1 /*	$FreeBSD: stable/9/sys/contrib/ipfilter/netinet/ip_ftp_pxy.c 170268 2007-06-04 02:54:36Z darrenr $	*/
2 
3 /*
4  * Copyright (C) 1997-2003 by Darren Reed
5  *
6  * See the IPFILTER.LICENCE file for details on licencing.
7  *
8  * Simple FTP transparent proxy for in-kernel use.  For use with the NAT
9  * code.
10  *
11  * $FreeBSD: stable/9/sys/contrib/ipfilter/netinet/ip_ftp_pxy.c 170268 2007-06-04 02:54:36Z darrenr $
12  * Id: ip_ftp_pxy.c,v 2.88.2.19 2006/04/01 10:14:53 darrenr Exp $
13  */
14 
15 #define	IPF_FTP_PROXY
16 
17 #define	IPF_MINPORTLEN	18
18 #define	IPF_MAXPORTLEN	30
19 #define	IPF_MIN227LEN	39
20 #define	IPF_MAX227LEN	51
21 #define	IPF_MIN229LEN	47
22 #define	IPF_MAX229LEN	51
23 
24 #define	FTPXY_GO	0
25 #define	FTPXY_INIT	1
26 #define	FTPXY_USER_1	2
27 #define	FTPXY_USOK_1	3
28 #define	FTPXY_PASS_1	4
29 #define	FTPXY_PAOK_1	5
30 #define	FTPXY_AUTH_1	6
31 #define	FTPXY_AUOK_1	7
32 #define	FTPXY_ADAT_1	8
33 #define	FTPXY_ADOK_1	9
34 #define	FTPXY_ACCT_1	10
35 #define	FTPXY_ACOK_1	11
36 #define	FTPXY_USER_2	12
37 #define	FTPXY_USOK_2	13
38 #define	FTPXY_PASS_2	14
39 #define	FTPXY_PAOK_2	15
40 
41 /*
42  * Values for FTP commands.  Numerics cover 0-999
43  */
44 #define	FTPXY_C_PASV	1000
45 
46 int ippr_ftp_client __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int));
47 int ippr_ftp_complete __P((char *, size_t));
48 int ippr_ftp_in __P((fr_info_t *, ap_session_t *, nat_t *));
49 int ippr_ftp_init __P((void));
50 void ippr_ftp_fini __P((void));
51 int ippr_ftp_new __P((fr_info_t *, ap_session_t *, nat_t *));
52 int ippr_ftp_out __P((fr_info_t *, ap_session_t *, nat_t *));
53 int ippr_ftp_pasv __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int));
54 int ippr_ftp_epsv __P((fr_info_t *, ip_t *, nat_t *, ftpside_t *, int));
55 int ippr_ftp_port __P((fr_info_t *, ip_t *, nat_t *, ftpside_t *, int));
56 int ippr_ftp_process __P((fr_info_t *, nat_t *, ftpinfo_t *, int));
57 int ippr_ftp_server __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int));
58 int ippr_ftp_valid __P((ftpinfo_t *, int, char *, size_t));
59 int ippr_ftp_server_valid __P((ftpside_t *, char *, size_t));
60 int ippr_ftp_client_valid __P((ftpside_t *, char *, size_t));
61 u_short ippr_ftp_atoi __P((char **));
62 int ippr_ftp_pasvreply __P((fr_info_t *, ip_t *, nat_t *, ftpside_t *,
63 			    u_int, char *, char *, u_int));
64 
65 
66 int	ftp_proxy_init = 0;
67 int	ippr_ftp_pasvonly = 0;
68 int	ippr_ftp_insecure = 0;	/* Do not require logins before transfers */
69 int	ippr_ftp_pasvrdr = 0;
70 int	ippr_ftp_forcepasv = 0;	/* PASV must be last command prior to 227 */
71 #if defined(_KERNEL)
72 int	ippr_ftp_debug = 0;
73 #else
74 int	ippr_ftp_debug = 2;
75 #endif
76 /*
77  * 1 - security
78  * 2 - errors
79  * 3 - error debugging
80  * 4 - parsing errors
81  * 5 - parsing info
82  * 6 - parsing debug
83  */
84 
85 static	frentry_t	ftppxyfr;
86 static	ipftuneable_t	ftptune = {
87 	{ &ippr_ftp_debug },
88 	"ippr_ftp_debug",
89 	0,
90 	10,
91 	sizeof(ippr_ftp_debug),
92 	0,
93 	NULL
94 };
95 
96 
97 /*
98  * Initialize local structures.
99  */
ippr_ftp_init()100 int ippr_ftp_init()
101 {
102 	bzero((char *)&ftppxyfr, sizeof(ftppxyfr));
103 	ftppxyfr.fr_ref = 1;
104 	ftppxyfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
105 	MUTEX_INIT(&ftppxyfr.fr_lock, "FTP Proxy Mutex");
106 	ftp_proxy_init = 1;
107 	(void) fr_addipftune(&ftptune);
108 
109 	return 0;
110 }
111 
112 
ippr_ftp_fini()113 void ippr_ftp_fini()
114 {
115 	(void) fr_delipftune(&ftptune);
116 
117 	if (ftp_proxy_init == 1) {
118 		MUTEX_DESTROY(&ftppxyfr.fr_lock);
119 		ftp_proxy_init = 0;
120 	}
121 }
122 
123 
ippr_ftp_new(fin,aps,nat)124 int ippr_ftp_new(fin, aps, nat)
125 fr_info_t *fin;
126 ap_session_t *aps;
127 nat_t *nat;
128 {
129 	ftpinfo_t *ftp;
130 	ftpside_t *f;
131 
132 	KMALLOC(ftp, ftpinfo_t *);
133 	if (ftp == NULL)
134 		return -1;
135 
136 	fin = fin;	/* LINT */
137 	nat = nat;	/* LINT */
138 
139 	aps->aps_data = ftp;
140 	aps->aps_psiz = sizeof(ftpinfo_t);
141 
142 	bzero((char *)ftp, sizeof(*ftp));
143 	f = &ftp->ftp_side[0];
144 	f->ftps_rptr = f->ftps_buf;
145 	f->ftps_wptr = f->ftps_buf;
146 	f = &ftp->ftp_side[1];
147 	f->ftps_rptr = f->ftps_buf;
148 	f->ftps_wptr = f->ftps_buf;
149 	ftp->ftp_passok = FTPXY_INIT;
150 	ftp->ftp_incok = 0;
151 	return 0;
152 }
153 
154 
ippr_ftp_port(fin,ip,nat,f,dlen)155 int ippr_ftp_port(fin, ip, nat, f, dlen)
156 fr_info_t *fin;
157 ip_t *ip;
158 nat_t *nat;
159 ftpside_t *f;
160 int dlen;
161 {
162 	tcphdr_t *tcp, tcph, *tcp2 = &tcph;
163 	char newbuf[IPF_FTPBUFSZ], *s;
164 	struct in_addr swip, swip2;
165 	u_int a1, a2, a3, a4;
166 	int inc, off, flags;
167 	u_short a5, a6, sp;
168 	size_t nlen, olen;
169 	fr_info_t fi;
170 	nat_t *nat2;
171 	mb_t *m;
172 
173 	m = fin->fin_m;
174 	tcp = (tcphdr_t *)fin->fin_dp;
175 	off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
176 
177 	/*
178 	 * Check for client sending out PORT message.
