1 /* $OpenBSD: rmpproto.c,v 1.9 2003/06/02 23:36:54 millert Exp $ */ 2 /* $NetBSD: rmpproto.c,v 1.5.2.1 1995/11/14 08:45:44 thorpej Exp $ */ 3 4 /* 5 * Copyright (c) 1988, 1992 The University of Utah and the Center 6 * for Software Science (CSS). 7 * Copyright (c) 1992, 1993 8 * The Regents of the University of California. All rights reserved. 9 * 10 * This code is derived from software contributed to Berkeley by 11 * the Center for Software Science of the University of Utah Computer 12 * Science Department. CSS requests users of this software to return 13 * to css-dist@cs.utah.edu any improvements that they make and grant 14 * CSS redistribution rights. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions 18 * are met: 19 * 1. Redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer. 21 * 2. Redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution. 24 * 3. Neither the name of the University nor the names of its contributors 25 * may be used to endorse or promote products derived from this software 26 * without specific prior written permission. 27 * 28 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 29 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 30 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 31 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 32 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 33 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 34 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 35 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 36 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 37 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 38 * SUCH DAMAGE. 39 * 40 * from: @(#)rmpproto.c 8.1 (Berkeley) 6/4/93 41 * 42 * From: Utah Hdr: rmpproto.c 3.1 92/07/06 43 * Author: Jeff Forys, University of Utah CSS 44 */ 45 46 #ifndef lint 47 /*static char sccsid[] = "@(#)rmpproto.c 8.1 (Berkeley) 6/4/93";*/ 48 static char rcsid[] = "$OpenBSD: rmpproto.c,v 1.9 2003/06/02 23:36:54 millert Exp $"; 49 #endif /* not lint */ 50 51 #include <sys/param.h> 52 #include <sys/time.h> 53 54 #include <errno.h> 55 #include <fcntl.h> 56 #include <stdio.h> 57 #include <string.h> 58 #include <syslog.h> 59 #include <unistd.h> 60 #include "defs.h" 61 62 /* 63 ** ProcessPacket -- determine packet type and do what's required. 64 ** 65 ** An RMP BOOT packet has been received. Look at the type field 66 ** and process Boot Requests, Read Requests, and Boot Complete 67 ** packets. Any other type will be dropped with a warning msg. 68 ** 69 ** Parameters: 70 ** rconn - the new connection 71 ** client - list of files available to this host 72 ** 73 ** Returns: 74 ** Nothing. 75 ** 76 ** Side Effects: 77 ** - If this is a valid boot request, it will be added to 78 ** the linked list of outstanding requests (RmpConns). 79 ** - If this is a valid boot complete, its associated 80 ** entry in RmpConns will be deleted. 81 ** - Also, unless we run out of memory, a reply will be 82 ** sent to the host that sent the packet. 83 */ 84 void 85 ProcessPacket(RMPCONN *rconn, CLIENT *client) 86 { 87 struct rmp_packet *rmp = &rconn->rmp; 88 RMPCONN *rconnout; 89 90 switch (rmp->r_type) { /* do what we came here to do */ 91 case RMP_BOOT_REQ: /* boot request */ 92 if ((rconnout = NewConn(rconn)) == NULL) 93 return; 94 95 /* 96 * If the Session ID is 0xffff, this is a "probe" 97 * packet and we do not want to add the connection 98 * to the linked list of active connections. There 99 * are two types of probe packets, if the Sequence 100 * Number is 0 they want to know our host name, o/w 101 * they want the name of the file associated with 102 * the number spec'd by the Sequence Number. 