rex 1.0.2 → 2.0.2

data/lib/rex/proto/tftp.rb

@@ -0,0 +1,13 @@
+# -*- coding: binary -*-
+#
+# TFTP Server implementation according to:
+#
+# RFC1350, RFC2347, RFC2348, RFC2349
+#
+# written by jduck <jduck [at] metasploit.com>
+# thx to scriptjunkie for pointing out option extensions
+#
+
+require 'rex/proto/tftp/constants'
+require 'rex/proto/tftp/server'
+require 'rex/proto/tftp/client'

data/lib/rex/proto/tftp/client.rb

@@ -0,0 +1,344 @@
+# -*- coding: binary -*-
+require 'rex/socket'
+require 'rex/proto/tftp'
+require 'tempfile'
+
+module Rex
+module Proto
+module TFTP
+
+#
+# TFTP Client class
+#
+# Note that TFTP has blocks, and so does Ruby. Watch out with the variable names!
+#
+# The big gotcha right now is that setting the mode between octet, netascii, or
+# anything else doesn't actually do anything other than declare it to the
+# server.
+#
+# Also, since TFTP clients act as both clients and servers, we use two
+# threads to handle transfers, regardless of the direction. For this reason,
+# the transfer actions are nonblocking; if you need to see the
+# results of a transfer before doing something else, check the boolean complete
+# attribute and any return data in the :status attribute. It's a little
+# weird like that.
+#
+# Finally, most (all?) clients will alter the data in netascii mode in order
+# to try to conform to the RFC standard for what "netascii" means, but there are
+# ambiguities in implementations on things like if nulls are allowed, what
+# to do with Unicode, and all that. For this reason, "octet" is default, and
+# if you want to send "netascii" data, it's on you to fix up your source data
+# prior to sending it.
+#
+class Client
+
+  attr_accessor :local_host, :local_port, :peer_host, :peer_port
+  attr_accessor :threads, :context, :server_sock, :client_sock
+  attr_accessor :local_file, :remote_file, :mode, :action
+  attr_accessor :complete, :recv_tempfile, :status
+  attr_accessor :block_size # This definitely breaks spec, should only use for fuzz/sploit.
+
+  # Returns an array of [code, type, msg]. Data packets
+  # specifically will /not/ unpack, since that would drop any trailing spaces or nulls.
+  def parse_tftp_response(str)
+    return nil unless str.length >= 4
+    ret = str.unpack("nnA*")
+    ret[2] = str[4,str.size] if ret[0] == OpData
+    return ret
+  end
+
+  def initialize(params)
+    self.threads = []
+    self.local_host = params["LocalHost"] || "0.0.0.0"
+    self.local_port = params["LocalPort"] || (1025 + rand(0xffff-1025))
+    self.peer_host = params["PeerHost"] || (raise ArgumentError, "Need a peer host.")
+    self.peer_port = params["PeerPort"] || 69
+    self.context = params["Context"]
+    self.local_file = params["LocalFile"]
+    self.remote_file = params["RemoteFile"] || (::File.split(self.local_file).last if self.local_file)
+    self.mode = params["Mode"] || "octet"
+    self.action = params["Action"] || (raise ArgumentError, "Need an action.")
+    self.block_size = params["BlockSize"] || 512
+  end
+
+  #
+  # Methods for both upload and download
+  #
+
+  def start_server_socket
+    self.server_sock = Rex::Socket::Udp.create(
+      'LocalHost' => local_host,
+      'LocalPort' => local_port,
+      'Context'   => context
+    )
+    if self.server_sock and block_given?
+      yield "Started TFTP client listener on #{local_host}:#{local_port}"
+    end
+    self.threads << Rex::ThreadFactory.spawn("TFTPServerMonitor", false) {
+      if block_given?
+        monitor_server_sock {|msg| yield msg}
+      else
+        monitor_server_sock
+      end
+    }
+  end
+
+  def monitor_server_sock
+    yield "Listening for incoming ACKs" if block_given?
+    res = self.server_sock.recvfrom(65535)
+    if res and res[0]
+      code, type, data = parse_tftp_response(res[0])
+      if code == OpAck and self.action == :upload
+        if block_given?
+          yield "WRQ accepted, sending the file." if type == 0
+          send_data(res[1], res[2]) {|msg| yield msg}
+        else
+          send_data(res[1], res[2])
+        end
+      elsif code == OpData and self.action == :download
+        if block_given?
