1 /***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 *
9 * Trivial file transfer protocol server.
10 *
11 * This code includes many modifications by Jim Guyton <guyton@rand-unix>
12 *
13 * This source file was started based on netkit-tftpd 0.17
14 * Heavily modified for curl's test suite
15 */
16
17 /*
18 * Copyright (c) 1983 Regents of the University of California.
19 * All rights reserved.
20 *
21 * Redistribution and use in source and binary forms, with or without
22 * modification, are permitted provided that the following conditions
23 * are met:
24 * 1. Redistributions of source code must retain the above copyright
25 * notice, this list of conditions and the following disclaimer.
26 * 2. Redistributions in binary form must reproduce the above copyright
27 * notice, this list of conditions and the following disclaimer in the
28 * documentation and/or other materials provided with the distribution.
29 * 3. All advertising materials mentioning features or use of this software
30 * must display the following acknowledgement:
31 * This product includes software developed by the University of
32 * California, Berkeley and its contributors.
33 * 4. Neither the name of the University nor the names of its contributors
34 * may be used to endorse or promote products derived from this software
35 * without specific prior written permission.
36 *
37 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
38 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
39 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
40 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
41 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
42 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
43 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
45 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
46 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
47 * SUCH DAMAGE.
48 */
49
50 #include "server_setup.h"
51
52 #ifdef HAVE_SYS_IOCTL_H
53 #include <sys/ioctl.h>
54 #endif
55 #ifdef HAVE_SIGNAL_H
56 #include <signal.h>
57 #endif
58 #ifdef HAVE_FCNTL_H
59 #include <fcntl.h>
60 #endif
61 #ifdef HAVE_NETINET_IN_H
62 #include <netinet/in.h>
63 #endif
64 #ifdef HAVE_ARPA_INET_H
65 #include <arpa/inet.h>
66 #endif
67 #ifdef HAVE_ARPA_TFTP_H
68 #include <arpa/tftp.h>
69 #else
70 #include "tftp.h"
71 #endif
72 #ifdef HAVE_NETDB_H
73 #include <netdb.h>
74 #endif
75 #ifdef HAVE_SYS_FILIO_H
76 /* FIONREAD on Solaris 7 */
77 #include <sys/filio.h>
78 #endif
79
80 #include <setjmp.h>
81
82 #ifdef HAVE_PWD_H
83 #include <pwd.h>
84 #endif
85
86 #define ENABLE_CURLX_PRINTF
87 /* make the curlx header define all printf() functions to use the curlx_*
88 versions instead */
89 #include "curlx.h" /* from the private lib dir */
90 #include "getpart.h"
91 #include "util.h"
92 #include "server_sockaddr.h"
93
94 /* include memdebug.h last */
95 #include "memdebug.h"
96
97 /*****************************************************************************
98 * STRUCT DECLARATIONS AND DEFINES *
99 *****************************************************************************/
100
101 #ifndef PKTSIZE
102 #define PKTSIZE (SEGSIZE + 4) /* SEGSIZE defined in arpa/tftp.h */
103 #endif
104
105 struct testcase {
106 char *buffer; /* holds the file data to send to the client */
107 size_t bufsize; /* size of the data in buffer */
108 char *rptr; /* read pointer into the buffer */
109 size_t rcount; /* amount of data left to read of the file */
110 long testno; /* test case number */
111 int ofile; /* file descriptor for output file when uploading to us */
112
113 int writedelay; /* number of seconds between each packet */
114 };
115
116 struct formats {
117 const char *f_mode;
118 int f_convert;
119 };
120
121 struct errmsg {
122 int e_code;
123 const char *e_msg;
124 };
125
126 typedef union {
127 struct tftphdr hdr;
128 char storage[PKTSIZE];
129 } tftphdr_storage_t;
130
131 /*
132 * bf.counter values in range [-1 .. SEGSIZE] represents size of data in the
133 * bf.buf buffer. Additionally it can also hold flags BF_ALLOC or BF_FREE.
134 */
135
136 struct bf {
137 int counter; /* size of data in buffer, or flag */
138 tftphdr_storage_t buf; /* room for data packet */
139 };
140
141 #define BF_ALLOC -3 /* alloc'd but not yet filled */
142 #define BF_FREE -2 /* free */
143
144 #define opcode_RRQ 1
145 #define opcode_WRQ 2
146 #define opcode_DATA 3
147 #define opcode_ACK 4
148 #define opcode_ERROR 5
149
150 #define TIMEOUT 5
151
152 #undef MIN
153 #define MIN(x,y) ((x)<(y)?(x):(y))
154
155 #ifndef DEFAULT_LOGFILE
156 #define DEFAULT_LOGFILE "log/tftpd.log"
157 #endif
158
159 #define REQUEST_DUMP "log/server.input"
160
161 #define DEFAULT_PORT 8999 /* UDP */
162
163 /*****************************************************************************
164 * GLOBAL VARIABLES *
165 *****************************************************************************/
166
167 static struct errmsg errmsgs[] = {
168 { EUNDEF, "Undefined error code" },
169 { ENOTFOUND, "File not found" },
