ip_ftp_pxy.c revision 1.1.1.2
1 /* $NetBSD: ip_ftp_pxy.c,v 1.1.1.2 2012/07/22 13:45:18 darrenr Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 * 8 * Simple FTP transparent proxy for in-kernel use. For use with the NAT 9 * code. 10 * 11 * $Id: ip_ftp_pxy.c,v 1.1.1.2 2012/07/22 13:45:18 darrenr Exp $ 12 */ 13 14 #define IPF_FTP_PROXY 15 16 #define IPF_MINPORTLEN 18 17 #define IPF_MINEPRTLEN 20 18 #define IPF_MAXPORTLEN 30 19 #define IPF_MIN227LEN 39 20 #define IPF_MAX227LEN 51 21 #define IPF_MIN229LEN 47 22 #define IPF_MAX229LEN 51 23 24 #define FTPXY_GO 0 25 #define FTPXY_INIT 1 26 #define FTPXY_USER_1 2 27 #define FTPXY_USOK_1 3 28 #define FTPXY_PASS_1 4 29 #define FTPXY_PAOK_1 5 30 #define FTPXY_AUTH_1 6 31 #define FTPXY_AUOK_1 7 32 #define FTPXY_ADAT_1 8 33 #define FTPXY_ADOK_1 9 34 #define FTPXY_ACCT_1 10 35 #define FTPXY_ACOK_1 11 36 #define FTPXY_USER_2 12 37 #define FTPXY_USOK_2 13 38 #define FTPXY_PASS_2 14 39 #define FTPXY_PAOK_2 15 40 41 #define FTPXY_JUNK_OK 0 42 #define FTPXY_JUNK_BAD 1 /* Ignore all commands for this connection */ 43 #define FTPXY_JUNK_EOL 2 /* consume the rest of this line only */ 44 #define FTPXY_JUNK_CONT 3 /* Saerching for next numeric */ 45 46 /* 47 * Values for FTP commands. Numerics cover 0-999 48 */ 49 #define FTPXY_C_PASV 1000 50 #define FTPXY_C_PORT 1001 51 #define FTPXY_C_EPSV 1002 52 #define FTPXY_C_EPRT 1003 53 54 55 typedef struct ipf_ftp_softc_s { 56 int ipf_p_ftp_pasvonly; 57 /* Do not require logins before transfers */ 58 int ipf_p_ftp_insecure; 59 int ipf_p_ftp_pasvrdr; 60 /* PASV must be last command prior to 227 */ 61 int ipf_p_ftp_forcepasv; 62 int ipf_p_ftp_debug; 63 int ipf_p_ftp_single_xfer; 64 void *ipf_p_ftp_tune; 65 } ipf_ftp_softc_t; 66 67 68 void ipf_p_ftp_main_load __P((void)); 69 void ipf_p_ftp_main_unload __P((void)); 70 void *ipf_p_ftp_soft_create __P((ipf_main_softc_t *)); 71 void ipf_p_ftp_soft_destroy __P((ipf_main_softc_t *, void *)); 72 73 int ipf_p_ftp_client __P((ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 74 ftpinfo_t *, int)); 75 int ipf_p_ftp_complete __P((char *, size_t)); 76 int ipf_p_ftp_in __P((void *, fr_info_t *, ap_session_t *, nat_t *)); 77 int ipf_p_ftp_new __P((void *, fr_info_t *, ap_session_t *, nat_t *)); 78 void ipf_p_ftp_del __P((ipf_main_softc_t *, ap_session_t *)); 79 int ipf_p_ftp_out __P((void *, fr_info_t *, ap_session_t *, nat_t *)); 80 int ipf_p_ftp_pasv __P((ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 81 ftpinfo_t *, int)); 82 int ipf_p_ftp_epsv __P((ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 83 ftpinfo_t *, int)); 84 int ipf_p_ftp_port __P((ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 85 ftpinfo_t *, int)); 86 int ipf_p_ftp_process __P((ipf_ftp_softc_t *, fr_info_t *, nat_t *, 87 ftpinfo_t *, int)); 88 int ipf_p_ftp_server __P((ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 89 ftpinfo_t *, int)); 90 int ipf_p_ftp_valid __P((ipf_ftp_softc_t *, ftpinfo_t *, int, char *, size_t)); 91 int ipf_p_ftp_server_valid __P((ipf_ftp_softc_t *, ftpside_t *, char *, 92 size_t)); 93 int ipf_p_ftp_client_valid __P((ipf_ftp_softc_t *, ftpside_t *, char *, 94 size_t)); 95 u_short ipf_p_ftp_atoi __P((char **)); 96 int ipf_p_ftp_pasvreply __P((ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 97 ftpinfo_t *, u_int, char *, char *)); 98 int ipf_p_ftp_eprt __P((ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 99 ftpinfo_t *, int)); 100 int ipf_p_ftp_eprt4 __P((ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 101 ftpinfo_t *, int)); 102 int ipf_p_ftp_eprt6 __P((ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 103 ftpinfo_t *, int)); 104 int ipf_p_ftp_addport __P((ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 105 ftpinfo_t *, int, int, int)); 106 void ipf_p_ftp_setpending __P((ipf_main_softc_t *, ftpinfo_t *)); 107 108 /* 109 * Debug levels 110 */ 111 #define DEBUG_SECURITY 0x01 112 #define DEBUG_ERROR 0x02 113 #define DEBUG_INFO 0x04 114 #define DEBUG_PARSE_ERR 0x08 115 #define DEBUG_PARSE_INFO 0x10 116 #define DEBUG_PARSE 0x20 117 118 static int ipf_p_ftp_proxy_init = 0; 119 static frentry_t ftppxyfr; 120 static ipftuneable_t ipf_ftp_tuneables[] = { 121 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_debug) }, 122 "ftp_debug", 0, 0x7f, 123 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_debug), 124 0, NULL, NULL }, 125 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_pasvonly) }, 126 "ftp_pasvonly", 0, 1, 127 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_pasvonly), 128 0, NULL, NULL }, 129 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_insecure) }, 130 "ftp_insecure", 0, 1, 131 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_insecure), 132 0, NULL, NULL }, 133 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_pasvrdr) }, 134 "ftp_pasvrdr", 0, 1, 135 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_pasvrdr), 136 0, NULL, NULL }, 137 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_forcepasv) }, 138 "ftp_forcepasv", 0, 1, 139 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_forcepasv), 140 0, NULL, NULL }, 141 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_single_xfer) }, 142 "ftp_single_xfer", 0, 1, 143 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_single_xfer), 144 0, NULL, NULL }, 145 { { NULL }, NULL, 0, 0, 0, 0, NULL, NULL } 146 }; 147 148 149 void 150 ipf_p_ftp_main_load() 151 { 152 bzero((char *)&ftppxyfr, sizeof(ftppxyfr)); 153 ftppxyfr.fr_ref = 1; 154 ftppxyfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE; 155 156 MUTEX_INIT(&ftppxyfr.fr_lock, "FTP Proxy Mutex"); 157 ipf_p_ftp_proxy_init = 1; 158 } 159 160 161 void 162 ipf_p_ftp_main_unload() 163 { 164 165 if (ipf_p_ftp_proxy_init == 1) { 166 MUTEX_DESTROY(&ftppxyfr.fr_lock); 167 ipf_p_ftp_proxy_init = 0; 168 } 169 } 170 171 172 /* 173 * Initialize local structures. 174 */ 175 void * 176 ipf_p_ftp_soft_create(softc) 177 ipf_main_softc_t *softc; 178 { 179 ipf_ftp_softc_t *softf; 180 181 KMALLOC(softf, ipf_ftp_softc_t *); 182 if (softf == NULL) 183 return NULL; 184 185 bzero((char *)softf, sizeof(*softf)); 186 #if defined(_KERNEL) 187 softf->ipf_p_ftp_debug = 0; 188 #else 189 softf->ipf_p_ftp_debug = DEBUG_PARSE_ERR; 190 #endif 191 softf->ipf_p_ftp_forcepasv = 1; 192 193 softf->ipf_p_ftp_tune = ipf_tune_array_copy(softf, 194 sizeof(ipf_ftp_tuneables), 195 ipf_ftp_tuneables); 196 if (softf->ipf_p_ftp_tune == NULL) { 197 ipf_p_ftp_soft_destroy(softc, softf); 198 return NULL; 199 } 200 if (ipf_tune_array_link(softc, softf->ipf_p_ftp_tune) == -1) { 201 ipf_p_ftp_soft_destroy(softc, softf); 202 return NULL; 203 } 204 205 return softf; 206 } 207 208 209 void 210 ipf_p_ftp_soft_destroy(softc, arg) 211 ipf_main_softc_t *softc; 212 void *arg; 213 { 214 ipf_ftp_softc_t *softf = arg; 215 216 if (softf->ipf_p_ftp_tune != NULL) { 217 ipf_tune_array_unlink(softc, softf->ipf_p_ftp_tune); 218 KFREES(softf->ipf_p_ftp_tune, sizeof(ipf_ftp_tuneables)); 219 softf->ipf_p_ftp_tune = NULL; 220 } 221 222 KFREE(softf); 223 } 224 225 226 int 227 ipf_p_ftp_new(arg, fin, aps, nat) 228 void *arg; 229 fr_info_t *fin; 230 ap_session_t *aps; 231 nat_t *nat; 232 { 233 ftpinfo_t *ftp; 234 ftpside_t *f; 235 236 KMALLOC(ftp, ftpinfo_t *); 237 if (ftp == NULL) 238 