179 	 */
180 	if (dlen < IPF_MINPORTLEN) {
181 		if (ippr_ftp_debug > 1)
182 			printf("ippr_ftp_port:dlen(%d) < IPF_MINPORTLEN\n",
183 			       dlen);
184 		return 0;
185 	}
186 	/*
187 	 * Skip the PORT command + space
188 	 */
189 	s = f->ftps_rptr + 5;
190 	/*
191 	 * Pick out the address components, two at a time.
192 	 */
193 	a1 = ippr_ftp_atoi(&s);
194 	if (s == NULL) {
195 		if (ippr_ftp_debug > 1)
196 			printf("ippr_ftp_port:ippr_ftp_atoi(%d) failed\n", 1);
197 		return 0;
198 	}
199 	a2 = ippr_ftp_atoi(&s);
200 	if (s == NULL) {
201 		if (ippr_ftp_debug > 1)
202 			printf("ippr_ftp_port:ippr_ftp_atoi(%d) failed\n", 2);
203 		return 0;
204 	}
205 
206 	/*
207 	 * Check that IP address in the PORT/PASV reply is the same as the
208 	 * sender of the command - prevents using PORT for port scanning.
209 	 */
210 	a1 <<= 16;
211 	a1 |= a2;
212 	if (((nat->nat_dir == NAT_OUTBOUND) &&
213 	     (a1 != ntohl(nat->nat_inip.s_addr))) ||
214 	    ((nat->nat_dir == NAT_INBOUND) &&
215 	     (a1 != ntohl(nat->nat_oip.s_addr)))) {
216 		if (ippr_ftp_debug > 0)
217 			printf("ippr_ftp_port:%s != nat->nat_inip\n", "a1");
218 		return APR_ERR(1);
219 	}
220 
221 	a5 = ippr_ftp_atoi(&s);
222 	if (s == NULL) {
223 		if (ippr_ftp_debug > 1)
224 			printf("ippr_ftp_port:ippr_ftp_atoi(%d) failed\n", 3);
225 		return 0;
226 	}
227 	if (*s == ')')
228 		s++;
229 
230 	/*
231 	 * check for CR-LF at the end.
232 	 */
233 	if (*s == '\n')
234 		s--;
235 	if ((*s == '\r') && (*(s + 1) == '\n')) {
236 		s += 2;
237 		a6 = a5 & 0xff;
238 	} else {
239 		if (ippr_ftp_debug > 1)
240 			printf("ippr_ftp_port:missing %s\n", "cr-lf");
241 		return 0;
242 	}
243 
244 	a5 >>= 8;
245 	a5 &= 0xff;
246 	sp = a5 << 8 | a6;
247 	/*
248 	 * Don't allow the PORT command to specify a port < 1024 due to
249 	 * security crap.
250 	 */
251 	if (sp < 1024) {
252 		if (ippr_ftp_debug > 0)
253 			printf("ippr_ftp_port:sp(%d) < 1024\n", sp);
254 		return 0;
255 	}
256 	/*
257 	 * Calculate new address parts for PORT command
258 	 */
259 	if (nat->nat_dir == NAT_INBOUND)
260 		a1 = ntohl(nat->nat_oip.s_addr);
261 	else
262 		a1 = ntohl(ip->ip_src.s_addr);
263 	a2 = (a1 >> 16) & 0xff;
264 	a3 = (a1 >> 8) & 0xff;
265 	a4 = a1 & 0xff;
266 	a1 >>= 24;
267 	olen = s - f->ftps_rptr;
268 	/* DO NOT change this to snprintf! */
269 #if defined(SNPRINTF) && defined(_KERNEL)
270 	SNPRINTF(newbuf, sizeof(newbuf), "%s %u,%u,%u,%u,%u,%u\r\n",
271 		 "PORT", a1, a2, a3, a4, a5, a6);
272 #else
273 	(void) sprintf(newbuf, "%s %u,%u,%u,%u,%u,%u\r\n",
274 		       "PORT", a1, a2, a3, a4, a5, a6);
275 #endif
276 
277 	nlen = strlen(newbuf);
278 	inc = nlen - olen;
279 	if ((inc + ip->ip_len) > 65535) {
280 		if (ippr_ftp_debug > 0)
281 			printf("ippr_ftp_port:inc(%d) + ip->ip_len > 65535\n",
282 			       inc);
283 		return 0;
284 	}
285 
286 #if !defined(_KERNEL)
287 	bcopy(newbuf, MTOD(m, char *) + off, nlen);
288 #else
289 # if defined(MENTAT)
290 	if (inc < 0)
291 		(void)adjmsg(m, inc);
292 # else /* defined(MENTAT) */
293 	/*
294 	 * m_adj takes care of pkthdr.len, if required and treats inc<0 to
295 	 * mean remove -len bytes from the end of the packet.
296 	 * The mbuf chain will be extended if necessary by m_copyback().
297 	 */
298 	if (inc < 0)
299 		m_adj(m, inc);
300 # endif /* defined(MENTAT) */
301 #endif /* !defined(_KERNEL) */
302 	COPYBACK(m, off, nlen, newbuf);
303 
304 	if (inc != 0) {
305 		ip->ip_len += inc;
306 		fin->fin_dlen += inc;
307 		fin->fin_plen += inc;
308 	}
309 
310 	/*
311 	 * The server may not make the connection back from port 20, but
312 	 * it is the most likely so use it here to check for a conflicting
313 	 * mapping.
314 	 */
315 	bcopy((char *)fin, (char *)&fi, sizeof(fi));
316 	fi.fin_state = NULL;
317 	fi.fin_nat = NULL;
318 	fi.fin_flx |= FI_IGNORE;
319 	fi.fin_data[0] = sp;
320 	fi.fin_data[1] = fin->fin_data[1] - 1;
321 	/*
322 	 * Add skeleton NAT entry for connection which will come back the
323 	 * other way.
