1 /* 2 * Copyright (c) 1988, 1992 The University of Utah and the Center 3 * for Software Science (CSS). 4 * Copyright (c) 1992, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * This code is derived from software contributed to Berkeley by 8 * the Center for Software Science of the University of Utah Computer 9 * Science Department. CSS requests users of this software to return 10 * to css-dist@cs.utah.edu any improvements that they make and grant 11 * CSS redistribution rights. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. All advertising materials mentioning features or use of this software 22 * must display the following acknowledgement: 23 * This product includes software developed by the University of 24 * California, Berkeley and its contributors. 25 * 4. Neither the name of the University nor the names of its contributors 26 * may be used to endorse or promote products derived from this software 27 * without specific prior written permission. 28 * 29 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 30 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 31 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 32 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 33 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 34 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 35 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 36 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 37 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 38 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 39 * SUCH DAMAGE. 40 * 41 * from: @(#)rmpproto.c 8.1 (Berkeley) 6/4/93 42 * 43 * From: Utah Hdr: rmpproto.c 3.1 92/07/06 44 * Author: Jeff Forys, University of Utah CSS 45 * 46 * @(#)rmpproto.c 8.1 (Berkeley) 6/4/93 47 * $FreeBSD: src/libexec/rbootd/rmpproto.c,v 1.6.2.1 2001/02/18 02:54:11 kris Exp $ 48 */ 49 50 #include <sys/param.h> 51 #include <sys/time.h> 52 53 #include <errno.h> 54 #include <fcntl.h> 55 #include <stdio.h> 56 #include <string.h> 57 #include <syslog.h> 58 #include <unistd.h> 59 #include "defs.h" 60 61 /* 62 ** ProcessPacket -- determine packet type and do what's required. 63 ** 64 ** An RMP BOOT packet has been received. Look at the type field 65 ** and process Boot Requests, Read Requests, and Boot Complete 66 ** packets. Any other type will be dropped with a warning msg. 67 ** 68 ** Parameters: 69 ** rconn - the new connection 70 ** client - list of files available to this host 71 ** 72 ** Returns: 73 ** Nothing. 74 ** 75 ** Side Effects: 76 ** - If this is a valid boot request, it will be added to 77 ** the linked list of outstanding requests (RmpConns). 78 ** - If this is a valid boot complete, its associated 79 ** entry in RmpConns will be deleted. 80 ** - Also, unless we run out of memory, a reply will be 81 ** sent to the host that sent the packet. 82 */ 83 void 84 ProcessPacket(rconn, client) 85 RMPCONN *rconn; 86 CLIENT *client; 87 { 88 struct rmp_packet *rmp; 89 RMPCONN *rconnout; 90 91 rmp = &rconn->rmp; /* cache pointer to RMP packet */ 92 93 switch(rmp->r_type) { /* do what we came here to do */ 94 case RMP_BOOT_REQ: /* boot request */ 95 if ((rconnout = NewConn(rconn)) == NULL) 96 return; 97 98 /* 99 * If the Session ID is 0xffff, this is a "probe" 100 * packet and we do not want to add the connection 101 * to the linked list of active connections. There 102 * are two types of probe packets, if the Sequence 103 * Number is 0 they want to know our host name, o/w 104 * they want the name of the file associated with 105 * the number spec'd by the Sequence Number. 