ip_ftp_pxy.c revision 1.3
1 /* $NetBSD: ip_ftp_pxy.c,v 1.3 2012/07/22 14:27:51 darrenr Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 * 8 * Simple FTP transparent proxy for in-kernel use. For use with the NAT 9 * code. 10 * 11 * Id: ip_ftp_pxy.c,v 1.1.1.2 2012/07/22 13:45:18 darrenr Exp 12 */ 13 14 #include <sys/cdefs.h> 15 __KERNEL_RCSID(1, "$NetBSD: ip_ftp_pxy.c,v 1.3 2012/07/22 14:27:51 darrenr Exp $"); 16 17 #define IPF_FTP_PROXY 18 19 #define IPF_MINPORTLEN 18 20 #define IPF_MINEPRTLEN 20 21 #define IPF_MAXPORTLEN 30 22 #define IPF_MIN227LEN 39 23 #define IPF_MAX227LEN 51 24 #define IPF_MIN229LEN 47 25 #define IPF_MAX229LEN 51 26 27 #define FTPXY_GO 0 28 #define FTPXY_INIT 1 29 #define FTPXY_USER_1 2 30 #define FTPXY_USOK_1 3 31 #define FTPXY_PASS_1 4 32 #define FTPXY_PAOK_1 5 33 #define FTPXY_AUTH_1 6 34 #define FTPXY_AUOK_1 7 35 #define FTPXY_ADAT_1 8 36 #define FTPXY_ADOK_1 9 37 #define FTPXY_ACCT_1 10 38 #define FTPXY_ACOK_1 11 39 #define FTPXY_USER_2 12 40 #define FTPXY_USOK_2 13 41 #define FTPXY_PASS_2 14 42 #define FTPXY_PAOK_2 15 43 44 #define FTPXY_JUNK_OK 0 45 #define FTPXY_JUNK_BAD 1 /* Ignore all commands for this connection */ 46 #define FTPXY_JUNK_EOL 2 /* consume the rest of this line only */ 47 #define FTPXY_JUNK_CONT 3 /* Saerching for next numeric */ 48 49 /* 50 * Values for FTP commands. Numerics cover 0-999 51 */ 52 #define FTPXY_C_PASV 1000 53 #define FTPXY_C_PORT 1001 54 #define FTPXY_C_EPSV 1002 55 #define FTPXY_C_EPRT 1003 56 57 58 typedef struct ipf_ftp_softc_s { 59 int ipf_p_ftp_pasvonly; 60 /* Do not require logins before transfers */ 61 int ipf_p_ftp_insecure; 62 int ipf_p_ftp_pasvrdr; 63 /* PASV must be last command prior to 227 */ 64 int ipf_p_ftp_forcepasv; 65 int ipf_p_ftp_debug; 66 int ipf_p_ftp_single_xfer; 67 void *ipf_p_ftp_tune; 68 } ipf_ftp_softc_t; 69 70 71 void ipf_p_ftp_main_load(void); 72 void ipf_p_ftp_main_unload(void); 73 void *ipf_p_ftp_soft_create(ipf_main_softc_t *); 74 void ipf_p_ftp_soft_destroy(ipf_main_softc_t *, void *); 75 76 int ipf_p_ftp_client(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 77 ftpinfo_t *, int); 78 int ipf_p_ftp_complete(char *, size_t); 79 int ipf_p_ftp_in(void *, fr_info_t *, ap_session_t *, nat_t *); 80 int ipf_p_ftp_new(void *, fr_info_t *, ap_session_t *, nat_t *); 81 void ipf_p_ftp_del(ipf_main_softc_t *, ap_session_t *); 82 int ipf_p_ftp_out(void *, fr_info_t *, ap_session_t *, nat_t *); 83 int ipf_p_ftp_pasv(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 84 ftpinfo_t *, int); 85 int ipf_p_ftp_epsv(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 86 ftpinfo_t *, int); 87 int ipf_p_ftp_port(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 88 ftpinfo_t *, int); 89 int ipf_p_ftp_process(ipf_ftp_softc_t *, fr_info_t *, nat_t *, 90 ftpinfo_t *, int); 91 int ipf_p_ftp_server(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 92 ftpinfo_t *, int); 93 int ipf_p_ftp_valid(ipf_ftp_softc_t *, ftpinfo_t *, int, char *, size_t); 94 int ipf_p_ftp_server_valid(ipf_ftp_softc_t *, ftpside_t *, char *, 95 size_t); 96 int ipf_p_ftp_client_valid(ipf_ftp_softc_t *, ftpside_t *, char *, 97 size_t); 98 u_short ipf_p_ftp_atoi(char **); 99 int ipf_p_ftp_pasvreply(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 100 ftpinfo_t *, u_int, char *, char *); 101 int ipf_p_ftp_eprt(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 102 ftpinfo_t *, int); 103 int ipf_p_ftp_eprt4(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 104 ftpinfo_t *, int); 105 int ipf_p_ftp_eprt6(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 106 ftpinfo_t *, int); 107 int ipf_p_ftp_addport(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *, 108 ftpinfo_t *, int, int, int); 109 void ipf_p_ftp_setpending(ipf_main_softc_t *, ftpinfo_t *); 110 111 /* 112 * Debug levels 113 */ 114 #define DEBUG_SECURITY 0x01 115 #define DEBUG_ERROR 0x02 116 #define DEBUG_INFO 0x04 117 #define DEBUG_PARSE_ERR 0x08 118 #define DEBUG_PARSE_INFO 0x10 119 #define DEBUG_PARSE 0x20 120 121 static int ipf_p_ftp_proxy_init = 0; 122 static frentry_t ftppxyfr; 123 static ipftuneable_t ipf_ftp_tuneables[] = { 124 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_debug) }, 125 "ftp_debug", 0, 0x7f, 126 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_debug), 127 0, NULL, NULL }, 128 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_pasvonly) }, 129 "ftp_pasvonly", 0, 1, 130 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_pasvonly), 131 0, NULL, NULL }, 132 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_insecure) }, 133 "ftp_insecure", 0, 1, 134 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_insecure), 135 0, NULL, NULL }, 136 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_pasvrdr) }, 137 "ftp_pasvrdr", 0, 1, 138 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_pasvrdr), 139 0, NULL, NULL }, 140 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_forcepasv) }, 141 "ftp_forcepasv", 0, 1, 142 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_forcepasv), 143 0, NULL, NULL }, 144 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_single_xfer) }, 145 "ftp_single_xfer", 0, 1, 146 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_single_xfer), 147 0, NULL, NULL }, 148 { { NULL }, NULL, 0, 0, 0, 0, NULL, NULL } 149 }; 150 151 152 void 153 ipf_p_ftp_main_load(void) 154 { 155 bzero((char *)&ftppxyfr, sizeof(ftppxyfr)); 156 ftppxyfr.fr_ref = 1; 157 ftppxyfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE; 158 159 MUTEX_INIT(&ftppxyfr.fr_lock, "FTP Proxy Mutex"); 160 ipf_p_ftp_proxy_init = 1; 161 } 162 163 164 void 165 ipf_p_ftp_main_unload(void) 166 { 167 168 if (ipf_p_ftp_proxy_init == 1) { 169 MUTEX_DESTROY(&ftppxyfr.fr_lock); 170 ipf_p_ftp_proxy_init = 0; 171 } 172 } 173 174 175 /* 176 * Initialize local structures. 177 */ 178 void * 179 ipf_p_ftp_soft_create(ipf_main_softc_t *softc) 180 { 181 ipf_ftp_softc_t *softf; 182 183 KMALLOC(softf, ipf_ftp_softc_t *); 184 if (softf == NULL) 185 return NULL; 186 187 bzero((char *)softf, sizeof(*softf)); 188 #if defined(_KERNEL) 189 softf->ipf_p_ftp_debug = 0; 190 #else 191 softf->ipf_p_ftp_debug = DEBUG_PARSE_ERR; 192 #endif 193 softf->ipf_p_ftp_forcepasv = 1; 194 195 softf->ipf_p_ftp_tune = ipf_tune_array_copy(softf, 196 sizeof(ipf_ftp_tuneables), 197 ipf_ftp_tuneables); 198 if (softf->ipf_p_ftp_tune == NULL) { 199 ipf_p_ftp_soft_destroy(softc, softf); 200 return NULL; 201 } 202 if (ipf_tune_array_link(softc, softf->ipf_p_ftp_tune) == -1) { 203 ipf_p_ftp_soft_destroy(softc, softf); 204 return NULL; 205 } 206 207 return softf; 208 } 209 210 211 void 212 ipf_p_ftp_soft_destroy(ipf_main_softc_t *softc, void *arg) 213 { 214 ipf_ftp_softc_t *softf = arg; 215 216 if (softf->ipf_p_ftp_tune != NULL) { 217 ipf_tune_array_unlink(softc, softf->ipf_p_ftp_tune); 218 KFREES(softf->ipf_p_ftp_tune, sizeof(ipf_ftp_tuneables)); 219 softf->ipf_p_ftp_tune = NULL; 220 } 221 222 KFREE(softf); 223 } 224 225 226 int 227 ipf_p_ftp_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 228 { 229 ftpinfo_t *ftp; 230 ftpside_t *f; 231 232 KMALLOC(ftp, ftpinfo_t *); 