103 * 104 * If this is an actual boot request, open the file 105 * and send a reply. If SendBootRepl() does not 106 * return 0, add the connection to the linked list 107 * of active connections, otherwise delete it since 108 * an error was encountered. 109 */ 110 if (ntohs(rmp->r_brq.rmp_session) == RMP_PROBESID) { 111 if (WORDZE(rmp->r_brq.rmp_seqno)) 112 (void) SendServerID(rconnout); 113 else 114 (void) SendFileNo(rmp, rconnout, 115 client ? client->files : BootFiles); 116 FreeConn(rconnout); 117 } else { 118 if (SendBootRepl(rmp, rconnout, 119 client? client->files: BootFiles)) 120 AddConn(rconnout); 121 else 122 FreeConn(rconnout); 123 } 124 break; 125 126 case RMP_BOOT_REPL: /* boot reply (not valid) */ 127 syslog(LOG_WARNING, "%s: sent a boot reply", 128 EnetStr(rconn)); 129 break; 130 131 case RMP_READ_REQ: /* read request */ 132 /* 133 * Send a portion of the boot file. 134 */ 135 (void) SendReadRepl(rconn); 136 break; 137 138 case RMP_READ_REPL: /* read reply (not valid) */ 139 syslog(LOG_WARNING, "%s: sent a read reply", 140 EnetStr(rconn)); 141 break; 142 143 case RMP_BOOT_DONE: /* boot complete */ 144 /* 145 * Remove the entry from the linked list of active 146 * connections. 147 */ 148 (void) BootDone(rconn); 149 break; 150 151 default: /* unknown RMP packet type */ 152 syslog(LOG_WARNING, "%s: unknown packet type (%u)", 153 EnetStr(rconn), rmp->r_type); 154 } 155 } 156 157 /* 158 ** SendServerID -- send our host name to who ever requested it. 159 ** 160 ** Parameters: 161 ** rconn - the reply packet to be formatted. 162 ** 163 ** Returns: 164 ** 1 on success, 0 on failure. 165 ** 166 ** Side Effects: 167 ** none. 168 */ 169 int 170 SendServerID(RMPCONN *rconn) 171 { 172 struct rmp_packet *rpl; 173 char *src, *dst; 174 u_int8_t *size; 175 176 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 177 178 /* 179 * Set up assorted fields in reply packet. 180 */ 181 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 182 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 183 ZEROWORD(rpl->r_brpl.rmp_seqno); 184 rpl->r_brpl.rmp_session = 0; 185 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 186 187 size = &rpl->r_brpl.rmp_flnmsize; /* ptr to length of host name */ 188 189 /* 190 * Copy our host name into the reply packet incrementing the 191 * length as we go. Stop at RMP_HOSTLEN or the first dot. 192 */ 193 src = MyHost; 194 dst = (char *) &rpl->r_brpl.rmp_flnm; 195 for (*size = 0; *size < RMP_HOSTLEN; (*size)++) { 196 if (*src == '.' || *src == '\0') 197 break; 198 *dst++ = *src++; 199 } 200 201 rconn->rmplen = RMPBOOTSIZE(*size); /* set packet length */ 202 203 return(SendPacket(rconn)); /* send packet */ 204 } 205 206 /* 207 ** SendFileNo -- send the name of a bootable file to the requester. 208 ** 209 ** Parameters: 210 ** req - RMP BOOT packet containing the request. 211 ** rconn - the reply packet to be formatted. 212 ** filelist - list of files available to the requester. 213 ** 214 ** Returns: 215 ** 1 on success, 0 on failure. 