tftp-proxy.c revision 1.2
1 /* $NetBSD: tftp-proxy.c,v 1.2 2008/06/18 09:06:26 yamt Exp $ */ 2 /* $OpenBSD: tftp-proxy.c,v 1.2 2006/12/20 03:33:38 joel Exp $ 3 * 4 * Copyright (c) 2005 DLS Internet Services 5 * Copyright (c) 2004, 2005 Camiel Dobbelaar, <cd (at) sentia.nl> 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of the author may not be used to endorse or promote products 17 * derived from this software without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #include <sys/types.h> 32 #include <sys/ioctl.h> 33 #include <sys/uio.h> 34 #include <unistd.h> 35 36 #include <netinet/in.h> 37 #include <arpa/inet.h> 38 #include <arpa/tftp.h> 39 #include <sys/socket.h> 40 #include <net/if.h> 41 #include <net/pfvar.h> 42 43 #include <errno.h> 44 #include <pwd.h> 45 #include <stdio.h> 46 #include <syslog.h> 47 #include <string.h> 48 #include <stdlib.h> 49 50 #include "filter.h" 51 52 #define CHROOT_DIR "/var/chroot/tftp-proxy" 53 #define NOPRIV_USER "_proxy" 54 55 #define PF_NAT_PROXY_PORT_LOW 50001 56 #define PF_NAT_PROXY_PORT_HIGH 65535 57 58 #define DEFTRANSWAIT 2 59 #define NTOP_BUFS 4 60 #ifndef PKTSIZE 61 #define PKTSIZE SEGSIZE+4 62 #endif /* !PKTSIZE */ 63 64 #ifndef IPPORT_HIFIRSTAUTO 65 #define IPPORT_HIFIRSTAUTO IPPORT_ANONMIN 66 #endif /* IPPORT_HIFIRSTAUTO */ 67 68 #ifndef IPPORT_HILASTAUTO 69 #define IPPORT_HILASTAUTO IPPORT_ANONMAX 70 #endif /* IPPORT_HILASTAUTO */ 71 72 const char *opcode(int); 73 const char *sock_ntop(struct sockaddr *); 74 u_int16_t pick_proxy_port(void); 75 static void usage(void); 76 77 extern char *__progname; 78 char ntop_buf[NTOP_BUFS][INET6_ADDRSTRLEN]; 79 int verbose = 0; 80 81 int 82 main(int argc, char *argv[]) 83 { 84 int c, fd = 0, on = 1, out_fd = 0, peer, reqsize = 0; 85 int transwait = DEFTRANSWAIT; 86 char *p; 87 struct tftphdr *tp; 88 struct passwd *pw; 89 size_t cbuflen; 90 char *cbuf; 91 char req[PKTSIZE]; 92 struct cmsghdr *cmsg; 93 struct msghdr msg; 94 struct iovec iov; 95 96 struct sockaddr_storage from, proxy, server, proxy_to_server, s_in; 97 struct sockaddr_in sock_out; 98 socklen_t j; 99 in_port_t bindport; 100 101 openlog(__progname, LOG_PID | LOG_NDELAY, LOG_DAEMON); 102 103 while ((c = getopt(argc, argv, "vw:")) != -1) 104 switch (c) { 105 case 'v': 106 verbose++; 107 break; 108 case 'w': 109 transwait = strtoll(optarg, &p, 10); 110 if (transwait < 1) { 111 syslog(LOG_ERR, "invalid -w value"); 112 exit(1); 113 } 114 break; 115 default: 116 usage(); 117 break; 118 } 119 120 /* open /dev/pf */ 121 init_filter(NULL, verbose); 122 123 tzset(); 124 125 pw = getpwnam(NOPRIV_USER); 126 if (!pw) { 127 syslog(LOG_ERR, "no such user %s: %m", NOPRIV_USER); 128 exit(1); 129 } 130 if (chroot(CHROOT_DIR) || chdir("/")) { 131 syslog(LOG_ERR, "chroot %s: %m", CHROOT_DIR); 132 exit(1); 133 } 134 #ifdef __NetBSD__ 135 if (setgroups(1, &pw->pw_gid) || 136 setgid(pw->pw_gid) || 137 setuid(pw->pw_uid)) { 138 syslog(LOG_ERR, "can't revoke privs: %m"); 139 exit(1); 140 } 141 #else 142 if (setgroups(1, &pw->pw_gid) || 143 setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) || 144 setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid)) { 145 syslog(LOG_ERR, "can't revoke privs: %m"); 146 exit(1); 147 } 148 #endif /* !