170 { EACCESS, "Access violation" },
171 { ENOSPACE, "Disk full or allocation exceeded" },
172 { EBADOP, "Illegal TFTP operation" },
173 { EBADID, "Unknown transfer ID" },
174 { EEXISTS, "File already exists" },
175 { ENOUSER, "No such user" },
176 { -1, 0 }
177 };
178
179 static struct formats formata[] = {
180 { "netascii", 1 },
181 { "octet", 0 },
182 { NULL, 0 }
183 };
184
185 static struct bf bfs[2];
186
187 static int nextone; /* index of next buffer to use */
188 static int current; /* index of buffer in use */
189
190 /* control flags for crlf conversions */
191 static int newline = 0; /* fillbuf: in middle of newline expansion */
192 static int prevchar = -1; /* putbuf: previous char (cr check) */
193
194 static tftphdr_storage_t buf;
195 static tftphdr_storage_t ackbuf;
196
197 static srvr_sockaddr_union_t from;
198 static curl_socklen_t fromlen;
199
200 static curl_socket_t peer = CURL_SOCKET_BAD;
201
202 static int timeout;
203 static int maxtimeout = 5 * TIMEOUT;
204
205 #ifdef ENABLE_IPV6
206 static bool use_ipv6 = FALSE;
207 #endif
208 static const char *ipv_inuse = "IPv4";
209
210 const char *serverlogfile = DEFAULT_LOGFILE;
211 static char *pidname= (char *)".tftpd.pid";
212 static int serverlogslocked = 0;
213 static int wrotepidfile = 0;
214
215 #ifdef HAVE_SIGSETJMP
216 static sigjmp_buf timeoutbuf;
217 #endif
218
219 #if defined(HAVE_ALARM) && defined(SIGALRM)
220 static int rexmtval = TIMEOUT;
221 #endif
222
223 /* do-nothing macro replacement for systems which lack siginterrupt() */
224
225 #ifndef HAVE_SIGINTERRUPT
226 #define siginterrupt(x,y) do {} while(0)
227 #endif
228
229 /* vars used to keep around previous signal handlers */
230
231 typedef RETSIGTYPE (*SIGHANDLER_T)(int);
232
233 #ifdef SIGHUP
234 static SIGHANDLER_T old_sighup_handler = SIG_ERR;
235 #endif
236
237 #ifdef SIGPIPE
238 static SIGHANDLER_T old_sigpipe_handler = SIG_ERR;
239 #endif
240
241 #ifdef SIGINT
242 static SIGHANDLER_T old_sigint_handler = SIG_ERR;
243 #endif
244
245 #ifdef SIGTERM
246 static SIGHANDLER_T old_sigterm_handler = SIG_ERR;
247 #endif
248
249 #if defined(SIGBREAK) && defined(WIN32)
250 static SIGHANDLER_T old_sigbreak_handler = SIG_ERR;
251 #endif
252
253 /* var which if set indicates that the program should finish execution */
254
255 SIG_ATOMIC_T got_exit_signal = 0;
256
257 /* if next is set indicates the first signal handled in exit_signal_handler */
258
259 static volatile int exit_signal = 0;
260
261 /*****************************************************************************
262 * FUNCTION PROTOTYPES *
263 *****************************************************************************/
264
265 static struct tftphdr *rw_init(int);
266
267 static struct tftphdr *w_init(void);
268
269 static struct tftphdr *r_init(void);
270
271 static void read_ahead(struct testcase *test, int convert);
272
273 static ssize_t write_behind(struct testcase *test, int convert);
274
275 static int synchnet(curl_socket_t);
276
277 static int do_tftp(struct testcase *test, struct tftphdr *tp, ssize_t size);
278
279 static int validate_access(struct testcase *test, const char *fname, int mode);
280
281 static void sendtftp(struct testcase *test, struct formats *pf);
282
283 static void recvtftp(struct testcase *test, struct formats *pf);
284
285 static void nak(int error);
286
287 #if defined(HAVE_ALARM) && defined(SIGALRM)
288
289 static void mysignal(int sig, void (*handler)(int));
290
291 static void timer(int signum);
292
293 static void justtimeout(int signum);
294
295 #endif /* HAVE_ALARM && SIGALRM */
296
297 static RETSIGTYPE exit_signal_handler(int signum);
298
299 static void install_signal_handlers(void);
300
301 static void restore_signal_handlers(void);
302
303 /*****************************************************************************
304 * FUNCTION IMPLEMENTATIONS *
305 *****************************************************************************/
306
307 #if defined(HAVE_ALARM) && defined(SIGALRM)
308
309 /*
310 * Like signal(), but with well-defined semantics.
311 */
mysignal(int sig,void (* handler)(int))312 static void mysignal(int sig, void (*handler)(int))
313 {
314 struct sigaction sa;
315 memset(&sa, 0, sizeof(sa));
316 sa.sa_handler = handler;
317 sigaction(sig, &sa, NULL);
318 }
319
timer(int signum)320 static void timer(int signum)
321 {
322 (void)signum;
323
324 logmsg("alarm!");
325
326 timeout += rexmtval;
327 if(timeout >= maxtimeout) {
328 if(wrotepidfile) {
329 wrotepidfile = 0;
330 unlink(pidname);
331 }
332 if(serverlogslocked) {
333 serverlogslocked = 0;
334 clear_advisor_read_lock(SERVERLOGS_LOCK);
335 }
336 exit(1);
337 }
338 #ifdef HAVE_SIGSETJMP
339 siglongjmp(timeoutbuf, 1);
340 #endif
341 }
342
justtimeout(int signum)343 static void justtimeout(int signum)
344 {
345 (void)signum;
346 }
347
348 #endif /* HAVE_ALARM && SIGALRM */
349
350 /* signal handler that will be triggered to indicate that the program
351 should finish its execution in a controlled manner as soon as possible.