216 ** 217 ** Side Effects: 218 ** none. 219 */ 220 int 221 SendFileNo(struct rmp_packet *req, RMPCONN *rconn, char *filelist[]) 222 { 223 struct rmp_packet *rpl; 224 char *src, *dst; 225 u_int8_t *size; 226 int i; 227 228 GETWORD(req->r_brpl.rmp_seqno, i); /* SeqNo is really FileNo */ 229 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 230 231 /* 232 * Set up assorted fields in reply packet. 233 */ 234 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 235 PUTWORD(i, rpl->r_brpl.rmp_seqno); 236 i--; 237 rpl->r_brpl.rmp_session = 0; 238 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 239 240 size = &rpl->r_brpl.rmp_flnmsize; /* ptr to length of filename */ 241 *size = 0; /* init length to zero */ 242 243 /* 244 * Copy the file name into the reply packet incrementing the 245 * length as we go. Stop at end of string or when RMPBOOTDATA 246 * characters have been copied. Also, set return code to 247 * indicate success or "no more files". 248 */ 249 if (i < C_MAXFILE && filelist[i] != NULL) { 250 src = filelist[i]; 251 dst = (char *)&rpl->r_brpl.rmp_flnm; 252 for (; *src && *size < RMPBOOTDATA; (*size)++) { 253 if (*src == '\0') 254 break; 255 *dst++ = *src++; 256 } 257 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 258 } else 259 rpl->r_brpl.rmp_retcode = RMP_E_NODFLT; 260 261 rconn->rmplen = RMPBOOTSIZE(*size); /* set packet length */ 262 263 return(SendPacket(rconn)); /* send packet */ 264 } 265 266 /* 267 ** SendBootRepl -- open boot file and respond to boot request. 268 ** 269 ** Parameters: 270 ** req - RMP BOOT packet containing the request. 271 ** rconn - the reply packet to be formatted. 272 ** filelist - list of files available to the requester. 273 ** 274 ** Returns: 275 ** 1 on success, 0 on failure. 276 ** 277 ** Side Effects: 278 ** none. 279 */ 280 int 281 SendBootRepl(struct rmp_packet *req, RMPCONN *rconn, char *filelist[]) 282 { 283 int retval; 284 char *filename, filepath[RMPBOOTDATA+1]; 285 RMPCONN *oldconn; 286 struct rmp_packet *rpl; 287 char *src, *dst1, *dst2; 288 u_int8_t i; 289 290 /* 291 * If another connection already exists, delete it since we 292 * are obviously starting again. 293 */ 294 if ((oldconn = FindConn(rconn)) != NULL) { 295 syslog(LOG_WARNING, "%s: dropping existing connection", 296 EnetStr(oldconn)); 297 RemoveConn(oldconn); 298 } 299 300 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 301 302 /* 303 * Set up assorted fields in reply packet. 304 */ 305 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 306 COPYWORD(req->r_brq.rmp_seqno, rpl->r_brpl.rmp_seqno); 307 rpl->r_brpl.rmp_session = htons(GenSessID()); 308 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 309 rpl->r_brpl.rmp_flnmsize = req->r_brq.rmp_flnmsize; 310 311 /* 312 * Copy file name to `filepath' string, and into reply packet. 313 */ 314 dst1 = filepath; 315 dst2 = &rpl->r_brpl.rmp_flnm; 316 if (req->r_brq.rmp_flnmsize) 317 src = &req->r_brq.rmp_flnm; 318 else { 319 /* no file supplied, substitute the first one */ 320 src = filelist[0]; 321 req->r_brq.rmp_flnmsize = strlen(src); 322 } 323 for (i = 0; i < req->r_brq.rmp_flnmsize; i++) 324 *dst1++ = *dst2++ = *src++; 325 *dst1 = '\0'; 326 327 /* 328 * If we are booting HP-UX machines, their secondary loader will 329 * ask for files like "/hp-ux". As a security measure, we do not 330 * allow boot files to lay outside the boot directory (unless they 331 * are purposely link'd out. So, make `filename' become the path- 332 * stripped file name and spoof the client into thinking that it 333 * really got what it wanted. 