1
2 /*
3 * Copyright (C) 2012 by Darren Reed.
4 *
5 * See the IPFILTER.LICENCE file for details on licencing.
6 *
7 * Simple FTP transparent proxy for in-kernel use. For use with the NAT
8 * code.
9 * Id: ip_ftp_pxy.c,v 2.88.2.19 2006/04/01 10:14:53 darrenr Exp $
10 */
11
12 #define IPF_FTP_PROXY
13
14 #define IPF_MINPORTLEN 18
15 #define IPF_MINEPRTLEN 20
16 #define IPF_MAXPORTLEN 30
17 #define IPF_MIN227LEN 39
18 #define IPF_MAX227LEN 51
19 #define IPF_MIN229LEN 47
20 #define IPF_MAX229LEN 51
21
22 #define FTPXY_GO 0
23 #define FTPXY_INIT 1
24 #define FTPXY_USER_1 2
25 #define FTPXY_USOK_1 3
26 #define FTPXY_PASS_1 4
27 #define FTPXY_PAOK_1 5
28 #define FTPXY_AUTH_1 6
29 #define FTPXY_AUOK_1 7
30 #define FTPXY_ADAT_1 8
31 #define FTPXY_ADOK_1 9
32 #define FTPXY_ACCT_1 10
33 #define FTPXY_ACOK_1 11
34 #define FTPXY_USER_2 12
35 #define FTPXY_USOK_2 13
36 #define FTPXY_PASS_2 14
37 #define FTPXY_PAOK_2 15
38
39 #define FTPXY_JUNK_OK 0
40 #define FTPXY_JUNK_BAD 1 /* Ignore all commands for this connection */
41 #define FTPXY_JUNK_EOL 2 /* consume the rest of this line only */
42 #define FTPXY_JUNK_CONT 3 /* Saerching for next numeric */
43
44 /*
45 * Values for FTP commands. Numerics cover 0-999
46 */
47 #define FTPXY_C_PASV 1000
48 #define FTPXY_C_PORT 1001
49 #define FTPXY_C_EPSV 1002
50 #define FTPXY_C_EPRT 1003
51
52
53 typedef struct ipf_ftp_softc_s {
54 int ipf_p_ftp_pasvonly;
55 /* Do not require logins before transfers */
56 int ipf_p_ftp_insecure;
57 int ipf_p_ftp_pasvrdr;
58 /* PASV must be last command prior to 227 */
59 int ipf_p_ftp_forcepasv;
60 int ipf_p_ftp_debug;
61 int ipf_p_ftp_single_xfer;
62 void *ipf_p_ftp_tune;
63 } ipf_ftp_softc_t;
64
65
66 void ipf_p_ftp_main_load(void);
67 void ipf_p_ftp_main_unload(void);
68 void *ipf_p_ftp_soft_create(ipf_main_softc_t *);
69 void ipf_p_ftp_soft_destroy(ipf_main_softc_t *, void *);
70
71 int ipf_p_ftp_client(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
72 ftpinfo_t *, int);
73 int ipf_p_ftp_complete(char *, size_t);
74 int ipf_p_ftp_in(void *, fr_info_t *, ap_session_t *, nat_t *);
75 int ipf_p_ftp_new(void *, fr_info_t *, ap_session_t *, nat_t *);
76 void ipf_p_ftp_del(ipf_main_softc_t *, ap_session_t *);
77 int ipf_p_ftp_out(void *, fr_info_t *, ap_session_t *, nat_t *);
78 int ipf_p_ftp_pasv(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
79 ftpinfo_t *, int);
80 int ipf_p_ftp_epsv(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
81 ftpinfo_t *, int);
82 int ipf_p_ftp_port(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
83 ftpinfo_t *, int);
84 int ipf_p_ftp_process(ipf_ftp_softc_t *, fr_info_t *, nat_t *,
85 ftpinfo_t *, int);
86 int ipf_p_ftp_server(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
87 ftpinfo_t *, int);
88 int ipf_p_ftp_valid(ipf_ftp_softc_t *, ftpinfo_t *, int, char *, size_t);
89 int ipf_p_ftp_server_valid(ipf_ftp_softc_t *, ftpside_t *, char *,
90 size_t);
91 int ipf_p_ftp_client_valid(ipf_ftp_softc_t *, ftpside_t *, char *,
92 size_t);
93 u_short ipf_p_ftp_atoi(char **);
94 int ipf_p_ftp_pasvreply(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
95 ftpinfo_t *, u_int, char *, char *);
96 int ipf_p_ftp_eprt(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
97 ftpinfo_t *, int);
98 int ipf_p_ftp_eprt4(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
99 ftpinfo_t *, int);
100 int ipf_p_ftp_eprt6(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
101 ftpinfo_t *, int);
102 int ipf_p_ftp_addport(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
103 ftpinfo_t *, int, int, int);
104 void ipf_p_ftp_setpending(ipf_main_softc_t *, ftpinfo_t *);
105
106 /*
107 * Debug levels
108 */
109 #define DEBUG_SECURITY 0x01
110 #define DEBUG_ERROR 0x02
111 #define DEBUG_INFO 0x04
112 #define DEBUG_PARSE_ERR 0x08
113 #define DEBUG_PARSE_INFO 0x10
114 #define DEBUG_PARSE 0x20
115
116 static int ipf_p_ftp_proxy_init = 0;
117 static frentry_t ftppxyfr;
118 static ipftuneable_t ipf_ftp_tuneables[] = {
119 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_debug) },
120 "ftp_debug", 0, 0x7f,
121 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_debug),
122 0, NULL, NULL },
123 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_pasvonly) },
124 "ftp_pasvonly", 0, 1,
125 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_pasvonly),
126 0, NULL, NULL },
127 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_insecure) },
128 "ftp_insecure", 0, 1,
129 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_insecure),
130 0, NULL, NULL },
131 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_pasvrdr) },
132 "ftp_pasvrdr", 0, 1,
133 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_pasvrdr),
134 0, NULL, NULL },
135 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_forcepasv) },
136 "ftp_forcepasv", 0, 1,
137 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_forcepasv),
138 0, NULL, NULL },
139 { { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_single_xfer) },
140 "ftp_single_xfer", 0, 1,
141 stsizeof(ipf_ftp_softc_t, ipf_p_ftp_single_xfer),
142 0, NULL, NULL },
143 { { NULL }, NULL, 0, 0, 0, 0, NULL, NULL }
144 };
145
146
147 void
ipf_p_ftp_main_load(void)148 ipf_p_ftp_main_load(void)
149 {
150 bzero((char *)&ftppxyfr, sizeof(ftppxyfr));
151 ftppxyfr.fr_ref = 1;
152 ftppxyfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
153
154 MUTEX_INIT(&ftppxyfr.fr_lock, "FTP Proxy Mutex");
155 ipf_p_ftp_proxy_init = 1;
156 }
157
158
159 void
ipf_p_ftp_main_unload(void)160 ipf_p_ftp_main_unload(void)
161 {
162
163 if (ipf_p_ftp_proxy_init == 1) {
164 MUTEX_DESTROY(&ftppxyfr.fr_lock);
165 ipf_p_ftp_proxy_init = 0;
166 }
167 }
168
169
170 /*
171 * Initialize local structures.
172 */
173 void *
ipf_p_ftp_soft_create(ipf_main_softc_t * softc)174 ipf_p_ftp_soft_create(ipf_main_softc_t *softc)
175 {
176 ipf_ftp_softc_t *softf;
177
178 KMALLOC(softf, ipf_ftp_softc_t *);
179 if (softf == NULL)
180 return (NULL);
181
182 bzero((char *)softf, sizeof(*softf));
183 #if defined(_KERNEL)
184 softf->ipf_p_ftp_debug = 0;
185 #else
186 softf->ipf_p_ftp_debug = DEBUG_PARSE_ERR;
187 #endif
188 softf->ipf_p_ftp_forcepasv = 1;
189
190 softf->ipf_p_ftp_tune = ipf_tune_array_copy(softf,
191 sizeof(ipf_ftp_tuneables),
192 ipf_ftp_tuneables);
193 if (softf->ipf_p_ftp_tune == NULL) {
194 ipf_p_ftp_soft_destroy(softc, softf);
195 return (NULL);
196 }
197 if (ipf_tune_array_link(softc, softf->ipf_p_ftp_tune) == -1) {
198 ipf_p_ftp_soft_destroy(softc, softf);
199 return (NULL);
200 }
201
202 return (softf);
203 }
204
205
206 void
ipf_p_ftp_soft_destroy(ipf_main_softc_t * softc,void * arg)207 ipf_p_ftp_soft_destroy(ipf_main_softc_t *softc, void *arg)
208 {
209 ipf_ftp_softc_t *softf = arg;
210
211 if (softf->ipf_p_ftp_tune != NULL) {
212 ipf_tune_array_unlink(softc, softf->ipf_p_ftp_tune);
213 KFREES(softf->ipf_p_ftp_tune, sizeof(ipf_ftp_tuneables));
214 softf->ipf_p_ftp_tune = NULL;
215 }
216
217 KFREE(softf);
218 }
219
220
221 int
ipf_p_ftp_new(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)222 ipf_p_ftp_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
223 {
224 ftpinfo_t *ftp;
225 ftpside_t *f;
226
227 KMALLOC(ftp, ftpinfo_t *);
228 if (ftp == NULL)
229 return (-1);
230
231 nat = nat; /* LINT */
232
233 aps->aps_data = ftp;
234 aps->aps_psiz = sizeof(ftpinfo_t);
235 aps->aps_sport = htons(fin->fin_sport);
236 aps->aps_dport = htons(fin->fin_dport);
237
238 bzero((char *)ftp, sizeof(*ftp));
239 f = &ftp->ftp_side[0];
240 f->ftps_rptr = f->ftps_buf;
241 f->ftps_wptr = f->ftps_buf;
242 f = &ftp->ftp_side[1];
243 f->ftps_rptr = f->ftps_buf;
244 f->ftps_wptr = f->ftps_buf;
245 ftp->ftp_passok = FTPXY_INIT;
246 ftp->ftp_incok = 0;
247 return (0);
248 }
249
250
251 void
ipf_p_ftp_setpending(ipf_main_softc_t * softc,ftpinfo_t * ftp)252 ipf_p_ftp_setpending(ipf_main_softc_t *softc, ftpinfo_t *ftp)
253 {
254 if (ftp->ftp_pendnat != NULL)
255 ipf_nat_setpending(softc, ftp->ftp_pendnat);
256
257 if (ftp->ftp_pendstate != NULL) {
258 READ_ENTER(&softc->ipf_state);
259 ipf_state_setpending(softc, ftp->ftp_pendstate);
260 RWLOCK_EXIT(&softc->ipf_state);
261 }
262 }
263
264
265 void
ipf_p_ftp_del(softc,aps)266 ipf_p_ftp_del(softc, aps)
267 ipf_main_softc_t *softc;
268 ap_session_t *aps;
269 {
270 ftpinfo_t *ftp;
271
272 ftp = aps->aps_data;
273 if (ftp != NULL)
274 ipf_p_ftp_setpending(softc, ftp);
275 }
276
277
278 int
ipf_p_ftp_port(ipf_ftp_softc_t * softf,fr_info_t * fin,ip_t * ip,nat_t * nat,ftpinfo_t * ftp,int dlen)279 ipf_p_ftp_port(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
280 ftpinfo_t *ftp, int dlen)
281 {
282 char newbuf[IPF_FTPBUFSZ], *s;
283 u_int a1, a2, a3, a4;
284 u_short a5, a6, sp;
285 size_t nlen, olen;
286 tcphdr_t *tcp;
287 int inc, off;
288 ftpside_t *f;
289 mb_t *m;
290
291 m = fin->fin_m;
292 f = &ftp->ftp_side[0];
293 tcp = (tcphdr_t *)fin->fin_dp;
294 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
295
296 /*
297 * Check for client sending out PORT message.
