release/src/router/dnsmasq/src/tftp.c

   1 /* dnsmasq is Copyright (c) 2000-2013 Simon Kelley
   2
   3    This program is free software; you can redistribute it and/or modify
   4    it under the terms of the GNU General Public License as published by
   5    the Free Software Foundation; version 2 dated June, 1991, or
   6    (at your option) version 3 dated 29 June, 2007.
   7
   8    This program is distributed in the hope that it will be useful,
   9    but WITHOUT ANY WARRANTY; without even the implied warranty of
  10    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  11    GNU General Public License for more details.
  12
  13    You should have received a copy of the GNU General Public License
  14    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  15 */
  16
  17 #include "dnsmasq.h"
  18
  19 #ifdef HAVE_TFTP
  20
  21 static struct tftp_file *check_tftp_fileperm(ssize_t *len, char *prefix);
  22 static void free_transfer(struct tftp_transfer *transfer);
  23 static ssize_t tftp_err(int err, char *packet, char *mess, char *file);
  24 static ssize_t tftp_err_oops(char *packet, char *file);
  25 static ssize_t get_block(char *packet, struct tftp_transfer *transfer);
  26 static char *next(char **p, char *end);
  27 static void sanitise(char *buf);
  28
  29 #define OP_RRQ  1
  30 #define OP_WRQ  2
  31 #define OP_DATA 3
  32 #define OP_ACK  4
  33 #define OP_ERR  5
  34 #define OP_OACK 6
  35
  36 #define ERR_NOTDEF 0
  37 #define ERR_FNF    1
  38 #define ERR_PERM   2
  39 #define ERR_FULL   3
  40 #define ERR_ILL    4
  41
  42 void tftp_request(struct listener *listen, time_t now)
  43 {
  44   ssize_t len;
  45   char *packet = daemon->packet;
  46   char *filename, *mode, *p, *end, *opt;
  47   union mysockaddr addr, peer;
  48   struct msghdr msg;
  49   struct iovec iov;
  50   struct ifreq ifr;
  51   int is_err = 1, if_index = 0, mtu = 0;
  52 #ifdef HAVE_DHCP
  53   struct iname *tmp;
  54 #endif
  55   struct tftp_transfer *transfer;
  56   int port = daemon->start_tftp_port; /* may be zero to use ephemeral port */
  57 #if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
  58   int mtuflag = IP_PMTUDISC_DONT;
  59 #endif
  60   char namebuff[IF_NAMESIZE];
  61   char *name = NULL;
  62   char *prefix = daemon->tftp_prefix;
  63   struct tftp_prefix *pref;
  64   struct all_addr addra;
  65
  66   union {
  67     struct cmsghdr align; /* this ensures alignment */
  68 #ifdef HAVE_IPV6
  69     char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
  70 #endif
  71 #if defined(HAVE_LINUX_NETWORK)
  72     char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
  73 #elif defined(HAVE_SOLARIS_NETWORK)
  74     char control[CMSG_SPACE(sizeof(unsigned int))];
  75 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
  76     char control[CMSG_SPACE(sizeof(struct sockaddr_dl))];
  77 #endif
  78   } control_u;
  79
  80   msg.msg_controllen = sizeof(control_u);
  81   msg.msg_control = control_u.control;
  82   msg.msg_flags = 0;
  83   msg.msg_name = &peer;
  84   msg.msg_namelen = sizeof(peer);
  85   msg.msg_iov = &iov;
  86   msg.msg_iovlen = 1;
  87
  88   iov.iov_base = packet;
  89   iov.iov_len = daemon->packet_buff_sz;
  90
  91   /* we overwrote the buffer... */
  92   daemon->srv_save = NULL;
  93
  94   if ((len = recvmsg(listen->tftpfd, &msg, 0)) < 2)
  95     return;
  96
  97   if (option_bool(OPT_NOWILD))
  98     {
  99       if (listen->iface)
 100         {
 101           addr = listen->iface->addr;
 102           mtu = listen->iface->mtu;
 103           name = listen->iface->name;
 104         }
 105       else
 106         {
