17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * Copyright (C) 1997-2003 by Darren Reed 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing. 57c478bd9Sstevel@tonic-gate * 6*ab25eeb5Syz * $Id: ip_ftp_pxy.c,v 2.88.2.15 2005/03/19 19:38:10 darrenr Exp $ 7*ab25eeb5Syz * 8*ab25eeb5Syz * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 97c478bd9Sstevel@tonic-gate * Use is subject to license terms. 107c478bd9Sstevel@tonic-gate * 117c478bd9Sstevel@tonic-gate * Simple FTP transparent proxy for in-kernel use. For use with the NAT 127c478bd9Sstevel@tonic-gate * code. 13*ab25eeb5Syz */ 147c478bd9Sstevel@tonic-gate 157c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 167c478bd9Sstevel@tonic-gate 177c478bd9Sstevel@tonic-gate 187c478bd9Sstevel@tonic-gate #define IPF_FTP_PROXY 197c478bd9Sstevel@tonic-gate 207c478bd9Sstevel@tonic-gate #define IPF_MINPORTLEN 18 217c478bd9Sstevel@tonic-gate #define IPF_MAXPORTLEN 30 227c478bd9Sstevel@tonic-gate #define IPF_MIN227LEN 39 237c478bd9Sstevel@tonic-gate #define IPF_MAX227LEN 51 247c478bd9Sstevel@tonic-gate #define IPF_MIN229LEN 47 257c478bd9Sstevel@tonic-gate #define IPF_MAX229LEN 51 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate #define FTPXY_GO 0 287c478bd9Sstevel@tonic-gate #define FTPXY_INIT 1 297c478bd9Sstevel@tonic-gate #define FTPXY_USER_1 2 307c478bd9Sstevel@tonic-gate #define FTPXY_USOK_1 3 317c478bd9Sstevel@tonic-gate #define FTPXY_PASS_1 4 327c478bd9Sstevel@tonic-gate #define FTPXY_PAOK_1 5 337c478bd9Sstevel@tonic-gate #define FTPXY_AUTH_1 6 347c478bd9Sstevel@tonic-gate #define FTPXY_AUOK_1 7 357c478bd9Sstevel@tonic-gate #define FTPXY_ADAT_1 8 367c478bd9Sstevel@tonic-gate #define FTPXY_ADOK_1 9 377c478bd9Sstevel@tonic-gate #define FTPXY_ACCT_1 10 387c478bd9Sstevel@tonic-gate #define FTPXY_ACOK_1 11 397c478bd9Sstevel@tonic-gate #define FTPXY_USER_2 12 407c478bd9Sstevel@tonic-gate #define FTPXY_USOK_2 13 417c478bd9Sstevel@tonic-gate #define FTPXY_PASS_2 14 427c478bd9Sstevel@tonic-gate #define FTPXY_PAOK_2 15 437c478bd9Sstevel@tonic-gate 447c478bd9Sstevel@tonic-gate /* 457c478bd9Sstevel@tonic-gate * Values for FTP commands. Numerics cover 0-999 467c478bd9Sstevel@tonic-gate */ 477c478bd9Sstevel@tonic-gate #define FTPXY_C_PASV 1000 487c478bd9Sstevel@tonic-gate 497c478bd9Sstevel@tonic-gate int ippr_ftp_client __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int)); 507c478bd9Sstevel@tonic-gate int ippr_ftp_complete __P((char *, size_t)); 517c478bd9Sstevel@tonic-gate int ippr_ftp_in __P((fr_info_t *, ap_session_t *, nat_t *)); 527c478bd9Sstevel@tonic-gate int ippr_ftp_init __P((void)); 537c478bd9Sstevel@tonic-gate void ippr_ftp_fini __P((void)); 547c478bd9Sstevel@tonic-gate int ippr_ftp_new __P((fr_info_t *, ap_session_t *, nat_t *)); 557c478bd9Sstevel@tonic-gate int ippr_ftp_out __P((fr_info_t *, ap_session_t *, nat_t *)); 567c478bd9Sstevel@tonic-gate int ippr_ftp_pasv __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int)); 577c478bd9Sstevel@tonic-gate int ippr_ftp_epsv __P((fr_info_t *, ip_t *, nat_t *, ftpside_t *, int)); 587c478bd9Sstevel@tonic-gate int ippr_ftp_port __P((fr_info_t *, ip_t *, nat_t *, ftpside_t *, int)); 597c478bd9Sstevel@tonic-gate int ippr_ftp_process __P((fr_info_t *, nat_t *, ftpinfo_t *, int)); 607c478bd9Sstevel@tonic-gate int ippr_ftp_server __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int)); 617c478bd9Sstevel@tonic-gate int ippr_ftp_valid __P((ftpinfo_t *, int, char *, size_t)); 627c478bd9Sstevel@tonic-gate int ippr_ftp_server_valid __P((ftpside_t *, char *, size_t)); 637c478bd9Sstevel@tonic-gate int ippr_ftp_client_valid __P((ftpside_t *, char *, size_t)); 647c478bd9Sstevel@tonic-gate u_short ippr_ftp_atoi __P((char **)); 657c478bd9Sstevel@tonic-gate int ippr_ftp_pasvreply __P((fr_info_t *, ip_t *, nat_t *, ftpside_t *, 667c478bd9Sstevel@tonic-gate u_int, char *, char *, u_int)); 677c478bd9Sstevel@tonic-gate 687c478bd9Sstevel@tonic-gate 697c478bd9Sstevel@tonic-gate int ftp_proxy_init = 0; 707c478bd9Sstevel@tonic-gate int ippr_ftp_pasvonly = 0; 717c478bd9Sstevel@tonic-gate int ippr_ftp_insecure = 0; /* Do not require logins before transfers */ 727c478bd9Sstevel@tonic-gate int ippr_ftp_pasvrdr = 0; 737c478bd9Sstevel@tonic-gate int ippr_ftp_forcepasv = 0; /* PASV must be last command prior to 227 */ 74*ab25eeb5Syz #if defined(_KERNEL) 75*ab25eeb5Syz int ippr_ftp_debug = 0; 76*ab25eeb5Syz #else 77*ab25eeb5Syz int ippr_ftp_debug = 2; 78*ab25eeb5Syz #endif 79*ab25eeb5Syz /* 80*ab25eeb5Syz * 1 - security 81*ab25eeb5Syz * 2 - errors 82*ab25eeb5Syz * 3 - error debugging 83*ab25eeb5Syz * 4 - parsing errors 84*ab25eeb5Syz * 5 - parsing info 85*ab25eeb5Syz * 6 - parsing debug 86*ab25eeb5Syz */ 87*ab25eeb5Syz 88*ab25eeb5Syz static frentry_t ftppxyfr; 89*ab25eeb5Syz static ipftuneable_t ftptune = { 90*ab25eeb5Syz { &ippr_ftp_debug }, 91*ab25eeb5Syz "ippr_ftp_debug", 92*ab25eeb5Syz 0, 93*ab25eeb5Syz 10, 94*ab25eeb5Syz sizeof(ippr_ftp_debug), 95*ab25eeb5Syz 0, 96*ab25eeb5Syz NULL 97*ab25eeb5Syz }; 987c478bd9Sstevel@tonic-gate 997c478bd9Sstevel@tonic-gate 1007c478bd9Sstevel@tonic-gate /* 1017c478bd9Sstevel@tonic-gate * Initialize local structures. 