net/wget.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * WGET/HTTP support driver based on U-BOOT's nfs.c
   4  * Copyright Duncan Hare <[email protected]> 2017
   5  */
   6
   7 #include <asm/global_data.h>
   8 #include <command.h>
   9 #include <common.h>
  10 #include <display_options.h>
  11 #include <env.h>
  12 #include <image.h>
  13 #include <lmb.h>
  14 #include <mapmem.h>
  15 #include <net.h>
  16 #include <net/tcp.h>
  17 #include <net/wget.h>
  18 #include <stdlib.h>
  19
  20 DECLARE_GLOBAL_DATA_PTR;
  21
  22 /* The default, change with environment variable 'httpdstp' */
  23 #define SERVER_PORT             80
  24
  25 static const char bootfile1[] = "GET ";
  26 static const char bootfile3[] = " HTTP/1.0\r\n\r\n";
  27 static const char http_eom[] = "\r\n\r\n";
  28 static const char http_ok[] = "200";
  29 static const char content_len[] = "Content-Length";
  30 static const char linefeed[] = "\r\n";
  31 static struct in_addr web_server_ip;
  32 static int our_port;
  33 static int wget_timeout_count;
  34
  35 struct pkt_qd {
  36         uchar *pkt;
  37         unsigned int tcp_seq_num;
  38         unsigned int len;
  39 };
  40
  41 /*
  42  * This is a control structure for out of order packets received.
  43  * The actual packet bufers are in the kernel space, and are
  44  * expected to be overwritten by the downloaded image.
  45  */
  46 #define PKTQ_SZ (PKTBUFSRX / 4)
  47 static struct pkt_qd pkt_q[PKTQ_SZ];
  48 static int pkt_q_idx;
  49 static unsigned long content_length;
  50 static unsigned int packets;
  51
  52 static unsigned int initial_data_seq_num;
  53
  54 static enum  wget_state current_wget_state;
  55
  56 static char *image_url;
  57 static unsigned int wget_timeout = WGET_TIMEOUT;
  58
  59 static enum net_loop_state wget_loop_state;
  60
  61 /* Timeout retry parameters */
  62 static u8 retry_action;                 /* actions for TCP retry */
  63 static unsigned int retry_tcp_ack_num;  /* TCP retry acknowledge number*/
  64 static unsigned int retry_tcp_seq_num;  /* TCP retry sequence number */
  65 static int retry_len;                   /* TCP retry length */
  66
  67 static ulong wget_load_size;
  68
  69 /**
  70  * wget_init_max_size() - initialize maximum load size
  71  *
  72  * Return:      0 if success, -1 if fails
  73  */
  74 static int wget_init_load_size(void)
  75 {
  76         struct lmb lmb;
  77         phys_size_t max_size;
  78
  79         lmb_init_and_reserve(&lmb, gd->bd, (void *)gd->fdt_blob);
  80
  81         max_size = lmb_get_free_size(&lmb, image_load_addr);
  82         if (!max_size)
  83                 return -1;
  84
  85         wget_load_size = max_size;
  86
  87         return 0;
  88 }
  89
  90 /**
  91  * store_block() - store block in memory
  92  * @src: source of data
  93  * @offset: offset
  94  * @len: length
  95  */
  96 static inline int store_block(uchar *src, unsigned int offset, unsigned int len)
  97 {
  98         ulong store_addr = image_load_addr + offset;
  99         ulong newsize = offset + len;
 100         uchar *ptr;
 101
 102         if (IS_ENABLED(CONFIG_LMB)) {
 103                 ulong end_addr = image_load_addr + wget_load_size;
 104
 105                 if (!end_addr)
 106                         end_addr = ULONG_MAX;
 107
 108                 if (store_addr < image_load_addr ||
 109                     store_addr + len > end_addr) {
 110                         printf("\nwget error: ");
 111                         printf("trying to overwrite reserved memory...\n");
 112                         return -1;
 113                 }
 114         }
 115
 116         ptr = map_sysmem(store_addr, len);
 117         memcpy(ptr, src, len);
 118         unmap_sysmem(ptr);
 119
 120         if (net_boot_file_size < (offset + len))
 121                 net_boot_file_size = newsize;
 122
 123         return 0;
 124 }
 125
 126 /**
 127  * wget_send_stored() - wget response dispatcher
 128  *
 129  * WARNING, This, and only this, is the place in wget.c where
 130  * SEQUENCE NUMBERS are swapped between incoming (RX)
 131  * and outgoing (TX).