106 * 107 * If this is an actual boot request, open the file 108 * and send a reply. If SendBootRepl() does not 109 * return 0, add the connection to the linked list 110 * of active connections, otherwise delete it since 111 * an error was encountered. 112 */ 113 if (ntohs(rmp->r_brq.rmp_session) == RMP_PROBESID) { 114 if (WORDZE(rmp->r_brq.rmp_seqno)) 115 (void) SendServerID(rconnout); 116 else 117 (void) SendFileNo(rmp, rconnout, 118 client? client->files: 119 BootFiles); 120 FreeConn(rconnout); 121 } else { 122 if (SendBootRepl(rmp, rconnout, 123 client? client->files: BootFiles)) 124 AddConn(rconnout); 125 else 126 FreeConn(rconnout); 127 } 128 break; 129 130 case RMP_BOOT_REPL: /* boot reply (not valid) */ 131 syslog(LOG_WARNING, "%s: sent a boot reply", 132 EnetStr(rconn)); 133 break; 134 135 case RMP_READ_REQ: /* read request */ 136 /* 137 * Send a portion of the boot file. 138 */ 139 (void) SendReadRepl(rconn); 140 break; 141 142 case RMP_READ_REPL: /* read reply (not valid) */ 143 syslog(LOG_WARNING, "%s: sent a read reply", 144 EnetStr(rconn)); 145 break; 146 147 case RMP_BOOT_DONE: /* boot complete */ 148 /* 149 * Remove the entry from the linked list of active 150 * connections. 151 */ 152 (void) BootDone(rconn); 153 break; 154 155 default: /* unknown RMP packet type */ 156 syslog(LOG_WARNING, "%s: unknown packet type (%u)", 157 EnetStr(rconn), rmp->r_type); 158 } 159 } 160 161 /* 162 ** SendServerID -- send our host name to who ever requested it. 163 ** 164 ** Parameters: 165 ** rconn - the reply packet to be formatted. 166 ** 167 ** Returns: 168 ** 1 on success, 0 on failure. 169 ** 170 ** Side Effects: 171 ** none. 172 */ 173 int 174 SendServerID(rconn) 175 RMPCONN *rconn; 176 { 177 struct rmp_packet *rpl; 178 char *src, *dst; 179 u_int8_t *size; 180 181 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 182 183 /* 184 * Set up assorted fields in reply packet. 185 */ 186 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 187 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 188 ZEROWORD(rpl->r_brpl.rmp_seqno); 189 rpl->r_brpl.rmp_session = 0; 190 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 191 192 size = &rpl->r_brpl.rmp_flnmsize; /* ptr to length of host name */ 193 194 /* 195 * Copy our host name into the reply packet incrementing the 196 * length as we go. Stop at RMP_HOSTLEN or the first dot. 197 */ 198 src = MyHost; 199 dst = (char *) &rpl->r_brpl.rmp_flnm; 200 for (*size = 0; *size < RMP_HOSTLEN; (*size)++) { 201 if (*src == '.' || *src == '\0') 202 break; 203 *dst++ = *src++; 204 } 205 206 rconn->rmplen = RMPBOOTSIZE(*size); /* set packet length */ 207 208 return(SendPacket(rconn)); /* send packet */ 209 } 210 211 /* 212 ** SendFileNo -- send the name of a bootable file to the requester. 213 ** 214 ** Parameters: 215 ** req - RMP BOOT packet containing the request. 216 ** rconn - the reply packet to be formatted. 217 ** filelist - list of files available to the requester. 218 ** 219 ** Returns: 220 ** 1 on success, 0 on failure. 