_read_data(struct tftp_session
*spt
, uint32_t block_nr
,
101 uint8_t *buf
, int len
)
106 spt
->fd
= open(spt
->filename
, O_RDONLY
| O_BINARY
);
114 lseek(spt
->fd
, block_nr
* 512, SEEK_SET
);
116 bytes_read
= read(spt
->fd
, buf
, len
);
122 static int tftp_send_oack(struct tftp_session
*spt
,
123 const char *key
, uint32_t value
,
124 struct tftp_t
*recv_tp
)
126 struct sockaddr_in saddr
, daddr
;
131 m
= m_get(spt
->slirp
);
136 memset(m
->m_data
, 0, m
->m_size
);
138 m
->m_data
+= IF_MAXLINKHDR
;
139 tp
= (void *)m
->m_data
;
140 m
->m_data
+= sizeof(struct udpiphdr
);
142 tp
->tp_op
= htons(TFTP_OACK
);
143 n
+= snprintf(tp
->x
.tp_buf
+ n
, sizeof(tp
->x
.tp_buf
) - n
, "%s",
145 n
+= snprintf(tp
->x
.tp_buf
+ n
, sizeof(tp
->x
.tp_buf
) - n
, "%u",
148 saddr
.sin_addr
= recv_tp
->ip
.ip_dst
;
149 saddr
.sin_port
= recv_tp
->udp
.uh_dport
;
151 daddr
.sin_addr
= spt
->client_ip
;
152 daddr
.sin_port
= spt
->client_port
;
154 m
->m_len
= sizeof(struct tftp_t
) - 514 + n
-
155 sizeof(struct ip
) - sizeof(struct udphdr
);
156 udp_output2(NULL
, m
, &saddr
, &daddr
, IPTOS_LOWDELAY
);
161 static void tftp_send_error(struct tftp_session
*spt
,
162 uint16_t errorcode
, const char *msg
,
163 struct tftp_t
*recv_tp
)
165 struct sockaddr_in saddr
, daddr
;
169 m
= m_get(spt
->slirp
);
175 memset(m
->m_data
, 0, m
->m_size
);
177 m
->m_data
+= IF_MAXLINKHDR
;
178 tp
= (void *)m
->m_data
;
179 m
->m_data
+= sizeof(struct udpiphdr
);
181 tp
->tp_op
= htons(TFTP_ERROR
);
182 tp
->x
.tp_error
.tp_error_code
= htons(errorcode
);
183 pstrcpy((char *)tp
->x
.tp_error
.tp_msg
, sizeof(tp
->x
.tp_error
.tp_msg
), msg
);
185 saddr
.sin_addr
= recv_tp
->ip
.ip_dst
;
186 saddr
.sin_port
= recv_tp
->udp
.uh_dport
;
188 daddr
.sin_addr
= spt
->client_ip
;
189 daddr
.sin_port
= spt
->client_port
;
191 m
->m_len
= sizeof(struct tftp_t
) - 514 + 3 + strlen(msg
) -
192 sizeof(struct ip
) - sizeof(struct udphdr
);
194 udp_output2(NULL
, m
, &saddr
, &daddr
, IPTOS_LOWDELAY
);
197 tftp_session_terminate(spt
);
200 static void tftp_send_next_block(struct tftp_session
*spt
,
201 struct tftp_t
*recv_tp
)
203 struct sockaddr_in saddr
, daddr
;
208 m
= m_get(spt
->slirp
);
214 memset(m
->m_data
, 0, m
->m_size
);
216 m
->m_data
+= IF_MAXLINKHDR
;
217 tp
= (void *)m
->m_data
;
218 m
->m_data
+= sizeof(struct udpiphdr
);
220 tp
->tp_op
= htons(TFTP_DATA
);
221 tp
->x
.tp_data
.tp_block_nr
= htons((spt
->block_nr
+ 1) & 0xffff);
223 saddr
.sin_addr
= recv_tp
->ip
.ip_dst
;
224 saddr
.sin_port
= recv_tp
->udp
.uh_dport
;
226 daddr
.sin_addr
= spt
->client_ip
;
227 daddr
.sin_port
= spt
->client_port
;
229 nobytes
= tftp_read_data(spt
, spt
->block_nr
, tp
->x
.tp_data
.tp_buf
, 512);
234 /* send "file not found" error back */
236 tftp_send_error(spt
, 1, "File not found", tp
);
241 m
->m_len
= sizeof(struct tftp_t
) - (512 - nobytes
) -
242 sizeof(struct ip
) - sizeof(struct udphdr
);
244 udp_output2(NULL
, m
, &saddr
, &daddr
, IPTOS_LOWDELAY
);
