1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1988, 1992 The University of Utah and the Center 5 * for Software Science (CSS). 6 * Copyright (c) 1992, 1993 7 * The Regents of the University of California. All rights reserved. 8 * 9 * This code is derived from software contributed to Berkeley by 10 * the Center for Software Science of the University of Utah Computer 11 * Science Department. CSS requests users of this software to return 12 * to css-dist@cs.utah.edu any improvements that they make and grant 13 * CSS redistribution rights. 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions 17 * are met: 18 * 1. Redistributions of source code must retain the above copyright 19 * notice, this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright 21 * notice, this list of conditions and the following disclaimer in the 22 * documentation and/or other materials provided with the distribution. 23 * 3. Neither the name of the University nor the names of its contributors 24 * may be used to endorse or promote products derived from this software 25 * without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 28 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 29 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 30 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37 * SUCH DAMAGE. 38 * 39 * From: Utah Hdr: rmpproto.c 3.1 92/07/06 40 * Author: Jeff Forys, University of Utah CSS 41 */ 42 43 #ifndef lint 44 #endif /* not lint */ 45 46 #include <sys/param.h> 47 #include <sys/time.h> 48 #include <netinet/in.h> 49 50 #include <errno.h> 51 #include <fcntl.h> 52 #include <stdio.h> 53 #include <string.h> 54 #include <syslog.h> 55 #include <unistd.h> 56 #include "defs.h" 57 58 /* 59 ** ProcessPacket -- determine packet type and do what's required. 60 ** 61 ** An RMP BOOT packet has been received. Look at the type field 62 ** and process Boot Requests, Read Requests, and Boot Complete 63 ** packets. Any other type will be dropped with a warning msg. 64 ** 65 ** Parameters: 66 ** rconn - the new connection 67 ** client - list of files available to this host 68 ** 69 ** Returns: 70 ** Nothing. 71 ** 72 ** Side Effects: 73 ** - If this is a valid boot request, it will be added to 74 ** the linked list of outstanding requests (RmpConns). 75 ** - If this is a valid boot complete, its associated 76 ** entry in RmpConns will be deleted. 77 ** - Also, unless we run out of memory, a reply will be 78 ** sent to the host that sent the packet. 79 */ 80 void 81 ProcessPacket(RMPCONN *rconn, CLIENT *client) 82 { 83 struct rmp_packet *rmp; 84 RMPCONN *rconnout; 85 86 rmp = &rconn->rmp; /* cache pointer to RMP packet */ 87 88 switch(rmp->r_type) { /* do what we came here to do */ 89 case RMP_BOOT_REQ: /* boot request */ 90 if ((rconnout = NewConn(rconn)) == NULL) 91 return; 92 93 /* 94 * If the Session ID is 0xffff, this is a "probe" 95 * packet and we do not want to add the connection 96 * to the linked list of active connections. There 97 * are two types of probe packets, if the Sequence 98 * Number is 0 they want to know our host name, o/w 99 * they want the name of the file associated with 100 * the number spec'd by the Sequence Number. 