/usr/src/usr.sbin/tftpd/tftpd.c

Bug Summary

File:	src/usr.sbin/tftpd/tftpd.c
Warning:	line 474, column 26 Access to field 's' results in a dereference of a null pointer (loaded from variable 'rwmap')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name tftpd.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/tftpd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/tftpd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/tftpd/tftpd.c
1/*	$OpenBSD: tftpd.c,v 1.50 2022/10/09 23:04:57 kn Exp $	*/

3/*
* Copyright (c) 2012 David Gwynne <dlg@uq.edu.au>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

19/*
* Copyright (c) 1983 Regents of the University of California.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

48/*
* Trivial file transfer protocol server.
*
* This version is based on src/libexec/tftpd which includes many
* modifications by Jim Guyton <guyton@rand-unix>.
*
* It was restructured to be a persistent event driven daemon
* supporting concurrent connections by dlg for use at the University
* of Queensland in the Faculty of Engineering Architecture and
* Information Technology.
*/

60#include <sys/types.h>
61#include <sys/queue.h>
62#include <sys/socket.h>
63#include <sys/stat.h>
64#include <sys/uio.h>
65#include <sys/un.h>

67#include <netinet/in.h>
68#include <arpa/inet.h>
69#include <arpa/tftp.h>
70#include <netdb.h>

72#include <err.h>
73#include <ctype.h>
74#include <errno(*__errno()).h>
75#include <event.h>
76#include <fcntl.h>
77#include <paths.h>
78#include <poll.h>
79#include <pwd.h>
80#include <stdio.h>
81#include <stdlib.h>
82#include <string.h>
83#include <stdarg.h>
84#include <syslog.h>
85#include <unistd.h>
86#include <limits.h>
87#include <vis.h>

89#define TIMEOUT5		5		/* packet rexmt timeout */
90#define TIMEOUT_MIN1	1		/* minimal packet rexmt timeout */
91#define TIMEOUT_MAX255	255		/* maximal packet rexmt timeout */

93#define RETRIES5		5

95#define SEEDPATH"/etc/random.seed"	"/etc/random.seed"

97struct formats;

99enum opt_enum {
OPT_TSIZE = 0,
OPT_TIMEOUT,
OPT_BLKSIZE,
NOPT
104};

106static char *opt_names[] = {
"tsize",
"timeout",
"blksize"
110};

112struct opt_client {
char *o_request;
long long o_reply;
115};


118struct tftp_server {
struct event ev;
TAILQ_ENTRY(tftp_server)struct { struct tftp_server *tqe_next; struct tftp_server **tqe_prev
; } entry;
int s;
122};

124TAILQ_HEAD(, tftp_server)struct { struct tftp_server *tqh_first; struct tftp_server **
tqh_last; } tftp_servers;

126struct tftp_client {
char buf[SEGSIZE_MAX65464 + 4];
struct event sev;
struct sockaddr_storage ss;

struct timeval tv;

TAILQ_ENTRY(tftp_client)struct { struct tftp_client *tqe_next; struct tftp_client **tqe_prev
; } entry;

struct opt_client *options;

size_t segment_size;
size_t packet_size;
size_t buflen;

FILE *file;
int (*fgetc)(struct tftp_client *);
int (*fputc)(struct tftp_client *, int);

u_int retries;
u_int16_t block;

int opcode;
int newline;

int sock;
152};

154__dead__attribute__((__noreturn__)) void	usage(void);
155const char	*getip(void *);
156int		rdaemon(int);

158void		rewrite_connect(const char *);
159void		rewrite_events(void);
160void		rewrite_map(struct tftp_client *, const char *);
161void		rewrite_req(int, short, void *);
162void		rewrite_res(int, short, void *);

164int		tftpd_listen(const char *, const char *, int);
165void		tftpd_events(void);
166void		tftpd_recv(int, short, void *);
167int		retry(struct tftp_client *);
168int		tftp_flush(struct tftp_client *);
169void		tftp_end(struct tftp_client *);

171void		tftp(struct tftp_client *, struct tftphdr *, size_t);
172void		tftp_open(struct tftp_client *, const char *);
173void		nak(struct tftp_client *, int);
174int		oack(struct tftp_client *);
175void		oack_done(int, short, void *);

177void		sendfile(struct tftp_client *);
178void		recvfile(struct tftp_client *);
179int		fget_octet(struct tftp_client *);
180int		fput_octet(struct tftp_client *, int);
181int		fget_netascii(struct tftp_client *);
182int		fput_netascii(struct tftp_client *, int);
183void		file_read(struct tftp_client *);
184void		tftp_send(struct tftp_client *);
185int		tftp_wrq_ack_packet(struct tftp_client *);
186void		tftp_rrq_ack(int, short, void *);
187void		tftp_wrq_ack(struct tftp_client *client);
188void		tftp_wrq(int, short, void *);
189void		tftp_wrq_end(int, short, void *);

191int		parse_options(struct tftp_client *, char *, size_t,
    struct opt_client *);
193int		validate_access(struct tftp_client *, const char *);

195struct tftp_client *
client_alloc(void);
197void		client_free(struct tftp_client *client);

199struct formats {
const char	*f_mode;
int (*f_getc)(struct tftp_client *);
int (*f_putc)(struct tftp_client *, int);
203} formats[] = {
{ "octet",	fget_octet,	fput_octet },
{ "netascii",	fget_netascii,	fput_netascii },
{ NULL((void *)0),		NULL((void *)0) }
207};

209struct errmsg {
int		 e_code;
const char	*e_msg;
212} errmsgs[] = {
{ EUNDEF0,	"Undefined error code" },
{ ENOTFOUND1,	"File not found" },
{ EACCESS2,	"Access violation" },
{ ENOSPACE3,	"Disk full or allocation exceeded" },
{ EBADOP4,	"Illegal TFTP operation" },
{ EBADID5,	"Unknown transfer ID" },
{ EEXISTS6,	"File already exists" },
{ ENOUSER7,	"No such user" },
{ EOPTNEG8,	"Option negotiation failed" },
{ -1,		NULL((void *)0) }
223};

225struct loggers {
__dead__attribute__((__noreturn__)) void (*err)(int, const char *, ...)
   __attribute__((__format__ (printf, 2, 3)));
__dead__attribute__((__noreturn__)) void (*errx)(int, const char *, ...)
   __attribute__((__format__ (printf, 2, 3)));
void (*warn)(const char *, ...)
   __attribute__((__format__ (printf, 1, 2)));
void (*warnx)(const char *, ...)
   __attribute__((__format__ (printf, 1, 2)));
void (*info)(const char *, ...)
   __attribute__((__format__ (printf, 1, 2)));
void (*debug)(const char *, ...)
   __attribute__((__format__ (printf, 1, 2)));
238};

240const struct loggers conslogger = {
err,
errx,
warn,
warnx,
warnx, /* info */
warnx /* debug */
247};

