net/wget.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * WGET/HTTP support driver based on U-BOOT's nfs.c
   4  * Copyright Duncan Hare <[email protected]> 2017
   5  */
   6
   7 #include <asm/global_data.h>
   8 #include <command.h>
   9 #include <display_options.h>
  10 #include <env.h>
  11 #include <efi_loader.h>
  12 #include <image.h>
  13 #include <lmb.h>
  14 #include <mapmem.h>
  15 #include <net.h>
  16 #include <net/tcp.h>
  17 #include <net/wget.h>
  18 #include <stdlib.h>
  19
  20 DECLARE_GLOBAL_DATA_PTR;
  21
  22 /* The default, change with environment variable 'httpdstp' */
  23 #define SERVER_PORT             80
  24
  25 static const char bootfile1[] = "GET ";
  26 static const char bootfile3[] = " HTTP/1.0\r\n\r\n";
  27 static const char http_eom[] = "\r\n\r\n";
  28 static const char http_ok[] = "200";
  29 static const char content_len[] = "Content-Length";
  30 static const char linefeed[] = "\r\n";
  31 static struct in_addr web_server_ip;
  32 static int our_port;
  33 static int wget_timeout_count;
  34
  35 struct pkt_qd {
  36         uchar *pkt;
  37         unsigned int tcp_seq_num;
  38         unsigned int len;
  39 };
  40
  41 /*
  42  * This is a control structure for out of order packets received.
  43  * The actual packet bufers are in the kernel space, and are
  44  * expected to be overwritten by the downloaded image.
  45  */
  46 #define PKTQ_SZ (PKTBUFSRX / 4)
  47 static struct pkt_qd pkt_q[PKTQ_SZ];
  48 static int pkt_q_idx;
  49 static unsigned long content_length;
  50 static unsigned int packets;
  51
  52 static unsigned int initial_data_seq_num;
  53 static unsigned int next_data_seq_num;
  54
  55 static enum  wget_state current_wget_state;
  56
  57 static char *image_url;
  58 static unsigned int wget_timeout = WGET_TIMEOUT;
  59
  60 static enum net_loop_state wget_loop_state;
  61
  62 /* Timeout retry parameters */
  63 static u8 retry_action;                 /* actions for TCP retry */
  64 static unsigned int retry_tcp_ack_num;  /* TCP retry acknowledge number*/
  65 static unsigned int retry_tcp_seq_num;  /* TCP retry sequence number */
  66 static int retry_len;                   /* TCP retry length */
  67
  68 /**
  69  * store_block() - store block in memory
  70  * @src: source of data
  71  * @offset: offset
  72  * @len: length
  73  */
  74 static inline int store_block(uchar *src, unsigned int offset, unsigned int len)
  75 {
  76         ulong store_addr = image_load_addr + offset;
  77         ulong newsize = offset + len;
  78         uchar *ptr;
  79
  80         if (CONFIG_IS_ENABLED(LMB)) {
  81                 if (store_addr < image_load_addr ||
  82                     lmb_read_check(store_addr, len)) {
  83                         printf("\nwget error: ");
  84                         printf("trying to overwrite reserved memory...\n");
  85                         return -1;
  86                 }
  87         }
  88
  89         ptr = map_sysmem(store_addr, len);
  90         memcpy(ptr, src, len);
  91         unmap_sysmem(ptr);
  92
  93         if (net_boot_file_size < (offset + len))
  94                 net_boot_file_size = newsize;
  95
  96         return 0;
  97 }
  98
  99 /**
 100  * wget_send_stored() - wget response dispatcher
 101  *
 102  * WARNING, This, and only this, is the place in wget.c where
 103  * SEQUENCE NUMBERS are swapped between incoming (RX)
 104  * and outgoing (TX).
 105  * Procedure wget_handler() is correct for RX traffic.