 132  * Procedure wget_handler() is correct for RX traffic.
 133  */
 134 static void wget_send_stored(void)
 135 {
 136         u8 action = retry_action;
 137         int len = retry_len;
 138         unsigned int tcp_ack_num = retry_tcp_seq_num + (len == 0 ? 1 : len);
 139         unsigned int tcp_seq_num = retry_tcp_ack_num;
 140         unsigned int server_port;
 141         uchar *ptr, *offset;
 142
 143         server_port = env_get_ulong("httpdstp", 10, SERVER_PORT) & 0xffff;
 144
 145         switch (current_wget_state) {
 146         case WGET_CLOSED:
 147                 debug_cond(DEBUG_WGET, "wget: send SYN\n");
 148                 current_wget_state = WGET_CONNECTING;
 149                 net_send_tcp_packet(0, server_port, our_port, action,
 150                                     tcp_seq_num, tcp_ack_num);
 151                 packets = 0;
 152                 break;
 153         case WGET_CONNECTING:
 154                 pkt_q_idx = 0;
 155                 net_send_tcp_packet(0, server_port, our_port, action,
 156                                     tcp_seq_num, tcp_ack_num);
 157
 158                 ptr = net_tx_packet + net_eth_hdr_size() +
 159                         IP_TCP_HDR_SIZE + TCP_TSOPT_SIZE + 2;
 160                 offset = ptr;
 161
 162                 memcpy(offset, &bootfile1, strlen(bootfile1));
 163                 offset += strlen(bootfile1);
 164
 165                 memcpy(offset, image_url, strlen(image_url));
 166                 offset += strlen(image_url);
 167
 168                 memcpy(offset, &bootfile3, strlen(bootfile3));
 169                 offset += strlen(bootfile3);
 170                 net_send_tcp_packet((offset - ptr), server_port, our_port,
 171                                     TCP_PUSH, tcp_seq_num, tcp_ack_num);
 172                 current_wget_state = WGET_CONNECTED;
 173                 break;
 174         case WGET_CONNECTED:
 175         case WGET_TRANSFERRING:
 176         case WGET_TRANSFERRED:
 177                 net_send_tcp_packet(0, server_port, our_port, action,
 178                                     tcp_seq_num, tcp_ack_num);
 179                 break;
 180         }
 181 }
 182
 183 static void wget_send(u8 action, unsigned int tcp_seq_num,
 184                       unsigned int tcp_ack_num, int len)
 185 {
 186         retry_action = action;
 187         retry_tcp_ack_num = tcp_ack_num;
 188         retry_tcp_seq_num = tcp_seq_num;
 189         retry_len = len;
 190
 191         wget_send_stored();
 192 }
 193
 194 void wget_fail(char *error_message, unsigned int tcp_seq_num,
 195                unsigned int tcp_ack_num, u8 action)
 196 {
 197         printf("wget: Transfer Fail - %s\n", error_message);
 198         net_set_timeout_handler(0, NULL);
 199         wget_send(action, tcp_seq_num, tcp_ack_num, 0);
 200 }
 201
 202 void wget_success(u8 action, unsigned int tcp_seq_num,
 203                   unsigned int tcp_ack_num, int len, int packets)
 204 {
 205         printf("Packets received %d, Transfer Successful\n", packets);
 206         wget_send(action, tcp_seq_num, tcp_ack_num, len);
 207 }
 208
 209 /*
 210  * Interfaces of U-BOOT
 211  */
 212 static void wget_timeout_handler(void)
 213 {
 214         if (++wget_timeout_count > WGET_RETRY_COUNT) {
 215                 puts("\nRetry count exceeded; starting again\n");
 216                 wget_send(TCP_RST, 0, 0, 0);
 217                 net_start_again();
 218         } else {
 219                 puts("T ");
 220                 net_set_timeout_handler(wget_timeout +
 221                                         WGET_TIMEOUT * wget_timeout_count,
 222                                         wget_timeout_handler);
 223                 wget_send_stored();
 224         }
 225 }
 226
 227 #define PKT_QUEUE_OFFSET 0x20000
 228 #define PKT_QUEUE_PACKET_SIZE 0x800
 229
 230 static void wget_connected(uchar *pkt, unsigned int tcp_seq_num,
 231                            u8 action, unsigned int tcp_ack_num, unsigned int len)
 232 {
 233         uchar *pkt_in_q;
 234         char *pos;
 235         int hlen, i;
 236         uchar *ptr1;
 237
 238         pkt[len] = '\0';
 239         pos = strstr((char *)pkt, http_eom);
 240