return -1; 239 240 nat = nat; /* LINT */ 241 242 aps->aps_data = ftp; 243 aps->aps_psiz = sizeof(ftpinfo_t); 244 aps->aps_sport = htons(fin->fin_sport); 245 aps->aps_dport = htons(fin->fin_dport); 246 247 bzero((char *)ftp, sizeof(*ftp)); 248 f = &ftp->ftp_side[0]; 249 f->ftps_rptr = f->ftps_buf; 250 f->ftps_wptr = f->ftps_buf; 251 f = &ftp->ftp_side[1]; 252 f->ftps_rptr = f->ftps_buf; 253 f->ftps_wptr = f->ftps_buf; 254 ftp->ftp_passok = FTPXY_INIT; 255 ftp->ftp_incok = 0; 256 return 0; 257 } 258 259 260 void 261 ipf_p_ftp_setpending(ipf_main_softc_t *softc, ftpinfo_t *ftp) 262 { 263 if (ftp->ftp_pendnat != NULL) 264 ipf_nat_setpending(softc, ftp->ftp_pendnat); 265 266 if (ftp->ftp_pendstate != NULL) { 267 READ_ENTER(&softc->ipf_state); 268 ipf_state_setpending(softc, ftp->ftp_pendstate); 269 RWLOCK_EXIT(&softc->ipf_state); 270 } 271 } 272 273 274 void 275 ipf_p_ftp_del(softc, aps) 276 ipf_main_softc_t *softc; 277 ap_session_t *aps; 278 { 279 ftpinfo_t *ftp; 280 281 ftp = aps->aps_data; 282 if (ftp != NULL) 283 ipf_p_ftp_setpending(softc, ftp); 284 } 285 286 287 int 288 ipf_p_ftp_port(softf, fin, ip, nat, ftp, dlen) 289 ipf_ftp_softc_t *softf; 290 fr_info_t *fin; 291 ip_t *ip; 292 nat_t *nat; 293 ftpinfo_t *ftp; 294 int dlen; 295 { 296 char newbuf[IPF_FTPBUFSZ], *s; 297 u_int a1, a2, a3, a4; 298 u_short a5, a6, sp; 299 size_t nlen, olen; 300 tcphdr_t *tcp; 301 int inc, off; 302 ftpside_t *f; 303 mb_t *m; 304 305 m = fin->fin_m; 306 f = &ftp->ftp_side[0]; 307 tcp = (tcphdr_t *)fin->fin_dp; 308 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 309 310 /* 311 * Check for client sending out PORT message. 312 */ 313 if (dlen < IPF_MINPORTLEN) { 314 DT3(ftp_PORT_error_dlen, nat_t *, nat, ftpside_t *, f, 315 u_int, dlen); 316 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 317 printf("ipf_p_ftp_port:dlen(%d) < IPF_MINPORTLEN\n", 318 dlen); 319 return 0; 320 } 321 /* 322 * Skip the PORT command + space 323 */ 324 s = f->ftps_rptr + 5; 325 /* 326 * Pick out the address components, two at a time. 327 */ 328 a1 = ipf_p_ftp_atoi(&s); 329 if (s == NULL) { 330 DT2(ftp_PORT_error_atoi_1, nat_t *, nat, ftpside_t *, f); 331 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 332 printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 1); 333 return 0; 334 } 335 a2 = ipf_p_ftp_atoi(&s); 336 if (s == NULL) { 337 DT2(ftp_PORT_error_atoi_2, nat_t *, nat, ftpside_t *, f); 338 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 339 printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 2); 340 return 0; 341 } 342 343 /* 344 * Check that IP address in the PORT/PASV reply is the same as the 345 * sender of the command - prevents using PORT for port scanning. 346 */ 347 a1 <<= 16; 348 a1 |= a2; 349 if (((nat->nat_dir == NAT_OUTBOUND) && 350 (a1 != ntohl(nat->nat_osrcaddr))) || 351 ((nat->nat_dir == NAT_INBOUND) && 352 (a1 != ntohl(nat->nat_nsrcaddr)))) { 353 DT3(ftp_PORT_error_address, nat_t *, nat, ftpside_t *, f, 354 u_int, a1); 355 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 356 printf("ipf_p_ftp_port:%s != nat->nat_inip\n", "a1"); 357 return APR_ERR(1); 358 } 359 360 a5 = ipf_p_ftp_atoi(&s); 361 if (s == NULL) { 362 DT2(ftp_PORT_error_atoi_3, nat_t *, nat, ftpside_t *, f); 363 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 364 printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 3); 365 return 0; 366 } 367 if (*s == ')') 368 s++; 369 370 /* 371 * check for CR-LF at the end. 372 */ 373 if (*s == '\n') 374 s--; 375 if ((*s != '\r') || (*(s + 1) != '\n')) { 376 DT2(ftp_PORT_error_no_crlf, nat_t *, nat, ftpside_t *, f); 377 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 378 printf("ipf_p_ftp_port:missing %s\n", "cr-lf"); 379 return 0; 380 } 381 s += 2; 382 a6 = a5 & 0xff; 383 384 /* 385 * Calculate the source port. Verification of > 1024 is in 386 * ipf_p_ftp_addport. 387 */ 388 a5 >>= 8; 389 a5 &= 0xff; 390 sp = a5 << 8 | a6; 391 392 /* 393 * Calculate new address parts for PORT command 394 */ 395 if (nat->nat_dir == NAT_INBOUND) 396 a1 = ntohl(nat->nat_ndstaddr); 397 else 398 a1 = ntohl(ip->ip_src.s_addr); 399 a1 = ntohl(ip->ip_src.s_addr); 400 a2 = (a1 >> 16) & 0xff; 401 a3 = (a1 >> 8) & 0xff; 402 a4 = a1 & 0xff; 403 a1 >>= 24; 404 olen = s - f->ftps_rptr; 405 /* DO NOT change this to snprintf! */ 406 #if defined(SNPRINTF) && defined(_KERNEL) 407 SNPRINTF(newbuf, sizeof(newbuf), "%s %u,%u,%u,%u,%u,%u\r\n", 408 "PORT", a1, a2, a3, a4, a5, a6); 409 #else 410 (void) sprintf(newbuf, "%s %u,%u,%u,%u,%u,%u\r\n", 411 "PORT", a1, a2, a3, a4, a5, a6); 412 #endif 413 414 nlen = strlen(newbuf); 415 inc = nlen - olen; 416 if ((inc + fin->fin_plen) > 65535) { 417 DT3(ftp_PORT_error_inc, nat_t *, nat, ftpside_t *, f, 418 int, inc); 419 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 420 printf("ipf_p_ftp_port:inc(%d) + ip->ip_len > 65535\n", 421 inc); 422 return 0; 423 } 424 425 #if !defined(_KERNEL) 426 M_ADJ(m, inc); 427 #else 428 /* 429 * m_adj takes care of pkthdr.len, if required and treats inc<0 to 430 * mean remove -len bytes from the end of the packet. 431 * The mbuf chain will be extended if necessary by m_copyback(). 432 */ 433 if (inc < 0) 434 M_ADJ(m, inc); 435 #endif /* !defined(_KERNEL) */ 436 COPYBACK(m, off, nlen, newbuf); 437 fin->fin_flx |= FI_DOCKSUM; 438 439 if (inc != 0) { 440 fin->fin_plen += inc; 441 ip->ip_len = htons(fin->fin_plen); 442 fin->fin_dlen += inc; 443 } 444 445 f->ftps_cmd = FTPXY_C_PORT; 446 return ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, sp, inc); 447 } 448 449 450 int 451 ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, nport, inc) 452 ipf_ftp_softc_t *softf; 453 fr_info_t *fin; 454 ip_t *ip; 455 nat_t *nat; 456 ftpinfo_t *ftp; 457 int dlen, nport, inc; 458 { 459 tcphdr_t tcph, *tcp2 = &tcph; 460 ipf_main_softc_t *softc; 461 ipf_nat_softc_t *softn; 462 int direction; 463 fr_info_t fi; 464 ipnat_t *ipn; 465 nat_t *nat2; 466 u_short sp; 467 int flags; 468 469 softc = fin->fin_main_soft; 470 softn = softc->ipf_nat_soft; 471 472 if ((ftp->ftp_pendnat != NULL) || (ftp->ftp_pendstate != NULL)) { 473 if (softf->ipf_p_ftp_single_xfer != 0) { 474 DT2(ftp_PORT_error_add_active, nat_t *, nat, 475 ftpinfo_t *, ftp); 476 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 477 printf("ipf_p_ftp_addport:xfer active %p/%p\n", 478 ftp->ftp_pendnat, ftp->ftp_pendstate); 479 return 0; 480 } 481 ipf_p_ftp_setpending(softc, ftp); 482 } 483 484 /* 485 * Add skeleton NAT entry for connection which will come back the 486 * other way. 487 */ 488 sp = nport; 489 /* 490 * Don't allow the PORT command to specify a port < 1024 due to 491 * security risks. 492 */ 493 if (sp < 1024) { 494 DT3(ftp_PORT_error_port, nat_t *, nat, ftpinfo_t *, ftp, 495 u_int, sp); 496 if (softf->ipf_p_ftp_debug & DEBUG_SECURITY) 497 printf("ipf_p_ftp_addport:sp(%d) < 1024\n", sp); 498 return 0; 499 } 500 /* 501 * The server may not make the connection back from port 20, but 502 * it is the most likely so use it here to check for a conflicting 503 * mapping. 