1 /* $OpenBSD: rmpproto.c,v 1.10 2009/10/27 23:59:54 deraadt Exp $ */ 2 /* $NetBSD: rmpproto.c,v 1.5.2.1 1995/11/14 08:45:44 thorpej Exp $ */ 3 4 /* 5 * Copyright (c) 1988, 1992 The University of Utah and the Center 6 * for Software Science (CSS). 7 * Copyright (c) 1992, 1993 8 * The Regents of the University of California. All rights reserved. 9 * 10 * This code is derived from software contributed to Berkeley by 11 * the Center for Software Science of the University of Utah Computer 12 * Science Department. CSS requests users of this software to return 13 * to css-dist@cs.utah.edu any improvements that they make and grant 14 * CSS redistribution rights. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions 18 * are met: 19 * 1. Redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer. 21 * 2. Redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution. 24 * 3. Neither the name of the University nor the names of its contributors 25 * may be used to endorse or promote products derived from this software 26 * without specific prior written permission. 27 * 28 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 29 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 30 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 31 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 32 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 33 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 34 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 35 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 36 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 37 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 38 * SUCH DAMAGE. 39 * 40 * from: @(#)rmpproto.c 8.1 (Berkeley) 6/4/93 41 * 42 * From: Utah Hdr: rmpproto.c 3.1 92/07/06 43 * Author: Jeff Forys, University of Utah CSS 44 */ 45 46 #include <sys/param.h> 47 #include <sys/time.h> 48 49 #include <errno.h> 50 #include <fcntl.h> 51 #include <stdio.h> 52 #include <string.h> 53 #include <syslog.h> 54 #include <unistd.h> 55 #include "defs.h" 56 57 /* 58 ** ProcessPacket -- determine packet type and do what's required. 59 ** 60 ** An RMP BOOT packet has been received. Look at the type field 61 ** and process Boot Requests, Read Requests, and Boot Complete 62 ** packets. Any other type will be dropped with a warning msg. 63 ** 64 ** Parameters: 65 ** rconn - the new connection 66 ** client - list of files available to this host 67 ** 68 ** Returns: 69 ** Nothing. 70 ** 71 ** Side Effects: 72 ** - If this is a valid boot request, it will be added to 73 ** the linked list of outstanding requests (RmpConns). 74 ** - If this is a valid boot complete, its associated 75 ** entry in RmpConns will be deleted. 76 ** - Also, unless we run out of memory, a reply will be 77 ** sent to the host that sent the packet. 78 */ 79 void 80 ProcessPacket(RMPCONN *rconn, CLIENT *client) 81 { 82 struct rmp_packet *rmp = &rconn->rmp; 83 RMPCONN *rconnout; 84 85 switch (rmp->r_type) { /* do what we came here to do */ 86 case RMP_BOOT_REQ: /* boot request */ 87 if ((rconnout = NewConn(rconn)) == NULL) 88 return; 89 90 /* 91 * If the Session ID is 0xffff, this is a "probe" 92 * packet and we do not want to add the connection 93 * to the linked list of active connections. There 94 * are two types of probe packets, if the Sequence 95 * Number is 0 they want to know our host name, o/w 96 * they want the name of the file associated with 97 * the number spec'd by the Sequence Number. 