101 * 102 * If this is an actual boot request, open the file 103 * and send a reply. If SendBootRepl() does not 104 * return 0, add the connection to the linked list 105 * of active connections, otherwise delete it since 106 * an error was encountered. 107 */ 108 if (ntohs(rmp->r_brq.rmp_session) == RMP_PROBESID) { 109 if (WORDZE(rmp->r_brq.rmp_seqno)) 110 (void) SendServerID(rconnout); 111 else 112 (void) SendFileNo(rmp, rconnout, 113 client? client->files: 114 BootFiles); 115 FreeConn(rconnout); 116 } else { 117 if (SendBootRepl(rmp, rconnout, 118 client? client->files: BootFiles)) 119 AddConn(rconnout); 120 else 121 FreeConn(rconnout); 122 } 123 break; 124 125 case RMP_BOOT_REPL: /* boot reply (not valid) */ 126 syslog(LOG_WARNING, "%s: sent a boot reply", 127 EnetStr(rconn)); 128 break; 129 130 case RMP_READ_REQ: /* read request */ 131 /* 132 * Send a portion of the boot file. 133 */ 134 (void) SendReadRepl(rconn); 135 break; 136 137 case RMP_READ_REPL: /* read reply (not valid) */ 138 syslog(LOG_WARNING, "%s: sent a read reply", 139 EnetStr(rconn)); 140 break; 141 142 case RMP_BOOT_DONE: /* boot complete */ 143 /* 144 * Remove the entry from the linked list of active 145 * connections. 146 */ 147 (void) BootDone(rconn); 148 break; 149 150 default: /* unknown RMP packet type */ 151 syslog(LOG_WARNING, "%s: unknown packet type (%u)", 152 EnetStr(rconn), rmp->r_type); 153 } 154 } 155 156 /* 157 ** SendServerID -- send our host name to who ever requested it. 158 ** 159 ** Parameters: 160 ** rconn - the reply packet to be formatted. 161 ** 162 ** Returns: 163 ** 1 on success, 0 on failure. 164 ** 165 ** Side Effects: 166 ** none. 167 */ 168 int 169 SendServerID(RMPCONN *rconn) 170 { 171 struct rmp_packet *rpl; 172 char *src, *dst; 173 u_int8_t *size; 174 175 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 176 177 /* 178 * Set up assorted fields in reply packet. 179 */ 180 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 181 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 182 ZEROWORD(rpl->r_brpl.rmp_seqno); 183 rpl->r_brpl.rmp_session = 0; 184 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 185 186 size = &rpl->r_brpl.rmp_flnmsize; /* ptr to length of host name */ 187 188 /* 189 * Copy our host name into the reply packet incrementing the 190 * length as we go. Stop at RMP_HOSTLEN or the first dot. 191 */ 192 src = MyHost; 193 dst = (char *) &rpl->r_brpl.rmp_flnm; 194 for (*size = 0; *size < RMP_HOSTLEN; (*size)++) { 195 if (*src == '.' || *src == '\0') 196 break; 197 *dst++ = *src++; 198 } 199 200 rconn->rmplen = RMPBOOTSIZE(*size); /* set packet length */ 201 202 return(SendPacket(rconn)); /* send packet */ 203 } 204 205 /* 206 ** SendFileNo -- send the name of a bootable file to the requester. 207 ** 208 ** Parameters: 209 ** req - RMP BOOT packet containing the request. 210 ** rconn - the reply packet to be formatted. 211 ** filelist - list of files available to the requester. 212 ** 213 ** Returns: 214 ** 1 on success, 0 on failure. 215 ** 216 ** Side Effects: 217 ** none. 218 */ 219 int 220 SendFileNo(struct rmp_packet *req, RMPCONN *rconn, char *filelist[]) 221 { 222 struct rmp_packet *rpl; 223 char *src, *dst; 224 u_int8_t *size; 225 int i; 226 227 GETWORD(req->r_brpl.rmp_seqno, i); /* SeqNo is really FileNo */ 228 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 229 230 /* 231 * Set up assorted fields in reply packet. 