blob: 960b1eeae2272be93ebcdd96241c4b4098969e5d [file] [log] [blame]
Simon Kelley61744352013-01-31 14:34:40 +00001/* dnsmasq is Copyright (c) 2000-2013 Simon Kelley
Simon Kelley832af0b2007-01-21 20:01:28 +00002
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
Simon Kelley824af852008-02-12 20:43:05 +00005 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
7
Simon Kelley832af0b2007-01-21 20:01:28 +00008 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
Simon Kelley824af852008-02-12 20:43:05 +000012
Simon Kelley73a08a22009-02-05 20:28:08 +000013 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
Simon Kelley832af0b2007-01-21 20:01:28 +000015*/
16
17#include "dnsmasq.h"
18
19#ifdef HAVE_TFTP
20
Simon Kelley8bc4cec2012-07-03 21:04:11 +010021static struct tftp_file *check_tftp_fileperm(ssize_t *len, char *prefix);
Simon Kelley832af0b2007-01-21 20:01:28 +000022static void free_transfer(struct tftp_transfer *transfer);
23static ssize_t tftp_err(int err, char *packet, char *mess, char *file);
Simon Kelley1b7ecd12007-02-05 14:57:57 +000024static ssize_t tftp_err_oops(char *packet, char *file);
Simon Kelley832af0b2007-01-21 20:01:28 +000025static ssize_t get_block(char *packet, struct tftp_transfer *transfer);
26static char *next(char **p, char *end);
Simon Kelley42fb8152012-04-20 17:15:01 +010027static void sanitise(char *buf);
Simon Kelley832af0b2007-01-21 20:01:28 +000028
29#define OP_RRQ 1
30#define OP_WRQ 2
31#define OP_DATA 3
32#define OP_ACK 4
33#define OP_ERR 5
34#define OP_OACK 6
35
36#define ERR_NOTDEF 0
37#define ERR_FNF 1
38#define ERR_PERM 2
39#define ERR_FULL 3
40#define ERR_ILL 4
41
Simon Kelley5aabfc72007-08-29 11:24:47 +010042void tftp_request(struct listener *listen, time_t now)
Simon Kelley832af0b2007-01-21 20:01:28 +000043{
44 ssize_t len;
45 char *packet = daemon->packet;
46 char *filename, *mode, *p, *end, *opt;
Simon Kelley28866e92011-02-14 20:19:14 +000047 union mysockaddr addr, peer;
Simon Kelley832af0b2007-01-21 20:01:28 +000048 struct msghdr msg;
Simon Kelley832af0b2007-01-21 20:01:28 +000049 struct iovec iov;
Simon Kelley1f15b812009-10-13 17:49:32 +010050 struct ifreq ifr;
Simon Kelley8bc4cec2012-07-03 21:04:11 +010051 int is_err = 1, if_index = 0, mtu = 0;
Simon Kelley8ef5ada2010-06-03 19:42:45 +010052#ifdef HAVE_DHCP
Simon Kelley832af0b2007-01-21 20:01:28 +000053 struct iname *tmp;
Simon Kelley8ef5ada2010-06-03 19:42:45 +010054#endif
Simon Kelley5aabfc72007-08-29 11:24:47 +010055 struct tftp_transfer *transfer;
Simon Kelley824af852008-02-12 20:43:05 +000056 int port = daemon->start_tftp_port; /* may be zero to use ephemeral port */
57#if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
Simon Kelley1f15b812009-10-13 17:49:32 +010058 int mtuflag = IP_PMTUDISC_DONT;
Simon Kelley824af852008-02-12 20:43:05 +000059#endif
Simon Kelley8ef5ada2010-06-03 19:42:45 +010060 char namebuff[IF_NAMESIZE];
Simon Kelley52d4abf2012-03-21 21:39:48 +000061 char *name = NULL;
Simon Kelley8ef5ada2010-06-03 19:42:45 +010062 char *prefix = daemon->tftp_prefix;
63 struct tftp_prefix *pref;
Simon Kelleye25db1f2013-01-29 22:10:26 +000064 struct all_addr addra;
Simon Kelley8ef5ada2010-06-03 19:42:45 +010065
Simon Kelley832af0b2007-01-21 20:01:28 +000066 union {
67 struct cmsghdr align; /* this ensures alignment */
Simon Kelley28866e92011-02-14 20:19:14 +000068#ifdef HAVE_IPV6
69 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
70#endif
Simon Kelley824af852008-02-12 20:43:05 +000071#if defined(HAVE_LINUX_NETWORK)
Simon Kelley832af0b2007-01-21 20:01:28 +000072 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
Simon Kelley824af852008-02-12 20:43:05 +000073#elif defined(HAVE_SOLARIS_NETWORK)
74 char control[CMSG_SPACE(sizeof(unsigned int))];
Simon Kelley7622fc02009-06-04 20:32:05 +010075#elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
Simon Kelley832af0b2007-01-21 20:01:28 +000076 char control[CMSG_SPACE(sizeof(struct sockaddr_dl))];
77#endif
78 } control_u;
79
80 msg.msg_controllen = sizeof(control_u);
81 msg.msg_control = control_u.control;
82 msg.msg_flags = 0;
