1 /* SPDX-License-Identifier: MIT */
3 * tftp.c - a simple, read-only tftp server for qemu
5 * Copyright (c) 2004 Magnus Damm <damm@opensource.se>
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
28 #include <sys/types.h>
32 static inline int tftp_session_in_use(struct tftp_session
*spt
)
34 return (spt
->slirp
!= NULL
);
37 static inline void tftp_session_update(struct tftp_session
*spt
)
39 spt
->timestamp
= curtime
;
42 static void tftp_session_terminate(struct tftp_session
*spt
)
48 g_free(spt
->filename
);
52 static int tftp_session_allocate(Slirp
*slirp
, struct sockaddr_storage
*srcsas
,
55 struct tftp_session
*spt
;
58 for (k
= 0; k
< TFTP_SESSIONS_MAX
; k
++) {
59 spt
= &slirp
->tftp_sessions
[k
];
61 if (!tftp_session_in_use(spt
))
64 /* sessions time out after 5 inactive seconds */
65 if ((int)(curtime
- spt
->timestamp
) > 5000) {
66 tftp_session_terminate(spt
);
74 memset(spt
, 0, sizeof(*spt
));
75 memcpy(&spt
->client_addr
, srcsas
, sockaddr_size(srcsas
));
77 spt
->block_size
= 512;
78 spt
->client_port
= tp
->udp
.uh_sport
;
81 tftp_session_update(spt
);
86 static int tftp_session_find(Slirp
*slirp
, struct sockaddr_storage
*srcsas
,
89 struct tftp_session
*spt
;
92 for (k
= 0; k
< TFTP_SESSIONS_MAX
; k
++) {
93 spt
= &slirp
->tftp_sessions
[k
];
95 if (tftp_session_in_use(spt
)) {
96 if (sockaddr_equal(&spt
->client_addr
, srcsas
)) {
97 if (spt
->client_port
== tp
->udp
.uh_sport
) {
107 static int tftp_read_data(struct tftp_session
*spt
, uint32_t block_nr
,
108 uint8_t *buf
, int len
)
113 spt
->fd
= open(spt
->filename
, O_RDONLY
| O_BINARY
);
121 lseek(spt
->fd
, block_nr
* spt
->block_size
, SEEK_SET
);
123 bytes_read
= read(spt
->fd
, buf
, len
);
129 static struct tftp_t
*tftp_prep_mbuf_data(struct tftp_session
*spt
,
134 memset(m
->m_data
, 0, m
->m_size
);
136 m
->m_data
+= IF_MAXLINKHDR
;
137 if (spt
->client_addr
.ss_family
== AF_INET6
) {
138 m
->m_data
+= sizeof(struct ip6
);
140 m
->m_data
+= sizeof(struct ip
);
142 tp
= (void *)m
->m_data
;
143 m
->m_data
+= sizeof(struct udphdr
);
148 static void tftp_udp_output(struct tftp_session
*spt
, struct mbuf
*m
,
149 struct tftp_t
*recv_tp
)
151 if (spt
->client_addr
.ss_family
== AF_INET6
) {
152 struct sockaddr_in6 sa6
, da6
;
154 sa6
.sin6_addr
= spt
->slirp
->vhost_addr6
;
155 sa6
.sin6_port
= recv_tp
->udp
.uh_dport
;
156 da6
.sin6_addr
= ((struct sockaddr_in6
*)&spt
->client_addr
)->sin6_addr
;
157 da6
.sin6_port
= spt
->client_port
;
159 udp6_output(NULL
, m
, &sa6
, &da6
);
161 struct sockaddr_in sa4
, da4
;
163 sa4
.sin_addr
= spt
->slirp
->vhost_addr
;
164 sa4
.sin_port
= recv_tp
->udp
.uh_dport
;
165 da4
.sin_addr
= ((struct sockaddr_in
*)&spt
->client_addr
)->sin_addr
;
166 da4
.sin_port
= spt
->client_port
;
168 udp_output(NULL
, m
, &sa4
, &da4
, IPTOS_LOWDELAY
);