249__dead__attribute__((__noreturn__)) void	syslog_err(int, const char *, ...)
    __attribute__((__format__ (printf, 2, 3)));
251__dead__attribute__((__noreturn__)) void	syslog_errx(int, const char *, ...)
    __attribute__((__format__ (printf, 2, 3)));
253void		syslog_warn(const char *, ...)
    __attribute__((__format__ (printf, 1, 2)));
255void		syslog_warnx(const char *, ...)
    __attribute__((__format__ (printf, 1, 2)));
257void		syslog_info(const char *, ...)
    __attribute__((__format__ (printf, 1, 2)));
259void		syslog_debug(const char *, ...)
    __attribute__((__format__ (printf, 1, 2)));
261void		syslog_vstrerror(int, int, const char *, va_list)
    __attribute__((__format__ (printf, 3, 0)));

264const struct loggers syslogger = {
syslog_err,
syslog_errx,
syslog_warn,
syslog_warnx,
syslog_info,
syslog_debug
271};

273const struct loggers *logger = &conslogger;

275#define lerr(_e, _f...)logger->err((_e), _f...) logger->err((_e), _f)
276#define lerrx(_e, _f...)logger->errx((_e), _f...) logger->errx((_e), _f)
277#define lwarn(_f...)logger->warn(_f...) logger->warn(_f)
278#define lwarnx(_f...)logger->warnx(_f...) logger->warnx(_f)
279#define linfo(_f...)logger->info(_f...) logger->info(_f)
280#define ldebug(_f...)logger->debug(_f...) logger->debug(_f)

282__dead__attribute__((__noreturn__)) void
283usage(void)
284{
extern char *__progname;
fprintf(stderr(&__sF[2]), "usage: %s [-46cdivw] [-l address] [-p port] [-r socket]"
   " directory\n", __progname);
exit(1);
289}

291int		  cancreate = 0;
292int		  canwrite = 0;
293int		  verbose = 0;
294int		  debug = 0;
295int		  iflag = 0;

297int
298main(int argc, char *argv[])
299{
extern char *__progname;

int		 c;
struct passwd	*pw;

char *dir = NULL((void *)0);
char *rewrite = NULL((void *)0);

char *addr = NULL((void *)0);
char *port = "tftp";
int family = AF_UNSPEC0;
int devnull = -1;

while ((c = getopt(argc, argv, "46cdil:p:r:vw")) != -1) {
1
Assuming the condition is true→
2
←
Loop condition is true.  Entering loop body→
4
←
 Execution continues on line 313→
5
←
Assuming the condition is true→
6
←
Loop condition is true.  Entering loop body→
9
←
 Execution continues on line 313→
10
←
Assuming the condition is true→
11
←
Loop condition is true.  Entering loop body→
13
←
 Execution continues on line 313→
14
←
Assuming the condition is false→
15
←
Loop condition is false. Execution continues on line 355→
switch (c) {
3
←
Control jumps to 'case 112:'  at line 335→
7
←
Control jumps to 'case 114:'  at line 338→
12
←
Control jumps to 'case 100:'  at line 324→
case '4':
	family = AF_INET2;
	break;
case '6':
	family = AF_INET624;
	break;
case 'c':
	canwrite = cancreate = 1;
	break;
case 'd':
	verbose = debug = 1;
	break;
case 'i':
	if (rewrite != NULL((void *)0))
		errx(1, "options -i and -r are incompatible");
	iflag = 1;
	break;
case 'l':
	addr = optarg;
	break;
case 'p':
	port = optarg;
	break;
case 'r':
	if (iflag7.1
'iflag' is not equal to 1
 == 1)
8
←
Taking false branch→
		errx(1, "options -i and -r are incompatible");
	rewrite = optarg;
	break;
case 'v':
	verbose = 1;
	break;
case 'w':
	canwrite = 1;
	break;
default:
	usage();
	/* NOTREACHED */
}
}

argc -= optind;
argv += optind;

if (argc != 1)
16
←
Assuming 'argc' is equal to 1→
17
←
Taking false branch→
usage();

dir = argv[0];

if (geteuid() != 0)
18
←
Assuming the condition is false→
19
←
Taking false branch→
errx(1, "need root privileges");

pw = getpwnam("_tftpd");
if (pw == NULL((void *)0))
20
←
Assuming 'pw' is not equal to NULL→
21
←
Taking false branch→
errx(1, "no _tftpd user");

if (!debug21.1
'debug' is 1
) {
22
←
Taking false branch→
openlog(__progname, LOG_PID0x01|LOG_NDELAY0x08, LOG_DAEMON(3<<3));
tzset();
logger = &syslogger;
devnull = open(_PATH_DEVNULL"/dev/null", O_RDWR0x0002);
if (devnull == -1)
	err(1, "open %s", _PATH_DEVNULL"/dev/null");
}

if (rewrite != NULL((void *)0))
23
←
Assuming 'rewrite' is not equal to NULL→
24
←
Taking true branch→
rewrite_connect(rewrite);

tftpd_listen(addr, port, family);

if (chroot(dir))
25
←
Assuming the condition is false→
26
←
Taking false branch→
err(1, "chroot %s", dir);
if (chdir("/"))
27
←
Assuming the condition is false→
err(1, "chdir %s", dir);

/* drop privs */
if (setgroups(1, &pw->pw_gid) ||
28
←
Assuming the condition is false→
   setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
29
←
Assuming the condition is false→
   setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
30
←
Assuming the condition is false→
errx(1, "can't drop privileges");

if (!debug30.1
'debug' is 0
 && rdaemon(devnull) == -1)
31
←
Assuming the condition is false→
32
←
Taking false branch→
err(1, "unable to daemonize");

if (cancreate32.1
'cancreate' is 0
) {
33
←
Taking false branch→
if (pledge("stdio rpath wpath cpath fattr dns inet", NULL((void *)0)) == -1)
	lerr(1, "pledge")logger->err((1), "pledge");
} else if (canwrite33.1
'canwrite' is 0
) {
34
←
Taking false branch→
if (pledge("stdio rpath wpath dns inet", NULL((void *)0)) == -1)
	lerr(1, "pledge")logger->err((1), "pledge");
} else {
if (pledge("stdio rpath dns inet", NULL((void *)0)) == -1)
35
←
Assuming the condition is false→
36
←
Taking false branch→
	lerr(1, "pledge")logger->err((1), "pledge");
}

event_init();

if (rewrite36.1
'rewrite' is not equal to NULL
 != NULL((void *)0))
37
←
Taking true branch→
rewrite_events();
38
←
Calling 'rewrite_events'→

tftpd_events();

event_dispatch();

exit(0);
419}

421struct rewritemap {
struct event wrev;
struct event rdev;
struct evbuffer *wrbuf;
struct evbuffer *rdbuf;

TAILQ_HEAD(, tftp_client)struct { struct tftp_client *tqh_first; struct tftp_client **
tqh_last; } clients;

int s;
430};

432struct rewritemap *rwmap = NULL((void *)0);

434void
435rewrite_connect(const char *path)
436{
int s;
struct sockaddr_un remote;
size_t len;

rwmap = malloc(sizeof(*rwmap));
if (rwmap == NULL((void *)0))
err(1, "rewrite event malloc");

rwmap->wrbuf = evbuffer_new();
if (rwmap->wrbuf == NULL((void *)0))
err(1, "rewrite wrbuf");

rwmap->rdbuf = evbuffer_new();
if (rwmap->rdbuf == NULL((void *)0))
err(1, "rewrite rdbuf");