 106  */
 107 static void wget_send_stored(void)
 108 {
 109         u8 action = retry_action;
 110         int len = retry_len;
 111         unsigned int tcp_ack_num = retry_tcp_seq_num + (len == 0 ? 1 : len);
 112         unsigned int tcp_seq_num = retry_tcp_ack_num;
 113         unsigned int server_port;
 114         uchar *ptr, *offset;
 115
 116         server_port = env_get_ulong("httpdstp", 10, SERVER_PORT) & 0xffff;
 117
 118         switch (current_wget_state) {
 119         case WGET_CLOSED:
 120                 debug_cond(DEBUG_WGET, "wget: send SYN\n");
 121                 current_wget_state = WGET_CONNECTING;
 122                 net_send_tcp_packet(0, server_port, our_port, action,
 123                                     tcp_seq_num, tcp_ack_num);
 124                 packets = 0;
 125                 break;
 126         case WGET_CONNECTING:
 127                 pkt_q_idx = 0;
 128                 net_send_tcp_packet(0, server_port, our_port, action,
 129                                     tcp_seq_num, tcp_ack_num);
 130
 131                 ptr = net_tx_packet + net_eth_hdr_size() +
 132                         IP_TCP_HDR_SIZE + TCP_TSOPT_SIZE + 2;
 133                 offset = ptr;
 134
 135                 memcpy(offset, &bootfile1, strlen(bootfile1));
 136                 offset += strlen(bootfile1);
 137
 138                 memcpy(offset, image_url, strlen(image_url));
 139                 offset += strlen(image_url);
 140
 141                 memcpy(offset, &bootfile3, strlen(bootfile3));
 142                 offset += strlen(bootfile3);
 143                 net_send_tcp_packet((offset - ptr), server_port, our_port,
 144                                     TCP_PUSH, tcp_seq_num, tcp_ack_num);
 145                 current_wget_state = WGET_CONNECTED;
 146                 break;
 147         case WGET_CONNECTED:
 148         case WGET_TRANSFERRING:
 149         case WGET_TRANSFERRED:
 150                 net_send_tcp_packet(0, server_port, our_port, action,
 151                                     tcp_seq_num, tcp_ack_num);
 152                 break;
 153         }
 154 }
 155
 156 static void wget_send(u8 action, unsigned int tcp_seq_num,
 157                       unsigned int tcp_ack_num, int len)
 158 {
 159         retry_action = action;
 160         retry_tcp_ack_num = tcp_ack_num;
 161         retry_tcp_seq_num = tcp_seq_num;
 162         retry_len = len;
 163
 164         wget_send_stored();
 165 }
 166
 167 void wget_fail(char *error_message, unsigned int tcp_seq_num,
 168                unsigned int tcp_ack_num, u8 action)
 169 {
 170         printf("wget: Transfer Fail - %s\n", error_message);
 171         net_set_timeout_handler(0, NULL);
 172         wget_send(action, tcp_seq_num, tcp_ack_num, 0);
 173 }
 174
 175 /*
 176  * Interfaces of U-BOOT
 177  */
 178 static void wget_timeout_handler(void)
 179 {
 180         if (++wget_timeout_count > WGET_RETRY_COUNT) {
 181                 puts("\nRetry count exceeded; starting again\n");
 182                 wget_send(TCP_RST, 0, 0, 0);
 183                 net_start_again();
 184         } else {
 185                 puts("T ");
 186                 net_set_timeout_handler(wget_timeout +
 187                                         WGET_TIMEOUT * wget_timeout_count,
 188                                         wget_timeout_handler);
 189                 wget_send_stored();
 190         }
 191 }
 192
 193 #define PKT_QUEUE_OFFSET 0x20000
 194 #define PKT_QUEUE_PACKET_SIZE 0x800
 195
 196 static void wget_connected(uchar *pkt, unsigned int tcp_seq_num,
 197                            u8 action, unsigned int tcp_ack_num, unsigned int len)
 198 {
 199         uchar *pkt_in_q;
 200         char *pos;
 201         int hlen, i;
 202         uchar *ptr1;
 203
 204         pkt[len] = '\0';
 205         pos = strstr((char *)pkt, http_eom);
 206
 207         if (!pos) {
 208                 debug_cond(DEBUG_WGET,
 209                            "wget: Connected, data before Header %p\n", pkt);
 210                 pkt_in_q = (void *)image_load_addr + PKT_QUEUE_OFFSET +
 211                         (pkt_q_idx * PKT_QUEUE_PACKET_SIZE);
 212
 213                 ptr1 = map_sysmem((ulong)pkt_in_q, len);
 214                 memcpy(ptr1, pkt, len);
 215                 unmap_sysmem(ptr1);
 216
 217                 pkt_q[pkt_q_idx].pkt = pkt_in_q;
 218                 pkt_q[pkt_q_idx].tcp_seq_num = tcp_seq_num;
 219                 pkt_q[pkt_q_idx].len = len;
 220                 pkt_q_idx++;