233 if (ftp == NULL) 234 return -1; 235 236 nat = nat; /* LINT */ 237 238 aps->aps_data = ftp; 239 aps->aps_psiz = sizeof(ftpinfo_t); 240 aps->aps_sport = htons(fin->fin_sport); 241 aps->aps_dport = htons(fin->fin_dport); 242 243 bzero((char *)ftp, sizeof(*ftp)); 244 f = &ftp->ftp_side[0]; 245 f->ftps_rptr = f->ftps_buf; 246 f->ftps_wptr = f->ftps_buf; 247 f = &ftp->ftp_side[1]; 248 f->ftps_rptr = f->ftps_buf; 249 f->ftps_wptr = f->ftps_buf; 250 ftp->ftp_passok = FTPXY_INIT; 251 ftp->ftp_incok = 0; 252 return 0; 253 } 254 255 256 void 257 ipf_p_ftp_setpending(ipf_main_softc_t *softc, ftpinfo_t *ftp) 258 { 259 if (ftp->ftp_pendnat != NULL) 260 ipf_nat_setpending(softc, ftp->ftp_pendnat); 261 262 if (ftp->ftp_pendstate != NULL) { 263 READ_ENTER(&softc->ipf_state); 264 ipf_state_setpending(softc, ftp->ftp_pendstate); 265 RWLOCK_EXIT(&softc->ipf_state); 266 } 267 } 268 269 270 void 271 ipf_p_ftp_del(ipf_main_softc_t *softc, ap_session_t *aps) 272 { 273 ftpinfo_t *ftp; 274 275 ftp = aps->aps_data; 276 if (ftp != NULL) 277 ipf_p_ftp_setpending(softc, ftp); 278 } 279 280 281 int 282 ipf_p_ftp_port(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 283 ftpinfo_t *ftp, int dlen) 284 { 285 char newbuf[IPF_FTPBUFSZ], *s; 286 u_int a1, a2, a3, a4; 287 u_short a5, a6, sp; 288 size_t nlen, olen; 289 tcphdr_t *tcp; 290 int inc, off; 291 ftpside_t *f; 292 mb_t *m; 293 294 m = fin->fin_m; 295 f = &ftp->ftp_side[0]; 296 tcp = (tcphdr_t *)fin->fin_dp; 297 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 298 299 /* 300 * Check for client sending out PORT message. 301 */ 302 if (dlen < IPF_MINPORTLEN) { 303 DT3(ftp_PORT_error_dlen, nat_t *, nat, ftpside_t *, f, 304 u_int, dlen); 305 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 306 printf("ipf_p_ftp_port:dlen(%d) < IPF_MINPORTLEN\n", 307 dlen); 308 return 0; 309 } 310 /* 311 * Skip the PORT command + space 312 */ 313 s = f->ftps_rptr + 5; 314 /* 315 * Pick out the address components, two at a time. 316 */ 317 a1 = ipf_p_ftp_atoi(&s); 318 if (s == NULL) { 319 DT2(ftp_PORT_error_atoi_1, nat_t *, nat, ftpside_t *, f); 320 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 321 printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 1); 322 return 0; 323 } 324 a2 = ipf_p_ftp_atoi(&s); 325 if (s == NULL) { 326 DT2(ftp_PORT_error_atoi_2, nat_t *, nat, ftpside_t *, f); 327 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 328 printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 2); 329 return 0; 330 } 331 332 /* 333 * Check that IP address in the PORT/PASV reply is the same as the 334 * sender of the command - prevents using PORT for port scanning. 335 */ 336 a1 <<= 16; 337 a1 |= a2; 338 if (((nat->nat_dir == NAT_OUTBOUND) && 339 (a1 != ntohl(nat->nat_osrcaddr))) || 340 ((nat->nat_dir == NAT_INBOUND) && 341 (a1 != ntohl(nat->nat_nsrcaddr)))) { 342 DT3(ftp_PORT_error_address, nat_t *, nat, ftpside_t *, f, 343 u_int, a1); 344 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 345 printf("ipf_p_ftp_port:%s != nat->nat_inip\n", "a1"); 346 return APR_ERR(1); 347 } 348 349 a5 = ipf_p_ftp_atoi(&s); 350 if (s == NULL) { 351 DT2(ftp_PORT_error_atoi_3, nat_t *, nat, ftpside_t *, f); 352 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 353 printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 3); 354 return 0; 355 } 356 if (*s == ')') 357 s++; 358 359 /* 360 * check for CR-LF at the end. 361 */ 362 if (*s == '\n') 363 s--; 364 if ((*s != '\r') || (*(s + 1) != '\n')) { 365 DT2(ftp_PORT_error_no_crlf, nat_t *, nat, ftpside_t *, f); 366 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 367 printf("ipf_p_ftp_port:missing %s\n", "cr-lf"); 368 return 0; 369 } 370 s += 2; 371 a6 = a5 & 0xff; 372 373 /* 374 * Calculate the source port. Verification of > 1024 is in 375 * ipf_p_ftp_addport. 376 */ 377 a5 >>= 8; 378 a5 &= 0xff; 379 sp = a5 << 8 | a6; 380 381 /* 382 * Calculate new address parts for PORT command 383 */ 384 if (nat->nat_dir == NAT_INBOUND) 385 a1 = ntohl(nat->nat_ndstaddr); 386 else 387 a1 = ntohl(ip->ip_src.s_addr); 388 a1 = ntohl(ip->ip_src.s_addr); 389 a2 = (a1 >> 16) & 0xff; 390 a3 = (a1 >> 8) & 0xff; 391 a4 = a1 & 0xff; 392 a1 >>= 24; 393 olen = s - f->ftps_rptr; 394 /* DO NOT change this to snprintf! */ 395 #if defined(SNPRINTF) && defined(_KERNEL) 396 SNPRINTF(newbuf, sizeof(newbuf), "%s %u,%u,%u,%u,%u,%u\r\n", 397 "PORT", a1, a2, a3, a4, a5, a6); 398 #else 399 (void) sprintf(newbuf, "%s %u,%u,%u,%u,%u,%u\r\n", 400 "PORT", a1, a2, a3, a4, a5, a6); 401 #endif 402 403 nlen = strlen(newbuf); 404 inc = nlen - olen; 405 if ((inc + fin->fin_plen) > 65535) { 406 DT3(ftp_PORT_error_inc, nat_t *, nat, ftpside_t *, f, 407 int, inc); 408 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 409 printf("ipf_p_ftp_port:inc(%d) + ip->ip_len > 65535\n", 410 inc); 411 return 0; 412 } 413 414 #if !defined(_KERNEL) 415 M_ADJ(m, inc); 416 #else 417 /* 418 * m_adj takes care of pkthdr.len, if required and treats inc<0 to 419 * mean remove -len bytes from the end of the packet. 420 * The mbuf chain will be extended if necessary by m_copyback(). 421 */ 422 if (inc < 0) 423 M_ADJ(m, inc); 424 #endif /* !defined(_KERNEL) */ 425 COPYBACK(m, off, nlen, newbuf); 426 fin->fin_flx |= FI_DOCKSUM; 427 428 if (inc != 0) { 429 fin->fin_plen += inc; 430 ip->ip_len = htons(fin->fin_plen); 431 fin->fin_dlen += inc; 432 } 433 434 f->ftps_cmd = FTPXY_C_PORT; 435 return ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, sp, inc); 436 } 437 438 439 int 440 ipf_p_ftp_addport(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 441 ftpinfo_t *ftp, int dlen, int nport, int inc) 442 { 443 tcphdr_t tcph, *tcp2 = &tcph; 444 ipf_main_softc_t *softc; 445 ipf_nat_softc_t *softn; 446 int direction; 447 fr_info_t fi; 448 ipnat_t *ipn; 449 nat_t *nat2; 450 u_short sp; 451 int flags; 452 453 softc = fin->fin_main_soft; 454 softn = softc->ipf_nat_soft; 455 456 if ((ftp->ftp_pendnat != NULL) || (ftp->ftp_pendstate != NULL)) { 457 if (softf->ipf_p_ftp_single_xfer != 0) { 458 DT2(ftp_PORT_error_add_active, nat_t *, nat, 459 ftpinfo_t *, ftp); 460 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 461 printf("ipf_p_ftp_addport:xfer active %p/%p\n", 462 ftp->ftp_pendnat, ftp->ftp_pendstate); 463 return 0; 464 } 465 ipf_p_ftp_setpending(softc, ftp); 466 } 467 468 /* 469 * Add skeleton NAT entry for connection which will come back the 470 * other way. 471 */ 472 sp = nport; 473 /* 474 * Don't allow the PORT command to specify a port < 1024 due to 475 * security risks. 476 */ 477 if (sp < 1024) { 478 DT3(ftp_PORT_error_port, nat_t *, nat, ftpinfo_t *, ftp, 479 u_int, sp); 480 if (softf->ipf_p_ftp_debug & DEBUG_SECURITY) 481 printf("ipf_p_ftp_addport:sp(%d) < 1024\n", sp); 482 return 0; 483 } 484 /* 485 * The server may not make the connection back from port 20, but 486 * it is the most likely so use it here to check for a conflicting 487 * mapping. 