TAILQ_INIT(&rwmap->clients)do { (&rwmap->clients)->tqh_first = ((void *)0); (&
rwmap->clients)->tqh_last = &(&rwmap->clients
)->tqh_first; } while (0);

s = socket(AF_UNIX1, SOCK_STREAM1 | SOCK_NONBLOCK0x4000, 0);
if (s == -1)
err(1, "rewrite socket");

remote.sun_family = AF_UNIX1;
len = strlcpy(remote.sun_path, path, sizeof(remote.sun_path));
if (len >= sizeof(remote.sun_path))
errx(1, "rewrite socket path is too long");

len += sizeof(remote.sun_family) + 1;
if (connect(s, (struct sockaddr *)&remote, len) == -1)
err(1, "%s", path);

rwmap->s = s;
469}

471void
472rewrite_events(void)
473{
event_set(&rwmap->wrev, rwmap->s, EV_WRITE0x04, rewrite_req, NULL((void *)0));
39
←
Access to field 's' results in a dereference of a null pointer (loaded from variable 'rwmap')
event_set(&rwmap->rdev, rwmap->s, EV_READ0x02 | EV_PERSIST0x10, rewrite_res, NULL((void *)0));
event_add(&rwmap->rdev, NULL((void *)0));
477}

479void
480rewrite_map(struct tftp_client *client, const char *filename)
481{
char *nicebuf;

if (stravis(&nicebuf, filename, VIS_SAFE0x20|VIS_OCTAL0x01) == -1)
lerr(1, "rwmap stravis")logger->err((1), "rwmap stravis");

if (evbuffer_add_printf(rwmap->wrbuf, "%s %s %s\n", getip(&client->ss),
   client->opcode == WRQ02 ? "write" : "read", nicebuf) == -1)
lerr(1, "rwmap printf")logger->err((1), "rwmap printf");

free(nicebuf);

TAILQ_INSERT_TAIL(&rwmap->clients, client, entry)do { (client)->entry.tqe_next = ((void *)0); (client)->
entry.tqe_prev = (&rwmap->clients)->tqh_last; *(&
rwmap->clients)->tqh_last = (client); (&rwmap->clients
)->tqh_last = &(client)->entry.tqe_next; } while (0
);

event_add(&rwmap->wrev, NULL((void *)0));
496}

498void
499rewrite_req(int fd, short events, void *arg)
500{
if (evbuffer_write(rwmap->wrbuf, fd) == -1) {
switch (errno(*__errno())) {
case EINTR4:
case EAGAIN35:
	event_add(&rwmap->wrev, NULL((void *)0));
	return;
}

lerr(1, "rewrite socket write")logger->err((1), "rewrite socket write");
}

if (EVBUFFER_LENGTH(rwmap->wrbuf)(rwmap->wrbuf)->off)
event_add(&rwmap->wrev, NULL((void *)0));
514}

516void
517rewrite_res(int fd, short events, void *arg)
518{
struct tftp_client *client;
char *filename;
size_t len;

switch (evbuffer_read(rwmap->rdbuf, fd, PATH_MAX1024)) {
case -1:
switch (errno(*__errno())) {
case EINTR4:
case EAGAIN35:
	return;
}
lerr(1, "rewrite socket read")logger->err((1), "rewrite socket read");
case 0:
lerrx(1, "rewrite socket closed")logger->errx((1), "rewrite socket closed");
default:
break;
}

while ((filename = evbuffer_readln(rwmap->rdbuf, &len,
   EVBUFFER_EOL_LF)) != NULL((void *)0)) {
client = TAILQ_FIRST(&rwmap->clients)((&rwmap->clients)->tqh_first);
if (client == NULL((void *)0))
	lerrx(1, "unexpected rwmap reply")logger->errx((1), "unexpected rwmap reply");

TAILQ_REMOVE(&rwmap->clients, client, entry)do { if (((client)->entry.tqe_next) != ((void *)0)) (client
)->entry.tqe_next->entry.tqe_prev = (client)->entry.
tqe_prev; else (&rwmap->clients)->tqh_last = (client
)->entry.tqe_prev; *(client)->entry.tqe_prev = (client)
->entry.tqe_next; ; ; } while (0);

tftp_open(client, filename);

free(filename);
};
549}

551int
552tftpd_listen(const char *addr, const char *port, int family)
553{
struct tftp_server *server;

struct addrinfo hints, *res, *res0;
int error;
int s;

int cerrno = EADDRNOTAVAIL49;
const char *cause = "getaddrinfo";

int on = 1;

memset(&hints, 0, sizeof(hints));
hints.ai_family = family;
hints.ai_socktype = SOCK_DGRAM2;
hints.ai_flags = AI_PASSIVE1;

TAILQ_INIT(&tftp_servers)do { (&tftp_servers)->tqh_first = ((void *)0); (&tftp_servers
)->tqh_last = &(&tftp_servers)->tqh_first; } while
 (0);

error = getaddrinfo(addr, port, &hints, &res0);
if (error) {
errx(1, "%s:%s: %s", addr ? addr : "*", port,
    gai_strerror(error));
}

for (res = res0; res != NULL((void *)0); res = res->ai_next) {
s = socket(res->ai_family, res->ai_socktype | SOCK_NONBLOCK0x4000,
    res->ai_protocol);
if (s == -1) {
	cause = "socket";
	cerrno = errno(*__errno());
	continue;
}

if (bind(s, res->ai_addr, res->ai_addrlen) == -1) {
	cause = "bind";
	cerrno = errno(*__errno());
	close(s);
	continue;
}

switch (res->ai_family) {
case AF_INET2:
	if (setsockopt(s, IPPROTO_IP0, IP_RECVDSTADDR7,
	    &on, sizeof(on)) == -1)
		err(1, "setsockopt(IP_RECVDSTADDR)");
	break;
case AF_INET624:
	if (setsockopt(s, IPPROTO_IPV641, IPV6_RECVPKTINFO36,
	    &on, sizeof(on)) == -1)
		err(1, "setsockopt(IPV6_RECVPKTINFO)");
	break;
}

server = malloc(sizeof(*server));
if (server == NULL((void *)0))
	err(1, "malloc");

server->s = s;
TAILQ_INSERT_TAIL(&tftp_servers, server, entry)do { (server)->entry.tqe_next = ((void *)0); (server)->
entry.tqe_prev = (&tftp_servers)->tqh_last; *(&tftp_servers
)->tqh_last = (server); (&tftp_servers)->tqh_last =
 &(server)->entry.tqe_next; } while (0);
}

if (TAILQ_EMPTY(&tftp_servers)(((&tftp_servers)->tqh_first) == ((void *)0)))
errc(1, cerrno, "%s", cause);

freeaddrinfo(res0);
return (0);
620}

622void
623tftpd_events(void)
624{
struct tftp_server *server;
TAILQ_FOREACH(server, &tftp_servers, entry)for((server) = ((&tftp_servers)->tqh_first); (server) !=
 ((void *)0); (server) = ((server)->entry.tqe_next)) {
event_set(&server->ev, server->s, EV_READ0x02 | EV_PERSIST0x10,
    tftpd_recv, server);
event_add(&server->ev, NULL((void *)0));
}
631}