504 */ 505 bcopy((char *)fin, (char *)&fi, sizeof(fi)); 506 fi.fin_flx |= FI_IGNORE; 507 fi.fin_data[0] = sp; 508 fi.fin_data[1] = fin->fin_data[1] - 1; 509 fi.fin_src6 = nat->nat_ndst6; 510 fi.fin_dst6 = nat->nat_nsrc6; 511 512 if (nat->nat_v[0] == 6) { 513 #ifndef USE_INET6 514 return APR_INC(inc); 515 #endif 516 } 517 518 /* 519 * Add skeleton NAT entry for connection which will come back the 520 * other way. 521 */ 522 if (nat->nat_v[0] == 6) { 523 #ifdef USE_INET6 524 if (nat->nat_dir == NAT_OUTBOUND) { 525 nat2 = ipf_nat6_outlookup(&fi, IPN_TCP|NAT_SEARCH, 526 nat->nat_pr[1], 527 &nat->nat_osrc6.in6, 528 &nat->nat_odst6.in6); 529 } else { 530 nat2 = ipf_nat6_inlookup(&fi, IPN_TCP|NAT_SEARCH, 531 nat->nat_pr[0], 532 &nat->nat_odst6.in6, 533 &nat->nat_osrc6.in6); 534 } 535 #endif 536 } else { 537 if (nat->nat_dir == NAT_OUTBOUND) { 538 nat2 = ipf_nat_outlookup(&fi, IPN_TCP|NAT_SEARCH, 539 nat->nat_pr[1], 540 nat->nat_osrcip, 541 nat->nat_odstip); 542 } else { 543 nat2 = ipf_nat_inlookup(&fi, IPN_TCP|NAT_SEARCH, 544 nat->nat_pr[0], 545 nat->nat_odstip, 546 nat->nat_osrcip); 547 } 548 } 549 if (nat2 != NULL) 550 return APR_INC(inc); 551 552 ipn = ipf_proxy_rule_rev(nat); 553 if (ipn == NULL) 554 return APR_ERR(1); 555 ipn->in_use = 0; 556 557 fi.fin_fr = &ftppxyfr; 558 fi.fin_dp = (char *)tcp2; 559 fi.fin_dlen = sizeof(*tcp2); 560 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2); 561 fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE; 562 fi.fin_data[1] = sp; 563 fi.fin_data[0] = 0; 564 565 bzero((char *)tcp2, sizeof(*tcp2)); 566 tcp2->th_sport = 0; 567 tcp2->th_dport = htons(sp); 568 569 tcp2->th_win = htons(8192); 570 TCP_OFF_A(tcp2, 5); 571 tcp2->th_flags = TH_SYN; 572 573 if (nat->nat_dir == NAT_INBOUND) { 574 fi.fin_out = 1; 575 direction = NAT_OUTBOUND; 576 } else { 577 fi.fin_out = 0; 578 direction = NAT_INBOUND; 579 } 580 flags = SI_W_SPORT|NAT_SLAVE|IPN_TCP; 581 582 MUTEX_ENTER(&softn->ipf_nat_new); 583 if (nat->nat_v[0] == 6) { 584 #ifdef USE_INET6 585 nat2 = ipf_nat6_add(&fi, ipn, &ftp->ftp_pendnat, flags, 586 direction); 587 #endif 588 } else { 589 nat2 = ipf_nat_add(&fi, ipn, &ftp->ftp_pendnat, flags, 590 direction); 591 } 592 MUTEX_EXIT(&softn->ipf_nat_new); 593 594 if (nat2 == NULL) { 595 KFREES(ipn, ipn->in_size); 596 return APR_ERR(1); 597 } 598 599 (void) ipf_nat_proto(&fi, nat2, IPN_TCP); 600 MUTEX_ENTER(&nat2->nat_lock); 601 ipf_nat_update(&fi, nat2); 602 MUTEX_EXIT(&nat2->nat_lock); 603 fi.fin_ifp = NULL; 604 if (nat2->nat_dir == NAT_INBOUND) 605 fi.fin_dst6 = nat->nat_osrc6; 606 if (ipf_state_add(softc, &fi, (ipstate_t **)&ftp->ftp_pendstate, 607 SI_W_SPORT) != 0) 608 ipf_nat_setpending(softc, nat2); 609 610 return APR_INC(inc); 611 } 612 613 614 int 615 ipf_p_ftp_client(softf, fin, ip, nat, ftp, dlen) 616 ipf_ftp_softc_t *softf; 617 fr_info_t *fin; 618 nat_t *nat; 619 ftpinfo_t *ftp; 620 ip_t *ip; 621 int dlen; 622 { 623 char *rptr, *wptr, cmd[6], c; 624 ftpside_t *f; 625 int inc, i; 626 627 inc = 0; 628 f = &ftp->ftp_side[0]; 629 rptr = f->ftps_rptr; 630 wptr = f->ftps_wptr; 631 632 for (i = 0; (i < 5) && (i < dlen); i++) { 633 c = rptr[i]; 634 if (ISALPHA(c)) { 635 cmd[i] = TOUPPER(c); 636 } else { 637 cmd[i] = c; 638 } 639 } 640 cmd[i] = '\0'; 641 642 ftp->ftp_incok = 0; 643 DT2(ftp_client_command, char [], cmd, int, ftp->ftp_passok); 644 if (!strncmp(cmd, "USER ", 5) || !strncmp(cmd, "XAUT ", 5)) { 645 if (ftp->ftp_passok == FTPXY_ADOK_1 || 646 ftp->ftp_passok == FTPXY_AUOK_1) { 647 ftp->ftp_passok = FTPXY_USER_2; 648 ftp->ftp_incok = 1; 649 } else { 650 ftp->ftp_passok = FTPXY_USER_1; 651 ftp->ftp_incok = 1; 652 } 653 } else if (!strncmp(cmd, "AUTH ", 5)) { 654 ftp->ftp_passok = FTPXY_AUTH_1; 655 ftp->ftp_incok = 1; 656 } else if (!strncmp(cmd, "PASS ", 5)) { 657 if (ftp->ftp_passok == FTPXY_USOK_1) { 658 ftp->ftp_passok = FTPXY_PASS_1; 659 ftp->ftp_incok = 1; 660 } else if (ftp->ftp_passok == FTPXY_USOK_2) { 661 ftp->ftp_passok = FTPXY_PASS_2; 662 ftp->ftp_incok = 1; 663 } 664 } else if ((ftp->ftp_passok == FTPXY_AUOK_1) && 665 !strncmp(cmd, "ADAT ", 5)) { 666 ftp->ftp_passok = FTPXY_ADAT_1; 667 ftp->ftp_incok = 1; 668 } else if ((ftp->ftp_passok == FTPXY_PAOK_1 || 669 ftp->ftp_passok == FTPXY_PAOK_2) && 670 !strncmp(cmd, "ACCT ", 5)) { 671 ftp->ftp_passok = FTPXY_ACCT_1; 672 ftp->ftp_incok = 1; 673 } else if ((ftp->ftp_passok == FTPXY_GO) && 674 !softf->ipf_p_ftp_pasvonly && 675 !strncmp(cmd, "PORT ", 5)) { 676 inc = ipf_p_ftp_port(softf, fin, ip, nat, ftp, dlen); 677 } else if ((ftp->ftp_passok == FTPXY_GO) && 678 !softf->ipf_p_ftp_pasvonly && 679 !strncmp(cmd, "EPRT ", 5)) { 680 inc = ipf_p_ftp_eprt(softf, fin, ip, nat, ftp, dlen); 681 } else if (softf->ipf_p_ftp_insecure && 682 !softf->ipf_p_ftp_pasvonly && 683 !strncmp(cmd, "PORT ", 5)) { 684 inc = ipf_p_ftp_port(softf, fin, ip, nat, ftp, dlen); 685 } 686 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 687 printf("ipf_p_ftp_client: cmd[%s] passok %d incok %d inc %d\n", 688 cmd, ftp->ftp_passok, ftp->ftp_incok, inc); 689 690 DT2(ftp_client_passok, char *, cmd, int, ftp->ftp_passok); 691 while ((*rptr++ != '\n') && (rptr < wptr)) 692 ; 693 f->ftps_rptr = rptr; 694 return inc; 695 } 696 697 698 int 699 ipf_p_ftp_pasv(softf, fin, ip, nat, ftp, dlen) 700 ipf_ftp_softc_t *softf; 701 fr_info_t *fin; 702 ip_t *ip; 703 nat_t *nat; 704 ftpinfo_t *ftp; 705 int dlen; 706 { 707 u_int a1, a2, a3, a4, data_ip; 708 char newbuf[IPF_FTPBUFSZ]; 709 const char *brackets[2]; 710 u_short a5, a6; 711 ftpside_t *f; 712 char *s; 713 714 if ((softf->ipf_p_ftp_forcepasv != 0) && 715 (ftp->ftp_side[0].ftps_cmd != FTPXY_C_PASV)) { 716 DT2(ftp_PASV_error_state, nat_t *, nat, ftpinfo_t *, ftp); 717 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 718 printf("ipf_p_ftp_pasv:ftps_cmd(%d) != FTPXY_C_PASV\n", 719 ftp->ftp_side[0].ftps_cmd); 720 return 0; 721 } 722 723 f = &ftp->ftp_side[1]; 724 725 #define PASV_REPLEN 24 726 /* 727 * Check for PASV reply message. 728 */ 729 if (dlen < IPF_MIN227LEN) { 730 DT3(ftp_PASV_error_short, nat_t *, nat, ftpinfo_t *, ftp, 731 int, dlen); 732 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 733 printf("ipf_p_ftp_pasv:dlen(%d) < IPF_MIN227LEN\n", 734 dlen); 735 return 0; 736 } else if (strncmp(f->ftps_rptr, 737 "227 Entering Passive Mod", PASV_REPLEN)) { 738 DT2(ftp_PASV_error_string, nat_t *, nat, ftpinfo_t *, ftp); 739 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 740 printf("ipf_p_ftp_pasv:%d reply wrong\n", 227); 741 return 0; 742 } 743 744 brackets[0] = ""; 745 brackets[1] = ""; 746 /* 747 * Skip the PASV reply + space 748 */ 749 s = f->ftps_rptr + PASV_REPLEN; 750 while (*s && !ISDIGIT(*s)) { 751 if (*s == '(') { 752 brackets[0] = "("; 753 brackets[1] = ")"; 754 } 755 s++; 756 } 757 758 /* 759 * Pick out the address components, two at a time. 760 */ 761 a1 = ipf_p_ftp_atoi(&s); 762 if (s == NULL) { 763 DT2(ftp_PASV_error_atoi_1, nat_t *, nat, ftpside_t *, f); 764 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 765 printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 1); 766 return 0; 767 } 768 a2 = ipf_p_ftp_atoi(&s); 769 if (s == NULL) { 770 DT2(ftp_PASV_error_atoi_2, nat_t *, nat, ftpside_t *, f); 771 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 772 printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 2); 773 return 0; 774 } 775 776 /* 777 * check that IP address in the PASV reply is the same as the 778 * sender of the command - prevents using PASV for port scanning. 