352 The first time this is called it will set got_exit_signal to one and
353 store in exit_signal the signal that triggered its execution. */
354
exit_signal_handler(int signum)355 static RETSIGTYPE exit_signal_handler(int signum)
356 {
357 int old_errno = errno;
358 if(got_exit_signal == 0) {
359 got_exit_signal = 1;
360 exit_signal = signum;
361 }
362 (void)signal(signum, exit_signal_handler);
363 errno = old_errno;
364 }
365
install_signal_handlers(void)366 static void install_signal_handlers(void)
367 {
368 #ifdef SIGHUP
369 /* ignore SIGHUP signal */
370 if((old_sighup_handler = signal(SIGHUP, SIG_IGN)) == SIG_ERR)
371 logmsg("cannot install SIGHUP handler: %s", strerror(errno));
372 #endif
373 #ifdef SIGPIPE
374 /* ignore SIGPIPE signal */
375 if((old_sigpipe_handler = signal(SIGPIPE, SIG_IGN)) == SIG_ERR)
376 logmsg("cannot install SIGPIPE handler: %s", strerror(errno));
377 #endif
378 #ifdef SIGINT
379 /* handle SIGINT signal with our exit_signal_handler */
380 if((old_sigint_handler = signal(SIGINT, exit_signal_handler)) == SIG_ERR)
381 logmsg("cannot install SIGINT handler: %s", strerror(errno));
382 else
383 siginterrupt(SIGINT, 1);
384 #endif
385 #ifdef SIGTERM
386 /* handle SIGTERM signal with our exit_signal_handler */
387 if((old_sigterm_handler = signal(SIGTERM, exit_signal_handler)) == SIG_ERR)
388 logmsg("cannot install SIGTERM handler: %s", strerror(errno));
389 else
390 siginterrupt(SIGTERM, 1);
391 #endif
392 #if defined(SIGBREAK) && defined(WIN32)
393 /* handle SIGBREAK signal with our exit_signal_handler */
394 if((old_sigbreak_handler = signal(SIGBREAK, exit_signal_handler)) == SIG_ERR)
395 logmsg("cannot install SIGBREAK handler: %s", strerror(errno));
396 else
397 siginterrupt(SIGBREAK, 1);
398 #endif
399 }
400
restore_signal_handlers(void)401 static void restore_signal_handlers(void)
402 {
403 #ifdef SIGHUP
404 if(SIG_ERR != old_sighup_handler)
405 (void)signal(SIGHUP, old_sighup_handler);
406 #endif
407 #ifdef SIGPIPE
408 if(SIG_ERR != old_sigpipe_handler)
409 (void)signal(SIGPIPE, old_sigpipe_handler);
410 #endif
411 #ifdef SIGINT
412 if(SIG_ERR != old_sigint_handler)
413 (void)signal(SIGINT, old_sigint_handler);
414 #endif
415 #ifdef SIGTERM
416 if(SIG_ERR != old_sigterm_handler)
417 (void)signal(SIGTERM, old_sigterm_handler);
418 #endif
419 #if defined(SIGBREAK) && defined(WIN32)
420 if(SIG_ERR != old_sigbreak_handler)
421 (void)signal(SIGBREAK, old_sigbreak_handler);
422 #endif
423 }
424
425 /*
426 * init for either read-ahead or write-behind.
427 * zero for write-behind, one for read-head.
428 */
rw_init(int x)429 static struct tftphdr *rw_init(int x)
430 {
431 newline = 0; /* init crlf flag */
432 prevchar = -1;
433 bfs[0].counter = BF_ALLOC; /* pass out the first buffer */
434 current = 0;
435 bfs[1].counter = BF_FREE;
436 nextone = x; /* ahead or behind? */
437 return &bfs[0].buf.hdr;
438 }
439
w_init(void)440 static struct tftphdr *w_init(void)
441 {
442 return rw_init(0); /* write-behind */
443 }
444
r_init(void)445 static struct tftphdr *r_init(void)
446 {
447 return rw_init(1); /* read-ahead */
448 }
449
450 /* Have emptied current buffer by sending to net and getting ack.
451 Free it and return next buffer filled with data.
452 */
readit(struct testcase * test,struct tftphdr ** dpp,int convert)453 static int readit(struct testcase *test, struct tftphdr **dpp,
454 int convert /* if true, convert to ascii */)
455 {
456 struct bf *b;
457
458 bfs[current].counter = BF_FREE; /* free old one */
459 current = !current; /* "incr" current */
460
461 b = &bfs[current]; /* look at new buffer */
462 if (b->counter == BF_FREE) /* if it's empty */
463 read_ahead(test, convert); /* fill it */
464
465 *dpp = &b->buf.hdr; /* set caller's ptr */
466 return b->counter;
467 }
468
469 /*
470 * fill the input buffer, doing ascii conversions if requested
471 * conversions are lf -> cr,lf and cr -> cr, nul
472 */
read_ahead(struct testcase * test,int convert)473 static void read_ahead(struct testcase *test,
474 int convert /* if true, convert to ascii */)
475 {
476 int i;
477 char *p;
478 int c;
479 struct bf *b;
480 struct tftphdr *dp;
481
482 b = &bfs[nextone]; /* look at "next" buffer */
483 if (b->counter != BF_FREE) /* nop if not free */
484 return;
485 nextone = !nextone; /* "incr" next buffer ptr */
486
487 dp = &b->buf.hdr;
488
489 if (convert == 0) {
490 /* The former file reading code did this:
491 b->counter = read(fileno(file), dp->th_data, SEGSIZE); */
492 size_t copy_n = MIN(SEGSIZE, test->rcount);
493 memcpy(dp->th_data, test->rptr, copy_n);
494
495 /* decrease amount, advance pointer */
496 test->rcount -= copy_n;
497 test->rptr += copy_n;
498 b->counter = (int)copy_n;
499 return;
500 }
501
502 p = dp->th_data;
503 for (i = 0 ; i < SEGSIZE; i++) {
504 if (newline) {
505 if (prevchar == '\n')
506 c = '\n'; /* lf to cr,lf */
507 else
508 c = '\0'; /* cr to cr,nul */
509 newline = 0;
510 }
511 else {
512 if(test->rcount) {
513 c=test->rptr[0];
514 test->rptr++;
515 test->rcount--;
516 }
517 else
518 break;
519 if (c == '\n' || c == '\r') {
520 prevchar = c;
521 c = '\r';
522 newline = 1;
523 }
524 }
525 *p++ = (char)c;
526 }
527 b->counter = (int)(p - dp->th_data);
528 }
529
530 /* Update count associated with the buffer, get new buffer from the queue.