 107           /* we're listening on an address that doesn't appear on an interface,
 108              ask the kernel what the socket is bound to */
 109           socklen_t tcp_len = sizeof(union mysockaddr);
 110           if (getsockname(listen->tftpfd, (struct sockaddr *)&addr, &tcp_len) == -1)
 111             return;
 112         }
 113     }
 114   else
 115     {
 116       struct cmsghdr *cmptr;
 117
 118       if (msg.msg_controllen < sizeof(struct cmsghdr))
 119         return;
 120
 121       addr.sa.sa_family = listen->family;
 122
 123 #if defined(HAVE_LINUX_NETWORK)
 124       if (listen->family == AF_INET)
 125         for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
 126           if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO)
 127             {
 128               union {
 129                 unsigned char *c;
 130                 struct in_pktinfo *p;
 131               } p;
 132               p.c = CMSG_DATA(cmptr);
 133               addr.in.sin_addr = p.p->ipi_spec_dst;
 134               if_index = p.p->ipi_ifindex;
 135             }
 136
 137 #elif defined(HAVE_SOLARIS_NETWORK)
 138       if (listen->family == AF_INET)
 139         for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
 140           {
 141             union {
 142               unsigned char *c;
 143               struct in_addr *a;
 144               unsigned int *i;
 145             } p;
 146             p.c = CMSG_DATA(cmptr);
 147             if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
 148             addr.in.sin_addr = *(p.a);
 149             else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
 150             if_index = *(p.i);
 151           }
 152
 153 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
 154       if (listen->family == AF_INET)
 155         for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
 156           {
 157             union {
 158               unsigned char *c;
 159               struct in_addr *a;
 160               struct sockaddr_dl *s;
 161             } p;
 162             p.c = CMSG_DATA(cmptr);
 163             if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
 164               addr.in.sin_addr = *(p.a);
 165             else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
 166               if_index = p.s->sdl_index;
 167           }
 168
 169 #endif
 170
 171 #ifdef HAVE_IPV6
 172       if (listen->family == AF_INET6)
 173         {
 174           for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
 175             if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo)
 176               {
 177                 union {
 178                   unsigned char *c;
 179                   struct in6_pktinfo *p;
 180                 } p;
 181                 p.c = CMSG_DATA(cmptr);
 182
 183                 addr.in6.sin6_addr = p.p->ipi6_addr;
 184                 if_index = p.p->ipi6_ifindex;
 185               }
 186         }
 187 #endif
 188
 189       if (!indextoname(listen->tftpfd, if_index, namebuff))
 190         return;
 191
 192       name = namebuff;
 193
 194       addra.addr.addr4 = addr.in.sin_addr;
 195
 196 #ifdef HAVE_IPV6
 197       if (listen->family == AF_INET6)
 198         addra.addr.addr6 = addr.in6.sin6_addr;
 199 #endif
 200
 201       if (!iface_check(listen->family, &addra, name, NULL))
 202         {
 203           if (!option_bool(OPT_CLEVERBIND))
 204             enumerate_interfaces(0);
 205           if (!loopback_exception(listen->tftpfd, listen->family, &addra, name) &&
 206               !label_exception(if_index, listen->family, &addra) )
 207             return;