298 */
299 if (dlen < IPF_MINPORTLEN) {
300 DT3(ftp_PORT_error_dlen, nat_t *, nat, ftpside_t *, f,
301 u_int, dlen);
302 if (softf->ipf_p_ftp_debug & DEBUG_PARSE)
303 printf("ipf_p_ftp_port:dlen(%d) < IPF_MINPORTLEN\n",
304 dlen);
305 return (0);
306 }
307 /*
308 * Skip the PORT command + space
309 */
310 s = f->ftps_rptr + 5;
311 /*
312 * Pick out the address components, two at a time.
313 */
314 a1 = ipf_p_ftp_atoi(&s);
315 if (s == NULL) {
316 DT2(ftp_PORT_error_atoi_1, nat_t *, nat, ftpside_t *, f);
317 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
318 printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 1);
319 return (0);
320 }
321 a2 = ipf_p_ftp_atoi(&s);
322 if (s == NULL) {
323 DT2(ftp_PORT_error_atoi_2, nat_t *, nat, ftpside_t *, f);
324 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
325 printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 2);
326 return (0);
327 }
328
329 /*
330 * Check that IP address in the PORT/PASV reply is the same as the
331 * sender of the command - prevents using PORT for port scanning.
332 */
333 a1 <<= 16;
334 a1 |= a2;
335 if (((nat->nat_dir == NAT_OUTBOUND) &&
336 (a1 != ntohl(nat->nat_osrcaddr))) ||
337 ((nat->nat_dir == NAT_INBOUND) &&
338 (a1 != ntohl(nat->nat_nsrcaddr)))) {
339 DT3(ftp_PORT_error_address, nat_t *, nat, ftpside_t *, f,
340 u_int, a1);
341 if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
342 printf("ipf_p_ftp_port:%s != nat->nat_inip\n", "a1");
343 return (APR_ERR(1));
344 }
345
346 a5 = ipf_p_ftp_atoi(&s);
347 if (s == NULL) {
348 DT2(ftp_PORT_error_atoi_3, nat_t *, nat, ftpside_t *, f);
349 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
350 printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 3);
351 return (0);
352 }
353 if (*s == ')')
354 s++;
355
356 /*
357 * check for CR-LF at the end.
358 */
359 if (*s == '\n')
360 s--;
361 if ((*s != '\r') || (*(s + 1) != '\n')) {
362 DT2(ftp_PORT_error_no_crlf, nat_t *, nat, ftpside_t *, f);
363 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
364 printf("ipf_p_ftp_port:missing %s\n", "cr-lf");
365 return (0);
366 }
367 s += 2;
368 a6 = a5 & 0xff;
369
370 /*
371 * Calculate the source port. Verification of > 1024 is in
372 * ipf_p_ftp_addport.
373 */
374 a5 >>= 8;
375 a5 &= 0xff;
376 sp = a5 << 8 | a6;
377
378 /*
379 * Calculate new address parts for PORT command
380 */
381 if (nat->nat_dir == NAT_INBOUND)
382 a1 = ntohl(nat->nat_ndstaddr);
383 else
384 a1 = ntohl(ip->ip_src.s_addr);
385 a1 = ntohl(ip->ip_src.s_addr);
386 a2 = (a1 >> 16) & 0xff;
387 a3 = (a1 >> 8) & 0xff;
388 a4 = a1 & 0xff;
389 a1 >>= 24;
390 olen = s - f->ftps_rptr;
391 (void) snprintf(newbuf, sizeof(newbuf), "%s %u,%u,%u,%u,%u,%u\r\n",
392 "PORT", a1, a2, a3, a4, a5, a6);
393
394 nlen = strlen(newbuf);
395 inc = nlen - olen;
396 if ((inc + fin->fin_plen) > 65535) {
397 DT3(ftp_PORT_error_inc, nat_t *, nat, ftpside_t *, f,
398 int, inc);
399 if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
400 printf("ipf_p_ftp_port:inc(%d) + ip->ip_len > 65535\n",
401 inc);
402 return (0);
403 }
404
405 #if !defined(_KERNEL)
406 M_ADJ(m, inc);
407 #else
408 /*
409 * m_adj takes care of pkthdr.len, if required and treats inc<0 to
410 * mean remove -len bytes from the end of the packet.
411 * The mbuf chain will be extended if necessary by m_copyback().
412 */
413 if (inc < 0)
414 M_ADJ(m, inc);
415 #endif /* !defined(_KERNEL) */
416 COPYBACK(m, off, nlen, newbuf);
417 fin->fin_flx |= FI_DOCKSUM;
418
419 if (inc != 0) {
420 fin->fin_plen += inc;
421 ip->ip_len = htons(fin->fin_plen);
422 fin->fin_dlen += inc;
423 }
424
425 f->ftps_cmd = FTPXY_C_PORT;
426 return (ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, sp, inc));
427 }
428
429
430 int
ipf_p_ftp_addport(ipf_ftp_softc_t * softf,fr_info_t * fin,ip_t * ip,nat_t * nat,ftpinfo_t * ftp,int dlen,int nport,int inc)431 ipf_p_ftp_addport(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
432 ftpinfo_t *ftp, int dlen, int nport, int inc)
433 {
434 tcphdr_t tcph, *tcp2 = &tcph;
435 ipf_main_softc_t *softc;
436 ipf_nat_softc_t *softn;
437 int direction;
438 fr_info_t fi;
439 ipnat_t *ipn;
440 nat_t *nat2;
441 u_short sp;
442 int flags;
443
444 softc = fin->fin_main_soft;
445 softn = softc->ipf_nat_soft;
446
447 if ((ftp->ftp_pendnat != NULL) || (ftp->ftp_pendstate != NULL)) {
448 if (softf->ipf_p_ftp_single_xfer != 0) {
449 DT2(ftp_PORT_error_add_active, nat_t *, nat,
450 ftpinfo_t *, ftp);
451 if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
452 printf("ipf_p_ftp_addport:xfer active %p/%p\n",
453 ftp->ftp_pendnat, ftp->ftp_pendstate);
454 return (0);
455 }
456 ipf_p_ftp_setpending(softc, ftp);
457 }
458
459 /*
460 * Add skeleton NAT entry for connection which will come back the
461 * other way.
462 */
463 sp = nport;
464 /*
465 * Don't allow the PORT command to specify a port < 1024 due to
466 * security risks.
467 */
468 if (sp < 1024) {
469 DT3(ftp_PORT_error_port, nat_t *, nat, ftpinfo_t *, ftp,
470 u_int, sp);
471 if (softf->ipf_p_ftp_debug & DEBUG_SECURITY)
472 printf("ipf_p_ftp_addport:sp(%d) < 1024\n", sp);
473 return (0);
474 }
475 /*
476 * The server may not make the connection back from port 20, but
477 * it is the most likely so use it here to check for a conflicting
478 * mapping.
479 */
480 bcopy((char *)fin, (char *)&fi, sizeof(fi));
481 fi.fin_flx |= FI_IGNORE;
482 fi.fin_data[0] = sp;
483 fi.fin_data[1] = fin->fin_data[1] - 1;
484 fi.fin_src6 = nat->nat_ndst6;
485 fi.fin_dst6 = nat->nat_nsrc6;
486
487 #ifndef USE_INET6
488 if (nat->nat_v[0] == 6)
489 return (APR_INC(inc));
490 #endif
491
492 /*
493 * If an existing entry already exists, use it instead.
494 */
495 #ifdef USE_INET6
496 if (nat->nat_v[0] == 6) {
497 if (nat->nat_dir == NAT_OUTBOUND) {
498 nat2 = ipf_nat6_outlookup(&fi, IPN_TCP|NAT_SEARCH,
499 nat->nat_pr[1],
500 &nat->nat_osrc6.in6,
501 &nat->nat_odst6.in6);
502 } else {
503 nat2 = ipf_nat6_inlookup(&fi, IPN_TCP|NAT_SEARCH,
504 nat->nat_pr[0],
505 &nat->nat_odst6.in6,
506 &nat->nat_osrc6.in6);
507 }
508 } else
509 #endif
510 {
511 if (nat->nat_dir == NAT_OUTBOUND) {
512 nat2 = ipf_nat_outlookup(&fi, IPN_TCP|NAT_SEARCH,
513 nat->nat_pr[1],
514 nat->nat_osrcip,
515 nat->nat_odstip);
516 } else {
517 nat2 = ipf_nat_inlookup(&fi, IPN_TCP|NAT_SEARCH,
518 nat->nat_pr[0],
519 nat->nat_odstip,
520 nat->nat_osrcip);
521 }
522 }
523 if (nat2 != NULL)
524 return (APR_INC(inc));
525
526 /*
527 * An existing entry doesn't exist. Let's make one.