531 Calls write_behind only if next buffer not available.
532 */
writeit(struct testcase * test,struct tftphdr * volatile * dpp,int ct,int convert)533 static int writeit(struct testcase *test, struct tftphdr * volatile *dpp,
534 int ct, int convert)
535 {
536 bfs[current].counter = ct; /* set size of data to write */
537 current = !current; /* switch to other buffer */
538 if (bfs[current].counter != BF_FREE) /* if not free */
539 write_behind(test, convert); /* flush it */
540 bfs[current].counter = BF_ALLOC; /* mark as alloc'd */
541 *dpp = &bfs[current].buf.hdr;
542 return ct; /* this is a lie of course */
543 }
544
545 /*
546 * Output a buffer to a file, converting from netascii if requested.
547 * CR,NUL -> CR and CR,LF => LF.
548 * Note spec is undefined if we get CR as last byte of file or a
549 * CR followed by anything else. In this case we leave it alone.
550 */
write_behind(struct testcase * test,int convert)551 static ssize_t write_behind(struct testcase *test, int convert)
552 {
553 char *writebuf;
554 int count;
555 int ct;
556 char *p;
557 int c; /* current character */
558 struct bf *b;
559 struct tftphdr *dp;
560
561 b = &bfs[nextone];
562 if (b->counter < -1) /* anything to flush? */
563 return 0; /* just nop if nothing to do */
564
565 if(!test->ofile) {
566 char outfile[256];
567 snprintf(outfile, sizeof(outfile), "log/upload.%ld", test->testno);
568 test->ofile=open(outfile, O_CREAT|O_RDWR, 0777);
569 if(test->ofile == -1) {
570 logmsg("Couldn't create and/or open file %s for upload!", outfile);
571 return -1; /* failure! */
572 }
573 }
574
575 count = b->counter; /* remember byte count */
576 b->counter = BF_FREE; /* reset flag */
577 dp = &b->buf.hdr;
578 nextone = !nextone; /* incr for next time */
579 writebuf = dp->th_data;
580
581 if (count <= 0)
582 return -1; /* nak logic? */
583
584 if (convert == 0)
585 return write(test->ofile, writebuf, count);
586
587 p = writebuf;
588 ct = count;
589 while (ct--) { /* loop over the buffer */
590 c = *p++; /* pick up a character */
591 if (prevchar == '\r') { /* if prev char was cr */
592 if (c == '\n') /* if have cr,lf then just */
593 lseek(test->ofile, -1, SEEK_CUR); /* smash lf on top of the cr */
594 else
595 if (c == '\0') /* if have cr,nul then */
596 goto skipit; /* just skip over the putc */
597 /* else just fall through and allow it */
598 }
599 /* formerly
600 putc(c, file); */
601 if(1 != write(test->ofile, &c, 1))
602 break;
603 skipit:
604 prevchar = c;
605 }
606 return count;
607 }
608
609 /* When an error has occurred, it is possible that the two sides are out of
610 * synch. Ie: that what I think is the other side's response to packet N is
611 * really their response to packet N-1.
612 *
613 * So, to try to prevent that, we flush all the input queued up for us on the
614 * network connection on our host.
615 *
616 * We return the number of packets we flushed (mostly for reporting when trace
617 * is active).
618 */
619
synchnet(curl_socket_t f)620 static int synchnet(curl_socket_t f /* socket to flush */)
621 {
622
623 #if defined(HAVE_IOCTLSOCKET)
624 unsigned long i;
625 #else
626 int i;
627 #endif
628 int j = 0;
629 char rbuf[PKTSIZE];
630 srvr_sockaddr_union_t fromaddr;
631 curl_socklen_t fromaddrlen;
632
633 for (;;) {
634 #if defined(HAVE_IOCTLSOCKET)
635 (void) ioctlsocket(f, FIONREAD, &i);
636 #else
637 (void) ioctl(f, FIONREAD, &i);
638 #endif
639 if (i) {
640 j++;
641 #ifdef ENABLE_IPV6
642 if(!use_ipv6)
643 #endif
644 fromaddrlen = sizeof(fromaddr.sa4);
645 #ifdef ENABLE_IPV6
646 else
647 fromaddrlen = sizeof(fromaddr.sa6);
648 #endif
649 (void) recvfrom(f, rbuf, sizeof(rbuf), 0,
650 &fromaddr.sa, &fromaddrlen);
651 }
652 else
653 break;
654 }
655 return j;
656 }
657
main(int argc,char ** argv)658 int main(int argc, char **argv)
659 {
660 srvr_sockaddr_union_t me;
661 struct tftphdr *tp;
662 ssize_t n = 0;
663 int arg = 1;
664 unsigned short port = DEFAULT_PORT;
665 curl_socket_t sock = CURL_SOCKET_BAD;
666 int flag;
667 int rc;
668 int error;
669 long pid;
670 struct testcase test;
671 int result = 0;
672
673 memset(&test, 0, sizeof(test));
674
675 while(argc>arg) {
676 if(!strcmp("--version", argv[arg])) {
677 printf("tftpd IPv4%s\n",
678 #ifdef ENABLE_IPV6
679 "/IPv6"
680 #else
681 ""
682 #endif
683 );
684 return 0;
685 }
686 else if(!strcmp("--pidfile", argv[arg])) {
687 arg++;
688 if(argc>arg)
689 pidname = argv[arg++];
690 }
691 else if(!strcmp("--logfile", argv[arg])) {
692 arg++;
693 if(argc>arg)
694 serverlogfile = argv[arg++];
695 }
696 else if(!strcmp("--ipv4", argv[arg])) {
697 #ifdef ENABLE_IPV6
698 ipv_inuse = "IPv4";
699 use_ipv6 = FALSE;
700 #endif
701 arg++;
702 }
703 else if(!strcmp("--ipv6", argv[arg])) {
704 #ifdef ENABLE_IPV6
705 ipv_inuse = "IPv6";
706 use_ipv6 = TRUE;
707 #endif
708 arg++;
709 }
710 else if(!strcmp("--port", argv[arg])) {
711 arg++;
712 if(argc>arg) {
713 char *endptr;