633struct tftp_client *
634client_alloc(void)
635{
struct tftp_client *client;

client = calloc(1, sizeof(*client));
if (client == NULL((void *)0))
return (NULL((void *)0));

client->segment_size = SEGSIZE512;
client->packet_size = SEGSIZE512 + 4;

client->tv.tv_sec = TIMEOUT5;
client->tv.tv_usec = 0;

client->sock = -1;
client->file = NULL((void *)0);
client->newline = 0;

return (client);
653}

655void
656client_free(struct tftp_client *client)
657{
free(client->options);

if (client->file != NULL((void *)0))
fclose(client->file);

close(client->sock);

free(client);
666}

668void
669tftpd_recv(int fd, short events, void *arg)
670{
union {
struct cmsghdr hdr;
char	buf[CMSG_SPACE(sizeof(struct sockaddr_storage))((((unsigned long)(sizeof(struct cmsghdr)) + (sizeof(long) - 1
)) &~(sizeof(long) - 1)) + (((unsigned long)(sizeof(struct
 sockaddr_storage)) + (sizeof(long) - 1)) &~(sizeof(long)
 - 1)))];
} cmsgbuf;
struct cmsghdr *cmsg;
struct msghdr msg;
struct iovec iov;

ssize_t n;
struct sockaddr_storage s_in;
int dobind = 1;
int on = 1;

struct tftphdr *tp;

struct tftp_client *client;

client = client_alloc();
if (client == NULL((void *)0)) {
char buf[SEGSIZE_MAX65464 + 4];
/* no memory! flush this request... */
recv(fd, buf, SEGSIZE_MAX65464 + 4, 0);
/* dont care if it fails */
return;
}

bzero(&msg, sizeof(msg));
iov.iov_base = client->buf;
iov.iov_len = client->packet_size;
msg.msg_name = &client->ss;
msg.msg_namelen = sizeof(client->ss);
msg.msg_iov = &iov;
msg.msg_iovlen = 1;
msg.msg_control = &cmsgbuf.buf;
msg.msg_controllen = sizeof(cmsgbuf.buf);

n = recvmsg(fd, &msg, 0);
if (n == -1) {
lwarn("recvmsg")logger->warn("recvmsg");
goto err;
}
if (n < 4)
goto err;

client->sock = socket(client->ss.ss_family,
   SOCK_DGRAM2 | SOCK_NONBLOCK0x4000, 0);
if (client->sock == -1) {
lwarn("socket")logger->warn("socket");
goto err;
}
memset(&s_in, 0, sizeof(s_in));
s_in.ss_family = client->ss.ss_family;
s_in.ss_len = client->ss.ss_len;

/* get local address if possible */
for (cmsg = CMSG_FIRSTHDR(&msg)((&msg)->msg_controllen >= sizeof(struct cmsghdr) ?
 (struct cmsghdr *)(&msg)->msg_control : (struct cmsghdr
 *)((void *)0)); cmsg != NULL((void *)0);
   cmsg = CMSG_NXTHDR(&msg, cmsg)(((char *)(cmsg) + (((unsigned long)((cmsg)->cmsg_len) + (
sizeof(long) - 1)) &~(sizeof(long) - 1)) + (((unsigned long
)(sizeof(struct cmsghdr)) + (sizeof(long) - 1)) &~(sizeof
(long) - 1)) > ((char *)(&msg)->msg_control) + (&
msg)->msg_controllen) ? (struct cmsghdr *)((void *)0) : (struct
 cmsghdr *)((char *)(cmsg) + (((unsigned long)((cmsg)->cmsg_len
) + (sizeof(long) - 1)) &~(sizeof(long) - 1))))) {
if (cmsg->cmsg_level == IPPROTO_IP0 &&
    cmsg->cmsg_type == IP_RECVDSTADDR7) {
	memcpy(&((struct sockaddr_in *)&s_in)->sin_addr,
	    CMSG_DATA(cmsg)((unsigned char *)(cmsg) + (((unsigned long)(sizeof(struct cmsghdr
)) + (sizeof(long) - 1)) &~(sizeof(long) - 1))), sizeof(struct in_addr));
	if (((struct sockaddr_in *)&s_in)->sin_addr.s_addr ==
	    INADDR_BROADCAST((u_int32_t)(0xffffffff)))
		dobind = 0;
	break;
}
if (cmsg->cmsg_level == IPPROTO_IPV641 &&
    cmsg->cmsg_type == IPV6_PKTINFO46) {
	struct in6_pktinfo *ipi;

	ipi = (struct in6_pktinfo *)CMSG_DATA(cmsg)((unsigned char *)(cmsg) + (((unsigned long)(sizeof(struct cmsghdr
)) + (sizeof(long) - 1)) &~(sizeof(long) - 1)));
	memcpy(&((struct sockaddr_in6 *)&s_in)->sin6_addr,
	    &ipi->ipi6_addr, sizeof(struct in6_addr));
	if (IN6_IS_ADDR_LINKLOCAL(&ipi->ipi6_addr)(((&ipi->ipi6_addr)->__u6_addr.__u6_addr8[0] == 0xfe
) && (((&ipi->ipi6_addr)->__u6_addr.__u6_addr8
[1] & 0xc0) == 0x80)))
		((struct sockaddr_in6 *)&s_in)->sin6_scope_id =
		    ipi->ipi6_ifindex;
	break;
}
}

if (dobind) {
setsockopt(client->sock, SOL_SOCKET0xffff, SO_REUSEADDR0x0004,
    &on, sizeof(on));
setsockopt(client->sock, SOL_SOCKET0xffff, SO_REUSEPORT0x0200,
    &on, sizeof(on));

if (bind(client->sock, (struct sockaddr *)&s_in,
    s_in.ss_len) == -1) {
	lwarn("bind to %s", getip(&s_in))logger->warn("bind to %s", getip(&s_in));
	goto err;
}
}
if (connect(client->sock, (struct sockaddr *)&client->ss,
   client->ss.ss_len) == -1) {
lwarn("connect to %s", getip(&client->ss))logger->warn("connect to %s", getip(&client->ss));
goto err;
}

tp = (struct tftphdr *)client->buf;
client->opcode = ntohs(tp->th_opcode)(__uint16_t)(__builtin_constant_p(tp->th_opcode) ? (__uint16_t
)(((__uint16_t)(tp->th_opcode) & 0xffU) << 8 | (
(__uint16_t)(tp->th_opcode) & 0xff00U) >> 8) : __swap16md
(tp->th_opcode));
if (client->opcode != RRQ01 && client->opcode != WRQ02) {
/* bad request */
goto err;
}

tftp(client, tp, n);

return;