+          recv_data(res[1], res[2], data) {|msg| yield msg}
+        else
+          recv_data(res[1], res[2], data)
+        end
+      elsif code == OpError
+        yield("Aborting, got error type:%d, message:'%s'" % [type, data]) if block_given?
+        self.status = {:error => [code, type, data]}
+      else
+        yield("Aborting, got code:%d, type:%d, message:'%s'" % [code, type, data]) if block_given?
+        self.status = {:error => [code, type, data]}
+      end
+    end
+    stop
+  end
+
+  def monitor_client_sock
+    res = self.client_sock.recvfrom(65535)
+    if res[1] # Got a response back, so that's never good; Acks come back on server_sock.
+      code, type, data = parse_tftp_response(res[0])
+      yield("Aborting, got code:%d, type:%d, message:'%s'" % [code, type, data]) if block_given?
+      self.status = {:error => [code, type, data]}
+      stop
+    end
+  end
+
+  def stop
+    self.complete = true
+    begin
+      self.server_sock.close
+      self.client_sock.close
+      self.server_sock = nil
+      self.client_sock = nil
+      self.threads.each {|t| t.kill}
+    rescue
+      nil
+    end
+  end
+
+  #
+  # Methods for download
+  #
+
+  def rrq_packet
+    req = [OpRead, self.remote_file, self.mode]
+    packstr = "na#{self.remote_file.length+1}a#{self.mode.length+1}"
+    req.pack(packstr)
+  end
+
+  def ack_packet(blocknum=0)
+    req = [OpAck, blocknum].pack("nn")
+  end
+
+  def send_read_request(&block)
+    self.status = nil
+    self.complete = false
+    if block_given?
+      start_server_socket {|msg| yield msg}
+    else
+      start_server_socket
+    end
+    self.client_sock = Rex::Socket::Udp.create(
+      'PeerHost'  => peer_host,
+      'PeerPort'  => peer_port,
+      'LocalHost' => local_host,
+      'LocalPort' => local_port,
+      'Context'   => context
+    )
+    self.client_sock.sendto(rrq_packet, peer_host, peer_port)
+    self.threads << Rex::ThreadFactory.spawn("TFTPClientMonitor", false) {
+      if block_given?
+        monitor_client_sock {|msg| yield msg}
+      else
+        monitor_client_sock
+      end
+    }
+    until self.complete
+      return self.status
+    end
+  end
+
+  def recv_data(host, port, first_block)
+    self.recv_tempfile = Rex::Quickfile.new('msf-tftp')
+    recvd_blocks = 1
+    if block_given?
+      yield "Source file: #{self.remote_file}, destination file: #{self.local_file}"
+      yield "Received and acknowledged #{first_block.size} in block #{recvd_blocks}"
+    end
+    if block_given?
+      write_and_ack_data(first_block,1,host,port) {|msg| yield msg}
+    else
+      write_and_ack_data(first_block,1,host,port)
+    end
+    current_block = first_block
+    while current_block.size == 512
+      res = self.server_sock.recvfrom(65535)
+      if res and res[0]
+        code, block_num, current_block = parse_tftp_response(res[0])
+        if code == 3
+          if block_given?
+            write_and_ack_data(current_block,block_num,host,port) {|msg| yield msg}
+          else
+            write_and_ack_data(current_block,block_num,host,port)
+          end
+          recvd_blocks += 1
+        else
+          yield("Aborting, got code:%d, type:%d, message:'%s'" % [code, type, msg]) if block_given?
+          stop
+        end
+      end
+    end
+    if block_given?
+      yield("Transferred #{self.recv_tempfile.size} bytes in #{recvd_blocks} blocks, download complete!")
+    end
+    self.status = {:success => [
+      self.local_file,
+      self.remote_file,
+      self.recv_tempfile.size,
+      recvd_blocks.size]
+    }
+    self.recv_tempfile.close
+    stop
+  end
+
+  def write_and_ack_data(data,blocknum,host,port)
+    self.recv_tempfile.write(data)
+    self.recv_tempfile.flush
+    req = ack_packet(blocknum)
+    self.server_sock.sendto(req, host, port)
+    yield "Received and acknowledged #{data.size} in block #{blocknum}" if block_given?
