ip_ftp_pxy.c revision 1.2.4.3
1 1.2.4.3 yamt /* $NetBSD: ip_ftp_pxy.c,v 1.2.4.3 2012/10/30 17:22:19 yamt Exp $ */ 2 1.2.4.2 yamt 3 1.2.4.2 yamt /* 4 1.2.4.3 yamt * Copyright (C) 2012 by Darren Reed. 5 1.2.4.2 yamt * 6 1.2.4.2 yamt * See the IPFILTER.LICENCE file for details on licencing. 7 1.2.4.2 yamt * 8 1.2.4.2 yamt * Simple FTP transparent proxy for in-kernel use. For use with the NAT 9 1.2.4.2 yamt * code. 10 1.2.4.2 yamt * 11 1.2.4.3 yamt * Id: ip_ftp_pxy.c,v 1.1.1.2 2012/07/22 13:45:18 darrenr Exp 12 1.2.4.2 yamt */ 13 1.2.4.2 yamt 14 1.2.4.2 yamt #include <sys/cdefs.h> 15 1.2.4.3 yamt __KERNEL_RCSID(1, "$NetBSD: ip_ftp_pxy.c,v 1.2.4.3 2012/10/30 17:22:19 yamt Exp $"); 16 1.2.4.2 yamt 17 1.2.4.2 yamt #define IPF_FTP_PROXY 18 1.2.4.2 yamt 19 1.2.4.2 yamt #define IPF_MINPORTLEN 18 20 1.2.4.2 yamt #define IPF_MINEPRTLEN 20 21 1.2.4.2 yamt #define IPF_MAXPORTLEN 30 22 1.2.4.2 yamt #define IPF_MIN227LEN 39 23 1.2.4.2 yamt #define IPF_MAX227LEN 51 24 1.2.4.2 yamt #define IPF_MIN229LEN 47 25 1.2.4.2 yamt #define IPF_MAX229LEN 51 26 1.2.4.2 yamt 27 1.2.4.2 yamt #define FTPXY_GO 0 28 1.2.4.2 yamt #define FTPXY_INIT 1 29 1.2.4.2 yamt #define FTPXY_USER_1 2 30 1.2.4.2 yamt #define FTPXY_USOK_1 3 31 1.2.4.2 yamt #define FTPXY_PASS_1 4 32 1.2.4.2 yamt #define FTPXY_PAOK_1 5 33 1.2.4.2 yamt #define FTPXY_AUTH_1 6 34 1.2.4.2 yamt #define FTPXY_AUOK_1 7 35 1.2.4.2 yamt #define FTPXY_ADAT_1 8 36 1.2.4.2 yamt #define FTPXY_ADOK_1 9 37 1.2.4.2 yamt #define FTPXY_ACCT_1 10 38 1.2.4.2 yamt #define FTPXY_ACOK_1 11 39 1.2.4.2 yamt #define FTPXY_USER_2 12 40 1.2.4.2 yamt #define FTPXY_USOK_2 13 41 1.2.4.2 yamt #define FTPXY_PASS_2 14 42 1.2.4.2 yamt #define FTPXY_PAOK_2 15 43 1.2.4.2 yamt 44 1.2.4.2 yamt #define FTPXY_JUNK_OK 0 45 1.2.4.2 yamt #define FTPXY_JUNK_BAD 1 /* Ignore all commands for this connection */ 46 1.2.4.2 yamt #define FTPXY_JUNK_EOL 2 /* consume the rest of this line only */ 47 1.2.4.2 yamt #define FTPXY_JUNK_CONT 3 /* Saerching for next numeric */ 48 1.2.4.2 yamt 49 1.2.4.2 yamt /* 50 1.2.4.2 yamt * Values for FTP commands. Numerics cover 0-999 51 1.2.4.2 yamt */ 52 1.2.4.2 yamt #define FTPXY_C_PASV 1000 53 1.2.4.2 yamt #define FTPXY_C_PORT 1001 54 1.2.4.2 yamt #define FTPXY_C_EPSV 1002 55 1.2.4.2 yamt #define FTPXY_C_EPRT 1003 56 1.2.4.2 yamt 57 1.2.4.2 yamt 58 1.2.4.2 yamt typedef struct ipf_ftp_softc_s { 59 1.2.4.2 yamt int ipf_p_ftp_pasvonly; 60 1.2.4.2 yamt /* Do not require logins before transfers */ 61 1.2.4.2 yamt int ipf_p_ftp_insecure; 62 1.2.4.2 yamt int ipf_p_ftp_pasvrdr; 63 1.2.4.2 yamt /* PASV must be last command prior to 227 */ 64 1.2.4.2 yamt int ipf_p_ftp_forcepasv; 65 1.2.4.2 yamt int ipf_p_ftp_debug; 66 1.2.4.2 yamt int ipf_p_ftp_single_xfer; 67 1.2.4.2 yamt void *ipf_p_ftp_tune; 68 1.2.4.2 yamt } ipf_ftp_softc_t; 69 1.2.4.2 yamt 70 1.2.4.2 yamt 71 1.2.4.2 yamt void ipf_p_ftp_main_load(void); 72 1.2.4.2 yamt void ipf_p_ftp_main_unload(void); 73 1.2.4.2 yamt void *ipf_p_ftp_soft_create(ipf_main_softc_t *); 74 1.2.4.2 yamt void ipf_p_ftp_soft_destroy(ipf_main_softc_t *, void *); 75 1.2.4.2 yamt 76 1.2.4.2 yamt int ipf_p_ftp_client(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 77 1.2.4.2 yamt ftpinfo_t *, int); 78 1.2.4.2 yamt int ipf_p_ftp_complete(char *, size_t); 79 1.2.4.2 yamt int ipf_p_ftp_in(void *, fr_info_t *, ap_session_t *, nat_t *); 80 1.2.4.2 yamt int ipf_p_ftp_new(void *, fr_info_t *, ap_session_t *, nat_t *); 81 1.2.4.2 yamt void ipf_p_ftp_del(ipf_main_softc_t *, ap_session_t *); 82 1.2.4.2 yamt int ipf_p_ftp_out(void *, fr_info_t *, ap_session_t *, nat_t *); 83 1.2.4.2 yamt int ipf_p_ftp_pasv(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 84 1.2.4.2 yamt ftpinfo_t *, int); 85 1.2.4.2 yamt int ipf_p_ftp_epsv(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 86 1.2.4.2 yamt ftpinfo_t *, int); 87 1.2.4.2 yamt int ipf_p_ftp_port(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 88 1.2.4.2 yamt ftpinfo_t *, int); 89 1.2.4.2 yamt int ipf_p_ftp_process(ipf_ftp_softc_t *, fr_info_t *, nat_t *, 90 1.2.4.2 yamt ftpinfo_t *, int); 91 1.2.4.2 yamt int ipf_p_ftp_server(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 92 1.2.4.2 yamt ftpinfo_t *, int); 93 1.2.4.2 yamt int ipf_p_ftp_valid(ipf_ftp_softc_t *, ftpinfo_t *, int, char *, size_t); 94 1.2.4.2 yamt int ipf_p_ftp_server_valid(ipf_ftp_softc_t *, ftpside_t *, char *, 95 1.2.4.2 yamt size_t); 96 1.2.4.2 yamt int ipf_p_ftp_client_valid(ipf_ftp_softc_t *, ftpside_t *, char *, 97 1.2.4.2 yamt size_t); 98 1.2.4.2 yamt u_short ipf_p_ftp_atoi(char **); 99 1.2.4.2 yamt int ipf_p_ftp_pasvreply(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 100 1.2.4.3 yamt ftpinfo_t *, u_int, char *, char *); 101 1.2.4.2 yamt int ipf_p_ftp_eprt(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 102 1.2.4.2 yamt ftpinfo_t *, int); 103 1.2.4.2 yamt int ipf_p_ftp_eprt4(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 104 1.2.4.2 yamt ftpinfo_t *, int); 105 1.2.4.3 yamt int ipf_p_ftp_eprt6(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 106 1.2.4.3 yamt ftpinfo_t *, int); 107 1.2.4.2 yamt int ipf_p_ftp_addport(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 108 1.2.4.2 yamt ftpinfo_t *, int, int, int); 109 1.2.4.2 yamt void ipf_p_ftp_setpending(ipf_main_softc_t *, ftpinfo_t *); 110 1.2.4.2 yamt 111 1.2.4.2 yamt /* 112 1.2.4.3 yamt * Debug levels 113 1.2.4.2 yamt */ 114 1.2.4.3 yamt #define DEBUG_SECURITY 0x01 115 1.2.4.3 yamt #define DEBUG_ERROR 0x02 116 1.2.4.3 yamt #define DEBUG_INFO 0x04 117 1.2.4.3 yamt #define DEBUG_PARSE_ERR 0x08 118 1.2.4.3 yamt #define DEBUG_PARSE_INFO 0x10 119 1.2.4.3 yamt #define DEBUG_PARSE 0x20 120 1.2.4.2 yamt 121 1.2.4.2 yamt static int ipf_p_ftp_proxy_init = 0; 122 1.2.4.2 yamt static frentry_t ftppxyfr; 123 1.2.4.2 yamt static ipftuneable_t ipf_ftp_tuneables[] = { 124 1.2.4.2 yamt { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_debug) }, 125 1.2.4.3 yamt "ftp_debug", 0, 0x7f, 126 1.2.4.2 yamt stsizeof(ipf_ftp_softc_t, ipf_p_ftp_debug), 127 1.2.4.2 yamt 0, NULL, NULL }, 128 1.2.4.2 yamt { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_pasvonly) }, 129 1.2.4.2 yamt "ftp_pasvonly", 0, 1, 130 1.2.4.2 yamt stsizeof(ipf_ftp_softc_t, ipf_p_ftp_pasvonly), 131 1.2.4.2 yamt 0, NULL, NULL }, 132 1.2.4.2 yamt { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_insecure) }, 133 1.2.4.2 yamt "ftp_insecure", 0, 1, 134 1.2.4.2 yamt stsizeof(ipf_ftp_softc_t, ipf_p_ftp_insecure), 135 1.2.4.2 yamt 0, NULL, NULL }, 136 1.2.4.2 yamt { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_pasvrdr) }, 137 1.2.4.2 yamt "ftp_pasvrdr", 0, 1, 138 1.2.4.2 yamt stsizeof(ipf_ftp_softc_t, ipf_p_ftp_pasvrdr), 139 1.2.4.2 yamt 0, NULL, NULL }, 140 1.2.4.2 yamt { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_forcepasv) }, 141 1.2.4.2 yamt "ftp_forcepasv", 0, 1, 142 1.2.4.2 yamt stsizeof(ipf_ftp_softc_t, ipf_p_ftp_forcepasv), 143 1.2.4.2 yamt 0, NULL, NULL }, 144 1.2.4.2 yamt { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_single_xfer) }, 145 1.2.4.2 yamt "ftp_single_xfer", 0, 1, 146 1.2.4.2 yamt stsizeof(ipf_ftp_softc_t, ipf_p_ftp_single_xfer), 147 1.2.4.2 yamt 0, NULL, NULL }, 148 1.2.4.2 yamt { { NULL }, NULL, 0, 0, 0, 0, NULL, NULL } 149 1.2.4.2 yamt }; 150 1.2.4.2 yamt 151 1.2.4.2 yamt 152 1.2.4.2 yamt void 153 1.2.4.2 yamt ipf_p_ftp_main_load(void) 154 1.2.4.2 yamt { 155 1.2.4.2 yamt bzero((char *)&ftppxyfr, sizeof(ftppxyfr)); 156 1.2.4.2 yamt ftppxyfr.fr_ref = 1; 157 1.2.4.2 yamt ftppxyfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE; 158 1.2.4.2 yamt 159 1.2.4.2 yamt MUTEX_INIT(&ftppxyfr.fr_lock, "FTP Proxy Mutex"); 160 1.2.4.2 yamt ipf_p_ftp_proxy_init = 1; 161 1.2.4.2 yamt } 162 1.2.4.2 yamt 163 1.2.4.2 yamt 164 1.2.4.2 yamt void 165 1.2.4.2 yamt ipf_p_ftp_main_unload(void) 166 1.2.4.2 yamt { 167 1.2.4.2 yamt 168 1.2.4.2 yamt if (ipf_p_ftp_proxy_init == 1) { 169 1.2.4.2 yamt MUTEX_DESTROY(&ftppxyfr.fr_lock); 170 1.2.4.2 yamt ipf_p_ftp_proxy_init = 0; 171 1.2.4.2 yamt } 172 1.2.4.2 yamt } 173 1.2.4.2 yamt 174 1.2.4.2 yamt 175 1.2.4.2 yamt /* 176 1.2.4.2 yamt * Initialize local structures. 177 1.2.4.2 yamt */ 178 1.2.4.2 yamt void * 179 1.2.4.2 yamt ipf_p_ftp_soft_create(ipf_main_softc_t *softc) 180 1.2.4.2 yamt { 181 1.2.4.2 yamt ipf_ftp_softc_t *softf; 182 1.2.4.2 yamt 183 1.2.4.2 yamt KMALLOC(softf, ipf_ftp_softc_t *); 184 1.2.4.2 yamt if (softf == NULL) 185 1.2.4.2 yamt return NULL; 186 1.2.4.2 yamt 187 1.2.4.2 yamt bzero((char *)softf, sizeof(*softf)); 188 1.2.4.2 yamt #if defined(_KERNEL) 189 1.2.4.2 yamt softf->ipf_p_ftp_debug = 0; 190 1.2.4.2 yamt #else 191 1.2.4.3 yamt softf->ipf_p_ftp_debug = DEBUG_PARSE_ERR; 192 1.2.4.2 yamt #endif 193 1.2.4.2 yamt softf->ipf_p_ftp_forcepasv = 1; 194 1.2.4.2 yamt 195 1.2.4.2 yamt softf->ipf_p_ftp_tune = ipf_tune_array_copy(softf, 196 1.2.4.2 yamt sizeof(ipf_ftp_tuneables), 197 1.2.4.2 yamt ipf_ftp_tuneables); 198 1.2.4.2 yamt if (softf->ipf_p_ftp_tune == NULL) { 199 1.2.4.2 yamt ipf_p_ftp_soft_destroy(softc, softf); 200 1.2.4.2 yamt return NULL; 201 1.2.4.2 yamt } 202 1.2.4.2 yamt if (ipf_tune_array_link(softc, softf->ipf_p_ftp_tune) == -1) { 203 1.2.4.2 yamt ipf_p_ftp_soft_destroy(softc, softf); 204 1.2.4.2 yamt return NULL; 205 1.2.4.2 yamt } 206 1.2.4.2 yamt 207 1.2.4.2 yamt return softf; 208 1.2.4.2 yamt } 209 1.2.4.2 yamt 210 1.2.4.2 yamt 211 1.2.4.2 yamt void 212 1.2.4.2 yamt ipf_p_ftp_soft_destroy(ipf_main_softc_t *softc, void *arg) 213 1.2.4.2 yamt { 214 1.2.4.2 yamt ipf_ftp_softc_t *softf = arg; 215 1.2.4.2 yamt 216 1.2.4.2 yamt if (softf->ipf_p_ftp_tune != NULL) { 217 1.2.4.2 yamt ipf_tune_array_unlink(softc, softf->ipf_p_ftp_tune); 218 1.2.4.2 yamt KFREES(softf->ipf_p_ftp_tune, sizeof(ipf_ftp_tuneables)); 219 1.2.4.2 yamt softf->ipf_p_ftp_tune = NULL; 220 1.2.4.2 yamt } 221 1.2.4.2 yamt 222 1.2.4.2 yamt KFREE(softf); 223 1.2.4.2 yamt } 224 1.2.4.2 yamt 225 1.2.4.2 yamt 226 1.2.4.2 yamt int 227 1.2.4.2 yamt ipf_p_ftp_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 228 1.2.4.2 yamt { 229 1.2.4.2 yamt ftpinfo_t *ftp; 230 1.2.4.2 yamt ftpside_t *f; 231 1.2.4.2 yamt 232 1.2.4.2 yamt KMALLOC(ftp, ftpinfo_t *); 233 1.2.4.2 yamt if (ftp == NULL) 234 1.2.4.2 yamt return -1; 235 1.2.4.2 yamt 236 1.2.4.2 yamt nat = nat; /* LINT */ 237 1.2.4.2 yamt 238 1.2.4.2 yamt aps->aps_data = ftp; 239 1.2.4.2 yamt aps->aps_psiz = sizeof(ftpinfo_t); 240 1.2.4.3 yamt aps->aps_sport = htons(fin->fin_sport); 241 1.2.4.3 yamt aps->aps_dport = htons(fin->fin_dport); 242 1.2.4.2 yamt 243 1.2.4.2 yamt bzero((char *)ftp, sizeof(*ftp)); 244 1.2.4.2 yamt f = &ftp->ftp_side[0]; 245 1.2.4.2 yamt f->ftps_rptr = f->ftps_buf; 246 1.2.4.2 yamt f->ftps_wptr = f->ftps_buf; 247 1.2.4.2 yamt f = &ftp->ftp_side[1]; 248 1.2.4.2 yamt f->ftps_rptr = f->ftps_buf; 249 1.2.4.2 yamt f->ftps_wptr = f->ftps_buf; 250 1.2.4.2 yamt ftp->ftp_passok = FTPXY_INIT; 251 1.2.4.2 yamt ftp->ftp_incok = 0; 252 1.2.4.2 yamt return 0; 253 1.2.4.2 yamt } 254 1.2.4.2 yamt 255 1.2.4.2 yamt 256 1.2.4.2 yamt void 257 1.2.4.2 yamt ipf_p_ftp_setpending(ipf_main_softc_t *softc, ftpinfo_t *ftp) 258 1.2.4.2 yamt { 259 1.2.4.2 yamt if (ftp->ftp_pendnat != NULL) 260 1.2.4.2 yamt ipf_nat_setpending(softc, ftp->ftp_pendnat); 261 1.2.4.2 yamt 262 1.2.4.2 yamt if (ftp->ftp_pendstate != NULL) { 263 1.2.4.2 yamt READ_ENTER(&softc->ipf_state); 264 1.2.4.2 yamt ipf_state_setpending(softc, ftp->ftp_pendstate); 265 1.2.4.2 yamt RWLOCK_EXIT(&softc->ipf_state); 266 1.2.4.2 yamt } 267 1.2.4.2 yamt } 268 1.2.4.2 yamt 269 1.2.4.2 yamt 270 1.2.4.2 yamt void 271 1.2.4.2 yamt ipf_p_ftp_del(ipf_main_softc_t *softc, ap_session_t *aps) 272 1.2.4.2 yamt { 273 1.2.4.2 yamt ftpinfo_t *ftp; 274 1.2.4.2 yamt 275 1.2.4.2 yamt ftp = aps->aps_data; 276 1.2.4.2 yamt if (ftp != NULL) 277 1.2.4.2 yamt ipf_p_ftp_setpending(softc, ftp); 278 1.2.4.2 yamt } 279 1.2.4.2 yamt 280 1.2.4.2 yamt 281 1.2.4.2 yamt int 282 1.2.4.2 yamt ipf_p_ftp_port(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 283 1.2.4.2 yamt ftpinfo_t *ftp, int dlen) 284 1.2.4.2 yamt { 285 1.2.4.2 yamt char newbuf[IPF_FTPBUFSZ], *s; 286 1.2.4.2 yamt u_int a1, a2, a3, a4; 287 1.2.4.2 yamt u_short a5, a6, sp; 288 1.2.4.2 yamt size_t nlen, olen; 289 1.2.4.2 yamt tcphdr_t *tcp; 290 1.2.4.2 yamt int inc, off; 291 1.2.4.2 yamt ftpside_t *f; 292 1.2.4.2 yamt mb_t *m; 293 1.2.4.2 yamt 294 1.2.4.2 yamt m = fin->fin_m; 295 1.2.4.2 yamt f = &ftp->ftp_side[0]; 296 1.2.4.2 yamt tcp = (tcphdr_t *)fin->fin_dp; 297 1.2.4.2 yamt off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 298 1.2.4.2 yamt 299 1.2.4.2 yamt /* 300 1.2.4.2 yamt * Check for client sending out PORT message. 301 1.2.4.2 yamt */ 302 1.2.4.2 yamt if (dlen < IPF_MINPORTLEN) { 303 1.2.4.3 yamt DT3(ftp_PORT_error_dlen, nat_t *, nat, ftpside_t *, f, 304 1.2.4.3 yamt u_int, dlen); 305 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 306 1.2.4.2 yamt printf("ipf_p_ftp_port:dlen(%d) < IPF_MINPORTLEN\n", 307 1.2.4.2 yamt dlen); 308 1.2.4.2 yamt return 0; 309 1.2.4.2 yamt } 310 1.2.4.2 yamt /* 311 1.2.4.2 yamt * Skip the PORT command + space 312 1.2.4.2 yamt */ 313 1.2.4.2 yamt s = f->ftps_rptr + 5; 314 1.2.4.2 yamt /* 315 1.2.4.2 yamt * Pick out the address components, two at a time. 316 1.2.4.2 yamt */ 317 1.2.4.2 yamt a1 = ipf_p_ftp_atoi(&s); 318 1.2.4.2 yamt if (s == NULL) { 319 1.2.4.3 yamt DT2(ftp_PORT_error_atoi_1, nat_t *, nat, ftpside_t *, f); 320 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 321 1.2.4.2 yamt printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 1); 322 1.2.4.2 yamt return 0; 323 1.2.4.2 yamt } 324 1.2.4.2 yamt a2 = ipf_p_ftp_atoi(&s); 325 1.2.4.2 yamt if (s == NULL) { 326 1.2.4.3 yamt DT2(ftp_PORT_error_atoi_2, nat_t *, nat, ftpside_t *, f); 327 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 328 1.2.4.2 yamt printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 2); 329 1.2.4.2 yamt return 0; 330 1.2.4.2 yamt } 331 1.2.4.2 yamt 332 1.2.4.2 yamt /* 333 1.2.4.2 yamt * Check that IP address in the PORT/PASV reply is the same as the 334 1.2.4.2 yamt * sender of the command - prevents using PORT for port scanning. 335 1.2.4.2 yamt */ 336 1.2.4.2 yamt a1 <<= 16; 337 1.2.4.2 yamt a1 |= a2; 338 1.2.4.2 yamt if (((nat->nat_dir == NAT_OUTBOUND) && 339 1.2.4.2 yamt (a1 != ntohl(nat->nat_osrcaddr))) || 340 1.2.4.2 yamt ((nat->nat_dir == NAT_INBOUND) && 341 1.2.4.3 yamt (a1 != ntohl(nat->nat_nsrcaddr)))) { 342 1.2.4.3 yamt DT3(ftp_PORT_error_address, nat_t *, nat, ftpside_t *, f, 343 1.2.4.3 yamt u_int, a1); 344 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 345 1.2.4.2 yamt printf("ipf_p_ftp_port:%s != nat->nat_inip\n", "a1"); 346 1.2.4.2 yamt return APR_ERR(1); 347 1.2.4.2 yamt } 348 1.2.4.2 yamt 349 1.2.4.2 yamt a5 = ipf_p_ftp_atoi(&s); 350 1.2.4.2 yamt if (s == NULL) { 351 1.2.4.3 yamt DT2(ftp_PORT_error_atoi_3, nat_t *, nat, ftpside_t *, f); 352 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 353 1.2.4.2 yamt printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 3); 354 1.2.4.2 yamt return 0; 355 1.2.4.2 yamt } 356 1.2.4.2 yamt if (*s == ')') 357 1.2.4.2 yamt s++; 358 1.2.4.2 yamt 359 1.2.4.2 yamt /* 360 1.2.4.2 yamt * check for CR-LF at the end. 361 1.2.4.2 yamt */ 362 1.2.4.2 yamt if (*s == '\n') 363 1.2.4.2 yamt s--; 364 1.2.4.3 yamt if ((*s != '\r') || (*(s + 1) != '\n')) { 365 1.2.4.3 yamt DT2(ftp_PORT_error_no_crlf, nat_t *, nat, ftpside_t *, f); 366 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 367 1.2.4.2 yamt printf("ipf_p_ftp_port:missing %s\n", "cr-lf"); 368 1.2.4.2 yamt return 0; 369 1.2.4.2 yamt } 370 1.2.4.3 yamt s += 2; 371 1.2.4.3 yamt a6 = a5 & 0xff; 372 1.2.4.2 yamt 373 1.2.4.3 yamt /* 374 1.2.4.3 yamt * Calculate the source port. Verification of > 1024 is in 375 1.2.4.3 yamt * ipf_p_ftp_addport. 376 1.2.4.3 yamt */ 377 1.2.4.2 yamt a5 >>= 8; 378 1.2.4.2 yamt a5 &= 0xff; 379 1.2.4.2 yamt sp = a5 << 8 | a6; 380 1.2.4.3 yamt 381 1.2.4.2 yamt /* 382 1.2.4.2 yamt * Calculate new address parts for PORT command 383 1.2.4.2 yamt */ 384 1.2.4.2 yamt if (nat->nat_dir == NAT_INBOUND) 385 1.2.4.3 yamt a1 = ntohl(nat->nat_ndstaddr); 386 1.2.4.2 yamt else 387 1.2.4.2 yamt a1 = ntohl(ip->ip_src.s_addr); 388 1.2.4.3 yamt a1 = ntohl(ip->ip_src.s_addr); 389 1.2.4.2 yamt a2 = (a1 >> 16) & 0xff; 390 1.2.4.2 yamt a3 = (a1 >> 8) & 0xff; 391 1.2.4.2 yamt a4 = a1 & 0xff; 392 1.2.4.2 yamt a1 >>= 24; 393 1.2.4.2 yamt olen = s - f->ftps_rptr; 394 1.2.4.2 yamt /* DO NOT change this to snprintf! */ 395 1.2.4.2 yamt #if defined(SNPRINTF) && defined(_KERNEL) 396 1.2.4.2 yamt SNPRINTF(newbuf, sizeof(newbuf), "%s %u,%u,%u,%u,%u,%u\r\n", 397 1.2.4.2 yamt "PORT", a1, a2, a3, a4, a5, a6); 398 1.2.4.2 yamt #else 399 1.2.4.2 yamt (void) sprintf(newbuf, "%s %u,%u,%u,%u,%u,%u\r\n", 400 1.2.4.2 yamt "PORT", a1, a2, a3, a4, a5, a6); 401 1.2.4.2 yamt #endif 402 1.2.4.2 yamt 403 1.2.4.2 yamt nlen = strlen(newbuf); 404 1.2.4.2 yamt inc = nlen - olen; 405 1.2.4.2 yamt if ((inc + fin->fin_plen) > 65535) { 406 1.2.4.3 yamt DT3(ftp_PORT_error_inc, nat_t *, nat, ftpside_t *, f, 407 1.2.4.3 yamt int, inc); 408 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 409 1.2.4.2 yamt printf("ipf_p_ftp_port:inc(%d) + ip->ip_len > 65535\n", 410 1.2.4.2 yamt inc); 411 1.2.4.2 yamt return 0; 412 1.2.4.2 yamt } 413 1.2.4.2 yamt 414 1.2.4.2 yamt #if !defined(_KERNEL) 415 1.2.4.3 yamt M_ADJ(m, inc); 416 1.2.4.2 yamt #else 417 1.2.4.2 yamt /* 418 1.2.4.2 yamt * m_adj takes care of pkthdr.len, if required and treats inc<0 to 419 1.2.4.2 yamt * mean remove -len bytes from the end of the packet. 420 1.2.4.2 yamt * The mbuf chain will be extended if necessary by m_copyback(). 421 1.2.4.2 yamt */ 422 1.2.4.2 yamt if (inc < 0) 423 1.2.4.2 yamt M_ADJ(m, inc); 424 1.2.4.2 yamt #endif /* !defined(_KERNEL) */ 425 1.2.4.2 yamt COPYBACK(m, off, nlen, newbuf); 426 1.2.4.3 yamt fin->fin_flx |= FI_DOCKSUM; 427 1.2.4.2 yamt 428 1.2.4.2 yamt if (inc != 0) { 429 1.2.4.2 yamt fin->fin_plen += inc; 430 1.2.4.2 yamt ip->ip_len = htons(fin->fin_plen); 431 1.2.4.2 yamt fin->fin_dlen += inc; 432 1.2.4.2 yamt } 433 1.2.4.2 yamt 434 1.2.4.2 yamt f->ftps_cmd = FTPXY_C_PORT; 435 1.2.4.3 yamt return ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, sp, inc); 436 1.2.4.2 yamt } 437 1.2.4.2 yamt 438 1.2.4.2 yamt 439 1.2.4.2 yamt int 440 1.2.4.2 yamt ipf_p_ftp_addport(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 441 1.2.4.2 yamt ftpinfo_t *ftp, int dlen, int nport, int inc) 442 1.2.4.2 yamt { 443 1.2.4.2 yamt tcphdr_t tcph, *tcp2 = &tcph; 444 1.2.4.2 yamt ipf_main_softc_t *softc; 445 1.2.4.2 yamt ipf_nat_softc_t *softn; 446 1.2.4.3 yamt int direction; 447 1.2.4.2 yamt fr_info_t fi; 448 1.2.4.3 yamt ipnat_t *ipn; 449 1.2.4.2 yamt nat_t *nat2; 450 1.2.4.2 yamt u_short sp; 451 1.2.4.2 yamt int flags; 452 1.2.4.2 yamt 453 1.2.4.2 yamt softc = fin->fin_main_soft; 454 1.2.4.2 yamt softn = softc->ipf_nat_soft; 455 1.2.4.2 yamt 456 1.2.4.2 yamt if ((ftp->ftp_pendnat != NULL) || (ftp->ftp_pendstate != NULL)) { 457 1.2.4.2 yamt if (softf->ipf_p_ftp_single_xfer != 0) { 458 1.2.4.3 yamt DT2(ftp_PORT_error_add_active, nat_t *, nat, 459 1.2.4.3 yamt ftpinfo_t *, ftp); 460 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 461 1.2.4.2 yamt printf("ipf_p_ftp_addport:xfer active %p/%p\n", 462 1.2.4.2 yamt ftp->ftp_pendnat, ftp->ftp_pendstate); 463 1.2.4.2 yamt return 0; 464 1.2.4.2 yamt } 465 1.2.4.2 yamt ipf_p_ftp_setpending(softc, ftp); 466 1.2.4.2 yamt } 467 1.2.4.2 yamt 468 1.2.4.2 yamt /* 469 1.2.4.2 yamt * Add skeleton NAT entry for connection which will come back the 470 1.2.4.2 yamt * other way. 471 1.2.4.2 yamt */ 472 1.2.4.2 yamt sp = nport; 473 1.2.4.2 yamt /* 474 1.2.4.2 yamt * Don't allow the PORT command to specify a port < 1024 due to 475 1.2.4.3 yamt * security risks. 476 1.2.4.2 yamt */ 477 1.2.4.2 yamt if (sp < 1024) { 478 1.2.4.3 yamt DT3(ftp_PORT_error_port, nat_t *, nat, ftpinfo_t *, ftp, 479 1.2.4.3 yamt u_int, sp); 480 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_SECURITY) 481 1.2.4.2 yamt printf("ipf_p_ftp_addport:sp(%d) < 1024\n", sp); 482 1.2.4.2 yamt return 0; 483 1.2.4.2 yamt } 484 1.2.4.2 yamt /* 485 1.2.4.2 yamt * The server may not make the connection back from port 20, but 486 1.2.4.2 yamt * it is the most likely so use it here to check for a conflicting 487 1.2.4.2 yamt * mapping. 