172 static int tftp_send_oack(struct tftp_session
*spt
,
173 const char *keys
[], uint32_t values
[], int nb
,
174 struct tftp_t
*recv_tp
)
180 m
= m_get(spt
->slirp
);
185 tp
= tftp_prep_mbuf_data(spt
, m
);
187 tp
->tp_op
= htons(TFTP_OACK
);
188 for (i
= 0; i
< nb
; i
++) {
189 n
+= snprintf(tp
->x
.tp_buf
+ n
, sizeof(tp
->x
.tp_buf
) - n
, "%s",
191 n
+= snprintf(tp
->x
.tp_buf
+ n
, sizeof(tp
->x
.tp_buf
) - n
, "%u",
195 m
->m_len
= sizeof(struct tftp_t
) - (TFTP_BLOCKSIZE_MAX
+ 2) + n
196 - sizeof(struct udphdr
);
197 tftp_udp_output(spt
, m
, recv_tp
);
202 static void tftp_send_error(struct tftp_session
*spt
,
203 uint16_t errorcode
, const char *msg
,
204 struct tftp_t
*recv_tp
)
209 DEBUG_TFTP("tftp error msg: %s", msg
);
211 m
= m_get(spt
->slirp
);
217 tp
= tftp_prep_mbuf_data(spt
, m
);
219 tp
->tp_op
= htons(TFTP_ERROR
);
220 tp
->x
.tp_error
.tp_error_code
= htons(errorcode
);
221 slirp_pstrcpy((char *)tp
->x
.tp_error
.tp_msg
, sizeof(tp
->x
.tp_error
.tp_msg
), msg
);
223 m
->m_len
= sizeof(struct tftp_t
) - (TFTP_BLOCKSIZE_MAX
+ 2) + 3 + strlen(msg
)
224 - sizeof(struct udphdr
);
225 tftp_udp_output(spt
, m
, recv_tp
);
228 tftp_session_terminate(spt
);
231 static void tftp_send_next_block(struct tftp_session
*spt
,
232 struct tftp_t
*recv_tp
)
238 m
= m_get(spt
->slirp
);
244 tp
= tftp_prep_mbuf_data(spt
, m
);
246 tp
->tp_op
= htons(TFTP_DATA
);
247 tp
->x
.tp_data
.tp_block_nr
= htons((spt
->block_nr
+ 1) & 0xffff);
249 nobytes
= tftp_read_data(spt
, spt
->block_nr
, tp
->x
.tp_data
.tp_buf
,
255 /* send "file not found" error back */
257 tftp_send_error(spt
, 1, "File not found", tp
);
262 m
->m_len
= sizeof(struct tftp_t
) - (TFTP_BLOCKSIZE_MAX
- nobytes
)
263 - sizeof(struct udphdr
);
264 tftp_udp_output(spt
, m
, recv_tp
);
266 if (nobytes
== spt
->block_size
) {
267 tftp_session_update(spt
);
270 tftp_session_terminate(spt
);
276 static void tftp_handle_rrq(Slirp
*slirp
, struct sockaddr_storage
*srcsas
,
277 struct tftp_t
*tp
, int pktlen
)
279 struct tftp_session
*spt
;
283 const char *option_name
[2];
284 uint32_t option_value
[2];
287 /* check if a session already exists and if so terminate it */
288 s
= tftp_session_find(slirp
, srcsas
, tp
);
290 tftp_session_terminate(&slirp
->tftp_sessions
[s
]);
293 s
= tftp_session_allocate(slirp
, srcsas
, tp
);
299 spt
= &slirp
->tftp_sessions
[s
];
301 /* unspecified prefix means service disabled */
302 if (!slirp
->tftp_prefix
) {
303 tftp_send_error(spt
, 2, "Access violation", tp
);
307 /* skip header fields */
309 pktlen
-= offsetof(struct tftp_t
, x
.tp_buf
);
311 /* prepend tftp_prefix */
312 prefix_len
= strlen(slirp
->tftp_prefix
);
313 spt
->filename
= g_malloc(prefix_len
+ TFTP_FILENAME_MAX
+ 2);
314 memcpy(spt
->filename
, slirp
->tftp_prefix
, prefix_len
);
315 spt
->filename
[prefix_len