714 unsigned long ulnum = strtoul(argv[arg], &endptr, 10);
715 if((endptr != argv[arg] + strlen(argv[arg])) ||
716 (ulnum < 1025UL) || (ulnum > 65535UL)) {
717 fprintf(stderr, "tftpd: invalid --port argument (%s)\n",
718 argv[arg]);
719 return 0;
720 }
721 port = curlx_ultous(ulnum);
722 arg++;
723 }
724 }
725 else if(!strcmp("--srcdir", argv[arg])) {
726 arg++;
727 if(argc>arg) {
728 path = argv[arg];
729 arg++;
730 }
731 }
732 else {
733 puts("Usage: tftpd [option]\n"
734 " --version\n"
735 " --logfile [file]\n"
736 " --pidfile [file]\n"
737 " --ipv4\n"
738 " --ipv6\n"
739 " --port [port]\n"
740 " --srcdir [path]");
741 return 0;
742 }
743 }
744
745 #ifdef WIN32
746 win32_init();
747 atexit(win32_cleanup);
748 #endif
749
750 install_signal_handlers();
751
752 pid = (long)getpid();
753
754 #ifdef ENABLE_IPV6
755 if(!use_ipv6)
756 #endif
757 sock = socket(AF_INET, SOCK_DGRAM, 0);
758 #ifdef ENABLE_IPV6
759 else
760 sock = socket(AF_INET6, SOCK_DGRAM, 0);
761 #endif
762
763 if(CURL_SOCKET_BAD == sock) {
764 error = SOCKERRNO;
765 logmsg("Error creating socket: (%d) %s",
766 error, strerror(error));
767 result = 1;
768 goto tftpd_cleanup;
769 }
770
771 flag = 1;
772 if (0 != setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
773 (void *)&flag, sizeof(flag))) {
774 error = SOCKERRNO;
775 logmsg("setsockopt(SO_REUSEADDR) failed with error: (%d) %s",
776 error, strerror(error));
777 result = 1;
778 goto tftpd_cleanup;
779 }
780
781 #ifdef ENABLE_IPV6
782 if(!use_ipv6) {
783 #endif
784 memset(&me.sa4, 0, sizeof(me.sa4));
785 me.sa4.sin_family = AF_INET;
786 me.sa4.sin_addr.s_addr = INADDR_ANY;
787 me.sa4.sin_port = htons(port);
788 rc = bind(sock, &me.sa, sizeof(me.sa4));
789 #ifdef ENABLE_IPV6
790 }
791 else {
792 memset(&me.sa6, 0, sizeof(me.sa6));
793 me.sa6.sin6_family = AF_INET6;
794 me.sa6.sin6_addr = in6addr_any;
795 me.sa6.sin6_port = htons(port);
796 rc = bind(sock, &me.sa, sizeof(me.sa6));
797 }
798 #endif /* ENABLE_IPV6 */
799 if(0 != rc) {
800 error = SOCKERRNO;
801 logmsg("Error binding socket on port %hu: (%d) %s",
802 port, error, strerror(error));
803 result = 1;
804 goto tftpd_cleanup;
805 }
806
807 wrotepidfile = write_pidfile(pidname);
808 if(!wrotepidfile) {
809 result = 1;
810 goto tftpd_cleanup;
811 }
812
813 logmsg("Running %s version on port UDP/%d", ipv_inuse, (int)port);
814
815 for (;;) {
816 fromlen = sizeof(from);
817 #ifdef ENABLE_IPV6
818 if(!use_ipv6)
819 #endif
820 fromlen = sizeof(from.sa4);
821 #ifdef ENABLE_IPV6
822 else
823 fromlen = sizeof(from.sa6);
824 #endif
825 n = (ssize_t)recvfrom(sock, &buf.storage[0], sizeof(buf.storage), 0,
826 &from.sa, &fromlen);
827 if(got_exit_signal)
828 break;
829 if (n < 0) {
830 logmsg("recvfrom");
831 result = 3;
832 break;
833 }
834
835 set_advisor_read_lock(SERVERLOGS_LOCK);
836 serverlogslocked = 1;
837
838 #ifdef ENABLE_IPV6
839 if(!use_ipv6) {
840 #endif
841 from.sa4.sin_family = AF_INET;
842 peer = socket(AF_INET, SOCK_DGRAM, 0);
843 if(CURL_SOCKET_BAD == peer) {
844 logmsg("socket");
845 result = 2;
846 break;
847 }
848 if(connect(peer, &from.sa, sizeof(from.sa4)) < 0) {
849 logmsg("connect: fail");
850 result = 1;
851 break;
852 }
853 #ifdef ENABLE_IPV6
854 }
855 else {
856 from.sa6.sin6_family = AF_INET6;
857 peer = socket(AF_INET6, SOCK_DGRAM, 0);
858 if(CURL_SOCKET_BAD == peer) {
859 logmsg("socket");
860 result = 2;
861 break;
862 }
863 if(connect(peer, &from.sa, sizeof(from.sa6)) < 0) {
864 logmsg("connect: fail");
865 result = 1;
866 break;
867 }
868 }
869 #endif
870
871 maxtimeout = 5*TIMEOUT;
872
873 tp = &buf.hdr;
874 tp->th_opcode = ntohs(tp->th_opcode);
875 if (tp->th_opcode == opcode_RRQ || tp->th_opcode == opcode_WRQ) {
876 memset(&test, 0, sizeof(test));
877 if (do_tftp(&test, tp, n) < 0)
878 break;
879 free(test.buffer);
880 }
881 sclose(peer);
882 peer = CURL_SOCKET_BAD;
883
884 if(test.ofile > 0) {
885 close(test.ofile);
886 test.ofile = 0;
887 }
888
889 if(got_exit_signal)
890 break;
891
892 if(serverlogslocked) {
893 serverlogslocked = 0;
894 clear_advisor_read_lock(SERVERLOGS_LOCK);
895 }
896
897 logmsg("end of one transfer");
898
899 }
900
901 tftpd_cleanup:
902
903 if(test.ofile > 0)
904 close(test.ofile);
905
906 if((peer != sock) && (peer != CURL_SOCKET_BAD))
907 sclose(peer);
908
909 if(sock != CURL_SOCKET_BAD)
910 sclose(sock);
911
912 if(got_exit_signal)
913 logmsg("signalled to die");
914
915 if(wrotepidfile)
916 unlink(pidname);
917
918 if(serverlogslocked) {
919 serverlogslocked = 0;
920 clear_advisor_read_lock(SERVERLOGS_LOCK);
921 }
922
923 restore_signal_handlers();
924
925 if(got_exit_signal) {
926 logmsg("========> %s tftpd (port: %d pid: %ld) exits with signal (%d)",
927 ipv_inuse, (int)port, pid, exit_signal);
928 /*
929 * To properly set the return status of the process we
930 * must raise the same signal SIGINT or SIGTERM that we
931 * caught and let the old handler take care of it.
