1 /* 2 * Copyright (c) 1988, 1992 The University of Utah and the Center 3 * for Software Science (CSS). 4 * Copyright (c) 1992, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * This code is derived from software contributed to Berkeley by 8 * the Center for Software Science of the University of Utah Computer 9 * Science Department. CSS requests users of this software to return 10 * to css-dist@cs.utah.edu any improvements that they make and grant 11 * CSS redistribution rights. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. All advertising materials mentioning features or use of this software 22 * must display the following acknowledgement: 23 * This product includes software developed by the University of 24 * California, Berkeley and its contributors. 25 * 4. Neither the name of the University nor the names of its contributors 26 * may be used to endorse or promote products derived from this software 27 * without specific prior written permission. 28 * 29 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 30 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 31 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 32 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 33 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 34 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 35 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 36 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 37 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 38 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 39 * SUCH DAMAGE. 40 * 41 * from: @(#)rmpproto.c 8.1 (Berkeley) 6/4/93 42 * 43 * From: Utah Hdr: rmpproto.c 3.1 92/07/06 44 * Author: Jeff Forys, University of Utah CSS 45 * 46 * @(#)rmpproto.c 8.1 (Berkeley) 6/4/93 47 * $FreeBSD: src/libexec/rbootd/rmpproto.c,v 1.6.2.1 2001/02/18 02:54:11 kris Exp $ 48 * $DragonFly: src/libexec/rbootd/rmpproto.c,v 1.2 2003/06/17 04:27:07 dillon Exp $ 49 */ 50 51 #include <sys/param.h> 52 #include <sys/time.h> 53 54 #include <errno.h> 55 #include <fcntl.h> 56 #include <stdio.h> 57 #include <string.h> 58 #include <syslog.h> 59 #include <unistd.h> 60 #include "defs.h" 61 62 /* 63 ** ProcessPacket -- determine packet type and do what's required. 64 ** 65 ** An RMP BOOT packet has been received. Look at the type field 66 ** and process Boot Requests, Read Requests, and Boot Complete 67 ** packets. Any other type will be dropped with a warning msg. 68 ** 69 ** Parameters: 70 ** rconn - the new connection 71 ** client - list of files available to this host 72 ** 73 ** Returns: 74 ** Nothing. 75 ** 76 ** Side Effects: 77 ** - If this is a valid boot request, it will be added to 78 ** the linked list of outstanding requests (RmpConns). 79 ** - If this is a valid boot complete, its associated 80 ** entry in RmpConns will be deleted. 81 ** - Also, unless we run out of memory, a reply will be 82 ** sent to the host that sent the packet. 83 */ 84 void 85 ProcessPacket(rconn, client) 86 RMPCONN *rconn; 87 CLIENT *client; 88 { 89 struct rmp_packet *rmp; 90 RMPCONN *rconnout; 91 92 rmp = &rconn->rmp; /* cache pointer to RMP packet */ 93 94 switch(rmp->r_type) { /* do what we came here to do */ 95 case RMP_BOOT_REQ: /* boot request */ 96 if ((rconnout = NewConn(rconn)) == NULL) 97 return; 98 99 /* 100 * If the Session ID is 0xffff, this is a "probe" 101 * packet and we do not want to add the connection 102 * to the linked list of active connections. There 103 * are two types of probe packets, if the Sequence 104 * Number is 0 they want to know our host name, o/w 105 * they want the name of the file associated with 106 * the number spec'd by the Sequence Number. 