232 */ 233 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 234 PUTWORD(i, rpl->r_brpl.rmp_seqno); 235 i--; 236 rpl->r_brpl.rmp_session = 0; 237 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 238 239 size = &rpl->r_brpl.rmp_flnmsize; /* ptr to length of filename */ 240 *size = 0; /* init length to zero */ 241 242 /* 243 * Copy the file name into the reply packet incrementing the 244 * length as we go. Stop at end of string or when RMPBOOTDATA 245 * characters have been copied. Also, set return code to 246 * indicate success or "no more files". 247 */ 248 if (i < C_MAXFILE && filelist[i] != NULL) { 249 src = filelist[i]; 250 dst = (char *)&rpl->r_brpl.rmp_flnm; 251 for (; *src && *size < RMPBOOTDATA; (*size)++) { 252 if (*src == '\0') 253 break; 254 *dst++ = *src++; 255 } 256 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 257 } else 258 rpl->r_brpl.rmp_retcode = RMP_E_NODFLT; 259 260 rconn->rmplen = RMPBOOTSIZE(*size); /* set packet length */ 261 262 return(SendPacket(rconn)); /* send packet */ 263 } 264 265 /* 266 ** SendBootRepl -- open boot file and respond to boot request. 267 ** 268 ** Parameters: 269 ** req - RMP BOOT packet containing the request. 270 ** rconn - the reply packet to be formatted. 271 ** filelist - list of files available to the requester. 272 ** 273 ** Returns: 274 ** 1 on success, 0 on failure. 275 ** 276 ** Side Effects: 277 ** none. 278 */ 279 int 280 SendBootRepl(struct rmp_packet *req, RMPCONN *rconn, char *filelist[]) 281 { 282 int retval; 283 char *filename, filepath[RMPBOOTDATA+1]; 284 RMPCONN *oldconn; 285 struct rmp_packet *rpl; 286 char *src, *dst1, *dst2; 287 u_int8_t i; 288 289 /* 290 * If another connection already exists, delete it since we 291 * are obviously starting again. 292 */ 293 if ((oldconn = FindConn(rconn)) != NULL) { 294 syslog(LOG_WARNING, "%s: dropping existing connection", 295 EnetStr(oldconn)); 296 RemoveConn(oldconn); 297 } 298 299 rpl = &rconn->rmp; /* cache ptr to RMP packet */ 300 301 /* 302 * Set up assorted fields in reply packet. 303 */ 304 rpl->r_brpl.rmp_type = RMP_BOOT_REPL; 305 COPYWORD(req->r_brq.rmp_seqno, rpl->r_brpl.rmp_seqno); 306 rpl->r_brpl.rmp_session = htons(GenSessID()); 307 rpl->r_brpl.rmp_version = htons(RMP_VERSION); 308 rpl->r_brpl.rmp_flnmsize = req->r_brq.rmp_flnmsize; 309 310 /* 311 * Copy file name to `filepath' string, and into reply packet. 312 */ 313 src = &req->r_brq.rmp_flnm; 314 dst1 = filepath; 315 dst2 = &rpl->r_brpl.rmp_flnm; 316 for (i = 0; i < req->r_brq.rmp_flnmsize; i++) 317 *dst1++ = *dst2++ = *src++; 318 *dst1 = '\0'; 319 320 /* 321 * If we are booting HP-UX machines, their secondary loader will 322 * ask for files like "/hp-ux". As a security measure, we do not 323 * allow boot files to lay outside the boot directory (unless they 324 * are purposely link'd out. So, make `filename' become the path- 325 * stripped file name and spoof the client into thinking that it 326 * really got what it wanted. 