 221
 222                 if (pkt_q_idx >= PKTQ_SZ) {
 223                         printf("wget: Fatal error, queue overrun!\n");
 224                         net_set_state(NETLOOP_FAIL);
 225
 226                         return;
 227                 }
 228         } else {
 229                 debug_cond(DEBUG_WGET, "wget: Connected HTTP Header %p\n", pkt);
 230                 /* sizeof(http_eom) - 1 is the string length of (http_eom) */
 231                 hlen = pos - (char *)pkt + sizeof(http_eom) - 1;
 232                 pos = strstr((char *)pkt, linefeed);
 233                 if (pos > 0)
 234                         i = pos - (char *)pkt;
 235                 else
 236                         i = hlen;
 237                 printf("%.*s", i,  pkt);
 238
 239                 current_wget_state = WGET_TRANSFERRING;
 240
 241                 initial_data_seq_num = tcp_seq_num + hlen;
 242                 next_data_seq_num    = tcp_seq_num + len;
 243
 244                 if (strstr((char *)pkt, http_ok) == 0) {
 245                         debug_cond(DEBUG_WGET,
 246                                    "wget: Connected Bad Xfer\n");
 247                         wget_loop_state = NETLOOP_FAIL;
 248                         wget_send(action, tcp_seq_num, tcp_ack_num, len);
 249                 } else {
 250                         debug_cond(DEBUG_WGET,
 251                                    "wget: Connected Pkt %p hlen %x\n",
 252                                    pkt, hlen);
 253
 254                         pos = strstr((char *)pkt, content_len);
 255                         if (!pos) {
 256                                 content_length = -1;
 257                         } else {
 258                                 pos += sizeof(content_len) + 2;
 259                                 strict_strtoul(pos, 10, &content_length);
 260                                 debug_cond(DEBUG_WGET,
 261                                            "wget: Connected Len %lu\n",
 262                                            content_length);
 263                         }
 264
 265                         net_boot_file_size = 0;
 266
 267                         if (len > hlen) {
 268                                 if (store_block(pkt + hlen, 0, len - hlen) != 0) {
 269                                         wget_loop_state = NETLOOP_FAIL;
 270                                         wget_fail("wget: store error\n", tcp_seq_num, tcp_ack_num, action);
 271                                         net_set_state(NETLOOP_FAIL);
 272                                         return;
 273                                 }
 274                         }
 275
 276                         for (i = 0; i < pkt_q_idx; i++) {
 277                                 int err;
 278
 279                                 ptr1 = map_sysmem((ulong)pkt_q[i].pkt,
 280                                                   pkt_q[i].len);
 281                                 err = store_block(ptr1,
 282                                           pkt_q[i].tcp_seq_num -
 283                                           initial_data_seq_num,
 284                                           pkt_q[i].len);
 285                                 unmap_sysmem(ptr1);
 286                                 debug_cond(DEBUG_WGET,
 287                                            "wget: Conncted pkt Q %p len %x\n",
 288                                            pkt_q[i].pkt, pkt_q[i].len);
 289                                 if (err) {
 290                                         wget_loop_state = NETLOOP_FAIL;
 291                                         wget_fail("wget: store error\n", tcp_seq_num, tcp_ack_num, action);
 292                                         net_set_state(NETLOOP_FAIL);
 293                                         return;
 294                                 }
 295                         }
 296                 }
 297         }
 298         wget_send(action, tcp_seq_num, tcp_ack_num, len);
 299 }
 300
 301 /**
 302  * wget_handler() - TCP handler of wget
 303  * @pkt: pointer to the application packet
 304  * @dport: destination TCP port
 305  * @sip: source IP address
 306  * @sport: source TCP port
 307  * @tcp_seq_num: TCP sequential number
 308  * @tcp_ack_num: TCP acknowledgment number
 309  * @action: TCP action (SYN, ACK, FIN, etc)
 310  * @len: packet length
 311  *
 312  * In the "application push" invocation, the TCP header with all
 313  * its information is pointed to by the packet pointer.