221 ** 222 ** Side Effects: 223 ** none. 224 */ 225 int 226 SendFileNo(req, rconn, filelist) 227 struct rmp_packet *req; 228 RMPCONN *rconn; 229 char *filelist[]; 230 { 231 struct rmp_packet *rpl; 232 char *src, *dst; 233 u_int8_t *size; 234 int i; 235 236 GETWORD(req->r_brpl.rmp_seqno, i); /* SeqNo is really FileNo */ 237 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 238 239 /* 240 * Set up assorted fields in reply packet. 241 */ 242 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 243 PUTWORD(i, rpl->r_brpl.rmp_seqno); 244 i--; 245 rpl->r_brpl.rmp_session = 0; 246 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 247 248 size = &rpl->r_brpl.rmp_flnmsize; /* ptr to length of filename */ 249 *size = 0; /* init length to zero */ 250 251 /* 252 * Copy the file name into the reply packet incrementing the 253 * length as we go. Stop at end of string or when RMPBOOTDATA 254 * characters have been copied. Also, set return code to 255 * indicate success or "no more files". 256 */ 257 if (i < C_MAXFILE && filelist[i] != NULL) { 258 src = filelist[i]; 259 dst = (char *)&rpl->r_brpl.rmp_flnm; 260 for (; *src && *size < RMPBOOTDATA; (*size)++) { 261 if (*src == '\0') 262 break; 263 *dst++ = *src++; 264 } 265 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 266 } else 267 rpl->r_brpl.rmp_retcode = RMP_E_NODFLT; 268 269 rconn->rmplen = RMPBOOTSIZE(*size); /* set packet length */ 270 271 return(SendPacket(rconn)); /* send packet */ 272 } 273 274 /* 275 ** SendBootRepl -- open boot file and respond to boot request. 276 ** 277 ** Parameters: 278 ** req - RMP BOOT packet containing the request. 279 ** rconn - the reply packet to be formatted. 280 ** filelist - list of files available to the requester. 281 ** 282 ** Returns: 283 ** 1 on success, 0 on failure. 284 ** 285 ** Side Effects: 286 ** none. 287 */ 288 int 289 SendBootRepl(req, rconn, filelist) 290 struct rmp_packet *req; 291 RMPCONN *rconn; 292 char *filelist[]; 293 { 294 int retval; 295 char *filename, filepath[RMPBOOTDATA+1]; 296 RMPCONN *oldconn; 297 struct rmp_packet *rpl; 298 char *src, *dst1, *dst2; 299 u_int8_t i; 300 301 /* 302 * If another connection already exists, delete it since we 303 * are obviously starting again. 304 */ 305 if ((oldconn = FindConn(rconn)) != NULL) { 306 syslog(LOG_WARNING, "%s: dropping existing connection", 307 EnetStr(oldconn)); 308 RemoveConn(oldconn); 309 } 310 311 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 312 313 /* 314 * Set up assorted fields in reply packet. 315 */ 316 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 317 COPYWORD(req->r_brq.rmp_seqno, rpl->r_brpl.rmp_seqno); 318 rpl->r_brpl.rmp_session = htons(GenSessID()); 319 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 320 rpl->r_brpl.rmp_flnmsize = req->r_brq.rmp_flnmsize; 321 322 /* 323 * Copy file name to `filepath' string, and into reply packet. 324 */ 325 src = &req->r_brq.rmp_flnm; 326 dst1 = filepath; 327 dst2 = &rpl->r_brpl.rmp_flnm; 328 for (i = 0; i < req->r_brq.rmp_flnmsize; i++) 329 *dst1++ = *dst2++ = *src++; 330 *dst1 = '\0'; 331 332 /* 333 * If we are booting HP-UX machines, their secondary loader will 334 * ask for files like "/hp-ux". As a security measure, we do not 335 * allow boot files to lay outside the boot directory (unless they 336 * are purposely link'd out. So, make `filename' become the path- 337 * stripped file name and spoof the client into thinking that it 338 * really got what it wanted. 