1 /* tftpd.c - TFTP server.
2 *
3 * Copyright 2013 Ranjan Kumar <ranjankumar.bth@gmail.com>
4 * Copyright 2013 Kyungwan Han <asura321@gmail.com>
5 *
6 * No Standard.
7
8 USE_TFTPD(NEWTOY(tftpd, "rcu:l", TOYFLAG_BIN))
9
10 config TFTPD
11 bool "tftpd"
12 default n
13 help
14 usage: tftpd [-cr] [-u USER] [DIR]
15
16 Transfer file from/to tftp server.
17
18 -r read only
19 -c Allow file creation via upload
20 -u run as USER
21 -l Log to syslog (inetd mode requires this)
22 */
23
24 #define FOR_tftpd
25 #include "toys.h"
26
27 GLOBALS(
28 char *user;
29
30 long sfd;
31 struct passwd *pw;
32 )
33
34 #define TFTPD_BLKSIZE 512 // as per RFC 1350.
35
36 // opcodes
37 #define TFTPD_OP_RRQ 1 // Read Request RFC 1350, RFC 2090
38 #define TFTPD_OP_WRQ 2 // Write Request RFC 1350
39 #define TFTPD_OP_DATA 3 // Data chunk RFC 1350
40 #define TFTPD_OP_ACK 4 // Acknowledgement RFC 1350
41 #define TFTPD_OP_ERR 5 // Error Message RFC 1350
42 #define TFTPD_OP_OACK 6 // Option acknowledgment RFC 2347
43
44 // Error Codes:
45 #define TFTPD_ER_NOSUCHFILE 1 // File not found
46 #define TFTPD_ER_ACCESS 2 // Access violation
47 #define TFTPD_ER_FULL 3 // Disk full or allocation exceeded
48 #define TFTPD_ER_ILLEGALOP 4 // Illegal TFTP operation
49 #define TFTPD_ER_UNKID 5 // Unknown transfer ID
50 #define TFTPD_ER_EXISTS 6 // File already exists
51 #define TFTPD_ER_UNKUSER 7 // No such user
52 #define TFTPD_ER_NEGOTIATE 8 // Terminate transfer due to option negotiation
53
54 /* TFTP Packet Formats
55 * Type Op # Format without header
56 * 2 bytes string 1 byte string 1 byte
57 * -----------------------------------------------
58 * RRQ/ | 01/02 | Filename | 0 | Mode | 0 |
59 * WRQ -----------------------------------------------
60 * 2 bytes 2 bytes n bytes
61 * ---------------------------------
62 * DATA | 03 | Block # | Data |
63 * ---------------------------------
64 * 2 bytes 2 bytes
65 * -------------------
66 * ACK | 04 | Block # |
67 * --------------------
68 * 2 bytes 2 bytes string 1 byte
69 * ----------------------------------------
70 * ERROR | 05 | ErrorCode | ErrMsg | 0 |
71 * ----------------------------------------
72 */
73
74 static char *g_errpkt = toybuf + TFTPD_BLKSIZE;
75
76 // Create and send error packet.
send_errpkt(struct sockaddr * dstaddr,socklen_t socklen,char * errmsg)77 static void send_errpkt(struct sockaddr *dstaddr,
78 socklen_t socklen, char *errmsg)
79 {
80 error_msg(errmsg);
81 g_errpkt[1] = TFTPD_OP_ERR;
82 strcpy(g_errpkt + 4, errmsg);
83 if (sendto(TT.sfd, g_errpkt, strlen(errmsg)+5, 0, dstaddr, socklen) < 0)
84 perror_exit("sendto failed");
85 }
86
87 // Used to send / receive packets.
do_action(struct sockaddr * srcaddr,struct sockaddr * dstaddr,socklen_t socklen,char * file,int opcode,int tsize,int blksize)88 static void do_action(struct sockaddr *srcaddr, struct sockaddr *dstaddr,
89 socklen_t socklen, char *file, int opcode, int tsize, int blksize)
90 {
91 int fd, done = 0, retry_count = 12, timeout = 100, len;
92 uint16_t blockno = 1, pktopcode, rblockno;
93 char *ptr, *spkt, *rpkt;
94 struct pollfd pollfds[1];
95
96 spkt = xzalloc(blksize + 4);
97 rpkt = xzalloc(blksize + 4);
98 ptr = spkt+2; //point after opcode.
99
100 pollfds[0].fd = TT.sfd;
101 // initialize groups, setgid and setuid
102 if (TT.pw) xsetuser(TT.pw);
103
104 if (opcode == TFTPD_OP_RRQ) fd = open(file, O_RDONLY, 0666);
105 else fd = open(file, ((toys.optflags & FLAG_c) ?