+  end
+
+  #
+  # Methods for upload
+  #
+
+  def wrq_packet
+    req = [OpWrite, self.remote_file, self.mode]
+    packstr = "na#{self.remote_file.length+1}a#{self.mode.length+1}"
+    req.pack(packstr)
+  end
+
+  # Note that the local filename for uploading need not be a real filename --
+  # if it begins with DATA: it can be any old string of bytes. If it's missing
+  # completely, then just quit.
+  def blockify_file_or_data
+    if self.local_file =~ /^DATA:(.*)/m
+      data = $1
+    elsif ::File.file?(self.local_file) and ::File.readable?(self.local_file)
+      data = ::File.open(self.local_file, "rb") {|f| f.read f.stat.size} rescue []
+    else
+      return []
+    end
+    data_blocks = data.scan(/.{1,#{block_size}}/m)
+    # Drop any trailing empty blocks
+    if data_blocks.size > 1 and data_blocks.last.empty?
+      data_blocks.pop
+    end
+    return data_blocks
+  end
+
+  def send_write_request(&block)
+    self.status = nil
+    self.complete = false
+    if block_given?
+      start_server_socket {|msg| yield msg}
+    else
+      start_server_socket
+    end
+    self.client_sock = Rex::Socket::Udp.create(
+      'PeerHost'  => peer_host,
+      'PeerPort'  => peer_port,
+      'LocalHost' => local_host,
+      'LocalPort' => local_port,
+      'Context'   => context
+    )
+    self.client_sock.sendto(wrq_packet, peer_host, peer_port)
+    self.threads << Rex::ThreadFactory.spawn("TFTPClientMonitor", false) {
+      if block_given?
+        monitor_client_sock {|msg| yield msg}
+      else
+        monitor_client_sock
+      end
+    }
+    until self.complete
+      return self.status
+    end
+  end
+
+  def send_data(host,port)
+    self.status = {:write_allowed => true}
+    data_blocks = blockify_file_or_data()
+    if data_blocks.empty?
+      yield "Closing down since there is no data to send." if block_given?
+      self.status = {:success => [self.local_file, self.local_file, 0, 0]}
+      return nil
+    end
+    sent_data = 0
+    sent_blocks = 0
+    expected_blocks = data_blocks.size
+    expected_size = data_blocks.join.size
+    if block_given?
+      yield "Source file: #{self.local_file =~ /^DATA:/ ? "(Data)" : self.remote_file}, destination file: #{self.remote_file}"
+      yield "Sending #{expected_size} bytes (#{expected_blocks} blocks)"
+    end
+    data_blocks.each_with_index do |data_block,idx|
+      req = [OpData, (idx + 1), data_block].pack("nnA*")
+      if self.server_sock.sendto(req, host, port) > 0
+        sent_data += data_block.size
+      end
+      res = self.server_sock.recvfrom(65535)
+      if res
+        code, type, msg = parse_tftp_response(res[0])
+        if code == 4
+          sent_blocks += 1
+          yield "Sent #{data_block.size} bytes in block #{sent_blocks}" if block_given?
+        else
+          if block_given?
+            yield "Got an unexpected response: Code:%d, Type:%d, Message:'%s'. Aborting." % [code, type, msg]
+          end
+          break
+        end
+      end
+    end
+    if block_given?
+      if(sent_data == expected_size)
+        yield("Transferred #{sent_data} bytes in #{sent_blocks} blocks, upload complete!")
+      else
+        yield "Upload complete, but with errors."
+      end
+    end
+    if sent_data == expected_size
+    self.status = {:success => [
+        self.local_file,
+        self.remote_file,
+        sent_data,
+        sent_blocks
+      ] }
+    end
+  end
+
+end
+
+end
+end
+end

data/lib/rex/proto/tftp/constants.rb

@@ -0,0 +1,39 @@
+# -*- coding: binary -*-
+require 'rex/proto/tftp'
+
+module Rex
+module Proto
+module TFTP
+
+OPCODES = %w{ Unknown RRQ WRQ DATA ACK ERROR }
+OpRead = 1
+OpWrite = 2
+OpData = 3
+OpAck = 4
+OpError = 5
+OpOptAck = 6
+
+ERRCODES = [
+  "Undefined",
+  "File not found",
+  "Access violation",
+  "Disk full or allocation exceeded",
+  "Illegal TFTP operation",
+  "Unknown transfer ID",
+  "File already exists",
+  "No such user",
+  "Failed option negotiation"
+]
+
+ErrFileNotFound = 1
+ErrAccessViolation = 2
+ErrDiskFull = 3
+ErrIllegalOperation = 4
+ErrUnknownTransferId = 5
+ErrFileExists = 6
+ErrNoSuchUser = 7
+ErrFailedOptNegotiation = 8
+
+end
+end
+end

data/lib/rex/proto/tftp/server.rb

@@ -0,0 +1,497 @@
+# -*- coding: binary -*-
+require 'rex/socket'
+require 'rex/proto/tftp'
+
+module Rex
+module Proto
+module TFTP
+
+#
+# Little util function
+#
+def self.get_string(data)
+  idx = data.index("\x00")
+  return nil if not idx
+  ret = data.slice!(0, idx)
+  # Slice off the nul byte.