932 */
933 raise(exit_signal);
934 }
935
936 logmsg("========> tftpd quits");
937 return result;
938 }
939
940 /*
941 * Handle initial connection protocol.
942 */
do_tftp(struct testcase * test,struct tftphdr * tp,ssize_t size)943 static int do_tftp(struct testcase *test, struct tftphdr *tp, ssize_t size)
944 {
945 char *cp;
946 int first = 1, ecode;
947 struct formats *pf;
948 char *filename, *mode = NULL;
949 int error;
950 FILE *server;
951 #ifdef USE_WINSOCK
952 DWORD recvtimeout, recvtimeoutbak;
953 #endif
954
955 /* Open request dump file. */
956 server = fopen(REQUEST_DUMP, "ab");
957 if(!server) {
958 error = errno;
959 logmsg("fopen() failed with error: %d %s", error, strerror(error));
960 logmsg("Error opening file: %s", REQUEST_DUMP);
961 return -1;
962 }
963
964 /* store input protocol */
965 fprintf(server, "opcode: %x\n", tp->th_opcode);
966
967 cp = (char *)&tp->th_stuff;
968 filename = cp;
969 again:
970 while (cp < &buf.storage[size]) {
971 if (*cp == '\0')
972 break;
973 cp++;
974 }
975 if (*cp) {
976 nak(EBADOP);
977 fclose(server);
978 return 3;
979 }
980 if (first) {
981 mode = ++cp;
982 first = 0;
983 goto again;
984 }
985 /* store input protocol */
986 fprintf(server, "filename: %s\n", filename);
987
988 for (cp = mode; cp && *cp; cp++)
989 if(ISUPPER(*cp))
990 *cp = (char)tolower((int)*cp);
991
992 /* store input protocol */
993 fprintf(server, "mode: %s\n", mode);
994 fclose(server);
995
996 for (pf = formata; pf->f_mode; pf++)
997 if (strcmp(pf->f_mode, mode) == 0)
998 break;
999 if (!pf->f_mode) {
1000 nak(EBADOP);
1001 return 2;
1002 }
1003 ecode = validate_access(test, filename, tp->th_opcode);
1004 if (ecode) {
1005 nak(ecode);
1006 return 1;
1007 }
1008
1009 #ifdef USE_WINSOCK
1010 recvtimeout = sizeof(recvtimeoutbak);
1011 getsockopt(peer, SOL_SOCKET, SO_RCVTIMEO,
1012 (char*)&recvtimeoutbak, (int*)&recvtimeout);
1013 recvtimeout = TIMEOUT*1000;
1014 setsockopt(peer, SOL_SOCKET, SO_RCVTIMEO,
1015 (const char*)&recvtimeout, sizeof(recvtimeout));
1016 #endif
1017
1018 if (tp->th_opcode == opcode_WRQ)
1019 recvtftp(test, pf);
1020 else
1021 sendtftp(test, pf);
1022
1023 #ifdef USE_WINSOCK
1024 recvtimeout = recvtimeoutbak;
1025 setsockopt(peer, SOL_SOCKET, SO_RCVTIMEO,
1026 (const char*)&recvtimeout, sizeof(recvtimeout));
1027 #endif
1028
1029 return 0;
1030 }
1031
1032 /* Based on the testno, parse the correct server commands. */
parse_servercmd(struct testcase * req)1033 static int parse_servercmd(struct testcase *req)
1034 {
1035 FILE *stream;
1036 char *filename;
1037 int error;
1038
1039 filename = test2file(req->testno);
1040
1041 stream=fopen(filename, "rb");
1042 if(!stream) {
1043 error = errno;
1044 logmsg("fopen() failed with error: %d %s", error, strerror(error));
1045 logmsg(" [1] Error opening file: %s", filename);
1046 logmsg(" Couldn't open test file %ld", req->testno);
1047 return 1; /* done */
1048 }
1049 else {
1050 char *orgcmd = NULL;
1051 char *cmd = NULL;
1052 size_t cmdsize = 0;
1053 int num=0;
1054
1055 /* get the custom server control "commands" */
1056 error = getpart(&orgcmd, &cmdsize, "reply", "servercmd", stream);
1057 fclose(stream);
1058 if(error) {
1059 logmsg("getpart() failed with error: %d", error);
1060 return 1; /* done */
1061 }
1062
1063 cmd = orgcmd;
1064 while(cmd && cmdsize) {
1065 char *check;
1066 if(1 == sscanf(cmd, "writedelay: %d", &num)) {
1067 logmsg("instructed to delay %d secs between packets", num);
1068 req->writedelay = num;
1069 }
1070 else {
1071 logmsg("Unknown <servercmd> instruction found: %s", cmd);
1072 }
1073 /* try to deal with CRLF or just LF */
1074 check = strchr(cmd, '\r');
1075 if(!check)
1076 check = strchr(cmd, '\n');
1077
1078 if(check) {
1079 /* get to the letter following the newline */
1080 while((*check == '\r') || (*check == '\n'))
1081 check++;
1082
1083 if(!*check)
1084 /* if we reached a zero, get out */
1085 break;
1086 cmd = check;
1087 }
1088 else
1089 break;
1090 }
1091 free(orgcmd);
1092 }
1093
1094 return 0; /* OK! */
1095 }
1096
1097
1098 /*
1099 * Validate file access.