339 */ 340 if ((filename = strrchr(filepath, '/')) != NULL) 341 filename++; 342 else 343 filename = filepath; 344 345 /* 346 * Check that this is a valid boot file name. 347 */ 348 for (i = 0; i < C_MAXFILE && filelist[i] != NULL; i++) 349 if (STREQN(filename, filelist[i])) 350 goto match; 351 352 /* 353 * Invalid boot file name, set error and send reply packet. 354 */ 355 rpl->r_brpl.rmp_retcode = RMP_E_NOFILE; 356 retval = 0; 357 goto sendpkt; 358 359 match: 360 /* 361 * This is a valid boot file. Open the file and save the file 362 * descriptor associated with this connection and set success 363 * indication. If the file couldnt be opened, set error: 364 * "no such file or dir" - RMP_E_NOFILE 365 * "file table overflow" - RMP_E_BUSY 366 * "too many open files" - RMP_E_BUSY 367 * anything else - RMP_E_OPENFILE 368 */ 369 if ((rconn->bootfd = open(filename, O_RDONLY, 0600)) < 0) { 370 rpl->r_brpl.rmp_retcode = (errno == ENOENT)? RMP_E_NOFILE: 371 (errno == EMFILE || errno == ENFILE)? RMP_E_BUSY: 372 RMP_E_OPENFILE; 373 retval = 0; 374 } else { 375 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 376 retval = 1; 377 } 378 379 sendpkt: 380 syslog(LOG_INFO, "%s: request to boot %s (%s)", 381 EnetStr(rconn), filename, retval? "granted": "denied"); 382 383 rconn->rmplen = RMPBOOTSIZE(rpl->r_brpl.rmp_flnmsize); 384 385 return (retval & SendPacket(rconn)); 386 } 387 388 /* 389 ** SendReadRepl -- send a portion of the boot file to the requester. 390 ** 391 ** Parameters: 392 ** rconn - the reply packet to be formatted. 393 ** 394 ** Returns: 395 ** 1 on success, 0 on failure. 396 ** 397 ** Side Effects: 398 ** none. 399 */ 400 int 401 SendReadRepl(rconn) 402 RMPCONN *rconn; 403 { 404 int retval = 0; 405 RMPCONN *oldconn; 406 struct rmp_packet *rpl, *req; 407 int size = 0; 408 int madeconn = 0; 409 410 /* 411 * Find the old connection. If one doesnt exist, create one only 412 * to return the error code. 413 */ 414 if ((oldconn = FindConn(rconn)) == NULL) { 415 if ((oldconn = NewConn(rconn)) == NULL) 416 return(0); 417 syslog(LOG_ERR, "SendReadRepl: no active connection (%s)", 418 EnetStr(rconn)); 419 madeconn++; 420 } 421 422 req = &rconn->rmp; /* cache ptr to request packet */ 423 rpl = &oldconn->rmp; /* cache ptr to reply packet */ 424 425 if (madeconn) { /* no active connection above; abort */ 426 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 427 retval = 1; 428 goto sendpkt; 429 } 430 431 /* 432 * Make sure Session ID's match. 433 */ 434 if (ntohs(req->r_rrq.rmp_session) != 435 ((rpl->r_type == RMP_BOOT_REPL)? ntohs(rpl->r_brpl.rmp_session): 436 ntohs(rpl->r_rrpl.rmp_session))) { 437 syslog(LOG_ERR, "SendReadRepl: bad session id (%s)", 438 EnetStr(rconn)); 439 rpl->r_rrpl.rmp_retcode = RMP_E_BADSID; 440 retval = 1; 441 goto sendpkt; 442 } 443 444 /* 445 * If the requester asks for more data than we can fit, 446 * silently clamp the request size down to RMPREADDATA. 447 * 448 * N.B. I do not know if this is "legal", however it seems 449 * to work. This is necessary for bpfwrite() on machines 450 * with MCLBYTES less than 1514. 451 */ 452 if (ntohs(req->r_rrq.rmp_size) > RMPREADDATA) 453 req->r_rrq.rmp_size = htons(RMPREADDATA); 454 455 /* 456 * Position read head on file according to info in request packet. 