98 * 99 * If this is an actual boot request, open the file 100 * and send a reply. If SendBootRepl() does not 101 * return 0, add the connection to the linked list 102 * of active connections, otherwise delete it since 103 * an error was encountered. 104 */ 105 if (ntohs(rmp->r_brq.rmp_session) == RMP_PROBESID) { 106 if (WORDZE(rmp->r_brq.rmp_seqno)) 107 (void) SendServerID(rconnout); 108 else 109 (void) SendFileNo(rmp, rconnout, 110 client ? client->files : BootFiles); 111 FreeConn(rconnout); 112 } else { 113 if (SendBootRepl(rmp, rconnout, 114 client? client->files: BootFiles)) 115 AddConn(rconnout); 116 else 117 FreeConn(rconnout); 118 } 119 break; 120 121 case RMP_BOOT_REPL: /* boot reply (not valid) */ 122 syslog(LOG_WARNING, "%s: sent a boot reply", 123 EnetStr(rconn)); 124 break; 125 126 case RMP_READ_REQ: /* read request */ 127 /* 128 * Send a portion of the boot file. 129 */ 130 (void) SendReadRepl(rconn); 131 break; 132 133 case RMP_READ_REPL: /* read reply (not valid) */ 134 syslog(LOG_WARNING, "%s: sent a read reply", 135 EnetStr(rconn)); 136 break; 137 138 case RMP_BOOT_DONE: /* boot complete */ 139 /* 140 * Remove the entry from the linked list of active 141 * connections. 142 */ 143 (void) BootDone(rconn); 144 break; 145 146 default: /* unknown RMP packet type */ 147 syslog(LOG_WARNING, "%s: unknown packet type (%u)", 148 EnetStr(rconn), rmp->r_type); 149 } 150 } 151 152 /* 153 ** SendServerID -- send our host name to who ever requested it. 154 ** 155 ** Parameters: 156 ** rconn - the reply packet to be formatted. 157 ** 158 ** Returns: 159 ** 1 on success, 0 on failure. 160 ** 161 ** Side Effects: 162 ** none. 163 */ 164 int 165 SendServerID(RMPCONN *rconn) 166 { 167 struct rmp_packet *rpl; 168 char *src, *dst; 169 u_int8_t *size; 170 171 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 172 173 /* 174 * Set up assorted fields in reply packet. 175 */ 176 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 177 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 178 ZEROWORD(rpl->r_brpl.rmp_seqno); 179 rpl->r_brpl.rmp_session = 0; 180 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 181 182 size = &rpl->r_brpl.rmp_flnmsize; /* ptr to length of host name */ 183 184 /* 185 * Copy our host name into the reply packet incrementing the 186 * length as we go. Stop at RMP_HOSTLEN or the first dot. 187 */ 188 src = MyHost; 189 dst = (char *) &rpl->r_brpl.rmp_flnm; 190 for (*size = 0; *size < RMP_HOSTLEN; (*size)++) { 191 if (*src == '.' || *src == '\0') 192 break; 193 *dst++ = *src++; 194 } 195 196 rconn->rmplen = RMPBOOTSIZE(*size); /* set packet length */ 197 198 return(SendPacket(rconn)); /* send packet */ 199 } 200 201 /* 202 ** SendFileNo -- send the name of a bootable file to the requester. 203 ** 204 ** Parameters: 205 ** req - RMP BOOT packet containing the request. 206 ** rconn - the reply packet to be formatted. 207 ** filelist - list of files available to the requester. 208 ** 209 ** Returns: 210 ** 1 on success, 0 on failure. 211 ** 212 ** Side Effects: 213 ** none. 214 */ 215 int 216 SendFileNo(struct rmp_packet *req, RMPCONN *rconn, char *filelist[]) 217 { 218 struct rmp_packet *rpl; 219 char *src, *dst; 220 u_int8_t *size; 221 int i; 222 223 GETWORD(req->r_brpl.rmp_seqno, i); /* SeqNo is really FileNo */ 224 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 225 226 /* 227 * Set up assorted fields in reply packet. 