2 * nmrpflash - Netgear Unbrick Utility
3 * Copyright (C) 2016 Joseph Lehner <joseph.c.lehner@gmail.com>
5 * nmrpflash is free software: you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation, either version 3 of the License, or
8 * (at your option) any later version.
10 * nmrpflash is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with nmrpflash. If not, see <http://www.gnu.org/licenses/>.
33 #define TFTP_PKT_SIZE 516
35 static const char *opcode_names[] = {
36 "RRQ", "WRQ", "DATA", "ACK", "ERR"
47 static bool is_netascii(const char *str)
49 uint8_t *p = (uint8_t*)str;
52 if (*p < 0x20 || *p > 0x7f) {
60 static inline void pkt_mknum(char *pkt, uint16_t n)
62 *(uint16_t*)pkt = htons(n);
65 static inline uint16_t pkt_num(char *pkt)
67 return ntohs(*(uint16_t*)pkt);
70 static void pkt_mkwrq(char *pkt, const char *filename)
74 filename = leafname(filename);
75 if (!tftp_is_valid_filename(filename)) {
76 fprintf(stderr, "Overlong/illegal filename; using 'firmware'.\n");
77 filename = "firmware";
78 } else if (!strcmp(filename, "-")) {
79 filename = "firmware";
84 strcpy(pkt + len, filename);
85 len += strlen(filename) + 1;
86 strcpy(pkt + len, "octet");
89 static inline void pkt_print(char *pkt, FILE *fp)
91 uint16_t opcode = pkt_num(pkt);
92 if (!opcode || opcode > ERR) {
93 fprintf(fp, "(%d)", opcode);
95 fprintf(fp, "%s", opcode_names[opcode - 1]);
96 if (opcode == ACK || opcode == DATA) {
97 fprintf(fp, "(%d)", pkt_num(pkt + 2));
98 } else if (opcode == WRQ || opcode == RRQ) {
99 fprintf(fp, "(%s, %s)", pkt + 2, pkt + 2 + strlen(pkt + 2) + 1);
104 static ssize_t tftp_recvfrom(int sock, char *pkt, uint16_t* port,
108 struct sockaddr_in src;
109 #ifndef NMRPFLASH_WINDOWS
115 len = select_fd(sock, timeout);
123 len = recvfrom(sock, pkt, TFTP_PKT_SIZE, 0, (struct sockaddr*)&src, &alen);
125 sock_perror("recvfrom");
129 *port = ntohs(src.sin_port);
131 uint16_t opcode = pkt_num(pkt);
134 fprintf(stderr, "Error (%d): %.511s\n", pkt_num(pkt + 2), pkt + 4);
136 } else if (isprint(pkt[0])) {
137 /* In case of a firmware checksum error, the EX2700 I've tested this
138 * on sends a raw UDP packet containing just an error message starting
139 * at offset 0. The limit of 32 chars is arbitrary.
141 fprintf(stderr, "Error: %.32s\n", pkt);
143 } else if (!opcode || opcode > ERR) {
144 fprintf(stderr, "Received invalid packet: ");
145 pkt_print(pkt, stderr);
146 fprintf(stderr, ".\n");
152 pkt_print(pkt, stdout);
159 static ssize_t tftp_sendto(int sock, char *pkt, size_t len,
160 struct sockaddr_in *dst)
164 switch (pkt_num(pkt)) {
167 len = 2 + strlen(pkt + 2) + 1;
168 len += strlen(pkt + len) + 1;
177 len = 4 + strlen(pkt + 4);
180 fprintf(stderr, "Attempted to send invalid packet ");
181 pkt_print(pkt, stderr);
182 fprintf(stderr, "; this is a bug!\n");
188 pkt_print(pkt, stdout);
192 sent = sendto(sock, pkt, len, 0, (struct sockaddr*)dst, sizeof(*dst));
194 sock_perror("sendto");
200 const char *leafname(const char *path)
202 const char *slash, *bslash;
204 slash = strrchr(path, '/');
205 bslash = strrchr(path, '\\');
207 if (slash && bslash) {
208 path = 1 + (slash > bslash ? slash : bslash);
218 #ifdef NMRPFLASH_WINDOWS
219 void sock_perror(const char *msg)
221 win_perror2(msg, WSAGetLastError());
225 inline bool tftp_is_valid_filename(const char *filename)
227 return strlen(filename) <= 500 && is_netascii(filename);
230 int tftp_put(struct nmrpd_args *args)
232 struct sockaddr_in addr;
233 uint16_t block, port;
234 ssize_t len, last_len;
235 int fd, sock, ret, timeout, errors, ackblock;
236 char rx[TFTP_PKT_SIZE], tx[TFTP_PKT_SIZE];
241 if (!strcmp(args->file_local, "-")) {
244 fd = open(args->file_local, O_RDONLY | O_BINARY);
252 sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
254 sock_perror("socket");
259 if ((addr.sin_addr.s_addr = inet_addr(args->ipaddr)) == INADDR_NONE) {
264 addr.sin_family = AF_INET;
265 addr.sin_port = htons(args->port);
271 /* Not really, but this way the loop sends our WRQ before receiving */
274 pkt_mkwrq(tx, args->file_remote);
277 if (!timeout && pkt_num(rx) == ACK) {
278 ackblock = pkt_num(rx + 2);
283 if (timeout || ackblock == block) {
287 pkt_mknum(tx + 2, block);
288 len = read(fd, tx + 4, 512);
294 if (last_len != 512 && last_len != -1) {
302 ret = tftp_sendto(sock, tx, len, &addr);
306 } else if (pkt_num(rx) != ACK || ackblock > block) {
308 fprintf(stderr, "Expected ACK(%d), got ", block);
309 pkt_print(rx, stderr);
310 fprintf(stderr, ".\n");
313 if (ackblock != -1 && ++errors > 5) {
314 fprintf(stderr, "Protocol error; bailing out.\n");
320 ret = tftp_recvfrom(sock, rx, &port, args->rx_timeout);
324 if (++timeout < 5 || (!block && timeout < 10)) {
327 fprintf(stderr, "Timeout while waiting for ACK(%d).\n", block);
329 fprintf(stderr, "Timeout while waiting for initial reply.\n");
337 if (!block && port != args->port) {
339 printf("Switching to port %d\n", port);
341 addr.sin_port = htons(port);
354 #ifndef NMRPFLASH_WINDOWS
355 shutdown(sock, SHUT_RDWR);
358 shutdown(sock, SD_BOTH);