488 */ 489 bcopy((char *)fin, (char *)&fi, sizeof(fi)); 490 fi.fin_flx |= FI_IGNORE; 491 fi.fin_data[0] = sp; 492 fi.fin_data[1] = fin->fin_data[1] - 1; 493 fi.fin_src6 = nat->nat_ndst6; 494 fi.fin_dst6 = nat->nat_nsrc6; 495 496 if (nat->nat_v[0] == 6) { 497 #ifndef USE_INET6 498 return APR_INC(inc); 499 #endif 500 } 501 502 /* 503 * Add skeleton NAT entry for connection which will come back the 504 * other way. 505 */ 506 if (nat->nat_v[0] == 6) { 507 #ifdef USE_INET6 508 if (nat->nat_dir == NAT_OUTBOUND) { 509 nat2 = ipf_nat6_outlookup(&fi, IPN_TCP|NAT_SEARCH, 510 nat->nat_pr[1], 511 &nat->nat_osrc6.in6, 512 &nat->nat_odst6.in6); 513 } else { 514 nat2 = ipf_nat6_inlookup(&fi, IPN_TCP|NAT_SEARCH, 515 nat->nat_pr[0], 516 &nat->nat_odst6.in6, 517 &nat->nat_osrc6.in6); 518 } 519 #endif 520 } else { 521 if (nat->nat_dir == NAT_OUTBOUND) { 522 nat2 = ipf_nat_outlookup(&fi, IPN_TCP|NAT_SEARCH, 523 nat->nat_pr[1], 524 nat->nat_osrcip, 525 nat->nat_odstip); 526 } else { 527 nat2 = ipf_nat_inlookup(&fi, IPN_TCP|NAT_SEARCH, 528 nat->nat_pr[0], 529 nat->nat_odstip, 530 nat->nat_osrcip); 531 } 532 } 533 if (nat2 != NULL) 534 return APR_INC(inc); 535 536 ipn = ipf_proxy_rule_rev(nat); 537 if (ipn == NULL) 538 return APR_ERR(1); 539 ipn->in_use = 0; 540 541 fi.fin_fr = &ftppxyfr; 542 fi.fin_dp = (char *)tcp2; 543 fi.fin_dlen = sizeof(*tcp2); 544 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2); 545 fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE; 546 fi.fin_data[1] = sp; 547 fi.fin_data[0] = 0; 548 549 bzero((char *)tcp2, sizeof(*tcp2)); 550 tcp2->th_sport = 0; 551 tcp2->th_dport = htons(sp); 552 553 tcp2->th_win = htons(8192); 554 TCP_OFF_A(tcp2, 5); 555 tcp2->th_flags = TH_SYN; 556 557 if (nat->nat_dir == NAT_INBOUND) { 558 fi.fin_out = 1; 559 direction = NAT_OUTBOUND; 560 } else { 561 fi.fin_out = 0; 562 direction = NAT_INBOUND; 563 } 564 flags = SI_W_SPORT|NAT_SLAVE|IPN_TCP; 565 566 MUTEX_ENTER(&softn->ipf_nat_new); 567 if (nat->nat_v[0] == 6) { 568 #ifdef USE_INET6 569 nat2 = ipf_nat6_add(&fi, ipn, &ftp->ftp_pendnat, flags, 570 direction); 571 #endif 572 } else { 573 nat2 = ipf_nat_add(&fi, ipn, &ftp->ftp_pendnat, flags, 574 direction); 575 } 576 MUTEX_EXIT(&softn->ipf_nat_new); 577 578 if (nat2 == NULL) { 579 KFREES(ipn, ipn->in_size); 580 return APR_ERR(1); 581 } 582 583 (void) ipf_nat_proto(&fi, nat2, IPN_TCP); 584 MUTEX_ENTER(&nat2->nat_lock); 585 ipf_nat_update(&fi, nat2); 586 MUTEX_EXIT(&nat2->nat_lock); 587 fi.fin_ifp = NULL; 588 if (nat2->nat_dir == NAT_INBOUND) 589 fi.fin_dst6 = nat->nat_osrc6; 590 if (ipf_state_add(softc, &fi, (ipstate_t **)&ftp->ftp_pendstate, 591 SI_W_SPORT) != 0) 592 ipf_nat_setpending(softc, nat2); 593 594 return APR_INC(inc); 595 } 596 597 598 int 599 ipf_p_ftp_client(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 600 ftpinfo_t *ftp, int dlen) 601 { 602 char *rptr, *wptr, cmd[6], c; 603 ftpside_t *f; 604 int inc, i; 605 606 inc = 0; 607 f = &ftp->ftp_side[0]; 608 rptr = f->ftps_rptr; 609 wptr = f->ftps_wptr; 610 611 for (i = 0; (i < 5) && (i < dlen); i++) { 612 c = rptr[i]; 613 if (ISALPHA(c)) { 614 cmd[i] = TOUPPER(c); 615 } else { 616 cmd[i] = c; 617 } 618 } 619 cmd[i] = '\0'; 620 621 ftp->ftp_incok = 0; 622 DT2(ftp_client_command, char [], cmd, int, ftp->ftp_passok); 623 if (!strncmp(cmd, "USER ", 5) || !strncmp(cmd, "XAUT ", 5)) { 624 if (ftp->ftp_passok == FTPXY_ADOK_1 || 625 ftp->ftp_passok == FTPXY_AUOK_1) { 626 ftp->ftp_passok = FTPXY_USER_2; 627 ftp->ftp_incok = 1; 628 } else { 629 ftp->ftp_passok = FTPXY_USER_1; 630 ftp->ftp_incok = 1; 631 } 632 } else if (!strncmp(cmd, "AUTH ", 5)) { 633 ftp->ftp_passok = FTPXY_AUTH_1; 634 ftp->ftp_incok = 1; 635 } else if (!strncmp(cmd, "PASS ", 5)) { 636 if (ftp->ftp_passok == FTPXY_USOK_1) { 637 ftp->ftp_passok = FTPXY_PASS_1; 638 ftp->ftp_incok = 1; 639 } else if (ftp->ftp_passok == FTPXY_USOK_2) { 640 ftp->ftp_passok = FTPXY_PASS_2; 641 ftp->ftp_incok = 1; 642 } 643 } else if ((ftp->ftp_passok == FTPXY_AUOK_1) && 644 !strncmp(cmd, "ADAT ", 5)) { 645 ftp->ftp_passok = FTPXY_ADAT_1; 646 ftp->ftp_incok = 1; 647 } else if ((ftp->ftp_passok == FTPXY_PAOK_1 || 648 ftp->ftp_passok == FTPXY_PAOK_2) && 649 !strncmp(cmd, "ACCT ", 5)) { 650 ftp->ftp_passok = FTPXY_ACCT_1; 651 ftp->ftp_incok = 1; 652 } else if ((ftp->ftp_passok == FTPXY_GO) && 653 !softf->ipf_p_ftp_pasvonly && 654 !strncmp(cmd, "PORT ", 5)) { 655 inc = ipf_p_ftp_port(softf, fin, ip, nat, ftp, dlen); 656 } else if ((ftp->ftp_passok == FTPXY_GO) && 657 !softf->ipf_p_ftp_pasvonly && 658 !strncmp(cmd, "EPRT ", 5)) { 659 inc = ipf_p_ftp_eprt(softf, fin, ip, nat, ftp, dlen); 660 } else if (softf->ipf_p_ftp_insecure && 661 !softf->ipf_p_ftp_pasvonly && 662 !strncmp(cmd, "PORT ", 5)) { 663 inc = ipf_p_ftp_port(softf, fin, ip, nat, ftp, dlen); 664 } 665 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 666 printf("ipf_p_ftp_client: cmd[%s] passok %d incok %d inc %d\n", 667 cmd, ftp->ftp_passok, ftp->ftp_incok, inc); 668 669 DT2(ftp_client_passok, char *, cmd, int, ftp->ftp_passok); 670 while ((*rptr++ != '\n') && (rptr < wptr)) 671 ; 672 f->ftps_rptr = rptr; 673 return inc; 674 } 675 676 677 int 678 ipf_p_ftp_pasv(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 679 ftpinfo_t *ftp, int dlen) 680 { 681 u_int a1, a2, a3, a4, data_ip; 682 char newbuf[IPF_FTPBUFSZ]; 683 const char *brackets[2]; 684 u_short a5, a6; 685 ftpside_t *f; 686 char *s; 687 688 if ((softf->ipf_p_ftp_forcepasv != 0) && 689 (ftp->ftp_side[0].ftps_cmd != FTPXY_C_PASV)) { 690 DT2(ftp_PASV_error_state, nat_t *, nat, ftpinfo_t *, ftp); 691 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 692 printf("ipf_p_ftp_pasv:ftps_cmd(%d) != FTPXY_C_PASV\n", 693 ftp->ftp_side[0].ftps_cmd); 694 return 0; 695 } 696 697 f = &ftp->ftp_side[1]; 698 699 #define PASV_REPLEN 24 700 /* 701 * Check for PASV reply message. 702 */ 703 if (dlen < IPF_MIN227LEN) { 704 DT3(ftp_PASV_error_short, nat_t *, nat, ftpinfo_t *, ftp, 705 int, dlen); 706 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 707 printf("ipf_p_ftp_pasv:dlen(%d) < IPF_MIN227LEN\n", 708 dlen); 709 return 0; 710 } else if (strncmp(f->ftps_rptr, 711 "227 Entering Passive Mod", PASV_REPLEN)) { 712 DT2(ftp_PASV_error_string, nat_t *, nat, ftpinfo_t *, ftp); 713 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 714 printf("ipf_p_ftp_pasv:%d reply wrong\n", 227); 715 return 0; 716 } 717 718 brackets[0] = ""; 719 brackets[1] = ""; 720 /* 721 * Skip the PASV reply + space 722 */ 723 s = f->ftps_rptr + PASV_REPLEN; 724 while (*s && !ISDIGIT(*s)) { 725 if (*s == '(') { 726 brackets[0] = "("; 727 brackets[1] = ")"; 728 } 729 s++; 730 } 731 732 /* 733 * Pick out the address components, two at a time. 734 */ 735 a1 = ipf_p_ftp_atoi(&s); 736 if (s == NULL) { 737 DT2(ftp_PASV_error_atoi_1, nat_t *, nat, ftpside_t *, f); 738 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 739 printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 1); 740 return 0; 741 } 742 a2 = ipf_p_ftp_atoi(&s); 743 if (s == NULL) { 744 DT2(ftp_PASV_error_atoi_2, nat_t *, nat, ftpside_t *, f); 745 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 746 printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 2); 747 return 0; 748 } 749 750 /* 751 * check that IP address in the PASV reply is the same as the 752 * sender of the command - prevents using PASV for port scanning. 