 314  */
 315 static void wget_handler(uchar *pkt, u16 dport,
 316                          struct in_addr sip, u16 sport,
 317                          u32 tcp_seq_num, u32 tcp_ack_num,
 318                          u8 action, unsigned int len)
 319 {
 320         enum tcp_state wget_tcp_state = tcp_get_tcp_state();
 321
 322         net_set_timeout_handler(wget_timeout, wget_timeout_handler);
 323         packets++;
 324
 325         switch (current_wget_state) {
 326         case WGET_CLOSED:
 327                 debug_cond(DEBUG_WGET, "wget: Handler: Error!, State wrong\n");
 328                 break;
 329         case WGET_CONNECTING:
 330                 debug_cond(DEBUG_WGET,
 331                            "wget: Connecting In len=%x, Seq=%u, Ack=%u\n",
 332                            len, tcp_seq_num, tcp_ack_num);
 333                 if (!len) {
 334                         if (wget_tcp_state == TCP_ESTABLISHED) {
 335                                 debug_cond(DEBUG_WGET,
 336                                            "wget: Cting, send, len=%x\n", len);
 337                                 wget_send(action, tcp_seq_num, tcp_ack_num,
 338                                           len);
 339                         } else {
 340                                 printf("%.*s", len,  pkt);
 341                                 wget_fail("wget: Handler Connected Fail\n",
 342                                           tcp_seq_num, tcp_ack_num, action);
 343                         }
 344                 }
 345                 break;
 346         case WGET_CONNECTED:
 347                 debug_cond(DEBUG_WGET, "wget: Connected seq=%u, len=%x\n",
 348                            tcp_seq_num, len);
 349                 if (!len) {
 350                         wget_fail("Image not found, no data returned\n",
 351                                   tcp_seq_num, tcp_ack_num, action);
 352                 } else {
 353                         wget_connected(pkt, tcp_seq_num, action, tcp_ack_num, len);
 354                 }
 355                 break;
 356         case WGET_TRANSFERRING:
 357                 debug_cond(DEBUG_WGET,
 358                            "wget: Transferring, seq=%x, ack=%x,len=%x\n",
 359                            tcp_seq_num, tcp_ack_num, len);
 360
 361                 if (next_data_seq_num != tcp_seq_num) {
 362                         debug_cond(DEBUG_WGET, "wget: seq=%x packet was lost\n", next_data_seq_num);
 363                         return;
 364                 }
 365                 next_data_seq_num = tcp_seq_num + len;
 366
 367                 if (store_block(pkt, tcp_seq_num - initial_data_seq_num, len) != 0) {
 368                         wget_fail("wget: store error\n",
 369                                   tcp_seq_num, tcp_ack_num, action);
 370                         net_set_state(NETLOOP_FAIL);
 371                         return;
 372                 }
 373
 374                 switch (wget_tcp_state) {
 375                 case TCP_FIN_WAIT_2:
 376                         wget_send(TCP_ACK, tcp_seq_num, tcp_ack_num, len);
 377                         fallthrough;
 378                 case TCP_SYN_SENT:
 379                 case TCP_SYN_RECEIVED:
 380                 case TCP_CLOSING:
 381                 case TCP_FIN_WAIT_1:
 382                 case TCP_CLOSED:
 383                         net_set_state(NETLOOP_FAIL);
 384                         break;
 385                 case TCP_ESTABLISHED:
 386                         wget_send(TCP_ACK, tcp_seq_num, tcp_ack_num,
 387                                   len);
 388                         wget_loop_state = NETLOOP_SUCCESS;