228 */ 229 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 230 PUTWORD(i, rpl->r_brpl.rmp_seqno); 231 i--; 232 rpl->r_brpl.rmp_session = 0; 233 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 234 235 size = &rpl->r_brpl.rmp_flnmsize; /* ptr to length of filename */ 236 *size = 0; /* init length to zero */ 237 238 /* 239 * Copy the file name into the reply packet incrementing the 240 * length as we go. Stop at end of string or when RMPBOOTDATA 241 * characters have been copied. Also, set return code to 242 * indicate success or "no more files". 243 */ 244 if (i < C_MAXFILE && filelist[i] != NULL) { 245 src = filelist[i]; 246 dst = (char *)&rpl->r_brpl.rmp_flnm; 247 for (; *src && *size < RMPBOOTDATA; (*size)++) { 248 if (*src == '\0') 249 break; 250 *dst++ = *src++; 251 } 252 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 253 } else 254 rpl->r_brpl.rmp_retcode = RMP_E_NODFLT; 255 256 rconn->rmplen = RMPBOOTSIZE(*size); /* set packet length */ 257 258 return(SendPacket(rconn)); /* send packet */ 259 } 260 261 /* 262 ** SendBootRepl -- open boot file and respond to boot request. 263 ** 264 ** Parameters: 265 ** req - RMP BOOT packet containing the request. 266 ** rconn - the reply packet to be formatted. 267 ** filelist - list of files available to the requester. 268 ** 269 ** Returns: 270 ** 1 on success, 0 on failure. 271 ** 272 ** Side Effects: 273 ** none. 274 */ 275 int 276 SendBootRepl(struct rmp_packet *req, RMPCONN *rconn, char *filelist[]) 277 { 278 int retval; 279 char *filename, filepath[RMPBOOTDATA+1]; 280 RMPCONN *oldconn; 281 struct rmp_packet *rpl; 282 char *src, *dst1, *dst2; 283 u_int8_t i; 284 285 /* 286 * If another connection already exists, delete it since we 287 * are obviously starting again. 288 */ 289 if ((oldconn = FindConn(rconn)) != NULL) { 290 syslog(LOG_WARNING, "%s: dropping existing connection", 291 EnetStr(oldconn)); 292 RemoveConn(oldconn); 293 } 294 295 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 296 297 /* 298 * Set up assorted fields in reply packet. 299 */ 300 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 301 COPYWORD(req->r_brq.rmp_seqno, rpl->r_brpl.rmp_seqno); 302 rpl->r_brpl.rmp_session = htons(GenSessID()); 303 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 304 rpl->r_brpl.rmp_flnmsize = req->r_brq.rmp_flnmsize; 305 306 /* 307 * Copy file name to `filepath' string, and into reply packet. 308 */ 309 dst1 = filepath; 310 dst2 = &rpl->r_brpl.rmp_flnm; 311 if (req->r_brq.rmp_flnmsize) 312 src = &req->r_brq.rmp_flnm; 313 else { 314 /* no file supplied, substitute the first one */ 315 src = filelist[0]; 316 req->r_brq.rmp_flnmsize = strlen(src); 317 } 318 for (i = 0; i < req->r_brq.rmp_flnmsize; i++) 319 *dst1++ = *dst2++ = *src++; 320 *dst1 = '\0'; 321 322 /* 323 * If we are booting HP-UX machines, their secondary loader will 324 * ask for files like "/hp-ux". As a security measure, we do not 325 * allow boot files to lay outside the boot directory (unless they 326 * are purposely link'd out. So, make `filename' become the path- 327 * stripped file name and spoof the client into thinking that it 328 * really got what it wanted. 