//usage: "[OPTIONS] HOST [PORT]"
//usage:#define tftp_full_usage "\n\n"
//usage: "Transfer a file from/to tftp server\n"
-//usage: "\nOptions:"
//usage: "\n -l FILE Local FILE"
//usage: "\n -r FILE Remote FILE"
//usage: IF_FEATURE_TFTP_GET(
//usage: " 69 dgram udp nowait root tftpd tftpd -l /files/to/serve\n"
//usage: "It also can be ran from udpsvd:\n"
//usage: " udpsvd -vE 0.0.0.0 69 tftpd /files/to/serve\n"
-//usage: "\nOptions:"
//usage: "\n -r Prohibit upload"
//usage: "\n -c Allow file creation via upload"
//usage: "\n -u Access files as USER"
struct globals {
/* u16 TFTP_ERROR; u16 reason; both network-endian, then error text: */
uint8_t error_pkt[4 + 32];
- char *user_opt;
- /* used in tftpd_main(), a bit big for stack: */
- char block_buf[TFTP_BLKSIZE_DEFAULT];
+ struct passwd *pw;
+ /* Used in tftpd_main() for initial packet */
+ /* Some HP PA-RISC firmware always sends fixed 516-byte requests */
+ char block_buf[516];
+ char block_buf_tail[1];
#if ENABLE_FEATURE_TFTP_PROGRESS_BAR
off_t pos;
off_t size;
#endif
} FIX_ALIASING;
#define G (*(struct globals*)&bb_common_bufsiz1)
-struct BUG_G_too_big {
- char BUG_G_too_big[sizeof(G) <= COMMON_BUFSIZE ? 1 : -1];
-};
-#define block_buf (G.block_buf )
-#define user_opt (G.user_opt )
-#define error_pkt (G.error_pkt )
-#define INIT_G() do { } while (0)
+#define INIT_G() do { \
+ BUILD_BUG_ON(sizeof(G) > COMMON_BUFSIZE); \
+} while (0)
-#define error_pkt_reason (error_pkt[3])
-#define error_pkt_str (error_pkt + 4)
+#define G_error_pkt_reason (G.error_pkt[3])
+#define G_error_pkt_str ((char*)(G.error_pkt + 4))
#if ENABLE_FEATURE_TFTP_PROGRESS_BAR
static void tftp_progress_update(void)
xconnect(socket_fd, &peer_lsa->u.sa, peer_lsa->len);
/* Is there an error already? Send pkt and bail out */
- if (error_pkt_reason || error_pkt_str[0])
+ if (G_error_pkt_reason || G_error_pkt_str[0])
goto send_err_pkt;
- if (user_opt) {
- struct passwd *pw = xgetpwnam(user_opt);
- change_identity(pw); /* initgroups, setgid, setuid */
+ if (G.pw) {
+ change_identity(G.pw); /* initgroups, setgid, setuid */
}
}
/* Open file (must be after changing user) */
local_fd = open(local_file, open_mode, 0666);
if (local_fd < 0) {
- error_pkt_reason = ERR_NOFILE;
- strcpy((char*)error_pkt_str, "can't open file");
+ G_error_pkt_reason = ERR_NOFILE;
+ strcpy(G_error_pkt_str, "can't open file");
goto send_err_pkt;
}
/* gcc 4.3.1 would NOT optimize it out as it should! */
* as if it is "block 0" */
block_nr = 0;
}
-
} else { /* tftp */
/* Open file (must be after changing user) */
local_fd = CMD_GET(option_mask32) ? STDOUT_FILENO : STDIN_FILENO;
if (res) {
blksize = tftp_blksize_check(res, blksize);
if (blksize < 0) {
- error_pkt_reason = ERR_BAD_OPT;
+ G_error_pkt_reason = ERR_BAD_OPT;
goto send_err_pkt;
}
io_bufsize = blksize + 4;
if (recv_blk == block_nr) {
int sz = full_write(local_fd, &rbuf[4], len - 4);
if (sz != len - 4) {
- strcpy((char*)error_pkt_str, bb_msg_write_error);
- error_pkt_reason = ERR_WRITE;
+ strcpy(G_error_pkt_str, bb_msg_write_error);
+ G_error_pkt_reason = ERR_WRITE;
goto send_err_pkt;
}
if (sz != blksize) {
return finished == 0; /* returns 1 on failure */
send_read_err_pkt:
- strcpy((char*)error_pkt_str, bb_msg_read_error);
+ strcpy(G_error_pkt_str, bb_msg_read_error);
send_err_pkt:
- if (error_pkt_str[0])
- bb_error_msg("%s", (char*)error_pkt_str);