__NetBSD__ */ 149 150 /* non-blocking io */ 151 if (ioctl(fd, FIONBIO, &on) < 0) { 152 syslog(LOG_ERR, "ioctl(FIONBIO): %m"); 153 exit(1); 154 } 155 156 if (setsockopt(fd, IPPROTO_IP, IP_RECVDSTADDR, &on, sizeof(on)) == -1) { 157 syslog(LOG_ERR, "setsockopt(IP_RECVDSTADDR): %m"); 158 exit(1); 159 } 160 161 j = sizeof(s_in); 162 if (getsockname(fd, (struct sockaddr *)&s_in, &j) == -1) { 163 syslog(LOG_ERR, "getsockname: %m"); 164 exit(1); 165 } 166 167 bindport = ((struct sockaddr_in *)&s_in)->sin_port; 168 169 /* req will be pushed back out at the end, unchanged */ 170 j = sizeof(from); 171 if ((reqsize = recvfrom(fd, req, sizeof(req), MSG_PEEK, 172 (struct sockaddr *)&from, &j)) < 0) { 173 syslog(LOG_ERR, "recvfrom: %m"); 174 exit(1); 175 } 176 177 178 bzero(&msg, sizeof(msg)); 179 iov.iov_base = req; 180 iov.iov_len = sizeof(req); 181 msg.msg_name = &from; 182 msg.msg_namelen = sizeof(from); 183 msg.msg_iov = &iov; 184 msg.msg_iovlen = 1; 185 186 cbuflen = CMSG_SPACE(sizeof(struct sockaddr_storage)); 187 if ((cbuf = malloc(cbuflen)) == NULL) { 188 syslog(LOG_ERR, "malloc: %m"); 189 exit(1); 190 } 191 192 msg.msg_control = cbuf; 193 msg.msg_controllen = cbuflen; 194 195 if (recvmsg(fd, &msg, 0) < 0) { 196 syslog(LOG_ERR, "recvmsg: %m"); 197 exit(1); 198 } 199 200 close(fd); 201 close(1); 202 203 peer = socket(from.ss_family, SOCK_DGRAM, 0); 204 if (peer < 0) { 205 syslog(LOG_ERR, "socket: %m"); 206 exit(1); 207 } 208 memset(&s_in, 0, sizeof(s_in)); 209 s_in.ss_family = from.ss_family; 210 s_in.ss_len = from.ss_len; 211 212 /* get local address if possible */ 213 for (cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL; 214 cmsg = CMSG_NXTHDR(&msg, cmsg)) { 215 if (cmsg->cmsg_level == IPPROTO_IP && 216 cmsg->cmsg_type == IP_RECVDSTADDR) { 217 memcpy(&((struct sockaddr_in *)&s_in)->sin_addr, 218 CMSG_DATA(cmsg), sizeof(struct in_addr)); 219 break; 220 } 221 } 222 223 if (bind(peer, (struct sockaddr *)&s_in, s_in.ss_len) < 0) { 224 syslog(LOG_ERR, "bind: %m"); 225 exit(1); 226 } 227 if (connect(peer, (struct sockaddr *)&from, from.ss_len) < 0) { 228 syslog(LOG_ERR, "connect: %m"); 229 exit(1); 230 } 231 232 tp = (struct tftphdr *)req; 233 if (!(ntohs(tp->th_opcode) == RRQ || ntohs(tp->th_opcode) == WRQ)) { 234 /* not a tftp request, bail */ 235 if (verbose) { 236 syslog(LOG_WARNING, "not a valid tftp request"); 237 exit(1); 238 } else 239 /* exit 0 so inetd doesn't log anything */ 240 exit(0); 241 } 242 243 j = sizeof(struct sockaddr_storage); 244 if (getsockname(fd, (struct sockaddr *)&proxy, &j) == -1) { 245 syslog(LOG_ERR, "getsockname: %m"); 246 exit(1); 247 } 248 249 ((struct sockaddr_in *)&proxy)->sin_port = bindport; 250 251 /* find the un-rdr'd server and port the client wanted */ 252 if (server_lookup((struct sockaddr *)&from, 253 (struct sockaddr *)&proxy, (struct sockaddr *)&server, 254 IPPROTO_UDP) != 0) { 255 syslog(LOG_ERR, "pf connection lookup failed (no rdr?)"); 256 exit(1); 257 } 258 259 /* establish a new outbound connection to the remote server */ 260 if ((out_fd = socket(((struct sockaddr *)&from)->sa_family, 261 SOCK_DGRAM, IPPROTO_UDP)) < 0) { 262 syslog(LOG_ERR, "couldn't create new socket"); 263 exit(1); 264 } 265 266 bzero((char *)&sock_out, sizeof(sock_out)); 267 sock_out.sin_family = from.ss_family; 268 sock_out.sin_port = htons(pick_proxy_port()); 269 if (bind(out_fd, (struct sockaddr *)&sock_out, sizeof(sock_out)) < 0) { 270 syslog(LOG_ERR, "couldn't bind to new socket: %m"); 271 exit(1); 272 } 273 274 if (connect(out_fd, (struct sockaddr *)&server, 275 ((struct sockaddr *)&server)->sa_len) < 0 && errno != EINPROGRESS) { 276 syslog(LOG_ERR, "couldn't connect to remote server: %m"); 277 exit(1); 278 } 279 280 j = sizeof(struct sockaddr_storage); 281 if ((getsockname(out_fd, (struct sockaddr *)&proxy_to_server, 282 &j)) < 0) { 283 syslog(LOG_ERR, "getsockname: %m"); 284 exit(1); 285 } 286 287 if (verbose) 288 syslog(LOG_INFO, "%s:%d -> %s:%d/%s:%d -> %s:%d \"%s %s\"", 