106 (O_WRONLY|O_TRUNC|O_CREAT) : (O_WRONLY|O_TRUNC)) , 0666);
107 if (fd < 0) {
108 g_errpkt[3] = TFTPD_ER_NOSUCHFILE;
109 send_errpkt(dstaddr, socklen, "can't open file");
110 goto CLEAN_APP;
111 }
112 // For download -> blockno will be 1.
113 // 1st ACK will be from dst,which will have blockno-=1
114 // Create and send ACK packet.
115 if (blksize != TFTPD_BLKSIZE || tsize) {
116 pktopcode = TFTPD_OP_OACK;
117 // add "blksize\000blksize_val\000" in send buffer.
118 if (blksize != TFTPD_BLKSIZE) {
119 strcpy(ptr, "blksize");
120 ptr += strlen("blksize") + 1;
121 ptr += snprintf(ptr, 6, "%d", blksize) + 1;
122 }
123 if (tsize) {// add "tsize\000tsize_val\000" in send buffer.
124 struct stat sb;
125
126 sb.st_size = 0;
127 fstat(fd, &sb);
128 strcpy(ptr, "tsize");
129 ptr += strlen("tsize") + 1;
130 ptr += sprintf(ptr, "%lu", (unsigned long)sb.st_size)+1;
131 }
132 goto SEND_PKT;
133 }
134 // upload -> ACK 1st packet with filename, as it has blockno 0.
135 if (opcode == TFTPD_OP_WRQ) blockno = 0;
136
137 // Prepare DATA and/or ACK pkt and send it.
138 for (;;) {
139 int poll_ret;
140
141 retry_count = 12, timeout = 100, pktopcode = TFTPD_OP_ACK;
142 ptr = spkt+2;
143 *((uint16_t*)ptr) = htons(blockno);
144 blockno++;
145 ptr += 2;
146 if (opcode == TFTPD_OP_RRQ) {
147 pktopcode = TFTPD_OP_DATA;
148 len = readall(fd, ptr, blksize);
149 if (len < 0) {
150 send_errpkt(dstaddr, socklen, "read-error");
151 break;
152 }
153 if (len != blksize) done = 1; //last pkt.
154 ptr += len;
155 }
156 SEND_PKT:
157 // 1st ACK will be from dst, which will have blockno-=1
158 *((uint16_t*)spkt) = htons(pktopcode); //append send pkt's opcode.
159 RETRY_SEND:
160 if (sendto(TT.sfd, spkt, (ptr - spkt), 0, dstaddr, socklen) <0)
161 perror_exit("sendto failed");
162 // if "block size < 512", send ACK and exit.
163 if ((pktopcode == TFTPD_OP_ACK) && done) break;
164
165 POLL_INPUT:
166 pollfds[0].events = POLLIN;
167 pollfds[0].fd = TT.sfd;
168 poll_ret = poll(pollfds, 1, timeout);
169 if (poll_ret < 0 && (errno == EINTR || errno == ENOMEM)) goto POLL_INPUT;
170 if (!poll_ret) {
171 if (!--retry_count) {
172 error_msg("timeout");
173 break;
174 }
175 timeout += 150;
176 goto RETRY_SEND;
177 } else if (poll_ret == 1) {
178 len = read(pollfds[0].fd, rpkt, blksize + 4);
179 if (len < 0) {
180 send_errpkt(dstaddr, socklen, "read-error");
181 break;
182 }
183 if (len < 4) goto POLL_INPUT;
184 } else {
185 perror_msg("poll");
186 break;
187 }
188 // Validate receive packet.
189 pktopcode = ntohs(((uint16_t*)rpkt)[0]);
190 rblockno = ntohs(((uint16_t*)rpkt)[1]);
191 if (pktopcode == TFTPD_OP_ERR) {
192 char *message = "DATA Check failure.";
193 char *arr[] = {"File not found", "Access violation",
194 "Disk full or allocation exceeded", "Illegal TFTP operation",
195 "Unknown transfer ID", "File already exists",
196 "No such user", "Terminate transfer due to option negotiation"};
197
198 if (rblockno && (rblockno < 9)) message = arr[rblockno - 1];
199 error_msg(message);
200 break; // Break the for loop.
201 }
202
203 // if download requested by client,
204 // server will send data pkt and will receive ACK pkt from client.
205 if ((opcode == TFTPD_OP_RRQ) && (pktopcode == TFTPD_OP_ACK)) {
206 if (rblockno == (uint16_t) (blockno - 1)) {
207 if (!done) continue; // Send next chunk of data.