488 1.2.4.2 yamt */ 489 1.2.4.2 yamt bcopy((char *)fin, (char *)&fi, sizeof(fi)); 490 1.2.4.2 yamt fi.fin_flx |= FI_IGNORE; 491 1.2.4.2 yamt fi.fin_data[0] = sp; 492 1.2.4.2 yamt fi.fin_data[1] = fin->fin_data[1] - 1; 493 1.2.4.3 yamt fi.fin_src6 = nat->nat_ndst6; 494 1.2.4.3 yamt fi.fin_dst6 = nat->nat_nsrc6; 495 1.2.4.3 yamt 496 1.2.4.3 yamt if (nat->nat_v[0] == 6) { 497 1.2.4.3 yamt #ifndef USE_INET6 498 1.2.4.3 yamt return APR_INC(inc); 499 1.2.4.3 yamt #endif 500 1.2.4.3 yamt } 501 1.2.4.3 yamt 502 1.2.4.2 yamt /* 503 1.2.4.2 yamt * Add skeleton NAT entry for connection which will come back the 504 1.2.4.2 yamt * other way. 505 1.2.4.2 yamt */ 506 1.2.4.3 yamt if (nat->nat_v[0] == 6) { 507 1.2.4.3 yamt #ifdef USE_INET6 508 1.2.4.3 yamt if (nat->nat_dir == NAT_OUTBOUND) { 509 1.2.4.3 yamt nat2 = ipf_nat6_outlookup(&fi, IPN_TCP|NAT_SEARCH, 510 1.2.4.3 yamt nat->nat_pr[1], 511 1.2.4.3 yamt &nat->nat_osrc6.in6, 512 1.2.4.3 yamt &nat->nat_odst6.in6); 513 1.2.4.3 yamt } else { 514 1.2.4.3 yamt nat2 = ipf_nat6_inlookup(&fi, IPN_TCP|NAT_SEARCH, 515 1.2.4.3 yamt nat->nat_pr[0], 516 1.2.4.3 yamt &nat->nat_odst6.in6, 517 1.2.4.3 yamt &nat->nat_osrc6.in6); 518 1.2.4.2 yamt } 519 1.2.4.3 yamt #endif 520 1.2.4.3 yamt } else { 521 1.2.4.3 yamt if (nat->nat_dir == NAT_OUTBOUND) { 522 1.2.4.3 yamt nat2 = ipf_nat_outlookup(&fi, IPN_TCP|NAT_SEARCH, 523 1.2.4.3 yamt nat->nat_pr[1], 524 1.2.4.3 yamt nat->nat_osrcip, 525 1.2.4.3 yamt nat->nat_odstip); 526 1.2.4.3 yamt } else { 527 1.2.4.3 yamt nat2 = ipf_nat_inlookup(&fi, IPN_TCP|NAT_SEARCH, 528 1.2.4.3 yamt nat->nat_pr[0], 529 1.2.4.3 yamt nat->nat_odstip, 530 1.2.4.3 yamt nat->nat_osrcip); 531 1.2.4.3 yamt } 532 1.2.4.3 yamt } 533 1.2.4.3 yamt if (nat2 != NULL) 534 1.2.4.3 yamt return APR_INC(inc); 535 1.2.4.3 yamt 536 1.2.4.3 yamt ipn = ipf_proxy_rule_rev(nat); 537 1.2.4.3 yamt if (ipn == NULL) 538 1.2.4.3 yamt return APR_ERR(1); 539 1.2.4.3 yamt ipn->in_use = 0; 540 1.2.4.3 yamt 541 1.2.4.3 yamt fi.fin_fr = &ftppxyfr; 542 1.2.4.3 yamt fi.fin_dp = (char *)tcp2; 543 1.2.4.3 yamt fi.fin_dlen = sizeof(*tcp2); 544 1.2.4.3 yamt fi.fin_plen = fi.fin_hlen + sizeof(*tcp2); 545 1.2.4.3 yamt fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE; 546 1.2.4.3 yamt fi.fin_data[1] = sp; 547 1.2.4.3 yamt fi.fin_data[0] = 0; 548 1.2.4.3 yamt 549 1.2.4.3 yamt bzero((char *)tcp2, sizeof(*tcp2)); 550 1.2.4.3 yamt tcp2->th_sport = 0; 551 1.2.4.3 yamt tcp2->th_dport = htons(sp); 552 1.2.4.3 yamt 553 1.2.4.3 yamt tcp2->th_win = htons(8192); 554 1.2.4.3 yamt TCP_OFF_A(tcp2, 5); 555 1.2.4.3 yamt tcp2->th_flags = TH_SYN; 556 1.2.4.3 yamt 557 1.2.4.3 yamt if (nat->nat_dir == NAT_INBOUND) { 558 1.2.4.3 yamt fi.fin_out = 1; 559 1.2.4.3 yamt direction = NAT_OUTBOUND; 560 1.2.4.3 yamt } else { 561 1.2.4.3 yamt fi.fin_out = 0; 562 1.2.4.3 yamt direction = NAT_INBOUND; 563 1.2.4.2 yamt } 564 1.2.4.3 yamt flags = SI_W_SPORT|NAT_SLAVE|IPN_TCP; 565 1.2.4.3 yamt 566 1.2.4.3 yamt MUTEX_ENTER(&softn->ipf_nat_new); 567 1.2.4.3 yamt if (nat->nat_v[0] == 6) { 568 1.2.4.3 yamt #ifdef USE_INET6 569 1.2.4.3 yamt nat2 = ipf_nat6_add(&fi, ipn, &ftp->ftp_pendnat, flags, 570 1.2.4.3 yamt direction); 571 1.2.4.3 yamt #endif 572 1.2.4.3 yamt } else { 573 1.2.4.3 yamt nat2 = ipf_nat_add(&fi, ipn, &ftp->ftp_pendnat, flags, 574 1.2.4.3 yamt direction); 575 1.2.4.3 yamt } 576 1.2.4.3 yamt MUTEX_EXIT(&softn->ipf_nat_new); 577 1.2.4.3 yamt 578 1.2.4.3 yamt if (nat2 == NULL) { 579 1.2.4.3 yamt KFREES(ipn, ipn->in_size); 580 1.2.4.3 yamt return APR_ERR(1); 581 1.2.4.3 yamt } 582 1.2.4.3 yamt 583 1.2.4.3 yamt (void) ipf_nat_proto(&fi, nat2, IPN_TCP); 584 1.2.4.3 yamt MUTEX_ENTER(&nat2->nat_lock); 585 1.2.4.3 yamt ipf_nat_update(&fi, nat2); 586 1.2.4.3 yamt MUTEX_EXIT(&nat2->nat_lock); 587 1.2.4.3 yamt fi.fin_ifp = NULL; 588 1.2.4.3 yamt if (nat2->nat_dir == NAT_INBOUND) 589 1.2.4.3 yamt fi.fin_dst6 = nat->nat_osrc6; 590 1.2.4.3 yamt if (ipf_state_add(softc, &fi, (ipstate_t **)&ftp->ftp_pendstate, 591 1.2.4.3 yamt SI_W_SPORT) != 0) 592 1.2.4.3 yamt ipf_nat_setpending(softc, nat2); 593 1.2.4.3 yamt 594 1.2.4.2 yamt return APR_INC(inc); 595 1.2.4.2 yamt } 596 1.2.4.2 yamt 597 1.2.4.2 yamt 598 1.2.4.2 yamt int 599 1.2.4.2 yamt ipf_p_ftp_client(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 600 1.2.4.2 yamt ftpinfo_t *ftp, int dlen) 601 1.2.4.2 yamt { 602 1.2.4.2 yamt char *rptr, *wptr, cmd[6], c; 603 1.2.4.2 yamt ftpside_t *f; 604 1.2.4.2 yamt int inc, i; 605 1.2.4.2 yamt 606 1.2.4.2 yamt inc = 0; 607 1.2.4.2 yamt f = &ftp->ftp_side[0]; 608 1.2.4.2 yamt rptr = f->ftps_rptr; 609 1.2.4.2 yamt wptr = f->ftps_wptr; 610 1.2.4.2 yamt 611 1.2.4.2 yamt for (i = 0; (i < 5) && (i < dlen); i++) { 612 1.2.4.2 yamt c = rptr[i]; 613 1.2.4.2 yamt if (ISALPHA(c)) { 614 1.2.4.2 yamt cmd[i] = TOUPPER(c); 615 1.2.4.2 yamt } else { 616 1.2.4.2 yamt cmd[i] = c; 617 1.2.4.2 yamt } 618 1.2.4.2 yamt } 619 1.2.4.2 yamt cmd[i] = '\0'; 620 1.2.4.2 yamt 621 1.2.4.2 yamt ftp->ftp_incok = 0; 622 1.2.4.3 yamt DT2(ftp_client_command, char [], cmd, int, ftp->ftp_passok); 623 1.2.4.2 yamt if (!strncmp(cmd, "USER ", 5) || !strncmp(cmd, "XAUT ", 5)) { 624 1.2.4.2 yamt if (ftp->ftp_passok == FTPXY_ADOK_1 || 625 1.2.4.2 yamt ftp->ftp_passok == FTPXY_AUOK_1) { 626 1.2.4.2 yamt ftp->ftp_passok = FTPXY_USER_2; 627 1.2.4.2 yamt ftp->ftp_incok = 1; 628 1.2.4.2 yamt } else { 629 1.2.4.2 yamt ftp->ftp_passok = FTPXY_USER_1; 630 1.2.4.2 yamt ftp->ftp_incok = 1; 631 1.2.4.2 yamt } 632 1.2.4.2 yamt } else if (!strncmp(cmd, "AUTH ", 5)) { 633 1.2.4.2 yamt ftp->ftp_passok = FTPXY_AUTH_1; 634 1.2.4.2 yamt ftp->ftp_incok = 1; 635 1.2.4.2 yamt } else if (!strncmp(cmd, "PASS ", 5)) { 636 1.2.4.2 yamt if (ftp->ftp_passok == FTPXY_USOK_1) { 637 1.2.4.2 yamt ftp->ftp_passok = FTPXY_PASS_1; 638 1.2.4.2 yamt ftp->ftp_incok = 1; 639 1.2.4.2 yamt } else if (ftp->ftp_passok == FTPXY_USOK_2) { 640 1.2.4.2 yamt ftp->ftp_passok = FTPXY_PASS_2; 641 1.2.4.2 yamt ftp->ftp_incok = 1; 642 1.2.4.2 yamt } 643 1.2.4.2 yamt } else if ((ftp->ftp_passok == FTPXY_AUOK_1) && 644 1.2.4.2 yamt !strncmp(cmd, "ADAT ", 5)) { 645 1.2.4.2 yamt ftp->ftp_passok = FTPXY_ADAT_1; 646 1.2.4.2 yamt ftp->ftp_incok = 1; 647 1.2.4.2 yamt } else if ((ftp->ftp_passok == FTPXY_PAOK_1 || 648 1.2.4.2 yamt ftp->ftp_passok == FTPXY_PAOK_2) && 649 1.2.4.2 yamt !strncmp(cmd, "ACCT ", 5)) { 650 1.2.4.2 yamt ftp->ftp_passok = FTPXY_ACCT_1; 651 1.2.4.2 yamt ftp->ftp_incok = 1; 652 1.2.4.2 yamt } else if ((ftp->ftp_passok == FTPXY_GO) && 653 1.2.4.2 yamt !softf->ipf_p_ftp_pasvonly && 654 1.2.4.2 yamt !strncmp(cmd, "PORT ", 5)) { 655 1.2.4.2 yamt inc = ipf_p_ftp_port(softf, fin, ip, nat, ftp, dlen); 656 1.2.4.2 yamt } else if ((ftp->ftp_passok == FTPXY_GO) && 657 1.2.4.2 yamt !softf->ipf_p_ftp_pasvonly && 658 1.2.4.2 yamt !strncmp(cmd, "EPRT ", 5)) { 659 1.2.4.2 yamt inc = ipf_p_ftp_eprt(softf, fin, ip, nat, ftp, dlen); 660 1.2.4.2 yamt } else if (softf->ipf_p_ftp_insecure && 661 1.2.4.2 yamt !softf->ipf_p_ftp_pasvonly && 662 1.2.4.2 yamt !strncmp(cmd, "PORT ", 5)) { 663 1.2.4.2 yamt inc = ipf_p_ftp_port(softf, fin, ip, nat, ftp, dlen); 664 1.2.4.2 yamt } 665 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 666 1.2.4.2 yamt printf("ipf_p_ftp_client: cmd[%s] passok %d incok %d inc %d\n", 667 1.2.4.2 yamt cmd, ftp->ftp_passok, ftp->ftp_incok, inc); 668 1.2.4.2 yamt 669 1.2.4.3 yamt DT2(ftp_client_passok, char *, cmd, int, ftp->ftp_passok); 670 1.2.4.2 yamt while ((*rptr++ != '\n') && (rptr < wptr)) 671 1.2.4.2 yamt ; 672 1.2.4.2 yamt f->ftps_rptr = rptr; 673 1.2.4.2 yamt return inc; 674 1.2.4.2 yamt } 675 1.2.4.2 yamt 676 1.2.4.2 yamt 677 1.2.4.2 yamt int 678 1.2.4.2 yamt ipf_p_ftp_pasv(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 679 1.2.4.2 yamt ftpinfo_t *ftp, int dlen) 680 1.2.4.2 yamt { 681 1.2.4.2 yamt u_int a1, a2, a3, a4, data_ip; 682 1.2.4.2 yamt char newbuf[IPF_FTPBUFSZ]; 683 1.2.4.2 yamt const char *brackets[2]; 684 1.2.4.2 yamt u_short a5, a6; 685 1.2.4.2 yamt ftpside_t *f; 686 1.2.4.2 yamt char *s; 687 1.2.4.2 yamt 688 1.2.4.2 yamt if ((softf->ipf_p_ftp_forcepasv != 0) && 689 1.2.4.2 yamt (ftp->ftp_side[0].ftps_cmd != FTPXY_C_PASV)) { 690 1.2.4.3 yamt DT2(ftp_PASV_error_state, nat_t *, nat, ftpinfo_t *, ftp); 691 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 692 1.2.4.2 yamt printf("ipf_p_ftp_pasv:ftps_cmd(%d) != FTPXY_C_PASV\n", 693 1.2.4.2 yamt ftp->ftp_side[0].ftps_cmd); 694 1.2.4.2 yamt return 0; 695 1.2.4.2 yamt } 696 1.2.4.2 yamt 697 1.2.4.2 yamt f = &ftp->ftp_side[1]; 698 1.2.4.2 yamt 699 1.2.4.2 yamt #define PASV_REPLEN 24 700 1.2.4.2 yamt /* 701 1.2.4.2 yamt * Check for PASV reply message. 702 1.2.4.2 yamt */ 703 1.2.4.2 yamt if (dlen < IPF_MIN227LEN) { 704 1.2.4.3 yamt DT3(ftp_PASV_error_short, nat_t *, nat, ftpinfo_t *, ftp, 705 1.2.4.3 yamt int, dlen); 706 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 707 1.2.4.2 yamt printf("ipf_p_ftp_pasv:dlen(%d) < IPF_MIN227LEN\n", 708 1.2.4.2 yamt dlen); 709 1.2.4.2 yamt return 0; 710 1.2.4.2 yamt } else if (strncmp(f->ftps_rptr, 711 1.2.4.2 yamt "227 Entering Passive Mod", PASV_REPLEN)) { 712 1.2.4.3 yamt DT2(ftp_PASV_error_string, nat_t *, nat, ftpinfo_t *, ftp); 713 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 714 1.2.4.2 yamt printf("ipf_p_ftp_pasv:%d reply wrong\n", 227); 715 1.2.4.2 yamt return 0; 716 1.2.4.2 yamt } 717 1.2.4.2 yamt 718 1.2.4.2 yamt brackets[0] = ""; 719 1.2.4.2 yamt brackets[1] = ""; 720 1.2.4.2 yamt /* 721 1.2.4.2 yamt * Skip the PASV reply + space 722 1.2.4.2 yamt */ 723 1.2.4.2 yamt s = f->ftps_rptr + PASV_REPLEN; 724 1.2.4.2 yamt while (*s && !ISDIGIT(*s)) { 725 1.2.4.2 yamt if (*s == '(') { 726 1.2.4.2 yamt brackets[0] = "("; 727 1.2.4.2 yamt brackets[1] = ")"; 728 1.2.4.2 yamt } 729 1.2.4.2 yamt s++; 730 1.2.4.2 yamt } 731 1.2.4.2 yamt 732 1.2.4.2 yamt /* 733 1.2.4.2 yamt * Pick out the address components, two at a time. 734 1.2.4.2 yamt */ 735 1.2.4.2 yamt a1 = ipf_p_ftp_atoi(&s); 736 1.2.4.2 yamt if (s == NULL) { 737 1.2.4.3 yamt DT2(ftp_PASV_error_atoi_1, nat_t *, nat, ftpside_t *, f); 738 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 739 1.2.4.2 yamt printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 1); 740 1.2.4.2 yamt return 0; 741 1.2.4.2 yamt } 742 1.2.4.2 yamt a2 = ipf_p_ftp_atoi(&s); 743 1.2.4.2 yamt if (s == NULL) { 744 1.2.4.3 yamt DT2(ftp_PASV_error_atoi_2, nat_t *, nat, ftpside_t *, f); 745 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 746 1.2.4.2 yamt printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 2); 747 1.2.4.2 yamt return 0; 748 1.2.4.2 yamt } 749 1.2.4.2 yamt 750 1.2.4.2 yamt /* 751 1.2.4.2 yamt * check that IP address in the PASV reply is the same as the 752 1.2.4.2 yamt * sender of the command - prevents using PASV for port scanning. 753 1.2.4.2 yamt */ 754 1.2.4.2 yamt a1 <<= 16; 755 1.2.4.2 yamt a1 |= a2; 756 1.2.4.2 yamt 757 1.2.4.2 yamt if (((nat->nat_dir == NAT_INBOUND) && 758 1.2.4.3 yamt (a1 != ntohl(nat->nat_ndstaddr))) || 759 1.2.4.2 yamt ((nat->nat_dir == NAT_OUTBOUND) && 760 1.2.4.2 yamt (a1 != ntohl(nat->nat_odstaddr)))) { 761 1.2.4.3 yamt DT3(ftp_PASV_error_address, nat_t *, nat, ftpside_t *, f, 762 1.2.4.3 yamt u_int, a1); 763 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 764 1.2.4.2 yamt printf("ipf_p_ftp_pasv:%s != nat->nat_oip\n", "a1"); 765 1.2.4.2 yamt return 0; 766 1.2.4.2 yamt } 767 1.2.4.2 yamt 768 1.2.4.2 yamt a5 = ipf_p_ftp_atoi(&s); 769 1.2.4.2 yamt if (s == NULL) { 770 1.2.4.3 yamt DT2(ftp_PASV_error_atoi_3, nat_t *, nat, ftpside_t *, f); 771 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 772 1.2.4.2 yamt printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 3); 773 1.2.4.2 yamt return 0; 774 1.2.4.2 yamt } 775 1.2.4.2 yamt 776 1.2.4.2 yamt if (*s == ')') 777 1.2.4.2 yamt s++; 778 1.2.4.2 yamt if (*s == '.') 