83 msg.msg_name = &peer;
84 msg.msg_namelen = sizeof(peer);
85 msg.msg_iov = &iov;
86 msg.msg_iovlen = 1;
87
88 iov.iov_base = packet;
89 iov.iov_len = daemon->packet_buff_sz;
90
91 /* we overwrote the buffer... */
92 daemon->srv_save = NULL;
93
94 if ((len = recvmsg(listen->tftpfd, &msg, 0)) < 2)
95 return;
96
Simon Kelley28866e92011-02-14 20:19:14 +000097 if (option_bool(OPT_NOWILD))
Simon Kelley1f15b812009-10-13 17:49:32 +010098 {
Simon Kelley52d4abf2012-03-21 21:39:48 +000099 if (listen->iface)
100 {
101 addr = listen->iface->addr;
102 mtu = listen->iface->mtu;
103 name = listen->iface->name;
104 }
105 else
106 {
107 /* we're listening on an address that doesn't appear on an interface,
108 ask the kernel what the socket is bound to */
109 socklen_t tcp_len = sizeof(union mysockaddr);
110 if (getsockname(listen->tftpfd, (struct sockaddr *)&addr, &tcp_len) == -1)
111 return;
112 }
Simon Kelley1f15b812009-10-13 17:49:32 +0100113 }
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000114 else
115 {
Simon Kelley7622fc02009-06-04 20:32:05 +0100116 struct cmsghdr *cmptr;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100117
Simon Kelley28866e92011-02-14 20:19:14 +0000118 if (msg.msg_controllen < sizeof(struct cmsghdr))
119 return;
120
121 addr.sa.sa_family = listen->family;
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000122
Simon Kelley832af0b2007-01-21 20:01:28 +0000123#if defined(HAVE_LINUX_NETWORK)
Simon Kelley28866e92011-02-14 20:19:14 +0000124 if (listen->family == AF_INET)
125 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
Simon Kelleyc72daea2012-01-05 21:33:27 +0000126 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO)
Simon Kelley28866e92011-02-14 20:19:14 +0000127 {
128 union {
129 unsigned char *c;
130 struct in_pktinfo *p;
131 } p;
132 p.c = CMSG_DATA(cmptr);
133 addr.in.sin_addr = p.p->ipi_spec_dst;
134 if_index = p.p->ipi_ifindex;
135 }
136
137#elif defined(HAVE_SOLARIS_NETWORK)
138 if (listen->family == AF_INET)
139 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000140 {
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100141 union {
142 unsigned char *c;
Simon Kelley28866e92011-02-14 20:19:14 +0000143 struct in_addr *a;
144 unsigned int *i;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100145 } p;
146 p.c = CMSG_DATA(cmptr);
Simon Kelley28866e92011-02-14 20:19:14 +0000147 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
148 addr.in.sin_addr = *(p.a);
149 else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
150 if_index = *(p.i);
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000151 }
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000152
Simon Kelley832af0b2007-01-21 20:01:28 +0000153#elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
Simon Kelley28866e92011-02-14 20:19:14 +0000154 if (listen->family == AF_INET)
155 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
156 {
157 union {
158 unsigned char *c;
159 struct in_addr *a;
160 struct sockaddr_dl *s;
161 } p;
162 p.c = CMSG_DATA(cmptr);
163 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
164 addr.in.sin_addr = *(p.a);
165 else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
166 if_index = p.s->sdl_index;
167 }
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100168
Simon Kelley824af852008-02-12 20:43:05 +0000169#endif
Simon Kelley28866e92011-02-14 20:19:14 +0000170
171#ifdef HAVE_IPV6
172 if (listen->family == AF_INET6)
173 {
174 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
Simon Kelleyc72daea2012-01-05 21:33:27 +0000175 if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo)
Simon Kelley28866e92011-02-14 20:19:14 +0000176 {
177 union {
178 unsigned char *c;
179 struct in6_pktinfo *p;
180 } p;
181 p.c = CMSG_DATA(cmptr);
182
183 addr.in6.sin6_addr = p.p->ipi6_addr;
184 if_index = p.p->ipi6_ifindex;
185 }
186 }
187#endif
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000188
Simon Kelley28866e92011-02-14 20:19:14 +0000189 if (!indextoname(listen->tftpfd, if_index, namebuff))