753 */ 754 a1 <<= 16; 755 a1 |= a2; 756 757 if (((nat->nat_dir == NAT_INBOUND) && 758 (a1 != ntohl(nat->nat_ndstaddr))) || 759 ((nat->nat_dir == NAT_OUTBOUND) && 760 (a1 != ntohl(nat->nat_odstaddr)))) { 761 DT3(ftp_PASV_error_address, nat_t *, nat, ftpside_t *, f, 762 u_int, a1); 763 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 764 printf("ipf_p_ftp_pasv:%s != nat->nat_oip\n", "a1"); 765 return 0; 766 } 767 768 a5 = ipf_p_ftp_atoi(&s); 769 if (s == NULL) { 770 DT2(ftp_PASV_error_atoi_3, nat_t *, nat, ftpside_t *, f); 771 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 772 printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 3); 773 return 0; 774 } 775 776 if (*s == ')') 777 s++; 778 if (*s == '.') 779 s++; 780 if (*s == '\n') 781 s--; 782 /* 783 * check for CR-LF at the end. 784 */ 785 if ((*s != '\r') || (*(s + 1) != '\n')) { 786 DT(pasv_missing_crlf); 787 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 788 printf("ipf_p_ftp_pasv:missing %s", "cr-lf\n"); 789 return 0; 790 } 791 s += 2; 792 793 a6 = a5 & 0xff; 794 a5 >>= 8; 795 /* 796 * Calculate new address parts for 227 reply 797 */ 798 if (nat->nat_dir == NAT_INBOUND) { 799 data_ip = nat->nat_odstaddr; 800 a1 = ntohl(data_ip); 801 } else 802 data_ip = htonl(a1); 803 804 a2 = (a1 >> 16) & 0xff; 805 a3 = (a1 >> 8) & 0xff; 806 a4 = a1 & 0xff; 807 a1 >>= 24; 808 809 #if defined(SNPRINTF) && defined(_KERNEL) 810 SNPRINTF(newbuf, sizeof(newbuf), "%s %s%u,%u,%u,%u,%u,%u%s\r\n", 811 "227 Entering Passive Mode", brackets[0], a1, a2, a3, a4, 812 a5, a6, brackets[1]); 813 #else 814 (void) sprintf(newbuf, "%s %s%u,%u,%u,%u,%u,%u%s\r\n", 815 "227 Entering Passive Mode", brackets[0], a1, a2, a3, a4, 816 a5, a6, brackets[1]); 817 #endif 818 return ipf_p_ftp_pasvreply(softf, fin, ip, nat, ftp, (a5 << 8 | a6), 819 newbuf, s); 820 } 821 822 int 823 ipf_p_ftp_pasvreply(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, 824 nat_t *nat, ftpinfo_t *ftp, u_int port, char *newmsg, char *s) 825 { 826 int inc, off, nflags; 827 tcphdr_t *tcp, tcph, *tcp2; 828 ipf_main_softc_t *softc; 829 ipf_nat_softc_t *softn; 830 size_t nlen, olen; 831 #ifdef USE_INET6 832 ip6_t *ip6; 833 #endif 834 ipnat_t *ipn; 835 fr_info_t fi; 836 ftpside_t *f; 837 nat_t *nat2; 838 mb_t *m; 839 840 softc = fin->fin_main_soft; 841 softn = softc->ipf_nat_soft; 842 843 if ((ftp->ftp_pendnat != NULL) || (ftp->ftp_pendstate != NULL)) 844 ipf_p_ftp_setpending(softc, ftp); 845 846 m = fin->fin_m; 847 tcp = (tcphdr_t *)fin->fin_dp; 848 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 849 850 tcp2 = &tcph; 851 inc = 0; 852 853 f = &ftp->ftp_side[1]; 854 olen = s - f->ftps_rptr; 855 nlen = strlen(newmsg); 856 inc = nlen - olen; 857 if ((inc + fin->fin_plen) > 65535) { 858 DT3(ftp_PASV_error_inc, nat_t *, nat, ftpside_t *, f, 859 int, inc); 860 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 861 printf("ipf_p_ftp_pasv:inc(%d) + ip->ip_len > 65535\n", 862 inc); 863 return 0; 864 } 865 866 ipn = ipf_proxy_rule_fwd(nat); 867 if (ipn == NULL) 868 return APR_ERR(1); 869 ipn->in_use = 0; 870 871 /* 872 * Add skeleton NAT entry for connection which will come back the 873 * other way. 874 */ 875 bzero((char *)tcp2, sizeof(*tcp2)); 876 bcopy((char *)fin, (char *)&fi, sizeof(fi)); 877 fi.fin_flx |= FI_IGNORE; 878 fi.fin_data[0] = 0; 879 fi.fin_data[1] = port; 880 nflags = IPN_TCP|SI_W_SPORT; 881 882 fi.fin_fr = &ftppxyfr; 883 fi.fin_dp = (char *)tcp2; 884 fi.fin_out = 1 - fin->fin_out; 885 fi.fin_dlen = sizeof(*tcp2); 886 fi.fin_src6 = nat->nat_osrc6; 887 fi.fin_dst6 = nat->nat_odst6; 888 fi.fin_plen = fi.fin_hlen + sizeof(*tcp); 889 fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE; 890 891 TCP_OFF_A(tcp2, 5); 892 tcp2->th_flags = TH_SYN; 893 tcp2->th_win = htons(8192); 894 tcp2->th_dport = htons(port); 895 896 MUTEX_ENTER(&softn->ipf_nat_new); 897 if (nat->nat_v[0] == 6) { 898 #ifdef USE_INET6 899 nat2 = ipf_nat6_add(&fi, ipn, &ftp->ftp_pendnat, 900 nflags, nat->nat_dir); 901 #endif 902 } else { 903 nat2 = ipf_nat_add(&fi, ipn, &ftp->ftp_pendnat, 904 nflags, nat->nat_dir); 905 } 906 MUTEX_EXIT(&softn->ipf_nat_new); 907 908 if (nat2 == NULL) { 909 KFREES(ipn, ipn->in_size); 910 return APR_ERR(1); 911 } 912 913 (void) ipf_nat_proto(&fi, nat2, IPN_TCP); 914 MUTEX_ENTER(&nat2->nat_lock); 915 ipf_nat_update(&fi, nat2); 916 MUTEX_EXIT(&nat2->nat_lock); 917 fi.fin_ifp = NULL; 918 if (nat->nat_dir == NAT_INBOUND) { 919 if (nat->nat_v[0] == 6) { 920 #ifdef USE_INET6 921 fi.fin_dst6 = nat->nat_ndst6; 922 #endif 923 } else { 924 fi.fin_daddr = nat->nat_ndstaddr; 925 } 926 } 927 if (ipf_state_add(softc, &fi, (ipstate_t **)&ftp->ftp_pendstate, 928 SI_W_SPORT) != 0) 929 ipf_nat_setpending(softc, nat2); 930 931 #if !defined(_KERNEL) 932 M_ADJ(m, inc); 933 #else 934 /* 935 * m_adj takes care of pkthdr.len, if required and treats inc<0 to 936 * mean remove -len bytes from the end of the packet. 937 * The mbuf chain will be extended if necessary by m_copyback(). 938 */ 939 if (inc < 0) 940 M_ADJ(m, inc); 941 #endif /* !defined(_KERNEL) */ 942 COPYBACK(m, off, nlen, newmsg); 943 fin->fin_flx |= FI_DOCKSUM; 944 945 if (inc != 0) { 946 fin->fin_plen += inc; 947 fin->fin_dlen += inc; 948 if (nat->nat_v[0] == 6) { 949 #ifdef USE_INET6 950 ip6 = (ip6_t *)fin->fin_ip; 951 u_short len = ntohs(ip6->ip6_plen) + inc; 952 ip6->ip6_plen = htons(len); 953 #endif 954 } else { 955 ip->ip_len = htons(fin->fin_plen); 956 } 957 } 958 959 return APR_INC(inc); 960 } 961 962 963 int 964 ipf_p_ftp_server(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 965 ftpinfo_t *ftp, int dlen) 966 { 967 char *rptr, *wptr; 968 ftpside_t *f; 969 int inc; 970 971 inc = 0; 972 f = &ftp->ftp_side[1]; 973 rptr = f->ftps_rptr; 974 wptr = f->ftps_wptr; 975 976 DT2(ftp_server_response, char *, rptr, int, ftp->ftp_passok); 977 if (*rptr == ' ') 978 goto server_cmd_ok; 979 if (!ISDIGIT(*rptr) || !ISDIGIT(*(rptr + 1)) || !ISDIGIT(*(rptr + 2))) 980 return 0; 981 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 982 printf("ipf_p_ftp_server_1: cmd[%4.4s] passok %d\n", 983 rptr, ftp->ftp_passok); 984 if (ftp->ftp_passok == FTPXY_GO) { 985 if (!strncmp(rptr, "227 ", 4)) 986 inc = ipf_p_ftp_pasv(softf, fin, ip, nat, ftp, dlen); 987 else if (!strncmp(rptr, "229 ", 4)) 988 inc = ipf_p_ftp_epsv(softf, fin, ip, nat, ftp, dlen); 989 else if (strncmp(rptr, "200", 3)) { 990 /* 991 * 200 is returned for a successful command. 