1 /*
2 * Copyright (c) 1988, 1992 The University of Utah and the Center
3 * for Software Science (CSS).
4 * Copyright (c) 1992, 1993
5 * The Regents of the University of California. All rights reserved.
6 *
7 * This code is derived from software contributed to Berkeley by
8 * the Center for Software Science of the University of Utah Computer
9 * Science Department. CSS requests users of this software to return
10 * to css-dist@cs.utah.edu any improvements that they make and grant
11 * CSS redistribution rights.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 * 3. All advertising materials mentioning features or use of this software
22 * must display the following acknowledgement:
23 * This product includes software developed by the University of
24 * California, Berkeley and its contributors.
25 * 4. Neither the name of the University nor the names of its contributors
26 * may be used to endorse or promote products derived from this software
27 * without specific prior written permission.
28 *
29 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
30 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
31 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
32 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
33 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
34 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
35 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
36 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
37 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
38 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 * SUCH DAMAGE.
40 *
41 * from: @(#)rmpproto.c 8.1 (Berkeley) 6/4/93
42 *
43 * From: Utah Hdr: rmpproto.c 3.1 92/07/06
44 * Author: Jeff Forys, University of Utah CSS
45 */
46
47 #ifndef lint
48 #if 0
49 static const char sccsid[] = "@(#)rmpproto.c 8.1 (Berkeley) 6/4/93";
50 #endif
51 static const char rcsid[] =
52 "$FreeBSD: stable/9/libexec/rbootd/rmpproto.c 129652 2004-05-24 11:59:17Z stefanf $";
53 #endif /* not lint */
54
55 #include <sys/param.h>
56 #include <sys/time.h>
57 #include <netinet/in.h>
58
59 #include <errno.h>
60 #include <fcntl.h>
61 #include <stdio.h>
62 #include <string.h>
63 #include <syslog.h>
64 #include <unistd.h>
65 #include "defs.h"
66
67 /*
68 ** ProcessPacket -- determine packet type and do what's required.
69 **
70 ** An RMP BOOT packet has been received. Look at the type field
71 ** and process Boot Requests, Read Requests, and Boot Complete
72 ** packets. Any other type will be dropped with a warning msg.
73 **
74 ** Parameters:
75 ** rconn - the new connection
76 ** client - list of files available to this host
77 **
78 ** Returns:
79 ** Nothing.
80 **
81 ** Side Effects:
82 ** - If this is a valid boot request, it will be added to
83 ** the linked list of outstanding requests (RmpConns).
84 ** - If this is a valid boot complete, its associated
85 ** entry in RmpConns will be deleted.
86 ** - Also, unless we run out of memory, a reply will be
87 ** sent to the host that sent the packet.
88 */
89 void
ProcessPacket(RMPCONN * rconn,CLIENT * client)90 ProcessPacket(RMPCONN *rconn, CLIENT *client)
91 {
92 struct rmp_packet *rmp;
93 RMPCONN *rconnout;
94
95 rmp = &rconn->rmp; /* cache pointer to RMP packet */
96
97 switch(rmp->r_type) { /* do what we came here to do */
98 case RMP_BOOT_REQ: /* boot request */
99 if ((rconnout = NewConn(rconn)) == NULL)
100 return;
101
102 /*
103 * If the Session ID is 0xffff, this is a "probe"
104 * packet and we do not want to add the connection
105 * to the linked list of active connections. There
106 * are two types of probe packets, if the Sequence
107 * Number is 0 they want to know our host name, o/w
108 * they want the name of the file associated with
109 * the number spec'd by the Sequence Number.
110 *
111 * If this is an actual boot request, open the file
112 * and send a reply. If SendBootRepl() does not
113 * return 0, add the connection to the linked list
114 * of active connections, otherwise delete it since
115 * an error was encountered.