779 1.2.4.2 yamt s++; 780 1.2.4.2 yamt if (*s == '\n') 781 1.2.4.2 yamt s--; 782 1.2.4.2 yamt /* 783 1.2.4.2 yamt * check for CR-LF at the end. 784 1.2.4.2 yamt */ 785 1.2.4.3 yamt if ((*s != '\r') || (*(s + 1) != '\n')) { 786 1.2.4.3 yamt DT(pasv_missing_crlf); 787 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 788 1.2.4.2 yamt printf("ipf_p_ftp_pasv:missing %s", "cr-lf\n"); 789 1.2.4.2 yamt return 0; 790 1.2.4.2 yamt } 791 1.2.4.3 yamt s += 2; 792 1.2.4.2 yamt 793 1.2.4.2 yamt a6 = a5 & 0xff; 794 1.2.4.2 yamt a5 >>= 8; 795 1.2.4.2 yamt /* 796 1.2.4.2 yamt * Calculate new address parts for 227 reply 797 1.2.4.2 yamt */ 798 1.2.4.2 yamt if (nat->nat_dir == NAT_INBOUND) { 799 1.2.4.3 yamt data_ip = nat->nat_odstaddr; 800 1.2.4.2 yamt a1 = ntohl(data_ip); 801 1.2.4.2 yamt } else 802 1.2.4.2 yamt data_ip = htonl(a1); 803 1.2.4.2 yamt 804 1.2.4.2 yamt a2 = (a1 >> 16) & 0xff; 805 1.2.4.2 yamt a3 = (a1 >> 8) & 0xff; 806 1.2.4.2 yamt a4 = a1 & 0xff; 807 1.2.4.2 yamt a1 >>= 24; 808 1.2.4.2 yamt 809 1.2.4.2 yamt #if defined(SNPRINTF) && defined(_KERNEL) 810 1.2.4.2 yamt SNPRINTF(newbuf, sizeof(newbuf), "%s %s%u,%u,%u,%u,%u,%u%s\r\n", 811 1.2.4.2 yamt "227 Entering Passive Mode", brackets[0], a1, a2, a3, a4, 812 1.2.4.2 yamt a5, a6, brackets[1]); 813 1.2.4.2 yamt #else 814 1.2.4.2 yamt (void) sprintf(newbuf, "%s %s%u,%u,%u,%u,%u,%u%s\r\n", 815 1.2.4.2 yamt "227 Entering Passive Mode", brackets[0], a1, a2, a3, a4, 816 1.2.4.2 yamt a5, a6, brackets[1]); 817 1.2.4.2 yamt #endif 818 1.2.4.2 yamt return ipf_p_ftp_pasvreply(softf, fin, ip, nat, ftp, (a5 << 8 | a6), 819 1.2.4.3 yamt newbuf, s); 820 1.2.4.2 yamt } 821 1.2.4.2 yamt 822 1.2.4.2 yamt int 823 1.2.4.2 yamt ipf_p_ftp_pasvreply(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, 824 1.2.4.3 yamt nat_t *nat, ftpinfo_t *ftp, u_int port, char *newmsg, char *s) 825 1.2.4.2 yamt { 826 1.2.4.3 yamt int inc, off, nflags; 827 1.2.4.2 yamt tcphdr_t *tcp, tcph, *tcp2; 828 1.2.4.2 yamt ipf_main_softc_t *softc; 829 1.2.4.2 yamt ipf_nat_softc_t *softn; 830 1.2.4.2 yamt size_t nlen, olen; 831 1.2.4.3 yamt #ifdef USE_INET6 832 1.2.4.3 yamt ip6_t *ip6; 833 1.2.4.3 yamt #endif 834 1.2.4.3 yamt ipnat_t *ipn; 835 1.2.4.2 yamt fr_info_t fi; 836 1.2.4.2 yamt ftpside_t *f; 837 1.2.4.3 yamt nat_t *nat2 = NULL; 838 1.2.4.2 yamt mb_t *m; 839 1.2.4.2 yamt 840 1.2.4.2 yamt softc = fin->fin_main_soft; 841 1.2.4.2 yamt softn = softc->ipf_nat_soft; 842 1.2.4.2 yamt 843 1.2.4.2 yamt if ((ftp->ftp_pendnat != NULL) || (ftp->ftp_pendstate != NULL)) 844 1.2.4.2 yamt ipf_p_ftp_setpending(softc, ftp); 845 1.2.4.2 yamt 846 1.2.4.2 yamt m = fin->fin_m; 847 1.2.4.2 yamt tcp = (tcphdr_t *)fin->fin_dp; 848 1.2.4.2 yamt off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 849 1.2.4.2 yamt 850 1.2.4.2 yamt tcp2 = &tcph; 851 1.2.4.2 yamt inc = 0; 852 1.2.4.2 yamt 853 1.2.4.2 yamt f = &ftp->ftp_side[1]; 854 1.2.4.2 yamt olen = s - f->ftps_rptr; 855 1.2.4.2 yamt nlen = strlen(newmsg); 856 1.2.4.2 yamt inc = nlen - olen; 857 1.2.4.2 yamt if ((inc + fin->fin_plen) > 65535) { 858 1.2.4.3 yamt DT3(ftp_PASV_error_inc, nat_t *, nat, ftpside_t *, f, 859 1.2.4.3 yamt int, inc); 860 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 861 1.2.4.2 yamt printf("ipf_p_ftp_pasv:inc(%d) + ip->ip_len > 65535\n", 862 1.2.4.2 yamt inc); 863 1.2.4.2 yamt return 0; 864 1.2.4.2 yamt } 865 1.2.4.2 yamt 866 1.2.4.3 yamt ipn = ipf_proxy_rule_fwd(nat); 867 1.2.4.3 yamt if (ipn == NULL) 868 1.2.4.3 yamt return APR_ERR(1); 869 1.2.4.3 yamt ipn->in_use = 0; 870 1.2.4.3 yamt 871 1.2.4.3 yamt /* 872 1.2.4.3 yamt * Add skeleton NAT entry for connection which will come back the 873 1.2.4.3 yamt * other way. 874 1.2.4.3 yamt */ 875 1.2.4.3 yamt bzero((char *)tcp2, sizeof(*tcp2)); 876 1.2.4.3 yamt bcopy((char *)fin, (char *)&fi, sizeof(fi)); 877 1.2.4.3 yamt fi.fin_flx |= FI_IGNORE; 878 1.2.4.3 yamt fi.fin_data[0] = 0; 879 1.2.4.3 yamt fi.fin_data[1] = port; 880 1.2.4.3 yamt nflags = IPN_TCP|SI_W_SPORT; 881 1.2.4.3 yamt 882 1.2.4.3 yamt fi.fin_fr = &ftppxyfr; 883 1.2.4.3 yamt fi.fin_dp = (char *)tcp2; 884 1.2.4.3 yamt fi.fin_out = 1 - fin->fin_out; 885 1.2.4.3 yamt fi.fin_dlen = sizeof(*tcp2); 886 1.2.4.3 yamt fi.fin_src6 = nat->nat_osrc6; 887 1.2.4.3 yamt fi.fin_dst6 = nat->nat_odst6; 888 1.2.4.3 yamt fi.fin_plen = fi.fin_hlen + sizeof(*tcp); 889 1.2.4.3 yamt fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE; 890 1.2.4.3 yamt 891 1.2.4.3 yamt TCP_OFF_A(tcp2, 5); 892 1.2.4.3 yamt tcp2->th_flags = TH_SYN; 893 1.2.4.3 yamt tcp2->th_win = htons(8192); 894 1.2.4.3 yamt tcp2->th_dport = htons(port); 895 1.2.4.3 yamt 896 1.2.4.3 yamt MUTEX_ENTER(&softn->ipf_nat_new); 897 1.2.4.3 yamt if (nat->nat_v[0] == 6) { 898 1.2.4.3 yamt #ifdef USE_INET6 899 1.2.4.3 yamt nat2 = ipf_nat6_add(&fi, ipn, &ftp->ftp_pendnat, 900 1.2.4.3 yamt nflags, nat->nat_dir); 901 1.2.4.3 yamt #endif 902 1.2.4.3 yamt } else { 903 1.2.4.3 yamt nat2 = ipf_nat_add(&fi, ipn, &ftp->ftp_pendnat, 904 1.2.4.3 yamt nflags, nat->nat_dir); 905 1.2.4.3 yamt } 906 1.2.4.3 yamt MUTEX_EXIT(&softn->ipf_nat_new); 907 1.2.4.3 yamt 908 1.2.4.3 yamt if (nat2 == NULL) { 909 1.2.4.3 yamt KFREES(ipn, ipn->in_size); 910 1.2.4.3 yamt return APR_ERR(1); 911 1.2.4.3 yamt } 912 1.2.4.3 yamt 913 1.2.4.3 yamt (void) ipf_nat_proto(&fi, nat2, IPN_TCP); 914 1.2.4.3 yamt MUTEX_ENTER(&nat2->nat_lock); 915 1.2.4.3 yamt ipf_nat_update(&fi, nat2); 916 1.2.4.3 yamt MUTEX_EXIT(&nat2->nat_lock); 917 1.2.4.3 yamt fi.fin_ifp = NULL; 918 1.2.4.3 yamt if (nat->nat_dir == NAT_INBOUND) { 919 1.2.4.3 yamt if (nat->nat_v[0] == 6) { 920 1.2.4.3 yamt #ifdef USE_INET6 921 1.2.4.3 yamt fi.fin_dst6 = nat->nat_ndst6; 922 1.2.4.3 yamt #endif 923 1.2.4.3 yamt } else { 924 1.2.4.3 yamt fi.fin_daddr = nat->nat_ndstaddr; 925 1.2.4.3 yamt } 926 1.2.4.3 yamt } 927 1.2.4.3 yamt if (ipf_state_add(softc, &fi, (ipstate_t **)&ftp->ftp_pendstate, 928 1.2.4.3 yamt SI_W_SPORT) != 0) 929 1.2.4.3 yamt ipf_nat_setpending(softc, nat2); 930 1.2.4.3 yamt 931 1.2.4.2 yamt #if !defined(_KERNEL) 932 1.2.4.3 yamt M_ADJ(m, inc); 933 1.2.4.2 yamt #else 934 1.2.4.2 yamt /* 935 1.2.4.2 yamt * m_adj takes care of pkthdr.len, if required and treats inc<0 to 936 1.2.4.2 yamt * mean remove -len bytes from the end of the packet. 937 1.2.4.2 yamt * The mbuf chain will be extended if necessary by m_copyback(). 938 1.2.4.2 yamt */ 939 1.2.4.2 yamt if (inc < 0) 940 1.2.4.2 yamt M_ADJ(m, inc); 941 1.2.4.2 yamt #endif /* !defined(_KERNEL) */ 942 1.2.4.2 yamt COPYBACK(m, off, nlen, newmsg); 943 1.2.4.3 yamt fin->fin_flx |= FI_DOCKSUM; 944 1.2.4.2 yamt 945 1.2.4.2 yamt if (inc != 0) { 946 1.2.4.2 yamt fin->fin_plen += inc; 947 1.2.4.2 yamt fin->fin_dlen += inc; 948 1.2.4.3 yamt if (nat->nat_v[0] == 6) { 949 1.2.4.3 yamt #ifdef USE_INET6 950 1.2.4.3 yamt ip6 = (ip6_t *)fin->fin_ip; 951 1.2.4.3 yamt u_short len = ntohs(ip6->ip6_plen) + inc; 952 1.2.4.3 yamt ip6->ip6_plen = htons(len); 953 1.2.4.3 yamt #endif 954 1.2.4.3 yamt } else { 955 1.2.4.3 yamt ip->ip_len = htons(fin->fin_plen); 956 1.2.4.2 yamt } 957 1.2.4.2 yamt } 958 1.2.4.3 yamt 959 1.2.4.3 yamt return APR_INC(inc); 960 1.2.4.2 yamt } 961 1.2.4.2 yamt 962 1.2.4.2 yamt 963 1.2.4.2 yamt int 964 1.2.4.2 yamt ipf_p_ftp_server(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 965 1.2.4.2 yamt ftpinfo_t *ftp, int dlen) 966 1.2.4.2 yamt { 967 1.2.4.2 yamt char *rptr, *wptr; 968 1.2.4.2 yamt ftpside_t *f; 969 1.2.4.2 yamt int inc; 970 1.2.4.2 yamt 971 1.2.4.2 yamt inc = 0; 972 1.2.4.2 yamt f = &ftp->ftp_side[1]; 973 1.2.4.2 yamt rptr = f->ftps_rptr; 974 1.2.4.2 yamt wptr = f->ftps_wptr; 975 1.2.4.2 yamt 976 1.2.4.3 yamt DT2(ftp_server_response, char *, rptr, int, ftp->ftp_passok); 977 1.2.4.2 yamt if (*rptr == ' ') 978 1.2.4.2 yamt goto server_cmd_ok; 979 1.2.4.2 yamt if (!ISDIGIT(*rptr) || !ISDIGIT(*(rptr + 1)) || !ISDIGIT(*(rptr + 2))) 980 1.2.4.2 yamt return 0; 981 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 982 1.2.4.3 yamt printf("ipf_p_ftp_server_1: cmd[%4.4s] passok %d\n", 983 1.2.4.3 yamt rptr, ftp->ftp_passok); 984 1.2.4.2 yamt if (ftp->ftp_passok == FTPXY_GO) { 985 1.2.4.2 yamt if (!strncmp(rptr, "227 ", 4)) 986 1.2.4.2 yamt inc = ipf_p_ftp_pasv(softf, fin, ip, nat, ftp, dlen); 987 1.2.4.2 yamt else if (!strncmp(rptr, "229 ", 4)) 988 1.2.4.2 yamt inc = ipf_p_ftp_epsv(softf, fin, ip, nat, ftp, dlen); 989 1.2.4.2 yamt else if (strncmp(rptr, "200", 3)) { 990 1.2.4.2 yamt /* 991 1.2.4.2 yamt * 200 is returned for a successful command. 992 1.2.4.2 yamt */ 993 1.2.4.2 yamt ; 994 1.2.4.2 yamt } 995 1.2.4.2 yamt } else if (softf->ipf_p_ftp_insecure && !strncmp(rptr, "227 ", 4)) { 996 1.2.4.2 yamt inc = ipf_p_ftp_pasv(softf, fin, ip, nat, ftp, dlen); 997 1.2.4.2 yamt } else if (softf->ipf_p_ftp_insecure && !strncmp(rptr, "229 ", 4)) { 998 1.2.4.2 yamt inc = ipf_p_ftp_epsv(softf, fin, ip, nat, ftp, dlen); 999 1.2.4.2 yamt } else if (*rptr == '5' || *rptr == '4') 1000 1.2.4.2 yamt ftp->ftp_passok = FTPXY_INIT; 1001 1.2.4.2 yamt else if (ftp->ftp_incok) { 1002 1.2.4.2 yamt if (*rptr == '3') { 1003 1.2.4.2 yamt if (ftp->ftp_passok == FTPXY_ACCT_1) 1004 1.2.4.2 yamt ftp->ftp_passok = FTPXY_GO; 1005 1.2.4.2 yamt else 1006 1.2.4.2 yamt ftp->ftp_passok++; 1007 1.2.4.2 yamt } else if (*rptr == '2') { 1008 1.2.4.2 yamt switch (ftp->ftp_passok) 1009 1.2.4.2 yamt { 1010 1.2.4.2 yamt case FTPXY_USER_1 : 1011 1.2.4.2 yamt case FTPXY_USER_2 : 1012 1.2.4.2 yamt case FTPXY_PASS_1 : 1013 1.2.4.2 yamt case FTPXY_PASS_2 : 1014 1.2.4.2 yamt case FTPXY_ACCT_1 : 1015 1.2.4.2 yamt ftp->ftp_passok = FTPXY_GO; 1016 1.2.4.2 yamt break; 1017 1.2.4.2 yamt default : 1018 1.2.4.2 yamt ftp->ftp_passok += 3; 1019 1.2.4.2 yamt break; 1020 1.2.4.2 yamt } 1021 1.2.4.2 yamt } 1022 1.2.4.2 yamt } 1023 1.2.4.2 yamt ftp->ftp_incok = 0; 1024 1.2.4.3 yamt server_cmd_ok: 1025 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 1026 1.2.4.3 yamt printf("ipf_p_ftp_server_2: cmd[%4.4s] passok %d\n", 1027 1.2.4.3 yamt rptr, ftp->ftp_passok); 1028 1.2.4.3 yamt DT3(ftp_server_passok, char *,rptr, int, ftp->ftp_incok, 1029 1.2.4.3 yamt int, ftp->ftp_passok); 1030 1.2.4.2 yamt 1031 1.2.4.2 yamt while ((*rptr++ != '\n') && (rptr < wptr)) 1032 1.2.4.2 yamt ; 1033 1.2.4.2 yamt f->ftps_rptr = rptr; 1034 1.2.4.2 yamt return inc; 1035 1.2.4.2 yamt } 1036 1.2.4.2 yamt 1037 1.2.4.2 yamt 1038 1.2.4.2 yamt /* 1039 1.2.4.3 yamt * 0 FTPXY_JUNK_OK 1040 1.2.4.3 yamt * 1 FTPXY_JUNK_BAD 1041 1.2.4.3 yamt * 2 FTPXY_JUNK_EOL 1042 1.2.4.3 yamt * 3 FTPXY_JUNK_CONT 1043 1.2.4.3 yamt * 1044 1.2.4.2 yamt * Look to see if the buffer starts with something which we recognise as 1045 1.2.4.2 yamt * being the correct syntax for the FTP protocol. 