208 break;
209 }
210 }
211
212 // server will receive DATA pkt and write the data.
213 if ((opcode == TFTPD_OP_WRQ) && (pktopcode == TFTPD_OP_DATA)) {
214 if (rblockno == blockno) {
215 int nw = writeall(fd, &rpkt[4], len-4);
216 if (nw != len-4) {
217 g_errpkt[3] = TFTPD_ER_FULL;
218 send_errpkt(dstaddr, socklen, "write error");
219 break;
220 }
221
222 if (nw != blksize) done = 1;
223 }
224 continue;
225 }
226 goto POLL_INPUT;
227 } // end of loop
228
229 CLEAN_APP:
230 if (CFG_TOYBOX_FREE) {
231 free(spkt);
232 free(rpkt);
233 close(fd);
234 }
235 }
236
tftpd_main(void)237 void tftpd_main(void)
238 {
239 int fd = 0, recvmsg_len, rbuflen, opcode, blksize = TFTPD_BLKSIZE, tsize = 0, set =1;
240 struct sockaddr_storage srcaddr, dstaddr;
241 socklen_t socklen = sizeof(struct sockaddr_storage);
242 char *buf = toybuf;
243
244 memset(&srcaddr, 0, sizeof(srcaddr));
245 if (getsockname(0, (struct sockaddr *)&srcaddr, &socklen)) help_exit(0);
246
247 if (TT.user) TT.pw = xgetpwnam(TT.user);
248 if (*toys.optargs) xchroot(*toys.optargs);
249
250 recvmsg_len = recvfrom(fd, toybuf, blksize, 0, (void *)&dstaddr, &socklen);
251
252 TT.sfd = xsocket(dstaddr.ss_family, SOCK_DGRAM, 0);
253 if (setsockopt(TT.sfd, SOL_SOCKET, SO_REUSEADDR, (const void *)&set,
254 sizeof(set)) < 0) perror_exit("setsockopt failed");
255 if (bind(TT.sfd, (void *)&srcaddr, socklen)) perror_exit("bind");
256 if (connect(TT.sfd, (void *)&dstaddr, socklen) < 0)
257 perror_exit("can't connect to remote host");
258 // Error condition.
259 if (recvmsg_len<4 || recvmsg_len>TFTPD_BLKSIZE || toybuf[recvmsg_len-1]) {
260 send_errpkt((struct sockaddr*)&dstaddr, socklen, "packet format error");
261 return;
262 }
263
264 // request is either upload or Download.
265 opcode = buf[1];
266 if (((opcode != TFTPD_OP_RRQ) && (opcode != TFTPD_OP_WRQ))
267 || ((opcode == TFTPD_OP_WRQ) && (toys.optflags & FLAG_r))) {
268 send_errpkt((struct sockaddr*)&dstaddr, socklen,
269 (opcode == TFTPD_OP_WRQ) ? "write error" : "packet format error");
270 return;
271 }
272
273 buf += 2;
274 if (*buf == '.' || strstr(buf, "/.")) {
275 send_errpkt((struct sockaddr*)&dstaddr, socklen, "dot in filename");
276 return;
277 }
278
279 buf += strlen(buf) + 1; //1 '\0'.
280 // As per RFC 1350, mode is case in-sensitive.
281 if (buf >= toybuf+recvmsg_len || strcasecmp(buf, "octet")) {
282 send_errpkt((struct sockaddr*)&dstaddr, socklen, "packet format error");
283 return;
284 }
285
286 //RFC2348. e.g. of size type: "ttype1\0ttype1_val\0...ttypeN\0ttypeN_val\0"
287 buf += strlen(buf) + 1;
288 rbuflen = toybuf + recvmsg_len - buf;
289 if (rbuflen) {
290 int jump = 0, bflag = 0;
291
292 for (; rbuflen; rbuflen -= jump, buf += jump) {
293 if (!bflag && !strcasecmp(buf, "blksize")) { //get blksize
294 errno = 0;
295 blksize = strtoul(buf, NULL, 10);
296 if (errno || blksize > 65564 || blksize < 8) blksize = TFTPD_BLKSIZE;
297 bflag ^= 1;
298 } else if (!tsize && !strcasecmp(buf, "tsize")) tsize ^= 1;
299
300 jump += strlen(buf) + 1;
301 }
302 tsize &= (opcode == TFTPD_OP_RRQ);
303 }
304
305 //do send / receive file.
306 do_action((struct sockaddr*)&srcaddr, (struct sockaddr*)&dstaddr,
307 socklen, toybuf + 2, opcode, tsize, blksize);
308 if (CFG_TOYBOX_FREE) close(STDIN_FILENO);
309 }
310