1027c478bd9Sstevel@tonic-gate */ 1037c478bd9Sstevel@tonic-gate int ippr_ftp_init() 1047c478bd9Sstevel@tonic-gate { 1057c478bd9Sstevel@tonic-gate bzero((char *)&ftppxyfr, sizeof(ftppxyfr)); 1067c478bd9Sstevel@tonic-gate ftppxyfr.fr_ref = 1; 1077c478bd9Sstevel@tonic-gate ftppxyfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE; 1087c478bd9Sstevel@tonic-gate MUTEX_INIT(&ftppxyfr.fr_lock, "FTP Proxy Mutex"); 1097c478bd9Sstevel@tonic-gate ftp_proxy_init = 1; 110*ab25eeb5Syz (void) fr_addipftune(&ftptune); 1117c478bd9Sstevel@tonic-gate 1127c478bd9Sstevel@tonic-gate return 0; 1137c478bd9Sstevel@tonic-gate } 1147c478bd9Sstevel@tonic-gate 1157c478bd9Sstevel@tonic-gate 1167c478bd9Sstevel@tonic-gate void ippr_ftp_fini() 1177c478bd9Sstevel@tonic-gate { 118*ab25eeb5Syz (void) fr_delipftune(&ftptune); 119*ab25eeb5Syz 1207c478bd9Sstevel@tonic-gate if (ftp_proxy_init == 1) { 1217c478bd9Sstevel@tonic-gate MUTEX_DESTROY(&ftppxyfr.fr_lock); 1227c478bd9Sstevel@tonic-gate ftp_proxy_init = 0; 1237c478bd9Sstevel@tonic-gate } 1247c478bd9Sstevel@tonic-gate } 1257c478bd9Sstevel@tonic-gate 1267c478bd9Sstevel@tonic-gate 1277c478bd9Sstevel@tonic-gate int ippr_ftp_new(fin, aps, nat) 1287c478bd9Sstevel@tonic-gate fr_info_t *fin; 1297c478bd9Sstevel@tonic-gate ap_session_t *aps; 1307c478bd9Sstevel@tonic-gate nat_t *nat; 1317c478bd9Sstevel@tonic-gate { 1327c478bd9Sstevel@tonic-gate ftpinfo_t *ftp; 1337c478bd9Sstevel@tonic-gate ftpside_t *f; 1347c478bd9Sstevel@tonic-gate 1357c478bd9Sstevel@tonic-gate KMALLOC(ftp, ftpinfo_t *); 1367c478bd9Sstevel@tonic-gate if (ftp == NULL) 1377c478bd9Sstevel@tonic-gate return -1; 1387c478bd9Sstevel@tonic-gate 1397c478bd9Sstevel@tonic-gate fin = fin; /* LINT */ 1407c478bd9Sstevel@tonic-gate nat = nat; /* LINT */ 1417c478bd9Sstevel@tonic-gate 1427c478bd9Sstevel@tonic-gate aps->aps_data = ftp; 1437c478bd9Sstevel@tonic-gate aps->aps_psiz = sizeof(ftpinfo_t); 1447c478bd9Sstevel@tonic-gate 1457c478bd9Sstevel@tonic-gate bzero((char *)ftp, sizeof(*ftp)); 1467c478bd9Sstevel@tonic-gate f = &ftp->ftp_side[0]; 1477c478bd9Sstevel@tonic-gate f->ftps_rptr = f->ftps_buf; 1487c478bd9Sstevel@tonic-gate f->ftps_wptr = f->ftps_buf; 1497c478bd9Sstevel@tonic-gate f = &ftp->ftp_side[1]; 1507c478bd9Sstevel@tonic-gate f->ftps_rptr = f->ftps_buf; 1517c478bd9Sstevel@tonic-gate f->ftps_wptr = f->ftps_buf; 1527c478bd9Sstevel@tonic-gate ftp->ftp_passok = FTPXY_INIT; 1537c478bd9Sstevel@tonic-gate ftp->ftp_incok = 0; 1547c478bd9Sstevel@tonic-gate return 0; 1557c478bd9Sstevel@tonic-gate } 1567c478bd9Sstevel@tonic-gate 1577c478bd9Sstevel@tonic-gate 1587c478bd9Sstevel@tonic-gate int ippr_ftp_port(fin, ip, nat, f, dlen) 1597c478bd9Sstevel@tonic-gate fr_info_t *fin; 1607c478bd9Sstevel@tonic-gate ip_t *ip; 1617c478bd9Sstevel@tonic-gate nat_t *nat; 1627c478bd9Sstevel@tonic-gate ftpside_t *f; 1637c478bd9Sstevel@tonic-gate int dlen; 1647c478bd9Sstevel@tonic-gate { 1657c478bd9Sstevel@tonic-gate tcphdr_t *tcp, tcph, *tcp2 = &tcph; 1667c478bd9Sstevel@tonic-gate char newbuf[IPF_FTPBUFSZ], *s; 1677c478bd9Sstevel@tonic-gate struct in_addr swip, swip2; 1687c478bd9Sstevel@tonic-gate u_int a1, a2, a3, a4; 169*ab25eeb5Syz int inc, off, flags; 1707c478bd9Sstevel@tonic-gate u_short a5, a6, sp; 1717c478bd9Sstevel@tonic-gate size_t nlen, olen; 1727c478bd9Sstevel@tonic-gate fr_info_t fi; 1737c478bd9Sstevel@tonic-gate nat_t *nat2; 1747c478bd9Sstevel@tonic-gate mb_t *m; 1757c478bd9Sstevel@tonic-gate 1767c478bd9Sstevel@tonic-gate m = fin->fin_m; 1777c478bd9Sstevel@tonic-gate tcp = (tcphdr_t *)fin->fin_dp; 178*ab25eeb5Syz off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 1797c478bd9Sstevel@tonic-gate 1807c478bd9Sstevel@tonic-gate /* 1817c478bd9Sstevel@tonic-gate * Check for client sending out PORT message. 1827c478bd9Sstevel@tonic-gate */ 1837c478bd9Sstevel@tonic-gate if (dlen < IPF_MINPORTLEN) { 184*ab25eeb5Syz if (ippr_ftp_debug > 1) 185*ab25eeb5Syz printf("ippr_ftp_port:dlen(%d) < IPF_MINPORTLEN\n", 186*ab25eeb5Syz dlen); 1877c478bd9Sstevel@tonic-gate return 0; 1887c478bd9Sstevel@tonic-gate } 1897c478bd9Sstevel@tonic-gate /* 1907c478bd9Sstevel@tonic-gate * Skip the PORT command + space 1917c478bd9Sstevel@tonic-gate */ 1927c478bd9Sstevel@tonic-gate s = f->ftps_rptr + 5; 1937c478bd9Sstevel@tonic-gate /* 1947c478bd9Sstevel@tonic-gate * Pick out the address components, two at a time. 1957c478bd9Sstevel@tonic-gate */ 1967c478bd9Sstevel@tonic-gate a1 = ippr_ftp_atoi(&s); 1977c478bd9Sstevel@tonic-gate if (s == NULL) { 198*ab25eeb5Syz if (ippr_ftp_debug > 1) 199*ab25eeb5Syz printf("ippr_ftp_port:ippr_ftp_atoi(%d) failed\n", 1); 2007c478bd9Sstevel@tonic-gate return 0; 2017c478bd9Sstevel@tonic-gate } 2027c478bd9Sstevel@tonic-gate a2 = ippr_ftp_atoi(&s); 2037c478bd9Sstevel@tonic-gate if (s == NULL) { 204*ab25eeb5Syz if (ippr_ftp_debug > 1) 205*ab25eeb5Syz printf("ippr_ftp_port:ippr_ftp_atoi(%d) failed\n", 2); 2067c478bd9Sstevel@tonic-gate return 0; 2077c478bd9Sstevel@tonic-gate } 208*ab25eeb5Syz 2097c478bd9Sstevel@tonic-gate /* 2107c478bd9Sstevel@tonic-gate * Check that IP address in the PORT/PASV reply is the same as the 2117c478bd9Sstevel@tonic-gate * sender of the command - prevents using PORT for port scanning. 2127c478bd9Sstevel@tonic-gate */ 2137c478bd9Sstevel@tonic-gate a1 <<= 16; 2147c478bd9Sstevel@tonic-gate a1 |= a2; 2157c478bd9Sstevel@tonic-gate if (((nat->nat_dir == NAT_OUTBOUND) && 2167c478bd9Sstevel@tonic-gate (a1 != ntohl(nat->nat_inip.s_addr))) || 2177c478bd9Sstevel@tonic-gate ((nat->nat_dir == NAT_INBOUND) && 2187c478bd9Sstevel@tonic-gate (a1 != ntohl(nat->nat_oip.s_addr)))) { 219*ab25eeb5Syz if (ippr_ftp_debug > 0) 220*ab25eeb5Syz printf("ippr_ftp_port:%s != nat->nat_inip\n", "a1"); 2217c478bd9Sstevel@tonic-gate return APR_ERR(1); 2227c478bd9Sstevel@tonic-gate } 2237c478bd9Sstevel@tonic-gate 2247c478bd9Sstevel@tonic-gate a5 = ippr_ftp_atoi(&s); 2257c478bd9Sstevel@tonic-gate if (s == NULL) { 226*ab25eeb5Syz if (ippr_ftp_debug > 1) 227*ab25eeb5Syz printf("ippr_ftp_port:ippr_ftp_atoi(%d) failed\n", 3); 2287c478bd9Sstevel@tonic-gate return 0; 2297c478bd9Sstevel@tonic-gate } 2307c478bd9Sstevel@tonic-gate if (*s == ')') 2317c478bd9Sstevel@tonic-gate s++; 2327c478bd9Sstevel@tonic-gate 2337c478bd9Sstevel@tonic-gate /* 2347c478bd9Sstevel@tonic-gate * check for CR-LF at the end. 2357c478bd9Sstevel@tonic-gate */ 2367c478bd9Sstevel@tonic-gate if (*s == '\n') 2377c478bd9Sstevel@tonic-gate s--; 2387c478bd9Sstevel@tonic-gate if ((*s == '\r') && (*(s + 1) == '\n')) { 2397c478bd9Sstevel@tonic-gate s += 2; 2407c478bd9Sstevel@tonic-gate a6 = a5 & 0xff; 2417c478bd9Sstevel@tonic-gate } else { 242*ab25eeb5Syz if (ippr_ftp_debug > 1) 243*ab25eeb5Syz printf("ippr_ftp_port:missing %s\n", "cr-lf"); 2447c478bd9Sstevel@tonic-gate return 0; 2457c478bd9Sstevel@tonic-gate } 246*ab25eeb5Syz 2477c478bd9Sstevel@tonic-gate a5 >>= 8; 2487c478bd9Sstevel@tonic-gate a5 &= 0xff; 249*ab25eeb5Syz sp = a5 << 8 | a6; 250*ab25eeb5Syz /* 251*ab25eeb5Syz * Don't allow the PORT command to specify a port < 1024 due to 252*ab25eeb5Syz * security crap. 253*ab25eeb5Syz */ 254*ab25eeb5Syz if (sp < 1024) { 255*ab25eeb5Syz if (ippr_ftp_debug > 0) 256*ab25eeb5Syz printf("ippr_ftp_port:sp(%d) < 1024\n", sp); 257*ab25eeb5Syz return 0; 258*ab25eeb5Syz } 2597c478bd9Sstevel@tonic-gate /* 2607c478bd9Sstevel@tonic-gate * Calculate new address parts for PORT command 2617c478bd9Sstevel@tonic-gate */ 2627c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_INBOUND) 2637c478bd9Sstevel@tonic-gate a1 = ntohl(nat->nat_oip.s_addr); 2647c478bd9Sstevel@tonic-gate else 2657c478bd9Sstevel@tonic-gate a1 = ntohl(ip->ip_src.s_addr); 2667c478bd9Sstevel@tonic-gate a2 = (a1 >> 16) & 0xff; 2677c478bd9Sstevel@tonic-gate a3 = (a1 >> 8) & 0xff; 2687c478bd9Sstevel@tonic-gate a4 = a1 & 0xff; 2697c478bd9Sstevel@tonic-gate a1 >>= 24; 2707c478bd9Sstevel@tonic-gate olen = s - f->ftps_rptr; 2717c478bd9Sstevel@tonic-gate /* DO NOT change this to snprintf! */ 272*ab25eeb5Syz #if defined(SNPRINTF) && defined(_KERNEL) 273*ab25eeb5Syz (void) SNPRINTF(newbuf, sizeof(newbuf), "%s %u,%u,%u,%u,%u,%u\r\n", 274*ab25eeb5Syz "PORT", a1, a2, a3, a4, a5, a6); 2757c478bd9Sstevel@tonic-gate #else 2767c478bd9Sstevel@tonic-gate (void) sprintf(newbuf, "%s %u,%u,%u,%u,%u,%u\r\n", 2777c478bd9Sstevel@tonic-gate "PORT", a1, a2, a3, a4, a5, a6); 2787c478bd9Sstevel@tonic-gate #endif 2797c478bd9Sstevel@tonic-gate 2807c478bd9Sstevel@tonic-gate nlen = strlen(newbuf); 2817c478bd9Sstevel@tonic-gate inc = nlen - olen; 2827c478bd9Sstevel@tonic-gate if ((inc + ip->ip_len) > 65535) { 283*ab25eeb5Syz if (ippr_ftp_debug > 0) 284*ab25eeb5Syz printf("ippr_ftp_port:inc(%d) + ip->ip_len > 65535\n", 285*ab25eeb5Syz inc); 2867c478bd9Sstevel@tonic-gate return 0; 2877c478bd9Sstevel@tonic-gate } 2887c478bd9Sstevel@tonic-gate 2897c478bd9Sstevel@tonic-gate #if !defined(_KERNEL) 2907c478bd9Sstevel@tonic-gate bcopy(newbuf, MTOD(m, char *) + off, nlen); 2917c478bd9Sstevel@tonic-gate #else 2927c478bd9Sstevel@tonic-gate # if defined(MENTAT) 2937c478bd9Sstevel@tonic-gate if (inc < 0) 2947c478bd9Sstevel@tonic-gate (void)adjmsg(m, inc); 295*ab25eeb5Syz # else /* defined(MENTAT) */ 296*ab25eeb5Syz /* 297*ab25eeb5Syz * m_adj takes care of pkthdr.len, if required and treats inc<0 to 298*ab25eeb5Syz * mean remove -len bytes from the end of the packet. 299*ab25eeb5Syz * The mbuf chain will be extended if necessary by m_copyback(). 300*ab25eeb5Syz */ 3017c478bd9Sstevel@tonic-gate if (inc < 0) 3027c478bd9Sstevel@tonic-gate m_adj(m, inc); 303*ab25eeb5Syz # endif /* defined(MENTAT) */ 304*ab25eeb5Syz #endif /* !defined(_KERNEL) */ 3057c478bd9Sstevel@tonic-gate COPYBACK(m, off, nlen, newbuf); 3067c478bd9Sstevel@tonic-gate 3077c478bd9Sstevel@tonic-gate if (inc != 0) { 3087c478bd9Sstevel@tonic-gate ip->ip_len += inc; 3097c478bd9Sstevel@tonic-gate fin->fin_dlen += inc; 3107c478bd9Sstevel@tonic-gate fin->fin_plen += inc; 3117c478bd9Sstevel@tonic-gate } 3127c478bd9Sstevel@tonic-gate 3137c478bd9Sstevel@tonic-gate /* 3147c478bd9Sstevel@tonic-gate * The server may not make the connection back from port 20, but 3157c478bd9Sstevel@tonic-gate * it is the most likely so use it here to check for a conflicting 3167c478bd9Sstevel@tonic-gate * mapping. 3177c478bd9Sstevel@tonic-gate */ 3187c478bd9Sstevel@tonic-gate bcopy((char *)fin, (char *)&fi, sizeof(fi)); 319*ab25eeb5Syz fi.fin_state = NULL; 320*ab25eeb5Syz fi.fin_nat = NULL; 3217c478bd9Sstevel@tonic-gate fi.fin_flx |= FI_IGNORE; 3227c478bd9Sstevel@tonic-gate fi.fin_data[0] = sp; 3237c478bd9Sstevel@tonic-gate fi.fin_data[1] = fin->fin_data[1] - 1; 324*ab25eeb5Syz /* 325*ab25eeb5Syz * Add skeleton NAT entry for connection which will come back the 326*ab25eeb5Syz * other way. 327*ab25eeb5Syz */ 3287c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_OUTBOUND) 3297c478bd9Sstevel@tonic-gate nat2 = nat_outlookup(&fi, NAT_SEARCH|IPN_TCP, nat->nat_p, 3307c478bd9Sstevel@tonic-gate nat->nat_inip, nat->nat_oip); 3317c478bd9Sstevel@tonic-gate else 3327c478bd9Sstevel@tonic-gate nat2 = nat_inlookup(&fi, NAT_SEARCH|IPN_TCP, nat->nat_p, 3337c478bd9Sstevel@tonic-gate nat->nat_inip, nat->nat_oip); 3347c478bd9Sstevel@tonic-gate if (nat2 == NULL) { 3357c478bd9Sstevel@tonic-gate int slen; 3367c478bd9Sstevel@tonic-gate 3377c478bd9Sstevel@tonic-gate slen = ip->ip_len; 3387c478bd9Sstevel@tonic-gate ip->ip_len = fin->fin_hlen + sizeof(*tcp2); 3397c478bd9Sstevel@tonic-gate bzero((char *)tcp2, sizeof(*tcp2)); 3407c478bd9Sstevel@tonic-gate tcp2->th_win = htons(8192); 3417c478bd9Sstevel@tonic-gate tcp2->th_sport = htons(sp); 3427c478bd9Sstevel@tonic-gate TCP_OFF_A(tcp2, 5); 3437c478bd9Sstevel@tonic-gate tcp2->th_flags = TH_SYN; 3447c478bd9Sstevel@tonic-gate tcp2->th_dport = 0; /* XXX - don't specify remote port */ 3457c478bd9Sstevel@tonic-gate fi.fin_data[1] = 0; 3467c478bd9Sstevel@tonic-gate fi.fin_dlen = sizeof(*tcp2); 3477c478bd9Sstevel@tonic-gate fi.fin_plen = fi.fin_hlen + sizeof(*tcp2); 3487c478bd9Sstevel@tonic-gate fi.fin_dp = (char *)tcp2; 3497c478bd9Sstevel@tonic-gate fi.fin_fr = &ftppxyfr; 3507c478bd9Sstevel@tonic-gate fi.fin_out = nat->nat_dir; 3517c478bd9Sstevel@tonic-gate fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE; 3527c478bd9Sstevel@tonic-gate swip = ip->ip_src; 3537c478bd9Sstevel@tonic-gate swip2 = ip->ip_dst; 3547c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_OUTBOUND) { 3557c478bd9Sstevel@tonic-gate fi.fin_fi.fi_saddr = nat->nat_inip.s_addr; 3567c478bd9Sstevel@tonic-gate ip->ip_src = nat->nat_inip; 3577c478bd9Sstevel@tonic-gate } else if (nat->nat_dir == NAT_INBOUND) { 3587c478bd9Sstevel@tonic-gate fi.fin_fi.fi_saddr = nat->nat_oip.s_addr; 3597c478bd9Sstevel@tonic-gate ip->ip_src = nat->nat_oip; 3607c478bd9Sstevel@tonic-gate } 3617c478bd9Sstevel@tonic-gate 3627c478bd9Sstevel@tonic-gate flags = NAT_SLAVE|IPN_TCP|SI_W_DPORT; 3637c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_INBOUND) 3647c478bd9Sstevel@tonic-gate flags |= NAT_NOTRULEPORT; 3657c478bd9Sstevel@tonic-gate nat2 = nat_new(&fi, nat->nat_ptr, NULL, flags, nat->nat_dir); 3667c478bd9Sstevel@tonic-gate 3677c478bd9Sstevel@tonic-gate if (nat2 != NULL) { 3687c478bd9Sstevel@tonic-gate (void) nat_proto(&fi, nat2, IPN_TCP); 3697c478bd9Sstevel@tonic-gate nat_update(&fi, nat2, nat->nat_ptr); 3707c478bd9Sstevel@tonic-gate fi.fin_ifp = NULL; 3717c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_INBOUND) { 3727c478bd9Sstevel@tonic-gate fi.fin_fi.fi_daddr = nat->nat_inip.s_addr; 3737c478bd9Sstevel@tonic-gate ip->ip_dst = nat->nat_inip; 3747c478bd9Sstevel@tonic-gate } 3757c478bd9Sstevel@tonic-gate (void) fr_addstate(&fi, &nat2->nat_state, SI_W_DPORT); 376*ab25eeb5Syz if (fi.fin_state != NULL) 377*ab25eeb5Syz fr_statederef(&fi, (ipstate_t **)&fi.fin_state); 3787c478bd9Sstevel@tonic-gate } 3797c478bd9Sstevel@tonic-gate ip->ip_len = slen; 3807c478bd9Sstevel@tonic-gate ip->ip_src = swip; 3817c478bd9Sstevel@tonic-gate ip->ip_dst = swip2; 3827c478bd9Sstevel@tonic-gate } else { 3837c478bd9Sstevel@tonic-gate ipstate_t *is; 3847c478bd9Sstevel@tonic-gate 3857c478bd9Sstevel@tonic-gate nat_update(&fi, nat2, nat->nat_ptr); 3867c478bd9Sstevel@tonic-gate READ_ENTER(&ipf_state); 3877c478bd9Sstevel@tonic-gate is = nat2->nat_state; 3887c478bd9Sstevel@tonic-gate if (is != NULL) { 3897c478bd9Sstevel@tonic-gate MUTEX_ENTER(&is->is_lock); 390*ab25eeb5Syz (void)fr_tcp_age(&is->is_sti, &fi, ips_tqtqb, 391*ab25eeb5Syz is->is_flags); 3927c478bd9Sstevel@tonic-gate MUTEX_EXIT(&is->is_lock); 3937c478bd9Sstevel@tonic-gate } 3947c478bd9Sstevel@tonic-gate RWLOCK_EXIT(&ipf_state); 3957c478bd9Sstevel@tonic-gate } 3967c478bd9Sstevel@tonic-gate return APR_INC(inc); 3977c478bd9Sstevel@tonic-gate } 3987c478bd9Sstevel@tonic-gate 3997c478bd9Sstevel@tonic-gate 4007c478bd9Sstevel@tonic-gate int ippr_ftp_client(fin, ip, nat, ftp, dlen) 4017c478bd9Sstevel@tonic-gate fr_info_t *fin; 4027c478bd9Sstevel@tonic-gate nat_t *nat; 4037c478bd9Sstevel@tonic-gate ftpinfo_t *ftp; 4047c478bd9Sstevel@tonic-gate ip_t *ip; 4057c478bd9Sstevel@tonic-gate int dlen; 4067c478bd9Sstevel@tonic-gate { 4077c478bd9Sstevel@tonic-gate char *rptr, *wptr, cmd[6], c; 4087c478bd9Sstevel@tonic-gate ftpside_t *f; 4097c478bd9Sstevel@tonic-gate int inc, i; 4107c478bd9Sstevel@tonic-gate 4117c478bd9Sstevel@tonic-gate inc = 0; 4127c478bd9Sstevel@tonic-gate f = &ftp->ftp_side[0]; 4137c478bd9Sstevel@tonic-gate rptr = f->ftps_rptr; 4147c478bd9Sstevel@tonic-gate wptr = f->ftps_wptr; 4157c478bd9Sstevel@tonic-gate 4167c478bd9Sstevel@tonic-gate for (i = 0; (i < 5) && (i < dlen); i++) { 4177c478bd9Sstevel@tonic-gate c = rptr[i]; 418*ab25eeb5Syz if (ISALPHA(c)) { 419*ab25eeb5Syz cmd[i] = TOUPPER(c); 4207c478bd9Sstevel@tonic-gate } else { 4217c478bd9Sstevel@tonic-gate cmd[i] = c; 4227c478bd9Sstevel@tonic-gate } 4237c478bd9Sstevel@tonic-gate } 4247c478bd9Sstevel@tonic-gate cmd[i] = '\0'; 4257c478bd9Sstevel@tonic-gate 4267c478bd9Sstevel@tonic-gate ftp->ftp_incok = 0; 4277c478bd9Sstevel@tonic-gate if (!strncmp(cmd, "USER ", 5) || !strncmp(cmd, "XAUT ", 5)) { 4287c478bd9Sstevel@tonic-gate if (ftp->ftp_passok == FTPXY_ADOK_1 || 4297c478bd9Sstevel@tonic-gate ftp->ftp_passok == FTPXY_AUOK_1) { 4307c478bd9Sstevel@tonic-gate ftp->ftp_passok = FTPXY_USER_2; 4317c478bd9Sstevel@tonic-gate ftp->ftp_incok = 1; 4327c478bd9Sstevel@tonic-gate } else { 4337c478bd9Sstevel@tonic-gate ftp->ftp_passok = FTPXY_USER_1; 4347c478bd9Sstevel@tonic-gate ftp->ftp_incok = 1; 4357c478bd9Sstevel@tonic-gate } 4367c478bd9Sstevel@tonic-gate } else if (!strncmp(cmd, "AUTH ", 5)) { 4377c478bd9Sstevel@tonic-gate ftp->ftp_passok = FTPXY_AUTH_1; 4387c478bd9Sstevel@tonic-gate ftp->ftp_incok = 1; 4397c478bd9Sstevel@tonic-gate } else if (!strncmp(cmd, "PASS ", 5)) { 4407c478bd9Sstevel@tonic-gate if (ftp->ftp_passok == FTPXY_USOK_1) { 4417c478bd9Sstevel@tonic-gate ftp->ftp_passok = FTPXY_PASS_1; 4427c478bd9Sstevel@tonic-gate ftp->ftp_incok = 1; 4437c478bd9Sstevel@tonic-gate } else if (ftp->ftp_passok == FTPXY_USOK_2) { 4447c478bd9Sstevel@tonic-gate ftp->ftp_passok = FTPXY_PASS_2; 4457c478bd9Sstevel@tonic-gate ftp->ftp_incok = 1; 4467c478bd9Sstevel@tonic-gate } 4477c478bd9Sstevel@tonic-gate } else if ((ftp->ftp_passok == FTPXY_AUOK_1) && 4487c478bd9Sstevel@tonic-gate !strncmp(cmd, "ADAT ", 5)) { 4497c478bd9Sstevel@tonic-gate ftp->ftp_passok = FTPXY_ADAT_1; 4507c478bd9Sstevel@tonic-gate ftp->ftp_incok = 1; 4517c478bd9Sstevel@tonic-gate } else if ((ftp->ftp_passok == FTPXY_PAOK_1 || 4527c478bd9Sstevel@tonic-gate ftp->ftp_passok == FTPXY_PAOK_2) && 4537c478bd9Sstevel@tonic-gate !strncmp(cmd, "ACCT ", 5)) { 4547c478bd9Sstevel@tonic-gate ftp->ftp_passok = FTPXY_ACCT_1; 4557c478bd9Sstevel@tonic-gate ftp->ftp_incok = 1; 4567c478bd9Sstevel@tonic-gate } else if ((ftp->ftp_passok == FTPXY_GO) && !ippr_ftp_pasvonly && 4577c478bd9Sstevel@tonic-gate !strncmp(cmd, "PORT ", 5)) { 4587c478bd9Sstevel@tonic-gate inc = ippr_ftp_port(fin, ip, nat, f, dlen); 4597c478bd9Sstevel@tonic-gate } else if (ippr_ftp_insecure && !ippr_ftp_pasvonly && 4607c478bd9Sstevel@tonic-gate !strncmp(cmd, "PORT ", 5)) { 4617c478bd9Sstevel@tonic-gate inc = ippr_ftp_port(fin, ip, nat, f, dlen); 4627c478bd9Sstevel@tonic-gate } 4637c478bd9Sstevel@tonic-gate 4647c478bd9Sstevel@tonic-gate while ((*rptr++ != '\n') && (rptr < wptr)) 4657c478bd9Sstevel@tonic-gate ; 4667c478bd9Sstevel@tonic-gate f->ftps_rptr = rptr; 4677c478bd9Sstevel@tonic-gate return inc; 4687c478bd9Sstevel@tonic-gate } 4697c478bd9Sstevel@tonic-gate 4707c478bd9Sstevel@tonic-gate 