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000190 return;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100191
192 name = namebuff;
Simon Kelleye25db1f2013-01-29 22:10:26 +0000193
194 addra.addr.addr4 = addr.in.sin_addr;
Simon Kelley28866e92011-02-14 20:19:14 +0000195
196#ifdef HAVE_IPV6
197 if (listen->family == AF_INET6)
Simon Kelleye25db1f2013-01-29 22:10:26 +0000198 addra.addr.addr6 = addr.in6.sin6_addr;
199#endif
200
201 if (!iface_check(listen->family, &addra, name, NULL))
Simon Kelley3169daa2012-08-13 17:39:57 +0100202 {
Simon Kelleye25db1f2013-01-29 22:10:26 +0000203 if (!option_bool(OPT_CLEVERBIND))
204 enumerate_interfaces();
205 if (!loopback_exception(listen->tftpfd, listen->family, &addra, name))
Simon Kelley3169daa2012-08-13 17:39:57 +0100206 return;
207 }
Simon Kelleye25db1f2013-01-29 22:10:26 +0000208
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100209#ifdef HAVE_DHCP
Simon Kelley8bc4cec2012-07-03 21:04:11 +0100210 /* allowed interfaces are the same as for DHCP */
211 for (tmp = daemon->dhcp_except; tmp; tmp = tmp->next)
Simon Kelley49333cb2013-03-15 20:30:51 +0000212 if (tmp->name && wildcard_match(tmp->name, name))
Simon Kelley8bc4cec2012-07-03 21:04:11 +0100213 return;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100214#endif
Simon Kelley8bc4cec2012-07-03 21:04:11 +0100215
Simon Kelley316e2732010-01-22 20:16:09 +0000216 strncpy(ifr.ifr_name, name, IF_NAMESIZE);
Simon Kelley1f15b812009-10-13 17:49:32 +0100217 if (ioctl(listen->tftpfd, SIOCGIFMTU, &ifr) != -1)
218 mtu = ifr.ifr_mtu;
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000219 }
220
Simon Kelley52d4abf2012-03-21 21:39:48 +0000221 if (name)
222 {
223 /* check for per-interface prefix */
224 for (pref = daemon->if_prefix; pref; pref = pref->next)
225 if (strcmp(pref->interface, name) == 0)
Simon Kelley8bc4cec2012-07-03 21:04:11 +0100226 prefix = pref->prefix;
Simon Kelley52d4abf2012-03-21 21:39:48 +0000227 }
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100228
Simon Kelley28866e92011-02-14 20:19:14 +0000229 if (listen->family == AF_INET)
Simon Kelley7de060b2011-08-26 17:24:52 +0100230 {
231 addr.in.sin_port = htons(port);
232#ifdef HAVE_SOCKADDR_SA_LEN
233 addr.in.sin_len = sizeof(addr.in);
234#endif
235 }
Simon Kelley28866e92011-02-14 20:19:14 +0000236#ifdef HAVE_IPV6
237 else
238 {
239 addr.in6.sin6_port = htons(port);
240 addr.in6.sin6_flowinfo = 0;
Simon Kelley7de060b2011-08-26 17:24:52 +0100241 addr.in6.sin6_scope_id = 0;
242#ifdef HAVE_SOCKADDR_SA_LEN
243 addr.in6.sin6_len = sizeof(addr.in6);
244#endif
Simon Kelley28866e92011-02-14 20:19:14 +0000245 }
246#endif
247
Simon Kelley5aabfc72007-08-29 11:24:47 +0100248 if (!(transfer = whine_malloc(sizeof(struct tftp_transfer))))
Simon Kelley832af0b2007-01-21 20:01:28 +0000249 return;
250
Simon Kelley28866e92011-02-14 20:19:14 +0000251 if ((transfer->sockfd = socket(listen->family, SOCK_DGRAM, 0)) == -1)
Simon Kelley832af0b2007-01-21 20:01:28 +0000252 {
253 free(transfer);
254 return;
255 }
256
257 transfer->peer = peer;
Simon Kelley5aabfc72007-08-29 11:24:47 +0100258 transfer->timeout = now + 2;
Simon Kelley832af0b2007-01-21 20:01:28 +0000259 transfer->backoff = 1;
260 transfer->block = 1;
261 transfer->blocksize = 512;
Simon Kelley9e038942008-05-30 20:06:34 +0100262 transfer->offset = 0;
Simon Kelley832af0b2007-01-21 20:01:28 +0000263 transfer->file = NULL;
264 transfer->opt_blocksize = transfer->opt_transize = 0;
Simon Kelley9e038942008-05-30 20:06:34 +0100265 transfer->netascii = transfer->carrylf = 0;
Simon Kelley28866e92011-02-14 20:19:14 +0000266
Simon Kelleyc72daea2012-01-05 21:33:27 +0000267 prettyprint_addr(&peer, daemon->addrbuff);
Simon Kelley28866e92011-02-14 20:19:14 +0000268
Simon Kelley824af852008-02-12 20:43:05 +0000269 /* if we have a nailed-down range, iterate until we find a free one. */
270 while (1)
Simon Kelley832af0b2007-01-21 20:01:28 +0000271 {
Simon Kelley7de060b2011-08-26 17:24:52 +0100272 if (bind(transfer->sockfd, &addr.sa, sa_len(&addr)) == -1 ||
Simon Kelley824af852008-02-12 20:43:05 +0000273#if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