 389                         break;
 390                 case TCP_CLOSE_WAIT:     /* End of transfer */
 391                         current_wget_state = WGET_TRANSFERRED;
 392                         wget_send(action | TCP_ACK | TCP_FIN,
 393                                   tcp_seq_num, tcp_ack_num, len);
 394                         break;
 395                 }
 396                 break;
 397         case WGET_TRANSFERRED:
 398                 printf("Packets received %d, Transfer Successful\n", packets);
 399                 net_set_state(wget_loop_state);
 400                 efi_set_bootdev("Net", "", image_url,
 401                                 map_sysmem(image_load_addr, 0),
 402                                 net_boot_file_size);
 403                 env_set_hex("filesize", net_boot_file_size);
 404                 break;
 405         }
 406 }
 407
 408 #define RANDOM_PORT_START 1024
 409 #define RANDOM_PORT_RANGE 0x4000
 410
 411 /**
 412  * random_port() - make port a little random (1024-17407)
 413  *
 414  * Return: random port number from 1024 to 17407
 415  *
 416  * This keeps the math somewhat trivial to compute, and seems to work with
 417  * all supported protocols/clients/servers
 418  */
 419 static unsigned int random_port(void)
 420 {
 421         return RANDOM_PORT_START + (get_timer(0) % RANDOM_PORT_RANGE);
 422 }
 423
 424 #define BLOCKSIZE 512
 425
 426 void wget_start(void)
 427 {
 428         image_url = strchr(net_boot_file_name, ':');
 429         if (image_url > 0) {
 430                 web_server_ip = string_to_ip(net_boot_file_name);
 431                 ++image_url;
 432                 net_server_ip = web_server_ip;
 433         } else {
 434                 web_server_ip = net_server_ip;
 435                 image_url = net_boot_file_name;
 436         }
 437
 438         debug_cond(DEBUG_WGET,
 439                    "wget: Transfer HTTP Server %pI4; our IP %pI4\n",
 440                    &web_server_ip, &net_ip);
 441
 442         /* Check if we need to send across this subnet */
 443         if (net_gateway.s_addr && net_netmask.s_addr) {
 444                 struct in_addr our_net;
 445                 struct in_addr server_net;
 446
 447                 our_net.s_addr = net_ip.s_addr & net_netmask.s_addr;
 448                 server_net.s_addr = net_server_ip.s_addr & net_netmask.s_addr;
 449                 if (our_net.s_addr != server_net.s_addr)
 450                         debug_cond(DEBUG_WGET,
 451                                    "wget: sending through gateway %pI4",
 452                                    &net_gateway);
 453         }
 454         debug_cond(DEBUG_WGET, "URL '%s'\n", image_url);
 455
 456         if (net_boot_file_expected_size_in_blocks) {
 457                 debug_cond(DEBUG_WGET, "wget: Size is 0x%x Bytes = ",
 458                            net_boot_file_expected_size_in_blocks * BLOCKSIZE);
 459                 print_size(net_boot_file_expected_size_in_blocks * BLOCKSIZE,
 460                            "");
 461         }
 462         debug_cond(DEBUG_WGET,
 463                    "\nwget:Load address: 0x%lx\nLoading: *\b", image_load_addr);
 464
 465         net_set_timeout_handler(wget_timeout, wget_timeout_handler);
 466         tcp_set_tcp_handler(wget_handler);
 467
 468         wget_timeout_count = 0;
 469         current_wget_state = WGET_CLOSED;
 470
 471         our_port = random_port();
 472
 473         /*
 474          * Zero out server ether to force arp resolution in case
 475          * the server ip for the previous u-boot command, for example dns
 476          * is not the same as the web server ip.