4717c478bd9Sstevel@tonic-gate int ippr_ftp_pasv(fin, ip, nat, ftp, dlen) 4727c478bd9Sstevel@tonic-gate fr_info_t *fin; 4737c478bd9Sstevel@tonic-gate ip_t *ip; 4747c478bd9Sstevel@tonic-gate nat_t *nat; 4757c478bd9Sstevel@tonic-gate ftpinfo_t *ftp; 4767c478bd9Sstevel@tonic-gate int dlen; 4777c478bd9Sstevel@tonic-gate { 4787c478bd9Sstevel@tonic-gate u_int a1, a2, a3, a4, data_ip; 4797c478bd9Sstevel@tonic-gate char newbuf[IPF_FTPBUFSZ]; 480*ab25eeb5Syz char *s, *brackets[2]; 4817c478bd9Sstevel@tonic-gate u_short a5, a6; 4827c478bd9Sstevel@tonic-gate ftpside_t *f; 4837c478bd9Sstevel@tonic-gate 4847c478bd9Sstevel@tonic-gate if (ippr_ftp_forcepasv != 0 && 4857c478bd9Sstevel@tonic-gate ftp->ftp_side[0].ftps_cmds != FTPXY_C_PASV) { 486*ab25eeb5Syz if (ippr_ftp_debug > 0) 487*ab25eeb5Syz printf("ippr_ftp_pasv:ftps_cmds(%d) != FTPXY_C_PASV\n", 488*ab25eeb5Syz ftp->ftp_side[0].ftps_cmds); 4897c478bd9Sstevel@tonic-gate return 0; 4907c478bd9Sstevel@tonic-gate } 4917c478bd9Sstevel@tonic-gate 4927c478bd9Sstevel@tonic-gate f = &ftp->ftp_side[1]; 4937c478bd9Sstevel@tonic-gate 4947c478bd9Sstevel@tonic-gate #define PASV_REPLEN 24 4957c478bd9Sstevel@tonic-gate /* 4967c478bd9Sstevel@tonic-gate * Check for PASV reply message. 4977c478bd9Sstevel@tonic-gate */ 4987c478bd9Sstevel@tonic-gate if (dlen < IPF_MIN227LEN) { 499*ab25eeb5Syz if (ippr_ftp_debug > 1) 500*ab25eeb5Syz printf("ippr_ftp_pasv:dlen(%d) < IPF_MIN227LEN\n", 501*ab25eeb5Syz dlen); 5027c478bd9Sstevel@tonic-gate return 0; 5037c478bd9Sstevel@tonic-gate } else if (strncmp(f->ftps_rptr, 5047c478bd9Sstevel@tonic-gate "227 Entering Passive Mod", PASV_REPLEN)) { 505*ab25eeb5Syz if (ippr_ftp_debug > 0) 506*ab25eeb5Syz printf("ippr_ftp_pasv:%d reply wrong\n", 227); 5077c478bd9Sstevel@tonic-gate return 0; 5087c478bd9Sstevel@tonic-gate } 5097c478bd9Sstevel@tonic-gate 510*ab25eeb5Syz brackets[0] = ""; 511*ab25eeb5Syz brackets[1] = ""; 5127c478bd9Sstevel@tonic-gate /* 5137c478bd9Sstevel@tonic-gate * Skip the PASV reply + space 5147c478bd9Sstevel@tonic-gate */ 5157c478bd9Sstevel@tonic-gate s = f->ftps_rptr + PASV_REPLEN; 516*ab25eeb5Syz while (*s && !ISDIGIT(*s)) { 517*ab25eeb5Syz if (*s == '(') { 518*ab25eeb5Syz brackets[0] = "("; 519*ab25eeb5Syz brackets[1] = ")"; 520*ab25eeb5Syz } 5217c478bd9Sstevel@tonic-gate s++; 522*ab25eeb5Syz } 523*ab25eeb5Syz 5247c478bd9Sstevel@tonic-gate /* 5257c478bd9Sstevel@tonic-gate * Pick out the address components, two at a time. 5267c478bd9Sstevel@tonic-gate */ 5277c478bd9Sstevel@tonic-gate a1 = ippr_ftp_atoi(&s); 5287c478bd9Sstevel@tonic-gate if (s == NULL) { 529*ab25eeb5Syz if (ippr_ftp_debug > 1) 530*ab25eeb5Syz printf("ippr_ftp_pasv:ippr_ftp_atoi(%d) failed\n", 1); 5317c478bd9Sstevel@tonic-gate return 0; 5327c478bd9Sstevel@tonic-gate } 5337c478bd9Sstevel@tonic-gate a2 = ippr_ftp_atoi(&s); 5347c478bd9Sstevel@tonic-gate if (s == NULL) { 535*ab25eeb5Syz if (ippr_ftp_debug > 1) 536*ab25eeb5Syz printf("ippr_ftp_pasv:ippr_ftp_atoi(%d) failed\n", 2); 5377c478bd9Sstevel@tonic-gate return 0; 5387c478bd9Sstevel@tonic-gate } 5397c478bd9Sstevel@tonic-gate 5407c478bd9Sstevel@tonic-gate /* 5417c478bd9Sstevel@tonic-gate * check that IP address in the PASV reply is the same as the 5427c478bd9Sstevel@tonic-gate * sender of the command - prevents using PASV for port scanning. 5437c478bd9Sstevel@tonic-gate */ 5447c478bd9Sstevel@tonic-gate a1 <<= 16; 5457c478bd9Sstevel@tonic-gate a1 |= a2; 5467c478bd9Sstevel@tonic-gate 5477c478bd9Sstevel@tonic-gate if (((nat->nat_dir == NAT_INBOUND) && 5487c478bd9Sstevel@tonic-gate (a1 != ntohl(nat->nat_inip.s_addr))) || 5497c478bd9Sstevel@tonic-gate ((nat->nat_dir == NAT_OUTBOUND) && 5507c478bd9Sstevel@tonic-gate (a1 != ntohl(nat->nat_oip.s_addr)))) { 551*ab25eeb5Syz if (ippr_ftp_debug > 0) 552*ab25eeb5Syz printf("ippr_ftp_pasv:%s != nat->nat_oip\n", "a1"); 5537c478bd9Sstevel@tonic-gate return 0; 5547c478bd9Sstevel@tonic-gate } 5557c478bd9Sstevel@tonic-gate 5567c478bd9Sstevel@tonic-gate a5 = ippr_ftp_atoi(&s); 5577c478bd9Sstevel@tonic-gate if (s == NULL) { 558*ab25eeb5Syz if (ippr_ftp_debug > 1) 559*ab25eeb5Syz printf("ippr_ftp_pasv:ippr_ftp_atoi(%d) failed\n", 3); 5607c478bd9Sstevel@tonic-gate return 0; 5617c478bd9Sstevel@tonic-gate } 5627c478bd9Sstevel@tonic-gate 5637c478bd9Sstevel@tonic-gate if (*s == ')') 5647c478bd9Sstevel@tonic-gate s++; 5657c478bd9Sstevel@tonic-gate if (*s == '.') 5667c478bd9Sstevel@tonic-gate s++; 5677c478bd9Sstevel@tonic-gate if (*s == '\n') 5687c478bd9Sstevel@tonic-gate s--; 5697c478bd9Sstevel@tonic-gate /* 5707c478bd9Sstevel@tonic-gate * check for CR-LF at the end. 5717c478bd9Sstevel@tonic-gate */ 5727c478bd9Sstevel@tonic-gate if ((*s == '\r') && (*(s + 1) == '\n')) { 5737c478bd9Sstevel@tonic-gate s += 2; 5747c478bd9Sstevel@tonic-gate } else { 575*ab25eeb5Syz if (ippr_ftp_debug > 1) 576*ab25eeb5Syz printf("ippr_ftp_pasv:missing %s", "cr-lf\n"); 5777c478bd9Sstevel@tonic-gate return 0; 5787c478bd9Sstevel@tonic-gate } 5797c478bd9Sstevel@tonic-gate 5807c478bd9Sstevel@tonic-gate a6 = a5 & 0xff; 5817c478bd9Sstevel@tonic-gate a5 >>= 8; 5827c478bd9Sstevel@tonic-gate /* 5837c478bd9Sstevel@tonic-gate * Calculate new address parts for 227 reply 5847c478bd9Sstevel@tonic-gate */ 5857c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_INBOUND) { 5867c478bd9Sstevel@tonic-gate data_ip = nat->nat_outip.s_addr; 5877c478bd9Sstevel@tonic-gate a1 = ntohl(data_ip); 5887c478bd9Sstevel@tonic-gate } else 5897c478bd9Sstevel@tonic-gate data_ip = htonl(a1); 5907c478bd9Sstevel@tonic-gate 5917c478bd9Sstevel@tonic-gate a2 = (a1 >> 16) & 0xff; 5927c478bd9Sstevel@tonic-gate a3 = (a1 >> 8) & 0xff; 5937c478bd9Sstevel@tonic-gate a4 = a1 & 0xff; 5947c478bd9Sstevel@tonic-gate a1 >>= 24; 5957c478bd9Sstevel@tonic-gate 596*ab25eeb5Syz #if defined(SNPRINTF) && defined(_KERNEL) 597*ab25eeb5Syz (void) SNPRINTF(newbuf, sizeof(newbuf), "%s %s%u,%u,%u,%u,%u,%u%s\r\n", 598*ab25eeb5Syz "227 