 241         if (!pos) {
 242                 debug_cond(DEBUG_WGET,
 243                            "wget: Connected, data before Header %p\n", pkt);
 244                 pkt_in_q = (void *)image_load_addr + PKT_QUEUE_OFFSET +
 245                         (pkt_q_idx * PKT_QUEUE_PACKET_SIZE);
 246
 247                 ptr1 = map_sysmem((phys_addr_t)pkt_in_q, len);
 248                 memcpy(ptr1, pkt, len);
 249                 unmap_sysmem(ptr1);
 250
 251                 pkt_q[pkt_q_idx].pkt = pkt_in_q;
 252                 pkt_q[pkt_q_idx].tcp_seq_num = tcp_seq_num;
 253                 pkt_q[pkt_q_idx].len = len;
 254                 pkt_q_idx++;
 255
 256                 if (pkt_q_idx >= PKTQ_SZ) {
 257                         printf("wget: Fatal error, queue overrun!\n");
 258                         net_set_state(NETLOOP_FAIL);
 259
 260                         return;
 261                 }
 262         } else {
 263                 debug_cond(DEBUG_WGET, "wget: Connected HTTP Header %p\n", pkt);
 264                 /* sizeof(http_eom) - 1 is the string length of (http_eom) */
 265                 hlen = pos - (char *)pkt + sizeof(http_eom) - 1;
 266                 pos = strstr((char *)pkt, linefeed);
 267                 if (pos > 0)
 268                         i = pos - (char *)pkt;
 269                 else
 270                         i = hlen;
 271                 printf("%.*s", i,  pkt);
 272
 273                 current_wget_state = WGET_TRANSFERRING;
 274
 275                 if (strstr((char *)pkt, http_ok) == 0) {
 276                         debug_cond(DEBUG_WGET,
 277                                    "wget: Connected Bad Xfer\n");
 278                         initial_data_seq_num = tcp_seq_num + hlen;
 279                         wget_loop_state = NETLOOP_FAIL;
 280                         wget_send(action, tcp_seq_num, tcp_ack_num, len);
 281                 } else {
 282                         debug_cond(DEBUG_WGET,
 283                                    "wget: Connctd pkt %p  hlen %x\n",
 284                                    pkt, hlen);
 285                         initial_data_seq_num = tcp_seq_num + hlen;
 286
 287                         pos = strstr((char *)pkt, content_len);
 288                         if (!pos) {
 289                                 content_length = -1;
 290                         } else {
 291                                 pos += sizeof(content_len) + 2;
 292                                 strict_strtoul(pos, 10, &content_length);
 293                                 debug_cond(DEBUG_WGET,
 294                                            "wget: Connected Len %lu\n",
 295                                            content_length);
 296                         }
 297
 298                         net_boot_file_size = 0;
 299
 300                         if (len > hlen) {
 301                                 if (store_block(pkt + hlen, 0, len - hlen) != 0) {
 302                                         wget_loop_state = NETLOOP_FAIL;
 303                                         wget_fail("wget: store error\n", tcp_seq_num, tcp_ack_num, action);
 304                                         net_set_state(NETLOOP_FAIL);
 305                                         return;
 306                                 }
 307                         }
 308
 309                         debug_cond(DEBUG_WGET,
 310                                    "wget: Connected Pkt %p hlen %x\n",
 311                                    pkt, hlen);
 312
 313                         for (i = 0; i < pkt_q_idx; i++) {
 314                                 int err;
 315
 316                                 ptr1 = map_sysmem(
 317                                         (phys_addr_t)(pkt_q[i].pkt),
 318                                         pkt_q[i].len);
 319                                 err = store_block(ptr1,
 320                                           pkt_q[i].tcp_seq_num -
 321                                           initial_data_seq_num,
 322                                           pkt_q[i].len);
 323                                 unmap_sysmem(ptr1);
 324                                 debug_cond(DEBUG_WGET,