116 */
117 if (ntohs(rmp->r_brq.rmp_session) == RMP_PROBESID) {
118 if (WORDZE(rmp->r_brq.rmp_seqno))
119 (void) SendServerID(rconnout);
120 else
121 (void) SendFileNo(rmp, rconnout,
122 client? client->files:
123 BootFiles);
124 FreeConn(rconnout);
125 } else {
126 if (SendBootRepl(rmp, rconnout,
127 client? client->files: BootFiles))
128 AddConn(rconnout);
129 else
130 FreeConn(rconnout);
131 }
132 break;
133
134 case RMP_BOOT_REPL: /* boot reply (not valid) */
135 syslog(LOG_WARNING, "%s: sent a boot reply",
136 EnetStr(rconn));
137 break;
138
139 case RMP_READ_REQ: /* read request */
140 /*
141 * Send a portion of the boot file.
142 */
143 (void) SendReadRepl(rconn);
144 break;
145
146 case RMP_READ_REPL: /* read reply (not valid) */
147 syslog(LOG_WARNING, "%s: sent a read reply",
148 EnetStr(rconn));
149 break;
150
151 case RMP_BOOT_DONE: /* boot complete */
152 /*
153 * Remove the entry from the linked list of active
154 * connections.
155 */
156 (void) BootDone(rconn);
157 break;
158
159 default: /* unknown RMP packet type */
160 syslog(LOG_WARNING, "%s: unknown packet type (%u)",
161 EnetStr(rconn), rmp->r_type);
162 }
163 }
164
165 /*
166 ** SendServerID -- send our host name to who ever requested it.
167 **
168 ** Parameters:
169 ** rconn - the reply packet to be formatted.
170 **
171 ** Returns:
172 ** 1 on success, 0 on failure.
173 **
174 ** Side Effects:
175 ** none.
176 */
177 int
SendServerID(RMPCONN * rconn)178 SendServerID(RMPCONN *rconn)
179 {
180 struct rmp_packet *rpl;
181 char *src, *dst;
182 u_int8_t *size;
183
184 rpl = &rconn->rmp; /* cache ptr to RMP packet */
185
186 /*
187 * Set up assorted fields in reply packet.
188 */
189 rpl->r_brpl.rmp_type = RMP_BOOT_REPL;
190 rpl->r_brpl.rmp_retcode = RMP_E_OKAY;
191 ZEROWORD(rpl->r_brpl.rmp_seqno);
192 rpl->r_brpl.rmp_session = 0;
193 rpl->r_brpl.rmp_version = htons(RMP_VERSION);
194
195 size = &rpl->r_brpl.rmp_flnmsize; /* ptr to length of host name */
196
197 /*
198 * Copy our host name into the reply packet incrementing the
199 * length as we go. Stop at RMP_HOSTLEN or the first dot.
200 */
201 src = MyHost;
202 dst = (char *) &rpl->r_brpl.rmp_flnm;
203 for (*size = 0; *size < RMP_HOSTLEN; (*size)++) {
204 if (*src == '.' || *src == '\0')
205 break;
206 *dst++ = *src++;
207 }
208
209 rconn->rmplen = RMPBOOTSIZE(*size); /* set packet length */
210
211 return(SendPacket(rconn)); /* send packet */
212 }
213
214 /*
215 ** SendFileNo -- send the name of a bootable file to the requester.
216 **
217 ** Parameters:
218 ** req - RMP BOOT packet containing the request.
219 ** rconn - the reply packet to be formatted.
220 ** filelist - list of files available to the requester.
221 **
222 ** Returns:
223 ** 1 on success, 0 on failure.
224 **
225 ** Side Effects:
226 ** none.
227 */
228 int
SendFileNo(struct rmp_packet * req,RMPCONN * rconn,char * filelist[])229 SendFileNo(struct rmp_packet *req, RMPCONN *rconn, char *filelist[])
230 {
231 struct rmp_packet *rpl;
232 char *src, *dst;
233 u_int8_t *size;
234 int i;
235
236 GETWORD(req->r_brpl.rmp_seqno, i); /* SeqNo is really FileNo */
237 rpl = &rconn->rmp; /* cache ptr to RMP packet */
238
239 /*
240 * Set up assorted fields in reply packet.