324 	 */
325 	if (nat->nat_dir == NAT_OUTBOUND)
326 		nat2 = nat_outlookup(&fi, NAT_SEARCH|IPN_TCP, nat->nat_p,
327 				     nat->nat_inip, nat->nat_oip);
328 	else
329 		nat2 = nat_inlookup(&fi, NAT_SEARCH|IPN_TCP, nat->nat_p,
330 				    nat->nat_inip, nat->nat_oip);
331 	if (nat2 == NULL) {
332 		int slen;
333 
334 		slen = ip->ip_len;
335 		ip->ip_len = fin->fin_hlen + sizeof(*tcp2);
336 		bzero((char *)tcp2, sizeof(*tcp2));
337 		tcp2->th_win = htons(8192);
338 		tcp2->th_sport = htons(sp);
339 		TCP_OFF_A(tcp2, 5);
340 		tcp2->th_flags = TH_SYN;
341 		tcp2->th_dport = 0; /* XXX - don't specify remote port */
342 		fi.fin_data[1] = 0;
343 		fi.fin_dlen = sizeof(*tcp2);
344 		fi.fin_plen = fi.fin_hlen + sizeof(*tcp2);
345 		fi.fin_dp = (char *)tcp2;
346 		fi.fin_fr = &ftppxyfr;
347 		fi.fin_out = nat->nat_dir;
348 		fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE;
349 		swip = ip->ip_src;
350 		swip2 = ip->ip_dst;
351 		if (nat->nat_dir == NAT_OUTBOUND) {
352 			fi.fin_fi.fi_saddr = nat->nat_inip.s_addr;
353 			ip->ip_src = nat->nat_inip;
354 		} else if (nat->nat_dir == NAT_INBOUND) {
355 			fi.fin_fi.fi_saddr = nat->nat_oip.s_addr;
356 			ip->ip_src = nat->nat_oip;
357 		}
358 
359 		flags = NAT_SLAVE|IPN_TCP|SI_W_DPORT;
360 		if (nat->nat_dir == NAT_INBOUND)
361 			flags |= NAT_NOTRULEPORT;
362 		nat2 = nat_new(&fi, nat->nat_ptr, NULL, flags, nat->nat_dir);
363 
364 		if (nat2 != NULL) {
365 			(void) nat_proto(&fi, nat2, IPN_TCP);
366 			nat_update(&fi, nat2, nat->nat_ptr);
367 			fi.fin_ifp = NULL;
368 			if (nat->nat_dir == NAT_INBOUND) {
369 				fi.fin_fi.fi_daddr = nat->nat_inip.s_addr;
370 				ip->ip_dst = nat->nat_inip;
371 			}
372 			(void) fr_addstate(&fi, NULL, SI_W_DPORT);
373 			if (fi.fin_state != NULL)
374 				fr_statederef((ipstate_t **)&fi.fin_state);
375 		}
376 		ip->ip_len = slen;
377 		ip->ip_src = swip;
378 		ip->ip_dst = swip2;
379 	}
380 	return APR_INC(inc);
381 }
382 
383 
ippr_ftp_client(fin,ip,nat,ftp,dlen)384 int ippr_ftp_client(fin, ip, nat, ftp, dlen)
385 fr_info_t *fin;
386 nat_t *nat;
387 ftpinfo_t *ftp;
388 ip_t *ip;
389 int dlen;
390 {
391 	char *rptr, *wptr, cmd[6], c;
392 	ftpside_t *f;
393 	int inc, i;
394 
395 	inc = 0;
396 	f = &ftp->ftp_side[0];
397 	rptr = f->ftps_rptr;
398 	wptr = f->ftps_wptr;
399 
400 	for (i = 0; (i < 5) && (i < dlen); i++) {
401 		c = rptr[i];
402 		if (ISALPHA(c)) {
403 			cmd[i] = TOUPPER(c);
404 		} else {
405 			cmd[i] = c;
406 		}
407 	}
408 	cmd[i] = '\0';
409 
410 	ftp->ftp_incok = 0;
411 	if (!strncmp(cmd, "USER ", 5) || !strncmp(cmd, "XAUT ", 5)) {
412 		if (ftp->ftp_passok == FTPXY_ADOK_1 ||
413 		    ftp->ftp_passok == FTPXY_AUOK_1) {
414 			ftp->ftp_passok = FTPXY_USER_2;
415 			ftp->ftp_incok = 1;
416 		} else {
417 			ftp->ftp_passok = FTPXY_USER_1;
418 			ftp->ftp_incok = 1;
419 		}
420 	} else if (!strncmp(cmd, "AUTH ", 5)) {
421 		ftp->ftp_passok = FTPXY_AUTH_1;
422 		ftp->ftp_incok = 1;
423 	} else if (!strncmp(cmd, "PASS ", 5)) {
424 		if (ftp->ftp_passok == FTPXY_USOK_1) {
425 			ftp->ftp_passok = FTPXY_PASS_1;
426 			ftp->ftp_incok = 1;
427 		} else if (ftp->ftp_passok == FTPXY_USOK_2) {
428 			ftp->ftp_passok = FTPXY_PASS_2;
429 			ftp->ftp_incok = 1;
430 		}
431 	} else if ((ftp->ftp_passok == FTPXY_AUOK_1) &&
432 		   !strncmp(cmd, "ADAT ", 5)) {
433 		ftp->ftp_passok = FTPXY_ADAT_1;
434 		ftp->ftp_incok = 1;
435 	} else if ((ftp->ftp_passok == FTPXY_PAOK_1 ||
436 		    ftp->ftp_passok == FTPXY_PAOK_2) &&
437 		 !strncmp(cmd, "ACCT ", 5)) {
438 		ftp->ftp_passok = FTPXY_ACCT_1;
439 		ftp->ftp_incok = 1;
440 	} else if ((ftp->ftp_passok == FTPXY_GO) && !ippr_ftp_pasvonly &&
441 		 !strncmp(cmd, "PORT ", 5)) {
442 		inc = ippr_ftp_port(fin, ip, nat, f, dlen);
443 	} else if (ippr_ftp_insecure && !ippr_ftp_pasvonly &&
444 		   !strncmp(cmd, "PORT ", 5)) {
445 		inc = ippr_ftp_port(fin, ip, nat, f, dlen);
446 	}
447 
448 	while ((*rptr++ != '\n') && (rptr < wptr))
449 		;
450 	f->ftps_rptr = rptr;
451 	return inc;
452 }
453 
454 
ippr_ftp_pasv(fin,ip,nat,ftp,dlen)455 int ippr_ftp_pasv(fin, ip, nat, ftp, dlen)
456 fr_info_t *fin;
457 ip_t *ip;
458 nat_t *nat;
459 ftpinfo_t *ftp;
460 int dlen;
461 {
462 	u_int a1, a2, a3, a4, data_ip;
463 	char newbuf[IPF_FTPBUFSZ];
464 	const char *brackets[2];
465 	u_short a5, a6;
466 	ftpside_t *f;
467 	char *s;
468 
469 	if (ippr_ftp_forcepasv != 0 &&
470 	    ftp->ftp_side[0].ftps_cmds != FTPXY_C_PASV) {
471 		if (ippr_ftp_debug > 0)
472 			printf("ippr_ftp_pasv:ftps_cmds(%d) != FTPXY_C_PASV\n",
473 			       ftp->ftp_side[0].ftps_cmds);
474 		return 0;
475 	}
476 
477 	f = &ftp->ftp_side[1];
478 
479 #define	PASV_REPLEN	24
480 	/*
481 	 * Check for PASV reply message.
482 	 */
483 	if (dlen < IPF_MIN227LEN) {
484 		if (ippr_ftp_debug > 1)
485 			printf("ippr_ftp_pasv:dlen(%d) < IPF_MIN227LEN\n",
486 			       dlen);
487 		return 0;
488 	} else if (strncmp(f->ftps_rptr,
489 			   "227 Entering Passive Mod", PASV_REPLEN)) {
490 		if (ippr_ftp_debug > 0)
491 			printf("ippr_ftp_pasv:%d reply wrong\n", 227);
492 		return 0;
493 	}
494 
495 	brackets[0] = "";
496 	brackets[1] = "";
497 	/*
498 	 * Skip the PASV reply + space
499 	 */
500 	s = f->ftps_rptr + PASV_REPLEN;
501 	while (*s && !ISDIGIT(*s)) {
502 		if (*s == '(') {
503 			brackets[0] = "(";
504 			brackets[1] = ")";
505 		}
506 		s++;
507 	}
508 
509 	/*
510 	 * Pick out the address components, two at a time.