 325                                            "wget: Connctd pkt Q %p len %x\n",
 326                                            pkt_q[i].pkt, pkt_q[i].len);
 327                                 if (err) {
 328                                         wget_loop_state = NETLOOP_FAIL;
 329                                         wget_fail("wget: store error\n", tcp_seq_num, tcp_ack_num, action);
 330                                         net_set_state(NETLOOP_FAIL);
 331                                         return;
 332                                 }
 333                         }
 334                 }
 335         }
 336         wget_send(action, tcp_seq_num, tcp_ack_num, len);
 337 }
 338
 339 /**
 340  * wget_handler() - TCP handler of wget
 341  * @pkt: pointer to the application packet
 342  * @dport: destination TCP port
 343  * @sip: source IP address
 344  * @sport: source TCP port
 345  * @tcp_seq_num: TCP sequential number
 346  * @tcp_ack_num: TCP acknowledgment number
 347  * @action: TCP action (SYN, ACK, FIN, etc)
 348  * @len: packet length
 349  *
 350  * In the "application push" invocation, the TCP header with all
 351  * its information is pointed to by the packet pointer.
 352  */
 353 static void wget_handler(uchar *pkt, u16 dport,
 354                          struct in_addr sip, u16 sport,
 355                          u32 tcp_seq_num, u32 tcp_ack_num,
 356                          u8 action, unsigned int len)
 357 {
 358         enum tcp_state wget_tcp_state = tcp_get_tcp_state();
 359
 360         net_set_timeout_handler(wget_timeout, wget_timeout_handler);
 361         packets++;
 362
 363         switch (current_wget_state) {
 364         case WGET_CLOSED:
 365                 debug_cond(DEBUG_WGET, "wget: Handler: Error!, State wrong\n");
 366                 break;
 367         case WGET_CONNECTING:
 368                 debug_cond(DEBUG_WGET,
 369                            "wget: Connecting In len=%x, Seq=%u, Ack=%u\n",
 370                            len, tcp_seq_num, tcp_ack_num);
 371                 if (!len) {
 372                         if (wget_tcp_state == TCP_ESTABLISHED) {
 373                                 debug_cond(DEBUG_WGET,
 374                                            "wget: Cting, send, len=%x\n", len);
 375                                 wget_send(action, tcp_seq_num, tcp_ack_num,
 376                                           len);
 377                         } else {
 378                                 printf("%.*s", len,  pkt);
 379                                 wget_fail("wget: Handler Connected Fail\n",
 380                                           tcp_seq_num, tcp_ack_num, action);
 381                         }
 382                 }
 383                 break;
 384         case WGET_CONNECTED:
 385                 debug_cond(DEBUG_WGET, "wget: Connected seq=%u, len=%x\n",
 386                            tcp_seq_num, len);
 387                 if (!len) {
 388                         wget_fail("Image not found, no data returned\n",
 389                                   tcp_seq_num, tcp_ack_num, action);
 390                 } else {
 391                         wget_connected(pkt, tcp_seq_num, action, tcp_ack_num, len);
 392                 }
 393                 break;
 394         case WGET_TRANSFERRING:
 395                 debug_cond(DEBUG_WGET,
 396                            "wget: Transferring, seq=%x, ack=%x,len=%x\n",
 397                            tcp_seq_num, tcp_ack_num, len);
 398
 399                 if (tcp_seq_num >= initial_data_seq_num &&
 400                     store_block(pkt, tcp_seq_num - initial_data_seq_num,
 401                                 len) != 0) {
 402                         wget_fail("wget: store error\n",
 403                                   tcp_seq_num, tcp_ack_num, action);
 404                         net_set_state(NETLOOP_FAIL);
 405                         return;
 406                 }
 407
 408                 switch (wget_tcp_state) {
 409                 case TCP_FIN_WAIT_2:
 410                         wget_send(TCP_ACK, tcp_seq_num, tcp_ack_num, len);
 411                         fallthrough;
 412                 case TCP_SYN_SENT:
 413                 case TCP_SYN_RECEIVED:
 414                 case TCP_CLOSING:
 415                 case TCP_FIN_WAIT_1:
 416                 case TCP_CLOSED:
 417                         net_set_state(NETLOOP_FAIL);
 418                         break;
 419                 case TCP_ESTABLISHED:
 420                         wget_send(TCP_ACK, tcp_seq_num, tcp_ack_num,
 421                                   len);
 422                         wget_loop_state = NETLOOP_SUCCESS;
 423                         break;
 424                 case TCP_CLOSE_WAIT:     /* End of transfer */
 425                         current_wget_state = WGET_TRANSFERRED;
 426                         wget_send(action | TCP_ACK | TCP_FIN,
 427                                   tcp_seq_num, tcp_ack_num, len);
 428                         break;
 429                 }
 430                 break;
 431         case WGET_TRANSFERRED:
 432                 printf("Packets received %d, Transfer Successful\n", packets);
 433                 net_set_state(wget_loop_state);
 434                 break;
 435         }
 436 }
 437
 438 #define RANDOM_PORT_START 1024
 439 #define RANDOM_PORT_RANGE 0x4000
 440
 441 /**
 442  * random_port() - make port a little random (1024-17407)
 443  *
 444  * Return: random port number from 1024 to 17407
 445  *
 446  * This keeps the math somewhat trivial to compute, and seems to work with
 447  * all supported protocols/clients/servers
 448  */
 449 static unsigned int random_port(void)
 450 {
 451         return RANDOM_PORT_START + (get_timer(0) % RANDOM_PORT_RANGE);
 452 }
 453
 454 #define BLOCKSIZE 512
 455
 456 void wget_start(void)
 457 {
 458         image_url = strchr(net_boot_file_name, ':');
 459         if (image_url > 0) {
 460                 web_server_ip = string_to_ip(net_boot_file_name);
 461                 ++image_url;
 462                 net_server_ip = web_server_ip;
 463         } else {
 464                 web_server_ip = net_server_ip;
 465                 image_url = net_boot_file_name;
 466         }
 467
 468         debug_cond(DEBUG_WGET,
 469                    "wget: Transfer HTTP Server %pI4; our IP %pI4\n",
 470                    &web_server_ip, &net_ip);
 471
 472         /* Check if we need to send across this subnet */
 473         if (net_gateway.s_addr && net_netmask.s_addr) {
 474                 struct in_addr our_net;
 475                 struct in_addr server_net;
 476
 477                 our_net.s_addr = net_ip.s_addr & net_netmask.s_addr;
 478                 server_net.s_addr = net_server_ip.s_addr & net_netmask.s_addr;
 479                 if (our_net.s_addr != server_net.s_addr)
 480                         debug_cond(DEBUG_WGET,
 481                                    "wget: sending through gateway %pI4",
 482                                    &net_gateway);
 483         }
 484         debug_cond(DEBUG_WGET, "URL '%s'\n", image_url);
 485
 486         if (net_boot_file_expected_size_in_blocks) {
 487                 debug_cond(DEBUG_WGET, "wget: Size is 0x%x Bytes = ",
 488                            net_boot_file_expected_size_in_blocks * BLOCKSIZE);
 489                 print_size(net_boot_file_expected_size_in_blocks * BLOCKSIZE,
 490                            "");
 491         }
 492         debug_cond(DEBUG_WGET,
 493                    "\nwget:Load address: 0x%lx\nLoading: *\b", image_load_addr);
 494
 495         if (IS_ENABLED(CONFIG_LMB)) {
 496                 if (wget_init_load_size()) {
 497                         printf("\nwget error: ");
 498                         printf("trying to overwrite reserved memory...\n");
 499                         net_set_state(NETLOOP_FAIL);
 500                         return;
 501                 }
 502         }
 503
 504         net_set_timeout_handler(wget_timeout, wget_timeout_handler);
 505         tcp_set_tcp_handler(wget_handler);
 506
 507         wget_timeout_count = 0;
 508         current_wget_state = WGET_CLOSED;
 509
 510         our_port = random_port();
 511
 512         /*
 513          * Zero out server ether to force arp resolution in case
 514          * the server ip for the previous u-boot command, for example dns
 515          * is not the same as the web server ip.