 208         }
 209
 210 #ifdef HAVE_DHCP
 211       /* allowed interfaces are the same as for DHCP */
 212       for (tmp = daemon->dhcp_except; tmp; tmp = tmp->next)
 213         if (tmp->name && wildcard_match(tmp->name, name))
 214           return;
 215 #endif
 216
 217       strncpy(ifr.ifr_name, name, IF_NAMESIZE);
 218       if (ioctl(listen->tftpfd, SIOCGIFMTU, &ifr) != -1)
 219         mtu = ifr.ifr_mtu;
 220     }
 221
 222   if (name)
 223     {
 224       /* check for per-interface prefix */
 225       for (pref = daemon->if_prefix; pref; pref = pref->next)
 226         if (strcmp(pref->interface, name) == 0)
 227           prefix = pref->prefix;
 228     }
 229
 230   if (listen->family == AF_INET)
 231     {
 232       addr.in.sin_port = htons(port);
 233 #ifdef HAVE_SOCKADDR_SA_LEN
 234       addr.in.sin_len = sizeof(addr.in);
 235 #endif
 236     }
 237 #ifdef HAVE_IPV6
 238   else
 239     {
 240       addr.in6.sin6_port = htons(port);
 241       addr.in6.sin6_flowinfo = 0;
 242       addr.in6.sin6_scope_id = 0;
 243 #ifdef HAVE_SOCKADDR_SA_LEN
 244       addr.in6.sin6_len = sizeof(addr.in6);
 245 #endif
 246     }
 247 #endif
 248
 249   if (!(transfer = whine_malloc(sizeof(struct tftp_transfer))))
 250     return;
 251
 252   if ((transfer->sockfd = socket(listen->family, SOCK_DGRAM, 0)) == -1)
 253     {
 254       free(transfer);
 255       return;
 256     }
 257
 258   transfer->peer = peer;
 259   transfer->timeout = now + 2;
 260   transfer->backoff = 1;
 261   transfer->block = 1;
 262   transfer->blocksize = 512;
 263   transfer->offset = 0;
 264   transfer->file = NULL;
 265   transfer->opt_blocksize = transfer->opt_transize = 0;
 266   transfer->netascii = transfer->carrylf = 0;
 267
 268   prettyprint_addr(&peer, daemon->addrbuff);
 269
 270   /* if we have a nailed-down range, iterate until we find a free one. */
 271   while (1)
 272     {
 273       if (bind(transfer->sockfd, &addr.sa, sa_len(&addr)) == -1 ||
 274 #if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
 275           setsockopt(transfer->sockfd, IPPROTO_IP, IP_MTU_DISCOVER, &mtuflag, sizeof(mtuflag)) == -1 ||
 276 #endif
 277           !fix_fd(transfer->sockfd))
 278         {
 279           if (errno == EADDRINUSE && daemon->start_tftp_port != 0)
 280             {
 281               if (++port <= daemon->end_tftp_port)
 282                 {
 283                   if (listen->family == AF_INET)
 284                     addr.in.sin_port = htons(port);
 285 #ifdef HAVE_IPV6
 286                   else
 287                      addr.in6.sin6_port = htons(port);
 288 #endif
 289                   continue;
 290                 }
 291               my_syslog(MS_TFTP | LOG_ERR, _("unable to get free port for TFTP"));
 292             }
 293           free_transfer(transfer);
 294           return;
 295         }
 296       break;
 297     }
 298
 299   p = packet + 2;
 300   end = packet + len;
 301
 302   if (ntohs(*((unsigned short *)packet)) != OP_RRQ ||
 303       !(filename = next(&p, end)) ||
 304       !(mode = next(&p, end)) ||
 305       (strcasecmp(mode, "octet") != 0 && strcasecmp(mode, "netascii") != 0))
 306     {
 307       len = tftp_err(ERR_ILL, packet, _("unsupported request from %s"), daemon->addrbuff);
 308       is_err = 1;
 309     }
 310   else
 311     {
 312       if (strcasecmp(mode, "netascii") == 0)
 313         transfer->netascii = 1;
 314
 315       while ((opt = next(&p, end)))
 316         {
 317           if (strcasecmp(opt, "blksize") == 0)
 318             {
 319               if ((opt = next(&p, end)) && !option_bool(OPT_TFTP_NOBLOCK))
 320                 {