528 */
529 ipn = ipf_proxy_rule_rev(nat);
530 if (ipn == NULL)
531 return (APR_ERR(1));
532 ipn->in_use = 0;
533
534 fi.fin_fr = &ftppxyfr;
535 fi.fin_dp = (char *)tcp2;
536 fi.fin_dlen = sizeof(*tcp2);
537 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2);
538 fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE;
539 fi.fin_data[1] = sp;
540 fi.fin_data[0] = 0;
541
542 bzero((char *)tcp2, sizeof(*tcp2));
543 tcp2->th_sport = 0;
544 tcp2->th_dport = htons(sp);
545
546 tcp2->th_win = htons(8192);
547 TCP_OFF_A(tcp2, 5);
548 tcp2->th_flags = TH_SYN;
549
550 if (nat->nat_dir == NAT_INBOUND) {
551 fi.fin_out = 1;
552 direction = NAT_OUTBOUND;
553 } else {
554 fi.fin_out = 0;
555 direction = NAT_INBOUND;
556 }
557 flags = SI_W_SPORT|NAT_SLAVE|IPN_TCP;
558
559 MUTEX_ENTER(&softn->ipf_nat_new);
560 #ifdef USE_INET6
561 if (nat->nat_v[0] == 6)
562 nat2 = ipf_nat6_add(&fi, ipn, &ftp->ftp_pendnat, flags,
563 direction);
564 else
565 #endif
566 nat2 = ipf_nat_add(&fi, ipn, &ftp->ftp_pendnat, flags,
567 direction);
568 MUTEX_EXIT(&softn->ipf_nat_new);
569
570 if (nat2 == NULL) {
571 KFREES(ipn, ipn->in_size);
572 return (APR_ERR(1));
573 }
574
575 (void) ipf_nat_proto(&fi, nat2, IPN_TCP);
576 MUTEX_ENTER(&nat2->nat_lock);
577 ipf_nat_update(&fi, nat2);
578 MUTEX_EXIT(&nat2->nat_lock);
579 fi.fin_ifp = NULL;
580 if (nat2->nat_dir == NAT_INBOUND)
581 fi.fin_dst6 = nat->nat_osrc6;
582 if (ipf_state_add(softc, &fi, (ipstate_t **)&ftp->ftp_pendstate,
583 SI_W_SPORT) != 0)
584 ipf_nat_setpending(softc, nat2);
585
586 return (APR_INC(inc));
587 }
588
589
590 int
ipf_p_ftp_client(ipf_ftp_softc_t * softf,fr_info_t * fin,ip_t * ip,nat_t * nat,ftpinfo_t * ftp,int dlen)591 ipf_p_ftp_client(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip,
592 nat_t *nat, ftpinfo_t *ftp, int dlen)
593 {
594 char *rptr, *wptr, cmd[6], c;
595 ftpside_t *f;
596 int inc, i;
597
598 inc = 0;
599 f = &ftp->ftp_side[0];
600 rptr = f->ftps_rptr;
601 wptr = f->ftps_wptr;
602
603 for (i = 0; (i < 5) && (i < dlen); i++) {
604 c = rptr[i];
605 if (ISALPHA(c)) {
606 cmd[i] = TOUPPER(c);
607 } else {
608 cmd[i] = c;
609 }
610 }
611 cmd[i] = '\0';
612
613 ftp->ftp_incok = 0;
614 DT2(ftp_client_command, char [], cmd, int, ftp->ftp_passok);
615 if (!strncmp(cmd, "USER ", 5) || !strncmp(cmd, "XAUT ", 5)) {
616 if (ftp->ftp_passok == FTPXY_ADOK_1 ||
617 ftp->ftp_passok == FTPXY_AUOK_1) {
618 ftp->ftp_passok = FTPXY_USER_2;
619 ftp->ftp_incok = 1;
620 } else {
621 ftp->ftp_passok = FTPXY_USER_1;
622 ftp->ftp_incok = 1;
623 }
624 } else if (!strncmp(cmd, "AUTH ", 5)) {
625 ftp->ftp_passok = FTPXY_AUTH_1;
626 ftp->ftp_incok = 1;
627 } else if (!strncmp(cmd, "PASS ", 5)) {
628 if (ftp->ftp_passok == FTPXY_USOK_1) {
629 ftp->ftp_passok = FTPXY_PASS_1;
630 ftp->ftp_incok = 1;
631 } else if (ftp->ftp_passok == FTPXY_USOK_2) {
632 ftp->ftp_passok = FTPXY_PASS_2;
633 ftp->ftp_incok = 1;
634 }
635 } else if ((ftp->ftp_passok == FTPXY_AUOK_1) &&
636 !strncmp(cmd, "ADAT ", 5)) {
637 ftp->ftp_passok = FTPXY_ADAT_1;
638 ftp->ftp_incok = 1;
639 } else if ((ftp->ftp_passok == FTPXY_PAOK_1 ||
640 ftp->ftp_passok == FTPXY_PAOK_2) &&
641 !strncmp(cmd, "ACCT ", 5)) {
642 ftp->ftp_passok = FTPXY_ACCT_1;
643 ftp->ftp_incok = 1;
644 } else if ((ftp->ftp_passok == FTPXY_GO) &&
645 !softf->ipf_p_ftp_pasvonly &&
646 !strncmp(cmd, "PORT ", 5)) {
647 inc = ipf_p_ftp_port(softf, fin, ip, nat, ftp, dlen);
648 } else if ((ftp->ftp_passok == FTPXY_GO) &&
649 !softf->ipf_p_ftp_pasvonly &&
650 !strncmp(cmd, "EPRT ", 5)) {
651 inc = ipf_p_ftp_eprt(softf, fin, ip, nat, ftp, dlen);
652 } else if (softf->ipf_p_ftp_insecure &&
653 !softf->ipf_p_ftp_pasvonly &&
654 !strncmp(cmd, "PORT ", 5)) {
655 inc = ipf_p_ftp_port(softf, fin, ip, nat, ftp, dlen);
656 }
657 if (softf->ipf_p_ftp_debug & DEBUG_PARSE)
658 printf("ipf_p_ftp_client: cmd[%s] passok %d incok %d inc %d\n",
659 cmd, ftp->ftp_passok, ftp->ftp_incok, inc);
660
661 DT2(ftp_client_passok, char *, cmd, int, ftp->ftp_passok);
662 while ((*rptr++ != '\n') && (rptr < wptr))
663 ;
664 f->ftps_rptr = rptr;
665 return (inc);
666 }
667
668
669 int
ipf_p_ftp_pasv(ipf_ftp_softc_t * softf,fr_info_t * fin,ip_t * ip,nat_t * nat,ftpinfo_t * ftp,int dlen)670 ipf_p_ftp_pasv(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
671 ftpinfo_t *ftp, int dlen)
672 {
673 u_int a1, a2, a3, a4, data_ip;
674 char newbuf[IPF_FTPBUFSZ];
675 const char *brackets[2];
676 u_short a5, a6;
677 ftpside_t *f;
678 char *s;
679
680 if ((softf->ipf_p_ftp_forcepasv != 0) &&
681 (ftp->ftp_side[0].ftps_cmd != FTPXY_C_PASV)) {
682 DT2(ftp_PASV_error_state, nat_t *, nat, ftpinfo_t *, ftp);
683 if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
684 printf("ipf_p_ftp_pasv:ftps_cmd(%d) != FTPXY_C_PASV\n",
685 ftp->ftp_side[0].ftps_cmd);
686 return (0);
687 }
688
689 f = &ftp->ftp_side[1];
690
691 #define PASV_REPLEN 24
692 /*
693 * Check for PASV reply message.
694 */
695 if (dlen < IPF_MIN227LEN) {
696 DT3(ftp_PASV_error_short, nat_t *, nat, ftpinfo_t *, ftp,
697 int, dlen);
698 if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
699 printf("ipf_p_ftp_pasv:dlen(%d) < IPF_MIN227LEN\n",
700 dlen);
701 return (0);
702 } else if (strncmp(f->ftps_rptr,
703 "227 Entering Passive Mod", PASV_REPLEN)) {
704 DT2(ftp_PASV_error_string, nat_t *, nat, ftpinfo_t *, ftp);
705 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
706 printf("ipf_p_ftp_pasv:%d reply wrong\n", 227);
707 return (0);
708 }
709
710 brackets[0] = "";
711 brackets[1] = "";
712 /*
713 * Skip the PASV reply + space
714 */
715 s = f->ftps_rptr + PASV_REPLEN;
716 while (*s && !ISDIGIT(*s)) {
717 if (*s == '(') {
718 brackets[0] = "(";
719 brackets[1] = ")";
720 }
721 s++;
722 }
723
724 /*
725 * Pick out the address components, two at a time.
726 */
727 a1 = ipf_p_ftp_atoi(&s);
728 if (s == NULL) {
729 DT2(ftp_PASV_error_atoi_1, nat_t *, nat, ftpside_t *, f);
730 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
731 printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 1);
732 return (0);
733 }
734 a2 = ipf_p_ftp_atoi(&s);
735 if (s == NULL) {
736 DT2(ftp_PASV_error_atoi_2, nat_t *, nat, ftpside_t *, f);
737 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
738 printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 2);
739 return (0);
740 }
741
742 /*
743 * check that IP address in the PASV reply is the same as the
744 * sender of the command - prevents using PASV for port scanning.