457 */ 458 GETWORD(req->r_rrq.rmp_offset, size); 459 if (lseek(oldconn->bootfd, (off_t)size, SEEK_SET) < 0) { 460 syslog(LOG_ERR, "SendReadRepl: lseek: %m (%s)", 461 EnetStr(rconn)); 462 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 463 retval = 1; 464 goto sendpkt; 465 } 466 467 /* 468 * Read data directly into reply packet. 469 */ 470 if ((size = read(oldconn->bootfd, &rpl->r_rrpl.rmp_data, 471 (int) ntohs(req->r_rrq.rmp_size))) <= 0) { 472 if (size < 0) { 473 syslog(LOG_ERR, "SendReadRepl: read: %m (%s)", 474 EnetStr(rconn)); 475 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 476 } else { 477 rpl->r_rrpl.rmp_retcode = RMP_E_EOF; 478 } 479 retval = 1; 480 goto sendpkt; 481 } 482 483 /* 484 * Set success indication. 485 */ 486 rpl->r_rrpl.rmp_retcode = RMP_E_OKAY; 487 488 sendpkt: 489 /* 490 * Set up assorted fields in reply packet. 491 */ 492 rpl->r_rrpl.rmp_type = RMP_READ_REPL; 493 COPYWORD(req->r_rrq.rmp_offset, rpl->r_rrpl.rmp_offset); 494 rpl->r_rrpl.rmp_session = req->r_rrq.rmp_session; 495 496 oldconn->rmplen = RMPREADSIZE(size); /* set size of packet */ 497 498 retval &= SendPacket(oldconn); /* send packet */ 499 500 if (madeconn) /* clean up after ourself */ 501 FreeConn(oldconn); 502 503 return (retval); 504 } 505 506 /* 507 ** BootDone -- free up memory allocated for a connection. 508 ** 509 ** Parameters: 510 ** rconn - incoming boot complete packet. 511 ** 512 ** Returns: 513 ** 1 on success, 0 on failure. 514 ** 515 ** Side Effects: 516 ** none. 517 */ 518 int 519 BootDone(rconn) 520 RMPCONN *rconn; 521 { 522 RMPCONN *oldconn; 523 struct rmp_packet *rpl; 524 525 /* 526 * If we cant find the connection, ignore the request. 527 */ 528 if ((oldconn = FindConn(rconn)) == NULL) { 529 syslog(LOG_ERR, "BootDone: no existing connection (%s)", 530 EnetStr(rconn)); 531 return(0); 532 } 533 534 rpl = &oldconn->rmp; /* cache ptr to RMP packet */ 535 536 /* 537 * Make sure Session ID's match. 538 */ 539 if (ntohs(rconn->rmp.r_rrq.rmp_session) != 540 ((rpl->r_type == RMP_BOOT_REPL)? ntohs(rpl->r_brpl.rmp_session): 541 ntohs(rpl->r_rrpl.rmp_session))) { 542 syslog(LOG_ERR, "BootDone: bad session id (%s)", 543 EnetStr(rconn)); 544 return(0); 545 } 546 547 RemoveConn(oldconn); /* remove connection */ 548 549 syslog(LOG_INFO, "%s: boot complete", EnetStr(rconn)); 550 551 return(1); 552 } 553 554 /* 555 ** SendPacket -- send an RMP packet to a remote host. 556 ** 557 ** Parameters: 558 ** rconn - packet to be sent. 559 ** 560 ** Returns: 561 ** 1 on success, 0 on failure. 562 ** 563 ** Side Effects: 564 ** none. 565 */ 566 int 567 SendPacket(rconn) 568 RMPCONN *rconn; 569 { 570 /* 571 * Set Ethernet Destination address to Source (BPF and the enet 572 * driver will take care of getting our source address set). 573 */ 574 memmove((char *)&rconn->rmp.hp_hdr.daddr[0], 575 (char *)&rconn->rmp.hp_hdr.saddr[0], RMP_ADDRLEN); 576 rconn->rmp.hp_hdr.len = htons(rconn->rmplen - sizeof(struct hp_hdr)); 577 578 /* 579 * Reverse 802.2/HP Extended Source & Destination Access Pts. 580 */ 581 rconn->rmp.hp_llc.dxsap = htons(HPEXT_SXSAP); 582 rconn->rmp.hp_llc.sxsap = htons(HPEXT_DXSAP); 583 584 /* 585 * Last time this connection was active. 586 */ 587 (void) gettimeofday(&rconn->tstamp, NULL); 588 589 if (DbgFp != NULL) /* display packet */ 590 DispPkt(rconn,DIR_SENT); 591 592 /* 593 * Send RMP packet to remote host. 594 */ 595 return(BpfWrite(rconn)); 596 } 597