992 */ 993 ; 994 } 995 } else if (softf->ipf_p_ftp_insecure && !strncmp(rptr, "227 ", 4)) { 996 inc = ipf_p_ftp_pasv(softf, fin, ip, nat, ftp, dlen); 997 } else if (softf->ipf_p_ftp_insecure && !strncmp(rptr, "229 ", 4)) { 998 inc = ipf_p_ftp_epsv(softf, fin, ip, nat, ftp, dlen); 999 } else if (*rptr == '5' || *rptr == '4') 1000 ftp->ftp_passok = FTPXY_INIT; 1001 else if (ftp->ftp_incok) { 1002 if (*rptr == '3') { 1003 if (ftp->ftp_passok == FTPXY_ACCT_1) 1004 ftp->ftp_passok = FTPXY_GO; 1005 else 1006 ftp->ftp_passok++; 1007 } else if (*rptr == '2') { 1008 switch (ftp->ftp_passok) 1009 { 1010 case FTPXY_USER_1 : 1011 case FTPXY_USER_2 : 1012 case FTPXY_PASS_1 : 1013 case FTPXY_PASS_2 : 1014 case FTPXY_ACCT_1 : 1015 ftp->ftp_passok = FTPXY_GO; 1016 break; 1017 default : 1018 ftp->ftp_passok += 3; 1019 break; 1020 } 1021 } 1022 } 1023 ftp->ftp_incok = 0; 1024 server_cmd_ok: 1025 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 1026 printf("ipf_p_ftp_server_2: cmd[%4.4s] passok %d\n", 1027 rptr, ftp->ftp_passok); 1028 DT3(ftp_server_passok, char *,rptr, int, ftp->ftp_incok, 1029 int, ftp->ftp_passok); 1030 1031 while ((*rptr++ != '\n') && (rptr < wptr)) 1032 ; 1033 f->ftps_rptr = rptr; 1034 return inc; 1035 } 1036 1037 1038 /* 1039 * 0 FTPXY_JUNK_OK 1040 * 1 FTPXY_JUNK_BAD 1041 * 2 FTPXY_JUNK_EOL 1042 * 3 FTPXY_JUNK_CONT 1043 * 1044 * Look to see if the buffer starts with something which we recognise as 1045 * being the correct syntax for the FTP protocol. 1046 */ 1047 int 1048 ipf_p_ftp_client_valid(ipf_ftp_softc_t *softf, ftpside_t *ftps, char *buf, 1049 size_t len) 1050 { 1051 register char *s, c, pc; 1052 register size_t i = len; 1053 char cmd[5]; 1054 1055 s = buf; 1056 1057 if (ftps->ftps_junk == FTPXY_JUNK_BAD) 1058 return FTPXY_JUNK_BAD; 1059 1060 if (i < 5) { 1061 DT1(client_valid, int, i); 1062 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 1063 printf("ipf_p_ftp_client_valid:i(%d) < 5\n", (int)i); 1064 return 2; 1065 } 1066 1067 i--; 1068 c = *s++; 1069 1070 if (ISALPHA(c)) { 1071 cmd[0] = TOUPPER(c); 1072 c = *s++; 1073 i--; 1074 if (ISALPHA(c)) { 1075 cmd[1] = TOUPPER(c); 1076 c = *s++; 1077 i--; 1078 if (ISALPHA(c)) { 1079 cmd[2] = TOUPPER(c); 1080 c = *s++; 1081 i--; 1082 if (ISALPHA(c)) { 1083 cmd[3] = TOUPPER(c); 1084 c = *s++; 1085 i--; 1086 if ((c != ' ') && (c != '\r')) 1087 goto bad_client_command; 1088 } else if ((c != ' ') && (c != '\r')) 1089 goto bad_client_command; 1090 } else 1091 goto bad_client_command; 1092 } else 1093 goto bad_client_command; 1094 } else { 1095 bad_client_command: 1096 DT4(client_junk, int, len, int, i, int, c, char *, buf); 1097 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1098 printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*.*s]\n", 1099 "ipf_p_ftp_client_valid", 1100 ftps->ftps_junk, (int)len, (int)i, c, 1101 (int)len, (int)len, buf); 1102 return FTPXY_JUNK_BAD; 1103 } 1104 1105 for (; i; i--) { 1106 pc = c; 1107 c = *s++; 1108 if ((pc == '\r') && (c == '\n')) { 1109 cmd[4] = '\0'; 1110 if (!strcmp(cmd, "PASV")) { 1111 ftps->ftps_cmd = FTPXY_C_PASV; 1112 } else if (!strcmp(cmd, "EPSV")) { 1113 ftps->ftps_cmd = FTPXY_C_EPSV; 1114 } else { 1115 ftps->ftps_cmd = 0; 1116 } 1117 return 0; 1118 } 1119 } 1120 #if !defined(_KERNEL) 1121 printf("ipf_p_ftp_client_valid:junk after cmd[%*.*s]\n", 1122 (int)len, (int)len, buf); 1123 #endif 1124 return FTPXY_JUNK_EOL; 1125 } 1126 1127 1128 int 1129 ipf_p_ftp_server_valid(ipf_ftp_softc_t *softf, ftpside_t *ftps, char *buf, 1130 size_t len) 1131 { 1132 register char *s, c, pc; 1133 register size_t i = len; 1134 int cmd; 1135 1136 s = buf; 1137 cmd = 0; 1138 1139 if (ftps->ftps_junk == FTPXY_JUNK_BAD) 1140 return FTPXY_JUNK_BAD; 1141 1142 if (i < 5) { 1143 DT1(server_valid, int, i); 1144 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1145 printf("ipf_p_ftp_servert_valid:i(%d) < 5\n", (int)i); 1146 return 2; 1147 } 1148 1149 c = *s++; 1150 i--; 1151 if (c == ' ') { 1152 cmd = -1; 1153 goto search_eol; 1154 } 1155 1156 if (ISDIGIT(c)) { 1157 cmd = (c - '0') * 100; 1158 c = *s++; 1159 i--; 1160 if (ISDIGIT(c)) { 1161 cmd += (c - '0') * 10; 1162 c = *s++; 1163 i--; 1164 if (ISDIGIT(c)) { 1165 cmd += (c - '0'); 1166 c = *s++; 1167 i--; 1168 if ((c != '-') && (c != ' ')) 1169 goto bad_server_command; 1170 if (c == '-') 1171 return FTPXY_JUNK_CONT; 1172 } else 1173 goto bad_server_command; 1174 } else 1175 goto bad_server_command; 1176 } else { 1177 bad_server_command: 1178 DT4(server_junk, int len, buf, int, i, int, c, char *, buf); 1179 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO) 1180 printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*.*s]\n", 1181 "ipf_p_ftp_server_valid", 1182 ftps->ftps_junk, (int)len, (int)i, 1183 c, (int)len, (int)len, buf); 1184 if (ftps->ftps_junk == FTPXY_JUNK_CONT) 1185 return FTPXY_JUNK_CONT; 1186 return FTPXY_JUNK_BAD; 1187 } 1188 search_eol: 1189 for (; i; i--) { 1190 pc = c; 1191 c = *s++; 1192 if ((pc == '\r') && (c == '\n')) { 1193 if (cmd == -1) { 1194 if (ftps->ftps_junk == FTPXY_JUNK_CONT) 1195 return FTPXY_JUNK_CONT; 1196 } else { 1197 ftps->ftps_cmd = cmd; 1198 } 1199 return FTPXY_JUNK_OK; 1200 } 1201 } 1202 1203 DT2(junk_eol, int, len, char *, buf); 1204 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO) 1205 printf("ipf_p_ftp_server_valid:junk after cmd[%*.*s]\n", 1206 (int)len, (int)len, buf); 1207 return FTPXY_JUNK_EOL; 1208 } 1209 1210 1211 int 1212 ipf_p_ftp_valid(ipf_ftp_softc_t *softf, ftpinfo_t *ftp, int side, char *buf, 1213 size_t len) 1214 { 1215 ftpside_t *ftps; 1216 int ret; 1217 1218 ftps = &ftp->ftp_side[side]; 1219 1220 if (side == 0) 1221 ret = ipf_p_ftp_client_valid(softf, ftps, buf, len); 1222 else 1223 ret = ipf_p_ftp_server_valid(softf, ftps, buf, len); 1224 return ret; 1225 } 1226 1227 1228 /* 1229 * For map rules, the following applies: 1230 * rv == 0 for outbound processing, 1231 * rv == 1 for inbound processing. 1232 * For rdr rules, the following applies: 1233 * rv == 0 for inbound processing, 1234 * rv == 1 for outbound processing. 1235 */ 1236 int 1237 ipf_p_ftp_process(ipf_ftp_softc_t *softf, fr_info_t *fin, nat_t *nat, 1238 ftpinfo_t *ftp, int rv) 1239 { 1240 int mlen, len, off, inc, i, sel, sel2, ok, ackoff, seqoff, retry; 1241 char *rptr, *wptr, *s; 1242 u_32_t thseq, thack; 1243 ap_session_t *aps; 1244 ftpside_t *f, *t; 1245 tcphdr_t *tcp; 1246 ip_t *ip; 1247 mb_t *m; 1248 1249 m = fin->fin_m; 1250 ip = fin->fin_ip; 1251 tcp = (tcphdr_t *)fin->fin_dp; 1252 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 1253 1254 f = &ftp->ftp_side[rv]; 1255 t = &ftp->ftp_side[1 - rv]; 1256 thseq = ntohl(tcp->th_seq); 1257 thack = ntohl(tcp->th_ack); 1258 #ifdef __sgi 1259 mlen = fin->fin_plen - off; 1260 #else 1261 mlen = MSGDSIZE(m) - off; 1262 #endif 1263 1264 DT3(process_debug, tcphdr_t *, tcp, int, off, int, mlen); 1265 if (softf->ipf_p_ftp_debug & DEBUG_INFO) 1266 printf("ipf_p_ftp_process: %d:%d,%d, mlen %d flags %x\n", 1267 fin->fin_out, fin->fin_sport, fin->fin_dport, 1268 mlen, tcp->th_flags); 1269 1270 if ((mlen == 0) && ((tcp->th_flags & TH_OPENING) == TH_OPENING)) { 1271 f->ftps_seq[0] = thseq + 1; 1272 t->ftps_seq[0] = thack; 1273 return 0; 1274 } else if (mlen < 0) { 1275 return 0; 1276 } 1277 1278 aps = nat->nat_aps; 1279 1280 sel = aps->aps_sel[1 - rv]; 1281 sel2 = aps->aps_sel[rv]; 1282 if (rv == 1) { 1283 seqoff = aps->aps_seqoff[sel]; 1284 if (aps->aps_seqmin[sel] > seqoff + thseq) 1285 seqoff = aps->aps_seqoff[!sel]; 1286 ackoff = aps->aps_ackoff[sel2]; 1287 if (aps->aps_ackmin[sel2] > ackoff + thack) 1288 ackoff = aps->aps_ackoff[!sel2]; 1289 } else { 1290 seqoff = aps->aps_ackoff[sel]; 1291 if (softf->ipf_p_ftp_debug & DEBUG_INFO) 1292 printf("seqoff %d thseq %x ackmin %x\n", seqoff, thseq, 1293 aps->aps_ackmin[sel]); 1294 if (aps->aps_ackmin[sel] > seqoff + thseq) 1295 seqoff = aps->aps_ackoff[!sel]; 1296 1297 ackoff = aps->aps_seqoff[sel2]; 1298 if (softf->ipf_p_ftp_debug & DEBUG_INFO) 1299 printf("ackoff %d thack %x seqmin %x\n", ackoff, thack, 1300 aps->aps_seqmin[sel2]); 1301 if (ackoff > 0) { 1302 if (aps->aps_seqmin[sel2] > ackoff + thack) 1303 ackoff = aps->aps_seqoff[!sel2]; 1304 } else { 1305 if (aps->aps_seqmin[sel2] > thack) 1306 ackoff = aps->aps_seqoff[!sel2]; 1307 } 1308 } 1309 if (softf->ipf_p_ftp_debug & DEBUG_INFO) { 1310 printf("%s: %x seq %x/%d ack %x/%d len %d/%d off %d\n", 1311 rv ? "IN" : "OUT", tcp->th_flags, thseq, seqoff, 1312 thack, ackoff, mlen, fin->fin_plen, off); 1313 printf("sel %d seqmin %x/%x offset %d/%d\n", sel, 1314 aps->aps_seqmin[sel], aps->aps_seqmin[sel2], 1315 aps->aps_seqoff[sel], aps->aps_seqoff[sel2]); 1316 printf("sel %d ackmin %x/%x offset %d/%d\n", sel2, 1317 aps->aps_ackmin[sel], aps->aps_ackmin[sel2], 1318 aps->aps_ackoff[sel], aps->aps_ackoff[sel2]); 1319 } 1320 1321 /* 1322 * XXX - Ideally, this packet should get dropped because we now know 1323 * that it is out of order (and there is no real danger in doing so 1324 * apart from causing packets to go through here ordered). 1325 */ 1326 if (softf->ipf_p_ftp_debug & DEBUG_INFO) { 1327 printf("rv %d t:seq[0] %x seq[1] %x %d/%d\n", 1328 rv, t->ftps_seq[0], t->ftps_seq[1], seqoff, ackoff); 1329 } 1330 1331 ok = 0; 1332 if (t->ftps_seq[0] == 0) { 1333 t->ftps_seq[0] = thack; 1334 ok = 1; 1335 } else { 1336 if (ackoff == 0) { 1337 if (t->ftps_seq[0] == thack) 1338 ok = 1; 1339 else if (t->ftps_seq[1] == thack) { 1340 t->ftps_seq[0] = thack; 1341 ok = 1; 1342 } 1343 } else { 1344 if (t->ftps_seq[0] + ackoff == thack) { 1345 t->ftps_seq[0] = thack; 1346 ok = 1; 1347 } else if (t->ftps_seq[0] == thack + ackoff) { 1348 t->ftps_seq[0] = thack + ackoff; 1349 ok = 1; 1350 } else if (t->ftps_seq[1] + ackoff == thack) { 1351 t->ftps_seq[0] = thack; 1352 ok = 1; 1353 } else if (t->ftps_seq[1] == thack + ackoff) { 1354 t->ftps_seq[0] = thack + ackoff; 1355 ok = 1; 1356 } 1357 } 1358 } 1359 1360 if (softf->ipf_p_ftp_debug & DEBUG_INFO) { 1361 if (!ok) 1362 printf("%s ok\n", "not"); 1363 } 1364 1365 if (!mlen) { 1366 if (t->ftps_seq[0] + ackoff != thack && 1367 t->ftps_seq[1] + ackoff != thack) { 1368 DT3(thack, ftpside_t *t, t, int, ackoff, u_32_t, thack); 1369 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) { 1370 printf("%s:seq[0](%u) + (%d) != (%u)\n", 1371 "ipf_p_ftp_process", t->ftps_seq[0], 1372 ackoff, thack); 1373 printf("%s:seq[0](%u) + (%d) != (%u)\n", 1374 "ipf_p_ftp_process", t->ftps_seq[1], 1375 ackoff, thack); 1376 } 1377 return APR_ERR(1); 1378 } 1379 1380 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) { 1381 printf("ipf_p_ftp_process:f:seq[0] %x seq[1] %x\n", 1382 f->ftps_seq[0], f->ftps_seq[1]); 1383 } 1384 1385 if (tcp->th_flags & TH_FIN) { 1386 if (thseq == f->ftps_seq[1]) { 1387 f->ftps_seq[0] = f->ftps_seq[1] - seqoff; 1388 f->ftps_seq[1] = thseq + 1 - seqoff; 1389 } else { 1390 DT2(thseq, ftpside_t *t, t, u_32_t, thseq); 1391 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) { 1392 printf("FIN: thseq %x seqoff %d ftps_seq %x\n", 1393 thseq, seqoff, f->ftps_seq[0]); 1394 } 1395 return APR_ERR(1); 1396 } 1397 } 1398 f->ftps_len = 0; 1399 return 0; 1400 } 1401 1402 ok = 0; 1403 if ((thseq == f->ftps_seq[0]) || (thseq == f->ftps_seq[1])) { 1404 ok = 1; 1405 /* 1406 * Retransmitted data packet. 1407 */ 1408 } else if ((thseq + mlen == f->ftps_seq[0]) || 1409 (thseq + mlen == f->ftps_seq[1])) { 1410 ok = 1; 1411 } 1412 1413 if (ok == 0) { 1414 DT3(ok_0, ftpside_t *, f, u_32_t, thseq, int, mlen); 1415 inc = thseq - f->ftps_seq[0]; 1416 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) { 1417 printf("inc %d sel %d rv %d\n", inc, sel, rv); 1418 printf("th_seq %x ftps_seq %x/%x\n", 1419 thseq, f->ftps_seq[0], f->ftps_seq[1]); 1420 printf("ackmin %x ackoff %d\n", aps->aps_ackmin[sel], 1421 aps->aps_ackoff[sel]); 1422 printf("seqmin %x seqoff %d\n", aps->aps_seqmin[sel], 1423 aps->aps_seqoff[sel]); 1424 } 1425 1426 return APR_ERR(1); 1427 } 1428 1429 inc = 0; 1430 rptr = f->ftps_rptr; 1431 wptr = f->ftps_wptr; 1432 f->ftps_seq[0] = thseq; 1433 f->ftps_seq[1] = f->ftps_seq[0] + mlen; 1434 f->ftps_len = mlen; 1435 1436 while (mlen > 0) { 1437 len = MIN(mlen, sizeof(f->ftps_buf) - (wptr - rptr)); 1438 if (len == 0) 1439 break; 1440 COPYDATA(m, off, len, wptr); 1441 mlen -= len; 1442 off += len; 1443 wptr += len; 1444 1445 whilemore: 1446 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 1447 printf("%s:len %d/%d off %d wptr %lx junk %d [%*.*s]\n", 1448 "ipf_p_ftp_process", 1449 len, mlen, off, (u_long)wptr, f->ftps_junk, 1450 len, len, rptr); 1451 1452 f->ftps_wptr = wptr; 1453 if (f->ftps_junk != FTPXY_JUNK_OK) { 1454 i = f->ftps_junk; 1455 f->ftps_junk = ipf_p_ftp_valid(softf, ftp, rv, rptr, 1456 wptr - rptr); 1457 DT2(junk_transit, int, i, int, f->ftps_junk); 1458 1459 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) 1460 printf("%s:junk %d -> %d\n", 1461 "ipf_p_ftp_process", i, f->ftps_junk); 1462 1463 if (f->ftps_junk == FTPXY_JUNK_BAD) { 1464 DT(buffer_full); 1465 if (wptr - rptr == sizeof(f->ftps_buf)) { 1466 if (softf->ipf_p_ftp_debug & 1467 DEBUG_PARSE_INFO) 1468 printf("%s:full buffer\n", 1469 "ipf_p_ftp_process"); 1470 f->ftps_rptr = f->ftps_buf; 1471 f->ftps_wptr = f->ftps_buf; 1472 rptr = f->ftps_rptr; 1473 wptr = f->ftps_wptr; 1474 continue; 1475 } 1476 } 1477 } 1478 1479 while ((f->ftps_junk == FTPXY_JUNK_OK) && (wptr > rptr)) { 1480 len = wptr - rptr; 1481 f->ftps_junk = ipf_p_ftp_valid(softf, ftp, rv, 1482 rptr, len); 1483 1484 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) { 1485 printf("%s=%d len %d rv %d ptr %lx/%lx ", 1486 "ipf_p_ftp_valid", 1487 f->ftps_junk, len, rv, (u_long)rptr, 1488 (u_long)wptr); 1489 printf("buf [%*.*s]\n", len, len, rptr); 1490 } 1491 1492 if (f->ftps_junk == FTPXY_JUNK_OK) { 1493 f->ftps_cmds++; 1494 f->ftps_rptr = rptr; 1495 if (rv) 1496 inc += ipf_p_ftp_server(softf, fin, ip, 1497 nat, ftp, len); 1498 else 1499 inc += ipf_p_ftp_client(softf, fin, ip, 1500 nat, ftp, len); 1501 rptr = f->ftps_rptr; 1502 wptr = f->ftps_wptr; 1503 } 1504 } 1505 1506 /* 1507 * Off to a bad start so lets just forget about using the 1508 * ftp proxy for this connection. 1509 */ 1510 if ((f->ftps_cmds == 0) && (f->ftps_junk == FTPXY_JUNK_BAD)) { 1511 /* f->ftps_seq[1] += inc; */ 1512 1513 DT(ftp_junk_cmd); 1514 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 1515 printf("%s:cmds == 0 junk == 1\n", 1516 "ipf_p_ftp_process"); 1517 return APR_ERR(2); 1518 } 1519 1520 retry = 0; 1521 if ((f->ftps_junk != FTPXY_JUNK_OK) && (rptr < wptr)) { 1522 for (s = rptr; s < wptr; s++) { 1523 if ((*s == '\r') && (s + 1 < wptr) && 1524 (*(s + 1) == '\n')) { 1525 rptr = s + 2; 1526 retry = 1; 1527 if (f->ftps_junk != FTPXY_JUNK_CONT) 1528 f->ftps_junk = FTPXY_JUNK_OK; 1529 break; 1530 } 1531 } 1532 } 1533 1534 if (rptr == wptr) { 1535 rptr = wptr = f->ftps_buf; 1536 } else { 1537 /* 1538 * Compact the buffer back to the start. The junk 1539 * flag should already be set and because we're not 1540 * throwing away any data, it is preserved from its 1541 * current state. 