779 */ 780 a1 <<= 16; 781 a1 |= a2; 782 783 if (((nat->nat_dir == NAT_INBOUND) && 784 (a1 != ntohl(nat->nat_ndstaddr))) || 785 ((nat->nat_dir == NAT_OUTBOUND) && 786 (a1 != ntohl(nat->nat_odstaddr)))) { 787 DT3(ftp_PASV_error_address, nat_t *, nat, ftpside_t *, f, 788 u_int, a1); 789 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 790 printf("ipf_p_ftp_pasv:%s != nat->nat_oip\n", "a1"); 791 return 0; 792 } 793 794 a5 = ipf_p_ftp_atoi(&s); 795 if (s == NULL) { 796 DT2(ftp_PASV_error_atoi_3, nat_t *, nat, ftpside_t *, f); 797 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 798 printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 3); 799 return 0; 800 } 801 802 if (*s == ')') 803 s++; 804 if (*s == '.') 805 s++; 806 if (*s == '\n') 807 s--; 808 /* 809 * check for CR-LF at the end. 810 */ 811 if ((*s != '\r') || (*(s + 1) != '\n')) { 812 DT(pasv_missing_crlf); 813 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 814 printf("ipf_p_ftp_pasv:missing %s", "cr-lf\n"); 815 return 0; 816 } 817 s += 2; 818 819 a6 = a5 & 0xff; 820 a5 >>= 8; 821 /* 822 * Calculate new address parts for 227 reply 823 */ 824 if (nat->nat_dir == NAT_INBOUND) { 825 data_ip = nat->nat_odstaddr; 826 a1 = ntohl(data_ip); 827 } else 828 data_ip = htonl(a1); 829 830 a2 = (a1 >> 16) & 0xff; 831 a3 = (a1 >> 8) & 0xff; 832 a4 = a1 & 0xff; 833 a1 >>= 24; 834 835 #if defined(SNPRINTF) && defined(_KERNEL) 836 SNPRINTF(newbuf, sizeof(newbuf), "%s %s%u,%u,%u,%u,%u,%u%s\r\n", 837 "227 Entering Passive Mode", brackets[0], a1, a2, a3, a4, 838 a5, a6, brackets[1]); 839 #else 840 (void) sprintf(newbuf, "%s %s%u,%u,%u,%u,%u,%u%s\r\n", 841 "227 Entering Passive Mode", brackets[0], a1, a2, a3, a4, 842 a5, a6, brackets[1]); 843 #endif 844 return ipf_p_ftp_pasvreply(softf, fin, ip, nat, ftp, (a5 << 8 | a6), 845 newbuf, s); 846 } 847 848 int 849 ipf_p_ftp_pasvreply(softf, fin, ip, nat, ftp, port, newmsg, s) 850 ipf_ftp_softc_t *softf; 851 fr_info_t *fin; 852 ip_t *ip; 853 nat_t *nat; 854 ftpinfo_t *ftp; 855 u_int port; 856 char *newmsg; 857 char *s; 858 { 859 int inc, off, nflags; 860 tcphdr_t *tcp, tcph, *tcp2; 861 ipf_main_softc_t *softc; 862 ipf_nat_softc_t *softn; 863 size_t nlen, olen; 864 #ifdef USE_INET6 865 ip6_t *ip6; 866 #endif 867 ipnat_t *ipn; 868 fr_info_t fi; 869 ftpside_t *f; 870 nat_t *nat2; 871 mb_t *m; 872 873 softc = fin->fin_main_soft; 874 softn = softc->ipf_nat_soft; 875 876 if ((ftp->ftp_pendnat != NULL) || (ftp->ftp_pendstate != NULL)) 877 ipf_p_ftp_setpending(softc, ftp); 878 879 m = fin->fin_m; 880 tcp = (tcphdr_t *)fin->fin_dp; 881 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 882 883 tcp2 = &tcph; 884 inc = 0; 885 886 f = &ftp->ftp_side[1]; 887 olen = s - f->ftps_rptr; 888 nlen = strlen(newmsg); 889 inc = nlen - olen; 890 if ((inc + fin->fin_plen) > 65535) { 891 DT3(ftp_PASV_error_inc, nat_t *, nat, ftpside_t *, f, 892 int, inc); 893 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 894 printf("ipf_p_ftp_pasv:inc(%d) + ip->ip_len > 65535\n", 895 inc); 896 return 0; 897 } 898 899 ipn = ipf_proxy_rule_fwd(nat); 900 if (ipn == NULL) 901 return APR_ERR(1); 902 ipn->in_use = 0; 903 904 /* 905 * Add skeleton NAT entry for connection which will come back the 906 * other way. 907 */ 908 bzero((char *)tcp2, sizeof(*tcp2)); 909 bcopy((char *)fin, (char *)&fi, sizeof(fi)); 910 fi.fin_flx |= FI_IGNORE; 911 fi.fin_data[0] = 0; 912 fi.fin_data[1] = port; 913 nflags = IPN_TCP|SI_W_SPORT; 914 915 fi.fin_fr = &ftppxyfr; 916 fi.fin_dp = (char *)tcp2; 917 fi.fin_out = 1 - fin->fin_out; 918 fi.fin_dlen = sizeof(*tcp2); 919 fi.fin_src6 = nat->nat_osrc6; 920 fi.fin_dst6 = nat->nat_odst6; 921 fi.fin_plen = fi.fin_hlen + sizeof(*tcp); 922 fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE; 923 924 TCP_OFF_A(tcp2, 5); 925 tcp2->th_flags = TH_SYN; 926 tcp2->th_win = htons(8192); 927 tcp2->th_dport = htons(port); 928 929 MUTEX_ENTER(&softn->ipf_nat_new); 930 if (nat->nat_v[0] == 6) { 931 #ifdef USE_INET6 932 nat2 = ipf_nat6_add(&fi, ipn, &ftp->ftp_pendnat, 933 nflags, nat->nat_dir); 934 #endif 935 } else { 936 nat2 = ipf_nat_add(&fi, ipn, &ftp->ftp_pendnat, 937 nflags, nat->nat_dir); 938 } 939 MUTEX_EXIT(&softn->ipf_nat_new); 940 941 if (nat2 == NULL) { 942 KFREES(ipn, ipn->in_size); 943 return APR_ERR(1); 944 } 945 946 (void) ipf_nat_proto(&fi, nat2, IPN_TCP); 947 MUTEX_ENTER(&nat2->nat_lock); 948 ipf_nat_update(&fi, nat2); 949 MUTEX_EXIT(&nat2->nat_lock); 950 fi.fin_ifp = NULL; 951 if (nat->nat_dir == NAT_INBOUND) { 952 if (nat->nat_v[0] == 6) { 953 #ifdef USE_INET6 954 fi.fin_dst6 = nat->nat_ndst6; 955 #endif 956 } else { 957 fi.fin_daddr = nat->nat_ndstaddr; 958 } 959 } 960 if (ipf_state_add(softc, &fi, (ipstate_t **)&ftp->ftp_pendstate, 961 SI_W_SPORT) != 0) 962 ipf_nat_setpending(softc, nat2); 963 964 #if !defined(_KERNEL) 965 M_ADJ(m, inc); 966 #else 967 /* 968 * m_adj takes care of pkthdr.len, if required and treats inc<0 to 969 * mean remove -len bytes from the end of the packet. 970 * The mbuf chain will be extended if necessary by m_copyback(). 971 */ 972 if (inc < 0) 973 M_ADJ(m, inc); 974 #endif /* !defined(_KERNEL) */ 975 COPYBACK(m, off, nlen, newmsg); 976 fin->fin_flx |= FI_DOCKSUM; 977 978 if (inc != 0) { 979 fin->fin_plen += inc; 980 fin->fin_dlen += inc; 981 if (nat->nat_v[0] == 6) { 982 #ifdef USE_INET6 983 ip6 = (ip6_t *)fin->fin_ip; 984 u_short len = ntohs(ip6->ip6_plen) + inc; 985 ip6->ip6_plen = htons(len); 986 #endif 987 } else { 988 ip->ip_len = htons(fin->fin_plen); 989 } 990 } 991 992 return APR_INC(inc); 993 } 994 995 996 int 997 ipf_p_ftp_server(softf, fin, ip, nat, ftp, dlen) 998 ipf_ftp_softc_t *softf; 999 fr_info_t *fin; 1000 ip_t *ip; 1001 nat_t *nat; 1002 ftpinfo_t *ftp; 1003 int dlen; 1004 { 1005 char *rptr, *wptr; 1006 ftpside_t *f; 1007 int inc; 1008 1009 inc = 0; 1010 f = &ftp->ftp_side[1]; 1011 rptr = f->ftps_rptr; 1012 wptr = f->ftps_wptr; 1013 1014 DT2(ftp_server_response, char *, rptr, int, ftp->ftp_passok); 1015 if (*rptr == ' ') 1016 goto server_cmd_ok; 1017 if (!ISDIGIT(*rptr) || !ISDIGIT(*(rptr + 1)) || !ISDIGIT(*(rptr + 2))) 1018 return 0; 1019 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 1020 printf("ipf_p_ftp_server_1: cmd[%4.4s] passok %d\n", 1021 rptr, ftp->ftp_passok); 1022 if (ftp->ftp_passok == FTPXY_GO) { 1023 if (!strncmp(rptr, "227 ", 4)) 1024 inc = ipf_p_ftp_pasv(softf, fin, ip, nat, ftp, dlen); 1025 else if (!strncmp(rptr, "229 ", 4)) 1026 inc = ipf_p_ftp_epsv(softf, fin, ip, nat, ftp, dlen); 1027 else if (strncmp(rptr, "200", 3)) { 1028 /* 1029 * 200 is returned for a successful command. 