334 */ 335 if ((filename = strrchr(filepath,'/')) != NULL) 336 filename++; 337 else 338 filename = filepath; 339 340 /* 341 * Check that this is a valid boot file name. 342 */ 343 for (i = 0; i < C_MAXFILE && filelist[i] != NULL; i++) 344 if (STREQN(filename, filelist[i])) 345 goto match; 346 347 /* 348 * Invalid boot file name, set error and send reply packet. 349 */ 350 rpl->r_brpl.rmp_retcode = RMP_E_NOFILE; 351 retval = 0; 352 goto sendpkt; 353 354 match: 355 /* 356 * This is a valid boot file. Open the file and save the file 357 * descriptor associated with this connection and set success 358 * indication. If the file couldnt be opened, set error: 359 * "no such file or dir" - RMP_E_NOFILE 360 * "file table overflow" - RMP_E_BUSY 361 * "too many open files" - RMP_E_BUSY 362 * anything else - RMP_E_OPENFILE 363 */ 364 if ((rconn->bootfd = open(filename, O_RDONLY, 0600)) < 0) { 365 rpl->r_brpl.rmp_retcode = (errno == ENOENT)? RMP_E_NOFILE: 366 (errno == EMFILE || errno == ENFILE)? RMP_E_BUSY: 367 RMP_E_OPENFILE; 368 retval = 0; 369 } else { 370 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 371 retval = 1; 372 } 373 374 sendpkt: 375 syslog(LOG_INFO, "%s: request to boot %s (%s)", 376 EnetStr(rconn), filename, retval? "granted": "denied"); 377 378 rconn->rmplen = RMPBOOTSIZE(rpl->r_brpl.rmp_flnmsize); 379 380 return (retval & SendPacket(rconn)); 381 } 382 383 /* 384 ** SendReadRepl -- send a portion of the boot file to the requester. 385 ** 386 ** Parameters: 387 ** rconn - the reply packet to be formatted. 388 ** 389 ** Returns: 390 ** 1 on success, 0 on failure. 391 ** 392 ** Side Effects: 393 ** none. 394 */ 395 int 396 SendReadRepl(RMPCONN *rconn) 397 { 398 int retval = 0; 399 RMPCONN *oldconn; 400 struct rmp_packet *rpl, *req; 401 int size = 0; 402 int madeconn = 0; 403 404 /* 405 * Find the old connection. If one doesnt exist, create one only 406 * to return the error code. 407 */ 408 if ((oldconn = FindConn(rconn)) == NULL) { 409 if ((oldconn = NewConn(rconn)) == NULL) 410 return(0); 411 syslog(LOG_ERR, "SendReadRepl: no active connection (%s)", 412 EnetStr(rconn)); 413 madeconn++; 414 } 415 416 req = &rconn->rmp; /* cache ptr to request packet */ 417 rpl = &oldconn->rmp; /* cache ptr to reply packet */ 418 419 if (madeconn) { /* no active connection above; abort */ 420 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 421 retval = 1; 422 goto sendpkt; 423 } 424 425 /* 426 * Make sure Session ID's match. 427 */ 428 if (ntohs(req->r_rrq.rmp_session) != 429 ((rpl->r_type == RMP_BOOT_REPL)? ntohs(rpl->r_brpl.rmp_session): 430 ntohs(rpl->r_rrpl.rmp_session))) { 431 syslog(LOG_ERR, "SendReadRepl: bad session id (%s)", 432 EnetStr(rconn)); 433 rpl->r_rrpl.rmp_retcode = RMP_E_BADSID; 434 retval = 1; 435 goto sendpkt; 436 } 437 438 /* 439 * If the requester asks for more data than we can fit, 440 * silently clamp the request size down to RMPREADDATA. 441 * 442 * N.B. I do not know if this is "legal", however it seems 443 * to work. This is necessary for bpfwrite() on machines 444 * with MCLBYTES less than 1514. 445 */ 446 if (ntohs(req->r_rrq.rmp_size) > RMPREADDATA) 447 req->r_rrq.rmp_size = htons(RMPREADDATA); 448 449 /* 450 * Position read head on file according to info in request packet. 