745 */
746 a1 <<= 16;
747 a1 |= a2;
748
749 if (((nat->nat_dir == NAT_INBOUND) &&
750 (a1 != ntohl(nat->nat_ndstaddr))) ||
751 ((nat->nat_dir == NAT_OUTBOUND) &&
752 (a1 != ntohl(nat->nat_odstaddr)))) {
753 DT3(ftp_PASV_error_address, nat_t *, nat, ftpside_t *, f,
754 u_int, a1);
755 if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
756 printf("ipf_p_ftp_pasv:%s != nat->nat_oip\n", "a1");
757 return (0);
758 }
759
760 a5 = ipf_p_ftp_atoi(&s);
761 if (s == NULL) {
762 DT2(ftp_PASV_error_atoi_3, nat_t *, nat, ftpside_t *, f);
763 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
764 printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 3);
765 return (0);
766 }
767
768 if (*s == ')')
769 s++;
770 if (*s == '.')
771 s++;
772 if (*s == '\n')
773 s--;
774 /*
775 * check for CR-LF at the end.
776 */
777 if ((*s != '\r') || (*(s + 1) != '\n')) {
778 DT(pasv_missing_crlf);
779 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
780 printf("ipf_p_ftp_pasv:missing %s", "cr-lf\n");
781 return (0);
782 }
783 s += 2;
784
785 a6 = a5 & 0xff;
786 a5 >>= 8;
787 /*
788 * Calculate new address parts for 227 reply
789 */
790 if (nat->nat_dir == NAT_INBOUND) {
791 data_ip = nat->nat_odstaddr;
792 a1 = ntohl(data_ip);
793 } else
794 data_ip = htonl(a1);
795
796 a2 = (a1 >> 16) & 0xff;
797 a3 = (a1 >> 8) & 0xff;
798 a4 = a1 & 0xff;
799 a1 >>= 24;
800
801 (void) snprintf(newbuf, sizeof(newbuf), "%s %s%u,%u,%u,%u,%u,%u%s\r\n",
802 "227 Entering Passive Mode", brackets[0], a1, a2, a3, a4,
803 a5, a6, brackets[1]);
804 return (ipf_p_ftp_pasvreply(softf, fin, ip, nat, ftp, (a5 << 8 | a6),
805 newbuf, s));
806 }
807
808 int
ipf_p_ftp_pasvreply(ipf_ftp_softc_t * softf,fr_info_t * fin,ip_t * ip,nat_t * nat,ftpinfo_t * ftp,u_int port,char * newmsg,char * s)809 ipf_p_ftp_pasvreply(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip,
810 nat_t *nat, ftpinfo_t *ftp, u_int port, char *newmsg, char *s)
811 {
812 int inc, off, nflags;
813 tcphdr_t *tcp, tcph, *tcp2;
814 ipf_main_softc_t *softc;
815 ipf_nat_softc_t *softn;
816 size_t nlen, olen;
817 #ifdef USE_INET6
818 ip6_t *ip6;
819 #endif
820 ipnat_t *ipn;
821 fr_info_t fi;
822 ftpside_t *f;
823 nat_t *nat2;
824 mb_t *m;
825
826 softc = fin->fin_main_soft;
827 softn = softc->ipf_nat_soft;
828
829 if ((ftp->ftp_pendnat != NULL) || (ftp->ftp_pendstate != NULL))
830 ipf_p_ftp_setpending(softc, ftp);
831
832 m = fin->fin_m;
833 tcp = (tcphdr_t *)fin->fin_dp;
834 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
835
836 tcp2 = &tcph;
837 inc = 0;
838
839 f = &ftp->ftp_side[1];
840 olen = s - f->ftps_rptr;
841 nlen = strlen(newmsg);
842 inc = nlen - olen;
843 if ((inc + fin->fin_plen) > 65535) {
844 DT3(ftp_PASV_error_inc, nat_t *, nat, ftpside_t *, f,
845 int, inc);
846 if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
847 printf("ipf_p_ftp_pasv:inc(%d) + ip->ip_len > 65535\n",
848 inc);
849 return (0);
850 }
851
852 ipn = ipf_proxy_rule_fwd(nat);
853 if (ipn == NULL)
854 return (APR_ERR(1));
855 ipn->in_use = 0;
856
857 /*
858 * Add skeleton NAT entry for connection which will come back the
859 * other way.
860 */
861 bzero((char *)tcp2, sizeof(*tcp2));
862 bcopy((char *)fin, (char *)&fi, sizeof(fi));
863 fi.fin_flx |= FI_IGNORE;
864 fi.fin_data[0] = 0;
865 fi.fin_data[1] = port;
866 nflags = IPN_TCP|SI_W_SPORT;
867
868 fi.fin_fr = &ftppxyfr;
869 fi.fin_dp = (char *)tcp2;
870 fi.fin_out = 1 - fin->fin_out;
871 fi.fin_dlen = sizeof(*tcp2);
872 fi.fin_src6 = nat->nat_osrc6;
873 fi.fin_dst6 = nat->nat_odst6;
874 fi.fin_plen = fi.fin_hlen + sizeof(*tcp);
875 fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE;
876
877 TCP_OFF_A(tcp2, 5);
878 tcp2->th_flags = TH_SYN;
879 tcp2->th_win = htons(8192);
880 tcp2->th_dport = htons(port);
881
882 MUTEX_ENTER(&softn->ipf_nat_new);
883 #ifdef USE_INET6
884 if (nat->nat_v[0] == 6)
885 nat2 = ipf_nat6_add(&fi, ipn, &ftp->ftp_pendnat,
886 nflags, nat->nat_dir);
887 else
888 #endif
889 nat2 = ipf_nat_add(&fi, ipn, &ftp->ftp_pendnat,
890 nflags, nat->nat_dir);
891 MUTEX_EXIT(&softn->ipf_nat_new);
892
893 if (nat2 == NULL) {
894 KFREES(ipn, ipn->in_size);
895 return (APR_ERR(1));
896 }
897
898 (void) ipf_nat_proto(&fi, nat2, IPN_TCP);
899 MUTEX_ENTER(&nat2->nat_lock);
900 ipf_nat_update(&fi, nat2);
901 MUTEX_EXIT(&nat2->nat_lock);
902 fi.fin_ifp = NULL;
903 if (nat->nat_dir == NAT_INBOUND) {
904 #ifdef USE_INET6
905 if (nat->nat_v[0] == 6)
906 fi.fin_dst6 = nat->nat_ndst6;
907 else
908 #endif
909 fi.fin_daddr = nat->nat_ndstaddr;
910 }
911 if (ipf_state_add(softc, &fi, (ipstate_t **)&ftp->ftp_pendstate,
912 SI_W_SPORT) != 0)
913 ipf_nat_setpending(softc, nat2);
914
915 #if !defined(_KERNEL)
916 M_ADJ(m, inc);
917 #else
918 /*
919 * m_adj takes care of pkthdr.len, if required and treats inc<0 to
920 * mean remove -len bytes from the end of the packet.
921 * The mbuf chain will be extended if necessary by m_copyback().
922 */
923 if (inc < 0)
924 M_ADJ(m, inc);
925 #endif /* !defined(_KERNEL) */
926 COPYBACK(m, off, nlen, newmsg);
927 fin->fin_flx |= FI_DOCKSUM;
928
929 if (inc != 0) {
930 fin->fin_plen += inc;
931 fin->fin_dlen += inc;
932 #ifdef USE_INET6
933 if (nat->nat_v[0] == 6) {
934 ip6 = (ip6_t *)fin->fin_ip;
935 u_short len = ntohs(ip6->ip6_plen) + inc;
936 ip6->ip6_plen = htons(len);
937 } else
938 #endif
939 ip->ip_len = htons(fin->fin_plen);
940 }
941
942 return (APR_INC(inc));
943 }
944
945
946 int
ipf_p_ftp_server(ipf_ftp_softc_t * softf,fr_info_t * fin,ip_t * ip,nat_t * nat,ftpinfo_t * ftp,int dlen)947 ipf_p_ftp_server(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
948 ftpinfo_t *ftp, int dlen)
949 {
950 char *rptr, *wptr;
951 ftpside_t *f;
952 int inc;
953
954 inc = 0;
955 f = &ftp->ftp_side[1];
956 rptr = f->ftps_rptr;
957 wptr = f->ftps_wptr;
958
959 DT2(ftp_server_response, char *, rptr, int, ftp->ftp_passok);
960 if (*rptr == ' ')
961 goto server_cmd_ok;
962 if (!ISDIGIT(*rptr) || !ISDIGIT(*(rptr + 1)) || !ISDIGIT(*(rptr + 2)))
963 return (0);
964 if (softf->ipf_p_ftp_debug & DEBUG_PARSE)
965 printf("ipf_p_ftp_server_1: cmd[%4.4s] passok %d\n",
966 rptr, ftp->ftp_passok);
967 if (ftp->ftp_passok == FTPXY_GO) {
968 if (!strncmp(rptr, "227 ", 4))
969 inc = ipf_p_ftp_pasv(softf, fin, ip, nat, ftp, dlen);
970 else if (!strncmp(rptr, "229 ", 4))
971 inc = ipf_p_ftp_epsv(softf, fin, ip, nat, ftp, dlen);
972 else if (strncmp(rptr, "200", 3)) {
973 /*
974 * 200 is returned for a successful command.