] = '/';
318 req_fname
= spt
->filename
+ prefix_len
+ 1;
321 if (k
>= TFTP_FILENAME_MAX
|| k
>= pktlen
) {
322 tftp_send_error(spt
, 2, "Access violation", tp
);
325 req_fname
[k
] = tp
->x
.tp_buf
[k
];
326 if (req_fname
[k
++] == '\0') {
331 DEBUG_TFTP("tftp rrq file: %s", req_fname
);
334 if ((pktlen
- k
) < 6) {
335 tftp_send_error(spt
, 2, "Access violation", tp
);
339 if (strcasecmp(&tp
->x
.tp_buf
[k
], "octet") != 0) {
340 tftp_send_error(spt
, 4, "Unsupported transfer mode", tp
);
344 k
+= 6; /* skipping octet */
346 /* do sanity checks on the filename */
347 if (!strncmp(req_fname
, "../", 3) ||
348 req_fname
[strlen(req_fname
) - 1] == '/' ||
349 strstr(req_fname
, "/../")) {
350 tftp_send_error(spt
, 2, "Access violation", tp
);
354 /* check if the file exists */
355 if (tftp_read_data(spt
, 0, NULL
, 0) < 0) {
356 tftp_send_error(spt
, 1, "File not found", tp
);
360 if (tp
->x
.tp_buf
[pktlen
- 1] != 0) {
361 tftp_send_error(spt
, 2, "Access violation", tp
);
365 while (k
< pktlen
&& nb_options
< G_N_ELEMENTS(option_name
)) {
366 const char *key
, *value
;
368 key
= &tp
->x
.tp_buf
[k
];
369 k
+= strlen(key
) + 1;
372 tftp_send_error(spt
, 2, "Access violation", tp
);
376 value
= &tp
->x
.tp_buf
[k
];
377 k
+= strlen(value
) + 1;
379 if (strcasecmp(key
, "tsize") == 0) {
380 int tsize
= atoi(value
);
384 if (stat(spt
->filename
, &stat_p
) == 0)
385 tsize
= stat_p
.st_size
;
387 tftp_send_error(spt
, 1, "File not found", tp
);
392 option_name
[nb_options
] = "tsize";
393 option_value
[nb_options
] = tsize
;
395 } else if (strcasecmp(key
, "blksize") == 0) {
396 int blksize
= atoi(value
);
398 /* Accept blksize up to our maximum size */
400 spt
->block_size
= MIN(blksize
, TFTP_BLOCKSIZE_MAX
);
401 option_name
[nb_options
] = "blksize";
402 option_value
[nb_options
] = spt
->block_size
;
408 if (nb_options
> 0) {
409 assert(nb_options
<= G_N_ELEMENTS(option_name
));
410 tftp_send_oack(spt
, option_name
, option_value
, nb_options
, tp
);
415 tftp_send_next_block(spt
, tp
);
418 static void tftp_handle_ack(Slirp
*slirp
, struct sockaddr_storage
*srcsas
,
419 struct tftp_t
*tp
, int pktlen
)
423 s
= tftp_session_find(slirp
, srcsas
, tp
);
429 tftp_send_next_block(&slirp
->tftp_sessions
[s
], tp
);
432 static void tftp_handle_error(Slirp
*slirp
, struct sockaddr_storage
*srcsas
,
433 struct tftp_t
*tp
, int pktlen
)
437 s
= tftp_session_find(slirp
, srcsas
, tp
);
443 tftp_session_terminate(&slirp
->tftp_sessions
[s
]);
446 void tftp_input(struct sockaddr_storage
*srcsas
, struct mbuf
*m
)
448 struct tftp_t
*tp
= (struct tftp_t
*)m
->m_data
;
450 switch(ntohs(tp
->tp_op
)) {
452 tftp_handle_rrq(m
->slirp
, srcsas
, tp
, m
->m_len
);
456 tftp_handle_ack(m
->slirp
, srcsas
, tp
, m
->m_len
);
460 tftp_handle_error(m
->slirp
, srcsas
, tp
, m
->m_len
);