327 */ 328 filename = strrchr(filepath,'/'); 329 filename = filename? filename + 1: filepath; 330 331 /* 332 * Check that this is a valid boot file name. 333 */ 334 for (i = 0; i < C_MAXFILE && filelist[i] != NULL; i++) 335 if (STREQN(filename, filelist[i])) 336 goto match; 337 338 /* 339 * Invalid boot file name, set error and send reply packet. 340 */ 341 rpl->r_brpl.rmp_retcode = RMP_E_NOFILE; 342 retval = 0; 343 goto sendpkt; 344 345 match: 346 /* 347 * This is a valid boot file. Open the file and save the file 348 * descriptor associated with this connection and set success 349 * indication. If the file couldnt be opened, set error: 350 * "no such file or dir" - RMP_E_NOFILE 351 * "file table overflow" - RMP_E_BUSY 352 * "too many open files" - RMP_E_BUSY 353 * anything else - RMP_E_OPENFILE 354 */ 355 if ((rconn->bootfd = open(filename, O_RDONLY, 0600)) < 0) { 356 rpl->r_brpl.rmp_retcode = (errno == ENOENT)? RMP_E_NOFILE: 357 (errno == EMFILE || errno == ENFILE)? RMP_E_BUSY: 358 RMP_E_OPENFILE; 359 retval = 0; 360 } else { 361 rpl->r_brpl.rmp_retcode = RMP_E_OKAY; 362 retval = 1; 363 } 364 365 sendpkt: 366 syslog(LOG_INFO, "%s: request to boot %s (%s)", 367 EnetStr(rconn), filename, retval? "granted": "denied"); 368 369 rconn->rmplen = RMPBOOTSIZE(rpl->r_brpl.rmp_flnmsize); 370 371 return (retval & SendPacket(rconn)); 372 } 373 374 /* 375 ** SendReadRepl -- send a portion of the boot file to the requester. 376 ** 377 ** Parameters: 378 ** rconn - the reply packet to be formatted. 379 ** 380 ** Returns: 381 ** 1 on success, 0 on failure. 382 ** 383 ** Side Effects: 384 ** none. 385 */ 386 int 387 SendReadRepl(RMPCONN *rconn) 388 { 389 int retval = 0; 390 RMPCONN *oldconn; 391 struct rmp_packet *rpl, *req; 392 int size = 0; 393 int madeconn = 0; 394 395 /* 396 * Find the old connection. If one doesn't exist, create one only 397 * to return the error code. 398 */ 399 if ((oldconn = FindConn(rconn)) == NULL) { 400 if ((oldconn = NewConn(rconn)) == NULL) 401 return(0); 402 syslog(LOG_ERR, "SendReadRepl: no active connection (%s)", 403 EnetStr(rconn)); 404 madeconn++; 405 } 406 407 req = &rconn->rmp; /* cache ptr to request packet */ 408 rpl = &oldconn->rmp; /* cache ptr to reply packet */ 409 410 if (madeconn) { /* no active connection above; abort */ 411 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 412 retval = 1; 413 goto sendpkt; 414 } 415 416 /* 417 * Make sure Session ID's match. 418 */ 419 if (ntohs(req->r_rrq.rmp_session) != 420 ((rpl->r_type == RMP_BOOT_REPL)? ntohs(rpl->r_brpl.rmp_session): 421 ntohs(rpl->r_rrpl.rmp_session))) { 422 syslog(LOG_ERR, "SendReadRepl: bad session id (%s)", 423 EnetStr(rconn)); 424 rpl->r_rrpl.rmp_retcode = RMP_E_BADSID; 425 retval = 1; 426 goto sendpkt; 427 } 428 429 /* 430 * If the requester asks for more data than we can fit, 431 * silently clamp the request size down to RMPREADDATA. 432 * 433 * N.B. I do not know if this is "legal", however it seems 434 * to work. This is necessary for bpfwrite() on machines 435 * with MCLBYTES less than 1514. 436 */ 437 if (ntohs(req->r_rrq.rmp_size) > RMPREADDATA) 438 req->r_rrq.rmp_size = htons(RMPREADDATA); 439 440 /* 441 * Position read head on file according to info in request packet. 