975 */
976 ;
977 }
978 } else if (softf->ipf_p_ftp_insecure && !strncmp(rptr, "227 ", 4)) {
979 inc = ipf_p_ftp_pasv(softf, fin, ip, nat, ftp, dlen);
980 } else if (softf->ipf_p_ftp_insecure && !strncmp(rptr, "229 ", 4)) {
981 inc = ipf_p_ftp_epsv(softf, fin, ip, nat, ftp, dlen);
982 } else if (*rptr == '5' || *rptr == '4')
983 ftp->ftp_passok = FTPXY_INIT;
984 else if (ftp->ftp_incok) {
985 if (*rptr == '3') {
986 if (ftp->ftp_passok == FTPXY_ACCT_1)
987 ftp->ftp_passok = FTPXY_GO;
988 else
989 ftp->ftp_passok++;
990 } else if (*rptr == '2') {
991 switch (ftp->ftp_passok)
992 {
993 case FTPXY_USER_1 :
994 case FTPXY_USER_2 :
995 case FTPXY_PASS_1 :
996 case FTPXY_PASS_2 :
997 case FTPXY_ACCT_1 :
998 ftp->ftp_passok = FTPXY_GO;
999 break;
1000 default :
1001 ftp->ftp_passok += 3;
1002 break;
1003 }
1004 }
1005 }
1006 ftp->ftp_incok = 0;
1007 server_cmd_ok:
1008 if (softf->ipf_p_ftp_debug & DEBUG_PARSE)
1009 printf("ipf_p_ftp_server_2: cmd[%4.4s] passok %d\n",
1010 rptr, ftp->ftp_passok);
1011 DT3(ftp_server_passok, char *,rptr, int, ftp->ftp_incok,
1012 int, ftp->ftp_passok);
1013
1014 while ((*rptr++ != '\n') && (rptr < wptr))
1015 ;
1016 f->ftps_rptr = rptr;
1017 return (inc);
1018 }
1019
1020
1021 /*
1022 * 0 FTPXY_JUNK_OK
1023 * 1 FTPXY_JUNK_BAD
1024 * 2 FTPXY_JUNK_EOL
1025 * 3 FTPXY_JUNK_CONT
1026 *
1027 * Look to see if the buffer starts with something which we recognise as
1028 * being the correct syntax for the FTP protocol.
1029 */
1030 int
ipf_p_ftp_client_valid(ipf_ftp_softc_t * softf,ftpside_t * ftps,char * buf,size_t len)1031 ipf_p_ftp_client_valid(ipf_ftp_softc_t *softf, ftpside_t *ftps, char *buf,
1032 size_t len)
1033 {
1034 register char *s, c, pc;
1035 register size_t i = len;
1036 char cmd[5];
1037
1038 s = buf;
1039
1040 if (ftps->ftps_junk == FTPXY_JUNK_BAD)
1041 return (FTPXY_JUNK_BAD);
1042
1043 if (i < 5) {
1044 DT1(client_valid, int, i);
1045 if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
1046 printf("ipf_p_ftp_client_valid:i(%d) < 5\n", (int)i);
1047 return (2);
1048 }
1049
1050 i--;
1051 c = *s++;
1052
1053 if (ISALPHA(c)) {
1054 cmd[0] = TOUPPER(c);
1055 c = *s++;
1056 i--;
1057 if (ISALPHA(c)) {
1058 cmd[1] = TOUPPER(c);
1059 c = *s++;
1060 i--;
1061 if (ISALPHA(c)) {
1062 cmd[2] = TOUPPER(c);
1063 c = *s++;
1064 i--;
1065 if (ISALPHA(c)) {
1066 cmd[3] = TOUPPER(c);
1067 c = *s++;
1068 i--;
1069 if ((c != ' ') && (c != '\r'))
1070 goto bad_client_command;
1071 } else if ((c != ' ') && (c != '\r'))
1072 goto bad_client_command;
1073 } else
1074 goto bad_client_command;
1075 } else
1076 goto bad_client_command;
1077 } else {
1078 bad_client_command:
1079 DT4(client_junk, int, len, int, i, int, c, char *, buf);
1080 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
1081 printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*.*s]\n",
1082 "ipf_p_ftp_client_valid",
1083 ftps->ftps_junk, (int)len, (int)i, c,
1084 (int)len, (int)len, buf);
1085 return (FTPXY_JUNK_BAD);
1086 }
1087
1088 for (; i; i--) {
1089 pc = c;
1090 c = *s++;
1091 if ((pc == '\r') && (c == '\n')) {
1092 cmd[4] = '\0';
1093 if (!strcmp(cmd, "PASV")) {
1094 ftps->ftps_cmd = FTPXY_C_PASV;
1095 } else if (!strcmp(cmd, "EPSV")) {
1096 ftps->ftps_cmd = FTPXY_C_EPSV;
1097 } else {
1098 ftps->ftps_cmd = 0;
1099 }
1100 return (0);
1101 }
1102 }
1103 #if !defined(_KERNEL)
1104 printf("ipf_p_ftp_client_valid:junk after cmd[%*.*s]\n",
1105 (int)len, (int)len, buf);
1106 #endif
1107 return (FTPXY_JUNK_EOL);
1108 }
1109
1110
1111 int
ipf_p_ftp_server_valid(ipf_ftp_softc_t * softf,ftpside_t * ftps,char * buf,size_t len)1112 ipf_p_ftp_server_valid(ipf_ftp_softc_t *softf, ftpside_t *ftps, char *buf,
1113 size_t len)
1114 {
1115 register char *s, c, pc;
1116 register size_t i = len;
1117 int cmd;
1118
1119 s = buf;
1120 cmd = 0;
1121
1122 if (ftps->ftps_junk == FTPXY_JUNK_BAD)
1123 return (FTPXY_JUNK_BAD);
1124
1125 if (i < 5) {
1126 DT1(server_valid, int, i);
1127 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
1128 printf("ipf_p_ftp_servert_valid:i(%d) < 5\n", (int)i);
1129 return (2);
1130 }
1131
1132 c = *s++;
1133 i--;
1134 if (c == ' ') {
1135 cmd = -1;
1136 goto search_eol;
1137 }
1138
1139 if (ISDIGIT(c)) {
1140 cmd = (c - '0') * 100;
1141 c = *s++;
1142 i--;
1143 if (ISDIGIT(c)) {
1144 cmd += (c - '0') * 10;
1145 c = *s++;
1146 i--;
1147 if (ISDIGIT(c)) {
1148 cmd += (c - '0');
1149 c = *s++;
1150 i--;
1151 if ((c != '-') && (c != ' '))
1152 goto bad_server_command;
1153 if (c == '-')
1154 return (FTPXY_JUNK_CONT);
1155 } else
1156 goto bad_server_command;
1157 } else
1158 goto bad_server_command;
1159 } else {
1160 bad_server_command:
1161 DT4(server_junk, int len, buf, int, i, int, c, char *, buf);
1162 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO)
1163 printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*.*s]\n",
1164 "ipf_p_ftp_server_valid",
1165 ftps->ftps_junk, (int)len, (int)i,
1166 c, (int)len, (int)len, buf);
1167 if (ftps->ftps_junk == FTPXY_JUNK_CONT)
1168 return (FTPXY_JUNK_CONT);
1169 return (FTPXY_JUNK_BAD);
1170 }
1171 search_eol:
1172 for (; i; i--) {
1173 pc = c;
1174 c = *s++;
1175 if ((pc == '\r') && (c == '\n')) {
1176 if (cmd == -1) {
1177 if (ftps->ftps_junk == FTPXY_JUNK_CONT)
1178 return (FTPXY_JUNK_CONT);
1179 } else {
1180 ftps->ftps_cmd = cmd;
1181 }
1182 return (FTPXY_JUNK_OK);
1183 }
1184 }
1185
1186 DT2(junk_eol, int, len, char *, buf);
1187 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO)
1188 printf("ipf_p_ftp_server_valid:junk after cmd[%*.*s]\n",
1189 (int)len, (int)len, buf);
1190 return (FTPXY_JUNK_EOL);
1191 }
1192
1193
1194 int
ipf_p_ftp_valid(ipf_ftp_softc_t * softf,ftpinfo_t * ftp,int side,char * buf,size_t len)1195 ipf_p_ftp_valid(ipf_ftp_softc_t *softf, ftpinfo_t *ftp, int side, char *buf,
1196 size_t len)
1197 {
1198 ftpside_t *ftps;
1199
1200 ftps = &ftp->ftp_side[side];
1201
1202 if (side == 0)
1203 return (ipf_p_ftp_client_valid(softf, ftps, buf, len));
1204 else
1205 return (ipf_p_ftp_server_valid(softf, ftps, buf, len));
1206 }
1207
1208
1209 /*
1210 * For map rules, the following applies:
1211 * rv == 0 for outbound processing,
1212 * rv == 1 for inbound processing.
1213 * For rdr rules, the following applies:
1214 * rv == 0 for inbound processing,
1215 * rv == 1 for outbound processing.