1046 1.2.4.2 yamt */ 1047 1.2.4.2 yamt int 1048 1.2.4.2 yamt ipf_p_ftp_client_valid(ipf_ftp_softc_t *softf, ftpside_t *ftps, char *buf, 1049 1.2.4.2 yamt size_t len) 1050 1.2.4.2 yamt { 1051 1.2.4.2 yamt register char *s, c, pc; 1052 1.2.4.2 yamt register size_t i = len; 1053 1.2.4.2 yamt char cmd[5]; 1054 1.2.4.2 yamt 1055 1.2.4.2 yamt s = buf; 1056 1.2.4.2 yamt 1057 1.2.4.2 yamt if (ftps->ftps_junk == FTPXY_JUNK_BAD) 1058 1.2.4.2 yamt return FTPXY_JUNK_BAD; 1059 1.2.4.2 yamt 1060 1.2.4.2 yamt if (i < 5) { 1061 1.2.4.3 yamt DT1(client_valid, int, i); 1062 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 1063 1.2.4.2 yamt printf("ipf_p_ftp_client_valid:i(%d) < 5\n", (int)i); 1064 1.2.4.2 yamt return 2; 1065 1.2.4.2 yamt } 1066 1.2.4.2 yamt 1067 1.2.4.2 yamt i--; 1068 1.2.4.2 yamt c = *s++; 1069 1.2.4.2 yamt 1070 1.2.4.2 yamt if (ISALPHA(c)) { 1071 1.2.4.2 yamt cmd[0] = TOUPPER(c); 1072 1.2.4.2 yamt c = *s++; 1073 1.2.4.2 yamt i--; 1074 1.2.4.2 yamt if (ISALPHA(c)) { 1075 1.2.4.2 yamt cmd[1] = TOUPPER(c); 1076 1.2.4.2 yamt c = *s++; 1077 1.2.4.2 yamt i--; 1078 1.2.4.2 yamt if (ISALPHA(c)) { 1079 1.2.4.2 yamt cmd[2] = TOUPPER(c); 1080 1.2.4.2 yamt c = *s++; 1081 1.2.4.2 yamt i--; 1082 1.2.4.2 yamt if (ISALPHA(c)) { 1083 1.2.4.2 yamt cmd[3] = TOUPPER(c); 1084 1.2.4.2 yamt c = *s++; 1085 1.2.4.2 yamt i--; 1086 1.2.4.2 yamt if ((c != ' ') && (c != '\r')) 1087 1.2.4.2 yamt goto bad_client_command; 1088 1.2.4.2 yamt } else if ((c != ' ') && (c != '\r')) 1089 1.2.4.2 yamt goto bad_client_command; 1090 1.2.4.2 yamt } else 1091 1.2.4.2 yamt goto bad_client_command; 1092 1.2.4.2 yamt } else 1093 1.2.4.2 yamt goto bad_client_command; 1094 1.2.4.2 yamt } else { 1095 1.2.4.2 yamt bad_client_command: 1096 1.2.4.3 yamt DT4(client_junk, int, len, int, i, int, c, char *, buf); 1097 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1098 1.2.4.2 yamt printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*.*s]\n", 1099 1.2.4.2 yamt "ipf_p_ftp_client_valid", 1100 1.2.4.2 yamt ftps->ftps_junk, (int)len, (int)i, c, 1101 1.2.4.2 yamt (int)len, (int)len, buf); 1102 1.2.4.2 yamt return FTPXY_JUNK_BAD; 1103 1.2.4.2 yamt } 1104 1.2.4.2 yamt 1105 1.2.4.2 yamt for (; i; i--) { 1106 1.2.4.2 yamt pc = c; 1107 1.2.4.2 yamt c = *s++; 1108 1.2.4.2 yamt if ((pc == '\r') && (c == '\n')) { 1109 1.2.4.2 yamt cmd[4] = '\0'; 1110 1.2.4.3 yamt if (!strcmp(cmd, "PASV")) { 1111 1.2.4.2 yamt ftps->ftps_cmd = FTPXY_C_PASV; 1112 1.2.4.3 yamt } else if (!strcmp(cmd, "EPSV")) { 1113 1.2.4.3 yamt ftps->ftps_cmd = FTPXY_C_EPSV; 1114 1.2.4.3 yamt } else { 1115 1.2.4.2 yamt ftps->ftps_cmd = 0; 1116 1.2.4.3 yamt } 1117 1.2.4.2 yamt return 0; 1118 1.2.4.2 yamt } 1119 1.2.4.2 yamt } 1120 1.2.4.2 yamt #if !defined(_KERNEL) 1121 1.2.4.2 yamt printf("ipf_p_ftp_client_valid:junk after cmd[%*.*s]\n", 1122 1.2.4.2 yamt (int)len, (int)len, buf); 1123 1.2.4.2 yamt #endif 1124 1.2.4.2 yamt return FTPXY_JUNK_EOL; 1125 1.2.4.2 yamt } 1126 1.2.4.2 yamt 1127 1.2.4.2 yamt 1128 1.2.4.2 yamt int 1129 1.2.4.2 yamt ipf_p_ftp_server_valid(ipf_ftp_softc_t *softf, ftpside_t *ftps, char *buf, 1130 1.2.4.2 yamt size_t len) 1131 1.2.4.2 yamt { 1132 1.2.4.2 yamt register char *s, c, pc; 1133 1.2.4.2 yamt register size_t i = len; 1134 1.2.4.2 yamt int cmd; 1135 1.2.4.2 yamt 1136 1.2.4.2 yamt s = buf; 1137 1.2.4.2 yamt cmd = 0; 1138 1.2.4.2 yamt 1139 1.2.4.2 yamt if (ftps->ftps_junk == FTPXY_JUNK_BAD) 1140 1.2.4.2 yamt return FTPXY_JUNK_BAD; 1141 1.2.4.2 yamt 1142 1.2.4.2 yamt if (i < 5) { 1143 1.2.4.3 yamt DT1(server_valid, int, i); 1144 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1145 1.2.4.2 yamt printf("ipf_p_ftp_servert_valid:i(%d) < 5\n", (int)i); 1146 1.2.4.2 yamt return 2; 1147 1.2.4.2 yamt } 1148 1.2.4.2 yamt 1149 1.2.4.2 yamt c = *s++; 1150 1.2.4.2 yamt i--; 1151 1.2.4.2 yamt if (c == ' ') { 1152 1.2.4.2 yamt cmd = -1; 1153 1.2.4.2 yamt goto search_eol; 1154 1.2.4.2 yamt } 1155 1.2.4.2 yamt 1156 1.2.4.2 yamt if (ISDIGIT(c)) { 1157 1.2.4.2 yamt cmd = (c - '0') * 100; 1158 1.2.4.2 yamt c = *s++; 1159 1.2.4.2 yamt i--; 1160 1.2.4.2 yamt if (ISDIGIT(c)) { 1161 1.2.4.2 yamt cmd += (c - '0') * 10; 1162 1.2.4.2 yamt c = *s++; 1163 1.2.4.2 yamt i--; 1164 1.2.4.2 yamt if (ISDIGIT(c)) { 1165 1.2.4.2 yamt cmd += (c - '0'); 1166 1.2.4.2 yamt c = *s++; 1167 1.2.4.2 yamt i--; 1168 1.2.4.2 yamt if ((c != '-') && (c != ' ')) 1169 1.2.4.2 yamt goto bad_server_command; 1170 1.2.4.2 yamt if (c == '-') 1171 1.2.4.2 yamt return FTPXY_JUNK_CONT; 1172 1.2.4.2 yamt } else 1173 1.2.4.2 yamt goto bad_server_command; 1174 1.2.4.2 yamt } else 1175 1.2.4.2 yamt goto bad_server_command; 1176 1.2.4.2 yamt } else { 1177 1.2.4.2 yamt bad_server_command: 1178 1.2.4.3 yamt DT4(server_junk, int len, buf, int, i, int, c, char *, buf); 1179 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO) 1180 1.2.4.2 yamt printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*.*s]\n", 1181 1.2.4.2 yamt "ipf_p_ftp_server_valid", 1182 1.2.4.2 yamt ftps->ftps_junk, (int)len, (int)i, 1183 1.2.4.2 yamt c, (int)len, (int)len, buf); 1184 1.2.4.2 yamt if (ftps->ftps_junk == FTPXY_JUNK_CONT) 1185 1.2.4.2 yamt return FTPXY_JUNK_CONT; 1186 1.2.4.2 yamt return FTPXY_JUNK_BAD; 1187 1.2.4.2 yamt } 1188 1.2.4.2 yamt search_eol: 1189 1.2.4.2 yamt for (; i; i--) { 1190 1.2.4.2 yamt pc = c; 1191 1.2.4.2 yamt c = *s++; 1192 1.2.4.2 yamt if ((pc == '\r') && (c == '\n')) { 1193 1.2.4.2 yamt if (cmd == -1) { 1194 1.2.4.2 yamt if (ftps->ftps_junk == FTPXY_JUNK_CONT) 1195 1.2.4.2 yamt return FTPXY_JUNK_CONT; 1196 1.2.4.2 yamt } else { 1197 1.2.4.2 yamt ftps->ftps_cmd = cmd; 1198 1.2.4.2 yamt } 1199 1.2.4.2 yamt return FTPXY_JUNK_OK; 1200 1.2.4.2 yamt } 1201 1.2.4.2 yamt } 1202 1.2.4.3 yamt 1203 1.2.4.3 yamt DT2(junk_eol, int, len, char *, buf); 1204 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO) 1205 1.2.4.2 yamt printf("ipf_p_ftp_server_valid:junk after cmd[%*.*s]\n", 1206 1.2.4.2 yamt (int)len, (int)len, buf); 1207 1.2.4.2 yamt return FTPXY_JUNK_EOL; 1208 1.2.4.2 yamt } 1209 1.2.4.2 yamt 1210 1.2.4.2 yamt 1211 1.2.4.2 yamt int 1212 1.2.4.2 yamt ipf_p_ftp_valid(ipf_ftp_softc_t *softf, ftpinfo_t *ftp, int side, char *buf, 1213 1.2.4.2 yamt size_t len) 1214 1.2.4.2 yamt { 1215 1.2.4.2 yamt ftpside_t *ftps; 1216 1.2.4.2 yamt int ret; 1217 1.2.4.2 yamt 1218 1.2.4.2 yamt ftps = &ftp->ftp_side[side]; 1219 1.2.4.2 yamt 1220 1.2.4.2 yamt if (side == 0) 1221 1.2.4.2 yamt ret = ipf_p_ftp_client_valid(softf, ftps, buf, len); 1222 1.2.4.2 yamt else 1223 1.2.4.2 yamt ret = ipf_p_ftp_server_valid(softf, ftps, buf, len); 1224 1.2.4.2 yamt return ret; 1225 1.2.4.2 yamt } 1226 1.2.4.2 yamt 1227 1.2.4.2 yamt 1228 1.2.4.2 yamt /* 1229 1.2.4.2 yamt * For map rules, the following applies: 1230 1.2.4.2 yamt * rv == 0 for outbound processing, 1231 1.2.4.2 yamt * rv == 1 for inbound processing. 1232 1.2.4.2 yamt * For rdr rules, the following applies: 1233 1.2.4.2 yamt * rv == 0 for inbound processing, 1234 1.2.4.2 yamt * rv == 1 for outbound processing. 1235 1.2.4.2 yamt */ 1236 1.2.4.2 yamt int 1237 1.2.4.2 yamt ipf_p_ftp_process(ipf_ftp_softc_t *softf, fr_info_t *fin, nat_t *nat, 1238 1.2.4.2 yamt ftpinfo_t *ftp, int rv) 1239 1.2.4.2 yamt { 1240 1.2.4.2 yamt int mlen, len, off, inc, i, sel, sel2, ok, ackoff, seqoff, retry; 1241 1.2.4.2 yamt char *rptr, *wptr, *s; 1242 1.2.4.2 yamt u_32_t thseq, thack; 1243 1.2.4.2 yamt ap_session_t *aps; 1244 1.2.4.2 yamt ftpside_t *f, *t; 1245 1.2.4.2 yamt tcphdr_t *tcp; 1246 1.2.4.2 yamt ip_t *ip; 1247 1.2.4.2 yamt mb_t *m; 1248 1.2.4.2 yamt 1249 1.2.4.2 yamt m = fin->fin_m; 1250 1.2.4.2 yamt ip = fin->fin_ip; 1251 1.2.4.2 yamt tcp = (tcphdr_t *)fin->fin_dp; 1252 1.2.4.2 yamt off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 1253 1.2.4.2 yamt 1254 1.2.4.2 yamt f = &ftp->ftp_side[rv]; 1255 1.2.4.2 yamt t = &ftp->ftp_side[1 - rv]; 1256 1.2.4.2 yamt thseq = ntohl(tcp->th_seq); 1257 1.2.4.2 yamt thack = ntohl(tcp->th_ack); 1258 1.2.4.2 yamt #ifdef __sgi 1259 1.2.4.2 yamt mlen = fin->fin_plen - off; 1260 1.2.4.2 yamt #else 1261 1.2.4.2 yamt mlen = MSGDSIZE(m) - off; 1262 1.2.4.2 yamt #endif 1263 1.2.4.3 yamt 1264 1.2.4.3 yamt DT3(process_debug, tcphdr_t *, tcp, int, off, int, mlen); 1265 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_INFO) 1266 1.2.4.3 yamt printf("ipf_p_ftp_process: %d:%d,%d, mlen %d flags %x\n", 1267 1.2.4.3 yamt fin->fin_out, fin->fin_sport, fin->fin_dport, 1268 1.2.4.3 yamt mlen, tcp->th_flags); 1269 1.2.4.2 yamt 1270 1.2.4.2 yamt if ((mlen == 0) && ((tcp->th_flags & TH_OPENING) == TH_OPENING)) { 1271 1.2.4.2 yamt f->ftps_seq[0] = thseq + 1; 1272 1.2.4.2 yamt t->ftps_seq[0] = thack; 1273 1.2.4.2 yamt return 0; 1274 1.2.4.2 yamt } else if (mlen < 0) { 1275 1.2.4.2 yamt return 0; 1276 1.2.4.2 yamt } 1277 1.2.4.2 yamt 1278 1.2.4.2 yamt aps = nat->nat_aps; 1279 1.2.4.2 yamt 1280 1.2.4.2 yamt sel = aps->aps_sel[1 - rv]; 1281 1.2.4.2 yamt sel2 = aps->aps_sel[rv]; 1282 1.2.4.3 yamt if (rv == 1) { 1283 1.2.4.2 yamt seqoff = aps->aps_seqoff[sel]; 1284 1.2.4.2 yamt if (aps->aps_seqmin[sel] > seqoff + thseq) 1285 1.2.4.2 yamt seqoff = aps->aps_seqoff[!sel]; 1286 1.2.4.2 yamt ackoff = aps->aps_ackoff[sel2]; 1287 1.2.4.2 yamt if (aps->aps_ackmin[sel2] > ackoff + thack) 1288 1.2.4.2 yamt ackoff = aps->aps_ackoff[!sel2]; 1289 1.2.4.2 yamt } else { 1290 1.2.4.2 yamt seqoff = aps->aps_ackoff[sel]; 1291 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_INFO) 1292 1.2.4.2 yamt printf("seqoff %d thseq %x ackmin %x\n", seqoff, thseq, 1293 1.2.4.2 yamt aps->aps_ackmin[sel]); 1294 1.2.4.2 yamt if (aps->aps_ackmin[sel] > seqoff + thseq) 1295 1.2.4.2 yamt seqoff = aps->aps_ackoff[!sel]; 1296 1.2.4.2 yamt 1297 1.2.4.2 yamt ackoff = aps->aps_seqoff[sel2]; 1298 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_INFO) 1299 1.2.4.2 yamt printf("ackoff %d thack %x seqmin %x\n", ackoff, thack, 1300 1.2.4.2 yamt aps->aps_seqmin[sel2]); 1301 1.2.4.2 yamt if (ackoff > 0) { 1302 1.2.4.2 yamt if (aps->aps_seqmin[sel2] > ackoff + thack) 1303 1.2.4.2 yamt ackoff = aps->aps_seqoff[!sel2]; 1304 1.2.4.2 yamt } else { 1305 1.2.4.2 yamt if (aps->aps_seqmin[sel2] > thack) 1306 1.2.4.2 yamt ackoff = aps->aps_seqoff[!sel2]; 1307 1.2.4.2 yamt } 1308 1.2.4.2 yamt } 1309 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_INFO) { 1310 1.2.4.2 yamt printf("%s: %x seq %x/%d ack %x/%d len %d/%d off %d\n", 1311 1.2.4.2 yamt rv ? "IN" : "OUT", tcp->th_flags, thseq, seqoff, 1312 1.2.4.2 yamt thack, ackoff, mlen, fin->fin_plen, off); 1313 1.2.4.2 yamt printf("sel %d seqmin %x/%x offset %d/%d\n", sel, 1314 1.2.4.2 yamt aps->aps_seqmin[sel], aps->aps_seqmin[sel2], 1315 1.2.4.2 yamt aps->aps_seqoff[sel], aps->aps_seqoff[sel2]); 1316 1.2.4.2 yamt printf("sel %d ackmin %x/%x offset %d/%d\n", sel2, 1317 1.2.4.2 yamt aps->aps_ackmin[sel], aps->aps_ackmin[sel2], 1318 1.2.4.2 yamt aps->aps_ackoff[sel], aps->aps_ackoff[sel2]); 1319 1.2.4.2 yamt } 1320 1.2.4.2 yamt 1321 1.2.4.2 yamt /* 1322 1.2.4.2 yamt * XXX - Ideally, this packet should get dropped because we now know 1323 1.2.4.2 yamt * that it is out of order (and there is no real danger in doing so 1324 1.2.4.2 yamt * apart from causing packets to go through here ordered). 