241 */
242 rpl->r_brpl.rmp_type = RMP_BOOT_REPL;
243 PUTWORD(i, rpl->r_brpl.rmp_seqno);
244 i--;
245 rpl->r_brpl.rmp_session = 0;
246 rpl->r_brpl.rmp_version = htons(RMP_VERSION);
247
248 size = &rpl->r_brpl.rmp_flnmsize; /* ptr to length of filename */
249 *size = 0; /* init length to zero */
250
251 /*
252 * Copy the file name into the reply packet incrementing the
253 * length as we go. Stop at end of string or when RMPBOOTDATA
254 * characters have been copied. Also, set return code to
255 * indicate success or "no more files".
256 */
257 if (i < C_MAXFILE && filelist[i] != NULL) {
258 src = filelist[i];
259 dst = (char *)&rpl->r_brpl.rmp_flnm;
260 for (; *src && *size < RMPBOOTDATA; (*size)++) {
261 if (*src == '\0')
262 break;
263 *dst++ = *src++;
264 }
265 rpl->r_brpl.rmp_retcode = RMP_E_OKAY;
266 } else
267 rpl->r_brpl.rmp_retcode = RMP_E_NODFLT;
268
269 rconn->rmplen = RMPBOOTSIZE(*size); /* set packet length */
270
271 return(SendPacket(rconn)); /* send packet */
272 }
273
274 /*
275 ** SendBootRepl -- open boot file and respond to boot request.
276 **
277 ** Parameters:
278 ** req - RMP BOOT packet containing the request.
279 ** rconn - the reply packet to be formatted.
280 ** filelist - list of files available to the requester.
281 **
282 ** Returns:
283 ** 1 on success, 0 on failure.
284 **
285 ** Side Effects:
286 ** none.
287 */
288 int
SendBootRepl(struct rmp_packet * req,RMPCONN * rconn,char * filelist[])289 SendBootRepl(struct rmp_packet *req, RMPCONN *rconn, char *filelist[])
290 {
291 int retval;
292 char *filename, filepath[RMPBOOTDATA+1];
293 RMPCONN *oldconn;
294 struct rmp_packet *rpl;
295 char *src, *dst1, *dst2;
296 u_int8_t i;
297
298 /*
299 * If another connection already exists, delete it since we
300 * are obviously starting again.
301 */
302 if ((oldconn = FindConn(rconn)) != NULL) {
303 syslog(LOG_WARNING, "%s: dropping existing connection",
304 EnetStr(oldconn));
305 RemoveConn(oldconn);
306 }
307
308 rpl = &rconn->rmp; /* cache ptr to RMP packet */
309
310 /*
311 * Set up assorted fields in reply packet.
312 */
313 rpl->r_brpl.rmp_type = RMP_BOOT_REPL;
314 COPYWORD(req->r_brq.rmp_seqno, rpl->r_brpl.rmp_seqno);
315 rpl->r_brpl.rmp_session = htons(GenSessID());
316 rpl->r_brpl.rmp_version = htons(RMP_VERSION);
317 rpl->r_brpl.rmp_flnmsize = req->r_brq.rmp_flnmsize;
318
319 /*
320 * Copy file name to `filepath' string, and into reply packet.
321 */
322 src = &req->r_brq.rmp_flnm;
323 dst1 = filepath;
324 dst2 = &rpl->r_brpl.rmp_flnm;
325 for (i = 0; i < req->r_brq.rmp_flnmsize; i++)
326 *dst1++ = *dst2++ = *src++;
327 *dst1 = '\0';
328
329 /*
330 * If we are booting HP-UX machines, their secondary loader will
331 * ask for files like "/hp-ux". As a security measure, we do not
332 * allow boot files to lay outside the boot directory (unless they
333 * are purposely link'd out. So, make `filename' become the path-
334 * stripped file name and spoof the client into thinking that it
335 * really got what it wanted.
336 */
337 filename = (filename = strrchr(filepath,'/'))? ++filename: filepath;
338
339 /*
340 * Check that this is a valid boot file name.
341 */
342 for (i = 0; i < C_MAXFILE && filelist[i] != NULL; i++)
343 if (STREQN(filename, filelist[i]))
344 goto match;
345
346 /*
347 * Invalid boot file name, set error and send reply packet.