780err:
client_free(client);
782}

784int
785parse_options(struct tftp_client *client, char *cp, size_t size,
  struct opt_client *options)
787{
char *option;
char *ccp;
int has_options = 0;
int i;

while (++cp < client->buf + size) {
for (i = 2, ccp = cp; i > 0; ccp++) {
	if (ccp >= client->buf + size) {
		/*
		 * Don't reject the request, just stop trying
		 * to parse the option and get on with it.
		 * Some Apple OpenFirmware versions have
		 * trailing garbage on the end of otherwise
		 * valid requests.
		 */
		return (has_options);
	} else if (*ccp == '\0')
		i--;
}

for (option = cp; *cp; cp++)
	*cp = tolower((unsigned char)*cp);

for (i = 0; i < NOPT; i++) {
	if (strcmp(option, opt_names[i]) == 0) {
		options[i].o_request = ++cp;
		has_options = 1;
	}
}
cp = ccp - 1;
}

return (has_options);
821}

823/*
* Handle initial connection protocol.
*/
826void
827tftp(struct tftp_client *client, struct tftphdr *tp, size_t size)
828{
struct opt_client *options;

char		*cp;
int		 i, first = 1, ecode, to;
struct formats	*pf;
char		*mode = NULL((void *)0);
char		 filename[PATH_MAX1024];
const char	*errstr;

if (size < 5) {
ecode = EBADOP4;
goto error;
}

cp = tp->th_stuffth_u.tu_stuff;
844again:
while (cp < client->buf + size) {
if (*cp == '\0')
	break;
cp++;
}
if (*cp != '\0') {
ecode = EBADOP4;
goto error;
}
i = cp - tp->th_stuffth_u.tu_stuff;
if (i >= sizeof(filename)) {
ecode = EBADOP4;
goto error;
}
memcpy(filename, tp->th_stuffth_u.tu_stuff, i);
filename[i] = '\0';
if (first) {
mode = ++cp;
first = 0;
goto again;
}
for (cp = mode; *cp; cp++)
*cp = tolower((unsigned char)*cp);

for (pf = formats; pf->f_mode; pf++) {
if (strcmp(pf->f_mode, mode) == 0)
	break;
}
if (pf->f_mode == 0) {
ecode = EBADOP4;
goto error;
}
client->fgetc = pf->f_getc;
client->fputc = pf->f_putc;

client->options = options = calloc(NOPT, sizeof(*client->options));
if (options == NULL((void *)0)) {
ecode = 100 + ENOMEM12;
goto error;
}

if (parse_options(client, cp, size, options)) {
if (options[OPT_TIMEOUT].o_request != NULL((void *)0)) {
	to = strtonum(options[OPT_TIMEOUT].o_request,
	    TIMEOUT_MIN1, TIMEOUT_MAX255, &errstr);
	if (errstr) {
		ecode = EBADOP4;
		goto error;
	}
	options[OPT_TIMEOUT].o_reply = client->tv.tv_sec = to;
}

if (options[OPT_BLKSIZE].o_request) {
	client->segment_size = strtonum(
	    options[OPT_BLKSIZE].o_request,
	    SEGSIZE_MIN8, SEGSIZE_MAX65464, &errstr);
	if (errstr) {
		ecode = EBADOP4;
		goto error;
	}
	client->packet_size = client->segment_size + 4;
	options[OPT_BLKSIZE].o_reply = client->segment_size;
}
} else {
free(options);
client->options = NULL((void *)0);
}

if (verbose) {
char nicebuf[PATH_MAX1024];

(void)strnvis(nicebuf, filename, PATH_MAX1024,
    VIS_SAFE0x20|VIS_OCTAL0x01);

linfo("%s: %s request for '%s'", getip(&client->ss),logger->info("%s: %s request for '%s'", getip(&client->
ss), client->opcode == 02 ? "write" : "read", nicebuf)
    client->opcode == WRQ ? "write" : "read", nicebuf)logger->info("%s: %s request for '%s'", getip(&client->
ss), client->opcode == 02 ? "write" : "read", nicebuf);
}

if (rwmap != NULL((void *)0))
rewrite_map(client, filename);
else
tftp_open(client, filename);

return;

930error:
nak(client, ecode);
932}

934void
935tftp_open(struct tftp_client *client, const char *filename)
936{
int ecode;

ecode = validate_access(client, filename);
if (ecode)
goto error;

if (client->options) {
if (oack(client) == -1)
	goto error;

free(client->options);
client->options = NULL((void *)0);
} else if (client->opcode == WRQ02) {
recvfile(client);
} else
sendfile(client);

return;
955error:
nak(client, ecode);
957}

959/*
* Validate file access.  Since we
* have no uid or gid, for now require
* file to exist and be publicly
* readable/writable.
* If we were invoked with arguments
* from inetd then the file must also be
* in one of the given directory prefixes.
* Note also, full path name must be
* given as we have no login directory.
*/
970int
971validate_access(struct tftp_client *client, const char *requested)
972{
int		 mode = client->opcode;
struct opt_client *options = client->options;
struct stat	 stbuf;
int		 fd, wmode;
const char	*errstr, *filename;
char		 rewritten[PATH_MAX1024];

if (!canwrite && mode != RRQ01)
return (EACCESS2);

if (strcmp(requested, SEEDPATH"/etc/random.seed") == 0) {
char *buf;
if (mode != RRQ01)
	return (EACCESS2);

buf = client->buf + sizeof(client->buf) - 512;
arc4random_buf(buf, 512);
if (options != NULL((void *)0) && options[OPT_TSIZE].o_request)
	options[OPT_TSIZE].o_reply = 512;
client->file = fmemopen(buf, 512, "r");
if (client->file == NULL((void *)0))
	return (errno(*__errno()) + 100);

return (0);
}

if (iflag) {
int ret;

/*
 * In -i mode, look in the directory named after the
 * client address.
 */
ret = snprintf(rewritten, sizeof(rewritten), "%s/%s",
    getip(&client->ss), requested);
if (ret < 0 || ret >= sizeof(rewritten))
	return (ENAMETOOLONG63 + 100);
filename = rewritten;
} else {
1012retryread:
filename = requested;
}

/*
* We use a different permissions scheme if `cancreate' is
* set.
*/
wmode = O_TRUNC0x0400;
if (stat(filename, &stbuf) == -1) {
if (!cancreate) {
	/*
	 * In -i mode, retry failed read requests from
	 * the root directory.
	 */
	if (mode == RRQ01 && errno(*__errno()) == ENOENT2 &&
	    filename == rewritten)
		goto retryread;
	return (errno(*__errno()) == ENOENT2 ? ENOTFOUND1 : EACCESS2);
} else {
	if ((errno(*__errno()) == ENOENT2) && (mode != RRQ01))
		wmode |= O_CREAT0x0200;
	else
		return (EACCESS2);
}
} else {
if (mode == RRQ01) {
	if ((stbuf.st_mode & (S_IRUSR0000400 >> 6)) == 0)
		return (EACCESS2);
} else {
	if ((stbuf.st_mode & (S_IWUSR0000200 >> 6)) == 0)
		return (EACCESS2);
}
}

if (options != NULL((void *)0) && options[OPT_TSIZE].o_request) {
if (mode == RRQ01)
	options[OPT_TSIZE].o_reply = stbuf.st_size;
else {
	/* allows writes of 65535 blocks * SEGSIZE_MAX bytes */
	options[OPT_TSIZE].o_reply =
	    strtonum(options[OPT_TSIZE].o_request,
	    1, 65535LL * SEGSIZE_MAX65464, &errstr);
	if (errstr)
		return (EOPTNEG8);
}
}
fd = open(filename, mode == RRQ01 ? O_RDONLY0x0000 : (O_WRONLY0x0001|wmode), 0666);
if (fd == -1)
return (errno(*__errno()) + 100);
/*
* If the file was created, set default permissions.
*/
if ((wmode & O_CREAT0x0200) && fchmod(fd, 0666) == -1) {
int serrno = errno(*__errno());

close(fd);
unlink(filename);

return (serrno + 100);
}
client->file = fdopen(fd, mode == RRQ01 ? "r" : "w");
if (client->file == NULL((void *)0)) {
close(fd);
return (errno(*__errno()) + 100);
}

return (0);
1080}

1082int
1083fget_octet(struct tftp_client *client)
1084{
return (getc(client->file)(!__isthreaded ? (--(client->file)->_r < 0 ? __srget
(client->file) : (int)(*(client->file)->_p++)) : (getc
)(client->file)));
1086}