Entering Passive Mode", brackets[0], a1, a2, a3, a4, 599*ab25eeb5Syz a5, a6, brackets[1]); 6007c478bd9Sstevel@tonic-gate #else 601*ab25eeb5Syz (void) sprintf(newbuf, "%s %s%u,%u,%u,%u,%u,%u%s\r\n", 602*ab25eeb5Syz "227 Entering Passive Mode", brackets[0], a1, a2, a3, a4, 603*ab25eeb5Syz a5, a6, brackets[1]); 6047c478bd9Sstevel@tonic-gate #endif 6057c478bd9Sstevel@tonic-gate return ippr_ftp_pasvreply(fin, ip, nat, f, (a5 << 8 | a6), 6067c478bd9Sstevel@tonic-gate newbuf, s, data_ip); 6077c478bd9Sstevel@tonic-gate } 6087c478bd9Sstevel@tonic-gate 6097c478bd9Sstevel@tonic-gate int ippr_ftp_pasvreply(fin, ip, nat, f, port, newmsg, s, data_ip) 6107c478bd9Sstevel@tonic-gate fr_info_t *fin; 6117c478bd9Sstevel@tonic-gate ip_t *ip; 6127c478bd9Sstevel@tonic-gate nat_t *nat; 6137c478bd9Sstevel@tonic-gate ftpside_t *f; 6147c478bd9Sstevel@tonic-gate u_int port; 6157c478bd9Sstevel@tonic-gate char *newmsg; 6167c478bd9Sstevel@tonic-gate char *s; 6177c478bd9Sstevel@tonic-gate u_int data_ip; 6187c478bd9Sstevel@tonic-gate { 6197c478bd9Sstevel@tonic-gate int inc, off, nflags, sflags; 6207c478bd9Sstevel@tonic-gate tcphdr_t *tcp, tcph, *tcp2; 6217c478bd9Sstevel@tonic-gate struct in_addr swip, swip2; 6227c478bd9Sstevel@tonic-gate struct in_addr data_addr; 6237c478bd9Sstevel@tonic-gate size_t nlen, olen; 6247c478bd9Sstevel@tonic-gate fr_info_t fi; 6257c478bd9Sstevel@tonic-gate nat_t *nat2; 6267c478bd9Sstevel@tonic-gate mb_t *m; 6277c478bd9Sstevel@tonic-gate 6287c478bd9Sstevel@tonic-gate m = fin->fin_m; 6297c478bd9Sstevel@tonic-gate tcp = (tcphdr_t *)fin->fin_dp; 630*ab25eeb5Syz off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 6317c478bd9Sstevel@tonic-gate 6327c478bd9Sstevel@tonic-gate data_addr.s_addr = data_ip; 6337c478bd9Sstevel@tonic-gate tcp2 = &tcph; 6347c478bd9Sstevel@tonic-gate inc = 0; 6357c478bd9Sstevel@tonic-gate 6367c478bd9Sstevel@tonic-gate 6377c478bd9Sstevel@tonic-gate olen = s - f->ftps_rptr; 6387c478bd9Sstevel@tonic-gate nlen = strlen(newmsg); 6397c478bd9Sstevel@tonic-gate inc = nlen - olen; 6407c478bd9Sstevel@tonic-gate if ((inc + ip->ip_len) > 65535) { 641*ab25eeb5Syz if (ippr_ftp_debug > 0) 642*ab25eeb5Syz printf("ippr_ftp_pasv:inc(%d) + ip->ip_len > 65535\n", 643*ab25eeb5Syz inc); 6447c478bd9Sstevel@tonic-gate return 0; 6457c478bd9Sstevel@tonic-gate } 6467c478bd9Sstevel@tonic-gate 6477c478bd9Sstevel@tonic-gate #if !defined(_KERNEL) 648*ab25eeb5Syz bcopy(newmsg, MTOD(m, char *) + off, nlen); 6497c478bd9Sstevel@tonic-gate #else 6507c478bd9Sstevel@tonic-gate # if defined(MENTAT) 6517c478bd9Sstevel@tonic-gate if (inc < 0) 6527c478bd9Sstevel@tonic-gate (void)adjmsg(m, inc); 6537c478bd9Sstevel@tonic-gate # else /* defined(MENTAT) */ 654*ab25eeb5Syz /* 655*ab25eeb5Syz * m_adj takes care of pkthdr.len, if required and treats inc<0 to 656*ab25eeb5Syz * mean remove -len bytes from the end of the packet. 657*ab25eeb5Syz * The mbuf chain will be extended if necessary by m_copyback(). 658*ab25eeb5Syz */ 6597c478bd9Sstevel@tonic-gate if (inc < 0) 6607c478bd9Sstevel@tonic-gate m_adj(m, inc); 6617c478bd9Sstevel@tonic-gate # endif /* defined(MENTAT) */ 6627c478bd9Sstevel@tonic-gate #endif /* !defined(_KERNEL) */ 6637c478bd9Sstevel@tonic-gate COPYBACK(m, off, nlen, newmsg); 6647c478bd9Sstevel@tonic-gate 6657c478bd9Sstevel@tonic-gate if (inc != 0) { 6667c478bd9Sstevel@tonic-gate ip->ip_len += inc; 6677c478bd9Sstevel@tonic-gate fin->fin_dlen += inc; 6687c478bd9Sstevel@tonic-gate fin->fin_plen += inc; 6697c478bd9Sstevel@tonic-gate } 6707c478bd9Sstevel@tonic-gate 6717c478bd9Sstevel@tonic-gate /* 6727c478bd9Sstevel@tonic-gate * Add skeleton NAT entry for connection which will come back the 6737c478bd9Sstevel@tonic-gate * other way. 6747c478bd9Sstevel@tonic-gate */ 6757c478bd9Sstevel@tonic-gate bcopy((char *)fin, (char *)&fi, sizeof(fi)); 676*ab25eeb5Syz fi.fin_state = NULL; 677*ab25eeb5Syz fi.fin_nat = NULL; 6787c478bd9Sstevel@tonic-gate fi.fin_flx |= FI_IGNORE; 6797c478bd9Sstevel@tonic-gate fi.fin_data[0] = 0; 6807c478bd9Sstevel@tonic-gate fi.fin_data[1] = port; 6817c478bd9Sstevel@tonic-gate nflags = IPN_TCP|SI_W_SPORT; 6827c478bd9Sstevel@tonic-gate if (ippr_ftp_pasvrdr && f->ftps_ifp) 6837c478bd9Sstevel@tonic-gate nflags |= SI_W_DPORT; 6847c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_OUTBOUND) 6857c478bd9Sstevel@tonic-gate nat2 = nat_outlookup(&fi, nflags|NAT_SEARCH, 6867c478bd9Sstevel@tonic-gate nat->nat_p, nat->nat_inip, nat->nat_oip); 6877c478bd9Sstevel@tonic-gate else 6887c478bd9Sstevel@tonic-gate nat2 = nat_inlookup(&fi, nflags|NAT_SEARCH, 6897c478bd9Sstevel@tonic-gate nat->nat_p, nat->nat_inip, nat->nat_oip); 6907c478bd9Sstevel@tonic-gate if (nat2 == NULL) { 6917c478bd9Sstevel@tonic-gate int slen; 6927c478bd9Sstevel@tonic-gate 6937c478bd9Sstevel@tonic-gate slen = ip->ip_len; 6947c478bd9Sstevel@tonic-gate ip->ip_len = fin->fin_hlen + sizeof(*tcp2); 6957c478bd9Sstevel@tonic-gate bzero((char *)tcp2, sizeof(*tcp2)); 6967c478bd9Sstevel@tonic-gate tcp2->th_win = htons(8192); 6977c478bd9Sstevel@tonic-gate tcp2->th_sport = 0; /* XXX - fake it for nat_new */ 6987c478bd9Sstevel@tonic-gate TCP_OFF_A(tcp2, 5); 6997c478bd9Sstevel@tonic-gate tcp2->th_flags = TH_SYN; 7007c478bd9Sstevel@tonic-gate fi.fin_data[1] = port; 7017c478bd9Sstevel@tonic-gate fi.fin_dlen = sizeof(*tcp2); 7027c478bd9Sstevel@tonic-gate tcp2->th_dport = htons(port); 7037c478bd9Sstevel@tonic-gate fi.fin_data[0] = 0; 7047c478bd9Sstevel@tonic-gate fi.fin_dp = (char *)tcp2; 7057c478bd9Sstevel@tonic-gate fi.fin_plen = fi.fin_hlen + sizeof(*tcp); 7067c478bd9Sstevel@tonic-gate fi.fin_fr = &ftppxyfr; 7077c478bd9Sstevel@tonic-gate fi.fin_out = nat->nat_dir; 7087c478bd9Sstevel@tonic-gate fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE; 7097c478bd9Sstevel@tonic-gate swip = ip->ip_src; 7107c478bd9Sstevel@tonic-gate swip2 = ip->ip_dst; 7117c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_OUTBOUND) { 