 321                   transfer->blocksize = atoi(opt);
 322                   if (transfer->blocksize < 1)
 323                     transfer->blocksize = 1;
 324                   if (transfer->blocksize > (unsigned)daemon->packet_buff_sz - 4)
 325                     transfer->blocksize = (unsigned)daemon->packet_buff_sz - 4;
 326                   /* 32 bytes for IP, UDP and TFTP headers */
 327                   if (mtu != 0 && transfer->blocksize > (unsigned)mtu - 32)
 328                     transfer->blocksize = (unsigned)mtu - 32;
 329                   transfer->opt_blocksize = 1;
 330                   transfer->block = 0;
 331                 }
 332             }
 333           else if (strcasecmp(opt, "tsize") == 0 && next(&p, end) && !transfer->netascii)
 334             {
 335               transfer->opt_transize = 1;
 336               transfer->block = 0;
 337             }
 338         }
 339
 340       /* cope with backslashes from windows boxen. */
 341       for (p = filename; *p; p++)
 342         if (*p == '\\')
 343           *p = '/';
 344         else if (option_bool(OPT_TFTP_LC))
 345           *p = tolower(*p);
 346
 347       strcpy(daemon->namebuff, "/");
 348       if (prefix)
 349         {
 350           if (prefix[0] == '/')
 351             daemon->namebuff[0] = 0;
 352           strncat(daemon->namebuff, prefix, (MAXDNAME-1) - strlen(daemon->namebuff));
 353           if (prefix[strlen(prefix)-1] != '/')
 354             strncat(daemon->namebuff, "/", (MAXDNAME-1) - strlen(daemon->namebuff));
 355
 356           if (option_bool(OPT_TFTP_APREF))
 357             {
 358               size_t oldlen = strlen(daemon->namebuff);
 359               struct stat statbuf;
 360
 361               strncat(daemon->namebuff, daemon->addrbuff, (MAXDNAME-1) - strlen(daemon->namebuff));
 362               strncat(daemon->namebuff, "/", (MAXDNAME-1) - strlen(daemon->namebuff));
 363
 364               /* remove unique-directory if it doesn't exist */
 365               if (stat(daemon->namebuff, &statbuf) == -1 || !S_ISDIR(statbuf.st_mode))
 366                 daemon->namebuff[oldlen] = 0;
 367             }
 368
 369           /* Absolute pathnames OK if they match prefix */
 370           if (filename[0] == '/')
 371             {
 372               if (strstr(filename, daemon->namebuff) == filename)
 373                 daemon->namebuff[0] = 0;
 374               else
 375                 filename++;
 376             }
 377         }
 378       else if (filename[0] == '/')
 379         daemon->namebuff[0] = 0;
 380       strncat(daemon->namebuff, filename, (MAXDNAME-1) - strlen(daemon->namebuff));
 381
 382       /* check permissions and open file */
 383       if ((transfer->file = check_tftp_fileperm(&len, prefix)))
 384         {
 385           if ((len = get_block(packet, transfer)) == -1)
 386             len = tftp_err_oops(packet, daemon->namebuff);
 387           else
 388             is_err = 0;
 389         }
 390     }
 391
 392   while (sendto(transfer->sockfd, packet, len, 0,
 393                 (struct sockaddr *)&peer, sa_len(&peer)) == -1 && errno == EINTR);
 394
 395   if (is_err)
 396     free_transfer(transfer);
 397   else
 398     {
 399       transfer->next = daemon->tftp_trans;
 400       daemon->tftp_trans = transfer;
 401     }
 402 }
 403
 404 static struct tftp_file *check_tftp_fileperm(ssize_t *len, char *prefix)
 405 {
 406   char *packet = daemon->packet, *namebuff = daemon->namebuff;
 407   struct tftp_file *file;
 408   struct tftp_transfer *t;
 409   uid_t uid = geteuid();
 410   struct stat statbuf;
 411   int fd = -1;
 412