1216 */
1217 int
ipf_p_ftp_process(ipf_ftp_softc_t * softf,fr_info_t * fin,nat_t * nat,ftpinfo_t * ftp,int rv)1218 ipf_p_ftp_process(ipf_ftp_softc_t *softf, fr_info_t *fin, nat_t *nat,
1219 ftpinfo_t *ftp, int rv)
1220 {
1221 int mlen, len, off, inc, i, sel, sel2, ok, ackoff, seqoff, retry;
1222 char *rptr, *wptr, *s;
1223 u_32_t thseq, thack;
1224 ap_session_t *aps;
1225 ftpside_t *f, *t;
1226 tcphdr_t *tcp;
1227 ip_t *ip;
1228 mb_t *m;
1229
1230 m = fin->fin_m;
1231 ip = fin->fin_ip;
1232 tcp = (tcphdr_t *)fin->fin_dp;
1233 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
1234
1235 f = &ftp->ftp_side[rv];
1236 t = &ftp->ftp_side[1 - rv];
1237 thseq = ntohl(tcp->th_seq);
1238 thack = ntohl(tcp->th_ack);
1239 mlen = MSGDSIZE(m) - off;
1240
1241 DT3(process_debug, tcphdr_t *, tcp, int, off, int, mlen);
1242 if (softf->ipf_p_ftp_debug & DEBUG_INFO)
1243 printf("ipf_p_ftp_process: %d:%d,%d, mlen %d flags %x\n",
1244 fin->fin_out, fin->fin_sport, fin->fin_dport,
1245 mlen, tcp->th_flags);
1246
1247 if ((mlen == 0) && ((tcp->th_flags & TH_OPENING) == TH_OPENING)) {
1248 f->ftps_seq[0] = thseq + 1;
1249 t->ftps_seq[0] = thack;
1250 return (0);
1251 } else if (mlen < 0) {
1252 return (0);
1253 }
1254
1255 aps = nat->nat_aps;
1256
1257 sel = aps->aps_sel[1 - rv];
1258 sel2 = aps->aps_sel[rv];
1259 if (rv == 1) {
1260 seqoff = aps->aps_seqoff[sel];
1261 if (aps->aps_seqmin[sel] > seqoff + thseq)
1262 seqoff = aps->aps_seqoff[!sel];
1263 ackoff = aps->aps_ackoff[sel2];
1264 if (aps->aps_ackmin[sel2] > ackoff + thack)
1265 ackoff = aps->aps_ackoff[!sel2];
1266 } else {
1267 seqoff = aps->aps_ackoff[sel];
1268 if (softf->ipf_p_ftp_debug & DEBUG_INFO)
1269 printf("seqoff %d thseq %x ackmin %x\n", seqoff, thseq,
1270 aps->aps_ackmin[sel]);
1271 if (aps->aps_ackmin[sel] > seqoff + thseq)
1272 seqoff = aps->aps_ackoff[!sel];
1273
1274 ackoff = aps->aps_seqoff[sel2];
1275 if (softf->ipf_p_ftp_debug & DEBUG_INFO)
1276 printf("ackoff %d thack %x seqmin %x\n", ackoff, thack,
1277 aps->aps_seqmin[sel2]);
1278 if (ackoff > 0) {
1279 if (aps->aps_seqmin[sel2] > ackoff + thack)
1280 ackoff = aps->aps_seqoff[!sel2];
1281 } else {
1282 if (aps->aps_seqmin[sel2] > thack)
1283 ackoff = aps->aps_seqoff[!sel2];
1284 }
1285 }
1286 if (softf->ipf_p_ftp_debug & DEBUG_INFO) {
1287 printf("%s: %x seq %x/%d ack %x/%d len %d/%d off %d\n",
1288 rv ? "IN" : "OUT", tcp->th_flags, thseq, seqoff,
1289 thack, ackoff, mlen, fin->fin_plen, off);
1290 printf("sel %d seqmin %x/%x offset %d/%d\n", sel,
1291 aps->aps_seqmin[sel], aps->aps_seqmin[sel2],
1292 aps->aps_seqoff[sel], aps->aps_seqoff[sel2]);
1293 printf("sel %d ackmin %x/%x offset %d/%d\n", sel2,
1294 aps->aps_ackmin[sel], aps->aps_ackmin[sel2],
1295 aps->aps_ackoff[sel], aps->aps_ackoff[sel2]);
1296 }
1297
1298 /*
1299 * XXX - Ideally, this packet should get dropped because we now know
1300 * that it is out of order (and there is no real danger in doing so
1301 * apart from causing packets to go through here ordered).
1302 */
1303 if (softf->ipf_p_ftp_debug & DEBUG_INFO) {
1304 printf("rv %d t:seq[0] %x seq[1] %x %d/%d\n",
1305 rv, t->ftps_seq[0], t->ftps_seq[1], seqoff, ackoff);
1306 }
1307
1308 ok = 0;
1309 if (t->ftps_seq[0] == 0) {
1310 t->ftps_seq[0] = thack;
1311 ok = 1;
1312 } else {
1313 if (ackoff == 0) {
1314 if (t->ftps_seq[0] == thack)
1315 ok = 1;
1316 else if (t->ftps_seq[1] == thack) {
1317 t->ftps_seq[0] = thack;
1318 ok = 1;
1319 }
1320 } else {
1321 if (t->ftps_seq[0] + ackoff == thack) {
1322 t->ftps_seq[0] = thack;
1323 ok = 1;
1324 } else if (t->ftps_seq[0] == thack + ackoff) {
1325 t->ftps_seq[0] = thack + ackoff;
1326 ok = 1;
1327 } else if (t->ftps_seq[1] + ackoff == thack) {
1328 t->ftps_seq[0] = thack;
1329 ok = 1;
1330 } else if (t->ftps_seq[1] == thack + ackoff) {
1331 t->ftps_seq[0] = thack + ackoff;
1332 ok = 1;
1333 }
1334 }
1335 }
1336
1337 if (softf->ipf_p_ftp_debug & DEBUG_INFO) {
1338 if (!ok)
1339 printf("%s ok\n", "not");
1340 }
1341
1342 if (!mlen) {
1343 if (t->ftps_seq[0] + ackoff != thack &&
1344 t->ftps_seq[1] + ackoff != thack) {
1345 DT3(thack, ftpside_t *t, t, int, ackoff, u_32_t, thack);
1346 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) {
1347 printf("%s:seq[0](%u) + (%d) != (%u)\n",
1348 "ipf_p_ftp_process", t->ftps_seq[0],
1349 ackoff, thack);
1350 printf("%s:seq[1](%u) + (%d) != (%u)\n",
1351 "ipf_p_ftp_process", t->ftps_seq[1],
1352 ackoff, thack);
1353 }
1354 return (APR_ERR(1));
1355 }
1356
1357 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) {
1358 printf("ipf_p_ftp_process:f:seq[0] %x seq[1] %x\n",
1359 f->ftps_seq[0], f->ftps_seq[1]);
1360 }
1361
1362 if (tcp->th_flags & TH_FIN) {
1363 if (thseq == f->ftps_seq[1]) {
1364 f->ftps_seq[0] = f->ftps_seq[1] - seqoff;
1365 f->ftps_seq[1] = thseq + 1 - seqoff;
1366 } else {
1367 DT2(thseq, ftpside_t *t, t, u_32_t, thseq);
1368 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) {
1369 printf("FIN: thseq %x seqoff %d ftps_seq %x\n",
1370 thseq, seqoff, f->ftps_seq[0]);
1371 }
1372 return (APR_ERR(1));
1373 }
1374 }
1375 f->ftps_len = 0;
1376 return (0);
1377 }
1378
1379 ok = 0;
1380 if ((thseq == f->ftps_seq[0]) || (thseq == f->ftps_seq[1])) {
1381 ok = 1;
1382 /*
1383 * Retransmitted data packet.
1384 */
1385 } else if ((thseq + mlen == f->ftps_seq[0]) ||
1386 (thseq + mlen == f->ftps_seq[1])) {
1387 ok = 1;
1388 }
1389
1390 if (ok == 0) {
1391 DT3(ok_0, ftpside_t *, f, u_32_t, thseq, int, mlen);
1392 inc = thseq - f->ftps_seq[0];
1393 if (softf->ipf_p_ftp_debug & DEBUG_ERROR) {
1394 printf("inc %d sel %d rv %d\n", inc, sel, rv);
1395 printf("th_seq %x ftps_seq %x/%x\n",
1396 thseq, f->ftps_seq[0], f->ftps_seq[1]);
1397 printf("ackmin %x ackoff %d\n", aps->aps_ackmin[sel],
1398 aps->aps_ackoff[sel]);
1399 printf("seqmin %x seqoff %d\n", aps->aps_seqmin[sel],
1400 aps->aps_seqoff[sel]);
1401 }
1402
1403 return (APR_ERR(1));
1404 }
1405
1406 inc = 0;
1407 rptr = f->ftps_rptr;
1408 wptr = f->ftps_wptr;
1409 f->ftps_seq[0] = thseq;
1410 f->ftps_seq[1] = f->ftps_seq[0] + mlen;
1411 f->ftps_len = mlen;
1412
1413 while (mlen > 0) {
1414 len = MIN(mlen, sizeof(f->ftps_buf) - (wptr - rptr));
1415 if (len == 0)
1416 break;
1417 COPYDATA(m, off, len, wptr);
1418 mlen -= len;
1419 off += len;
1420 wptr += len;
1421
1422 whilemore:
1423 if (softf->ipf_p_ftp_debug & DEBUG_PARSE)
1424 printf("%s:len %d/%d off %d wptr %lx junk %d [%*.*s]\n",
1425 "ipf_p_ftp_process",
1426 len, mlen, off, (u_long)wptr, f->ftps_junk,
1427 len, len, rptr);
1428
1429 f->ftps_wptr = wptr;
1430 if (f->ftps_junk != FTPXY_JUNK_OK) {
1431 i = f->ftps_junk;
1432 f->ftps_junk = ipf_p_ftp_valid(softf, ftp, rv, rptr,
1433 wptr - rptr);
1434 DT2(junk_transit, int, i, int, f->ftps_junk);
1435
1436 if (softf->ipf_p_ftp_debug & DEBUG_PARSE)
1437 printf("%s:junk %d -> %d\n",
1438 "ipf_p_ftp_process", i, f->ftps_junk);
1439
1440 if (f->ftps_junk == FTPXY_JUNK_BAD) {
1441 DT(buffer_full);
1442 if (wptr - rptr == sizeof(f->ftps_buf)) {
1443 if (softf->ipf_p_ftp_debug &
1444 DEBUG_PARSE_INFO)
1445 printf("%s:full buffer\n",
1446 "ipf_p_ftp_process");
1447 f->ftps_rptr = f->ftps_buf;
1448 f->ftps_wptr = f->ftps_buf;
1449 rptr = f->ftps_rptr;
1450 wptr = f->ftps_wptr;
1451 continue;
1452 }
1453 }
1454 }
1455
1456 while ((f->ftps_junk == FTPXY_JUNK_OK) && (wptr > rptr)) {
1457 len = wptr - rptr;
1458 f->ftps_junk = ipf_p_ftp_valid(softf, ftp, rv,
1459 rptr, len);
1460 DT5(junk_ftp_valid, int, len, int, rv, u_long, rptr,
1461 u_long, wptr, int, f->ftps_junk);
1462
1463 if (softf->ipf_p_ftp_debug & DEBUG_PARSE) {
1464 printf("%s=%d len %d rv %d ptr %lx/%lx ",
1465 "ipf_p_ftp_valid",
1466 f->ftps_junk, len, rv, (u_long)rptr,
1467 (u_long)wptr);
1468 printf("buf [%*.*s]\n", len, len, rptr);
1469 }
1470
1471 if (f->ftps_junk == FTPXY_JUNK_OK) {
1472 f->ftps_cmds++;
1473 f->ftps_rptr = rptr;
1474 if (rv)
1475 inc += ipf_p_ftp_server(softf, fin, ip,
1476 nat, ftp, len);
1477 else
1478 inc += ipf_p_ftp_client(softf, fin, ip,
1479 nat, ftp, len);
1480 rptr = f->ftps_rptr;
1481 wptr = f->ftps_wptr;
1482 }
1483 }
1484
1485 /*
1486 * Off to a bad start so lets just forget about using the
1487 * ftp proxy for this connection.