289 sock_ntop((struct sockaddr *)&from), 290 ntohs(((struct sockaddr_in *)&from)->sin_port), 291 sock_ntop((struct sockaddr *)&proxy), 292 ntohs(((struct sockaddr_in *)&proxy)->sin_port), 293 sock_ntop((struct sockaddr *)&proxy_to_server), 294 ntohs(((struct sockaddr_in *)&proxy_to_server)->sin_port), 295 sock_ntop((struct sockaddr *)&server), 296 ntohs(((struct sockaddr_in *)&server)->sin_port), 297 opcode(ntohs(tp->th_opcode)), 298 tp->th_stuff); 299 300 /* get ready to add rdr and pass rules */ 301 if (prepare_commit(1) == -1) { 302 syslog(LOG_ERR, "couldn't prepare pf commit"); 303 exit(1); 304 } 305 306 /* rdr from server to us on our random port -> client on its port */ 307 if (add_rdr(1, (struct sockaddr *)&server, 308 (struct sockaddr *)&proxy_to_server, ntohs(sock_out.sin_port), 309 (struct sockaddr *)&from, 310 ntohs(((struct sockaddr_in *)&from)->sin_port), 311 IPPROTO_UDP) == -1) { 312 syslog(LOG_ERR, "couldn't add rdr"); 313 exit(1); 314 } 315 316 /* explicitly allow the packets to return back to the client (which pf 317 * will see post-rdr) */ 318 if (add_filter(1, PF_IN, (struct sockaddr *)&server, 319 (struct sockaddr *)&from, 320 ntohs(((struct sockaddr_in *)&from)->sin_port), 321 IPPROTO_UDP) == -1) { 322 syslog(LOG_ERR, "couldn't add pass in"); 323 exit(1); 324 } 325 if (add_filter(1, PF_OUT, (struct sockaddr *)&server, 326 (struct sockaddr *)&from, 327 ntohs(((struct sockaddr_in *)&from)->sin_port), 328 IPPROTO_UDP) == -1) { 329 syslog(LOG_ERR, "couldn't add pass out"); 330 exit(1); 331 } 332 333 /* and just in case, to pass out from us to the server */ 334 if (add_filter(1, PF_OUT, (struct sockaddr *)&proxy_to_server, 335 (struct sockaddr *)&server, 336 ntohs(((struct sockaddr_in *)&server)->sin_port), 337 IPPROTO_UDP) == -1) { 338 syslog(LOG_ERR, "couldn't add pass out"); 339 exit(1); 340 } 341 342 if (do_commit() == -1) { 343 syslog(LOG_ERR, "couldn't commit pf rules"); 344 exit(1); 345 } 346 347 /* forward the initial tftp request and start the insanity */ 348 if (send(out_fd, tp, reqsize, 0) < 0) { 349 syslog(LOG_ERR, "couldn't forward tftp packet: %m"); 350 exit(1); 351 } 352 353 /* allow the transfer to start to establish a state */ 354 sleep(transwait); 355 356 /* delete our rdr rule and clean up */ 357 prepare_commit(1); 358 do_commit(); 359 360 return(0); 361 } 362 363 const char * 364 opcode(int code) 365 { 366 static char str[6]; 367 368 switch (code) { 369 case 1: 370 (void)snprintf(str, sizeof(str), "RRQ"); 371 break; 372 case 2: 373 (void)snprintf(str, sizeof(str), "WRQ"); 374 break; 375 default: 376 (void)snprintf(str, sizeof(str), "(%d)", code); 377 break; 378 } 379 380 return (str); 381 } 382 383 const char * 384 sock_ntop(struct sockaddr *sa) 385 { 386 static int n = 0; 387 388 /* Cycle to next buffer. */ 389 n = (n + 1) % NTOP_BUFS; 390 ntop_buf[n][0] = '\0'; 391 392 if (sa->sa_family == AF_INET) { 393 struct sockaddr_in *sin = (struct sockaddr_in *)sa; 394 395 return (inet_ntop(AF_INET, &sin->sin_addr, ntop_buf[n], 396 sizeof ntop_buf[0])); 397 } 398 399 if (sa->sa_family == AF_INET6) { 400 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa; 401 402 return (inet_ntop(AF_INET6, &sin6->sin6_addr, ntop_buf[n], 403 sizeof ntop_buf[0])); 404 } 405 406 return (NULL); 407 } 408 409 u_int16_t 410 pick_proxy_port(void) 411 { 412 return (IPPORT_HIFIRSTAUTO + (arc4random() % 413 (IPPORT_HILASTAUTO - IPPORT_HIFIRSTAUTO))); 414 } 415 416 static void 417 usage(void) 418 { 419 syslog(LOG_ERR, "usage: %s [-v] [-w transwait]", __progname); 420 exit(1); 421 } 422
Indexes created Tue Sep 23 20:09:58 GMT 2025