1088int
1089fput_octet(struct tftp_client *client, int c)
1090{
return (putc(c, client->file)(!__isthreaded ? __sputc(c, client->file) : (putc)(c, client
->file)));
1092}

1094int
1095fget_netascii(struct tftp_client *client)
1096{
int c = -1;

switch (client->newline) {
case 0:
c = getc(client->file)(!__isthreaded ? (--(client->file)->_r < 0 ? __srget
(client->file) : (int)(*(client->file)->_p++)) : (getc
)(client->file));
if (c == EOF(-1))
	break;

if (c == '\n' || c == '\r') {
	client->newline = c;
	c = '\r';
}
break;
case '\n':
client->newline = 0;
c = '\n';
break;
case '\r':
client->newline = 0;
c = '\0';
break;
}

return (c);
1121}

1123int
1124fput_netascii(struct tftp_client *client, int c)
1125{
if (client->newline == '\r') {
client->newline = 0;

if (c == '\0')
	c = '\r';

} else if (c == '\r') {
client->newline = c;
return (c);
}

return (putc(c, client->file)(!__isthreaded ? __sputc(c, client->file) : (putc)(c, client
->file)));
1138}

1140void
1141sendfile(struct tftp_client *client)
1142{
event_set(&client->sev, client->sock, EV_READ0x02, tftp_rrq_ack, client);
client->block = 1;

file_read(client);
1147}

1149void
1150file_read(struct tftp_client *client)
1151{
u_int8_t *buf;
struct tftphdr *dp;
int i;
int c;

dp = (struct tftphdr *)client->buf;
dp->th_opcode = htons((u_short)DATA)(__uint16_t)(__builtin_constant_p((u_short)03) ? (__uint16_t)
(((__uint16_t)((u_short)03) & 0xffU) << 8 | ((__uint16_t
)((u_short)03) & 0xff00U) >> 8) : __swap16md((u_short
)03));
dp->th_blockth_u.tu_block = htons(client->block)(__uint16_t)(__builtin_constant_p(client->block) ? (__uint16_t
)(((__uint16_t)(client->block) & 0xffU) << 8 | (
(__uint16_t)(client->block) & 0xff00U) >> 8) : __swap16md
(client->block));
buf = (u_int8_t *)dp->th_data;

for (i = 0; i < client->segment_size; i++) {
c = client->fgetc(client);
if (c == EOF(-1)) {
	if (ferror(client->file)(!__isthreaded ? (((client->file)->_flags & 0x0040)
 != 0) : (ferror)(client->file))) {
		nak(client, 100 + EIO5);
		return;
	}

	break;
}
buf[i] = c;
}

client->buflen = i + 4;
client->retries = RETRIES5;

tftp_send(client);
1179}

1181void
1182tftp_send(struct tftp_client *client)
1183{
if (send(client->sock, client->buf, client->buflen, 0) == -1) {
lwarn("send(block)")logger->warn("send(block)");
client_free(client);
return;
}

event_add(&client->sev, &client->tv);
1191}

1193void
1194tftp_rrq_ack(int fd, short events, void *arg)
1195{
struct tftp_client *client = arg;
struct tftphdr *ap; /* ack packet */
char rbuf[SEGSIZE_MIN8];
ssize_t n;

if (events & EV_TIMEOUT0x01) {
if (retry(client) == -1) {
	lwarn("%s: retry", getip(&client->ss))logger->warn("%s: retry", getip(&client->ss));
	goto done;
}

return;
}

n = recv(fd, rbuf, sizeof(rbuf), 0);
if (n == -1) {
switch (errno(*__errno())) {
case EINTR4:
case EAGAIN35:
	event_add(&client->sev, &client->tv);
	return;

default:
	lwarn("%s: recv", getip(&client->ss))logger->warn("%s: recv", getip(&client->ss));
	goto done;
}
}

ap = (struct tftphdr *)rbuf;
ap->th_opcode = ntohs((u_short)ap->th_opcode)(__uint16_t)(__builtin_constant_p((u_short)ap->th_opcode) ?
 (__uint16_t)(((__uint16_t)((u_short)ap->th_opcode) & 0xffU
) << 8 | ((__uint16_t)((u_short)ap->th_opcode) &
 0xff00U) >> 8) : __swap16md((u_short)ap->th_opcode)
);
ap->th_blockth_u.tu_block = ntohs((u_short)ap->th_block)(__uint16_t)(__builtin_constant_p((u_short)ap->th_u.tu_block
) ? (__uint16_t)(((__uint16_t)((u_short)ap->th_u.tu_block)
 & 0xffU) << 8 | ((__uint16_t)((u_short)ap->th_u
.tu_block) & 0xff00U) >> 8) : __swap16md((u_short)ap
->th_u.tu_block));

switch (ap->th_opcode) {
case ACK04:
break;
case ERROR05:
default: /* assume the worst */
goto done;
}

if (ap->th_blockth_u.tu_block != client->block) {
if (tftp_flush(client) == -1) {
	lwarnx("%s: flush", getip(&client->ss))logger->warnx("%s: flush", getip(&client->ss));
	goto done;
}

if (ap->th_blockth_u.tu_block != (client->block - 1))
	goto done;

tftp_send(client);
return;
}

if (client->buflen != client->packet_size) {
/* this was the last packet in the stream */
goto done;
}

client->block++;
file_read(client);
return;

1258done:
client_free(client);
1260}

1262int
1263tftp_flush(struct tftp_client *client)
1264{
char rbuf[SEGSIZE_MIN8];
ssize_t n;

for (;;) {
n = recv(client->sock, rbuf, sizeof(rbuf), 0);
if (n == -1) {
	switch (errno(*__errno())) {
	case EAGAIN35:
		return (0);

	case EINTR4:
		break;

	default:
		return (-1);
	}
}
}
1283}

1285void
1286recvfile(struct tftp_client *client)
1287{
event_set(&client->sev, client->sock, EV_READ0x02, tftp_wrq, client);
tftp_wrq_ack(client);
1290}