1030 */ 1031 ; 1032 } 1033 } else if (softf->ipf_p_ftp_insecure && !strncmp(rptr, "227 ", 4)) { 1034 inc = ipf_p_ftp_pasv(softf, fin, ip, nat, ftp, dlen); 1035 } else if (softf->ipf_p_ftp_insecure && !strncmp(rptr, "229 ", 4)) { 1036 inc = ipf_p_ftp_epsv(softf, fin, ip, nat, ftp, dlen); 1037 } else if (*rptr == '5' || *rptr == '4') 1038 ftp->ftp_passok = FTPXY_INIT; 1039 else if (ftp->ftp_incok) { 1040 if (*rptr == '3') { 1041 if (ftp->ftp_passok == FTPXY_ACCT_1) 1042 ftp->ftp_passok = FTPXY_GO; 1043 else 1044 ftp->ftp_passok++; 1045 } else if (*rptr == '2') { 1046 switch (ftp->ftp_passok) 1047 { 1048 case FTPXY_USER_1 : 1049 case FTPXY_USER_2 : 1050 case FTPXY_PASS_1 : 1051 case FTPXY_PASS_2 : 1052 case FTPXY_ACCT_1 : 1053 ftp->ftp_passok = FTPXY_GO; 1054 break; 1055 default : 1056 ftp->ftp_passok += 3; 1057 break; 1058 } 1059 } 1060 } 1061 ftp->ftp_incok = 0; 1062 server_cmd_ok: 1063 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 1064 printf("ipf_p_ftp_server_2: cmd[%4.4s] passok %d\n", 1065 rptr, ftp->ftp_passok); 1066 DT3(ftp_server_passok, char *,rptr, int, ftp->ftp_incok, 1067 int, ftp->ftp_passok); 1068 1069 while ((*rptr++ != '\n') && (rptr < wptr)) 1070 ; 1071 f->ftps_rptr = rptr; 1072 return inc; 1073 } 1074 1075 1076 /* 1077 * 0 FTPXY_JUNK_OK 1078 * 1 FTPXY_JUNK_BAD 1079 * 2 FTPXY_JUNK_EOL 1080 * 3 FTPXY_JUNK_CONT 1081 * 1082 * Look to see if the buffer starts with something which we recognise as 1083 * being the correct syntax for the FTP protocol. 1084 */ 1085 int 1086 ipf_p_ftp_client_valid(softf, ftps, buf, len) 1087 ipf_ftp_softc_t *softf; 1088 ftpside_t *ftps; 1089 char *buf; 1090 size_t len; 1091 { 1092 register char *s, c, pc; 1093 register size_t i = len; 1094 char cmd[5]; 1095 1096 s = buf; 1097 1098 if (ftps->ftps_junk == FTPXY_JUNK_BAD) 1099 return FTPXY_JUNK_BAD; 1100 1101 if (i < 5) { 1102 DT1(client_valid, int, i); 1103 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 1104 printf("ipf_p_ftp_client_valid:i(%d) < 5\n", (int)i); 1105 return 2; 1106 } 1107 1108 i--; 1109 c = *s++; 1110 1111 if (ISALPHA(c)) { 1112 cmd[0] = TOUPPER(c); 1113 c = *s++; 1114 i--; 1115 if (ISALPHA(c)) { 1116 cmd[1] = TOUPPER(c); 1117 c = *s++; 1118 i--; 1119 if (ISALPHA(c)) { 1120 cmd[2] = TOUPPER(c); 1121 c = *s++; 1122 i--; 1123 if (ISALPHA(c)) { 1124 cmd[3] = TOUPPER(c); 1125 c = *s++; 1126 i--; 1127 if ((c != ' ') && (c != '\r')) 1128 goto bad_client_command; 1129 } else if ((c != ' ') && (c != '\r')) 1130 goto bad_client_command; 1131 } else 1132 goto bad_client_command; 1133 } else 1134 goto bad_client_command; 1135 } else { 1136 bad_client_command: 1137 DT4(client_junk, int, len, int, i, int, c, char *, buf); 1138 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1139 printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*.*s]\n", 1140 "ipf_p_ftp_client_valid", 1141 ftps->ftps_junk, (int)len, (int)i, c, 1142 (int)len, (int)len, buf); 1143 return FTPXY_JUNK_BAD; 1144 } 1145 1146 for (; i; i--) { 1147 pc = c; 1148 c = *s++; 1149 if ((pc == '\r') && (c == '\n')) { 1150 cmd[4] = '\0'; 1151 if (!strcmp(cmd, "PASV")) { 1152 ftps->ftps_cmd = FTPXY_C_PASV; 1153 } else if (!strcmp(cmd, "EPSV")) { 1154 ftps->ftps_cmd = FTPXY_C_EPSV; 1155 } else { 1156 ftps->ftps_cmd = 0; 1157 } 1158 return 0; 1159 } 1160 } 1161 #if !defined(_KERNEL) 1162 printf("ipf_p_ftp_client_valid:junk after cmd[%*.*s]\n", 1163 (int)len, (int)len, buf); 1164 #endif 1165 return FTPXY_JUNK_EOL; 1166 } 1167 1168 1169 int 1170 ipf_p_ftp_server_valid(softf, ftps, buf, len) 1171 ipf_ftp_softc_t *softf; 1172 ftpside_t *ftps; 1173 char *buf; 1174 size_t len; 1175 { 1176 register char *s, c, pc; 1177 register size_t i = len; 1178 int cmd; 1179 1180 s = buf; 1181 cmd = 0; 1182 1183 if (ftps->ftps_junk == FTPXY_JUNK_BAD) 1184 return FTPXY_JUNK_BAD; 1185 1186 if (i < 5) { 1187 DT1(server_valid, int, i); 1188 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1189 printf("ipf_p_ftp_servert_valid:i(%d) < 5\n", (int)i); 1190 return 2; 1191 } 1192 1193 c = *s++; 1194 i--; 1195 if (c == ' ') { 1196 cmd = -1; 1197 goto search_eol; 1198 } 1199 1200 if (ISDIGIT(c)) { 1201 cmd = (c - '0') * 100; 1202 c = *s++; 1203 i--; 1204 if (ISDIGIT(c)) { 1205 cmd += (c - '0') * 10; 1206 c = *s++; 1207 i--; 1208 if (ISDIGIT(c)) { 1209 cmd += (c - '0'); 1210 c = *s++; 1211 i--; 1212 if ((c != '-') && (c != ' ')) 1213 goto bad_server_command; 1214 if (c == '-') 1215 return FTPXY_JUNK_CONT; 1216 } else 1217 goto bad_server_command; 1218 } else 1219 goto bad_server_command; 1220 } else { 1221 bad_server_command: 1222 DT4(server_junk, int len, buf, int, i, int, c, char *, buf); 1223 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO) 1224 printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*.*s]\n", 1225 "ipf_p_ftp_server_valid", 1226 ftps->ftps_junk, (int)len, (int)i, 1227 c, (int)len, (int)len, buf); 1228 if (ftps->ftps_junk == FTPXY_JUNK_CONT) 1229 return FTPXY_JUNK_CONT; 1230 return FTPXY_JUNK_BAD; 1231 } 1232 search_eol: 1233 for (; i; i--) { 1234 pc = c; 1235 c = *s++; 1236 if ((pc == '\r') && (c == '\n')) { 1237 if (cmd == -1) { 1238 if (ftps->ftps_junk == FTPXY_JUNK_CONT) 1239 return FTPXY_JUNK_CONT; 1240 } else { 1241 ftps->ftps_cmd = cmd; 1242 } 1243 return FTPXY_JUNK_OK; 1244 } 1245 } 1246 1247 DT2(junk_eol, int, len, char *, buf); 1248 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO) 1249 printf("ipf_p_ftp_server_valid:junk after cmd[%*.*s]\n", 1250 (int)len, (int)len, buf); 1251 return FTPXY_JUNK_EOL; 1252 } 1253 1254 1255 int 1256 ipf_p_ftp_valid(softf, ftp, side, buf, len) 1257 ipf_ftp_softc_t *softf; 1258 ftpinfo_t *ftp; 1259 int side; 1260 char *buf; 1261 size_t len; 1262 { 1263 ftpside_t *ftps; 1264 int ret; 1265 1266 ftps = &ftp->ftp_side[side]; 1267 1268 if (side == 0) 1269 ret = ipf_p_ftp_client_valid(softf, ftps, buf, len); 1270 else 1271 ret = ipf_p_ftp_server_valid(softf, ftps, buf, len); 1272 return ret; 1273 } 1274 1275 1276 /* 1277 * For map rules, the following applies: 1278 * rv == 0 for outbound processing, 1279 * rv == 1 for inbound processing. 1280 * For rdr rules, the following applies: 1281 * rv == 0 for inbound processing, 1282 * rv == 1 for outbound processing. 1283 */ 1284 int 1285 ipf_p_ftp_process(softf, fin, nat, ftp, rv) 1286 ipf_ftp_softc_t *softf; 1287 fr_info_t *fin; 1288 nat_t *nat; 1289 ftpinfo_t *ftp; 1290 int rv; 1291 { 1292 int mlen, len, off, inc, i, sel, sel2, ok, ackoff, seqoff, retry; 1293 char *rptr, *wptr, *s; 1294 u_32_t thseq, thack; 1295 ap_session_t *aps; 1296 ftpside_t *f, *t; 1297 tcphdr_t *tcp; 1298 ip_t *ip; 1299 mb_t *m; 1300 1301 m = fin->fin_m; 1302 ip = fin->fin_ip; 1303 tcp = (tcphdr_t *)fin->fin_dp; 1304 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 1305 1306 f = &ftp->ftp_side[rv]; 1307 t = &ftp->ftp_side[1 - rv]; 1308 thseq = ntohl(tcp->th_seq); 1309 thack = ntohl(tcp->th_ack); 1310 #ifdef __sgi 1311 mlen = fin->fin_plen - off; 1312 #else 1313 mlen = MSGDSIZE(m) - off; 1314 #endif 1315 1316 DT3(process_debug, tcphdr_t *, tcp, int, off, int, mlen); 1317 if (softf->ipf_p_ftp_debug & DEBUG_INFO) 1318 printf("ipf_p_ftp_process: %d:%d,%d, mlen %d flags %x\n", 1319 fin->fin_out, fin->fin_sport, fin->fin_dport, 1320 mlen, tcp->th_flags); 1321 1322 if ((mlen == 0) && ((tcp->th_flags & TH_OPENING) == TH_OPENING)) { 1323 f->ftps_seq[0] = thseq + 1; 1324 t->ftps_seq[0] = thack; 1325 return 0; 1326 } else if (mlen < 0) { 1327 return 0; 1328 } 1329 1330 aps = nat->nat_aps; 1331 1332 sel = aps->aps_sel[1 - rv]; 1333 sel2 = aps->aps_sel[rv]; 1334 if (rv == 1) { 1335 seqoff = aps->aps_seqoff[sel]; 1336 if (aps->aps_seqmin[sel] > seqoff + thseq) 1337 seqoff = aps->aps_seqoff[!sel]; 1338 ackoff = aps->aps_ackoff[sel2]; 1339 if (aps->aps_ackmin[sel2] > ackoff + thack) 1340 ackoff = aps->aps_ackoff[!sel2]; 1341 } else { 1342 seqoff = aps->aps_ackoff[sel]; 1343 if (softf->ipf_p_ftp_debug & DEBUG_INFO) 1344 printf("seqoff %d thseq %x ackmin %x\n", seqoff, thseq, 1345 