1325 1.2.4.2 yamt */ 1326 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_INFO) { 1327 1.2.4.2 yamt printf("rv %d t:seq[0] %x seq[1] %x %d/%d\n", 1328 1.2.4.2 yamt rv, t->ftps_seq[0], t->ftps_seq[1], seqoff, ackoff); 1329 1.2.4.2 yamt } 1330 1.2.4.2 yamt 1331 1.2.4.2 yamt ok = 0; 1332 1.2.4.2 yamt if (t->ftps_seq[0] == 0) { 1333 1.2.4.2 yamt t->ftps_seq[0] = thack; 1334 1.2.4.2 yamt ok = 1; 1335 1.2.4.2 yamt } else { 1336 1.2.4.2 yamt if (ackoff == 0) { 1337 1.2.4.2 yamt if (t->ftps_seq[0] == thack) 1338 1.2.4.2 yamt ok = 1; 1339 1.2.4.2 yamt else if (t->ftps_seq[1] == thack) { 1340 1.2.4.2 yamt t->ftps_seq[0] = thack; 1341 1.2.4.2 yamt ok = 1; 1342 1.2.4.2 yamt } 1343 1.2.4.2 yamt } else { 1344 1.2.4.3 yamt if (t->ftps_seq[0] + ackoff == thack) { 1345 1.2.4.3 yamt t->ftps_seq[0] = thack; 1346 1.2.4.2 yamt ok = 1; 1347 1.2.4.3 yamt } else if (t->ftps_seq[0] == thack + ackoff) { 1348 1.2.4.3 yamt t->ftps_seq[0] = thack + ackoff; 1349 1.2.4.2 yamt ok = 1; 1350 1.2.4.3 yamt } else if (t->ftps_seq[1] + ackoff == thack) { 1351 1.2.4.3 yamt t->ftps_seq[0] = thack; 1352 1.2.4.2 yamt ok = 1; 1353 1.2.4.2 yamt } else if (t->ftps_seq[1] == thack + ackoff) { 1354 1.2.4.3 yamt t->ftps_seq[0] = thack + ackoff; 1355 1.2.4.2 yamt ok = 1; 1356 1.2.4.2 yamt } 1357 1.2.4.2 yamt } 1358 1.2.4.2 yamt } 1359 1.2.4.2 yamt 1360 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_INFO) { 1361 1.2.4.2 yamt if (!ok) 1362 1.2.4.2 yamt printf("%s ok\n", "not"); 1363 1.2.4.2 yamt } 1364 1.2.4.2 yamt 1365 1.2.4.2 yamt if (!mlen) { 1366 1.2.4.3 yamt if (t->ftps_seq[0] + ackoff != thack && 1367 1.2.4.3 yamt t->ftps_seq[1] + ackoff != thack) { 1368 1.2.4.3 yamt DT3(thack, ftpside_t *t, t, int, ackoff, u_32_t, thack); 1369 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) { 1370 1.2.4.3 yamt printf("%s:seq[0](%u) + (%d) != (%u)\n", 1371 1.2.4.2 yamt "ipf_p_ftp_process", t->ftps_seq[0], 1372 1.2.4.2 yamt ackoff, thack); 1373 1.2.4.3 yamt printf("%s:seq[0](%u) + (%d) != (%u)\n", 1374 1.2.4.3 yamt "ipf_p_ftp_process", t->ftps_seq[1], 1375 1.2.4.3 yamt ackoff, thack); 1376 1.2.4.2 yamt } 1377 1.2.4.2 yamt return APR_ERR(1); 1378 1.2.4.2 yamt } 1379 1.2.4.2 yamt 1380 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE) { 1381 1.2.4.2 yamt printf("ipf_p_ftp_process:f:seq[0] %x seq[1] %x\n", 1382 1.2.4.2 yamt f->ftps_seq[0], f->ftps_seq[1]); 1383 1.2.4.2 yamt } 1384 1.2.4.2 yamt 1385 1.2.4.2 yamt if (tcp->th_flags & TH_FIN) { 1386 1.2.4.2 yamt if (thseq == f->ftps_seq[1]) { 1387 1.2.4.2 yamt f->ftps_seq[0] = f->ftps_seq[1] - seqoff; 1388 1.2.4.2 yamt f->ftps_seq[1] = thseq + 1 - seqoff; 1389 1.2.4.2 yamt } else { 1390 1.2.4.3 yamt DT2(thseq, ftpside_t *t, t, u_32_t, thseq); 1391 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) { 1392 1.2.4.2 yamt printf("FIN: thseq %x seqoff %d ftps_seq %x\n", 1393 1.2.4.2 yamt thseq, seqoff, f->ftps_seq[0]); 1394 1.2.4.2 yamt } 1395 1.2.4.2 yamt return APR_ERR(1); 1396 1.2.4.2 yamt } 1397 1.2.4.2 yamt } 1398 1.2.4.2 yamt f->ftps_len = 0; 1399 1.2.4.2 yamt return 0; 1400 1.2.4.2 yamt } 1401 1.2.4.2 yamt 1402 1.2.4.2 yamt ok = 0; 1403 1.2.4.2 yamt if ((thseq == f->ftps_seq[0]) || (thseq == f->ftps_seq[1])) { 1404 1.2.4.2 yamt ok = 1; 1405 1.2.4.2 yamt /* 1406 1.2.4.2 yamt * Retransmitted data packet. 1407 1.2.4.2 yamt */ 1408 1.2.4.2 yamt } else if ((thseq + mlen == f->ftps_seq[0]) || 1409 1.2.4.2 yamt (thseq + mlen == f->ftps_seq[1])) { 1410 1.2.4.2 yamt ok = 1; 1411 1.2.4.2 yamt } 1412 1.2.4.2 yamt 1413 1.2.4.2 yamt if (ok == 0) { 1414 1.2.4.3 yamt DT3(ok_0, ftpside_t *, f, u_32_t, thseq, int, mlen); 1415 1.2.4.2 yamt inc = thseq - f->ftps_seq[0]; 1416 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) { 1417 1.2.4.2 yamt printf("inc %d sel %d rv %d\n", inc, sel, rv); 1418 1.2.4.2 yamt printf("th_seq %x ftps_seq %x/%x\n", 1419 1.2.4.2 yamt thseq, f->ftps_seq[0], f->ftps_seq[1]); 1420 1.2.4.2 yamt printf("ackmin %x ackoff %d\n", aps->aps_ackmin[sel], 1421 1.2.4.2 yamt aps->aps_ackoff[sel]); 1422 1.2.4.2 yamt printf("seqmin %x seqoff %d\n", aps->aps_seqmin[sel], 1423 1.2.4.2 yamt aps->aps_seqoff[sel]); 1424 1.2.4.2 yamt } 1425 1.2.4.2 yamt 1426 1.2.4.2 yamt return APR_ERR(1); 1427 1.2.4.2 yamt } 1428 1.2.4.2 yamt 1429 1.2.4.2 yamt inc = 0; 1430 1.2.4.2 yamt rptr = f->ftps_rptr; 1431 1.2.4.2 yamt wptr = f->ftps_wptr; 1432 1.2.4.2 yamt f->ftps_seq[0] = thseq; 1433 1.2.4.2 yamt f->ftps_seq[1] = f->ftps_seq[0] + mlen; 1434 1.2.4.2 yamt f->ftps_len = mlen; 1435 1.2.4.2 yamt 1436 1.2.4.2 yamt while (mlen > 0) { 1437 1.2.4.2 yamt len = MIN(mlen, sizeof(f->ftps_buf) - (wptr - rptr)); 1438 1.2.4.2 yamt if (len == 0) 1439 1.2.4.2 yamt break; 1440 1.2.4.2 yamt COPYDATA(m, off, len, wptr); 1441 1.2.4.2 yamt mlen -= len; 1442 1.2.4.2 yamt off += len; 1443 1.2.4.2 yamt wptr += len; 1444 1.2.4.2 yamt 1445 1.2.4.2 yamt whilemore: 1446 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 1447 1.2.4.2 yamt printf("%s:len %d/%d off %d wptr %lx junk %d [%*.*s]\n", 1448 1.2.4.2 yamt "ipf_p_ftp_process", 1449 1.2.4.2 yamt len, mlen, off, (u_long)wptr, f->ftps_junk, 1450 1.2.4.2 yamt len, len, rptr); 1451 1.2.4.2 yamt 1452 1.2.4.2 yamt f->ftps_wptr = wptr; 1453 1.2.4.2 yamt if (f->ftps_junk != FTPXY_JUNK_OK) { 1454 1.2.4.2 yamt i = f->ftps_junk; 1455 1.2.4.2 yamt f->ftps_junk = ipf_p_ftp_valid(softf, ftp, rv, rptr, 1456 1.2.4.2 yamt wptr - rptr); 1457 1.2.4.3 yamt DT2(junk_transit, int, i, int, f->ftps_junk); 1458 1.2.4.2 yamt 1459 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 1460 1.2.4.2 yamt printf("%s:junk %d -> %d\n", 1461 1.2.4.2 yamt "ipf_p_ftp_process", i, f->ftps_junk); 1462 1.2.4.2 yamt 1463 1.2.4.2 yamt if (f->ftps_junk == FTPXY_JUNK_BAD) { 1464 1.2.4.3 yamt DT(buffer_full); 1465 1.2.4.2 yamt if (wptr - rptr == sizeof(f->ftps_buf)) { 1466 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & 1467 1.2.4.3 yamt DEBUG_PARSE_INFO) 1468 1.2.4.2 yamt printf("%s:full buffer\n", 1469 1.2.4.2 yamt "ipf_p_ftp_process"); 1470 1.2.4.2 yamt f->ftps_rptr = f->ftps_buf; 1471 1.2.4.2 yamt f->ftps_wptr = f->ftps_buf; 1472 1.2.4.2 yamt rptr = f->ftps_rptr; 1473 1.2.4.2 yamt wptr = f->ftps_wptr; 1474 1.2.4.2 yamt continue; 1475 1.2.4.2 yamt } 1476 1.2.4.2 yamt } 1477 1.2.4.2 yamt } 1478 1.2.4.2 yamt 1479 1.2.4.2 yamt while ((f->ftps_junk == FTPXY_JUNK_OK) && (wptr > rptr)) { 1480 1.2.4.2 yamt len = wptr - rptr; 1481 1.2.4.2 yamt f->ftps_junk = ipf_p_ftp_valid(softf, ftp, rv, 1482 1.2.4.2 yamt rptr, len); 1483 1.2.4.2 yamt 1484 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE) { 1485 1.2.4.2 yamt printf("%s=%d len %d rv %d ptr %lx/%lx ", 1486 1.2.4.2 yamt "ipf_p_ftp_valid", 1487 1.2.4.2 yamt f->ftps_junk, len, rv, (u_long)rptr, 1488 1.2.4.2 yamt (u_long)wptr); 1489 1.2.4.2 yamt printf("buf [%*.*s]\n", len, len, rptr); 1490 1.2.4.2 yamt } 1491 1.2.4.2 yamt 1492 1.2.4.2 yamt if (f->ftps_junk == FTPXY_JUNK_OK) { 1493 1.2.4.2 yamt f->ftps_cmds++; 1494 1.2.4.2 yamt f->ftps_rptr = rptr; 1495 1.2.4.2 yamt if (rv) 1496 1.2.4.3 yamt inc += ipf_p_ftp_server(softf, fin, ip, 1497 1.2.4.3 yamt nat, ftp, len); 1498 1.2.4.2 yamt else 1499 1.2.4.3 yamt inc += ipf_p_ftp_client(softf, fin, ip, 1500 1.2.4.3 yamt nat, ftp, len); 1501 1.2.4.2 yamt rptr = f->ftps_rptr; 1502 1.2.4.2 yamt wptr = f->ftps_wptr; 1503 1.2.4.2 yamt } 1504 1.2.4.2 yamt } 1505 1.2.4.2 yamt 1506 1.2.4.2 yamt /* 1507 1.2.4.2 yamt * Off to a bad start so lets just forget about using the 1508 1.2.4.2 yamt * ftp proxy for this connection. 1509 1.2.4.2 yamt */ 1510 1.2.4.2 yamt if ((f->ftps_cmds == 0) && (f->ftps_junk == FTPXY_JUNK_BAD)) { 1511 1.2.4.2 yamt /* f->ftps_seq[1] += inc; */ 1512 1.2.4.2 yamt 1513 1.2.4.3 yamt DT(ftp_junk_cmd); 1514 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 1515 1.2.4.2 yamt printf("%s:cmds == 0 junk == 1\n", 1516 1.2.4.2 yamt "ipf_p_ftp_process"); 1517 1.2.4.2 yamt return APR_ERR(2); 1518 1.2.4.2 yamt } 1519 1.2.4.2 yamt 1520 1.2.4.2 yamt retry = 0; 1521 1.2.4.2 yamt if ((f->ftps_junk != FTPXY_JUNK_OK) && (rptr < wptr)) { 1522 1.2.4.2 yamt for (s = rptr; s < wptr; s++) { 1523 1.2.4.2 yamt if ((*s == '\r') && (s + 1 < wptr) && 1524 1.2.4.2 yamt (*(s + 1) == '\n')) { 1525 1.2.4.2 yamt rptr = s + 2; 1526 1.2.4.2 yamt retry = 1; 1527 1.2.4.2 yamt if (f->ftps_junk != FTPXY_JUNK_CONT) 1528 1.2.4.2 yamt f->ftps_junk = FTPXY_JUNK_OK; 1529 1.2.4.2 yamt break; 1530 1.2.4.2 yamt } 1531 1.2.4.2 yamt } 1532 1.2.4.2 yamt } 1533 1.2.4.2 yamt 1534 1.2.4.2 yamt if (rptr == wptr) { 1535 1.2.4.2 yamt rptr = wptr = f->ftps_buf; 1536 1.2.4.2 yamt } else { 1537 1.2.4.2 yamt /* 1538 1.2.4.2 yamt * Compact the buffer back to the start. The junk 1539 1.2.4.2 yamt * flag should already be set and because we're not 1540 1.2.4.2 yamt * throwing away any data, it is preserved from its 1541 1.2.4.2 yamt * current state. 