451 */ 452 GETWORD(req->r_rrq.rmp_offset, size); 453 if (lseek(oldconn->bootfd, (off_t)size, SEEK_SET) < 0) { 454 syslog(LOG_ERR, "SendReadRepl: lseek: %m (%s)", 455 EnetStr(rconn)); 456 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 457 retval = 1; 458 goto sendpkt; 459 } 460 461 /* 462 * Read data directly into reply packet. 463 */ 464 if ((size = read(oldconn->bootfd, &rpl->r_rrpl.rmp_data, 465 (int) ntohs(req->r_rrq.rmp_size))) <= 0) { 466 if (size < 0) { 467 syslog(LOG_ERR, "SendReadRepl: read: %m (%s)", 468 EnetStr(rconn)); 469 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 470 } else { 471 rpl->r_rrpl.rmp_retcode = RMP_E_EOF; 472 } 473 retval = 1; 474 goto sendpkt; 475 } 476 477 /* 478 * Set success indication. 479 */ 480 rpl->r_rrpl.rmp_retcode = RMP_E_OKAY; 481 482 sendpkt: 483 /* 484 * Set up assorted fields in reply packet. 485 */ 486 rpl->r_rrpl.rmp_type = RMP_READ_REPL; 487 COPYWORD(req->r_rrq.rmp_offset, rpl->r_rrpl.rmp_offset); 488 rpl->r_rrpl.rmp_session = req->r_rrq.rmp_session; 489 490 oldconn->rmplen = RMPREADSIZE(size); /* set size of packet */ 491 492 retval &= SendPacket(oldconn); /* send packet */ 493 494 if (madeconn) /* clean up after ourself */ 495 FreeConn(oldconn); 496 497 return (retval); 498 } 499 500 /* 501 ** BootDone -- free up memory allocated for a connection. 502 ** 503 ** Parameters: 504 ** rconn - incoming boot complete packet. 505 ** 506 ** Returns: 507 ** 1 on success, 0 on failure. 508 ** 509 ** Side Effects: 510 ** none. 511 */ 512 int 513 BootDone(RMPCONN *rconn) 514 { 515 RMPCONN *oldconn; 516 struct rmp_packet *rpl; 517 518 /* 519 * If we cant find the connection, ignore the request. 520 */ 521 if ((oldconn = FindConn(rconn)) == NULL) { 522 syslog(LOG_ERR, "BootDone: no existing connection (%s)", 523 EnetStr(rconn)); 524 return(0); 525 } 526 527 rpl = &oldconn->rmp; /* cache ptr to RMP packet */ 528 529 /* 530 * Make sure Session ID's match. 531 */ 532 if (ntohs(rconn->rmp.r_rrq.rmp_session) != 533 ((rpl->r_type == RMP_BOOT_REPL)? ntohs(rpl->r_brpl.rmp_session): 534 ntohs(rpl->r_rrpl.rmp_session))) { 535 syslog(LOG_ERR, "BootDone: bad session id (%s)", 536 EnetStr(rconn)); 537 return(0); 538 } 539 540 RemoveConn(oldconn); /* remove connection */ 541 542 syslog(LOG_INFO, "%s: boot complete", EnetStr(rconn)); 543 544 return(1); 545 } 546 547 /* 548 ** SendPacket -- send an RMP packet to a remote host. 549 ** 550 ** Parameters: 551 ** rconn - packet to be sent. 552 ** 553 ** Returns: 554 ** 1 on success, 0 on failure. 555 ** 556 ** Side Effects: 557 ** none. 558 */ 559 int 560 SendPacket(RMPCONN *rconn) 561 { 562 /* 563 * Set Ethernet Destination address to Source (BPF and the enet 564 * driver will take care of getting our source address set). 565 */ 566 bcopy((char *)&rconn->rmp.hp_hdr.saddr[0], 567 (char *)&rconn->rmp.hp_hdr.daddr[0], RMP_ADDRLEN); 568 rconn->rmp.hp_hdr.len = htons(rconn->rmplen - sizeof(struct hp_hdr)); 569 570 /* 571 * Reverse 802.2/HP Extended Source & Destination Access Pts. 572 */ 573 rconn->rmp.hp_llc.dxsap = htons(HPEXT_SXSAP); 574 rconn->rmp.hp_llc.sxsap = htons(HPEXT_DXSAP); 575 576 /* 577 * Last time this connection was active. 578 */ 579 (void) gettimeofday(&rconn->tstamp, (struct timezone *)0); 580 581 if (DbgFp != NULL) /* display packet */ 582 DispPkt(rconn,DIR_SENT); 583 584 /* 585 * Send RMP packet to remote host. 586 */ 587 return(BpfWrite(rconn)); 588 } 589