329 */ 330 if ((filename = strrchr(filepath,'/')) != NULL) 331 filename++; 332 else 333 filename = filepath; 334 335 /* 336 * Check that this is a valid boot file name. 337 */ 338 for (i = 0; i < C_MAXFILE && filelist[i] != NULL; i++) 339 if (STREQN(filename, filelist[i])) 340 goto match; 341 342 /* 343 * Invalid boot file name, set error and send reply packet. 344 */ 345 rpl->r_brpl.rmp_retcode = RMP_E_NOFILE; 346 retval = 0; 347 goto sendpkt; 348 349 match: 350 /* 351 * This is a valid boot file. Open the file and save the file 352 * descriptor associated with this connection and set success 353 * indication. If the file couldnt be opened, set error: 354 * "no such file or dir" - RMP_E_NOFILE 355 * "file table overflow" - RMP_E_BUSY 356 * "too many open files" - RMP_E_BUSY 357 * anything else - RMP_E_OPENFILE 358 */ 359 if ((rconn->bootfd = open(filename, O_RDONLY, 0600)) < 0) { 360 rpl->r_brpl.rmp_retcode = (errno == ENOENT)? RMP_E_NOFILE: 361 (errno == EMFILE || errno == ENFILE)? RMP_E_BUSY: 362 RMP_E_OPENFILE; 363 retval = 0; 364 } else { 365 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 366 retval = 1; 367 } 368 369 sendpkt: 370 syslog(LOG_INFO, "%s: request to boot %s (%s)", 371 EnetStr(rconn), filename, retval? "granted": "denied"); 372 373 rconn->rmplen = RMPBOOTSIZE(rpl->r_brpl.rmp_flnmsize); 374 375 return (retval & SendPacket(rconn)); 376 } 377 378 /* 379 ** SendReadRepl -- send a portion of the boot file to the requester. 380 ** 381 ** Parameters: 382 ** rconn - the reply packet to be formatted. 383 ** 384 ** Returns: 385 ** 1 on success, 0 on failure. 386 ** 387 ** Side Effects: 388 ** none. 389 */ 390 int 391 SendReadRepl(RMPCONN *rconn) 392 { 393 int retval = 0; 394 RMPCONN *oldconn; 395 struct rmp_packet *rpl, *req; 396 int size = 0; 397 int madeconn = 0; 398 399 /* 400 * Find the old connection. If one doesnt exist, create one only 401 * to return the error code. 402 */ 403 if ((oldconn = FindConn(rconn)) == NULL) { 404 if ((oldconn = NewConn(rconn)) == NULL) 405 return(0); 406 syslog(LOG_ERR, "SendReadRepl: no active connection (%s)", 407 EnetStr(rconn)); 408 madeconn++; 409 } 410 411 req = &rconn->rmp; /* cache ptr to request packet */ 412 rpl = &oldconn->rmp; /* cache ptr to reply packet */ 413 414 if (madeconn) { /* no active connection above; abort */ 415 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 416 retval = 1; 417 goto sendpkt; 418 } 419 420 /* 421 * Make sure Session ID's match. 422 */ 423 if (ntohs(req->r_rrq.rmp_session) != 424 ((rpl->r_type == RMP_BOOT_REPL)? ntohs(rpl->r_brpl.rmp_session): 425 ntohs(rpl->r_rrpl.rmp_session))) { 426 syslog(LOG_ERR, "SendReadRepl: bad session id (%s)", 427 EnetStr(rconn)); 428 rpl->r_rrpl.rmp_retcode = RMP_E_BADSID; 429 retval = 1; 430 goto sendpkt; 431 } 432 433 /* 434 * If the requester asks for more data than we can fit, 435 * silently clamp the request size down to RMPREADDATA. 436 * 437 * N.B. I do not know if this is "legal", however it seems 438 * to work. This is necessary for bpfwrite() on machines 439 * with MCLBYTES less than 1514. 440 */ 441 if (ntohs(req->r_rrq.rmp_size) > RMPREADDATA) 442 req->r_rrq.rmp_size = htons(RMPREADDATA); 443 444 /* 445 * Position read head on file according to info in request packet. 