Simon Kelleyc72daea2012-01-05 21:33:27 +0000274 setsockopt(transfer->sockfd, IPPROTO_IP, IP_MTU_DISCOVER, &mtuflag, sizeof(mtuflag)) == -1 ||
Simon Kelley824af852008-02-12 20:43:05 +0000275#endif
276 !fix_fd(transfer->sockfd))
277 {
278 if (errno == EADDRINUSE && daemon->start_tftp_port != 0)
279 {
280 if (++port <= daemon->end_tftp_port)
281 {
Simon Kelley28866e92011-02-14 20:19:14 +0000282 if (listen->family == AF_INET)
283 addr.in.sin_port = htons(port);
284#ifdef HAVE_IPV6
285 else
286 addr.in6.sin6_port = htons(port);
287#endif
Simon Kelley824af852008-02-12 20:43:05 +0000288 continue;
289 }
Simon Kelley7622fc02009-06-04 20:32:05 +0100290 my_syslog(MS_TFTP | LOG_ERR, _("unable to get free port for TFTP"));
Simon Kelley824af852008-02-12 20:43:05 +0000291 }
292 free_transfer(transfer);
293 return;
294 }
295 break;
Simon Kelley832af0b2007-01-21 20:01:28 +0000296 }
Simon Kelley824af852008-02-12 20:43:05 +0000297
Simon Kelley832af0b2007-01-21 20:01:28 +0000298 p = packet + 2;
299 end = packet + len;
300
301 if (ntohs(*((unsigned short *)packet)) != OP_RRQ ||
302 !(filename = next(&p, end)) ||
303 !(mode = next(&p, end)) ||
Simon Kelley9e038942008-05-30 20:06:34 +0100304 (strcasecmp(mode, "octet") != 0 && strcasecmp(mode, "netascii") != 0))
Simon Kelley6a69ab52012-04-24 14:42:26 +0100305 {
306 len = tftp_err(ERR_ILL, packet, _("unsupported request from %s"), daemon->addrbuff);
307 is_err = 1;
308 }
Simon Kelley832af0b2007-01-21 20:01:28 +0000309 else
310 {
Simon Kelley9e038942008-05-30 20:06:34 +0100311 if (strcasecmp(mode, "netascii") == 0)
312 transfer->netascii = 1;
313
Simon Kelley832af0b2007-01-21 20:01:28 +0000314 while ((opt = next(&p, end)))
315 {
Simon Kelley77e94da2009-08-31 17:32:17 +0100316 if (strcasecmp(opt, "blksize") == 0)
Simon Kelley832af0b2007-01-21 20:01:28 +0000317 {
Simon Kelley8bc4cec2012-07-03 21:04:11 +0100318 if ((opt = next(&p, end)) && !option_bool(OPT_TFTP_NOBLOCK))
Simon Kelley77e94da2009-08-31 17:32:17 +0100319 {
320 transfer->blocksize = atoi(opt);
321 if (transfer->blocksize < 1)
322 transfer->blocksize = 1;
323 if (transfer->blocksize > (unsigned)daemon->packet_buff_sz - 4)
324 transfer->blocksize = (unsigned)daemon->packet_buff_sz - 4;
Simon Kelley1f15b812009-10-13 17:49:32 +0100325 /* 32 bytes for IP, UDP and TFTP headers */
326 if (mtu != 0 && transfer->blocksize > (unsigned)mtu - 32)
327 transfer->blocksize = (unsigned)mtu - 32;
Simon Kelley77e94da2009-08-31 17:32:17 +0100328 transfer->opt_blocksize = 1;
329 transfer->block = 0;
330 }
Simon Kelley832af0b2007-01-21 20:01:28 +0000331 }
Simon Kelley77e94da2009-08-31 17:32:17 +0100332 else if (strcasecmp(opt, "tsize") == 0 && next(&p, end) && !transfer->netascii)
Simon Kelley832af0b2007-01-21 20:01:28 +0000333 {
334 transfer->opt_transize = 1;
335 transfer->block = 0;
336 }
337 }
338
Simon Kelley1f15b812009-10-13 17:49:32 +0100339 /* cope with backslashes from windows boxen. */
Simon Kelley61ce6002012-04-20 21:28:49 +0100340 for (p = filename; *p; p++)
341 if (*p == '\\')
342 *p = '/';
343 else if (option_bool(OPT_TFTP_LC))
344 *p = tolower(*p);
345
Simon Kelleyf2621c72007-04-29 19:47:21 +0100346 strcpy(daemon->namebuff, "/");
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100347 if (prefix)
Simon Kelley832af0b2007-01-21 20:01:28 +0000348 {
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100349 if (prefix[0] == '/')
Simon Kelleyf2621c72007-04-29 19:47:21 +0100350 daemon->namebuff[0] = 0;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100351 strncat(daemon->namebuff, prefix, (MAXDNAME-1) - strlen(daemon->namebuff));
352 if (prefix[strlen(prefix)-1] != '/')
Simon Kelley77e94da2009-08-31 17:32:17 +0100353 strncat(daemon->namebuff, "/", (MAXDNAME-1) - strlen(daemon->namebuff));
Simon Kelley5aabfc72007-08-29 11:24:47 +0100354
Simon Kelley8bc4cec2012-07-03 21:04:11 +0100355 if (option_bool(OPT_TFTP_APREF))
Simon Kelley5aabfc72007-08-29 11:24:47 +0100356 {
357 size_t oldlen = strlen(daemon->namebuff);
358 struct stat statbuf;
359