1542 */ 1543 if (rptr > f->ftps_buf) { 1544 bcopy(rptr, f->ftps_buf, wptr - rptr); 1545 wptr -= rptr - f->ftps_buf; 1546 rptr = f->ftps_buf; 1547 } 1548 } 1549 f->ftps_rptr = rptr; 1550 f->ftps_wptr = wptr; 1551 if (retry) 1552 goto whilemore; 1553 } 1554 1555 /* f->ftps_seq[1] += inc; */ 1556 if (tcp->th_flags & TH_FIN) 1557 f->ftps_seq[1]++; 1558 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO) { 1559 #ifdef __sgi 1560 mlen = fin->fin_plen; 1561 #else 1562 mlen = MSGDSIZE(m); 1563 #endif 1564 mlen -= off; 1565 printf("ftps_seq[1] = %x inc %d len %d\n", 1566 f->ftps_seq[1], inc, mlen); 1567 } 1568 1569 f->ftps_rptr = rptr; 1570 f->ftps_wptr = wptr; 1571 return APR_INC(inc); 1572 } 1573 1574 1575 int 1576 ipf_p_ftp_out(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 1577 { 1578 ipf_ftp_softc_t *softf = arg; 1579 ftpinfo_t *ftp; 1580 int rev; 1581 1582 ftp = aps->aps_data; 1583 if (ftp == NULL) 1584 return 0; 1585 1586 rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1; 1587 if (ftp->ftp_side[1 - rev].ftps_ifp == NULL) 1588 ftp->ftp_side[1 - rev].ftps_ifp = fin->fin_ifp; 1589 1590 return ipf_p_ftp_process(softf, fin, nat, ftp, rev); 1591 } 1592 1593 1594 int 1595 ipf_p_ftp_in(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 1596 { 1597 ipf_ftp_softc_t *softf = arg; 1598 ftpinfo_t *ftp; 1599 int rev; 1600 1601 ftp = aps->aps_data; 1602 if (ftp == NULL) 1603 return 0; 1604 1605 rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1; 1606 if (ftp->ftp_side[rev].ftps_ifp == NULL) 1607 ftp->ftp_side[rev].ftps_ifp = fin->fin_ifp; 1608 1609 return ipf_p_ftp_process(softf, fin, nat, ftp, 1 - rev); 1610 } 1611 1612 1613 /* 1614 * ipf_p_ftp_atoi - implement a version of atoi which processes numbers in 1615 * pairs separated by commas (which are expected to be in the range 0 - 255), 1616 * returning a 16 bit number combining either side of the , as the MSB and 1617 * LSB. 1618 */ 1619 u_short 1620 ipf_p_ftp_atoi(char **ptr) 1621 { 1622 register char *s = *ptr, c; 1623 register u_char i = 0, j = 0; 1624 1625 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1626 i *= 10; 1627 i += c - '0'; 1628 } 1629 if (c != ',') { 1630 *ptr = NULL; 1631 return 0; 1632 } 1633 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1634 j *= 10; 1635 j += c - '0'; 1636 } 1637 *ptr = s; 1638 i &= 0xff; 1639 j &= 0xff; 1640 return (i << 8) | j; 1641 } 1642 1643 1644 int 1645 ipf_p_ftp_eprt(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 1646 ftpinfo_t *ftp, int dlen) 1647 { 1648 ftpside_t *f; 1649 1650 /* 1651 * Check for client sending out EPRT message. 1652 */ 1653 if (dlen < IPF_MINEPRTLEN) { 1654 DT1(epert_dlen, int, dlen); 1655 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1656 printf("ipf_p_ftp_eprt:dlen(%d) < IPF_MINEPRTLEN\n", 1657 dlen); 1658 return 0; 1659 } 1660 1661 /* 1662 * Parse the EPRT command. Format is: 1663 * "EPRT |1|1.2.3.4|2000|" for IPv4 and 1664 * "EPRT |2|ef00::1:2|2000|" for IPv6 1665 */ 1666 f = &ftp->ftp_side[0]; 1667 if (f->ftps_rptr[5] != '|') 1668 return 0; 1669 if (f->ftps_rptr[5] == f->ftps_rptr[7]) { 1670 if (f->ftps_rptr[6] == '1' && nat->nat_v[0] == 4) 1671 return ipf_p_ftp_eprt4(softf, fin, ip, nat, ftp, dlen); 1672 if (f->ftps_rptr[6] == '2' && nat->nat_v[0] == 6) 1673 return ipf_p_ftp_eprt6(softf, fin, ip, nat, ftp, dlen); 1674 } 1675 return 0; 1676 } 1677 1678 1679 int 1680 ipf_p_ftp_eprt4(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 1681 ftpinfo_t *ftp, int dlen) 1682 { 1683 int a1, a2, a3, a4, port, olen, nlen, inc, off; 1684 char newbuf[IPF_FTPBUFSZ]; 1685 char *s, c, delim; 1686 u_32_t addr, i; 1687 tcphdr_t *tcp; 1688 ftpside_t *f; 1689 mb_t *m; 1690 1691 m = fin->fin_m; 1692 tcp = (tcphdr_t *)fin->fin_dp; 1693 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 1694 f = &ftp->ftp_side[0]; 1695 delim = f->ftps_rptr[5]; 1696 s = f->ftps_rptr + 8; 1697 1698 /* 1699 * get the IP address. 1700 */ 1701 i = 0; 1702 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1703 i *= 10; 1704 i += c - '0'; 1705 } 1706 if (i > 255) 1707 return 0; 1708 if (c != '.') 1709 return 0; 1710 addr = (i << 24); 1711 1712 i = 0; 1713 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1714 i *= 10; 1715 i += c - '0'; 1716 } 1717 if (i > 255) 1718 return 0; 1719 if (c != '.') 1720 return 0; 1721 addr |= (addr << 16); 1722 1723 i = 0; 1724 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1725 i *= 10; 1726 i += c - '0'; 1727 } 1728 if (i > 255) 1729 return 0; 1730 if (c != '.') 1731 return 0; 1732 addr |= (addr << 8); 1733 1734 i = 0; 1735 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1736 i *= 10; 1737 i += c - '0'; 1738 } 1739 if (i > 255) 1740 return 0; 1741 if (c != delim) 1742 return 0; 1743 addr |= addr; 1744 1745 /* 1746 * Get the port number 1747 */ 1748 i = 0; 1749 while (((c = *s++) != '\0') && ISDIGIT(c)) { 1750 i *= 10; 1751 i += c - '0'; 1752 } 1753 if (i > 65535) 1754 return 0; 1755 if (c != delim) 1756 return 0; 1757 port = i; 1758 1759 /* 1760 * Check for CR-LF at the end of the command string. 1761 */ 1762 if ((*s != '\r') || (*(s + 1) != '\n')) { 1763 DT(eprt4_no_crlf); 1764 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1765 printf("ipf_p_ftp_eprt4:missing %s\n", "cr-lf"); 1766 return 0; 1767 } 1768 s += 2; 1769 1770 /* 1771 * Calculate new address parts for PORT command 1772 */ 1773 if (nat->nat_dir == NAT_INBOUND) 1774 a1 = ntohl(nat->nat_odstaddr); 1775 else 1776 a1 = ntohl(ip->ip_src.s_addr); 1777 a2 = (a1 >> 16) & 0xff; 1778 a3 = (a1 >> 8) & 0xff; 1779 a4 = a1 & 0xff; 1780 a1 >>= 24; 1781 olen = s - f->ftps_rptr; 1782 /* DO NOT change this to snprintf! */ 1783 /* 1784 * While we could force the use of | as a delimiter here, it makes 1785 * sense to preserve whatever character is being used by the systems 1786 * involved in the communication. 1787 */ 1788 #if defined(SNPRINTF) && defined(_KERNEL) 1789 SNPRINTF(newbuf, sizeof(newbuf), "%s %c1%c%u.%u.%u.%u%c%u%c\r\n", 1790 "EPRT", delim, delim, a1, a2, a3, a4, delim, port, delim); 1791 #else 1792 (void) sprintf(newbuf, "%s %c1%c%u.%u.%u.%u%c%u%c\r\n", 1793 "EPRT", delim, delim, a1, a2, a3, a4, delim, port, 1794 delim); 1795 #endif 1796 1797 nlen = strlen(newbuf); 1798 inc = nlen - olen; 1799 if ((inc + fin->fin_plen) > 65535) { 1800 DT2(eprt4_len, int, inc, int, fin->fin_plen); 1801 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 1802 printf("ipf_p_ftp_eprt4:inc(%d) + ip->ip_len > 65535\n", 1803 inc); 1804 return 0; 1805 } 1806 1807 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 1808 #if !defined(_KERNEL) 1809 M_ADJ(m, inc); 1810 #else 1811 if (inc < 0) 1812 M_ADJ(m, inc); 1813 #endif 1814 /* the mbuf chain will be extended if necessary by m_copyback() */ 1815 COPYBACK(m, off, nlen, newbuf); 1816 fin->fin_flx |= FI_DOCKSUM; 1817 1818 if (inc != 0) { 1819 fin->fin_plen += inc; 1820 ip->ip_len = htons(fin->fin_plen); 1821 fin->fin_dlen += inc; 1822 } 1823 1824 f->ftps_cmd = FTPXY_C_EPRT; 1825 return ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, port, inc); 1826 } 1827 1828 1829 int 1830 ipf_p_ftp_epsv(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat, 1831 ftpinfo_t *ftp, int dlen) 1832 { 1833 char newbuf[IPF_FTPBUFSZ]; 1834 u_short ap = 0; 1835 ftpside_t *f; 1836 char *s; 1837 1838 if ((softf->ipf_p_ftp_forcepasv != 0) && 1839 (ftp->ftp_side[0].ftps_cmd != FTPXY_C_EPSV)) { 1840 DT1(epsv_cmd, int, ftp->ftp_side[0].ftps_cmd); 1841 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 1842 printf("ipf_p_ftp_epsv:ftps_cmd(%d) != FTPXY_C_EPSV\n", 1843 ftp->ftp_side[0].ftps_cmd); 1844 return 0; 1845 } 1846 f = &ftp->ftp_side[1]; 1847 1848 #define EPSV_REPLEN 33 1849 /* 1850 * Check for EPSV reply message. 