+  data.slice!(0,1)
+  ret
+end
+
+
+##
+#
+# TFTP Server class
+#
+##
+class Server
+
+  def initialize(port = 69, listen_host = '0.0.0.0', context = {})
+    self.listen_host = listen_host
+    self.listen_port = port
+    self.context = context
+    self.sock = nil
+    @shutting_down = false
+    @output_dir = nil
+    @tftproot = nil
+
+    self.files = []
+    self.uploaded = []
+    self.transfers = []
+  end
+
+
+  #
+  # Start the TFTP server
+  #
+  def start
+    self.sock = Rex::Socket::Udp.create(
+      'LocalHost' => listen_host,
+      'LocalPort' => listen_port,
+      'Context'   => context
+      )
+
+    self.thread = Rex::ThreadFactory.spawn("TFTPServerMonitor", false) {
+      monitor_socket
+    }
+  end
+
+
+  #
+  # Stop the TFTP server
+  #
+  def stop
+    @shutting_down = true
+
+    # Wait a maximum of 30 seconds for all transfers to finish.
+    start = ::Time.now
+    while (self.transfers.length > 0)
+      ::IO.select(nil, nil, nil, 0.5)
+      dur = ::Time.now - start
+      break if (dur > 30)
+    end
+
+    self.files.clear
+    self.thread.kill
+    self.sock.close rescue nil # might be closed already
+  end
+
+
+  #
+  # Register a filename and content for a client to request
+  #
+  def register_file(fn, content, once = false)
+    self.files << {
+      :name => fn,
+      :data => content,
+      :once => once
+    }
+  end
+
+
+  #
+  # Register an entire directory to serve files from
+  #
+  def set_tftproot(rootdir)
+    @tftproot = rootdir if ::File.directory?(rootdir)
+  end
+
+
+  #
+  # Register a directory to write uploaded files to
+  #
+  def set_output_dir(outdir)
+    @output_dir = outdir if ::File.directory?(outdir)
+  end
+
+
+  #
+  # Send an error packet w/the specified code and string
+  #
+  def send_error(from, num)
+    if (num < 1 or num >= ERRCODES.length)
+      # ignore..
+      return
+    end
+    pkt = [OpError, num].pack('nn')
+    pkt << ERRCODES[num]
+    pkt << "\x00"
+    send_packet(from, pkt)
+  end
+
+
+  #
+  # Send a single packet to the specified host
+  #
+  def send_packet(from, pkt)
+    self.sock.sendto(pkt, from[0], from[1])
+  end
+
+
+  #
+  # Find the hash entry for a file that may be offered
+  #
+  def find_file(fname)
+    # Files served via register_file() take precedence.
+    self.files.each do |f|
+      if (fname == f[:name])
+        return f
+      end
+    end
+
+    # Now, if we have a tftproot, see if it can serve from it
+    if @tftproot
+      return find_file_in_root(fname)
+    end
+
+    nil
+  end
+
+
+  #
+  # Find the file in the specified tftp root and add a temporary
+  # entry to the files hash.