511 	 */
512 	a1 = ippr_ftp_atoi(&s);
513 	if (s == NULL) {
514 		if (ippr_ftp_debug > 1)
515 			printf("ippr_ftp_pasv:ippr_ftp_atoi(%d) failed\n", 1);
516 		return 0;
517 	}
518 	a2 = ippr_ftp_atoi(&s);
519 	if (s == NULL) {
520 		if (ippr_ftp_debug > 1)
521 			printf("ippr_ftp_pasv:ippr_ftp_atoi(%d) failed\n", 2);
522 		return 0;
523 	}
524 
525 	/*
526 	 * check that IP address in the PASV reply is the same as the
527 	 * sender of the command - prevents using PASV for port scanning.
528 	 */
529 	a1 <<= 16;
530 	a1 |= a2;
531 
532 	if (((nat->nat_dir == NAT_INBOUND) &&
533 	     (a1 != ntohl(nat->nat_inip.s_addr))) ||
534 	    ((nat->nat_dir == NAT_OUTBOUND) &&
535 	     (a1 != ntohl(nat->nat_oip.s_addr)))) {
536 		if (ippr_ftp_debug > 0)
537 			printf("ippr_ftp_pasv:%s != nat->nat_oip\n", "a1");
538 		return 0;
539 	}
540 
541 	a5 = ippr_ftp_atoi(&s);
542 	if (s == NULL) {
543 		if (ippr_ftp_debug > 1)
544 			printf("ippr_ftp_pasv:ippr_ftp_atoi(%d) failed\n", 3);
545 		return 0;
546 	}
547 
548 	if (*s == ')')
549 		s++;
550 	if (*s == '.')
551 		s++;
552 	if (*s == '\n')
553 		s--;
554 	/*
555 	 * check for CR-LF at the end.
556 	 */
557 	if ((*s == '\r') && (*(s + 1) == '\n')) {
558 		s += 2;
559 	} else {
560 		if (ippr_ftp_debug > 1)
561 			printf("ippr_ftp_pasv:missing %s", "cr-lf\n");
562 		return 0;
563 	}
564 
565 	a6 = a5 & 0xff;
566 	a5 >>= 8;
567 	/*
568 	 * Calculate new address parts for 227 reply
569 	 */
570 	if (nat->nat_dir == NAT_INBOUND) {
571 		data_ip = nat->nat_outip.s_addr;
572 		a1 = ntohl(data_ip);
573 	} else
574 		data_ip = htonl(a1);
575 
576 	a2 = (a1 >> 16) & 0xff;
577 	a3 = (a1 >> 8) & 0xff;
578 	a4 = a1 & 0xff;
579 	a1 >>= 24;
580 
581 #if defined(SNPRINTF) && defined(_KERNEL)
582 	SNPRINTF(newbuf, sizeof(newbuf), "%s %s%u,%u,%u,%u,%u,%u%s\r\n",
583 		"227 Entering Passive Mode", brackets[0], a1, a2, a3, a4,
584 		a5, a6, brackets[1]);
585 #else
586 	(void) sprintf(newbuf, "%s %s%u,%u,%u,%u,%u,%u%s\r\n",
587 		"227 Entering Passive Mode", brackets[0], a1, a2, a3, a4,
588 		a5, a6, brackets[1]);
589 #endif
590 	return ippr_ftp_pasvreply(fin, ip, nat, f, (a5 << 8 | a6),
591 				  newbuf, s, data_ip);
592 }
593 
ippr_ftp_pasvreply(fin,ip,nat,f,port,newmsg,s,data_ip)594 int ippr_ftp_pasvreply(fin, ip, nat, f, port, newmsg, s, data_ip)
595 fr_info_t *fin;
596 ip_t *ip;
597 nat_t *nat;
598 ftpside_t *f;
599 u_int port;
600 char *newmsg;
601 char *s;
602 u_int data_ip;
603 {
604 	int inc, off, nflags, sflags;
605 	tcphdr_t *tcp, tcph, *tcp2;
606 	struct in_addr swip, swip2;
607 	struct in_addr data_addr;
608 	size_t nlen, olen;
609 	fr_info_t fi;
610 	nat_t *nat2;
611 	mb_t *m;
612 
613 	m = fin->fin_m;
614 	tcp = (tcphdr_t *)fin->fin_dp;
615 	off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
616 
617 	data_addr.s_addr = data_ip;
618 	tcp2 = &tcph;
619 	inc = 0;
620 
621 
622 	olen = s - f->ftps_rptr;
623 	nlen = strlen(newmsg);
624 	inc = nlen - olen;
625 	if ((inc + ip->ip_len) > 65535) {
626 		if (ippr_ftp_debug > 0)
627 			printf("ippr_ftp_pasv:inc(%d) + ip->ip_len > 65535\n",
628 			       inc);
629 		return 0;
630 	}
631 
632 #if !defined(_KERNEL)
633 	bcopy(newmsg, MTOD(m, char *) + off, nlen);
634 #else
635 # if defined(MENTAT)
636 	if (inc < 0)
637 		(void)adjmsg(m, inc);
638 # else /* defined(MENTAT) */
639 	/*
640 	 * m_adj takes care of pkthdr.len, if required and treats inc<0 to
641 	 * mean remove -len bytes from the end of the packet.
642 	 * The mbuf chain will be extended if necessary by m_copyback().
643 	 */
644 	if (inc < 0)
645 		m_adj(m, inc);
646 # endif /* defined(MENTAT) */
647 #endif /* !defined(_KERNEL) */
648 	COPYBACK(m, off, nlen, newmsg);
649 
650 	if (inc != 0) {
651 		ip->ip_len += inc;
652 		fin->fin_dlen += inc;
653 		fin->fin_plen += inc;
654 	}
655 
656 	/*
657 	 * Add skeleton NAT entry for connection which will come back the
658 	 * other way.