aps->aps_ackmin[sel]); 1346 if (aps->aps_ackmin[sel] > seqoff + thseq) 1347 seqoff = aps->aps_ackoff[!sel]; 1348 1349 ackoff = aps->aps_seqoff[sel2]; 1350 if (softf->ipf_p_ftp_debug & DEBUG_INFO) 1351 printf("ackoff %d thack %x seqmin %x\n", ackoff, thack, 1352 aps->aps_seqmin[sel2]); 1353 if (ackoff > 0) { 1354 if (aps->aps_seqmin[sel2] > ackoff + thack) 1355 ackoff = aps->aps_seqoff[!sel2]; 1356 } else { 1357 if (aps->aps_seqmin[sel2] > thack) 1358 ackoff = aps->aps_seqoff[!sel2]; 1359 } 1360 } 1361 if (softf->ipf_p_ftp_debug & DEBUG_INFO) { 1362 printf("%s: %x seq %x/%d ack %x/%d len %d/%d off %d\n", 1363 rv ? "IN" : "OUT", tcp->th_flags, thseq, seqoff, 1364 thack, ackoff, mlen, fin->fin_plen, off); 1365 printf("sel %d seqmin %x/%x offset %d/%d\n", sel, 1366 aps->aps_seqmin[sel], aps->aps_seqmin[sel2], 1367 aps->aps_seqoff[sel], aps->aps_seqoff[sel2]); 1368 printf("sel %d ackmin %x/%x offset %d/%d\n", sel2, 1369 aps->aps_ackmin[sel], aps->aps_ackmin[sel2], 1370 aps->aps_ackoff[sel], aps->aps_ackoff[sel2]); 1371 } 1372 1373 /* 1374 * XXX - Ideally, this packet should get dropped because we now know 1375 * that it is out of order (and there is no real danger in doing so 1376 * apart from causing packets to go through here ordered). 1377 */ 1378 if (softf->ipf_p_ftp_debug & DEBUG_INFO) { 1379 printf("rv %d t:seq[0] %x seq[1] %x %d/%d\n", 1380 rv, t->ftps_seq[0], t->ftps_seq[1], seqoff, ackoff); 1381 } 1382 1383 ok = 0; 1384 if (t->ftps_seq[0] == 0) { 1385 t->ftps_seq[0] = thack; 1386 ok = 1; 1387 } else { 1388 if (ackoff == 0) { 1389 if (t->ftps_seq[0] == thack) 1390 ok = 1; 1391 else if (t->ftps_seq[1] == thack) { 1392 t->ftps_seq[0] = thack; 1393 ok = 1; 1394 } 1395 } else { 1396 if (t->ftps_seq[0] + ackoff == thack) { 1397 t->ftps_seq[0] = thack; 1398 ok = 1; 1399 } else if (t->ftps_seq[0] == thack + ackoff) { 1400 t->ftps_seq[0] = thack + ackoff; 1401 ok = 1; 1402 } else if (t->ftps_seq[1] + ackoff == thack) { 1403 t->ftps_seq[0] = thack; 1404 ok = 1; 1405 } else if (t->ftps_seq[1] == thack + ackoff) { 1406 t->ftps_seq[0] = thack + ackoff; 1407 ok = 1; 1408 } 1409 } 1410 } 1411 1412 if (softf->ipf_p_ftp_debug & DEBUG_INFO) { 1413 if (!ok) 1414 printf("%s ok\n", "not"); 1415 } 1416 1417 if (!mlen) { 1418 if (t->ftps_seq[0] + ackoff != thack && 1419 t->ftps_seq[1] + ackoff != thack) { 1420 DT3(thack, ftpside_t *t, t, int, ackoff, u_32_t, thack); 1421 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) { 1422 printf("%s:seq[0](%u) + (%d) != (%u)\n", 1423 "ipf_p_ftp_process", t->ftps_seq[0], 1424 ackoff, thack); 1425 printf("%s:seq[0](%u) + (%d) != (%u)\n", 1426 "ipf_p_ftp_process", t->ftps_seq[1], 1427 ackoff, thack); 1428 } 1429 return APR_ERR(1); 1430 } 1431 1432 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) { 1433 printf("ipf_p_ftp_process:f:seq[0] %x seq[1] %x\n", 1434 f->ftps_seq[0], f->ftps_seq[1]); 1435 } 1436 1437 if (tcp->th_flags & TH_FIN) { 1438 if (thseq == f->ftps_seq[1]) { 1439 f->ftps_seq[0] = f->ftps_seq[1] - seqoff; 1440 f->ftps_seq[1] = thseq + 1 - seqoff; 1441 } else { 1442 DT2(thseq, ftpside_t *t, t, u_32_t, thseq); 1443 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) { 1444 printf("FIN: thseq %x seqoff %d ftps_seq %x\n", 1445 thseq, seqoff, f->ftps_seq[0]); 1446 } 1447 return APR_ERR(1); 1448 } 1449 } 1450 f->ftps_len = 0; 1451 return 0; 1452 } 1453 1454 ok = 0; 1455 if ((thseq == f->ftps_seq[0]) || (thseq == f->ftps_seq[1])) { 1456 ok = 1; 1457 /* 1458 * Retransmitted data packet. 1459 */ 1460 } else if ((thseq + mlen == f->ftps_seq[0]) || 1461 (thseq + mlen == f->ftps_seq[1])) { 1462 ok = 1; 1463 } 1464 1465 if (ok == 0) { 1466 DT3(ok_0, ftpside_t *, f, u_32_t, thseq, int, mlen); 1467 inc = thseq - f->ftps_seq[0]; 1468 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) { 1469 printf("inc %d sel %d rv %d\n", inc, sel, rv); 1470 printf("th_seq %x ftps_seq %x/%x\n", 1471 thseq, f->ftps_seq[0], f->ftps_seq[1]); 1472 printf("ackmin %x ackoff %d\n", aps->aps_ackmin[sel], 1473 aps->aps_ackoff[sel]); 1474 printf("seqmin %x seqoff %d\n", aps->aps_seqmin[sel], 1475 aps->aps_seqoff[sel]); 1476 } 1477 1478 return APR_ERR(1); 1479 } 1480 1481 inc = 0; 1482 rptr = f->ftps_rptr; 1483 wptr = f->ftps_wptr; 1484 f->ftps_seq[0] = thseq; 1485 f->ftps_seq[1] = f->ftps_seq[0] + mlen; 1486 f->ftps_len = mlen; 1487 1488 while (mlen > 0) { 1489 len = MIN(mlen, sizeof(f->ftps_buf) - (wptr - rptr)); 1490 if (len == 0) 1491 break; 1492 COPYDATA(m, off, len, wptr); 1493 mlen -= len; 1494 off += len; 1495 wptr += len; 1496 1497 whilemore: 1498 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 1499 printf("%s:len %d/%d off %d wptr %lx junk %d [%*.*s]\n", 1500 "ipf_p_ftp_process", 1501 len, mlen, off, (u_long)wptr, f->ftps_junk, 1502 len, len, rptr); 1503 1504 f->ftps_wptr = wptr; 1505 if (f->ftps_junk != FTPXY_JUNK_OK) { 1506 i = f->ftps_junk; 1507 f->ftps_junk = ipf_p_ftp_valid(softf, ftp, rv, rptr, 1508 wptr - rptr); 1509 DT2(junk_transit, int, i, int, f->ftps_junk); 1510 1511 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 1512 printf("%s:junk %d -> %d\n", 1513 "ipf_p_ftp_process", i, f->ftps_junk); 1514 1515 if (f->ftps_junk == FTPXY_JUNK_BAD) { 1516 DT(buffer_full); 1517 if (wptr - rptr == sizeof(f->ftps_buf)) { 1518 if (softf->ipf_p_ftp_debug & 1519 DEBUG_PARSE_INFO) 1520 printf("%s:full buffer\n", 1521 "ipf_p_ftp_process"); 1522 f->ftps_rptr = f->ftps_buf; 1523 f->ftps_wptr = f->ftps_buf; 1524 rptr = f->ftps_rptr; 1525 wptr = f->ftps_wptr; 1526 continue; 1527 } 1528 } 1529 } 1530 1531 while ((f->ftps_junk == FTPXY_JUNK_OK) && (wptr > rptr)) { 1532 len = wptr - rptr; 1533 f->ftps_junk = ipf_p_ftp_valid(softf, ftp, rv, 1534 rptr, len); 1535 1536 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) { 1537 printf("%s=%d len %d rv %d ptr %lx/%lx ", 1538 "ipf_p_ftp_valid", 1539 f->ftps_junk, len, rv, (u_long)rptr, 1540 (u_long)wptr); 1541 printf("buf [%*.*s]\n", len, len, rptr); 1542 } 1543 1544 if (f->ftps_junk == FTPXY_JUNK_OK) { 1545 f->ftps_cmds++; 1546 f->ftps_rptr = rptr; 1547 if (rv) 1548 inc += ipf_p_ftp_server(softf, fin, ip, 1549 nat, ftp, len); 1550 else 1551 inc += ipf_p_ftp_client(softf, fin, ip, 1552 nat, ftp, len); 1553 rptr = f->ftps_rptr; 1554 wptr = f->ftps_wptr; 1555 } 1556 } 1557 1558 /* 1559 * Off to a bad start so lets just forget about using the 1560 * ftp proxy for this connection. 1561 */ 1562 if ((f->ftps_cmds == 0) && (f->ftps_junk == FTPXY_JUNK_BAD)) { 1563 /* f->ftps_seq[1] += inc; */ 1564 1565 DT(ftp_junk_cmd); 1566 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 1567 printf("%s:cmds == 0 junk == 1\n", 1568 "ipf_p_ftp_process"); 1569 return APR_ERR(2); 1570 } 1571 1572 retry = 0; 1573 if ((f->ftps_junk != FTPXY_JUNK_OK) && (rptr < wptr)) { 1574 for (s = rptr; s < wptr; s++) { 1575 if ((*s == '\r') && (s + 1 < wptr) && 1576 (*(s + 1) == '\n')) { 1577 rptr = s + 2; 1578 retry = 1; 1579 if (f->ftps_junk != FTPXY_JUNK_CONT) 1580 f->ftps_junk = FTPXY_JUNK_OK; 1581 break; 1582 } 1583 } 1584 } 1585 1586 if (rptr == wptr) { 1587 rptr = wptr = f->ftps_buf; 1588 } else { 1589 /* 1590 * Compact the buffer back to the start. The junk 1591 * flag should already be set and because we're not 1592 * throwing away any data, it is preserved from its 1593 * current state. 