1542 1.2.4.2 yamt */ 1543 1.2.4.2 yamt if (rptr > f->ftps_buf) { 1544 1.2.4.2 yamt bcopy(rptr, f->ftps_buf, wptr - rptr); 1545 1.2.4.2 yamt wptr -= rptr - f->ftps_buf; 1546 1.2.4.2 yamt rptr = f->ftps_buf; 1547 1.2.4.2 yamt } 1548 1.2.4.2 yamt } 1549 1.2.4.2 yamt f->ftps_rptr = rptr; 1550 1.2.4.2 yamt f->ftps_wptr = wptr; 1551 1.2.4.2 yamt if (retry) 1552 1.2.4.2 yamt goto whilemore; 1553 1.2.4.2 yamt } 1554 1.2.4.2 yamt 1555 1.2.4.2 yamt /* f->ftps_seq[1] += inc; */ 1556 1.2.4.2 yamt if (tcp->th_flags & TH_FIN) 1557 1.2.4.2 yamt f->ftps_seq[1]++; 1558 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO) { 1559 1.2.4.2 yamt #ifdef __sgi 1560 1.2.4.2 yamt mlen = fin->fin_plen; 1561 1.2.4.2 yamt #else 1562 1.2.4.2 yamt mlen = MSGDSIZE(m); 1563 1.2.4.2 yamt #endif 1564 1.2.4.2 yamt mlen -= off; 1565 1.2.4.2 yamt printf("ftps_seq[1] = %x inc %d len %d\n", 1566 1.2.4.2 yamt f->ftps_seq[1], inc, mlen); 1567 1.2.4.2 yamt } 1568 1.2.4.2 yamt 1569 1.2.4.2 yamt f->ftps_rptr = rptr; 1570 1.2.4.2 yamt f->ftps_wptr = wptr; 1571 1.2.4.2 yamt return APR_INC(inc); 1572 1.2.4.2 yamt } 1573 1.2.4.2 yamt 1574 1.2.4.2 yamt 1575 1.2.4.2 yamt int 1576 1.2.4.2 yamt ipf_p_ftp_out(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 1577 1.2.4.2 yamt { 1578 1.2.4.2 yamt ipf_ftp_softc_t *softf = arg; 1579 1.2.4.2 yamt ftpinfo_t *ftp; 1580 1.2.4.2 yamt int rev; 1581 1.2.4.2 yamt 1582 1.2.4.2 yamt ftp = aps->aps_data; 1583 1.2.4.2 yamt if (ftp == NULL) 1584 1.2.4.2 yamt return 0; 1585 1.2.4.2 yamt 1586 1.2.4.2 yamt rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1; 1587 1.2.4.2 yamt if (ftp->ftp_side[1 - rev].ftps_ifp == NULL) 1588 1.2.4.2 yamt ftp->ftp_side[1 - rev].ftps_ifp = fin->fin_ifp; 1589 1.2.4.2 yamt 1590 1.2.4.2 yamt return ipf_p_ftp_process(softf, fin, nat, ftp, rev); 1591 1.2.4.2 yamt } 1592 1.2.4.2 yamt 1593 1.2.4.2 yamt 1594 1.2.4.2 yamt int 1595 1.2.4.2 yamt ipf_p_ftp_in(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 1596 1.2.4.2 yamt { 1597 1.2.4.2 yamt ipf_ftp_softc_t *softf = arg; 1598 1.2.4.2 yamt ftpinfo_t *ftp; 1599 1.2.4.2 yamt int rev; 1600 1.2.4.2 yamt 1601 1.2.4.2 yamt ftp = aps->aps_data; 1602 1.2.4.2 yamt if (ftp == NULL) 1603 1.2.4.2 yamt return 0; 1604 1.2.4.2 yamt 1605 1.2.4.2 yamt rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1; 1606 1.2.4.2 yamt if (ftp->ftp_side[rev].ftps_ifp == NULL) 1607 1.2.4.2 yamt ftp->ftp_side[rev].ftps_ifp = fin->fin_ifp; 1608 1.2.4.2 yamt 1609 1.2.4.2 yamt return ipf_p_ftp_process(softf, fin, nat, ftp, 1 - rev); 1610 1.2.4.2 yamt } 1611 1.2.4.2 yamt 1612 1.2.4.2 yamt 1613 1.2.4.2 yamt /* 1614 1.2.4.2 yamt * ipf_p_ftp_atoi - implement a version of atoi which processes numbers in 1615 1.2.4.2 yamt * pairs separated by commas (which are expected to be in the range 0 - 255), 1616 1.2.4.2 yamt * returning a 16 bit number combining either side of the , as the MSB and 1617 1.2.4.2 yamt * LSB. 1618 1.2.4.2 yamt */ 1619 1.2.4.2 yamt u_short 1620 1.2.4.2 yamt ipf_p_ftp_atoi(char **ptr) 1621 1.2.4.2 yamt { 1622 1.2.4.2 yamt register char *s = *ptr, c; 1623 1.2.4.2 yamt register u_char i = 0, j = 0; 1624 1.2.4.2 yamt 1625 1.2.4.2 yamt while (((c = *s++) != '\0') && ISDIGIT(c)) { 1626 1.2.4.2 yamt i *= 10; 1627 1.2.4.2 yamt i += c - '0'; 1628 1.2.4.2 yamt } 1629 1.2.4.2 yamt if (c != ',') { 1630 1.2.4.2 yamt *ptr = NULL; 1631 1.2.4.2 yamt return 0; 1632 1.2.4.2 yamt } 1633 1.2.4.2 yamt while (((c = *s++) != '\0') && ISDIGIT(c)) { 1634 1.2.4.2 yamt j *= 10; 1635 1.2.4.2 yamt j += c - '0'; 1636 1.2.4.2 yamt } 1637 1.2.4.2 yamt *ptr = s; 1638 1.2.4.2 yamt i &= 0xff; 1639 1.2.4.2 yamt j &= 0xff; 1640 1.2.4.2 yamt return (i << 8) | j; 1641 1.2.4.2 yamt } 1642 1.2.4.2 yamt 1643 1.2.4.2 yamt 1644 1.2.4.2 yamt int 1645 1.2.4.2 yamt ipf_p_ftp_eprt(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 1646 1.2.4.2 yamt ftpinfo_t *ftp, int dlen) 1647 1.2.4.2 yamt { 1648 1.2.4.2 yamt ftpside_t *f; 1649 1.2.4.2 yamt 1650 1.2.4.2 yamt /* 1651 1.2.4.2 yamt * Check for client sending out EPRT message. 1652 1.2.4.2 yamt */ 1653 1.2.4.2 yamt if (dlen < IPF_MINEPRTLEN) { 1654 1.2.4.3 yamt DT1(epert_dlen, int, dlen); 1655 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1656 1.2.4.2 yamt printf("ipf_p_ftp_eprt:dlen(%d) < IPF_MINEPRTLEN\n", 1657 1.2.4.2 yamt dlen); 1658 1.2.4.2 yamt return 0; 1659 1.2.4.2 yamt } 1660 1.2.4.2 yamt 1661 1.2.4.2 yamt /* 1662 1.2.4.2 yamt * Parse the EPRT command. Format is: 1663 1.2.4.2 yamt * "EPRT |1|1.2.3.4|2000|" for IPv4 and 1664 1.2.4.3 yamt * "EPRT |2|ef00::1:2|2000|" for IPv6 1665 1.2.4.2 yamt */ 1666 1.2.4.2 yamt f = &ftp->ftp_side[0]; 1667 1.2.4.3 yamt if (f->ftps_rptr[5] != '|') 1668 1.2.4.3 yamt return 0; 1669 1.2.4.2 yamt if (f->ftps_rptr[5] == f->ftps_rptr[7]) { 1670 1.2.4.3 yamt if (f->ftps_rptr[6] == '1' && nat->nat_v[0] == 4) 1671 1.2.4.2 yamt return ipf_p_ftp_eprt4(softf, fin, ip, nat, ftp, dlen); 1672 1.2.4.3 yamt #ifdef USE_INET6 1673 1.2.4.3 yamt if (f->ftps_rptr[6] == '2' && nat->nat_v[0] == 6) 1674 1.2.4.3 yamt return ipf_p_ftp_eprt6(softf, fin, ip, nat, ftp, dlen); 1675 1.2.4.3 yamt #endif 1676 1.2.4.2 yamt } 1677 1.2.4.2 yamt return 0; 1678 1.2.4.2 yamt } 1679 1.2.4.2 yamt 1680 1.2.4.2 yamt 1681 1.2.4.2 yamt int 1682 1.2.4.2 yamt ipf_p_ftp_eprt4(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 1683 1.2.4.2 yamt ftpinfo_t *ftp, int dlen) 1684 1.2.4.2 yamt { 1685 1.2.4.2 yamt int a1, a2, a3, a4, port, olen, nlen, inc, off; 1686 1.2.4.2 yamt char newbuf[IPF_FTPBUFSZ]; 1687 1.2.4.2 yamt char *s, c, delim; 1688 1.2.4.2 yamt u_32_t addr, i; 1689 1.2.4.2 yamt tcphdr_t *tcp; 1690 1.2.4.2 yamt ftpside_t *f; 1691 1.2.4.2 yamt mb_t *m; 1692 1.2.4.2 yamt 1693 1.2.4.2 yamt m = fin->fin_m; 1694 1.2.4.2 yamt tcp = (tcphdr_t *)fin->fin_dp; 1695 1.2.4.2 yamt off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 1696 1.2.4.2 yamt f = &ftp->ftp_side[0]; 1697 1.2.4.2 yamt delim = f->ftps_rptr[5]; 1698 1.2.4.2 yamt s = f->ftps_rptr + 8; 1699 1.2.4.2 yamt 1700 1.2.4.2 yamt /* 1701 1.2.4.2 yamt * get the IP address. 1702 1.2.4.2 yamt */ 1703 1.2.4.2 yamt i = 0; 1704 1.2.4.2 yamt while (((c = *s++) != '\0') && ISDIGIT(c)) { 1705 1.2.4.2 yamt i *= 10; 1706 1.2.4.2 yamt i += c - '0'; 1707 1.2.4.2 yamt } 1708 1.2.4.2 yamt if (i > 255) 1709 1.2.4.2 yamt return 0; 1710 1.2.4.2 yamt if (c != '.') 1711 1.2.4.2 yamt return 0; 1712 1.2.4.2 yamt addr = (i << 24); 1713 1.2.4.2 yamt 1714 1.2.4.2 yamt i = 0; 1715 1.2.4.2 yamt while (((c = *s++) != '\0') && ISDIGIT(c)) { 1716 1.2.4.2 yamt i *= 10; 1717 1.2.4.2 yamt i += c - '0'; 1718 1.2.4.2 yamt } 1719 1.2.4.2 yamt if (i > 255) 1720 1.2.4.2 yamt return 0; 1721 1.2.4.2 yamt if (c != '.') 1722 1.2.4.2 yamt return 0; 1723 1.2.4.2 yamt addr |= (addr << 16); 1724 1.2.4.2 yamt 1725 1.2.4.2 yamt i = 0; 1726 1.2.4.2 yamt while (((c = *s++) != '\0') && ISDIGIT(c)) { 1727 1.2.4.2 yamt i *= 10; 1728 1.2.4.2 yamt i += c - '0'; 1729 1.2.4.2 yamt } 1730 1.2.4.2 yamt if (i > 255) 1731 1.2.4.2 yamt return 0; 1732 1.2.4.2 yamt if (c != '.') 1733 1.2.4.2 yamt return 0; 1734 1.2.4.2 yamt addr |= (addr << 8); 1735 1.2.4.2 yamt 1736 1.2.4.2 yamt i = 0; 1737 1.2.4.2 yamt while (((c = *s++) != '\0') && ISDIGIT(c)) { 1738 1.2.4.2 yamt i *= 10; 1739 1.2.4.2 yamt i += c - '0'; 1740 1.2.4.2 yamt } 1741 1.2.4.2 yamt if (i > 255) 1742 1.2.4.2 yamt return 0; 1743 1.2.4.2 yamt if (c != delim) 1744 1.2.4.2 yamt return 0; 1745 1.2.4.2 yamt addr |= addr; 1746 1.2.4.2 yamt 1747 1.2.4.2 yamt /* 1748 1.2.4.2 yamt * Get the port number 1749 1.2.4.2 yamt */ 1750 1.2.4.2 yamt i = 0; 1751 1.2.4.2 yamt while (((c = *s++) != '\0') && ISDIGIT(c)) { 1752 1.2.4.2 yamt i *= 10; 1753 1.2.4.2 yamt i += c - '0'; 1754 1.2.4.2 yamt } 1755 1.2.4.2 yamt if (i > 65535) 1756 1.2.4.2 yamt return 0; 1757 1.2.4.2 yamt if (c != delim) 1758 1.2.4.2 yamt return 0; 1759 1.2.4.2 yamt port = i; 1760 1.2.4.2 yamt 1761 1.2.4.2 yamt /* 1762 1.2.4.2 yamt * Check for CR-LF at the end of the command string. 1763 1.2.4.2 yamt */ 1764 1.2.4.2 yamt if ((*s != '\r') || (*(s + 1) != '\n')) { 1765 1.2.4.3 yamt DT(eprt4_no_crlf); 1766 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1767 1.2.4.2 yamt printf("ipf_p_ftp_eprt4:missing %s\n", "cr-lf"); 1768 1.2.4.2 yamt return 0; 1769 1.2.4.2 yamt } 1770 1.2.4.3 yamt s += 2; 1771 1.2.4.2 yamt 1772 1.2.4.2 yamt /* 1773 1.2.4.2 yamt * Calculate new address parts for PORT command 1774 1.2.4.2 yamt */ 1775 1.2.4.2 yamt if (nat->nat_dir == NAT_INBOUND) 1776 1.2.4.2 yamt a1 = ntohl(nat->nat_odstaddr); 1777 1.2.4.2 yamt else 1778 1.2.4.2 yamt a1 = ntohl(ip->ip_src.s_addr); 1779 1.2.4.2 yamt a2 = (a1 >> 16) & 0xff; 1780 1.2.4.2 yamt a3 = (a1 >> 8) & 0xff; 1781 1.2.4.2 yamt a4 = a1 & 0xff; 1782 1.2.4.2 yamt a1 >>= 24; 1783 1.2.4.2 yamt olen = s - f->ftps_rptr; 1784 1.2.4.2 yamt /* DO NOT change this to snprintf! */ 1785 1.2.4.2 yamt /* 1786 1.2.4.2 yamt * While we could force the use of | as a delimiter here, it makes 1787 1.2.4.2 yamt * sense to preserve whatever character is being used by the systems 1788 1.2.4.2 yamt * involved in the communication. 1789 1.2.4.2 yamt */ 1790 1.2.4.2 yamt #if defined(SNPRINTF) && defined(_KERNEL) 1791 1.2.4.2 yamt SNPRINTF(newbuf, sizeof(newbuf), "%s %c1%c%u.%u.%u.%u%c%u%c\r\n", 1792 1.2.4.3 yamt "EPRT", delim, delim, a1, a2, a3, a4, delim, port, delim); 1793 1.2.4.2 yamt #else 1794 1.2.4.2 yamt (void) sprintf(newbuf, "%s %c1%c%u.%u.%u.%u%c%u%c\r\n", 1795 1.2.4.2 yamt "EPRT", delim, delim, a1, a2, a3, a4, delim, port, 1796 1.2.4.2 yamt delim); 1797 1.2.4.2 yamt #endif 1798 1.2.4.2 yamt 1799 1.2.4.2 yamt nlen = strlen(newbuf); 1800 1.2.4.2 yamt inc = nlen - olen; 1801 1.2.4.2 yamt if ((inc + fin->fin_plen) > 65535) { 1802 1.2.4.3 yamt DT2(eprt4_len, int, inc, int, fin->fin_plen); 1803 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 1804 1.2.4.2 yamt printf("ipf_p_ftp_eprt4:inc(%d) + ip->ip_len > 65535\n", 1805 1.2.4.2 yamt inc); 1806 1.2.4.2 yamt return 0; 1807 1.2.4.2 yamt } 1808 1.2.4.2 yamt 1809 1.2.4.2 yamt off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 1810 1.2.4.2 yamt #if !defined(_KERNEL) 1811 1.2.4.3 yamt M_ADJ(m, inc); 1812 1.2.4.2 yamt #else 1813 1.2.4.2 yamt if (inc < 0) 1814 1.2.4.2 yamt M_ADJ(m, inc); 1815 1.2.4.2 yamt #endif 1816 1.2.4.2 yamt /* the mbuf chain will be extended if necessary by m_copyback() */ 1817 1.2.4.2 yamt COPYBACK(m, off, nlen, newbuf); 1818 1.2.4.3 yamt fin->fin_flx |= FI_DOCKSUM; 1819 1.2.4.2 yamt 1820 1.2.4.2 yamt if (inc != 0) { 1821 1.2.4.2 yamt fin->fin_plen += inc; 1822 1.2.4.2 yamt ip->ip_len = htons(fin->fin_plen); 1823 1.2.4.2 yamt fin->fin_dlen += inc; 1824 1.2.4.2 yamt } 1825 1.2.4.2 yamt 1826 1.2.4.2 yamt f->ftps_cmd = FTPXY_C_EPRT; 1827 1.2.4.2 yamt return ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, port, inc); 1828 1.2.4.2 yamt } 1829 1.2.4.2 yamt 1830 1.2.4.2 yamt 1831 1.2.4.2 yamt int 1832 1.2.4.2 yamt ipf_p_ftp_epsv(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 1833 1.2.4.2 yamt ftpinfo_t *ftp, int dlen) 1834 1.2.4.2 yamt { 1835 1.2.4.2 yamt char newbuf[IPF_FTPBUFSZ]; 1836 1.2.4.2 yamt u_short ap = 0; 1837 1.2.4.2 yamt ftpside_t *f; 1838 1.2.4.2 yamt char *s; 1839 1.2.4.2 yamt 1840 1.2.4.2 yamt if ((softf->ipf_p_ftp_forcepasv != 0) && 1841 1.2.4.2 yamt (ftp->ftp_side[0].ftps_cmd != FTPXY_C_EPSV)) { 1842 1.2.4.3 yamt DT1(epsv_cmd, int, ftp->ftp_side[0].ftps_cmd); 1843 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1844 1.2.4.2 yamt printf("ipf_p_ftp_epsv:ftps_cmd(%d) != FTPXY_C_EPSV\n", 1845 1.2.4.2 yamt ftp->ftp_side[0].ftps_cmd); 1846 1.2.4.2 yamt return 0; 1847 1.2.4.2 yamt } 1848 1.2.4.2 yamt f = &ftp->ftp_side[1]; 1849 1.2.4.2 yamt 1850 1.2.4.2 yamt #define EPSV_REPLEN 33 1851 1.2.4.2 yamt /* 1852 1.2.4.2 yamt * Check for EPSV reply message. 