+  #
+  def find_file_in_root(fname)
+    fn = ::File.expand_path(::File.join(@tftproot, fname))
+
+    # Don't allow directory traversal
+    return nil if fn.index(@tftproot) != 0
+
+    return nil if not ::File.file?(fn) or not ::File.readable?(fn)
+
+    # Read the file contents, and register it as being served once
+    data = data = ::File.open(fn, "rb") { |fd| fd.read(fd.stat.size) }
+    register_file(fname, data)
+
+    # Return the last file in the array
+    return self.files[-1]
+  end
+
+
+  attr_accessor :listen_host, :listen_port, :context
+  attr_accessor :sock, :files, :transfers, :uploaded
+  attr_accessor :thread
+
+  attr_accessor :incoming_file_hook
+
+protected
+
+  def find_transfer(type, from, block)
+    self.transfers.each do |tr|
+      if (tr[:type] == type and tr[:from] == from and tr[:block] == block)
+        return tr
+      end
+    end
+    nil
+  end
+
+  def save_output(tr)
+    self.uploaded << tr[:file]
+
+    return incoming_file_hook.call(tr) if incoming_file_hook
+
+    if @output_dir
+      fn = tr[:file][:name].split(File::SEPARATOR)[-1]
+      if fn
+        fn = ::File.join(@output_dir, Rex::FileUtils.clean_path(fn))
+        ::File.open(fn, "wb") { |fd|
+          fd.write(tr[:file][:data])
+        }
+      end
+    end
+  end
+
+
+  def check_retransmission(tr)
+    elapsed = ::Time.now - tr[:last_sent]
+    if (elapsed >= tr[:timeout])
+      # max retries reached?
+      if (tr[:retries] < 3)
+        #if (tr[:type] == OpRead)
+        #	puts "[-] ack timed out, resending block"
+        #else
+        #	puts "[-] block timed out, resending ack"
+        #end
+        tr[:last_sent] = nil
+        tr[:retries] += 1
+      else
+        #puts "[-] maximum tries reached, terminating transfer"
+        self.transfers.delete(tr)
+      end
+    end
+  end
+
+
+  #
+  # See if there is anything to do.. If so, dispatch it.
+  #
+  def monitor_socket
+    while true
+      rds = [@sock]
+      wds = []
+      self.transfers.each do |tr|
+        if (not tr[:last_sent])
+          wds << @sock
+          break
+        end
+      end
+      eds = [@sock]
+
+      r,w,e = ::IO.select(rds,wds,eds,1)
+
+      if (r != nil and r[0] == self.sock)
+        buf,host,port = self.sock.recvfrom(65535)
+        # Lame compatabilitiy :-/
+        from = [host, port]
+        dispatch_request(from, buf)
+      end
+
+      #
+      # Check to see if transfers need maintenance
+      #
+      self.transfers.each do |tr|
+        # We handle RRQ and WRQ separately
+        #
+        if (tr[:type] == OpRead)
+          # Are we awaiting an ack?
+          if (tr[:last_sent])
+            check_retransmission(tr)
+          elsif (w != nil and w[0] == self.sock)
+            # No ack waiting, send next block..
+            chunk = tr[:file][:data].slice(tr[:offset], tr[:blksize])
+            if (chunk and chunk.length >= 0)
+              pkt = [OpData, tr[:block]].pack('nn')
+              pkt << chunk
+
+              send_packet(tr[:from], pkt)
+              tr[:last_sent] = ::Time.now
+
+              # If the file is a one-serve, mark it as started
+              tr[:file][:started] = true if (tr[:file][:once])
+            else
+              # No more chunks.. transfer is most likely done.
+              # However, we can only delete it once the last chunk has been
+              # acked.
+            end
+          end
+        else
+          # Are we awaiting data?
+          if (tr[:last_sent])
+            check_retransmission(tr)
+          elsif (w != nil and w[0] == self.sock)
+            # Not waiting for data, send an ack..
+            #puts "[*] sending ack for block %d" % [tr[:block]]
+            pkt = [OpAck, tr[:block]].pack('nn')
+
+            send_packet(tr[:from], pkt)
+            tr[:last_sent] = ::Time.now
+
+            # If we had a 0-511 byte chunk, we're done.
+            if (tr[:last_size] and tr[:last_size] < tr[:blksize])
+              #puts "[*] Transfer complete, saving output"
+              save_output(tr)
+              self.transfers.delete(tr)
+            end
+          end
+        end
+      end
+    end
+  end
+
+
+  def next_block(tr)
+    tr[:block] += 1
+    tr[:last_sent] = nil
+    tr[:retries] = 0
+  end
+
+
+  #
+  # Dispatch a packet that we received
+  #
+  def dispatch_request(from, buf)
+
+    op = buf.unpack('n')[0]
+    buf.slice!(0,2)
+
+    #XXX: todo - create call backs for status
+    #start = "[*] TFTP - %s:%u - %s" % [from[0], from[1], OPCODES[op]]
+
+    case op
+    when OpRead
+      # Process RRQ packets
+      fn = TFTP::get_string(buf)
+      mode = TFTP::get_string(buf).downcase
+
+      #puts "%s %s %s" % [start, fn, mode]
+
+      if (not @shutting_down) and (file = self.find_file(fn))
+        if (file[:once] and file[:started])
+          send_error(from, ErrFileNotFound)
+        else
+          transfer = {
+            :type => OpRead,
+            :from => from,
+            :file => file,
+            :block => 1,
+            :blksize => 512,
+            :offset => 0,
+            :timeout => 3,
+            :last_sent => nil,
+            :retries => 0
+          }
+
+          process_options(from, buf, transfer)
+
+          self.transfers << transfer
+        end
+      else
+        #puts "[-] file not found!"