1851 */ 1852 if (dlen < IPF_MIN229LEN) { 1853 return (0); 1854 } else if (strncmp(f->ftps_rptr, 1855 "229 Entering Extended Passive Mode", EPSV_REPLEN)) { 1856 return (0); 1857 } 1858 1859 /* 1860 * Skip the EPSV command + space 1861 */ 1862 s = f->ftps_rptr + 33; 1863 while (*s && !ISDIGIT(*s)) 1864 s++; 1865 1866 /* 1867 * As per RFC 2428, there are no addres components in the EPSV 1868 * response. So we'll go straight to getting the port. 1869 */ 1870 while (*s && ISDIGIT(*s)) { 1871 ap *= 10; 1872 ap += *s++ - '0'; 1873 } 1874 1875 if (!s) { 1876 return 0; 1877 } 1878 1879 if (*s == '|') 1880 s++; 1881 if (*s == ')') 1882 s++; 1883 if (*s == '\n') 1884 s--; 1885 /* 1886 * check for CR-LF at the end. 1887 */ 1888 if ((*s != '\r') || (*(s + 1) != '\n')) { 1889 return 0; 1890 } 1891 s += 2; 1892 1893 #if defined(SNPRINTF) && defined(_KERNEL) 1894 SNPRINTF(newbuf, sizeof(newbuf), "%s (|||%u|)\r\n", 1895 "229 Entering Extended Passive Mode", ap); 1896 #else 1897 (void) sprintf(newbuf, "%s (|||%u|)\r\n", 1898 "229 Entering Extended Passive Mode", ap); 1899 #endif 1900 1901 return ipf_p_ftp_pasvreply(softf, fin, ip, nat, ftp, (u_int)ap, 1902 newbuf, s); 1903 } 1904 1905 1906 int 1907 ipf_p_ftp_eprt6(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, 1908 nat_t *nat, ftpinfo_t *ftp, int dlen) 1909 { 1910 int port, olen, nlen, inc, off, left, i; 1911 char newbuf[IPF_FTPBUFSZ]; 1912 char *s, c; 1913 i6addr_t addr, *a6; 1914 tcphdr_t *tcp; 1915 ip6_t *ip6; 1916 char delim; 1917 u_short whole; 1918 u_short part; 1919 ftpside_t *f; 1920 u_short *t; 1921 int fwd; 1922 mb_t *m; 1923 u_32_t a; 1924 1925 m = fin->fin_m; 1926 ip6 = (ip6_t *)ip; 1927 f = &ftp->ftp_side[0]; 1928 s = f->ftps_rptr + 8; 1929 f = &ftp->ftp_side[0]; 1930 delim = f->ftps_rptr[5]; 1931 tcp = (tcphdr_t *)fin->fin_dp; 1932 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 1933 1934 addr.i6[0] = 0; 1935 addr.i6[1] = 0; 1936 addr.i6[2] = 0; 1937 addr.i6[3] = 0; 1938 /* 1939 * Parse an IPv6 address. 1940 * Go forward until either :: or | is found. If :: is found, 1941 * reverse direction. Direction change is performed to ease 1942 * parsing an unknown number of 0s in the middle. 1943 */ 1944 whole = 0; 1945 t = (u_short *)&addr; 1946 fwd = 1; 1947 for (part = 0; (c = *s) != '\0'; ) { 1948 if (c == delim) { 1949 *t = htons((u_short)whole); 1950 break; 1951 } 1952 if (c == ':') { 1953 *t = part; 1954 if (fwd) { 1955 *t = htons((u_short)whole); 1956 t++; 1957 } else { 1958 *t = htons((u_short)(whole >> 16)); 1959 t--; 1960 } 1961 whole = 0; 1962 if (fwd == 1 && s[1] == ':') { 1963 while (*s && *s != '|') 1964 s++; 1965 if ((c = *s) != delim) 1966 break; 1967 t = (u_short *)&addr.i6[3]; 1968 t++; 1969 fwd = 0; 1970 } else if (fwd == 0 && s[-1] == ':') { 1971 break; 1972 } 1973 } else { 1974 if (c >= '0' && c <= '9') { 1975 c -= '0'; 1976 } else if (c >= 'a' && c <= 'f') { 1977 c -= 'a' + 10; 1978 } else if (c >= 'A' && c <= 'F') { 1979 c -= 'A' + 10; 1980 } 1981 if (fwd) { 1982 whole <<= 8; 1983 whole |= c; 1984 } else { 1985 whole >>= 8; 1986 whole |= ((u_32_t)c) << 24; 1987 } 1988 } 1989 if (fwd) 1990 s++; 1991 else 1992 s--; 1993 } 1994 if (c != ':' && c != delim) 1995 return 0; 1996 1997 while (*s != '|') 1998 s++; 1999 s++; 2000 2001 /* 2002 * Get the port number 2003 */ 2004 i = 0; 2005 while (((c = *s++) != '\0') && ISDIGIT(c)) { 2006 i *= 10; 2007 i += c - '0'; 2008 } 2009 if (i > 65535) 2010 return 0; 2011 if (c != delim) 2012 return 0; 2013 port = (u_short)(i & 0xffff); 2014 2015 /* 2016 * Check for CR-LF at the end of the command string. 2017 */ 2018 if ((*s != '\r') || (*(s + 1) != '\n')) { 2019 DT(eprt6_no_crlf); 2020 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR) 2021 printf("ipf_p_ftp_eprt6:missing %s\n", "cr-lf"); 2022 return 0; 2023 } 2024 s += 2; 2025 2026 /* 2027 * Calculate new address parts for PORT command 2028 */ 2029 a6 = (i6addr_t *)&ip6->ip6_src; 2030 olen = s - f->ftps_rptr; 2031 /* DO NOT change this to snprintf! */ 2032 /* 2033 * While we could force the use of | as a delimiter here, it makes 2034 * sense to preserve whatever character is being used by the systems 2035 * involved in the communication. 2036 */ 2037 s = newbuf; 2038 left = sizeof(newbuf); 2039 #if defined(SNPRINTF) && defined(_KERNEL) 2040 SNPRINTF(newbuf, left, "EPRT %c2%c", delim, delim); 2041 left -= strlen(s) + 1; 2042 s += strlen(s); 2043 a = ntohl(a6->i6[0]); 2044 SNPRINTF(s, left, "%x:%x:", a >> 16, a & 0xffff); 2045 left -= strlen(s); 2046 s += strlen(s); 2047 a = ntohl(a6->i6[1]); 2048 SNPRINTF(s, left, "%x:%x:", a >> 16, a & 0xffff); 2049 left -= strlen(s); 2050 s += strlen(s); 2051 a = ntohl(a6->i6[2]); 2052 SNPRINTF(s, left, "%x:%x:", a >> 16, a & 0xffff); 2053 left -= strlen(s); 2054 s += strlen(s); 2055 a = ntohl(a6->i6[3]); 2056 SNPRINTF(s, left, "%x:%x", a >> 16, a & 0xffff); 2057 left -= strlen(s); 2058 s += strlen(s); 2059 sprintf(s, "|%d|\r\n", port); 2060 #else 2061 (void) sprintf(s, "EPRT %c2%c", delim, delim); 2062 s += strlen(s); 2063 a = ntohl(a6->i6[0]); 2064 sprintf(s, "%x:%x:", a >> 16, a & 0xffff); 2065 s += strlen(s); 2066 a = ntohl(a6->i6[1]); 2067 sprintf(s, "%x:%x:", a >> 16, a & 0xffff); 2068 left -= strlen(s); 2069 s += strlen(s); 2070 a = ntohl(a6->i6[2]); 2071 sprintf(s, "%x:%x:", a >> 16, a & 0xffff); 2072 left -= strlen(s); 2073 s += strlen(s); 2074 a = ntohl(a6->i6[3]); 2075 sprintf(s, "%x:%x", a >> 16, a & 0xffff); 2076 left -= strlen(s); 2077 s += strlen(s); 2078 sprintf(s, "|%d|\r\n", port); 2079 #endif 2080 nlen = strlen(newbuf); 2081 inc = nlen - olen; 2082 if ((inc + fin->fin_plen) > 65535) { 2083 DT2(eprt6_len, int, inc, int, fin->fin_plen); 2084 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) 2085 printf("ipf_p_ftp_eprt6:inc(%d) + ip->ip_len > 65535\n", 2086 inc); 2087 return 0; 2088 } 2089 2090 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 2091 #if !defined(_KERNEL) 2092 M_ADJ(m, inc); 2093 #else 2094 if (inc < 0) 2095 M_ADJ(m, inc); 2096 #endif 2097 /* the mbuf chain will be extended if necessary by m_copyback() */ 2098 COPYBACK(m, off, nlen, newbuf); 2099 fin->fin_flx |= FI_DOCKSUM; 2100 2101 if (inc != 0) { 2102 fin->fin_plen += inc; 2103 ip6->ip6_plen = htons(fin->fin_plen - fin->fin_hlen); 2104 fin->fin_dlen += inc; 2105 } 2106 2107 f->ftps_cmd = FTPXY_C_EPRT; 2108 return ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, port, inc); 2109 } 2110
Indexes created Mon Sep 29 21:09:56 GMT 2025