7127c478bd9Sstevel@tonic-gate fi.fin_fi.fi_daddr = data_addr.s_addr; 7137c478bd9Sstevel@tonic-gate fi.fin_fi.fi_saddr = nat->nat_inip.s_addr; 7147c478bd9Sstevel@tonic-gate ip->ip_dst = data_addr; 7157c478bd9Sstevel@tonic-gate ip->ip_src = nat->nat_inip; 7167c478bd9Sstevel@tonic-gate } else if (nat->nat_dir == NAT_INBOUND) { 7177c478bd9Sstevel@tonic-gate fi.fin_fi.fi_saddr = nat->nat_oip.s_addr; 7187c478bd9Sstevel@tonic-gate fi.fin_fi.fi_daddr = nat->nat_outip.s_addr; 7197c478bd9Sstevel@tonic-gate ip->ip_src = nat->nat_oip; 7207c478bd9Sstevel@tonic-gate ip->ip_dst = nat->nat_outip; 7217c478bd9Sstevel@tonic-gate } 7227c478bd9Sstevel@tonic-gate 7237c478bd9Sstevel@tonic-gate sflags = nflags; 7247c478bd9Sstevel@tonic-gate nflags |= NAT_SLAVE; 7257c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_INBOUND) 7267c478bd9Sstevel@tonic-gate nflags |= NAT_NOTRULEPORT; 7277c478bd9Sstevel@tonic-gate nat2 = nat_new(&fi, nat->nat_ptr, NULL, nflags, nat->nat_dir); 7287c478bd9Sstevel@tonic-gate if (nat2 != NULL) { 7297c478bd9Sstevel@tonic-gate (void) nat_proto(&fi, nat2, IPN_TCP); 7307c478bd9Sstevel@tonic-gate nat_update(&fi, nat2, nat->nat_ptr); 7317c478bd9Sstevel@tonic-gate fi.fin_ifp = NULL; 7327c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_INBOUND) { 7337c478bd9Sstevel@tonic-gate fi.fin_fi.fi_daddr = nat->nat_inip.s_addr; 7347c478bd9Sstevel@tonic-gate ip->ip_dst = nat->nat_inip; 7357c478bd9Sstevel@tonic-gate } 7367c478bd9Sstevel@tonic-gate (void) fr_addstate(&fi, &nat2->nat_state, sflags); 737*ab25eeb5Syz if (fi.fin_state != NULL) 738*ab25eeb5Syz fr_statederef(&fi, (ipstate_t **)&fi.fin_state); 7397c478bd9Sstevel@tonic-gate } 7407c478bd9Sstevel@tonic-gate 7417c478bd9Sstevel@tonic-gate ip->ip_len = slen; 7427c478bd9Sstevel@tonic-gate ip->ip_src = swip; 7437c478bd9Sstevel@tonic-gate ip->ip_dst = swip2; 7447c478bd9Sstevel@tonic-gate } else { 7457c478bd9Sstevel@tonic-gate ipstate_t *is; 7467c478bd9Sstevel@tonic-gate 7477c478bd9Sstevel@tonic-gate nat_update(&fi, nat2, nat->nat_ptr); 7487c478bd9Sstevel@tonic-gate READ_ENTER(&ipf_state); 7497c478bd9Sstevel@tonic-gate is = nat2->nat_state; 7507c478bd9Sstevel@tonic-gate if (is != NULL) { 7517c478bd9Sstevel@tonic-gate MUTEX_ENTER(&is->is_lock); 752*ab25eeb5Syz (void)fr_tcp_age(&is->is_sti, &fi, ips_tqtqb, 753*ab25eeb5Syz is->is_flags); 7547c478bd9Sstevel@tonic-gate MUTEX_EXIT(&is->is_lock); 7557c478bd9Sstevel@tonic-gate } 7567c478bd9Sstevel@tonic-gate RWLOCK_EXIT(&ipf_state); 7577c478bd9Sstevel@tonic-gate } 7587c478bd9Sstevel@tonic-gate return inc; 7597c478bd9Sstevel@tonic-gate } 7607c478bd9Sstevel@tonic-gate 7617c478bd9Sstevel@tonic-gate 7627c478bd9Sstevel@tonic-gate int ippr_ftp_server(fin, ip, nat, ftp, dlen) 7637c478bd9Sstevel@tonic-gate fr_info_t *fin; 7647c478bd9Sstevel@tonic-gate ip_t *ip; 7657c478bd9Sstevel@tonic-gate nat_t *nat; 7667c478bd9Sstevel@tonic-gate ftpinfo_t *ftp; 7677c478bd9Sstevel@tonic-gate int dlen; 7687c478bd9Sstevel@tonic-gate { 7697c478bd9Sstevel@tonic-gate char *rptr, *wptr; 7707c478bd9Sstevel@tonic-gate ftpside_t *f; 7717c478bd9Sstevel@tonic-gate int inc; 7727c478bd9Sstevel@tonic-gate 7737c478bd9Sstevel@tonic-gate inc = 0; 7747c478bd9Sstevel@tonic-gate f = &ftp->ftp_side[1]; 7757c478bd9Sstevel@tonic-gate rptr = f->ftps_rptr; 7767c478bd9Sstevel@tonic-gate wptr = f->ftps_wptr; 7777c478bd9Sstevel@tonic-gate 778*ab25eeb5Syz if (*rptr == ' ') 779*ab25eeb5Syz goto server_cmd_ok; 780*ab25eeb5Syz if (!ISDIGIT(*rptr) || !ISDIGIT(*(rptr + 1)) || !ISDIGIT(*(rptr + 2))) 7817c478bd9Sstevel@tonic-gate return 0; 7827c478bd9Sstevel@tonic-gate if (ftp->ftp_passok == FTPXY_GO) { 7837c478bd9Sstevel@tonic-gate if (!strncmp(rptr, "227 ", 4)) 7847c478bd9Sstevel@tonic-gate inc = ippr_ftp_pasv(fin, ip, nat, ftp, dlen); 7857c478bd9Sstevel@tonic-gate else if (!strncmp(rptr, "229 ", 4)) 7867c478bd9Sstevel@tonic-gate inc = ippr_ftp_epsv(fin, ip, nat, f, dlen); 7877c478bd9Sstevel@tonic-gate } else if (ippr_ftp_insecure && !strncmp(rptr, "227 ", 4)) { 7887c478bd9Sstevel@tonic-gate inc = ippr_ftp_pasv(fin, ip, nat, ftp, dlen); 7897c478bd9Sstevel@tonic-gate } else if (ippr_ftp_insecure && !strncmp(rptr, "229 ", 4)) { 7907c478bd9Sstevel@tonic-gate inc = ippr_ftp_epsv(fin, ip, nat, f, dlen); 7917c478bd9Sstevel@tonic-gate } else if (*rptr == '5' || *rptr == '4') 7927c478bd9Sstevel@tonic-gate ftp->ftp_passok = FTPXY_INIT; 7937c478bd9Sstevel@tonic-gate else if (ftp->ftp_incok) { 7947c478bd9Sstevel@tonic-gate if (*rptr == '3') { 7957c478bd9Sstevel@tonic-gate if (ftp->ftp_passok == FTPXY_ACCT_1) 7967c478bd9Sstevel@tonic-gate ftp->ftp_passok = FTPXY_GO; 7977c478bd9Sstevel@tonic-gate else 7987c478bd9Sstevel@tonic-gate ftp->ftp_passok++; 7997c478bd9Sstevel@tonic-gate } else if (*rptr == '2') { 8007c478bd9Sstevel@tonic-gate switch (ftp->ftp_passok) 8017c478bd9Sstevel@tonic-gate { 8027c478bd9Sstevel@tonic-gate case FTPXY_USER_1 : 8037c478bd9Sstevel@tonic-gate case FTPXY_USER_2 : 8047c478bd9Sstevel@tonic-gate case FTPXY_PASS_1 : 8057c478bd9Sstevel@tonic-gate case FTPXY_PASS_2 : 8067c478bd9Sstevel@tonic-gate case FTPXY_ACCT_1 : 8077c478bd9Sstevel@tonic-gate ftp->ftp_passok = FTPXY_GO; 8087c478bd9Sstevel@tonic-gate break; 8097c478bd9Sstevel@tonic-gate default : 8107c478bd9Sstevel@tonic-gate ftp->ftp_passok += 3; 8117c478bd9Sstevel@tonic-gate break; 8127c478bd9Sstevel@tonic-gate } 8137c478bd9Sstevel@tonic-gate } 8147c478bd9Sstevel@tonic-gate } 815*ab25eeb5Syz server_cmd_ok: 8167c478bd9Sstevel@tonic-gate ftp->ftp_incok = 0; 8177c478bd9Sstevel@tonic-gate 8187c478bd9Sstevel@tonic-gate while ((*rptr++ != '\n') && (rptr < wptr)) 8197c478bd9Sstevel@tonic-gate ; 8207c478bd9Sstevel@tonic-gate f->ftps_rptr = rptr; 8217c478bd9Sstevel@tonic-gate return inc; 8227c478bd9Sstevel@tonic-gate } 8237c478bd9Sstevel@tonic-gate 8247c478bd9Sstevel@tonic-gate 8257c478bd9Sstevel@tonic-gate /* 8267c478bd9Sstevel@tonic-gate * Look to see if the buffer starts with something which we recognise as 8277c478bd9Sstevel@tonic-gate * being the correct syntax for the FTP protocol. 