107 * 108 * If this is an actual boot request, open the file 109 * and send a reply. If SendBootRepl() does not 110 * return 0, add the connection to the linked list 111 * of active connections, otherwise delete it since 112 * an error was encountered. 113 */ 114 if (ntohs(rmp->r_brq.rmp_session) == RMP_PROBESID) { 115 if (WORDZE(rmp->r_brq.rmp_seqno)) 116 (void) SendServerID(rconnout); 117 else 118 (void) SendFileNo(rmp, rconnout, 119 client? client->files: 120 BootFiles); 121 FreeConn(rconnout); 122 } else { 123 if (SendBootRepl(rmp, rconnout, 124 client? client->files: BootFiles)) 125 AddConn(rconnout); 126 else 127 FreeConn(rconnout); 128 } 129 break; 130 131 case RMP_BOOT_REPL: /* boot reply (not valid) */ 132 syslog(LOG_WARNING, "%s: sent a boot reply", 133 EnetStr(rconn)); 134 break; 135 136 case RMP_READ_REQ: /* read request */ 137 /* 138 * Send a portion of the boot file. 139 */ 140 (void) SendReadRepl(rconn); 141 break; 142 143 case RMP_READ_REPL: /* read reply (not valid) */ 144 syslog(LOG_WARNING, "%s: sent a read reply", 145 EnetStr(rconn)); 146 break; 147 148 case RMP_BOOT_DONE: /* boot complete */ 149 /* 150 * Remove the entry from the linked list of active 151 * connections. 152 */ 153 (void) BootDone(rconn); 154 break; 155 156 default: /* unknown RMP packet type */ 157 syslog(LOG_WARNING, "%s: unknown packet type (%u)", 158 EnetStr(rconn), rmp->r_type); 159 } 160 } 161 162 /* 163 ** SendServerID -- send our host name to who ever requested it. 164 ** 165 ** Parameters: 166 ** rconn - the reply packet to be formatted. 167 ** 168 ** Returns: 169 ** 1 on success, 0 on failure. 170 ** 171 ** Side Effects: 172 ** none. 173 */ 174 int 175 SendServerID(rconn) 176 RMPCONN *rconn; 177 { 178 struct rmp_packet *rpl; 179 char *src, *dst; 180 u_int8_t *size; 181 182 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 183 184 /* 185 * Set up assorted fields in reply packet. 186 */ 187 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 188 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 189 ZEROWORD(rpl->r_brpl.rmp_seqno); 190 rpl->r_brpl.rmp_session = 0; 191 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 192 193 size = &rpl->r_brpl.rmp_flnmsize; /* ptr to length of host name */ 194 195 /* 196 * Copy our host name into the reply packet incrementing the 197 * length as we go. Stop at RMP_HOSTLEN or the first dot. 198 */ 199 src = MyHost; 200 dst = (char *) &rpl->r_brpl.rmp_flnm; 201 for (*size = 0; *size < RMP_HOSTLEN; (*size)++) { 202 if (*src == '.' || *src == '\0') 203 break; 204 *dst++ = *src++; 205 } 206 207 rconn->rmplen = RMPBOOTSIZE(*size); /* set packet length */ 208 209 return(SendPacket(rconn)); /* send packet */ 210 } 211 212 /* 213 ** SendFileNo -- send the name of a bootable file to the requester. 214 ** 215 ** Parameters: 216 ** req - RMP BOOT packet containing the request. 217 ** rconn - the reply packet to be formatted. 218 ** filelist - list of files available to the requester. 219 ** 220 ** Returns: 221 ** 1 on success, 0 on failure. 