1488 */
1489 if ((f->ftps_cmds == 0) && (f->ftps_junk == FTPXY_JUNK_BAD)) {
1490 /* f->ftps_seq[1] += inc; */
1491
1492 DT(ftp_junk_cmd);
1493 if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
1494 printf("%s:cmds == 0 junk == 1\n",
1495 "ipf_p_ftp_process");
1496 return (APR_ERR(2));
1497 }
1498
1499 retry = 0;
1500 if ((f->ftps_junk != FTPXY_JUNK_OK) && (rptr < wptr)) {
1501 for (s = rptr; s < wptr; s++) {
1502 if ((*s == '\r') && (s + 1 < wptr) &&
1503 (*(s + 1) == '\n')) {
1504 rptr = s + 2;
1505 retry = 1;
1506 if (f->ftps_junk != FTPXY_JUNK_CONT)
1507 f->ftps_junk = FTPXY_JUNK_OK;
1508 break;
1509 }
1510 }
1511 }
1512
1513 if (rptr == wptr) {
1514 rptr = wptr = f->ftps_buf;
1515 } else {
1516 /*
1517 * Compact the buffer back to the start. The junk
1518 * flag should already be set and because we're not
1519 * throwing away any data, it is preserved from its
1520 * current state.
1521 */
1522 if (rptr > f->ftps_buf) {
1523 bcopy(rptr, f->ftps_buf, wptr - rptr);
1524 wptr -= rptr - f->ftps_buf;
1525 rptr = f->ftps_buf;
1526 }
1527 }
1528 f->ftps_rptr = rptr;
1529 f->ftps_wptr = wptr;
1530 if (retry)
1531 goto whilemore;
1532 }
1533
1534 /* f->ftps_seq[1] += inc; */
1535 if (tcp->th_flags & TH_FIN)
1536 f->ftps_seq[1]++;
1537 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO) {
1538 mlen = MSGDSIZE(m);
1539 mlen -= off;
1540 printf("ftps_seq[1] = %x inc %d len %d\n",
1541 f->ftps_seq[1], inc, mlen);
1542 }
1543
1544 f->ftps_rptr = rptr;
1545 f->ftps_wptr = wptr;
1546 return (APR_INC(inc));
1547 }
1548
1549
1550 int
ipf_p_ftp_out(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)1551 ipf_p_ftp_out(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
1552 {
1553 ipf_ftp_softc_t *softf = arg;
1554 ftpinfo_t *ftp;
1555 int rev;
1556
1557 ftp = aps->aps_data;
1558 if (ftp == NULL)
1559 return (0);
1560
1561 rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1;
1562 if (ftp->ftp_side[1 - rev].ftps_ifp == NULL)
1563 ftp->ftp_side[1 - rev].ftps_ifp = fin->fin_ifp;
1564
1565 return (ipf_p_ftp_process(softf, fin, nat, ftp, rev));
1566 }
1567
1568
1569 int
ipf_p_ftp_in(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)1570 ipf_p_ftp_in(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
1571 {
1572 ipf_ftp_softc_t *softf = arg;
1573 ftpinfo_t *ftp;
1574 int rev;
1575
1576 ftp = aps->aps_data;
1577 if (ftp == NULL)
1578 return (0);
1579
1580 rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1;
1581 if (ftp->ftp_side[rev].ftps_ifp == NULL)
1582 ftp->ftp_side[rev].ftps_ifp = fin->fin_ifp;
1583
1584 return (ipf_p_ftp_process(softf, fin, nat, ftp, 1 - rev));
1585 }
1586
1587
1588 /*
1589 * ipf_p_ftp_atoi - implement a version of atoi which processes numbers in
1590 * pairs separated by commas (which are expected to be in the range 0 - 255),
1591 * returning a 16 bit number combining either side of the , as the MSB and
1592 * LSB.
1593 */
1594 u_short
ipf_p_ftp_atoi(char ** ptr)1595 ipf_p_ftp_atoi(char **ptr)
1596 {
1597 register char *s = *ptr, c;
1598 register u_char i = 0, j = 0;
1599
1600 while (((c = *s++) != '\0') && ISDIGIT(c)) {
1601 i *= 10;
1602 i += c - '0';
1603 }
1604 if (c != ',') {
1605 *ptr = NULL;
1606 return (0);
1607 }
1608 while (((c = *s++) != '\0') && ISDIGIT(c)) {
1609 j *= 10;
1610 j += c - '0';
1611 }
1612 *ptr = s;
1613 i &= 0xff;
1614 j &= 0xff;
1615 return (i << 8) | j;
1616 }
1617
1618
1619 int
ipf_p_ftp_eprt(ipf_ftp_softc_t * softf,fr_info_t * fin,ip_t * ip,nat_t * nat,ftpinfo_t * ftp,int dlen)1620 ipf_p_ftp_eprt(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
1621 ftpinfo_t *ftp, int dlen)
1622 {
1623 ftpside_t *f;
1624
1625 /*
1626 * Check for client sending out EPRT message.
1627 */
1628 if (dlen < IPF_MINEPRTLEN) {
1629 DT1(epert_dlen, int, dlen);
1630 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
1631 printf("ipf_p_ftp_eprt:dlen(%d) < IPF_MINEPRTLEN\n",
1632 dlen);
1633 return (0);
1634 }
1635
1636 /*
1637 * Parse the EPRT command. Format is:
1638 * "EPRT |1|1.2.3.4|2000|" for IPv4 and
1639 * "EPRT |2|ef00::1:2|2000|" for IPv6
1640 */
1641 f = &ftp->ftp_side[0];
1642 if (f->ftps_rptr[5] != '|')
1643 return (0);
1644 if (f->ftps_rptr[5] == f->ftps_rptr[7]) {
1645 if (f->ftps_rptr[6] == '1' && nat->nat_v[0] == 4)
1646 return (ipf_p_ftp_eprt4(softf, fin, ip, nat, ftp, dlen));
1647 #ifdef USE_INET6
1648 if (f->ftps_rptr[6] == '2' && nat->nat_v[0] == 6)
1649 return (ipf_p_ftp_eprt6(softf, fin, ip, nat, ftp, dlen));
1650 #endif
1651 }
1652 return (0);
1653 }
1654
1655
1656 int
ipf_p_ftp_eprt4(ipf_ftp_softc_t * softf,fr_info_t * fin,ip_t * ip,nat_t * nat,ftpinfo_t * ftp,int dlen)1657 ipf_p_ftp_eprt4(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
1658 ftpinfo_t *ftp, int dlen)
1659 {
1660 int a1, a2, a3, a4, port, olen, nlen, inc, off;
1661 char newbuf[IPF_FTPBUFSZ];
1662 char *s, c, delim;
1663 u_32_t addr, i;
1664 tcphdr_t *tcp;
1665 ftpside_t *f;
1666 mb_t *m;
1667
1668 m = fin->fin_m;
1669 tcp = (tcphdr_t *)fin->fin_dp;
1670 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
1671 f = &ftp->ftp_side[0];
1672 delim = f->ftps_rptr[5];
1673 s = f->ftps_rptr + 8;
1674
1675 /*
1676 * get the IP address.
1677 */
1678 i = 0;
1679 while (((c = *s++) != '\0') && ISDIGIT(c)) {
1680 i *= 10;
1681 i += c - '0';
1682 }
1683 if (i > 255)
1684 return (0);
1685 if (c != '.')
1686 return (0);
1687 addr = (i << 24);
1688
1689 i = 0;
1690 while (((c = *s++) != '\0') && ISDIGIT(c)) {
1691 i *= 10;
1692 i += c - '0';
1693 }
1694 if (i > 255)
1695 return (0);
1696 if (c != '.')
1697 return (0);
1698 addr |= (addr << 16);
1699
1700 i = 0;
1701 while (((c = *s++) != '\0') && ISDIGIT(c)) {
1702 i *= 10;
1703 i += c - '0';
1704 }
1705 if (i > 255)
1706 return (0);
1707 if (c != '.')
1708 return (0);
1709 addr |= (addr << 8);
1710
1711 i = 0;
1712 while (((c = *s++) != '\0') && ISDIGIT(c)) {
1713 i *= 10;
1714 i += c - '0';
1715 }
1716 if (i > 255)
1717 return (0);
1718 if (c != delim)
1719 return (0);
1720 addr |= addr;
1721
1722 /*
1723 * Get the port number
1724 */
1725 i = 0;
1726 while (((c = *s++) != '\0') && ISDIGIT(c)) {
1727 i *= 10;
1728 i += c - '0';
1729 }
1730 if (i > 65535)
1731 return (0);
1732 if (c != delim)
1733 return (0);
1734 port = i;
1735
1736 /*
1737 * Check for CR-LF at the end of the command string.
1738 */
1739 if ((*s != '\r') || (*(s + 1) != '\n')) {
1740 DT(eprt4_no_crlf);
1741 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
1742 printf("ipf_p_ftp_eprt4:missing %s\n", "cr-lf");
1743 return (0);
1744 }
1745 s += 2;
1746
1747 /*
1748 * Calculate new address parts for PORT command
1749 */
1750 if (nat->nat_dir == NAT_INBOUND)
1751 a1 = ntohl(nat->nat_odstaddr);
1752 else
1753 a1 = ntohl(ip->ip_src.s_addr);
1754 a2 = (a1 >> 16) & 0xff;
1755 a3 = (a1 >> 8) & 0xff;
1756 a4 = a1 & 0xff;
1757 a1 >>= 24;
1758 olen = s - f->ftps_rptr;
1759 /* DO NOT change this to snprintf! */
1760 /*
1761 * While we could force the use of | as a delimiter here, it makes
1762 * sense to preserve whatever character is being used by the systems
1763 * involved in the communication.