659 	 */
660 	bcopy((char *)fin, (char *)&fi, sizeof(fi));
661 	fi.fin_state = NULL;
662 	fi.fin_nat = NULL;
663 	fi.fin_flx |= FI_IGNORE;
664 	fi.fin_data[0] = 0;
665 	fi.fin_data[1] = port;
666 	nflags = IPN_TCP|SI_W_SPORT;
667 	if (ippr_ftp_pasvrdr && f->ftps_ifp)
668 		nflags |= SI_W_DPORT;
669 	if (nat->nat_dir == NAT_OUTBOUND)
670 		nat2 = nat_outlookup(&fi, nflags|NAT_SEARCH,
671 				     nat->nat_p, nat->nat_inip, nat->nat_oip);
672 	else
673 		nat2 = nat_inlookup(&fi, nflags|NAT_SEARCH,
674 				    nat->nat_p, nat->nat_inip, nat->nat_oip);
675 	if (nat2 == NULL) {
676 		int slen;
677 
678 		slen = ip->ip_len;
679 		ip->ip_len = fin->fin_hlen + sizeof(*tcp2);
680 		bzero((char *)tcp2, sizeof(*tcp2));
681 		tcp2->th_win = htons(8192);
682 		tcp2->th_sport = 0;		/* XXX - fake it for nat_new */
683 		TCP_OFF_A(tcp2, 5);
684 		tcp2->th_flags = TH_SYN;
685 		fi.fin_data[1] = port;
686 		fi.fin_dlen = sizeof(*tcp2);
687 		tcp2->th_dport = htons(port);
688 		fi.fin_data[0] = 0;
689 		fi.fin_dp = (char *)tcp2;
690 		fi.fin_plen = fi.fin_hlen + sizeof(*tcp);
691 		fi.fin_fr = &ftppxyfr;
692 		fi.fin_out = nat->nat_dir;
693 		fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE;
694 		swip = ip->ip_src;
695 		swip2 = ip->ip_dst;
696 		if (nat->nat_dir == NAT_OUTBOUND) {
697 			fi.fin_fi.fi_daddr = data_addr.s_addr;
698 			fi.fin_fi.fi_saddr = nat->nat_inip.s_addr;
699 			ip->ip_dst = data_addr;
700 			ip->ip_src = nat->nat_inip;
701 		} else if (nat->nat_dir == NAT_INBOUND) {
702 			fi.fin_fi.fi_saddr = nat->nat_oip.s_addr;
703 			fi.fin_fi.fi_daddr = nat->nat_outip.s_addr;
704 			ip->ip_src = nat->nat_oip;
705 			ip->ip_dst = nat->nat_outip;
706 		}
707 
708 		sflags = nflags;
709 		nflags |= NAT_SLAVE;
710 		if (nat->nat_dir == NAT_INBOUND)
711 			nflags |= NAT_NOTRULEPORT;
712 		nat2 = nat_new(&fi, nat->nat_ptr, NULL, nflags, nat->nat_dir);
713 		if (nat2 != NULL) {
714 			(void) nat_proto(&fi, nat2, IPN_TCP);
715 			nat_update(&fi, nat2, nat->nat_ptr);
716 			fi.fin_ifp = NULL;
717 			if (nat->nat_dir == NAT_INBOUND) {
718 				fi.fin_fi.fi_daddr = nat->nat_inip.s_addr;
719 				ip->ip_dst = nat->nat_inip;
720 			}
721 			(void) fr_addstate(&fi, NULL, sflags);
722 			if (fi.fin_state != NULL)
723 				fr_statederef((ipstate_t **)&fi.fin_state);
724 		}
725 
726 		ip->ip_len = slen;
727 		ip->ip_src = swip;
728 		ip->ip_dst = swip2;
729 	}
730 	return inc;
731 }
732 
733 
ippr_ftp_server(fin,ip,nat,ftp,dlen)734 int ippr_ftp_server(fin, ip, nat, ftp, dlen)
735 fr_info_t *fin;
736 ip_t *ip;
737 nat_t *nat;
738 ftpinfo_t *ftp;
739 int dlen;
740 {
741 	char *rptr, *wptr;
742 	ftpside_t *f;
743 	int inc;
744 
745 	inc = 0;
746 	f = &ftp->ftp_side[1];
747 	rptr = f->ftps_rptr;
748 	wptr = f->ftps_wptr;
749 
750 	if (*rptr == ' ')
751 		goto server_cmd_ok;
752 	if (!ISDIGIT(*rptr) || !ISDIGIT(*(rptr + 1)) || !ISDIGIT(*(rptr + 2)))
753 		return 0;
754 	if (ftp->ftp_passok == FTPXY_GO) {
755 		if (!strncmp(rptr, "227 ", 4))
756 			inc = ippr_ftp_pasv(fin, ip, nat, ftp, dlen);
757 		else if (!strncmp(rptr, "229 ", 4))
758 			inc = ippr_ftp_epsv(fin, ip, nat, f, dlen);
759 	} else if (ippr_ftp_insecure && !strncmp(rptr, "227 ", 4)) {
760 		inc = ippr_ftp_pasv(fin, ip, nat, ftp, dlen);
761 	} else if (ippr_ftp_insecure && !strncmp(rptr, "229 ", 4)) {
762 		inc = ippr_ftp_epsv(fin, ip, nat, f, dlen);
763 	} else if (*rptr == '5' || *rptr == '4')
764 		ftp->ftp_passok = FTPXY_INIT;
765 	else if (ftp->ftp_incok) {
766 		if (*rptr == '3') {
767 			if (ftp->ftp_passok == FTPXY_ACCT_1)
768 				ftp->ftp_passok = FTPXY_GO;
769 			else
770 				ftp->ftp_passok++;
771 		} else if (*rptr == '2') {
772 			switch (ftp->ftp_passok)
773 			{
774 			case FTPXY_USER_1 :
775 			case FTPXY_USER_2 :
776 			case FTPXY_PASS_1 :
777 			case FTPXY_PASS_2 :
778 			case FTPXY_ACCT_1 :
779 				ftp->ftp_passok = FTPXY_GO;
780 				break;
781 			default :
782 				ftp->ftp_passok += 3;
783 				break;
784 			}
785 		}
786 	}
787 server_cmd_ok:
788 	ftp->ftp_incok = 0;
789 
790 	while ((*rptr++ != '\n') && (rptr < wptr))
791 		;
792 	f->ftps_rptr = rptr;
793 	return inc;
794 }
795 
796 
797 /*
798  * Look to see if the buffer starts with something which we recognise as
799  * being the correct syntax for the FTP protocol.
800  */
ippr_ftp_client_valid(ftps,buf,len)801 int ippr_ftp_client_valid(ftps, buf, len)
802 ftpside_t *ftps;
803 char *buf;
804 size_t len;
805 {
806 	register char *s, c, pc;
807 	register size_t i = len;
808 	char cmd[5];
809 
810 	s = buf;
811 
812 	if (ftps->ftps_junk == 1)
813 		return 1;
814 
815 	if (i < 5) {
816 		if (ippr_ftp_debug > 3)
817 			printf("ippr_ftp_client_valid:i(%d) < 5\n", (int)i);
818 		return 2;
819 	}
820 
821 	i--;
822 	c = *s++;
823 
824 	if (ISALPHA(c)) {
825 		cmd[0] = TOUPPER(c);
826 		c = *s++;
827 		i--;
828 		if (ISALPHA(c)) {
829 			cmd[1] = TOUPPER(c);
830 			c = *s++;
831 			i--;
832 			if (ISALPHA(c)) {
833 				cmd[2] = TOUPPER(c);
834 				c = *s++;
835 				i--;
836 				if (ISALPHA(c)) {
837 					cmd[3] = TOUPPER(c);
838 					c = *s++;
839 					i--;
840 					if ((c != ' ') && (c != '\r'))
841 						goto bad_client_command;
842 				} else if ((c != ' ') && (c != '\r'))
843 					goto bad_client_command;
844 			} else
845 				goto bad_client_command;
846 		} else
847 			goto bad_client_command;
848 	} else {
849 bad_client_command:
850 		if (ippr_ftp_debug > 3)
851 			printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*.*s]\n",
852 			       "ippr_ftp_client_valid",
853 			       ftps->ftps_junk, (int)len, (int)i, c,
854 			       (int)len, (int)len, buf);