Simon Kelleyc72daea2012-01-05 21:33:27 +0000360 strncat(daemon->namebuff, daemon->addrbuff, (MAXDNAME-1) - strlen(daemon->namebuff));
Simon Kelley77e94da2009-08-31 17:32:17 +0100361 strncat(daemon->namebuff, "/", (MAXDNAME-1) - strlen(daemon->namebuff));
Simon Kelley5aabfc72007-08-29 11:24:47 +0100362
363 /* remove unique-directory if it doesn't exist */
364 if (stat(daemon->namebuff, &statbuf) == -1 || !S_ISDIR(statbuf.st_mode))
365 daemon->namebuff[oldlen] = 0;
366 }
367
Simon Kelleyf2621c72007-04-29 19:47:21 +0100368 /* Absolute pathnames OK if they match prefix */
369 if (filename[0] == '/')
370 {
371 if (strstr(filename, daemon->namebuff) == filename)
372 daemon->namebuff[0] = 0;
373 else
374 filename++;
375 }
Simon Kelley832af0b2007-01-21 20:01:28 +0000376 }
Simon Kelleyf2621c72007-04-29 19:47:21 +0100377 else if (filename[0] == '/')
Simon Kelley832af0b2007-01-21 20:01:28 +0000378 daemon->namebuff[0] = 0;
Simon Kelley77e94da2009-08-31 17:32:17 +0100379 strncat(daemon->namebuff, filename, (MAXDNAME-1) - strlen(daemon->namebuff));
Simon Kelley832af0b2007-01-21 20:01:28 +0000380
Simon Kelley5aabfc72007-08-29 11:24:47 +0100381 /* check permissions and open file */
Simon Kelley8bc4cec2012-07-03 21:04:11 +0100382 if ((transfer->file = check_tftp_fileperm(&len, prefix)))
Simon Kelley832af0b2007-01-21 20:01:28 +0000383 {
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000384 if ((len = get_block(packet, transfer)) == -1)
385 len = tftp_err_oops(packet, daemon->namebuff);
386 else
387 is_err = 0;
Simon Kelley832af0b2007-01-21 20:01:28 +0000388 }
389 }
390
391 while (sendto(transfer->sockfd, packet, len, 0,
Simon Kelley04363602012-04-27 10:11:51 +0100392 (struct sockaddr *)&peer, sa_len(&peer)) == -1 && errno == EINTR);
Simon Kelley832af0b2007-01-21 20:01:28 +0000393
394 if (is_err)
395 free_transfer(transfer);
396 else
397 {
Simon Kelley832af0b2007-01-21 20:01:28 +0000398 transfer->next = daemon->tftp_trans;
399 daemon->tftp_trans = transfer;
400 }
401}
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000402
Simon Kelley8bc4cec2012-07-03 21:04:11 +0100403static struct tftp_file *check_tftp_fileperm(ssize_t *len, char *prefix)
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000404{
405 char *packet = daemon->packet, *namebuff = daemon->namebuff;
406 struct tftp_file *file;
Simon Kelley5aabfc72007-08-29 11:24:47 +0100407 struct tftp_transfer *t;
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000408 uid_t uid = geteuid();
409 struct stat statbuf;
Simon Kelley5aabfc72007-08-29 11:24:47 +0100410 int fd = -1;
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000411
412 /* trick to ban moving out of the subtree */
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100413 if (prefix && strstr(namebuff, "/../"))
Simon Kelley5aabfc72007-08-29 11:24:47 +0100414 goto perm;
415
416 if ((fd = open(namebuff, O_RDONLY)) == -1)
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000417 {
Simon Kelley5aabfc72007-08-29 11:24:47 +0100418 if (errno == ENOENT)
419 {
420 *len = tftp_err(ERR_FNF, packet, _("file %s not found"), namebuff);
421 return NULL;
422 }
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000423 else if (errno == EACCES)
424 goto perm;
425 else
426 goto oops;
427 }
Simon Kelley5aabfc72007-08-29 11:24:47 +0100428
429 /* stat the file descriptor to avoid stat->open races */
430 if (fstat(fd, &statbuf) == -1)
431 goto oops;
432
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000433 /* running as root, must be world-readable */
434 if (uid == 0)
435 {
436 if (!(statbuf.st_mode & S_IROTH))
Simon Kelley5aabfc72007-08-29 11:24:47 +0100437 goto perm;
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000438 }
439 /* in secure mode, must be owned by user running dnsmasq */
Simon Kelley8bc4cec2012-07-03 21:04:11 +0100440 else if (option_bool(OPT_TFTP_SECURE) && uid != statbuf.st_uid)
Simon Kelley5aabfc72007-08-29 11:24:47 +0100441 goto perm;
442
443 /* If we're doing many tranfers from the same file, only
444 open it once this saves lots of file descriptors
445 when mass-booting a big cluster, for instance.