222 ** 223 ** Side Effects: 224 ** none. 225 */ 226 int 227 SendFileNo(req, rconn, filelist) 228 struct rmp_packet *req; 229 RMPCONN *rconn; 230 char *filelist[]; 231 { 232 struct rmp_packet *rpl; 233 char *src, *dst; 234 u_int8_t *size; 235 int i; 236 237 GETWORD(req->r_brpl.rmp_seqno, i); /* SeqNo is really FileNo */ 238 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 239 240 /* 241 * Set up assorted fields in reply packet. 242 */ 243 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 244 PUTWORD(i, rpl->r_brpl.rmp_seqno); 245 i--; 246 rpl->r_brpl.rmp_session = 0; 247 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 248 249 size = &rpl->r_brpl.rmp_flnmsize; /* ptr to length of filename */ 250 *size = 0; /* init length to zero */ 251 252 /* 253 * Copy the file name into the reply packet incrementing the 254 * length as we go. Stop at end of string or when RMPBOOTDATA 255 * characters have been copied. Also, set return code to 256 * indicate success or "no more files". 257 */ 258 if (i < C_MAXFILE && filelist[i] != NULL) { 259 src = filelist[i]; 260 dst = (char *)&rpl->r_brpl.rmp_flnm; 261 for (; *src && *size < RMPBOOTDATA; (*size)++) { 262 if (*src == '\0') 263 break; 264 *dst++ = *src++; 265 } 266 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 267 } else 268 rpl->r_brpl.rmp_retcode = RMP_E_NODFLT; 269 270 rconn->rmplen = RMPBOOTSIZE(*size); /* set packet length */ 271 272 return(SendPacket(rconn)); /* send packet */ 273 } 274 275 /* 276 ** SendBootRepl -- open boot file and respond to boot request. 277 ** 278 ** Parameters: 279 ** req - RMP BOOT packet containing the request. 280 ** rconn - the reply packet to be formatted. 281 ** filelist - list of files available to the requester. 282 ** 283 ** Returns: 284 ** 1 on success, 0 on failure. 285 ** 286 ** Side Effects: 287 ** none. 288 */ 289 int 290 SendBootRepl(req, rconn, filelist) 291 struct rmp_packet *req; 292 RMPCONN *rconn; 293 char *filelist[]; 294 { 295 int retval; 296 char *filename, filepath[RMPBOOTDATA+1]; 297 RMPCONN *oldconn; 298 struct rmp_packet *rpl; 299 char *src, *dst1, *dst2; 300 u_int8_t i; 301 302 /* 303 * If another connection already exists, delete it since we 304 * are obviously starting again. 305 */ 306 if ((oldconn = FindConn(rconn)) != NULL) { 307 syslog(LOG_WARNING, "%s: dropping existing connection", 308 EnetStr(oldconn)); 309 RemoveConn(oldconn); 310 } 311 312 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 313 314 /* 315 * Set up assorted fields in reply packet. 316 */ 317 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 318 COPYWORD(req->r_brq.rmp_seqno, rpl->r_brpl.rmp_seqno); 319 rpl->r_brpl.rmp_session = htons(GenSessID()); 320 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 321 rpl->r_brpl.rmp_flnmsize = req->r_brq.rmp_flnmsize; 322 323 /* 324 * Copy file name to `filepath' string, and into reply packet. 325 */ 326 src = &req->r_brq.rmp_flnm; 327 dst1 = filepath; 328 dst2 = &rpl->r_brpl.rmp_flnm; 329 for (i = 0; i < req->r_brq.rmp_flnmsize; i++) 330 *dst1++ = *dst2++ = *src++; 331 *dst1 = '\0'; 332 333 /* 334 * If we are booting HP-UX machines, their secondary loader will 335 * ask for files like "/hp-ux". As a security measure, we do not 336 * allow boot files to lay outside the boot directory (unless they 337 * are purposely link'd out. So, make `filename' become the path- 338 * stripped file name and spoof the client into thinking that it 339 * really got what it wanted. 