855 		return 1;
856 	}
857 
858 	for (; i; i--) {
859 		pc = c;
860 		c = *s++;
861 		if ((pc == '\r') && (c == '\n')) {
862 			cmd[4] = '\0';
863 			if (!strcmp(cmd, "PASV"))
864 				ftps->ftps_cmds = FTPXY_C_PASV;
865 			else
866 				ftps->ftps_cmds = 0;
867 			return 0;
868 		}
869 	}
870 #if !defined(_KERNEL)
871 	printf("ippr_ftp_client_valid:junk after cmd[%*.*s]\n",
872 	       (int)len, (int)len, buf);
873 #endif
874 	return 2;
875 }
876 
877 
ippr_ftp_server_valid(ftps,buf,len)878 int ippr_ftp_server_valid(ftps, buf, len)
879 ftpside_t *ftps;
880 char *buf;
881 size_t len;
882 {
883 	register char *s, c, pc;
884 	register size_t i = len;
885 	int cmd;
886 
887 	s = buf;
888 	cmd = 0;
889 
890 	if (ftps->ftps_junk == 1)
891 		return 1;
892 
893 	if (i < 5) {
894 		if (ippr_ftp_debug > 3)
895 			printf("ippr_ftp_servert_valid:i(%d) < 5\n", (int)i);
896 		return 2;
897 	}
898 
899 	c = *s++;
900 	i--;
901 	if (c == ' ')
902 		goto search_eol;
903 
904 	if (ISDIGIT(c)) {
905 		cmd = (c - '0') * 100;
906 		c = *s++;
907 		i--;
908 		if (ISDIGIT(c)) {
909 			cmd += (c - '0') * 10;
910 			c = *s++;
911 			i--;
912 			if (ISDIGIT(c)) {
913 				cmd += (c - '0');
914 				c = *s++;
915 				i--;
916 				if ((c != '-') && (c != ' '))
917 					goto bad_server_command;
918 			} else
919 				goto bad_server_command;
920 		} else
921 			goto bad_server_command;
922 	} else {
923 bad_server_command:
924 		if (ippr_ftp_debug > 3)
925 			printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*.*s]\n",
926 			       "ippr_ftp_server_valid",
927 			       ftps->ftps_junk, (int)len, (int)i,
928 			       c, (int)len, (int)len, buf);
929 		return 1;
930 	}
931 search_eol:
932 	for (; i; i--) {
933 		pc = c;
934 		c = *s++;
935 		if ((pc == '\r') && (c == '\n')) {
936 			ftps->ftps_cmds = cmd;
937 			return 0;
938 		}
939 	}
940 	if (ippr_ftp_debug > 3)
941 		printf("ippr_ftp_server_valid:junk after cmd[%*.*s]\n",
942 		       (int)len, (int)len, buf);
943 	return 2;
944 }
945 
946 
ippr_ftp_valid(ftp,side,buf,len)947 int ippr_ftp_valid(ftp, side, buf, len)
948 ftpinfo_t *ftp;
949 int side;
950 char *buf;
951 size_t len;
952 {
953 	ftpside_t *ftps;
954 	int ret;
955 
956 	ftps = &ftp->ftp_side[side];
957 
958 	if (side == 0)
959 		ret = ippr_ftp_client_valid(ftps, buf, len);
960 	else
961 		ret = ippr_ftp_server_valid(ftps, buf, len);
962 	return ret;
963 }
964 
965 
966 /*
967  * For map rules, the following applies:
968  * rv == 0 for outbound processing,
969  * rv == 1 for inbound processing.
970  * For rdr rules, the following applies:
971  * rv == 0 for inbound processing,
972  * rv == 1 for outbound processing.
973  */
ippr_ftp_process(fin,nat,ftp,rv)974 int ippr_ftp_process(fin, nat, ftp, rv)
975 fr_info_t *fin;
976 nat_t *nat;
977 ftpinfo_t *ftp;
978 int rv;
979 {
980 	int mlen, len, off, inc, i, sel, sel2, ok, ackoff, seqoff;
981 	char *rptr, *wptr, *s;
982 	u_32_t thseq, thack;
983 	ap_session_t *aps;
984 	ftpside_t *f, *t;
985 	tcphdr_t *tcp;
986 	ip_t *ip;
987 	mb_t *m;
988 
989 	m = fin->fin_m;
990 	ip = fin->fin_ip;
991 	tcp = (tcphdr_t *)fin->fin_dp;
992 	off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
993 
994 	f = &ftp->ftp_side[rv];
995 	t = &ftp->ftp_side[1 - rv];
996 	thseq = ntohl(tcp->th_seq);
997 	thack = ntohl(tcp->th_ack);
998 
999 #ifdef __sgi
1000 	mlen = fin->fin_plen - off;
1001 #else
1002 	mlen = MSGDSIZE(m) - off;
1003 #endif
1004 	if (ippr_ftp_debug > 4)
1005 		printf("ippr_ftp_process: mlen %d\n", mlen);
1006 
1007 	if ((mlen == 0) && ((tcp->th_flags & TH_OPENING) == TH_OPENING)) {
1008 		f->ftps_seq[0] = thseq + 1;
1009 		t->ftps_seq[0] = thack;
1010 		return 0;
1011 	} else if (mlen < 0) {
1012 		return 0;
1013 	}
1014 
1015 	aps = nat->nat_aps;
1016 
1017 	sel = aps->aps_sel[1 - rv];
1018 	sel2 = aps->aps_sel[rv];
1019 	if (rv == 0) {
1020 		seqoff = aps->aps_seqoff[sel];
1021 		if (aps->aps_seqmin[sel] > seqoff + thseq)
1022 			seqoff = aps->aps_seqoff[!sel];
1023 		ackoff = aps->aps_ackoff[sel2];
1024 		if (aps->aps_ackmin[sel2] > ackoff + thack)
1025 			ackoff = aps->aps_ackoff[!sel2];
1026 	} else {
1027 		seqoff = aps->aps_ackoff[sel];
1028 		if (ippr_ftp_debug > 2)
1029 			printf("seqoff %d thseq %x ackmin %x\n", seqoff, thseq,
1030 			       aps->aps_ackmin[sel]);
1031 		if (aps->aps_ackmin[sel] > seqoff + thseq)
1032 			seqoff = aps->aps_ackoff[!sel];
1033 
1034 		ackoff = aps->aps_seqoff[sel2];
1035 		if (ippr_ftp_debug > 2)
1036 			printf("ackoff %d thack %x seqmin %x\n", ackoff, thack,
1037 			       aps->aps_seqmin[sel2]);
1038 		if (ackoff > 0) {
1039 			if (aps->aps_seqmin[sel2] > ackoff + thack)
1040 				ackoff = aps->aps_seqoff[!sel2];
1041 		} else {
1042 			if (aps->aps_seqmin[sel2] > thack)
1043 				ackoff = aps->aps_seqoff[!sel2];
1044 		}
1045 	}
1046 	if (ippr_ftp_debug > 2) {
1047 		printf("%s: %x seq %x/%d ack %x/%d len %d/%d off %d\n",
1048 		       rv ? "IN" : "OUT", tcp->th_flags, thseq, seqoff,
1049 		       thack, ackoff, mlen, fin->fin_plen, off);
1050 		printf("sel %d seqmin %x/%x offset %d/%d\n", sel,
1051 		       aps->aps_seqmin[sel], aps->aps_seqmin[sel2],
1052 		       aps->aps_seqoff[sel], aps->aps_seqoff[sel2]);
1053 		printf("sel %d ackmin %x/%x offset %d/%d\n", sel2,
1054 		       aps->aps_ackmin[sel], aps->aps_ackmin[sel2],
1055 		       aps->aps_ackoff[sel], aps->aps_ackoff[sel2]);
1056 	}
1057 
1058 	/*
1059 	 * XXX - Ideally, this packet should get dropped because we now know
1060 	 * that it is out of order (and there is no real danger in doing so
1061 	 * apart from causing packets to go through here ordered).
