[tftp] T1261: bugfix listening on multiple IP addesses

tftp-hpa which is the TFTP daemon used by VyOS does not support
listening on multiple IP adresses. With this limitation we will start
one TFTP daemon instance per configured listen-address via systemd.

(cherry picked from commit 735a24d58ddf55294241ce8160471fe9be062498)

2 files changed, 62 insertions, 56 deletions

diff --git a/src/conf_mode/tftp_server.py b/src/conf_mode/tftp_server.py
index 0984b4545..5f119be3a 100755
--- a/src/conf_mode/tftp_server.py
+++ b/src/conf_mode/tftp_server.py
@@ -20,6 +20,8 @@ import sys
 import os
 import stat
 import pwd
+import copy
+import glob
 
 import jinja2
 import vyos.validate
@@ -27,25 +29,13 @@ import vyos.validate
 from vyos.config import Config
 from vyos import ConfigError
 
-config_file = r'/etc/default/tftpd-hpa'
+config_file = r'/etc/default/tftpd'
 
 # Please be careful if you edit the template.
 config_tmpl = """
 ### Autogenerated by tftp_server.py ###
+DAEMON_ARGS="--listen --user tftp --address {% for a in listen-%}{{ a }}{% endfor %} --secure{% if allow_upload %} --create --umask 000{% endif %} {{ directory }}"
 
-# See manual at https://linux.die.net/man/8/tftpd
-
-TFTP_USERNAME="tftp"
-TFTP_DIRECTORY="{{ directory }}"
-{% if listen_ipv4 and listen_ipv6 -%}
-TFTP_ADDRESS="{% for a in listen_ipv4 -%}{{ a }}:{{ port }}{{- " --address " if not loop.last -}}{% endfor -%} {% for a in listen_ipv6 %} --address [{{ a }}]:{{ port }}{% endfor -%}"
-{% elif listen_ipv4 -%}
-TFTP_ADDRESS="{% for a in listen_ipv4 -%}{{ a }}:{{ port }}{{- " --address " if not loop.last -}}{% endfor %} -4"
-{% elif listen_ipv6 -%}
-TFTP_ADDRESS="{% for a in listen_ipv6 -%}[{{ a }}]:{{ port }}{{- " --address " if not loop.last -}}{% endfor %} -6"
-{%- endif %}
-
-TFTP_OPTIONS="--secure {% if allow_upload %}--create --umask 000{% endif %}"
 
 """
 
@@ -53,12 +43,11 @@ default_config_data = {
     'directory': '',
     'allow_upload': False,
     'port': '69',
-    'listen_ipv4': [],
-    'listen_ipv6': []
+    'listen': []
 }
 
 def get_config():
-    tftpd = default_config_data
+    tftpd = copy.deepcopy(default_config_data)
     conf = Config()
     if not conf.exists('service tftp-server'):
         return None
@@ -68,18 +57,13 @@ def get_config():
     if conf.exists('directory'):
         tftpd['directory'] = conf.return_value('directory')
 
-    if conf.exists('allow-upload'):
+    if conf.exists('allow_upload'):
         tftpd['allow_upload'] = True
 
     if conf.exists('port'):
         tftpd['port'] = conf.return_value('port')
 
-    if conf.exists('listen-address'):
-        for addr in conf.return_values('listen-address'):
-            if vyos.validate.is_ipv4(addr):
-                tftpd['listen_ipv4'].append(addr)
-            else:
-                tftpd['listen_ipv6'].append(addr)
+    tftpd['listen'] = conf.return_values('listen-address')
 
     return tftpd
 
@@ -92,55 +76,63 @@ def verify(tftpd):
     if not tftpd['directory']:
         raise ConfigError('TFTP root directory must be configured!')
 
-    if not (tftpd['listen_ipv4'] or tftpd['listen_ipv6']):
+    if not tftpd['listen']:
         raise ConfigError('TFTP server listen address must be configured!')
 