446 Be conservative and only share when inode and name match
447 this keeps error messages sane. */
448 for (t = daemon->tftp_trans; t; t = t->next)
449 if (t->file->dev == statbuf.st_dev &&
450 t->file->inode == statbuf.st_ino &&
451 strcmp(t->file->filename, namebuff) == 0)
452 {
453 close(fd);
454 t->file->refcount++;
455 return t->file;
456 }
457
458 if (!(file = whine_malloc(sizeof(struct tftp_file) + strlen(namebuff) + 1)))
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000459 {
460 errno = ENOMEM;
461 goto oops;
462 }
463
Simon Kelley5aabfc72007-08-29 11:24:47 +0100464 file->fd = fd;
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000465 file->size = statbuf.st_size;
Simon Kelley5aabfc72007-08-29 11:24:47 +0100466 file->dev = statbuf.st_dev;
467 file->inode = statbuf.st_ino;
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000468 file->refcount = 1;
469 strcpy(file->filename, namebuff);
470 return file;
Simon Kelley5aabfc72007-08-29 11:24:47 +0100471
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000472 perm:
Simon Kelley5aabfc72007-08-29 11:24:47 +0100473 errno = EACCES;
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000474 *len = tftp_err(ERR_PERM, packet, _("cannot access %s: %s"), namebuff);
Simon Kelley5aabfc72007-08-29 11:24:47 +0100475 if (fd != -1)
476 close(fd);
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000477 return NULL;
478
Simon Kelley5aabfc72007-08-29 11:24:47 +0100479 oops:
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000480 *len = tftp_err_oops(packet, namebuff);
Simon Kelley5aabfc72007-08-29 11:24:47 +0100481 if (fd != -1)
482 close(fd);
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000483 return NULL;
484}
485
Simon Kelley5aabfc72007-08-29 11:24:47 +0100486void check_tftp_listeners(fd_set *rset, time_t now)
Simon Kelley832af0b2007-01-21 20:01:28 +0000487{
488 struct tftp_transfer *transfer, *tmp, **up;
489 ssize_t len;
490
491 struct ack {
492 unsigned short op, block;
493 } *mess = (struct ack *)daemon->packet;
494
495 /* Check for activity on any existing transfers */
496 for (transfer = daemon->tftp_trans, up = &daemon->tftp_trans; transfer; transfer = tmp)
497 {
498 tmp = transfer->next;
499
Simon Kelley6a69ab52012-04-24 14:42:26 +0100500 prettyprint_addr(&transfer->peer, daemon->addrbuff);
501
Simon Kelley832af0b2007-01-21 20:01:28 +0000502 if (FD_ISSET(transfer->sockfd, rset))
503 {
504 /* we overwrote the buffer... */
505 daemon->srv_save = NULL;
506
507 if ((len = recv(transfer->sockfd, daemon->packet, daemon->packet_buff_sz, 0)) >= (ssize_t)sizeof(struct ack))
508 {
509 if (ntohs(mess->op) == OP_ACK && ntohs(mess->block) == (unsigned short)transfer->block)
510 {
511 /* Got ack, ensure we take the (re)transmit path */
512 transfer->timeout = now;
513 transfer->backoff = 0;
Simon Kelley9e038942008-05-30 20:06:34 +0100514 if (transfer->block++ != 0)
515 transfer->offset += transfer->blocksize - transfer->expansion;
Simon Kelley832af0b2007-01-21 20:01:28 +0000516 }
517 else if (ntohs(mess->op) == OP_ERR)
518 {
519 char *p = daemon->packet + sizeof(struct ack);
520 char *end = daemon->packet + len;
521 char *err = next(&p, end);
Simon Kelley28866e92011-02-14 20:19:14 +0000522
Simon Kelley832af0b2007-01-21 20:01:28 +0000523 /* Sanitise error message */
524 if (!err)
525 err = "";
526 else
Simon Kelley7a14dfe2012-04-20 20:50:42 +0100527 sanitise(err);
Simon Kelley6a69ab52012-04-24 14:42:26 +0100528
Simon Kelley316e2732010-01-22 20:16:09 +0000529 my_syslog(MS_TFTP | LOG_ERR, _("error %d %s received from %s"),
Simon Kelleyf2621c72007-04-29 19:47:21 +0100530 (int)ntohs(mess->block), err,
Simon Kelleyc72daea2012-01-05 21:33:27 +0000531 daemon->addrbuff);
Simon Kelley832af0b2007-01-21 20:01:28 +0000532