- error_pkt[1] = TFTP_ERROR;
- xsendto(socket_fd, error_pkt, 4 + 1 + strlen((char*)error_pkt_str),
+ if (G_error_pkt_str[0])
+ bb_error_msg("%s", G_error_pkt_str);
+ G.error_pkt[1] = TFTP_ERROR;
+ xsendto(socket_fd, G.error_pkt, 4 + 1 + strlen(G_error_pkt_str),
&peer_lsa->u.sa, peer_lsa->len);
return EXIT_FAILURE;
#undef remote_file
{
len_and_sockaddr *our_lsa;
len_and_sockaddr *peer_lsa;
- char *local_file, *mode;
+ char *local_file, *mode, *user_opt;
const char *error_msg;
int opt, result, opcode;
IF_FEATURE_TFTP_BLOCKSIZE(int blksize = TFTP_BLKSIZE_DEFAULT;)
openlog(applet_name, LOG_PID, LOG_DAEMON);
logmode = LOGMODE_SYSLOG;
}
- if (argv[0])
- xchdir(argv[0]);
+ if (opt & TFTPD_OPT_u) {
+ /* Must be before xchroot */
+ G.pw = xgetpwnam(user_opt);
+ }
+ if (argv[0]) {
+ xchroot(argv[0]);
+ }
- result = recv_from_to(STDIN_FILENO, block_buf, sizeof(block_buf),
+ result = recv_from_to(STDIN_FILENO,
+ G.block_buf, sizeof(G.block_buf) + 1,
+ /* ^^^ sizeof+1 to reliably detect oversized input */
0 /* flags */,
&peer_lsa->u.sa, &our_lsa->u.sa, our_lsa->len);
error_msg = "malformed packet";
- opcode = ntohs(*(uint16_t*)block_buf);
- if (result < 4 || result >= sizeof(block_buf)
- || block_buf[result-1] != '\0'
+ opcode = ntohs(*(uint16_t*)G.block_buf);
+ if (result < 4 || result > sizeof(G.block_buf)
+ /*|| G.block_buf[result-1] != '\0' - bug compatibility, see below */
|| (IF_FEATURE_TFTP_PUT(opcode != TFTP_RRQ) /* not download */
IF_GETPUT(&&)
IF_FEATURE_TFTP_GET(opcode != TFTP_WRQ) /* not upload */
) {
goto err;
}
- local_file = block_buf + 2;
+ /* Some HP PA-RISC firmware always sends fixed 516-byte requests,
+ * with trailing garbage.
+ * Support that by not requiring NUL to be the last byte (see above).
+ * To make strXYZ() ops safe, force NUL termination:
+ */
+ G.block_buf_tail[0] = '\0';
+
+ local_file = G.block_buf + 2;
if (local_file[0] == '.' || strstr(local_file, "/.")) {
error_msg = "dot in file name";
goto err;
}
mode = local_file + strlen(local_file) + 1;
- if (mode >= block_buf + result || strcmp(mode, "octet") != 0) {
+ /* RFC 1350 says mode string is case independent */
+ if (mode >= G.block_buf + result || strcasecmp(mode, "octet") != 0) {
goto err;
}
# if ENABLE_FEATURE_TFTP_BLOCKSIZE
{
char *res;
char *opt_str = mode + sizeof("octet");
- int opt_len = block_buf + result - opt_str;
+ int opt_len = G.block_buf + result - opt_str;
if (opt_len > 0) {
res = tftp_get_option("blksize", opt_str, opt_len);
if (res) {
blksize = tftp_blksize_check(res, 65564);
if (blksize < 0) {
- error_pkt_reason = ERR_BAD_OPT;
+ G_error_pkt_reason = ERR_BAD_OPT;
/* will just send error pkt */
goto do_proto;
}
if (!ENABLE_FEATURE_TFTP_PUT || opcode == TFTP_WRQ) {
if (opt & TFTPD_OPT_r) {
/* This would mean "disk full" - not true */
- /*error_pkt_reason = ERR_WRITE;*/
+ /*G_error_pkt_reason = ERR_WRITE;*/
error_msg = bb_msg_write_error;
goto err;
}
IF_GETPUT(option_mask32 |= TFTP_OPT_PUT;) /* will send file's data */
}
- /* NB: if error_pkt_str or error_pkt_reason is set up,
+ /* NB: if G_error_pkt_str or G_error_pkt_reason is set up,
* tftp_protocol() just sends one error pkt and returns */
do_proto:
return result;
err:
- strcpy((char*)error_pkt_str, error_msg);
+ strcpy(G_error_pkt_str, error_msg);
goto do_proto;
}
projects / oweals / busybox.git / blobdiff