 413   /* trick to ban moving out of the subtree */
 414   if (prefix && strstr(namebuff, "/../"))
 415     goto perm;
 416
 417   if ((fd = open(namebuff, O_RDONLY)) == -1)
 418     {
 419       if (errno == ENOENT)
 420         {
 421           *len = tftp_err(ERR_FNF, packet, _("file %s not found"), namebuff);
 422           return NULL;
 423         }
 424       else if (errno == EACCES)
 425         goto perm;
 426       else
 427         goto oops;
 428     }
 429
 430   /* stat the file descriptor to avoid stat->open races */
 431   if (fstat(fd, &statbuf) == -1)
 432     goto oops;
 433
 434   /* running as root, must be world-readable */
 435   if (uid == 0)
 436     {
 437       if (!(statbuf.st_mode & S_IROTH))
 438         goto perm;
 439     }
 440   /* in secure mode, must be owned by user running dnsmasq */
 441   else if (option_bool(OPT_TFTP_SECURE) && uid != statbuf.st_uid)
 442     goto perm;
 443
 444   /* If we're doing many tranfers from the same file, only
 445      open it once this saves lots of file descriptors
 446      when mass-booting a big cluster, for instance.
 447      Be conservative and only share when inode and name match
 448      this keeps error messages sane. */
 449   for (t = daemon->tftp_trans; t; t = t->next)
 450     if (t->file->dev == statbuf.st_dev &&
 451         t->file->inode == statbuf.st_ino &&
 452         strcmp(t->file->filename, namebuff) == 0)
 453       {
 454         close(fd);
 455         t->file->refcount++;
 456         return t->file;
 457       }
 458
 459   if (!(file = whine_malloc(sizeof(struct tftp_file) + strlen(namebuff) + 1)))
 460     {
 461       errno = ENOMEM;
 462       goto oops;
 463     }
 464
 465   file->fd = fd;
 466   file->size = statbuf.st_size;
 467   file->dev = statbuf.st_dev;
 468   file->inode = statbuf.st_ino;
 469   file->refcount = 1;
 470   strcpy(file->filename, namebuff);
 471   return file;
 472
 473  perm:
 474   errno = EACCES;
 475   *len =  tftp_err(ERR_PERM, packet, _("cannot access %s: %s"), namebuff);
 476   if (fd != -1)
 477     close(fd);
 478   return NULL;
 479
 480  oops:
 481   *len =  tftp_err_oops(packet, namebuff);
 482   if (fd != -1)
 483     close(fd);
 484   return NULL;
 485 }
 486
 487 void check_tftp_listeners(fd_set *rset, time_t now)
 488 {
 489   struct tftp_transfer *transfer, *tmp, **up;
 490   ssize_t len;
 491
 492   struct ack {
 493     unsigned short op, block;
 494   } *mess = (struct ack *)daemon->packet;
 495
 496   /* Check for activity on any existing transfers */
 497   for (transfer = daemon->tftp_trans, up = &daemon->tftp_trans; transfer; transfer = tmp)
 498     {
 499       tmp = transfer->next;
 500
 501       prettyprint_addr(&transfer->peer, daemon->addrbuff);
 502
 503       if (FD_ISSET(transfer->sockfd, rset))
 504         {
 505           /* we overwrote the buffer... */
 506           daemon->srv_save = NULL;
 507
 508           if ((len = recv(transfer->sockfd, daemon->packet, daemon->packet_buff_sz, 0)) >= (ssize_t)sizeof(struct ack))
 509             {
 510               if (ntohs(mess->op) == OP_ACK && ntohs(mess->block) == (unsigned short)transfer->block)
 511                 {
 512                   /* Got ack, ensure we take the (re)transmit path */
 513                   transfer->timeout = now;
 514                   transfer->backoff = 0;
 515                   if (transfer->block++ != 0)
 516                     transfer->offset += transfer->blocksize - transfer->expansion;
 517                 }
 518               else if (ntohs(mess->op) == OP_ERR)
 519                 {
 520                   char *p = daemon->packet + sizeof(struct ack);