1062 	 */
1063 	if (ippr_ftp_debug > 2) {
1064 		printf("rv %d t:seq[0] %x seq[1] %x %d/%d\n",
1065 		       rv, t->ftps_seq[0], t->ftps_seq[1], seqoff, ackoff);
1066 	}
1067 
1068 	ok = 0;
1069 	if (t->ftps_seq[0] == 0) {
1070 		t->ftps_seq[0] = thack;
1071 		ok = 1;
1072 	} else {
1073 		if (ackoff == 0) {
1074 			if (t->ftps_seq[0] == thack)
1075 				ok = 1;
1076 			else if (t->ftps_seq[1] == thack) {
1077 				t->ftps_seq[0] = thack;
1078 				ok = 1;
1079 			}
1080 		} else {
1081 			if (t->ftps_seq[0] + ackoff == thack)
1082 				ok = 1;
1083 			else if (t->ftps_seq[0] == thack + ackoff)
1084 				ok = 1;
1085 			else if (t->ftps_seq[1] + ackoff == thack) {
1086 				t->ftps_seq[0] = thack - ackoff;
1087 				ok = 1;
1088 			} else if (t->ftps_seq[1] == thack + ackoff) {
1089 				t->ftps_seq[0] = thack - ackoff;
1090 				ok = 1;
1091 			}
1092 		}
1093 	}
1094 
1095 	if (ippr_ftp_debug > 2) {
1096 		if (!ok)
1097 			printf("%s ok\n", "not");
1098 	}
1099 
1100 	if (!mlen) {
1101 		if (t->ftps_seq[0] + ackoff != thack) {
1102 			if (ippr_ftp_debug > 1) {
1103 				printf("%s:seq[0](%x) + (%x) != (%x)\n",
1104 				       "ippr_ftp_process", t->ftps_seq[0],
1105 				       ackoff, thack);
1106 			}
1107 			return APR_ERR(1);
1108 		}
1109 
1110 		if (ippr_ftp_debug > 2) {
1111 			printf("ippr_ftp_process:f:seq[0] %x seq[1] %x\n",
1112 				f->ftps_seq[0], f->ftps_seq[1]);
1113 		}
1114 
1115 		if (tcp->th_flags & TH_FIN) {
1116 			if (thseq == f->ftps_seq[1]) {
1117 				f->ftps_seq[0] = f->ftps_seq[1] - seqoff;
1118 				f->ftps_seq[1] = thseq + 1 - seqoff;
1119 			} else {
1120 				if (ippr_ftp_debug > 1) {
1121 					printf("FIN: thseq %x seqoff %d ftps_seq %x %x\n",
1122 					       thseq, seqoff, f->ftps_seq[0], f->ftps_seq[1]);
1123 				}
1124 				return APR_ERR(1);
1125 			}
1126 		}
1127 		f->ftps_len = 0;
1128 		return 0;
1129 	}
1130 
1131 	ok = 0;
1132 	if ((thseq == f->ftps_seq[0]) || (thseq == f->ftps_seq[1])) {
1133 		ok = 1;
1134 	/*
1135 	 * Retransmitted data packet.
1136 	 */
1137 	} else if ((thseq + mlen == f->ftps_seq[0]) ||
1138 		   (thseq + mlen == f->ftps_seq[1])) {
1139 		ok = 1;
1140 	}
1141 
1142 	if (ok == 0) {
1143 		inc = thseq - f->ftps_seq[0];
1144 		if (ippr_ftp_debug > 1) {
1145 			printf("inc %d sel %d rv %d\n", inc, sel, rv);
1146 			printf("th_seq %x ftps_seq %x/%x\n",
1147 			       thseq, f->ftps_seq[0], f->ftps_seq[1]);
1148 			printf("ackmin %x ackoff %d\n", aps->aps_ackmin[sel],
1149 			       aps->aps_ackoff[sel]);
1150 			printf("seqmin %x seqoff %d\n", aps->aps_seqmin[sel],
1151 			       aps->aps_seqoff[sel]);
1152 		}
1153 
1154 		return APR_ERR(1);
1155 	}
1156 
1157 	inc = 0;
1158 	rptr = f->ftps_rptr;
1159 	wptr = f->ftps_wptr;
1160 	f->ftps_seq[0] = thseq;
1161 	f->ftps_seq[1] = f->ftps_seq[0] + mlen;
1162 	f->ftps_len = mlen;
1163 
1164 	while (mlen > 0) {
1165 		len = MIN(mlen, sizeof(f->ftps_buf) - (wptr - rptr));
1166 		COPYDATA(m, off, len, wptr);
1167 		mlen -= len;
1168 		off += len;
1169 		wptr += len;
1170 
1171 		if (ippr_ftp_debug > 3)
1172 			printf("%s:len %d/%d off %d wptr %lx junk %d [%*.*s]\n",
1173 			       "ippr_ftp_process",
1174 			       len, mlen, off, (u_long)wptr, f->ftps_junk,
1175 			       len, len, rptr);
1176 
1177 		f->ftps_wptr = wptr;
1178 		if (f->ftps_junk != 0) {
1179 			i = f->ftps_junk;
1180 			f->ftps_junk = ippr_ftp_valid(ftp, rv, rptr,
1181 						      wptr - rptr);
1182 
1183 			if (ippr_ftp_debug > 5)
1184 				printf("%s:junk %d -> %d\n",
1185 				       "ippr_ftp_process", i, f->ftps_junk);
1186 
1187 			if (f->ftps_junk != 0) {
1188 				if (wptr - rptr == sizeof(f->ftps_buf)) {
1189 					if (ippr_ftp_debug > 4)
1190 						printf("%s:full buffer\n",
1191 						       "ippr_ftp_process");
1192 					f->ftps_rptr = f->ftps_buf;
1193 					f->ftps_wptr = f->ftps_buf;
1194 					rptr = f->ftps_rptr;
1195 					wptr = f->ftps_wptr;
1196 					/*
1197 					 * Because we throw away data here that
1198 					 * we would otherwise parse, set the
1199 					 * junk flag to indicate just ignore
1200 					 * any data upto the next CRLF.
1201 					 */
1202 					f->ftps_junk = 1;
1203 					continue;
1204 				}
1205 			}
1206 		}
1207 
1208 		while ((f->ftps_junk == 0) && (wptr > rptr)) {
1209 			len = wptr - rptr;
1210 			f->ftps_junk = ippr_ftp_valid(ftp, rv, rptr, len);
1211 
1212 			if (ippr_ftp_debug > 3) {
1213 				printf("%s=%d len %d rv %d ptr %lx/%lx ",
1214 				       "ippr_ftp_valid",
1215 				       f->ftps_junk, len, rv, (u_long)rptr,
1216 				       (u_long)wptr);
1217 				printf("buf [%*.*s]\n", len, len, rptr);
1218 			}
1219 
1220 			if (f->ftps_junk == 0) {
1221 				f->ftps_rptr = rptr;
1222 				if (rv)
1223 					inc += ippr_ftp_server(fin, ip, nat,
1224 							       ftp, len);
1225 				else
1226 					inc += ippr_ftp_client(fin, ip, nat,
1227 							       ftp, len);
1228 				rptr = f->ftps_rptr;
1229 				wptr = f->ftps_wptr;
1230 			}
1231 		}
1232 
1233 		/*
1234 		 * Off to a bad start so lets just forget about using the
1235 		 * ftp proxy for this connection.