1853 1.2.4.2 yamt */ 1854 1.2.4.3 yamt if (dlen < IPF_MIN229LEN) { 1855 1.2.4.2 yamt return (0); 1856 1.2.4.3 yamt } else if (strncmp(f->ftps_rptr, 1857 1.2.4.3 yamt "229 Entering Extended Passive Mode", EPSV_REPLEN)) { 1858 1.2.4.2 yamt return (0); 1859 1.2.4.3 yamt } 1860 1.2.4.2 yamt 1861 1.2.4.2 yamt /* 1862 1.2.4.2 yamt * Skip the EPSV command + space 1863 1.2.4.2 yamt */ 1864 1.2.4.2 yamt s = f->ftps_rptr + 33; 1865 1.2.4.2 yamt while (*s && !ISDIGIT(*s)) 1866 1.2.4.2 yamt s++; 1867 1.2.4.2 yamt 1868 1.2.4.2 yamt /* 1869 1.2.4.2 yamt * As per RFC 2428, there are no addres components in the EPSV 1870 1.2.4.2 yamt * response. So we'll go straight to getting the port. 1871 1.2.4.2 yamt */ 1872 1.2.4.2 yamt while (*s && ISDIGIT(*s)) { 1873 1.2.4.2 yamt ap *= 10; 1874 1.2.4.2 yamt ap += *s++ - '0'; 1875 1.2.4.2 yamt } 1876 1.2.4.2 yamt 1877 1.2.4.3 yamt if (!s) { 1878 1.2.4.2 yamt return 0; 1879 1.2.4.3 yamt } 1880 1.2.4.2 yamt 1881 1.2.4.2 yamt if (*s == '|') 1882 1.2.4.2 yamt s++; 1883 1.2.4.2 yamt if (*s == ')') 1884 1.2.4.2 yamt s++; 1885 1.2.4.2 yamt if (*s == '\n') 1886 1.2.4.2 yamt s--; 1887 1.2.4.2 yamt /* 1888 1.2.4.2 yamt * check for CR-LF at the end. 1889 1.2.4.2 yamt */ 1890 1.2.4.3 yamt if ((*s != '\r') || (*(s + 1) != '\n')) { 1891 1.2.4.2 yamt return 0; 1892 1.2.4.3 yamt } 1893 1.2.4.3 yamt s += 2; 1894 1.2.4.2 yamt 1895 1.2.4.2 yamt #if defined(SNPRINTF) && defined(_KERNEL) 1896 1.2.4.2 yamt SNPRINTF(newbuf, sizeof(newbuf), "%s (|||%u|)\r\n", 1897 1.2.4.2 yamt "229 Entering Extended Passive Mode", ap); 1898 1.2.4.2 yamt #else 1899 1.2.4.2 yamt (void) sprintf(newbuf, "%s (|||%u|)\r\n", 1900 1.2.4.2 yamt "229 Entering Extended Passive Mode", ap); 1901 1.2.4.2 yamt #endif 1902 1.2.4.2 yamt 1903 1.2.4.2 yamt return ipf_p_ftp_pasvreply(softf, fin, ip, nat, ftp, (u_int)ap, 1904 1.2.4.3 yamt newbuf, s); 1905 1.2.4.3 yamt } 1906 1.2.4.3 yamt 1907 1.2.4.3 yamt #ifdef USE_INET6 1908 1.2.4.3 yamt int 1909 1.2.4.3 yamt ipf_p_ftp_eprt6(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, 1910 1.2.4.3 yamt nat_t *nat, ftpinfo_t *ftp, int dlen) 1911 1.2.4.3 yamt { 1912 1.2.4.3 yamt int port, olen, nlen, inc, off, left, i; 1913 1.2.4.3 yamt char newbuf[IPF_FTPBUFSZ]; 1914 1.2.4.3 yamt char *s, c; 1915 1.2.4.3 yamt i6addr_t addr, *a6; 1916 1.2.4.3 yamt tcphdr_t *tcp; 1917 1.2.4.3 yamt ip6_t *ip6; 1918 1.2.4.3 yamt char delim; 1919 1.2.4.3 yamt u_short whole; 1920 1.2.4.3 yamt u_short part; 1921 1.2.4.3 yamt ftpside_t *f; 1922 1.2.4.3 yamt u_short *t; 1923 1.2.4.3 yamt int fwd; 1924 1.2.4.3 yamt mb_t *m; 1925 1.2.4.3 yamt u_32_t a; 1926 1.2.4.3 yamt 1927 1.2.4.3 yamt m = fin->fin_m; 1928 1.2.4.3 yamt ip6 = (ip6_t *)ip; 1929 1.2.4.3 yamt f = &ftp->ftp_side[0]; 1930 1.2.4.3 yamt s = f->ftps_rptr + 8; 1931 1.2.4.3 yamt f = &ftp->ftp_side[0]; 1932 1.2.4.3 yamt delim = f->ftps_rptr[5]; 1933 1.2.4.3 yamt tcp = (tcphdr_t *)fin->fin_dp; 1934 1.2.4.3 yamt off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 1935 1.2.4.3 yamt 1936 1.2.4.3 yamt addr.i6[0] = 0; 1937 1.2.4.3 yamt addr.i6[1] = 0; 1938 1.2.4.3 yamt addr.i6[2] = 0; 1939 1.2.4.3 yamt addr.i6[3] = 0; 1940 1.2.4.3 yamt /* 1941 1.2.4.3 yamt * Parse an IPv6 address. 1942 1.2.4.3 yamt * Go forward until either :: or | is found. If :: is found, 1943 1.2.4.3 yamt * reverse direction. Direction change is performed to ease 1944 1.2.4.3 yamt * parsing an unknown number of 0s in the middle. 1945 1.2.4.3 yamt */ 1946 1.2.4.3 yamt whole = 0; 1947 1.2.4.3 yamt t = (u_short *)&addr; 1948 1.2.4.3 yamt fwd = 1; 1949 1.2.4.3 yamt for (part = 0; (c = *s) != '\0'; ) { 1950 1.2.4.3 yamt if (c == delim) { 1951 1.2.4.3 yamt *t = htons((u_short)whole); 1952 1.2.4.3 yamt break; 1953 1.2.4.3 yamt } 1954 1.2.4.3 yamt if (c == ':') { 1955 1.2.4.3 yamt *t = part; 1956 1.2.4.3 yamt if (fwd) { 1957 1.2.4.3 yamt *t = htons((u_short)whole); 1958 1.2.4.3 yamt t++; 1959 1.2.4.3 yamt } else { 1960 1.2.4.3 yamt *t = htons((u_short)(whole >> 16)); 1961 1.2.4.3 yamt t--; 1962 1.2.4.3 yamt } 1963 1.2.4.3 yamt whole = 0; 1964 1.2.4.3 yamt if (fwd == 1 && s[1] == ':') { 1965 1.2.4.3 yamt while (*s && *s != '|') 1966 1.2.4.3 yamt s++; 1967 1.2.4.3 yamt if ((c = *s) != delim) 1968 1.2.4.3 yamt break; 1969 1.2.4.3 yamt t = (u_short *)&addr.i6[3]; 1970 1.2.4.3 yamt t++; 1971 1.2.4.3 yamt fwd = 0; 1972 1.2.4.3 yamt } else if (fwd == 0 && s[-1] == ':') { 1973 1.2.4.3 yamt break; 1974 1.2.4.3 yamt } 1975 1.2.4.3 yamt } else { 1976 1.2.4.3 yamt if (c >= '0' && c <= '9') { 1977 1.2.4.3 yamt c -= '0'; 1978 1.2.4.3 yamt } else if (c >= 'a' && c <= 'f') { 1979 1.2.4.3 yamt c -= 'a' + 10; 1980 1.2.4.3 yamt } else if (c >= 'A' && c <= 'F') { 1981 1.2.4.3 yamt c -= 'A' + 10; 1982 1.2.4.3 yamt } 1983 1.2.4.3 yamt if (fwd) { 1984 1.2.4.3 yamt whole <<= 8; 1985 1.2.4.3 yamt whole |= c; 1986 1.2.4.3 yamt } else { 1987 1.2.4.3 yamt whole >>= 8; 1988 1.2.4.3 yamt whole |= ((u_32_t)c) << 24; 1989 1.2.4.3 yamt } 1990 1.2.4.3 yamt } 1991 1.2.4.3 yamt if (fwd) 1992 1.2.4.3 yamt s++; 1993 1.2.4.3 yamt else 1994 1.2.4.3 yamt s--; 1995 1.2.4.3 yamt } 1996 1.2.4.3 yamt if (c != ':' && c != delim) 1997 1.2.4.3 yamt return 0; 1998 1.2.4.3 yamt 1999 1.2.4.3 yamt while (*s != '|') 2000 1.2.4.3 yamt s++; 2001 1.2.4.3 yamt s++; 2002 1.2.4.3 yamt 2003 1.2.4.3 yamt /* 2004 1.2.4.3 yamt * Get the port number 2005 1.2.4.3 yamt */ 2006 1.2.4.3 yamt i = 0; 2007 1.2.4.3 yamt while (((c = *s++) != '\0') && ISDIGIT(c)) { 2008 1.2.4.3 yamt i *= 10; 2009 1.2.4.3 yamt i += c - '0'; 2010 1.2.4.3 yamt } 2011 1.2.4.3 yamt if (i > 65535) 2012 1.2.4.3 yamt return 0; 2013 1.2.4.3 yamt if (c != delim) 2014 1.2.4.3 yamt return 0; 2015 1.2.4.3 yamt port = (u_short)(i & 0xffff); 2016 1.2.4.3 yamt 2017 1.2.4.3 yamt /* 2018 1.2.4.3 yamt * Check for CR-LF at the end of the command string. 2019 1.2.4.3 yamt */ 2020 1.2.4.3 yamt if ((*s != '\r') || (*(s + 1) != '\n')) { 2021 1.2.4.3 yamt DT(eprt6_no_crlf); 2022 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 2023 1.2.4.3 yamt printf("ipf_p_ftp_eprt6:missing %s\n", "cr-lf"); 2024 1.2.4.3 yamt return 0; 2025 1.2.4.3 yamt } 2026 1.2.4.3 yamt s += 2; 2027 1.2.4.3 yamt 2028 1.2.4.3 yamt /* 2029 1.2.4.3 yamt * Calculate new address parts for PORT command 2030 1.2.4.3 yamt */ 2031 1.2.4.3 yamt a6 = (i6addr_t *)&ip6->ip6_src; 2032 1.2.4.3 yamt olen = s - f->ftps_rptr; 2033 1.2.4.3 yamt /* DO NOT change this to snprintf! */ 2034 1.2.4.3 yamt /* 2035 1.2.4.3 yamt * While we could force the use of | as a delimiter here, it makes 2036 1.2.4.3 yamt * sense to preserve whatever character is being used by the systems 2037 1.2.4.3 yamt * involved in the communication. 2038 1.2.4.3 yamt */ 2039 1.2.4.3 yamt s = newbuf; 2040 1.2.4.3 yamt left = sizeof(newbuf); 2041 1.2.4.3 yamt #if defined(SNPRINTF) && defined(_KERNEL) 2042 1.2.4.3 yamt SNPRINTF(newbuf, left, "EPRT %c2%c", delim, delim); 2043 1.2.4.3 yamt left -= strlen(s) + 1; 2044 1.2.4.3 yamt s += strlen(s); 2045 1.2.4.3 yamt a = ntohl(a6->i6[0]); 2046 1.2.4.3 yamt SNPRINTF(s, left, "%x:%x:", a >> 16, a & 0xffff); 2047 1.2.4.3 yamt left -= strlen(s); 2048 1.2.4.3 yamt s += strlen(s); 2049 1.2.4.3 yamt a = ntohl(a6->i6[1]); 2050 1.2.4.3 yamt SNPRINTF(s, left, "%x:%x:", a >> 16, a & 0xffff); 2051 1.2.4.3 yamt left -= strlen(s); 2052 1.2.4.3 yamt s += strlen(s); 2053 1.2.4.3 yamt a = ntohl(a6->i6[2]); 2054 1.2.4.3 yamt SNPRINTF(s, left, "%x:%x:", a >> 16, a & 0xffff); 2055 1.2.4.3 yamt left -= strlen(s); 2056 1.2.4.3 yamt s += strlen(s); 2057 1.2.4.3 yamt a = ntohl(a6->i6[3]); 2058 1.2.4.3 yamt SNPRINTF(s, left, "%x:%x", a >> 16, a & 0xffff); 2059 1.2.4.3 yamt left -= strlen(s); 2060 1.2.4.3 yamt s += strlen(s); 2061 1.2.4.3 yamt sprintf(s, "|%d|\r\n", port); 2062 1.2.4.3 yamt #else 2063 1.2.4.3 yamt (void) sprintf(s, "EPRT %c2%c", delim, delim); 2064 1.2.4.3 yamt s += strlen(s); 2065 1.2.4.3 yamt a = ntohl(a6->i6[0]); 2066 1.2.4.3 yamt sprintf(s, "%x:%x:", a >> 16, a & 0xffff); 2067 1.2.4.3 yamt s += strlen(s); 2068 1.2.4.3 yamt a = ntohl(a6->i6[1]); 2069 1.2.4.3 yamt sprintf(s, "%x:%x:", a >> 16, a & 0xffff); 2070 1.2.4.3 yamt left -= strlen(s); 2071 1.2.4.3 yamt s += strlen(s); 2072 1.2.4.3 yamt a = ntohl(a6->i6[2]); 2073 1.2.4.3 yamt sprintf(s, "%x:%x:", a >> 16, a & 0xffff); 2074 1.2.4.3 yamt left -= strlen(s); 2075 1.2.4.3 yamt s += strlen(s); 2076 1.2.4.3 yamt a = ntohl(a6->i6[3]); 2077 1.2.4.3 yamt sprintf(s, "%x:%x", a >> 16, a & 0xffff); 2078 1.2.4.3 yamt left -= strlen(s); 2079 1.2.4.3 yamt s += strlen(s); 2080 1.2.4.3 yamt sprintf(s, "|%d|\r\n", port); 2081 1.2.4.3 yamt #endif 2082 1.2.4.3 yamt nlen = strlen(newbuf); 2083 1.2.4.3 yamt inc = nlen - olen; 2084 1.2.4.3 yamt if ((inc + fin->fin_plen) > 65535) { 2085 1.2.4.3 yamt DT2(eprt6_len, int, inc, int, fin->fin_plen); 2086 1.2.4.3 yamt if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 2087 1.2.4.3 yamt printf("ipf_p_ftp_eprt6:inc(%d) + ip->ip_len > 65535\n", 2088 1.2.4.3 yamt inc); 2089 1.2.4.3 yamt return 0; 2090 1.2.4.3 yamt } 2091 1.2.4.3 yamt 2092 1.2.4.3 yamt off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 2093 1.2.4.3 yamt #if !defined(_KERNEL) 2094 1.2.4.3 yamt M_ADJ(m, inc); 2095 1.2.4.3 yamt #else 2096 1.2.4.3 yamt if (inc < 0) 2097 1.2.4.3 yamt M_ADJ(m, inc); 2098 1.2.4.3 yamt #endif 2099 1.2.4.3 yamt /* the mbuf chain will be extended if necessary by m_copyback() */ 2100 1.2.4.3 yamt COPYBACK(m, off, nlen, newbuf); 2101 1.2.4.3 yamt fin->fin_flx |= FI_DOCKSUM; 2102 1.2.4.3 yamt 2103 1.2.4.3 yamt if (inc != 0) { 2104 1.2.4.3 yamt fin->fin_plen += inc; 2105 1.2.4.3 yamt ip6->ip6_plen = htons(fin->fin_plen - fin->fin_hlen); 2106 1.2.4.3 yamt fin->fin_dlen += inc; 2107 1.2.4.3 yamt } 2108 1.2.4.3 yamt 2109 1.2.4.3 yamt f->ftps_cmd = FTPXY_C_EPRT; 2110 1.2.4.3 yamt return ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, port, inc); 2111 1.2.4.2 yamt } 2112 1.2.4.3 yamt #endif /* USE_INET6 */ 2113
Indexes created Wed Oct 22 06:10:02 GMT 2025