 521                   char *end = daemon->packet + len;
 522                   char *err = next(&p, end);
 523
 524                   /* Sanitise error message */
 525                   if (!err)
 526                     err = "";
 527                   else
 528                     sanitise(err);
 529
 530                   my_syslog(MS_TFTP | LOG_ERR, _("error %d %s received from %s"),
 531                             (int)ntohs(mess->block), err,
 532                             daemon->addrbuff);
 533
 534                   /* Got err, ensure we take abort */
 535                   transfer->timeout = now;
 536                   transfer->backoff = 100;
 537                 }
 538             }
 539         }
 540
 541       if (difftime(now, transfer->timeout) >= 0.0)
 542         {
 543           int endcon = 0;
 544
 545           /* timeout, retransmit */
 546           transfer->timeout += 1 + (1<<transfer->backoff);
 547
 548           /* we overwrote the buffer... */
 549           daemon->srv_save = NULL;
 550
 551           if ((len = get_block(daemon->packet, transfer)) == -1)
 552             {
 553               len = tftp_err_oops(daemon->packet, transfer->file->filename);
 554               endcon = 1;
 555             }
 556           /* don't complain about timeout when we're awaiting the last
 557              ACK, some clients never send it */
 558           else if (++transfer->backoff > 5 && len != 0)
 559             {
 560               endcon = 1;
 561               len = 0;
 562             }
 563
 564           if (len != 0)
 565             while(sendto(transfer->sockfd, daemon->packet, len, 0,
 566                          (struct sockaddr *)&transfer->peer, sa_len(&transfer->peer)) == -1 && errno == EINTR);
 567
 568           if (endcon || len == 0)
 569             {
 570               strcpy(daemon->namebuff, transfer->file->filename);
 571               sanitise(daemon->namebuff);
 572               my_syslog(MS_TFTP | LOG_INFO, endcon ? _("failed sending %s to %s") : _("sent %s to %s"), daemon->namebuff, daemon->addrbuff);
 573               /* unlink */
 574               *up = tmp;
 575               if (endcon)
 576                 free_transfer(transfer);
 577               else
 578                 {
 579                   /* put on queue to be sent to script and deleted */
 580                   transfer->next = daemon->tftp_done_trans;
 581                   daemon->tftp_done_trans = transfer;
 582                 }
 583               continue;
 584             }
 585         }
 586
 587       up = &transfer->next;
 588     }
 589 }
 590
 591 static void free_transfer(struct tftp_transfer *transfer)
 592 {
 593   close(transfer->sockfd);
 594   if (transfer->file && (--transfer->file->refcount) == 0)
 595     {
 596       close(transfer->file->fd);
 597       free(transfer->file);
 598     }
 599   free(transfer);
 600 }
 601
 602 static char *next(char **p, char *end)
 603 {
 604   char *ret = *p;
 605   size_t len;
 606
 607   if (*(end-1) != 0 ||
 608       *p == end ||
 609       (len = strlen(ret)) == 0)
 610     return NULL;
 611
 612   *p += len + 1;
 613   return ret;
 614 }
 615
 616 static void sanitise(char *buf)
 617 {
 618   unsigned char *q, *r;
 619   for (q = r = (unsigned char *)buf; *r; r++)
 620     if (isprint((int)*r))
 621       *(q++) = *r;
 622   *q = 0;
 623
 624 }
 625
 626 static ssize_t tftp_err(int err, char *packet, char *message, char *file)
 627 {
 628   struct errmess {
 629     unsigned short op, err;
 630     char message[];
 631   } *mess = (struct errmess *)packet;
 632   ssize_t ret = 4;