1292int
1293tftp_wrq_ack_packet(struct tftp_client *client)
1294{
struct tftphdr *ap; /* ack packet */

ap = (struct tftphdr *)client->buf;
ap->th_opcode = htons((u_short)ACK)(__uint16_t)(__builtin_constant_p((u_short)04) ? (__uint16_t)
(((__uint16_t)((u_short)04) & 0xffU) << 8 | ((__uint16_t
)((u_short)04) & 0xff00U) >> 8) : __swap16md((u_short
)04));
ap->th_blockth_u.tu_block = htons(client->block)(__uint16_t)(__builtin_constant_p(client->block) ? (__uint16_t
)(((__uint16_t)(client->block) & 0xffU) << 8 | (
(__uint16_t)(client->block) & 0xff00U) >> 8) : __swap16md
(client->block));

client->buflen = 4;
client->retries = RETRIES5;

return (send(client->sock, client->buf, client->buflen, 0) != 4);
1305}

1307void
1308tftp_wrq_ack(struct tftp_client *client)
1309{
if (tftp_wrq_ack_packet(client) != 0) {
lwarn("tftp wrq ack")logger->warn("tftp wrq ack");
client_free(client);
return;
}

client->block++;
event_add(&client->sev, &client->tv);
1318}

1320void
1321tftp_wrq(int fd, short events, void *arg)
1322{
char wbuf[SEGSIZE_MAX65464 + 4];
struct tftp_client *client = arg;
struct tftphdr *dp;
ssize_t n;
int i;

if (events & EV_TIMEOUT0x01) {
if (retry(client) == -1) {
	lwarn("%s", getip(&client->ss))logger->warn("%s", getip(&client->ss));
	goto done;
}

return;
}

n = recv(fd, wbuf, client->packet_size, 0);
if (n == -1) {
switch (errno(*__errno())) {
case EINTR4:
case EAGAIN35:
	goto retry;

default:
	lwarn("tftp_wrq recv")logger->warn("tftp_wrq recv");
	goto done;
}
}

if (n < 4)
goto done;

dp = (struct tftphdr *)wbuf;
dp->th_opcode = ntohs((u_short)dp->th_opcode)(__uint16_t)(__builtin_constant_p((u_short)dp->th_opcode) ?
 (__uint16_t)(((__uint16_t)((u_short)dp->th_opcode) & 0xffU
) << 8 | ((__uint16_t)((u_short)dp->th_opcode) &
 0xff00U) >> 8) : __swap16md((u_short)dp->th_opcode)
);
dp->th_blockth_u.tu_block = ntohs((u_short)dp->th_block)(__uint16_t)(__builtin_constant_p((u_short)dp->th_u.tu_block
) ? (__uint16_t)(((__uint16_t)((u_short)dp->th_u.tu_block)
 & 0xffU) << 8 | ((__uint16_t)((u_short)dp->th_u
.tu_block) & 0xff00U) >> 8) : __swap16md((u_short)dp
->th_u.tu_block));

switch (dp->th_opcode) {
case ERROR05:
goto done;
case DATA03:
break;
default:
goto retry;
}

if (dp->th_blockth_u.tu_block != client->block) {
if (tftp_flush(client) == -1) {
	lwarnx("%s: flush", getip(&client->ss))logger->warnx("%s: flush", getip(&client->ss));
	goto done;
}

if (dp->th_blockth_u.tu_block != (client->block - 1))
	goto done;

goto retry;
}

for (i = 4; i < n; i++) {
if (client->fputc(client, wbuf[i]) == EOF(-1)) {
	lwarn("tftp wrq")logger->warn("tftp wrq");
	goto done;
}
}

if (n < client->packet_size) {
tftp_wrq_ack_packet(client);
fclose(client->file);
client->file = NULL((void *)0);
event_set(&client->sev, client->sock, EV_READ0x02,
    tftp_wrq_end, client);
event_add(&client->sev, &client->tv);
return;
}

tftp_wrq_ack(client);
return;

1399retry:
event_add(&client->sev, &client->tv);
return;
1402done:
client_free(client);
1404}

1406void
1407tftp_wrq_end(int fd, short events, void *arg)
1408{
char wbuf[SEGSIZE_MAX65464 + 4];
struct tftp_client *client = arg;
struct tftphdr *dp;
ssize_t n;

if (events & EV_TIMEOUT0x01) {
/* this was the last packet, we can clean up */
goto done;
}

n = recv(fd, wbuf, client->packet_size, 0);
if (n == -1) {
switch (errno(*__errno())) {
case EINTR4:
case EAGAIN35:
	goto retry;

default:
	lwarn("tftp_wrq_end recv")logger->warn("tftp_wrq_end recv");
	goto done;
}
}

if (n < 4)
goto done;

dp = (struct tftphdr *)wbuf;
dp->th_opcode = ntohs((u_short)dp->th_opcode)(__uint16_t)(__builtin_constant_p((u_short)dp->th_opcode) ?
 (__uint16_t)(((__uint16_t)((u_short)dp->th_opcode) & 0xffU
) << 8 | ((__uint16_t)((u_short)dp->th_opcode) &
 0xff00U) >> 8) : __swap16md((u_short)dp->th_opcode)
);
dp->th_blockth_u.tu_block = ntohs((u_short)dp->th_block)(__uint16_t)(__builtin_constant_p((u_short)dp->th_u.tu_block
) ? (__uint16_t)(((__uint16_t)((u_short)dp->th_u.tu_block)
 & 0xffU) << 8 | ((__uint16_t)((u_short)dp->th_u
.tu_block) & 0xff00U) >> 8) : __swap16md((u_short)dp
->th_u.tu_block));

switch (dp->th_opcode) {
case ERROR05:
goto done;
case DATA03:
break;
default:
goto retry;
}

if (dp->th_blockth_u.tu_block != client->block)
goto done;

1451retry:
if (retry(client) == -1) {
lwarn("%s", getip(&client->ss))logger->warn("%s", getip(&client->ss));
goto done;
}
return;
1457done:
client_free(client);
return;
1460}


1463/*
* Send a nak packet (error message).
* Error code passed in is one of the
* standard TFTP codes, or a UNIX errno
* offset by 100.
*/
1469void
1470nak(struct tftp_client *client, int error)
1471{
struct tftphdr	*tp;
struct errmsg	*pe;
size_t		 length;
ssize_t		 rslt;

tp = (struct tftphdr *)client->buf;
tp->th_opcode = htons((u_short)ERROR)(__uint16_t)(__builtin_constant_p((u_short)05) ? (__uint16_t)
(((__uint16_t)((u_short)05) & 0xffU) << 8 | ((__uint16_t
)((u_short)05) & 0xff00U) >> 8) : __swap16md((u_short
)05));
tp->th_codeth_u.tu_code = htons((u_short)error)(__uint16_t)(__builtin_constant_p((u_short)error) ? (__uint16_t
)(((__uint16_t)((u_short)error) & 0xffU) << 8 | ((__uint16_t
)((u_short)error) & 0xff00U) >> 8) : __swap16md((u_short
)error));

for (pe = errmsgs; pe->e_code >= 0; pe++) {
if (pe->e_code == error)
	break;
}
if (pe->e_code < 0) {
pe->e_msg = strerror(error - 100);
tp->th_codeth_u.tu_code = htons(EUNDEF)(__uint16_t)(__builtin_constant_p(0) ? (__uint16_t)(((__uint16_t
)(0) & 0xffU) << 8 | ((__uint16_t)(0) & 0xff00U
) >> 8) : __swap16md(0));   /* set 'undef' errorcode */
}

length = strlcpy(tp->th_msgth_data, pe->e_msg, client->packet_size - 5) + 5;
if (length > client->packet_size)
length = client->packet_size;

linfo("%s: nak: %s", getip(&client->ss), tp->th_msg)logger->info("%s: nak: %s", getip(&client->ss), tp->
th_data);

rslt = send(client->sock, client->buf, length, 0);
if (rslt == -1)
lwarn("%s: nak", getip(&client->ss))logger->warn("%s: nak", getip(&client->ss));
else if ((size_t)rslt != length)
lwarnx("%s: nak: sent %zd of %zu bytes", getip(&client->ss),logger->warnx("%s: nak: sent %zd of %zu bytes", getip(&
client->ss), rslt, length)
    rslt, length)logger->warnx("%s: nak: sent %zd of %zu bytes", getip(&
client->ss), rslt, length);