1594 */ 1595 if (rptr > f->ftps_buf) { 1596 bcopy(rptr, f->ftps_buf, wptr - rptr); 1597 wptr -= rptr - f->ftps_buf; 1598 rptr = f->ftps_buf; 1599 } 1600 } 1601 f->ftps_rptr = rptr; 1602 f->ftps_wptr = wptr; 1603 if (retry) 1604 goto whilemore; 1605 } 1606 1607 /* f->ftps_seq[1] += inc; */ 1608 if (tcp->th_flags & TH_FIN) 1609 f->ftps_seq[1]++; 1610 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO) { 1611 #ifdef __sgi 1612 mlen = fin->fin_plen; 1613 #else 1614 mlen = MSGDSIZE(m); 1615 #endif 1616 mlen -= off; 1617 printf("ftps_seq[1] = %x inc %d len %d\n", 1618 f->ftps_seq[1], inc, mlen); 1619 } 1620 1621 f->ftps_rptr = rptr; 1622 f->ftps_wptr = wptr; 1623 return APR_INC(inc); 1624 } 1625 1626 1627 int 1628 ipf_p_ftp_out(arg, fin, aps, nat) 1629 void *arg; 1630 fr_info_t *fin; 1631 ap_session_t *aps; 1632 nat_t *nat; 1633 { 1634 ipf_ftp_softc_t *softf = arg; 1635 ftpinfo_t *ftp; 1636 int rev; 1637 1638 ftp = aps->aps_data; 1639 if (ftp == NULL) 1640 return 0; 1641 1642 rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1; 1643 if (ftp->ftp_side[1 - rev].ftps_ifp == NULL) 1644 ftp->ftp_side[1 - rev].ftps_ifp = fin->fin_ifp; 1645 1646 return ipf_p_ftp_process(softf, fin, nat, ftp, rev); 1647 } 1648 1649 1650 int 1651 ipf_p_ftp_in(arg, fin, aps, nat) 1652 void *arg; 1653 fr_info_t *fin; 1654 ap_session_t *aps; 1655 nat_t *nat; 1656 { 1657 ipf_ftp_softc_t *softf = arg; 1658 ftpinfo_t *ftp; 1659 int rev; 1660 1661 ftp = aps->aps_data; 1662 if (ftp == NULL) 1663 return 0; 1664 1665 rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1; 1666 if (ftp->ftp_side[rev].ftps_ifp == NULL) 1667 ftp->ftp_side[rev].ftps_ifp = fin->fin_ifp; 1668 1669 return ipf_p_ftp_process(softf, fin, nat, ftp, 1 - rev); 1670 } 1671 1672 1673 /* 1674 * ipf_p_ftp_atoi - implement a version of atoi which processes numbers in 1675 * pairs separated by commas (which are expected to be in the range 0 - 255), 1676 * returning a 16 bit number combining either side of the , as the MSB and 1677 * LSB. 1678 */ 1679 u_short 1680 ipf_p_ftp_atoi(ptr) 1681 char **ptr; 1682 { 1683 register char *s = *ptr, c; 1684 register u_char i = 0, j = 0; 1685 1686 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1687 i *= 10; 1688 i += c - '0'; 1689 } 1690 if (c != ',') { 1691 *ptr = NULL; 1692 return 0; 1693 } 1694 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1695 j *= 10; 1696 j += c - '0'; 1697 } 1698 *ptr = s; 1699 i &= 0xff; 1700 j &= 0xff; 1701 return (i << 8) | j; 1702 } 1703 1704 1705 int 1706 ipf_p_ftp_eprt(softf, fin, ip, nat, ftp, dlen) 1707 ipf_ftp_softc_t *softf; 1708 fr_info_t *fin; 1709 ip_t *ip; 1710 nat_t *nat; 1711 ftpinfo_t *ftp; 1712 int dlen; 1713 { 1714 ftpside_t *f; 1715 1716 /* 1717 * Check for client sending out EPRT message. 1718 */ 1719 if (dlen < IPF_MINEPRTLEN) { 1720 DT1(epert_dlen, int, dlen); 1721 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1722 printf("ipf_p_ftp_eprt:dlen(%d) < IPF_MINEPRTLEN\n", 1723 dlen); 1724 return 0; 1725 } 1726 1727 /* 1728 * Parse the EPRT command. Format is: 1729 * "EPRT |1|1.2.3.4|2000|" for IPv4 and 1730 * "EPRT |2|ef00::1:2|2000|" for IPv6 1731 */ 1732 f = &ftp->ftp_side[0]; 1733 if (f->ftps_rptr[5] != '|') 1734 return 0; 1735 if (f->ftps_rptr[5] == f->ftps_rptr[7]) { 1736 if (f->ftps_rptr[6] == '1' && nat->nat_v[0] == 4) 1737 return ipf_p_ftp_eprt4(softf, fin, ip, nat, ftp, dlen); 1738 if (f->ftps_rptr[6] == '2' && nat->nat_v[0] == 6) 1739 return ipf_p_ftp_eprt6(softf, fin, ip, nat, ftp, dlen); 1740 } 1741 return 0; 1742 } 1743 1744 1745 int 1746 ipf_p_ftp_eprt4(softf, fin, ip, nat, ftp, dlen) 1747 ipf_ftp_softc_t *softf; 1748 fr_info_t *fin; 1749 ip_t *ip; 1750 nat_t *nat; 1751 ftpinfo_t *ftp; 1752 int dlen; 1753 { 1754 int a1, a2, a3, a4, port, olen, nlen, inc, off; 1755 char newbuf[IPF_FTPBUFSZ]; 1756 char *s, c, delim; 1757 u_32_t addr, i; 1758 tcphdr_t *tcp; 1759 ftpside_t *f; 1760 mb_t *m; 1761 1762 m = fin->fin_m; 1763 tcp = (tcphdr_t *)fin->fin_dp; 1764 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 1765 f = &ftp->ftp_side[0]; 1766 delim = f->ftps_rptr[5]; 1767 s = f->ftps_rptr + 8; 1768 1769 /* 1770 * get the IP address. 1771 */ 1772 i = 0; 1773 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1774 i *= 10; 1775 i += c - '0'; 1776 } 1777 if (i > 255) 1778 return 0; 1779 if (c != '.') 1780 return 0; 1781 addr = (i << 24); 1782 1783 i = 0; 1784 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1785 i *= 10; 1786 i += c - '0'; 1787 } 1788 if (i > 255) 1789 return 0; 1790 if (c != '.') 1791 return 0; 1792 addr |= (addr << 16); 1793 1794 i = 0; 1795 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1796 i *= 10; 1797 i += c - '0'; 1798 } 1799 if (i > 255) 1800 return 0; 1801 if (c != '.') 1802 return 0; 1803 addr |= (addr << 8); 1804 1805 i = 0; 1806 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1807 i *= 10; 1808 i += c - '0'; 1809 } 1810 if (i > 255) 1811 return 0; 1812 if (c != delim) 1813 return 0; 1814 addr |= addr; 1815 1816 /* 1817 * Get the port number 1818 */ 1819 i = 0; 1820 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1821 i *= 10; 1822 i += c - '0'; 1823 } 1824 if (i > 65535) 1825 return 0; 1826 if (c != delim) 1827 return 0; 1828 port = i; 1829 1830 /* 1831 * Check for CR-LF at the end of the command string. 1832 */ 1833 if ((*s != '\r') || (*(s + 1) != '\n')) { 1834 DT(eprt4_no_crlf); 1835 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1836 printf("ipf_p_ftp_eprt4:missing %s\n", "cr-lf"); 1837 return 0; 1838 } 1839 s += 2; 1840 1841 /* 1842 * Calculate new address parts for PORT command 1843 */ 1844 if (nat->nat_dir == NAT_INBOUND) 1845 a1 = ntohl(nat->nat_odstaddr); 1846 else 1847 a1 = ntohl(ip->ip_src.s_addr); 1848 a2 = (a1 >> 16) & 0xff; 1849 a3 = (a1 >> 8) & 0xff; 1850 a4 = a1 & 0xff; 1851 a1 >>= 24; 1852 olen = s - f->ftps_rptr; 1853 /* DO NOT change this to snprintf! */ 1854 /* 1855 * While we could force the use of | as a delimiter here, it makes 1856 * sense to preserve whatever character is being used by the systems 1857 * involved in the communication. 1858 */ 1859 #if defined(SNPRINTF) && defined(_KERNEL) 1860 SNPRINTF(newbuf, sizeof(newbuf), "%s %c1%c%u.%u.%u.%u%c%u%c\r\n", 1861 "EPRT", delim, delim, a1, a2, a3, a4, delim, port, delim); 1862 #else 1863 (void) sprintf(newbuf, "%s %c1%c%u.%u.%u.%u%c%u%c\r\n", 1864 "EPRT", delim, delim, a1, a2, a3, a4, delim, port, 1865 delim); 1866 #endif 1867 1868 nlen = strlen(newbuf); 1869 inc = nlen - olen; 1870 if ((inc + fin->fin_plen) > 65535) { 1871 DT2(eprt4_len, int, inc, int, fin->fin_plen); 1872 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 1873 printf("ipf_p_ftp_eprt4:inc(%d) + ip->ip_len > 65535\n", 1874 inc); 1875 return 0; 1876 } 1877 1878 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 1879 #if !defined(_KERNEL) 1880 M_ADJ(m, inc); 1881 #else 1882 if (inc < 0) 1883 M_ADJ(m, inc); 1884 #endif 1885 /* the mbuf chain will be extended if necessary by m_copyback() */ 1886 COPYBACK(m, off, nlen, newbuf); 1887 fin->fin_flx |= FI_DOCKSUM; 1888 1889 if (inc != 0) { 1890 fin->fin_plen += inc; 1891 ip->ip_len = htons(fin->fin_plen); 1892 fin->fin_dlen += inc; 1893 } 1894 1895 f->ftps_cmd = FTPXY_C_EPRT; 1896 return ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, port, inc); 1897 } 1898 1899 1900 int 1901 ipf_p_ftp_epsv(softf, fin, ip, nat, ftp, dlen) 1902 ipf_ftp_softc_t *softf; 1903 fr_info_t *fin; 1904 ip_t *ip; 1905 nat_t *nat; 1906 ftpinfo_t *ftp; 1907 int dlen; 1908 { 1909 char newbuf[IPF_FTPBUFSZ]; 1910 u_short ap = 0; 1911 ftpside_t *f; 1912 char *s; 1913 1914 if ((softf->ipf_p_ftp_forcepasv != 0) && 1915 (ftp->ftp_side[0].ftps_cmd != FTPXY_C_EPSV)) { 1916 DT1(epsv_cmd, int, ftp->ftp_side[0].ftps_cmd); 1917 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1918 printf("ipf_p_ftp_epsv:ftps_cmd(%d) != FTPXY_C_EPSV\n", 1919 ftp->ftp_side[0].ftps_cmd); 1920 return 0; 1921 } 1922 f = &ftp->ftp_side[1]; 1923 1924 #define EPSV_REPLEN 33 1925 /* 1926 * Check for EPSV reply message. 