340 */ 341 filename = (filename = strrchr(filepath,'/'))? ++filename: filepath; 342 343 /* 344 * Check that this is a valid boot file name. 345 */ 346 for (i = 0; i < C_MAXFILE && filelist[i] != NULL; i++) 347 if (STREQN(filename, filelist[i])) 348 goto match; 349 350 /* 351 * Invalid boot file name, set error and send reply packet. 352 */ 353 rpl->r_brpl.rmp_retcode = RMP_E_NOFILE; 354 retval = 0; 355 goto sendpkt; 356 357 match: 358 /* 359 * This is a valid boot file. Open the file and save the file 360 * descriptor associated with this connection and set success 361 * indication. If the file couldnt be opened, set error: 362 * "no such file or dir" - RMP_E_NOFILE 363 * "file table overflow" - RMP_E_BUSY 364 * "too many open files" - RMP_E_BUSY 365 * anything else - RMP_E_OPENFILE 366 */ 367 if ((rconn->bootfd = open(filename, O_RDONLY, 0600)) < 0) { 368 rpl->r_brpl.rmp_retcode = (errno == ENOENT)? RMP_E_NOFILE: 369 (errno == EMFILE || errno == ENFILE)? RMP_E_BUSY: 370 RMP_E_OPENFILE; 371 retval = 0; 372 } else { 373 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 374 retval = 1; 375 } 376 377 sendpkt: 378 syslog(LOG_INFO, "%s: request to boot %s (%s)", 379 EnetStr(rconn), filename, retval? "granted": "denied"); 380 381 rconn->rmplen = RMPBOOTSIZE(rpl->r_brpl.rmp_flnmsize); 382 383 return (retval & SendPacket(rconn)); 384 } 385 386 /* 387 ** SendReadRepl -- send a portion of the boot file to the requester. 388 ** 389 ** Parameters: 390 ** rconn - the reply packet to be formatted. 391 ** 392 ** Returns: 393 ** 1 on success, 0 on failure. 394 ** 395 ** Side Effects: 396 ** none. 397 */ 398 int 399 SendReadRepl(rconn) 400 RMPCONN *rconn; 401 { 402 int retval = 0; 403 RMPCONN *oldconn; 404 struct rmp_packet *rpl, *req; 405 int size = 0; 406 int madeconn = 0; 407 408 /* 409 * Find the old connection. If one doesnt exist, create one only 410 * to return the error code. 411 */ 412 if ((oldconn = FindConn(rconn)) == NULL) { 413 if ((oldconn = NewConn(rconn)) == NULL) 414 return(0); 415 syslog(LOG_ERR, "SendReadRepl: no active connection (%s)", 416 EnetStr(rconn)); 417 madeconn++; 418 } 419 420 req = &rconn->rmp; /* cache ptr to request packet */ 421 rpl = &oldconn->rmp; /* cache ptr to reply packet */ 422 423 if (madeconn) { /* no active connection above; abort */ 424 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 425 retval = 1; 426 goto sendpkt; 427 } 428 429 /* 430 * Make sure Session ID's match. 431 */ 432 if (ntohs(req->r_rrq.rmp_session) != 433 ((rpl->r_type == RMP_BOOT_REPL)? ntohs(rpl->r_brpl.rmp_session): 434 ntohs(rpl->r_rrpl.rmp_session))) { 435 syslog(LOG_ERR, "SendReadRepl: bad session id (%s)", 436 EnetStr(rconn)); 437 rpl->r_rrpl.rmp_retcode = RMP_E_BADSID; 438 retval = 1; 439 goto sendpkt; 440 } 441 442 /* 443 * If the requester asks for more data than we can fit, 444 * silently clamp the request size down to RMPREADDATA. 445 * 446 * N.B. I do not know if this is "legal", however it seems 447 * to work. This is necessary for bpfwrite() on machines 448 * with MCLBYTES less than 1514. 449 */ 450 if (ntohs(req->r_rrq.rmp_size) > RMPREADDATA) 451 req->r_rrq.rmp_size = htons(RMPREADDATA); 452 453 /* 454 * Position read head on file according to info in request packet. 