533 /* Got err, ensure we take abort */
534 transfer->timeout = now;
535 transfer->backoff = 100;
536 }
537 }
538 }
539
540 if (difftime(now, transfer->timeout) >= 0.0)
541 {
542 int endcon = 0;
543
544 /* timeout, retransmit */
Simon Kelley5aabfc72007-08-29 11:24:47 +0100545 transfer->timeout += 1 + (1<<transfer->backoff);
Simon Kelley832af0b2007-01-21 20:01:28 +0000546
547 /* we overwrote the buffer... */
548 daemon->srv_save = NULL;
549
550 if ((len = get_block(daemon->packet, transfer)) == -1)
551 {
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000552 len = tftp_err_oops(daemon->packet, transfer->file->filename);
Simon Kelley832af0b2007-01-21 20:01:28 +0000553 endcon = 1;
554 }
Simon Kelley42fb8152012-04-20 17:15:01 +0100555 /* don't complain about timeout when we're awaiting the last
556 ACK, some clients never send it */
557 else if (++transfer->backoff > 5 && len != 0)
Simon Kelley832af0b2007-01-21 20:01:28 +0000558 {
Simon Kelley42fb8152012-04-20 17:15:01 +0100559 endcon = 1;
560 len = 0;
Simon Kelley832af0b2007-01-21 20:01:28 +0000561 }
Simon Kelley42fb8152012-04-20 17:15:01 +0100562
Simon Kelley832af0b2007-01-21 20:01:28 +0000563 if (len != 0)
564 while(sendto(transfer->sockfd, daemon->packet, len, 0,
Simon Kelley04363602012-04-27 10:11:51 +0100565 (struct sockaddr *)&transfer->peer, sa_len(&transfer->peer)) == -1 && errno == EINTR);
Simon Kelley832af0b2007-01-21 20:01:28 +0000566
567 if (endcon || len == 0)
568 {
Simon Kelley42fb8152012-04-20 17:15:01 +0100569 strcpy(daemon->namebuff, transfer->file->filename);
570 sanitise(daemon->namebuff);
571 my_syslog(MS_TFTP | LOG_INFO, endcon ? _("failed sending %s to %s") : _("sent %s to %s"), daemon->namebuff, daemon->addrbuff);
Simon Kelley832af0b2007-01-21 20:01:28 +0000572 /* unlink */
573 *up = tmp;
Simon Kelley231d0612012-04-27 13:50:45 +0100574 if (endcon)
575 free_transfer(transfer);
576 else
577 {
578 /* put on queue to be sent to script and deleted */
579 transfer->next = daemon->tftp_done_trans;
580 daemon->tftp_done_trans = transfer;
581 }
Simon Kelley832af0b2007-01-21 20:01:28 +0000582 continue;
583 }
584 }
585
586 up = &transfer->next;
Simon Kelley28866e92011-02-14 20:19:14 +0000587 }
Simon Kelley832af0b2007-01-21 20:01:28 +0000588}
589
590static void free_transfer(struct tftp_transfer *transfer)
591{
592 close(transfer->sockfd);
593 if (transfer->file && (--transfer->file->refcount) == 0)
594 {
595 close(transfer->file->fd);
596 free(transfer->file);
597 }
598 free(transfer);
599}
600
601static char *next(char **p, char *end)
602{
603 char *ret = *p;
604 size_t len;
605
606 if (*(end-1) != 0 ||
607 *p == end ||
608 (len = strlen(ret)) == 0)
609 return NULL;
610
611 *p += len + 1;
612 return ret;
613}
614
Simon Kelley42fb8152012-04-20 17:15:01 +0100615static void sanitise(char *buf)
616{
Simon Kelley7a14dfe2012-04-20 20:50:42 +0100617 unsigned char *q, *r;
618 for (q = r = (unsigned char *)buf; *r; r++)
Simon Kelley11263a42012-04-27 14:00:55 +0100619 if (isprint((int)*r))
Simon Kelley7a14dfe2012-04-20 20:50:42 +0100620 *(q++) = *r;
621 *q = 0;
Simon Kelley42fb8152012-04-20 17:15:01 +0100622
Simon Kelley7a14dfe2012-04-20 20:50:42 +0100623}
Simon Kelley42fb8152012-04-20 17:15:01 +0100624
Simon Kelley832af0b2007-01-21 20:01:28 +0000625static ssize_t tftp_err(int err, char *packet, char *message, char *file)
626{
627 struct errmess {
628 unsigned short op, err;
629 char message[];
630 } *mess = (struct errmess *)packet;
631 ssize_t ret = 4;
632 char *errstr = strerror(errno);
Simon Kelley42fb8152012-04-20 17:15:01 +0100633
634 sanitise(file);
635
Simon Kelley832af0b2007-01-21 20:01:28 +0000636 mess->op = htons(OP_ERR);
637 mess->err = htons(err);