client_free(client);
1504}

1506/*
* Send an oack packet (option acknowledgement).
*/
1509int
1510oack(struct tftp_client *client)
1511{
struct opt_client *options = client->options;
struct tftphdr *tp;
char *bp;
int i, n, size;

tp = (struct tftphdr *)client->buf;
bp = (char *)tp->th_stuffth_u.tu_stuff;
size = sizeof(client->buf) - 2;

tp->th_opcode = htons((u_short)OACK)(__uint16_t)(__builtin_constant_p((u_short)06) ? (__uint16_t)
(((__uint16_t)((u_short)06) & 0xffU) << 8 | ((__uint16_t
)((u_short)06) & 0xff00U) >> 8) : __swap16md((u_short
)06));
for (i = 0; i < NOPT; i++) {
if (options[i].o_request == NULL((void *)0))
	continue;

n = snprintf(bp, size, "%s%c%lld", opt_names[i], '\0',
    options[i].o_reply);
if (n < 0 || n >= size) {
	lwarnx("oack: no buffer space")logger->warnx("oack: no buffer space");
	goto error;
}

bp += n + 1;
size -= n + 1;
if (size < 0) {
	lwarnx("oack: no buffer space")logger->warnx("oack: no buffer space");
	goto error;
}
}

client->buflen = bp - client->buf;
client->retries = RETRIES5;

if (send(client->sock, client->buf, client->buflen, 0) == -1) {
lwarn("oack")logger->warn("oack");
goto error;
}

/* no client ACK for write requests with options */
if (client->opcode == WRQ02) {
client->block = 1;
event_set(&client->sev, client->sock, EV_READ0x02,
    tftp_wrq, client);
} else
event_set(&client->sev, client->sock, EV_READ0x02,
    oack_done, client);

event_add(&client->sev, &client->tv);
return (0);

1561error:
return (-1);
1563}

1565int
1566retry(struct tftp_client *client)
1567{
if (--client->retries == 0) {
errno(*__errno()) = ETIMEDOUT60;
return (-1);
}

tftp_send(client);

return (0);
1576}

1578void
1579oack_done(int fd, short events, void *arg)
1580{
struct tftp_client *client = arg;
struct tftphdr *ap;
ssize_t n;

if (events & EV_TIMEOUT0x01) {
if (retry(client) == -1) {
	lwarn("%s", getip(&client->ss))logger->warn("%s", getip(&client->ss));
	goto done;
}

return;
}

n = recv(client->sock, client->buf, client->packet_size, 0);
if (n == -1) {
switch (errno(*__errno())) {
case EINTR4:
case EAGAIN35:
	event_add(&client->sev, &client->tv);
	return;

default:
	lwarn("%s: recv", getip(&client->ss))logger->warn("%s: recv", getip(&client->ss));
	goto done;
}
}

if (n < 4)
goto done;

ap = (struct tftphdr *)client->buf;
ap->th_opcode = ntohs((u_short)ap->th_opcode)(__uint16_t)(__builtin_constant_p((u_short)ap->th_opcode) ?
 (__uint16_t)(((__uint16_t)((u_short)ap->th_opcode) & 0xffU
) << 8 | ((__uint16_t)((u_short)ap->th_opcode) &
 0xff00U) >> 8) : __swap16md((u_short)ap->th_opcode)
);
ap->th_blockth_u.tu_block = ntohs((u_short)ap->th_block)(__uint16_t)(__builtin_constant_p((u_short)ap->th_u.tu_block
) ? (__uint16_t)(((__uint16_t)((u_short)ap->th_u.tu_block)
 & 0xffU) << 8 | ((__uint16_t)((u_short)ap->th_u
.tu_block) & 0xff00U) >> 8) : __swap16md((u_short)ap
->th_u.tu_block));

if (ap->th_opcode != ACK04 || ap->th_blockth_u.tu_block != 0)
goto done;

sendfile(client);
return;

1621done:
client_free(client);
1623}

1625const char *
1626getip(void *s)
1627{
struct sockaddr *sa = s;
static char hbuf[NI_MAXHOST256];

if (getnameinfo(sa, sa->sa_len, hbuf, sizeof(hbuf),
   NULL((void *)0), 0, NI_NUMERICHOST1))
strlcpy(hbuf, "0.0.0.0", sizeof(hbuf));

return(hbuf);
1636}

1638/* daemon(3) clone, intended to be used in a "r"estricted environment */
1639int
1640rdaemon(int devnull)
1641{
if (devnull == -1) {
errno(*__errno()) = EBADF9;
return (-1);
}
if (fcntl(devnull, F_GETFL3) == -1)
return (-1);

switch (fork()) {
case -1:
return (-1);
case 0:
break;
default:
_exit(0);
}

if (setsid() == -1)
return (-1);

(void)dup2(devnull, STDIN_FILENO0);
(void)dup2(devnull, STDOUT_FILENO1);
(void)dup2(devnull, STDERR_FILENO2);
if (devnull > 2)
(void)close(devnull);

return (0);
1668}

1670void
1671syslog_vstrerror(int e, int priority, const char *fmt, va_list ap)
1672{
char *s;

if (vasprintf(&s, fmt, ap) == -1) {
syslog(LOG_EMERG0, "unable to alloc in syslog_vstrerror");
exit(1);
}

syslog(priority, "%s: %s", s, strerror(e));

free(s);
1683}

1685void
1686syslog_err(int ecode, const char *fmt, ...)
1687{
va_list ap;

va_start(ap, fmt)__builtin_va_start((ap), fmt);
syslog_vstrerror(errno(*__errno()), LOG_CRIT2, fmt, ap);
va_end(ap)__builtin_va_end((ap));

exit(ecode);
1695}

1697void
1698syslog_errx(int ecode, const char *fmt, ...)
1699{
va_list ap;

va_start(ap, fmt)__builtin_va_start((ap), fmt);
vsyslog(LOG_CRIT2, fmt, ap);
va_end(ap)__builtin_va_end((ap));

exit(ecode);
1707}

1709void
1710syslog_warn(const char *fmt, ...)
1711{
va_list ap;

va_start(ap, fmt)__builtin_va_start((ap), fmt);
syslog_vstrerror(errno(*__errno()), LOG_ERR3, fmt, ap);
va_end(ap)__builtin_va_end((ap));
1717}

1719void
1720syslog_warnx(const char *fmt, ...)
1721{
va_list ap;

va_start(ap, fmt)__builtin_va_start((ap), fmt);
vsyslog(LOG_ERR3, fmt, ap);
va_end(ap)__builtin_va_end((ap));
1727}

1729void
1730syslog_info(const char *fmt, ...)
1731{
va_list ap;

va_start(ap, fmt)__builtin_va_start((ap), fmt);
vsyslog(LOG_INFO6, fmt, ap);
va_end(ap)__builtin_va_end((ap));
1737}

1739void
1740syslog_debug(const char *fmt, ...)
1741{
va_list ap;

if (!debug)
return;

va_start(ap, fmt)__builtin_va_start((ap), fmt);
vsyslog(LOG_DEBUG7, fmt, ap);
va_end(ap)__builtin_va_end((ap));
1750}