1100 */
validate_access(struct testcase * test,const char * filename,int mode)1101 static int validate_access(struct testcase *test,
1102 const char *filename, int mode)
1103 {
1104 char *ptr;
1105 long testno, partno;
1106 int error;
1107 char partbuf[80]="data";
1108
1109 logmsg("trying to get file: %s mode %x", filename, mode);
1110
1111 if(!strncmp("verifiedserver", filename, 14)) {
1112 char weare[128];
1113 size_t count = sprintf(weare, "WE ROOLZ: %ld\r\n", (long)getpid());
1114
1115 logmsg("Are-we-friendly question received");
1116 test->buffer = strdup(weare);
1117 test->rptr = test->buffer; /* set read pointer */
1118 test->bufsize = count; /* set total count */
1119 test->rcount = count; /* set data left to read */
1120 return 0; /* fine */
1121 }
1122
1123 /* find the last slash */
1124 ptr = strrchr(filename, '/');
1125
1126 if(ptr) {
1127 char *file;
1128
1129 ptr++; /* skip the slash */
1130
1131 /* skip all non-numericals following the slash */
1132 while(*ptr && !ISDIGIT(*ptr))
1133 ptr++;
1134
1135 /* get the number */
1136 testno = strtol(ptr, &ptr, 10);
1137
1138 if(testno > 10000) {
1139 partno = testno % 10000;
1140 testno /= 10000;
1141 }
1142 else
1143 partno = 0;
1144
1145
1146 logmsg("requested test number %ld part %ld", testno, partno);
1147
1148 test->testno = testno;
1149
1150 (void)parse_servercmd(test);
1151
1152 file = test2file(testno);
1153
1154 if(0 != partno)
1155 sprintf(partbuf, "data%ld", partno);
1156
1157 if(file) {
1158 FILE *stream=fopen(file, "rb");
1159 if(!stream) {
1160 error = errno;
1161 logmsg("fopen() failed with error: %d %s", error, strerror(error));
1162 logmsg("Error opening file: %s", file);
1163 logmsg("Couldn't open test file: %s", file);
1164 return EACCESS;
1165 }
1166 else {
1167 size_t count;
1168 error = getpart(&test->buffer, &count, "reply", partbuf, stream);
1169 fclose(stream);
1170 if(error) {
1171 logmsg("getpart() failed with error: %d", error);
1172 return EACCESS;
1173 }
1174 if(test->buffer) {
1175 test->rptr = test->buffer; /* set read pointer */
1176 test->bufsize = count; /* set total count */
1177 test->rcount = count; /* set data left to read */
1178 }
1179 else
1180 return EACCESS;
1181 }
1182
1183 }
1184 else
1185 return EACCESS;
1186 }
1187 else {
1188 logmsg("no slash found in path");
1189 return EACCESS; /* failure */
1190 }
1191
1192 logmsg("file opened and all is good");
1193 return 0;
1194 }
1195
1196 /*
1197 * Send the requested file.
1198 */
sendtftp(struct testcase * test,struct formats * pf)1199 static void sendtftp(struct testcase *test, struct formats *pf)
1200 {
1201 int size;
1202 ssize_t n;
1203 /* This is volatile to live through a siglongjmp */
1204 volatile unsigned short sendblock; /* block count */
1205 struct tftphdr *sdp; /* data buffer */
1206 struct tftphdr *sap; /* ack buffer */
1207
1208 sendblock = 1;
1209 #if defined(HAVE_ALARM) && defined(SIGALRM)
1210 mysignal(SIGALRM, timer);
1211 #endif
1212 sdp = r_init();
1213 sap = &ackbuf.hdr;
1214 do {
1215 size = readit(test, &sdp, pf->f_convert);
1216 if (size < 0) {
1217 nak(errno + 100);
1218 return;
1219 }
1220 sdp->th_opcode = htons((unsigned short)opcode_DATA);
1221 sdp->th_block = htons(sendblock);
1222 timeout = 0;
1223 #ifdef HAVE_SIGSETJMP
1224 (void) sigsetjmp(timeoutbuf, 1);
1225 #endif
1226 if(test->writedelay) {
1227 logmsg("Pausing %d seconds before %d bytes", test->writedelay,
1228 size);
1229 wait_ms(1000*test->writedelay);
1230 }
1231
1232 send_data:
1233 if (swrite(peer, sdp, size + 4) != size + 4) {
1234 logmsg("write");
1235 return;
1236 }
1237 read_ahead(test, pf->f_convert);
1238 for ( ; ; ) {
1239 #ifdef HAVE_ALARM
1240 alarm(rexmtval); /* read the ack */
1241 #endif
1242 n = sread(peer, &ackbuf.storage[0], sizeof(ackbuf.storage));
1243 #ifdef HAVE_ALARM
1244 alarm(0);
1245 #endif
1246 if(got_exit_signal)
1247 return;
1248 if (n < 0) {
1249 logmsg("read: fail");
1250 return;
1251 }
1252 sap->th_opcode = ntohs((unsigned short)sap->th_opcode);
1253 sap->th_block = ntohs(sap->th_block);
1254
1255 if (sap->th_opcode == opcode_ERROR) {
1256 logmsg("got ERROR");
1257 return;
1258 }
1259
1260 if (sap->th_opcode == opcode_ACK) {
1261 if (sap->th_block == sendblock) {
1262 break;
1263 }
1264 /* Re-synchronize with the other side */
1265 (void) synchnet(peer);
1266 if (sap->th_block == (sendblock-1)) {
1267 goto send_data;
1268 }
1269 }
1270
1271 }
1272 sendblock++;
1273 } while (size == SEGSIZE);
1274 }
1275
1276 /*
1277 * Receive a file.