 633   char *errstr = strerror(errno);
 634
 635   sanitise(file);
 636
 637   mess->op = htons(OP_ERR);
 638   mess->err = htons(err);
 639   ret += (snprintf(mess->message, 500,  message, file, errstr) + 1);
 640   my_syslog(MS_TFTP | LOG_ERR, "%s", mess->message);
 641
 642   return  ret;
 643 }
 644
 645 static ssize_t tftp_err_oops(char *packet, char *file)
 646 {
 647   /* May have >1 refs to file, so potentially mangle a copy of the name */
 648   strcpy(daemon->namebuff, file);
 649   return tftp_err(ERR_NOTDEF, packet, _("cannot read %s: %s"), daemon->namebuff);
 650 }
 651
 652 /* return -1 for error, zero for done. */
 653 static ssize_t get_block(char *packet, struct tftp_transfer *transfer)
 654 {
 655   if (transfer->block == 0)
 656     {
 657       /* send OACK */
 658       char *p;
 659       struct oackmess {
 660         unsigned short op;
 661         char data[];
 662       } *mess = (struct oackmess *)packet;
 663
 664       p = mess->data;
 665       mess->op = htons(OP_OACK);
 666       if (transfer->opt_blocksize)
 667         {
 668           p += (sprintf(p, "blksize") + 1);
 669           p += (sprintf(p, "%d", transfer->blocksize) + 1);
 670         }
 671       if (transfer->opt_transize)
 672         {
 673           p += (sprintf(p,"tsize") + 1);
 674           p += (sprintf(p, "%u", (unsigned int)transfer->file->size) + 1);
 675         }
 676
 677       return p - packet;
 678     }
 679   else
 680     {
 681       /* send data packet */
 682       struct datamess {
 683         unsigned short op, block;
 684         unsigned char data[];
 685       } *mess = (struct datamess *)packet;
 686
 687       size_t size = transfer->file->size - transfer->offset;
 688
 689       if (transfer->offset > transfer->file->size)
 690         return 0; /* finished */
 691
 692       if (size > transfer->blocksize)
 693         size = transfer->blocksize;
 694
 695       mess->op = htons(OP_DATA);
 696       mess->block = htons((unsigned short)(transfer->block));
 697
 698       if (lseek(transfer->file->fd, transfer->offset, SEEK_SET) == (off_t)-1 ||
 699           !read_write(transfer->file->fd, mess->data, size, 1))
 700         return -1;
 701
 702       transfer->expansion = 0;
 703
 704       /* Map '\n' to CR-LF in netascii mode */
 705       if (transfer->netascii)
 706         {
 707           size_t i;
 708           int newcarrylf;
 709
 710           for (i = 0, newcarrylf = 0; i < size; i++)
 711             if (mess->data[i] == '\n' && ( i != 0 || !transfer->carrylf))
 712               {
 713                 transfer->expansion++;
 714
 715                 if (size != transfer->blocksize)
 716                   size++; /* room in this block */
 717                 else  if (i == size - 1)
 718                   newcarrylf = 1; /* don't expand LF again if it moves to the next block */
 719
 720                 /* make space and insert CR */
 721                 memmove(&mess->data[i+1], &mess->data[i], size - (i + 1));
 722                 mess->data[i] = '\r';
 723
 724                 i++;
 725               }
 726           transfer->carrylf = newcarrylf;
 727
 728         }
 729
 730       return size + 4;
 731     }
 732 }
 733
 734
 735 int do_tftp_script_run(void)
 736 {
 737   struct tftp_transfer *transfer;
 738
 739   if ((transfer = daemon->tftp_done_trans))
 740     {
 741       daemon->tftp_done_trans = transfer->next;
 742 #ifdef HAVE_SCRIPT
 743       queue_tftp(transfer->file->size, transfer->file->filename, &transfer->peer);
 744 #endif
 745       free_transfer(transfer);
 746       return 1;
 747     }
 748
 749   return 0;
 750 }
 751 #endif