246 if (nobytes
== 512) {
247 tftp_session_update(spt
);
250 tftp_session_terminate(spt
);
256 static void tftp_handle_rrq(Slirp
*slirp
, struct tftp_t
*tp
, int pktlen
)
258 struct tftp_session
*spt
;
263 /* check if a session already exists and if so terminate it */
264 s
= tftp_session_find(slirp
, tp
);
266 tftp_session_terminate(&slirp
->tftp_sessions
[s
]);
269 s
= tftp_session_allocate(slirp
, tp
);
275 spt
= &slirp
->tftp_sessions
[s
];
277 /* unspecifed prefix means service disabled */
278 if (!slirp
->tftp_prefix
) {
279 tftp_send_error(spt
, 2, "Access violation", tp
);
283 /* skip header fields */
285 pktlen
-= offsetof(struct tftp_t
, x
.tp_buf
);
287 /* prepend tftp_prefix */
288 prefix_len
= strlen(slirp
->tftp_prefix
);
289 spt
->filename
= g_malloc(prefix_len
+ TFTP_FILENAME_MAX
+ 2);
290 memcpy(spt
->filename
, slirp
->tftp_prefix
, prefix_len
);
291 spt
->filename
[prefix_len
] = '/';
294 req_fname
= spt
->filename
+ prefix_len
+ 1;
297 if (k
>= TFTP_FILENAME_MAX
|| k
>= pktlen
) {
298 tftp_send_error(spt
, 2, "Access violation", tp
);
301 req_fname
[k
] = tp
->x
.tp_buf
[k
];
302 if (req_fname
[k
++] == '\0') {
308 if ((pktlen
- k
) < 6) {
309 tftp_send_error(spt
, 2, "Access violation", tp
);
313 if (strcasecmp(&tp
->x
.tp_buf
[k
], "octet") != 0) {
314 tftp_send_error(spt
, 4, "Unsupported transfer mode", tp
);
318 k
+= 6; /* skipping octet */
320 /* do sanity checks on the filename */
321 if (!strncmp(req_fname
, "../", 3) ||
322 req_fname
[strlen(req_fname
) - 1] == '/' ||
323 strstr(req_fname
, "/../")) {
324 tftp_send_error(spt
, 2, "Access violation", tp
);
328 /* check if the file exists */
329 if (tftp_read_data(spt
, 0, NULL
, 0) < 0) {
330 tftp_send_error(spt
, 1, "File not found", tp
);
334 if (tp
->x
.tp_buf
[pktlen
- 1] != 0) {
335 tftp_send_error(spt
, 2, "Access violation", tp
);
340 const char *key
, *value
;
342 key
= &tp
->x
.tp_buf
[k
];
343 k
+= strlen(key
) + 1;
346 tftp_send_error(spt
, 2, "Access violation", tp
);
350 value
= &tp
->x
.tp_buf
[k
];
351 k
+= strlen(value
) + 1;
353 if (strcasecmp(key
, "tsize") == 0) {
354 int tsize
= atoi(value
);
358 if (stat(spt
->filename
, &stat_p
) == 0)
359 tsize
= stat_p
.st_size
;
361 tftp_send_error(spt
, 1, "File not found", tp
);
366 tftp_send_oack(spt
, "tsize", tsize
, tp
);
372 tftp_send_next_block(spt
, tp
);
375 static void tftp_handle_ack(Slirp
*slirp
, struct tftp_t
*tp
, int pktlen
)
379 s
= tftp_session_find(slirp
, tp
);
385 tftp_send_next_block(&slirp
->tftp_sessions
[s
], tp
);
388 static void tftp_handle_error(Slirp
*slirp
, struct tftp_t
*tp
, int pktlen
)
392 s
= tftp_session_find(slirp
, tp
);
398 tftp_session_terminate(&slirp
->tftp_sessions
[s
]);
401 void tftp_input(struct mbuf
*m
)
403 struct tftp_t
*tp
= (struct tftp_t
*)m
->m_data
;
405 switch(ntohs(tp
->tp_op
)) {
407 tftp_handle_rrq(m
->slirp
, tp
, m
->m_len
);
411 tftp_handle_ack(m
->slirp
, tp
, m
->m_len
);
415 tftp_handle_error(m
->slirp
, tp
, m
->m_len
);