 477          */
 478
 479         memset(net_server_ethaddr, 0, 6);
 480
 481         wget_send(TCP_SYN, 0, 0, 0);
 482 }
 483
 484 #if (IS_ENABLED(CONFIG_CMD_DNS))
 485 int wget_with_dns(ulong dst_addr, char *uri)
 486 {
 487         int ret;
 488         char *s, *host_name, *file_name, *str_copy;
 489
 490         /*
 491          * Download file using wget.
 492          *
 493          * U-Boot wget takes the target uri in this format.
 494          *  "<http server ip>:<file path>"  e.g.) 192.168.1.1:/sample/test.iso
 495          * Need to resolve the http server ip address before starting wget.
 496          */
 497         str_copy = strdup(uri);
 498         if (!str_copy)
 499                 return -ENOMEM;
 500
 501         s = str_copy + strlen("http://");
 502         host_name = strsep(&s, "/");
 503         if (!s) {
 504                 log_err("Error: invalied uri, no file path\n");
 505                 ret = -EINVAL;
 506                 goto out;
 507         }
 508         file_name = s;
 509
 510         /* TODO: If the given uri has ip address for the http server, skip dns */
 511         net_dns_resolve = host_name;
 512         net_dns_env_var = "httpserverip";
 513         if (net_loop(DNS) < 0) {
 514                 log_err("Error: dns lookup of %s failed, check setup\n", net_dns_resolve);
 515                 ret = -EINVAL;
 516                 goto out;
 517         }
 518         s = env_get("httpserverip");
 519         if (!s) {
 520                 ret = -EINVAL;
 521                 goto out;
 522         }
 523
 524         strlcpy(net_boot_file_name, s, sizeof(net_boot_file_name));
 525         strlcat(net_boot_file_name, ":/", sizeof(net_boot_file_name)); /* append '/' which is removed by strsep() */
 526         strlcat(net_boot_file_name, file_name, sizeof(net_boot_file_name));
 527         image_load_addr = dst_addr;
 528         ret = net_loop(WGET);
 529
 530 out:
 531         free(str_copy);
 532
 533         return ret;
 534 }
 535 #endif
 536
 537 /**
 538  * wget_validate_uri() - validate the uri for wget
 539  *
 540  * @uri:        uri string
 541  *
 542  * This function follows the current U-Boot wget implementation.
 543  * scheme: only "http:" is supported
 544  * authority:
 545  *   - user information: not supported
 546  *   - host: supported
 547  *   - port: not supported(always use the default port)
 548  *
 549  * Uri is expected to be correctly percent encoded.
 550  * This is the minimum check, control codes(0x1-0x19, 0x7F, except '\0')
 551  * and space character(0x20) are not allowed.
 552  *
 553  * TODO: stricter uri conformance check
 554  *
 555  * Return:      true on success, false on failure
 556  */
 557 bool wget_validate_uri(char *uri)
 558 {
 559         char c;
 560         bool ret = true;
 561         char *str_copy, *s, *authority;
 562
 563         for (c = 0x1; c < 0x21; c++) {
 564                 if (strchr(uri, c)) {
 565                         log_err("invalid character is used\n");
 566                         return false;
 567                 }
 568         }
 569         if (strchr(uri, 0x7f)) {
 570                 log_err("invalid character is used\n");
 571                 return false;
 572         }
 573
 574         if (strncmp(uri, "http://", 7)) {
 575                 log_err("only http:// is supported\n");
 576                 return false;
 577         }
 578         str_copy = strdup(uri);
 579         if (!str_copy)
 580                 return false;
 581
 582         s = str_copy + strlen("http://");
 583         authority = strsep(&s, "/");
 584         if (!s) {
 585                 log_err("invalid uri, no file path\n");
 586                 ret = false;
 587                 goto out;
 588         }
 589         s = strchr(authority, '@');
 590         if (s) {
 591                 log_err("user information is not supported\n");
 592                 ret = false;
 593                 goto out;
 594         }
 595         s = strchr(authority, ':');
 596         if (s) {
 597                 log_err("user defined port is not supported\n");
 598                 ret = false;
 599                 goto out;
 600         }
 601
 602 out:
 603         free(str_copy);
 604
 605         return ret;
 606 }