1236 		 */
1237 		if ((f->ftps_cmds == 0) && (f->ftps_junk == 1)) {
1238 			/* f->ftps_seq[1] += inc; */
1239 
1240 			if (ippr_ftp_debug > 1)
1241 				printf("%s:cmds == 0 junk == 1\n",
1242 				       "ippr_ftp_process");
1243 			return APR_ERR(2);
1244 		}
1245 
1246 		if ((f->ftps_junk != 0) && (rptr < wptr)) {
1247 			for (s = rptr; s < wptr; s++) {
1248 				if ((*s == '\r') && (s + 1 < wptr) &&
1249 				    (*(s + 1) == '\n')) {
1250 					rptr = s + 2;
1251 					f->ftps_junk = 0;
1252 					break;
1253 				}
1254 			}
1255 		}
1256 
1257 		if (rptr == wptr) {
1258 			rptr = wptr = f->ftps_buf;
1259 		} else {
1260 			/*
1261 			 * Compact the buffer back to the start.  The junk
1262 			 * flag should already be set and because we're not
1263 			 * throwing away any data, it is preserved from its
1264 			 * current state.
1265 			 */
1266 			if (rptr > f->ftps_buf) {
1267 				bcopy(rptr, f->ftps_buf, len);
1268 				wptr -= rptr - f->ftps_buf;
1269 				rptr = f->ftps_buf;
1270 			}
1271 		}
1272 		f->ftps_rptr = rptr;
1273 		f->ftps_wptr = wptr;
1274 	}
1275 
1276 	/* f->ftps_seq[1] += inc; */
1277 	if (tcp->th_flags & TH_FIN)
1278 		f->ftps_seq[1]++;
1279 	if (ippr_ftp_debug > 3) {
1280 #ifdef __sgi
1281 		mlen = fin->fin_plen;
1282 #else
1283 		mlen = MSGDSIZE(m);
1284 #endif
1285 		mlen -= off;
1286 		printf("ftps_seq[1] = %x inc %d len %d\n",
1287 		       f->ftps_seq[1], inc, mlen);
1288 	}
1289 
1290 	f->ftps_rptr = rptr;
1291 	f->ftps_wptr = wptr;
1292 	return APR_INC(inc);
1293 }
1294 
1295 
ippr_ftp_out(fin,aps,nat)1296 int ippr_ftp_out(fin, aps, nat)
1297 fr_info_t *fin;
1298 ap_session_t *aps;
1299 nat_t *nat;
1300 {
1301 	ftpinfo_t *ftp;
1302 	int rev;
1303 
1304 	ftp = aps->aps_data;
1305 	if (ftp == NULL)
1306 		return 0;
1307 
1308 	rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1;
1309 	if (ftp->ftp_side[1 - rev].ftps_ifp == NULL)
1310 		ftp->ftp_side[1 - rev].ftps_ifp = fin->fin_ifp;
1311 
1312 	return ippr_ftp_process(fin, nat, ftp, rev);
1313 }
1314 
1315 
ippr_ftp_in(fin,aps,nat)1316 int ippr_ftp_in(fin, aps, nat)
1317 fr_info_t *fin;
1318 ap_session_t *aps;
1319 nat_t *nat;
1320 {
1321 	ftpinfo_t *ftp;
1322 	int rev;
1323 
1324 	ftp = aps->aps_data;
1325 	if (ftp == NULL)
1326 		return 0;
1327 
1328 	rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1;
1329 	if (ftp->ftp_side[rev].ftps_ifp == NULL)
1330 		ftp->ftp_side[rev].ftps_ifp = fin->fin_ifp;
1331 
1332 	return ippr_ftp_process(fin, nat, ftp, 1 - rev);
1333 }
1334 
1335 
1336 /*
1337  * ippr_ftp_atoi - implement a version of atoi which processes numbers in
1338  * pairs separated by commas (which are expected to be in the range 0 - 255),
1339  * returning a 16 bit number combining either side of the , as the MSB and
1340  * LSB.
1341  */
ippr_ftp_atoi(ptr)1342 u_short ippr_ftp_atoi(ptr)
1343 char **ptr;
1344 {
1345 	register char *s = *ptr, c;
1346 	register u_char i = 0, j = 0;
1347 
1348 	while (((c = *s++) != '\0') && ISDIGIT(c)) {
1349 		i *= 10;
1350 		i += c - '0';
1351 	}
1352 	if (c != ',') {
1353 		*ptr = NULL;
1354 		return 0;
1355 	}
1356 	while (((c = *s++) != '\0') && ISDIGIT(c)) {
1357 		j *= 10;
1358 		j += c - '0';
1359 	}
1360 	*ptr = s;
1361 	i &= 0xff;
1362 	j &= 0xff;
1363 	return (i << 8) | j;
1364 }
1365 
1366 
ippr_ftp_epsv(fin,ip,nat,f,dlen)1367 int ippr_ftp_epsv(fin, ip, nat, f, dlen)
1368 fr_info_t *fin;
1369 ip_t *ip;
1370 nat_t *nat;
1371 ftpside_t *f;
1372 int dlen;
1373 {
1374 	char newbuf[IPF_FTPBUFSZ];
1375 	char *s;
1376 	u_short ap = 0;
1377 
1378 #define EPSV_REPLEN	33
1379 	/*
1380 	 * Check for EPSV reply message.
1381 	 */
1382 	if (dlen < IPF_MIN229LEN)
1383 		return (0);
1384 	else if (strncmp(f->ftps_rptr,
1385 			 "229 Entering Extended Passive Mode", EPSV_REPLEN))
1386 		return (0);
1387 
1388 	/*
1389 	 * Skip the EPSV command + space
1390 	 */
1391 	s = f->ftps_rptr + 33;
1392 	while (*s && !ISDIGIT(*s))
1393 		s++;
1394 
1395 	/*
1396 	 * As per RFC 2428, there are no addres components in the EPSV
1397 	 * response.  So we'll go straight to getting the port.
1398 	 */
1399 	while (*s && ISDIGIT(*s)) {
1400 		ap *= 10;
1401 		ap += *s++ - '0';
1402 	}
1403 
1404 	if (!*s)
1405 		return 0;
1406 
1407 	if (*s == '|')
1408 		s++;
1409 	if (*s == ')')
1410 		s++;
1411 	if (*s == '\n')
1412 		s--;
1413 	/*
1414 	 * check for CR-LF at the end.
1415 	 */
1416 	if ((*s == '\r') && (*(s + 1) == '\n')) {
1417 		s += 2;
1418 	} else
1419 		return 0;
1420 
1421 #if defined(SNPRINTF) && defined(_KERNEL)
1422 	SNPRINTF(newbuf, sizeof(newbuf), "%s (|||%u|)\r\n",
1423 		 "229 Entering Extended Passive Mode", ap);
1424 #else
1425 	(void) sprintf(newbuf, "%s (|||%u|)\r\n",
1426 		       "229 Entering Extended Passive Mode", ap);
1427 #endif
1428 
1429 	return ippr_ftp_pasvreply(fin, ip, nat, f, (u_int)ap, newbuf, s,
1430 				  ip->ip_src.s_addr);
1431 }
1432