1764 */
1765 (void) snprintf(newbuf, sizeof(newbuf), "%s %c1%c%u.%u.%u.%u%c%u%c\r\n",
1766 "EPRT", delim, delim, a1, a2, a3, a4, delim, port,
1767 delim);
1768
1769 nlen = strlen(newbuf);
1770 inc = nlen - olen;
1771 if ((inc + fin->fin_plen) > 65535) {
1772 DT2(eprt4_len, int, inc, int, fin->fin_plen);
1773 if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
1774 printf("ipf_p_ftp_eprt4:inc(%d) + ip->ip_len > 65535\n",
1775 inc);
1776 return (0);
1777 }
1778
1779 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
1780 #if !defined(_KERNEL)
1781 M_ADJ(m, inc);
1782 #else
1783 if (inc < 0)
1784 M_ADJ(m, inc);
1785 #endif
1786 /* the mbuf chain will be extended if necessary by m_copyback() */
1787 COPYBACK(m, off, nlen, newbuf);
1788 fin->fin_flx |= FI_DOCKSUM;
1789
1790 if (inc != 0) {
1791 fin->fin_plen += inc;
1792 ip->ip_len = htons(fin->fin_plen);
1793 fin->fin_dlen += inc;
1794 }
1795
1796 f->ftps_cmd = FTPXY_C_EPRT;
1797 return (ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, port, inc));
1798 }
1799
1800
1801 int
ipf_p_ftp_epsv(ipf_ftp_softc_t * softf,fr_info_t * fin,ip_t * ip,nat_t * nat,ftpinfo_t * ftp,int dlen)1802 ipf_p_ftp_epsv(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
1803 ftpinfo_t *ftp, int dlen)
1804 {
1805 char newbuf[IPF_FTPBUFSZ];
1806 u_short ap = 0;
1807 ftpside_t *f;
1808 char *s;
1809
1810 if ((softf->ipf_p_ftp_forcepasv != 0) &&
1811 (ftp->ftp_side[0].ftps_cmd != FTPXY_C_EPSV)) {
1812 DT1(epsv_cmd, int, ftp->ftp_side[0].ftps_cmd);
1813 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
1814 printf("ipf_p_ftp_epsv:ftps_cmd(%d) != FTPXY_C_EPSV\n",
1815 ftp->ftp_side[0].ftps_cmd);
1816 return (0);
1817 }
1818 f = &ftp->ftp_side[1];
1819
1820 #define EPSV_REPLEN 33
1821 /*
1822 * Check for EPSV reply message.
1823 */
1824 if (dlen < IPF_MIN229LEN) {
1825 return (0);
1826 } else if (strncmp(f->ftps_rptr,
1827 "229 Entering Extended Passive Mode", EPSV_REPLEN)) {
1828 return (0);
1829 }
1830
1831 /*
1832 * Skip the EPSV command + space
1833 */
1834 s = f->ftps_rptr + 33;
1835 while (*s && !ISDIGIT(*s))
1836 s++;
1837
1838 /*
1839 * As per RFC 2428, there are no address components in the EPSV
1840 * response. So we'll go straight to getting the port.
1841 */
1842 while (*s && ISDIGIT(*s)) {
1843 ap *= 10;
1844 ap += *s++ - '0';
1845 }
1846
1847 if (*s == '|')
1848 s++;
1849 if (*s == ')')
1850 s++;
1851 if (*s == '\n')
1852 s--;
1853 /*
1854 * check for CR-LF at the end.
1855 */
1856 if ((*s != '\r') || (*(s + 1) != '\n')) {
1857 return (0);
1858 }
1859 s += 2;
1860
1861 (void) snprintf(newbuf, sizeof(newbuf), "%s (|||%u|)\r\n",
1862 "229 Entering Extended Passive Mode", ap);
1863
1864 return (ipf_p_ftp_pasvreply(softf, fin, ip, nat, ftp, (u_int)ap,
1865 newbuf, s));
1866 }
1867
1868 #ifdef USE_INET6
1869 int
ipf_p_ftp_eprt6(ipf_ftp_softc_t * softf,fr_info_t * fin,ip_t * ip,nat_t * nat,ftpinfo_t * ftp,int dlen)1870 ipf_p_ftp_eprt6(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
1871 ftpinfo_t *ftp, int dlen)
1872 {
1873 int port, olen, nlen, inc, off, left, i;
1874 char newbuf[IPF_FTPBUFSZ];
1875 char *s, c;
1876 i6addr_t addr, *a6;
1877 tcphdr_t *tcp;
1878 ip6_t *ip6;
1879 char delim;
1880 u_short whole;
1881 u_short part;
1882 ftpside_t *f;
1883 u_short *t;
1884 int fwd;
1885 mb_t *m;
1886 u_32_t a;
1887
1888 m = fin->fin_m;
1889 ip6 = (ip6_t *)ip;
1890 f = &ftp->ftp_side[0];
1891 s = f->ftps_rptr + 8;
1892 f = &ftp->ftp_side[0];
1893 delim = f->ftps_rptr[5];
1894 tcp = (tcphdr_t *)fin->fin_dp;
1895 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
1896
1897 addr.i6[0] = 0;
1898 addr.i6[1] = 0;
1899 addr.i6[2] = 0;
1900 addr.i6[3] = 0;
1901 /*
1902 * Parse an IPv6 address.
1903 * Go forward until either :: or | is found. If :: is found,
1904 * reverse direction. Direction change is performed to ease
1905 * parsing an unknown number of 0s in the middle.
1906 */
1907 whole = 0;
1908 t = (u_short *)&addr;
1909 fwd = 1;
1910 for (part = 0; (c = *s) != '\0'; ) {
1911 if (c == delim) {
1912 *t = htons((u_short)whole);
1913 break;
1914 }
1915 if (c == ':') {
1916 *t = part;
1917 if (fwd) {
1918 *t = htons((u_short)whole);
1919 t++;
1920 } else {
1921 *t = htons((u_short)(whole >> 16));
1922 t--;
1923 }
1924 whole = 0;
1925 if (fwd == 1 && s[1] == ':') {
1926 while (*s && *s != '|')
1927 s++;
1928 if ((c = *s) != delim)
1929 break;
1930 t = (u_short *)&addr.i6[3];
1931 t++;
1932 fwd = 0;
1933 } else if (fwd == 0 && s[-1] == ':') {
1934 break;
1935 }
1936 } else {
1937 if (c >= '0' && c <= '9') {
1938 c -= '0';
1939 } else if (c >= 'a' && c <= 'f') {
1940 c -= 'a' + 10;
1941 } else if (c >= 'A' && c <= 'F') {
1942 c -= 'A' + 10;
1943 }
1944 if (fwd) {
1945 whole <<= 8;
1946 whole |= c;
1947 } else {
1948 whole >>= 8;
1949 whole |= ((u_32_t)c) << 24;
1950 }
1951 }
1952 if (fwd)
1953 s++;
1954 else
1955 s--;
1956 }
1957 if (c != ':' && c != delim)
1958 return (0);
1959
1960 while (*s != '|')
1961 s++;
1962 s++;
1963
1964 /*
1965 * Get the port number
1966 */
1967 i = 0;
1968 while (((c = *s++) != '\0') && ISDIGIT(c)) {
1969 i *= 10;
1970 i += c - '0';
1971 }
1972 if (i > 65535)
1973 return (0);
1974 if (c != delim)
1975 return (0);
1976 port = (u_short)(i & 0xffff);
1977
1978 /*
1979 * Check for CR-LF at the end of the command string.
1980 */
1981 if ((*s != '\r') || (*(s + 1) != '\n')) {
1982 DT(eprt6_no_crlf);
1983 if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
1984 printf("ipf_p_ftp_eprt6:missing %s\n", "cr-lf");
1985 return (0);
1986 }
1987 s += 2;
1988
1989 /*
1990 * Calculate new address parts for PORT command
1991 */
1992 a6 = (i6addr_t *)&ip6->ip6_src;
1993 olen = s - f->ftps_rptr;
1994 /* DO NOT change this to snprintf! */
1995 /*
1996 * While we could force the use of | as a delimiter here, it makes
1997 * sense to preserve whatever character is being used by the systems
1998 * involved in the communication.
1999 */
2000 s = newbuf;
2001 left = sizeof(newbuf);
2002 (void) snprintf(s, left, "EPRT %c2%c", delim, delim);
2003 s += strlen(s);
2004 a = ntohl(a6->i6[0]);
2005 snprintf(s, left, "%x:%x:", a >> 16, a & 0xffff);
2006 left -= strlen(s);
2007 s += strlen(s);
2008 a = ntohl(a6->i6[1]);
2009 snprintf(s, left, "%x:%x:", a >> 16, a & 0xffff);
2010 left -= strlen(s);
2011 s += strlen(s);
2012 a = ntohl(a6->i6[2]);
2013 snprintf(s, left,"%x:%x:", a >> 16, a & 0xffff);
2014 left -= strlen(s);
2015 s += strlen(s);
2016 a = ntohl(a6->i6[3]);
2017 snprintf(s, left, "%x:%x", a >> 16, a & 0xffff);
2018 left -= strlen(s);
2019 s += strlen(s);
2020 snprintf(s, left, "|%d|\r\n", port);
2021 nlen = strlen(newbuf);
2022 inc = nlen - olen;
2023 if ((inc + fin->fin_plen) > 65535) {
2024 DT2(eprt6_len, int, inc, int, fin->fin_plen);
2025 if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
2026 printf("ipf_p_ftp_eprt6:inc(%d) + ip->ip_len > 65535\n",
2027 inc);
2028 return (0);
2029 }
2030
2031 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
2032 #if !defined(_KERNEL)
2033 M_ADJ(m, inc);
2034 #else
2035 if (inc < 0)
2036 M_ADJ(m, inc);
2037 #endif
2038 /* the mbuf chain will be extended if necessary by m_copyback() */
2039 COPYBACK(m, off, nlen, newbuf);
2040 fin->fin_flx |= FI_DOCKSUM;
2041
2042 if (inc != 0) {
2043 fin->fin_plen += inc;
2044 ip6->ip6_plen = htons(fin->fin_plen - fin->fin_hlen);
2045 fin->fin_dlen += inc;
2046 }
2047
2048 f->ftps_cmd = FTPXY_C_EPRT;
2049 return (ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, port, inc));
2050 }
2051 #endif
2052