348 */
349 rpl->r_brpl.rmp_retcode = RMP_E_NOFILE;
350 retval = 0;
351 goto sendpkt;
352
353 match:
354 /*
355 * This is a valid boot file. Open the file and save the file
356 * descriptor associated with this connection and set success
357 * indication. If the file couldnt be opened, set error:
358 * "no such file or dir" - RMP_E_NOFILE
359 * "file table overflow" - RMP_E_BUSY
360 * "too many open files" - RMP_E_BUSY
361 * anything else - RMP_E_OPENFILE
362 */
363 if ((rconn->bootfd = open(filename, O_RDONLY, 0600)) < 0) {
364 rpl->r_brpl.rmp_retcode = (errno == ENOENT)? RMP_E_NOFILE:
365 (errno == EMFILE || errno == ENFILE)? RMP_E_BUSY:
366 RMP_E_OPENFILE;
367 retval = 0;
368 } else {
369 rpl->r_brpl.rmp_retcode = RMP_E_OKAY;
370 retval = 1;
371 }
372
373 sendpkt:
374 syslog(LOG_INFO, "%s: request to boot %s (%s)",
375 EnetStr(rconn), filename, retval? "granted": "denied");
376
377 rconn->rmplen = RMPBOOTSIZE(rpl->r_brpl.rmp_flnmsize);
378
379 return (retval & SendPacket(rconn));
380 }
381
382 /*
383 ** SendReadRepl -- send a portion of the boot file to the requester.
384 **
385 ** Parameters:
386 ** rconn - the reply packet to be formatted.
387 **
388 ** Returns:
389 ** 1 on success, 0 on failure.
390 **
391 ** Side Effects:
392 ** none.
393 */
394 int
SendReadRepl(RMPCONN * rconn)395 SendReadRepl(RMPCONN *rconn)
396 {
397 int retval = 0;
398 RMPCONN *oldconn;
399 struct rmp_packet *rpl, *req;
400 int size = 0;
401 int madeconn = 0;
402
403 /*
404 * Find the old connection. If one doesnt exist, create one only
405 * to return the error code.
406 */
407 if ((oldconn = FindConn(rconn)) == NULL) {
408 if ((oldconn = NewConn(rconn)) == NULL)
409 return(0);
410 syslog(LOG_ERR, "SendReadRepl: no active connection (%s)",
411 EnetStr(rconn));
412 madeconn++;
413 }
414
415 req = &rconn->rmp; /* cache ptr to request packet */
416 rpl = &oldconn->rmp; /* cache ptr to reply packet */
417
418 if (madeconn) { /* no active connection above; abort */
419 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT;
420 retval = 1;
421 goto sendpkt;
422 }
423
424 /*
425 * Make sure Session ID's match.
426 */
427 if (ntohs(req->r_rrq.rmp_session) !=
428 ((rpl->r_type == RMP_BOOT_REPL)? ntohs(rpl->r_brpl.rmp_session):
429 ntohs(rpl->r_rrpl.rmp_session))) {
430 syslog(LOG_ERR, "SendReadRepl: bad session id (%s)",
431 EnetStr(rconn));
432 rpl->r_rrpl.rmp_retcode = RMP_E_BADSID;
433 retval = 1;
434 goto sendpkt;
435 }
436
437 /*
438 * If the requester asks for more data than we can fit,
439 * silently clamp the request size down to RMPREADDATA.
440 *
441 * N.B. I do not know if this is "legal", however it seems
442 * to work. This is necessary for bpfwrite() on machines
443 * with MCLBYTES less than 1514.
444 */
445 if (ntohs(req->r_rrq.rmp_size) > RMPREADDATA)
446 req->r_rrq.rmp_size = htons(RMPREADDATA);
447
448 /*
449 * Position read head on file according to info in request packet.
450 */
451 GETWORD(req->r_rrq.rmp_offset, size);
452 if (lseek(oldconn->bootfd, (off_t)size, SEEK_SET) < 0) {
453 syslog(LOG_ERR, "SendReadRepl: lseek: %m (%s)",
454 EnetStr(rconn));
455 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT;
456 retval = 1;
457 goto sendpkt;
458 }
459
460 /*
461 * Read data directly into reply packet.