-    for addr in tftpd['listen_ipv4']:
-        # we always bind to localhost
-        if '127.0.0.1' not in tftpd['listen_ipv4']:
-            tftpd['listen_ipv4'].append('127.0.0.1')
-
-        if not vyos.validate.is_addr_assigned(addr):
-            print('WARNING: TFTP server listen address {0} not configured!'.format(addr))
-
-    for addr in tftpd['listen_ipv6']:
-        # we always bind to localhost
-        if '::1' not in tftpd['listen_ipv6']:
-            tftpd['listen_ipv6'].append('::1')
-
+    for addr in tftpd['listen']:
         if not vyos.validate.is_addr_assigned(addr):
-            print('WARNING: TFTP server listen address {0} not configured!'.format(addr))
+            print('WARNING: TFTP server listen address {0} not assigned to any interface!'.format(addr))
 
     return None
 
 def generate(tftpd):
+    # cleanup any available configuration file
+    # files will be recreated on demand
+    for i in glob.glob(config_file + '*'):
+        os.unlink(i)
+
     # bail out early - looks like removal from running config
     if tftpd is None:
         return None
 
-    tmpl = jinja2.Template(config_tmpl)
-    config_text = tmpl.render(tftpd)
-    with open(config_file, 'w') as f:
-        f.write(config_text)
+    idx = 0
+    for listen in tftpd['listen']:
+        config = copy.deepcopy(tftpd)
+        if vyos.validate.is_ipv4(listen):
+            config['listen'] = [listen + ":" + tftpd['port'] + " -4"]
+        else:
+            config['listen'] = ["[" + listen + "]" + tftpd['port'] + " -6"]
+
+        tmpl = jinja2.Template(config_tmpl)
+        config_text = tmpl.render(config)
+        file = config_file + str(idx)
+        with open(file, 'w') as f:
+            f.write(config_text)
+
+        idx = idx + 1
 
     return None
 
 def apply(tftpd):
-    if tftpd is not None:
+    # stop all services first - then we will decide
+    os.system('sudo systemctl stop tftpd@{0..20}')
 
-        tftp_root = tftpd['directory']
-        if not os.path.exists(tftp_root):
-            os.makedirs(tftp_root)
-            os.chmod(tftp_root, stat.S_IRUSR|stat.S_IWUSR|stat.S_IXUSR|stat.S_IRGRP|stat.S_IXGRP|stat.S_IROTH|stat.S_IXOTH)
-            # get UNIX uid for user 'tftp'
-            tftp_uid = pwd.getpwnam('tftp').pw_uid
-            os.chown(tftp_root, tftp_uid, -1)
+    # bail out early - e.g. service deletion
+    if tftpd is None:
+        return None
 
-        os.system('sudo systemctl restart tftpd-hpa.service')
-    else:
-        # TFTP server support is removed in the commit
-        os.system('sudo systemctl stop tftpd-hpa.service')
-        os.unlink(config_file)
+    tftp_root = tftpd['directory']
+    if not os.path.exists(tftp_root):
+        os.makedirs(tftp_root)
+        os.chmod(tftp_root, stat.S_IRUSR|stat.S_IWUSR|stat.S_IXUSR|stat.S_IRGRP|stat.S_IXGRP|stat.S_IROTH|stat.S_IXOTH)
+        # get UNIX uid for user 'tftp'
+        tftp_uid = pwd.getpwnam('tftp').pw_uid
+        os.chown(tftp_root, tftp_uid, -1)
+
+    idx = 0
+    for listen in tftpd['listen']:
+        os.system('sudo systemctl restart tftpd@{0}.service'.format(idx))
+        idx = idx + 1
 
     return None
 
diff --git a/src/systemd/tftpd@.service b/src/systemd/tftpd@.service
new file mode 100644
index 000000000..e5c289466
--- /dev/null
+++ b/src/systemd/tftpd@.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=TFTP server
+After=network.target
+RequiresMountsFor=/run
+
+[Service]
+Type=forking
+#NotifyAccess=main
+EnvironmentFile=-/etc/default/tftpd%I
+ExecStart=/usr/sbin/in.tftpd "$DAEMON_ARGS"
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target