+        send_error(from, ErrFileNotFound)
+      end
+
+    when OpWrite
+      # Process WRQ packets
+      fn = TFTP::get_string(buf)
+      mode = TFTP::get_string(buf).downcase
+
+      #puts "%s %s %s" % [start, fn, mode]
+
+      if not @shutting_down
+        transfer = {
+          :type => OpWrite,
+          :from => from,
+          :file => { :name => fn, :data => '' },
+          :block => 0, # WRQ starts at 0
+          :blksize => 512,
+          :timeout => 3,
+          :last_sent => nil,
+          :retries => 0
+        }
+
+        process_options(from, buf, transfer)
+
+        self.transfers << transfer
+      else
+        send_error(from, ErrIllegalOperation)
+      end
+
+    when OpAck
+      # Process ACK packets
+      block = buf.unpack('n')[0]
+
+      #puts "%s %d" % [start, block]
+
+      tr = find_transfer(OpRead, from, block)
+      if not tr
+        # NOTE: some clients, such as pxelinux, send an ack for block 0.
+        # To deal with this, we simply ignore it as we start with block 1.
+        return if block == 0
+
+        # If we didn't find it, send an error.
+        send_error(from, ErrUnknownTransferId)
+      else
+        # acked! send the next block
+        tr[:offset] += tr[:blksize]
+        next_block(tr)
+
+        # If the transfer is finished, delete it
+        if (tr[:offset] > tr[:file][:data].length)
+          #puts "[*] Transfer complete"
+          self.transfers.delete(tr)
+
+          # if the file is a one-serve, delete it from the files array
+          if tr[:file][:once]
+            #puts "[*] Removed one-serve file: #{tr[:file][:name]}"
+            self.files.delete(tr[:file])
+          end
+        end
+      end
+
+    when OpData
+      # Process Data packets
+      block = buf.unpack('n')[0]
+      data = buf.slice(2, buf.length)
+
+      #puts "%s %d %d bytes" % [start, block, data.length]
+
+      tr = find_transfer(OpWrite, from, (block-1))
+      if not tr
+        # If we didn't find it, send an error.
+        send_error(from, ErrUnknownTransferId)
+      else
+        tr[:file][:data] << data
+        tr[:last_size] = data.length
+        next_block(tr)
+
+        # Similar to RRQ transfers, we cannot detect that the
+        # transfer finished here. We must do so after transmitting
+        # the final ACK.
+      end
+
+    else
+      # Other packets are unsupported
+      #puts start
+      send_error(from, ErrAccessViolation)
+
+    end
+  end
+
+  def process_options(from, buf, tr)
+    found = 0
+    to_ack = []
+    while buf.length >= 4
+      opt = TFTP::get_string(buf)
+      break if not opt
+      val = TFTP::get_string(buf)
+      break if not val
+
+      found += 1
+
+      # Is it one we support?
+      opt.downcase!
+
+      case opt
+      when "blksize"
+        val = val.to_i
+        if val > 0
+          tr[:blksize] = val
+          to_ack << [ opt, val.to_s ]
+        end
+
+      when "timeout"
+        val = val.to_i
+        if val >= 1 and val <= 255
+          tr[:timeout] = val
+          to_ack << [ opt, val.to_s ]
+        end
+
+      when "tsize"
+        if tr[:type] == OpRead
+          len = tr[:file][:data].length
+        else
+          val = val.to_i
+          len = val
+        end
+        to_ack << [ opt, len.to_s ]
+
+      end
+    end
+
+    return if to_ack.length < 1
+
+    # if we have anything to ack, do it
+    data = [OpOptAck].pack('n')
+    to_ack.each { |el|
+      data << el[0] << "\x00" << el[1] << "\x00"
+    }
+
+    send_packet(from, data)
+  end
+
+end
+
+end
+end
+end