1278 */
recvtftp(struct testcase * test,struct formats * pf)1279 static void recvtftp(struct testcase *test, struct formats *pf)
1280 {
1281 ssize_t n, size;
1282 /* These are volatile to live through a siglongjmp */
1283 volatile unsigned short recvblock; /* block count */
1284 struct tftphdr * volatile rdp; /* data buffer */
1285 struct tftphdr *rap; /* ack buffer */
1286
1287 recvblock = 0;
1288 rdp = w_init();
1289 #if defined(HAVE_ALARM) && defined(SIGALRM)
1290 mysignal(SIGALRM, timer);
1291 #endif
1292 rap = &ackbuf.hdr;
1293 do {
1294 timeout = 0;
1295 rap->th_opcode = htons((unsigned short)opcode_ACK);
1296 rap->th_block = htons(recvblock);
1297 recvblock++;
1298 #ifdef HAVE_SIGSETJMP
1299 (void) sigsetjmp(timeoutbuf, 1);
1300 #endif
1301 send_ack:
1302 if (swrite(peer, &ackbuf.storage[0], 4) != 4) {
1303 logmsg("write: fail\n");
1304 goto abort;
1305 }
1306 write_behind(test, pf->f_convert);
1307 for ( ; ; ) {
1308 #ifdef HAVE_ALARM
1309 alarm(rexmtval);
1310 #endif
1311 n = sread(peer, rdp, PKTSIZE);
1312 #ifdef HAVE_ALARM
1313 alarm(0);
1314 #endif
1315 if(got_exit_signal)
1316 goto abort;
1317 if (n < 0) { /* really? */
1318 logmsg("read: fail\n");
1319 goto abort;
1320 }
1321 rdp->th_opcode = ntohs((unsigned short)rdp->th_opcode);
1322 rdp->th_block = ntohs(rdp->th_block);
1323 if (rdp->th_opcode == opcode_ERROR)
1324 goto abort;
1325 if (rdp->th_opcode == opcode_DATA) {
1326 if (rdp->th_block == recvblock) {
1327 break; /* normal */
1328 }
1329 /* Re-synchronize with the other side */
1330 (void) synchnet(peer);
1331 if (rdp->th_block == (recvblock-1))
1332 goto send_ack; /* rexmit */
1333 }
1334 }
1335
1336 size = writeit(test, &rdp, (int)(n - 4), pf->f_convert);
1337 if (size != (n-4)) { /* ahem */
1338 if (size < 0)
1339 nak(errno + 100);
1340 else
1341 nak(ENOSPACE);
1342 goto abort;
1343 }
1344 } while (size == SEGSIZE);
1345 write_behind(test, pf->f_convert);
1346
1347 rap->th_opcode = htons((unsigned short)opcode_ACK); /* send the "final" ack */
1348 rap->th_block = htons(recvblock);
1349 (void) swrite(peer, &ackbuf.storage[0], 4);
1350 #if defined(HAVE_ALARM) && defined(SIGALRM)
1351 mysignal(SIGALRM, justtimeout); /* just abort read on timeout */
1352 alarm(rexmtval);
1353 #endif
1354 /* normally times out and quits */
1355 n = sread(peer, &buf.storage[0], sizeof(buf.storage));
1356 #ifdef HAVE_ALARM
1357 alarm(0);
1358 #endif
1359 if(got_exit_signal)
1360 goto abort;
1361 if (n >= 4 && /* if read some data */
1362 rdp->th_opcode == opcode_DATA && /* and got a data block */
1363 recvblock == rdp->th_block) { /* then my last ack was lost */
1364 (void) swrite(peer, &ackbuf.storage[0], 4); /* resend final ack */
1365 }
1366 abort:
1367 return;
1368 }
1369
1370 /*
1371 * Send a nak packet (error message). Error code passed in is one of the
1372 * standard TFTP codes, or a Unix errno offset by 100.
1373 */
nak(int error)1374 static void nak(int error)
1375 {
1376 struct tftphdr *tp;
1377 int length;
1378 struct errmsg *pe;
1379
1380 tp = &buf.hdr;
1381 tp->th_opcode = htons((unsigned short)opcode_ERROR);
1382 tp->th_code = htons((unsigned short)error);
1383 for (pe = errmsgs; pe->e_code >= 0; pe++)
1384 if (pe->e_code == error)
1385 break;
1386 if (pe->e_code < 0) {
1387 pe->e_msg = strerror(error - 100);
1388 tp->th_code = EUNDEF; /* set 'undef' errorcode */
1389 }
1390 length = (int)strlen(pe->e_msg);
1391
1392 /* we use memcpy() instead of strcpy() in order to avoid buffer overflow
1393 * report from glibc with FORTIFY_SOURCE */
1394 memcpy(tp->th_msg, pe->e_msg, length + 1);
1395 length += 5;
1396 if (swrite(peer, &buf.storage[0], length) != length)
1397 logmsg("nak: fail\n");
1398 }
1399