638 ret += (snprintf(mess->message, 500, message, file, errstr) + 1);
Simon Kelley316e2732010-01-22 20:16:09 +0000639 my_syslog(MS_TFTP | LOG_ERR, "%s", mess->message);
Simon Kelley832af0b2007-01-21 20:01:28 +0000640
641 return ret;
642}
643
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000644static ssize_t tftp_err_oops(char *packet, char *file)
645{
Simon Kelley42fb8152012-04-20 17:15:01 +0100646 /* May have >1 refs to file, so potentially mangle a copy of the name */
647 strcpy(daemon->namebuff, file);
648 return tftp_err(ERR_NOTDEF, packet, _("cannot read %s: %s"), daemon->namebuff);
Simon Kelley1b7ecd12007-02-05 14:57:57 +0000649}
650
Simon Kelley832af0b2007-01-21 20:01:28 +0000651/* return -1 for error, zero for done. */
652static ssize_t get_block(char *packet, struct tftp_transfer *transfer)
653{
654 if (transfer->block == 0)
655 {
656 /* send OACK */
657 char *p;
658 struct oackmess {
659 unsigned short op;
660 char data[];
661 } *mess = (struct oackmess *)packet;
662
663 p = mess->data;
664 mess->op = htons(OP_OACK);
665 if (transfer->opt_blocksize)
666 {
667 p += (sprintf(p, "blksize") + 1);
668 p += (sprintf(p, "%d", transfer->blocksize) + 1);
669 }
670 if (transfer->opt_transize)
671 {
672 p += (sprintf(p,"tsize") + 1);
673 p += (sprintf(p, "%u", (unsigned int)transfer->file->size) + 1);
674 }
675
676 return p - packet;
677 }
678 else
679 {
680 /* send data packet */
681 struct datamess {
682 unsigned short op, block;
683 unsigned char data[];
684 } *mess = (struct datamess *)packet;
685
Simon Kelley9e038942008-05-30 20:06:34 +0100686 size_t size = transfer->file->size - transfer->offset;
Simon Kelley832af0b2007-01-21 20:01:28 +0000687
Simon Kelley9e038942008-05-30 20:06:34 +0100688 if (transfer->offset > transfer->file->size)
Simon Kelley832af0b2007-01-21 20:01:28 +0000689 return 0; /* finished */
690
691 if (size > transfer->blocksize)
692 size = transfer->blocksize;
693
Simon Kelley832af0b2007-01-21 20:01:28 +0000694 mess->op = htons(OP_DATA);
695 mess->block = htons((unsigned short)(transfer->block));
696
Simon Kelley9e038942008-05-30 20:06:34 +0100697 if (lseek(transfer->file->fd, transfer->offset, SEEK_SET) == (off_t)-1 ||
698 !read_write(transfer->file->fd, mess->data, size, 1))
Simon Kelley832af0b2007-01-21 20:01:28 +0000699 return -1;
Simon Kelley9e038942008-05-30 20:06:34 +0100700
701 transfer->expansion = 0;
702
703 /* Map '\n' to CR-LF in netascii mode */
704 if (transfer->netascii)
705 {
706 size_t i;
707 int newcarrylf;
708
709 for (i = 0, newcarrylf = 0; i < size; i++)
710 if (mess->data[i] == '\n' && ( i != 0 || !transfer->carrylf))
711 {
Simon Kelley7de060b2011-08-26 17:24:52 +0100712 transfer->expansion++;
713
714 if (size != transfer->blocksize)
Simon Kelley9e038942008-05-30 20:06:34 +0100715 size++; /* room in this block */
Simon Kelley7de060b2011-08-26 17:24:52 +0100716 else if (i == size - 1)
717 newcarrylf = 1; /* don't expand LF again if it moves to the next block */
718
Simon Kelley9e038942008-05-30 20:06:34 +0100719 /* make space and insert CR */
720 memmove(&mess->data[i+1], &mess->data[i], size - (i + 1));
721 mess->data[i] = '\r';
722
723 i++;
724 }
725 transfer->carrylf = newcarrylf;
726
727 }
728
729 return size + 4;
Simon Kelley832af0b2007-01-21 20:01:28 +0000730 }
731}
732
Simon Kelleya9530962012-03-20 22:07:35 +0000733
734int do_tftp_script_run(void)
735{
736 struct tftp_transfer *transfer;
737
738 if ((transfer = daemon->tftp_done_trans))
739 {
740 daemon->tftp_done_trans = transfer->next;
741#ifdef HAVE_SCRIPT
742 queue_tftp(transfer->file->size, transfer->file->filename, &transfer->peer);
743#endif
744 free_transfer(transfer);
745 return 1;
746 }
747
748 return 0;
749}
Simon Kelley832af0b2007-01-21 20:01:28 +0000750#endif