446 */ 447 GETWORD(req->r_rrq.rmp_offset, size); 448 if (lseek(oldconn->bootfd, (off_t)size, SEEK_SET) < 0) { 449 syslog(LOG_ERR, "SendReadRepl: lseek: %m (%s)", 450 EnetStr(rconn)); 451 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 452 retval = 1; 453 goto sendpkt; 454 } 455 456 /* 457 * Read data directly into reply packet. 458 */ 459 if ((size = read(oldconn->bootfd, &rpl->r_rrpl.rmp_data, 460 (int) ntohs(req->r_rrq.rmp_size))) <= 0) { 461 if (size < 0) { 462 syslog(LOG_ERR, "SendReadRepl: read: %m (%s)", 463 EnetStr(rconn)); 464 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 465 } else { 466 rpl->r_rrpl.rmp_retcode = RMP_E_EOF; 467 } 468 retval = 1; 469 goto sendpkt; 470 } 471 472 /* 473 * Set success indication. 474 */ 475 rpl->r_rrpl.rmp_retcode = RMP_E_OKAY; 476 477 sendpkt: 478 /* 479 * Set up assorted fields in reply packet. 480 */ 481 rpl->r_rrpl.rmp_type = RMP_READ_REPL; 482 COPYWORD(req->r_rrq.rmp_offset, rpl->r_rrpl.rmp_offset); 483 rpl->r_rrpl.rmp_session = req->r_rrq.rmp_session; 484 485 oldconn->rmplen = RMPREADSIZE(size); /* set size of packet */ 486 487 retval &= SendPacket(oldconn); /* send packet */ 488 489 if (madeconn) /* clean up after ourself */ 490 FreeConn(oldconn); 491 492 return (retval); 493 } 494 495 /* 496 ** BootDone -- free up memory allocated for a connection. 497 ** 498 ** Parameters: 499 ** rconn - incoming boot complete packet. 500 ** 501 ** Returns: 502 ** 1 on success, 0 on failure. 503 ** 504 ** Side Effects: 505 ** none. 506 */ 507 int 508 BootDone(RMPCONN *rconn) 509 { 510 RMPCONN *oldconn; 511 struct rmp_packet *rpl; 512 513 /* 514 * If we cant find the connection, ignore the request. 515 */ 516 if ((oldconn = FindConn(rconn)) == NULL) { 517 syslog(LOG_ERR, "BootDone: no existing connection (%s)", 518 EnetStr(rconn)); 519 return(0); 520 } 521 522 rpl = &oldconn->rmp; /* cache ptr to RMP packet */ 523 524 /* 525 * Make sure Session ID's match. 526 */ 527 if (ntohs(rconn->rmp.r_rrq.rmp_session) != 528 ((rpl->r_type == RMP_BOOT_REPL)? ntohs(rpl->r_brpl.rmp_session): 529 ntohs(rpl->r_rrpl.rmp_session))) { 530 syslog(LOG_ERR, "BootDone: bad session id (%s)", 531 EnetStr(rconn)); 532 return(0); 533 } 534 535 RemoveConn(oldconn); /* remove connection */ 536 537 syslog(LOG_INFO, "%s: boot complete", EnetStr(rconn)); 538 539 return(1); 540 } 541 542 /* 543 ** SendPacket -- send an RMP packet to a remote host. 544 ** 545 ** Parameters: 546 ** rconn - packet to be sent. 547 ** 548 ** Returns: 549 ** 1 on success, 0 on failure. 550 ** 551 ** Side Effects: 552 ** none. 553 */ 554 int 555 SendPacket(RMPCONN *rconn) 556 { 557 /* 558 * Set Ethernet Destination address to Source (BPF and the enet 559 * driver will take care of getting our source address set). 560 */ 561 bcopy((char *)&rconn->rmp.hp_hdr.saddr[0], 562 (char *)&rconn->rmp.hp_hdr.daddr[0], RMP_ADDRLEN); 563 rconn->rmp.hp_hdr.len = htons(rconn->rmplen - sizeof(struct hp_hdr)); 564 565 /* 566 * Reverse 802.2/HP Extended Source & Destination Access Pts. 567 */ 568 rconn->rmp.hp_llc.dxsap = htons(HPEXT_SXSAP); 569 rconn->rmp.hp_llc.sxsap = htons(HPEXT_DXSAP); 570 571 /* 572 * Last time this connection was active. 573 */ 574 (void) gettimeofday(&rconn->tstamp, (struct timezone *)0); 575 576 if (DbgFp != NULL) /* display packet */ 577 DispPkt(rconn,DIR_SENT); 578 579 /* 580 * Send RMP packet to remote host. 581 */ 582 return(BpfWrite(rconn)); 583 } 584