 516          */
 517
 518         memset(net_server_ethaddr, 0, 6);
 519
 520         wget_send(TCP_SYN, 0, 0, 0);
 521 }
 522
 523 #if (IS_ENABLED(CONFIG_CMD_DNS))
 524 int wget_with_dns(ulong dst_addr, char *uri)
 525 {
 526         int ret;
 527         char *s, *host_name, *file_name, *str_copy;
 528
 529         /*
 530          * Download file using wget.
 531          *
 532          * U-Boot wget takes the target uri in this format.
 533          *  "<http server ip>:<file path>"  e.g.) 192.168.1.1:/sample/test.iso
 534          * Need to resolve the http server ip address before starting wget.
 535          */
 536         str_copy = strdup(uri);
 537         if (!str_copy)
 538                 return -ENOMEM;
 539
 540         s = str_copy + strlen("http://");
 541         host_name = strsep(&s, "/");
 542         if (!s) {
 543                 log_err("Error: invalied uri, no file path\n");
 544                 ret = -EINVAL;
 545                 goto out;
 546         }
 547         file_name = s;
 548
 549         /* TODO: If the given uri has ip address for the http server, skip dns */
 550         net_dns_resolve = host_name;
 551         net_dns_env_var = "httpserverip";
 552         if (net_loop(DNS) < 0) {
 553                 log_err("Error: dns lookup of %s failed, check setup\n", net_dns_resolve);
 554                 ret = -EINVAL;
 555                 goto out;
 556         }
 557         s = env_get("httpserverip");
 558         if (!s) {
 559                 ret = -EINVAL;
 560                 goto out;
 561         }
 562
 563         strlcpy(net_boot_file_name, s, sizeof(net_boot_file_name));
 564         strlcat(net_boot_file_name, ":/", sizeof(net_boot_file_name)); /* append '/' which is removed by strsep() */
 565         strlcat(net_boot_file_name, file_name, sizeof(net_boot_file_name));
 566         image_load_addr = dst_addr;
 567         ret = net_loop(WGET);
 568
 569 out:
 570         free(str_copy);
 571
 572         return ret;
 573 }
 574 #endif
 575
 576 /**
 577  * wget_validate_uri() - validate the uri for wget
 578  *
 579  * @uri:        uri string
 580  *
 581  * This function follows the current U-Boot wget implementation.
 582  * scheme: only "http:" is supported
 583  * authority:
 584  *   - user information: not supported
 585  *   - host: supported
 586  *   - port: not supported(always use the default port)
 587  *
 588  * Uri is expected to be correctly percent encoded.
 589  * This is the minimum check, control codes(0x1-0x19, 0x7F, except '\0')
 590  * and space character(0x20) are not allowed.
 591  *
 592  * TODO: stricter uri conformance check
 593  *
 594  * Return:      true on success, false on failure
 595  */
 596 bool wget_validate_uri(char *uri)
 597 {
 598         char c;
 599         bool ret = true;
 600         char *str_copy, *s, *authority;
 601
 602         for (c = 0x1; c < 0x21; c++) {
 603                 if (strchr(uri, c)) {
 604                         log_err("invalid character is used\n");
 605                         return false;
 606                 }
 607         }
 608         if (strchr(uri, 0x7f)) {
 609                 log_err("invalid character is used\n");
 610                 return false;
 611         }
 612
 613         if (strncmp(uri, "http://", 7)) {
 614                 log_err("only http:// is supported\n");
 615                 return false;
 616         }
 617         str_copy = strdup(uri);
 618         if (!str_copy)
 619                 return false;
 620
 621         s = str_copy + strlen("http://");
 622         authority = strsep(&s, "/");
 623         if (!s) {
 624                 log_err("invalid uri, no file path\n");
 625                 ret = false;
 626                 goto out;
 627         }
 628         s = strchr(authority, '@');
 629         if (s) {
 630                 log_err("user information is not supported\n");
 631                 ret = false;
 632                 goto out;
 633         }
 634         s = strchr(authority, ':');
 635         if (s) {
 636                 log_err("user defined port is not supported\n");
 637                 ret = false;
 638                 goto out;
 639         }
 640
 641 out:
 642         free(str_copy);
 643
 644         return ret;
 645 }