455 */ 456 GETWORD(req->r_rrq.rmp_offset, size); 457 if (lseek(oldconn->bootfd, (off_t)size, SEEK_SET) < 0) { 458 syslog(LOG_ERR, "SendReadRepl: lseek: %m (%s)", 459 EnetStr(rconn)); 460 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 461 retval = 1; 462 goto sendpkt; 463 } 464 465 /* 466 * Read data directly into reply packet. 467 */ 468 if ((size = read(oldconn->bootfd, &rpl->r_rrpl.rmp_data, 469 (int) ntohs(req->r_rrq.rmp_size))) <= 0) { 470 if (size < 0) { 471 syslog(LOG_ERR, "SendReadRepl: read: %m (%s)", 472 EnetStr(rconn)); 473 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 474 } else { 475 rpl->r_rrpl.rmp_retcode = RMP_E_EOF; 476 } 477 retval = 1; 478 goto sendpkt; 479 } 480 481 /* 482 * Set success indication. 483 */ 484 rpl->r_rrpl.rmp_retcode = RMP_E_OKAY; 485 486 sendpkt: 487 /* 488 * Set up assorted fields in reply packet. 489 */ 490 rpl->r_rrpl.rmp_type = RMP_READ_REPL; 491 COPYWORD(req->r_rrq.rmp_offset, rpl->r_rrpl.rmp_offset); 492 rpl->r_rrpl.rmp_session = req->r_rrq.rmp_session; 493 494 oldconn->rmplen = RMPREADSIZE(size); /* set size of packet */ 495 496 retval &= SendPacket(oldconn); /* send packet */ 497 498 if (madeconn) /* clean up after ourself */ 499 FreeConn(oldconn); 500 501 return (retval); 502 } 503 504 /* 505 ** BootDone -- free up memory allocated for a connection. 506 ** 507 ** Parameters: 508 ** rconn - incoming boot complete packet. 509 ** 510 ** Returns: 511 ** 1 on success, 0 on failure. 512 ** 513 ** Side Effects: 514 ** none. 515 */ 516 int 517 BootDone(rconn) 518 RMPCONN *rconn; 519 { 520 RMPCONN *oldconn; 521 struct rmp_packet *rpl; 522 523 /* 524 * If we cant find the connection, ignore the request. 525 */ 526 if ((oldconn = FindConn(rconn)) == NULL) { 527 syslog(LOG_ERR, "BootDone: no existing connection (%s)", 528 EnetStr(rconn)); 529 return(0); 530 } 531 532 rpl = &oldconn->rmp; /* cache ptr to RMP packet */ 533 534 /* 535 * Make sure Session ID's match. 536 */ 537 if (ntohs(rconn->rmp.r_rrq.rmp_session) != 538 ((rpl->r_type == RMP_BOOT_REPL)? ntohs(rpl->r_brpl.rmp_session): 539 ntohs(rpl->r_rrpl.rmp_session))) { 540 syslog(LOG_ERR, "BootDone: bad session id (%s)", 541 EnetStr(rconn)); 542 return(0); 543 } 544 545 RemoveConn(oldconn); /* remove connection */ 546 547 syslog(LOG_INFO, "%s: boot complete", EnetStr(rconn)); 548 549 return(1); 550 } 551 552 /* 553 ** SendPacket -- send an RMP packet to a remote host. 554 ** 555 ** Parameters: 556 ** rconn - packet to be sent. 557 ** 558 ** Returns: 559 ** 1 on success, 0 on failure. 560 ** 561 ** Side Effects: 562 ** none. 563 */ 564 int 565 SendPacket(rconn) 566 RMPCONN *rconn; 567 { 568 /* 569 * Set Ethernet Destination address to Source (BPF and the enet 570 * driver will take care of getting our source address set). 571 */ 572 memmove((char *)&rconn->rmp.hp_hdr.daddr[0], 573 (char *)&rconn->rmp.hp_hdr.saddr[0], RMP_ADDRLEN); 574 rconn->rmp.hp_hdr.len = htons(rconn->rmplen - sizeof(struct hp_hdr)); 575 576 /* 577 * Reverse 802.2/HP Extended Source & Destination Access Pts. 578 */ 579 rconn->rmp.hp_llc.dxsap = htons(HPEXT_SXSAP); 580 rconn->rmp.hp_llc.sxsap = htons(HPEXT_DXSAP); 581 582 /* 583 * Last time this connection was active. 584 */ 585 (void) gettimeofday(&rconn->tstamp, (struct timezone *)0); 586 587 if (DbgFp != NULL) /* display packet */ 588 DispPkt(rconn,DIR_SENT); 589 590 /* 591 * Send RMP packet to remote host. 592 */ 593 return(BpfWrite(rconn)); 594 } 595