1927 */ 1928 if (dlen < IPF_MIN229LEN) { 1929 return (0); 1930 } else if (strncmp(f->ftps_rptr, 1931 "229 Entering Extended Passive Mode", EPSV_REPLEN)) { 1932 return (0); 1933 } 1934 1935 /* 1936 * Skip the EPSV command + space 1937 */ 1938 s = f->ftps_rptr + 33; 1939 while (*s && !ISDIGIT(*s)) 1940 s++; 1941 1942 /* 1943 * As per RFC 2428, there are no addres components in the EPSV 1944 * response. So we'll go straight to getting the port. 1945 */ 1946 while (*s && ISDIGIT(*s)) { 1947 ap *= 10; 1948 ap += *s++ - '0'; 1949 } 1950 1951 if (!s) { 1952 return 0; 1953 } 1954 1955 if (*s == '|') 1956 s++; 1957 if (*s == ')') 1958 s++; 1959 if (*s == '\n') 1960 s--; 1961 /* 1962 * check for CR-LF at the end. 1963 */ 1964 if ((*s != '\r') || (*(s + 1) != '\n')) { 1965 return 0; 1966 } 1967 s += 2; 1968 1969 #if defined(SNPRINTF) && defined(_KERNEL) 1970 SNPRINTF(newbuf, sizeof(newbuf), "%s (|||%u|)\r\n", 1971 "229 Entering Extended Passive Mode", ap); 1972 #else 1973 (void) sprintf(newbuf, "%s (|||%u|)\r\n", 1974 "229 Entering Extended Passive Mode", ap); 1975 #endif 1976 1977 return ipf_p_ftp_pasvreply(softf, fin, ip, nat, ftp, (u_int)ap, 1978 newbuf, s); 1979 } 1980 1981 1982 int 1983 ipf_p_ftp_eprt6(softf, fin, ip, nat, ftp, dlen) 1984 ipf_ftp_softc_t *softf; 1985 fr_info_t *fin; 1986 ip_t *ip; 1987 nat_t *nat; 1988 ftpinfo_t *ftp; 1989 int dlen; 1990 { 1991 int port, olen, nlen, inc, off, left, i; 1992 char newbuf[IPF_FTPBUFSZ]; 1993 char *s, c; 1994 i6addr_t addr, *a6; 1995 tcphdr_t *tcp; 1996 ip6_t *ip6; 1997 char delim; 1998 u_short whole; 1999 u_short part; 2000 ftpside_t *f; 2001 u_short *t; 2002 int fwd; 2003 mb_t *m; 2004 u_32_t a; 2005 2006 m = fin->fin_m; 2007 ip6 = (ip6_t *)ip; 2008 f = &ftp->ftp_side[0]; 2009 s = f->ftps_rptr + 8; 2010 f = &ftp->ftp_side[0]; 2011 delim = f->ftps_rptr[5]; 2012 tcp = (tcphdr_t *)fin->fin_dp; 2013 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 2014 2015 addr.i6[0] = 0; 2016 addr.i6[1] = 0; 2017 addr.i6[2] = 0; 2018 addr.i6[3] = 0; 2019 /* 2020 * Parse an IPv6 address. 2021 * Go forward until either :: or | is found. If :: is found, 2022 * reverse direction. Direction change is performed to ease 2023 * parsing an unknown number of 0s in the middle. 2024 */ 2025 whole = 0; 2026 t = (u_short *)&addr; 2027 fwd = 1; 2028 for (part = 0; (c = *s) != '\0'; ) { 2029 if (c == delim) { 2030 *t = htons((u_short)whole); 2031 break; 2032 } 2033 if (c == ':') { 2034 *t = part; 2035 if (fwd) { 2036 *t = htons((u_short)whole); 2037 t++; 2038 } else { 2039 *t = htons((u_short)(whole >> 16)); 2040 t--; 2041 } 2042 whole = 0; 2043 if (fwd == 1 && s[1] == ':') { 2044 while (*s && *s != '|') 2045 s++; 2046 if ((c = *s) != delim) 2047 break; 2048 t = (u_short *)&addr.i6[3]; 2049 t++; 2050 fwd = 0; 2051 } else if (fwd == 0 && s[-1] == ':') { 2052 break; 2053 } 2054 } else { 2055 if (c >= '0' && c <= '9') { 2056 c -= '0'; 2057 } else if (c >= 'a' && c <= 'f') { 2058 c -= 'a' + 10; 2059 } else if (c >= 'A' && c <= 'F') { 2060 c -= 'A' + 10; 2061 } 2062 if (fwd) { 2063 whole <<= 8; 2064 whole |= c; 2065 } else { 2066 whole >>= 8; 2067 whole |= ((u_32_t)c) << 24; 2068 } 2069 } 2070 if (fwd) 2071 s++; 2072 else 2073 s--; 2074 } 2075 if (c != ':' && c != delim) 2076 return 0; 2077 2078 while (*s != '|') 2079 s++; 2080 s++; 2081 2082 /* 2083 * Get the port number 2084 */ 2085 i = 0; 2086 while (((c = *s++) != '\0') && ISDIGIT(c)) { 2087 i *= 10; 2088 i += c - '0'; 2089 } 2090 if (i > 65535) 2091 return 0; 2092 if (c != delim) 2093 return 0; 2094 port = (u_short)(i & 0xffff); 2095 2096 /* 2097 * Check for CR-LF at the end of the command string. 2098 */ 2099 if ((*s != '\r') || (*(s + 1) != '\n')) { 2100 DT(eprt6_no_crlf); 2101 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 2102 printf("ipf_p_ftp_eprt6:missing %s\n", "cr-lf"); 2103 return 0; 2104 } 2105 s += 2; 2106 2107 /* 2108 * Calculate new address parts for PORT command 2109 */ 2110 a6 = (i6addr_t *)&ip6->ip6_src; 2111 olen = s - f->ftps_rptr; 2112 /* DO NOT change this to snprintf! */ 2113 /* 2114 * While we could force the use of | as a delimiter here, it makes 2115 * sense to preserve whatever character is being used by the systems 2116 * involved in the communication. 2117 */ 2118 s = newbuf; 2119 left = sizeof(newbuf); 2120 #if defined(SNPRINTF) && defined(_KERNEL) 2121 SNPRINTF(newbuf, left, "EPRT %c2%c", delim, delim); 2122 left -= strlen(s) + 1; 2123 s += strlen(s); 2124 a = ntohl(a6->i6[0]); 2125 SNPRINTF(s, left, "%x:%x:", a >> 16, a & 0xffff); 2126 left -= strlen(s); 2127 s += strlen(s); 2128 a = ntohl(a6->i6[1]); 2129 SNPRINTF(s, left, "%x:%x:", a >> 16, a & 0xffff); 2130 left -= strlen(s); 2131 s += strlen(s); 2132 a = ntohl(a6->i6[2]); 2133 SNPRINTF(s, left, "%x:%x:", a >> 16, a & 0xffff); 2134 left -= strlen(s); 2135 s += strlen(s); 2136 a = ntohl(a6->i6[3]); 2137 SNPRINTF(s, left, "%x:%x", a >> 16, a & 0xffff); 2138 left -= strlen(s); 2139 s += strlen(s); 2140 sprintf(s, "|%d|\r\n", port); 2141 #else 2142 (void) sprintf(s, "EPRT %c2%c", delim, delim); 2143 s += strlen(s); 2144 a = ntohl(a6->i6[0]); 2145 sprintf(s, "%x:%x:", a >> 16, a & 0xffff); 2146 s += strlen(s); 2147 a = ntohl(a6->i6[1]); 2148 sprintf(s, "%x:%x:", a >> 16, a & 0xffff); 2149 left -= strlen(s); 2150 s += strlen(s); 2151 a = ntohl(a6->i6[2]); 2152 sprintf(s, "%x:%x:", a >> 16, a & 0xffff); 2153 left -= strlen(s); 2154 s += strlen(s); 2155 a = ntohl(a6->i6[3]); 2156 sprintf(s, "%x:%x", a >> 16, a & 0xffff); 2157 left -= strlen(s); 2158 s += strlen(s); 2159 sprintf(s, "|%d|\r\n", port); 2160 #endif 2161 nlen = strlen(newbuf); 2162 inc = nlen - olen; 2163 if ((inc + fin->fin_plen) > 65535) { 2164 DT2(eprt6_len, int, inc, int, fin->fin_plen); 2165 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 2166 printf("ipf_p_ftp_eprt6:inc(%d) + ip->ip_len > 65535\n", 2167 inc); 2168 return 0; 2169 } 2170 2171 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 2172 #if !defined(_KERNEL) 2173 M_ADJ(m, inc); 2174 #else 2175 if (inc < 0) 2176 M_ADJ(m, inc); 2177 #endif 2178 /* the mbuf chain will be extended if necessary by m_copyback() */ 2179 COPYBACK(m, off, nlen, newbuf); 2180 fin->fin_flx |= FI_DOCKSUM; 2181 2182 if (inc != 0) { 2183 fin->fin_plen += inc; 2184 ip6->ip6_plen = htons(fin->fin_plen - fin->fin_hlen); 2185 fin->fin_dlen += inc; 2186 } 2187 2188 f->ftps_cmd = FTPXY_C_EPRT; 2189 return ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, port, inc); 2190 } 2191
Indexes created Tue Oct 21 12:09:54 GMT 2025