442 */ 443 GETWORD(req->r_rrq.rmp_offset, size); 444 if (lseek(oldconn->bootfd, (off_t)size, SEEK_SET) < 0) { 445 syslog(LOG_ERR, "SendReadRepl: lseek: %m (%s)", 446 EnetStr(rconn)); 447 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 448 retval = 1; 449 goto sendpkt; 450 } 451 452 /* 453 * Read data directly into reply packet. 454 */ 455 if ((size = read(oldconn->bootfd, &rpl->r_rrpl.rmp_data, 456 (int) ntohs(req->r_rrq.rmp_size))) <= 0) { 457 if (size < 0) { 458 syslog(LOG_ERR, "SendReadRepl: read: %m (%s)", 459 EnetStr(rconn)); 460 rpl->r_rrpl.rmp_retcode = RMP_E_ABORT; 461 } else { 462 rpl->r_rrpl.rmp_retcode = RMP_E_EOF; 463 } 464 retval = 1; 465 goto sendpkt; 466 } 467 468 /* 469 * Set success indication. 470 */ 471 rpl->r_rrpl.rmp_retcode = RMP_E_OKAY; 472 473 sendpkt: 474 /* 475 * Set up assorted fields in reply packet. 476 */ 477 rpl->r_rrpl.rmp_type = RMP_READ_REPL; 478 COPYWORD(req->r_rrq.rmp_offset, rpl->r_rrpl.rmp_offset); 479 rpl->r_rrpl.rmp_session = req->r_rrq.rmp_session; 480 481 oldconn->rmplen = RMPREADSIZE(size); /* set size of packet */ 482 483 retval &= SendPacket(oldconn); /* send packet */ 484 485 if (madeconn) /* clean up after ourself */ 486 FreeConn(oldconn); 487 488 return (retval); 489 } 490 491 /* 492 ** BootDone -- free up memory allocated for a connection. 493 ** 494 ** Parameters: 495 ** rconn - incoming boot complete packet. 496 ** 497 ** Returns: 498 ** 1 on success, 0 on failure. 499 ** 500 ** Side Effects: 501 ** none. 502 */ 503 int 504 BootDone(RMPCONN *rconn) 505 { 506 RMPCONN *oldconn; 507 struct rmp_packet *rpl; 508 509 /* 510 * If we can't find the connection, ignore the request. 511 */ 512 if ((oldconn = FindConn(rconn)) == NULL) { 513 syslog(LOG_ERR, "BootDone: no existing connection (%s)", 514 EnetStr(rconn)); 515 return(0); 516 } 517 518 rpl = &oldconn->rmp; /* cache ptr to RMP packet */ 519 520 /* 521 * Make sure Session ID's match. 522 */ 523 if (ntohs(rconn->rmp.r_rrq.rmp_session) != 524 ((rpl->r_type == RMP_BOOT_REPL)? ntohs(rpl->r_brpl.rmp_session): 525 ntohs(rpl->r_rrpl.rmp_session))) { 526 syslog(LOG_ERR, "BootDone: bad session id (%s)", 527 EnetStr(rconn)); 528 return(0); 529 } 530 531 RemoveConn(oldconn); /* remove connection */ 532 533 syslog(LOG_INFO, "%s: boot complete", EnetStr(rconn)); 534 535 return(1); 536 } 537 538 /* 539 ** SendPacket -- send an RMP packet to a remote host. 540 ** 541 ** Parameters: 542 ** rconn - packet to be sent. 543 ** 544 ** Returns: 545 ** 1 on success, 0 on failure. 546 ** 547 ** Side Effects: 548 ** none. 549 */ 550 int 551 SendPacket(RMPCONN *rconn) 552 { 553 /* 554 * Set Ethernet Destination address to Source (BPF and the enet 555 * driver will take care of getting our source address set). 556 */ 557 memmove((char *)&rconn->rmp.hp_hdr.daddr[0], 558 (char *)&rconn->rmp.hp_hdr.saddr[0], RMP_ADDRLEN); 559 rconn->rmp.hp_hdr.len = htons(rconn->rmplen - sizeof(struct hp_hdr)); 560 561 /* 562 * Reverse 802.2/HP Extended Source & Destination Access Pts. 563 */ 564 rconn->rmp.hp_llc.dxsap = htons(HPEXT_SXSAP); 565 rconn->rmp.hp_llc.sxsap = htons(HPEXT_DXSAP); 566 567 /* 568 * Last time this connection was active. 569 */ 570 (void)gettimeofday(&rconn->tstamp, NULL); 571 572 if (DbgFp != NULL) /* display packet */ 573 DispPkt(rconn,DIR_SENT); 574 575 /* 576 * Send RMP packet to remote host. 577 */ 578 return(BpfWrite(rconn)); 579 } 580