462 */
463 if ((size = read(oldconn->bootfd, &rpl->r_rrpl.rmp_data,
464 (int) ntohs(req->r_rrq.rmp_size))) <= 0) {
465 if (size < 0) {
466 syslog(LOG_ERR, "SendReadRepl: read: %m (%s)",
467 EnetStr(rconn));
468 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT;
469 } else {
470 rpl->r_rrpl.rmp_retcode = RMP_E_EOF;
471 }
472 retval = 1;
473 goto sendpkt;
474 }
475
476 /*
477 * Set success indication.
478 */
479 rpl->r_rrpl.rmp_retcode = RMP_E_OKAY;
480
481 sendpkt:
482 /*
483 * Set up assorted fields in reply packet.
484 */
485 rpl->r_rrpl.rmp_type = RMP_READ_REPL;
486 COPYWORD(req->r_rrq.rmp_offset, rpl->r_rrpl.rmp_offset);
487 rpl->r_rrpl.rmp_session = req->r_rrq.rmp_session;
488
489 oldconn->rmplen = RMPREADSIZE(size); /* set size of packet */
490
491 retval &= SendPacket(oldconn); /* send packet */
492
493 if (madeconn) /* clean up after ourself */
494 FreeConn(oldconn);
495
496 return (retval);
497 }
498
499 /*
500 ** BootDone -- free up memory allocated for a connection.
501 **
502 ** Parameters:
503 ** rconn - incoming boot complete packet.
504 **
505 ** Returns:
506 ** 1 on success, 0 on failure.
507 **
508 ** Side Effects:
509 ** none.
510 */
511 int
BootDone(RMPCONN * rconn)512 BootDone(RMPCONN *rconn)
513 {
514 RMPCONN *oldconn;
515 struct rmp_packet *rpl;
516
517 /*
518 * If we cant find the connection, ignore the request.
519 */
520 if ((oldconn = FindConn(rconn)) == NULL) {
521 syslog(LOG_ERR, "BootDone: no existing connection (%s)",
522 EnetStr(rconn));
523 return(0);
524 }
525
526 rpl = &oldconn->rmp; /* cache ptr to RMP packet */
527
528 /*
529 * Make sure Session ID's match.
530 */
531 if (ntohs(rconn->rmp.r_rrq.rmp_session) !=
532 ((rpl->r_type == RMP_BOOT_REPL)? ntohs(rpl->r_brpl.rmp_session):
533 ntohs(rpl->r_rrpl.rmp_session))) {
534 syslog(LOG_ERR, "BootDone: bad session id (%s)",
535 EnetStr(rconn));
536 return(0);
537 }
538
539 RemoveConn(oldconn); /* remove connection */
540
541 syslog(LOG_INFO, "%s: boot complete", EnetStr(rconn));
542
543 return(1);
544 }
545
546 /*
547 ** SendPacket -- send an RMP packet to a remote host.
548 **
549 ** Parameters:
550 ** rconn - packet to be sent.
551 **
552 ** Returns:
553 ** 1 on success, 0 on failure.
554 **
555 ** Side Effects:
556 ** none.
557 */
558 int
SendPacket(RMPCONN * rconn)559 SendPacket(RMPCONN *rconn)
560 {
561 /*
562 * Set Ethernet Destination address to Source (BPF and the enet
563 * driver will take care of getting our source address set).
564 */
565 memmove((char *)&rconn->rmp.hp_hdr.daddr[0],
566 (char *)&rconn->rmp.hp_hdr.saddr[0], RMP_ADDRLEN);
567 rconn->rmp.hp_hdr.len = htons(rconn->rmplen - sizeof(struct hp_hdr));
568
569 /*
570 * Reverse 802.2/HP Extended Source & Destination Access Pts.
571 */
572 rconn->rmp.hp_llc.dxsap = htons(HPEXT_SXSAP);
573 rconn->rmp.hp_llc.sxsap = htons(HPEXT_DXSAP);
574
575 /*
576 * Last time this connection was active.
577 */
578 (void) gettimeofday(&rconn->tstamp, (struct timezone *)0);
579
580 if (DbgFp != NULL) /* display packet */
581 DispPkt(rconn,DIR_SENT);
582
583 /*
584 * Send RMP packet to remote host.
585 */
586 return(BpfWrite(rconn));
587 }
588