ideawu / tftpx

TFTP server and client implementation in C

TFTP的扩展和实现

这个项目是我在大学学习时开发的, 后来成为几乎所有人的课堂作业. http://www.ideawu.net/person/tftpx/

用C语言开发的在Linux平台上的TFTP(RFC1350)服务器端和客户端. 支持目录列表, 可变块大小(RFC2348). 传输模式只支持二进制模式.

停止等待(Stop and Wait)和自动重传(ARQ)机制作为数据传输的基本机制, 是网络编程必须要掌握的技能. TFTP 协议使用基于UDP的停止等待和超时重传机制来实现文件的可靠传输.

在查看 tftpx 的源码之前, 你最好先阅读 W.Richard.Stevens 的 TCP/IP Illustrated Volume 1: The Protocols(TCP/IP详解 卷1:协议).

tftpx 使用这样的代码来实现停止等待机制:

int send_packet(int sock, struct tftpx_packet *packet, int size){
	struct tftpx_packet rcv_packet;
	int time_wait_ack = 0;
	int rxmt = 0;
	int r_size = 0;

	for(rxmt = 0; rxmt < PKT_MAX_RXMT; rxmt ++){
		printf("Send block=%d\n", ntohs(packet->block));
		if(send(sock, packet, size, 0) != size){
			return -1;
		}
		for(time_wait_ack = 0; time_wait_ack < PKT_RCV_TIMEOUT; time_wait_ack += 20000){
			usleep(20000);
			// Try receive(Nonblock receive).
			r_size = recv(sock, &rcv_packet, sizeof(struct tftpx_packet), MSG_DONTWAIT);
			if(r_size >= 4 && rcv_packet.cmd == htons(CMD_ACK) && rcv_packet.block == packet->block){
				//printf("ACK: block=%d\n", ntohs(rcv_packet.block));
				// Valid ACK
				break;
			}
		}
		if(time_wait_ack < PKT_RCV_TIMEOUT){
			break;
		}else{
			// Retransmission.
			continue;
		}
	}
	if(rxmt == PKT_MAX_RXMT){
		// send timeout
		printf("Sent packet exceeded PKT_MAX_RXMT.\n");
		return -1;
	}

	return size;
}

tftpx's Issues

endian conversion problem in threaded request dispatcher

// Choose handler
switch(request->packet.cmd){

This should be switch(ntohs(request->packet.cmd)) in my view otherwise it will only work on big endian machines.

his really works!!!

thanks for sharing

Lack of resolution of current path leads to directory traversal vulnerability

The following code exists in the handle_rrq function：
`

char *r_path = request->packet.filename;	// request file
    ........
strcat(fullpath, r_path);
    .......
FILE *fp = fopen(fullpath, "r");

`

By not eliminating the "../" from the request path leads to the possibility of passing the request ".. /.. /../.. /.. /../../" Get the files in the root directory

TFTP 是 RFC 1350吧

TFTP 是 RFC 1350，不是1380

上传文件缓存区溢出

client.c:195行：

sprintf(snd_packet.filename, "%s%c%s%c%d%c", filename, 0, "octet", 0, blocksize, 0);

很好奇文件名为什么只有2个字节长度？

struct tftpx_packet{
    ushort cmd;
    union{
        ushort code;
        ushort block;
        // For a RRQ and WRQ TFTP packet
        char filename[2];
    };
    char data[DATA_SIZE];
};

协议数据包存在不兼容情况

你实现的这个tftp客户端与服务器之间是可以正常运行，但是客户端与其他的tftp服务器无法正常工作

License information

Hi!

Can we use this project for comercial purposes ? Would you please add license information in file headers (Creative commons , LGPL , GPL ) ... ?

Thanks,
Samuel