8287c478bd9Sstevel@tonic-gate */ 8297c478bd9Sstevel@tonic-gate int ippr_ftp_client_valid(ftps, buf, len) 8307c478bd9Sstevel@tonic-gate ftpside_t *ftps; 8317c478bd9Sstevel@tonic-gate char *buf; 8327c478bd9Sstevel@tonic-gate size_t len; 8337c478bd9Sstevel@tonic-gate { 834*ab25eeb5Syz register char *s, c, pc; 8357c478bd9Sstevel@tonic-gate register size_t i = len; 8367c478bd9Sstevel@tonic-gate char cmd[5]; 8377c478bd9Sstevel@tonic-gate 838*ab25eeb5Syz s = buf; 839*ab25eeb5Syz 840*ab25eeb5Syz if (ftps->ftps_junk == 1) 841*ab25eeb5Syz return 1; 842*ab25eeb5Syz 8437c478bd9Sstevel@tonic-gate if (i < 5) { 844*ab25eeb5Syz if (ippr_ftp_debug > 3) 845*ab25eeb5Syz printf("ippr_ftp_client_valid:i(%d) < 5\n", (int)i); 8467c478bd9Sstevel@tonic-gate return 2; 8477c478bd9Sstevel@tonic-gate } 848*ab25eeb5Syz 8497c478bd9Sstevel@tonic-gate i--; 850*ab25eeb5Syz c = *s++; 8517c478bd9Sstevel@tonic-gate 852*ab25eeb5Syz if (ISALPHA(c)) { 853*ab25eeb5Syz cmd[0] = TOUPPER(c); 8547c478bd9Sstevel@tonic-gate c = *s++; 8557c478bd9Sstevel@tonic-gate i--; 856*ab25eeb5Syz if (ISALPHA(c)) { 857*ab25eeb5Syz cmd[1] = TOUPPER(c); 8587c478bd9Sstevel@tonic-gate c = *s++; 8597c478bd9Sstevel@tonic-gate i--; 860*ab25eeb5Syz if (ISALPHA(c)) { 861*ab25eeb5Syz cmd[2] = TOUPPER(c); 8627c478bd9Sstevel@tonic-gate c = *s++; 8637c478bd9Sstevel@tonic-gate i--; 864*ab25eeb5Syz if (ISALPHA(c)) { 865*ab25eeb5Syz cmd[3] = TOUPPER(c); 8667c478bd9Sstevel@tonic-gate c = *s++; 8677c478bd9Sstevel@tonic-gate i--; 8687c478bd9Sstevel@tonic-gate if ((c != ' ') && (c != '\r')) 8697c478bd9Sstevel@tonic-gate goto bad_client_command; 8707c478bd9Sstevel@tonic-gate } else if ((c != ' ') && (c != '\r')) 8717c478bd9Sstevel@tonic-gate goto bad_client_command; 8727c478bd9Sstevel@tonic-gate } else 8737c478bd9Sstevel@tonic-gate goto bad_client_command; 8747c478bd9Sstevel@tonic-gate } else 8757c478bd9Sstevel@tonic-gate goto bad_client_command; 8767c478bd9Sstevel@tonic-gate } else { 8777c478bd9Sstevel@tonic-gate bad_client_command: 878*ab25eeb5Syz if (ippr_ftp_debug > 3) 879*ab25eeb5Syz printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*s]\n", 880*ab25eeb5Syz "ippr_ftp_client_valid", 881*ab25eeb5Syz ftps->ftps_junk, (int)len, (int)i, c, 882*ab25eeb5Syz (int)len, buf); 8837c478bd9Sstevel@tonic-gate return 1; 8847c478bd9Sstevel@tonic-gate } 8857c478bd9Sstevel@tonic-gate 8867c478bd9Sstevel@tonic-gate for (; i; i--) { 887*ab25eeb5Syz pc = c; 8887c478bd9Sstevel@tonic-gate c = *s++; 889*ab25eeb5Syz if ((pc == '\r') && (c == '\n')) { 8907c478bd9Sstevel@tonic-gate cmd[4] = '\0'; 8917c478bd9Sstevel@tonic-gate if (!strcmp(cmd, "PASV")) 8927c478bd9Sstevel@tonic-gate ftps->ftps_cmds = FTPXY_C_PASV; 8937c478bd9Sstevel@tonic-gate else 8947c478bd9Sstevel@tonic-gate ftps->ftps_cmds = 0; 8957c478bd9Sstevel@tonic-gate return 0; 8967c478bd9Sstevel@tonic-gate } 8977c478bd9Sstevel@tonic-gate } 8987c478bd9Sstevel@tonic-gate #if !defined(_KERNEL) 899*ab25eeb5Syz printf("ippr_ftp_client_valid:junk after cmd[%*.*s]\n", 900*ab25eeb5Syz (int)len, (int)len, buf); 9017c478bd9Sstevel@tonic-gate #endif 9027c478bd9Sstevel@tonic-gate return 2; 9037c478bd9Sstevel@tonic-gate } 9047c478bd9Sstevel@tonic-gate 9057c478bd9Sstevel@tonic-gate 9067c478bd9Sstevel@tonic-gate int ippr_ftp_server_valid(ftps, buf, len) 9077c478bd9Sstevel@tonic-gate ftpside_t *ftps; 9087c478bd9Sstevel@tonic-gate char *buf; 9097c478bd9Sstevel@tonic-gate size_t len; 9107c478bd9Sstevel@tonic-gate { 911*ab25eeb5Syz register char *s, c, pc; 9127c478bd9Sstevel@tonic-gate register size_t i = len; 9137c478bd9Sstevel@tonic-gate int cmd; 9147c478bd9Sstevel@tonic-gate 9157c478bd9Sstevel@tonic-gate s = buf; 9167c478bd9Sstevel@tonic-gate cmd = 0; 917*ab25eeb5Syz 918*ab25eeb5Syz if (ftps->ftps_junk == 1) 919*ab25eeb5Syz return 1; 920*ab25eeb5Syz 921*ab25eeb5Syz if (i < 5) { 922*ab25eeb5Syz if (ippr_ftp_debug > 3) 923*ab25eeb5Syz printf("ippr_ftp_servert_valid:i(%d) < 5\n", (int)i); 924*ab25eeb5Syz return 2; 925*ab25eeb5Syz } 926*ab25eeb5Syz 927*ab25eeb5Syz c = *s++; 9287c478bd9Sstevel@tonic-gate i--; 929*ab25eeb5Syz if (c == ' ') 930*ab25eeb5Syz goto search_eol; 9317c478bd9Sstevel@tonic-gate 932*ab25eeb5Syz if (ISDIGIT(c)) { 9337c478bd9Sstevel@tonic-gate cmd = (c - '0') * 100; 9347c478bd9Sstevel@tonic-gate c = *s++; 9357c478bd9Sstevel@tonic-gate i--; 936*ab25eeb5Syz if (ISDIGIT(c)) { 9377c478bd9Sstevel@tonic-gate cmd += (c - '0') * 10; 9387c478bd9Sstevel@tonic-gate c = *s++; 9397c478bd9Sstevel@tonic-gate i--; 940*ab25eeb5Syz if (ISDIGIT(c)) { 9417c478bd9Sstevel@tonic-gate cmd += (c - '0'); 9427c478bd9Sstevel@tonic-gate c = *s++; 9437c478bd9Sstevel@tonic-gate i--; 9447c478bd9Sstevel@tonic-gate if ((c != '-') && (c != ' ')) 9457c478bd9Sstevel@tonic-gate goto bad_server_command; 9467c478bd9Sstevel@tonic-gate } else 9477c478bd9Sstevel@tonic-gate goto bad_server_command; 9487c478bd9Sstevel@tonic-gate } else 9497c478bd9Sstevel@tonic-gate goto bad_server_command; 9507c478bd9Sstevel@tonic-gate } else { 9517c478bd9Sstevel@tonic-gate bad_server_command: 952*ab25eeb5Syz if (ippr_ftp_debug > 3) 953*ab25eeb5Syz printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*s]\n", 954*ab25eeb5Syz "ippr_ftp_server_valid", 955*ab25eeb5Syz ftps->ftps_junk, (int)len, (int)i, 956*ab25eeb5Syz c, (int)len, buf); 9577c478bd9Sstevel@tonic-gate return 1; 9587c478bd9Sstevel@tonic-gate } 959*ab25eeb5Syz search_eol: 9607c478bd9Sstevel@tonic-gate for (; i; i--) { 961*ab25eeb5Syz pc = c; 9627c478bd9Sstevel@tonic-gate c = *s++; 963*ab25eeb5Syz if ((pc == '\r') && (c == '\n')) { 9647c478bd9Sstevel@tonic-gate ftps->ftps_cmds = cmd; 9657c478bd9Sstevel@tonic-gate return 0; 9667c478bd9Sstevel@tonic-gate } 9677c478bd9Sstevel@tonic-gate } 968*ab25eeb5Syz if (ippr_ftp_debug > 3) 969*ab25eeb5Syz printf("ippr_ftp_server_valid:junk after cmd[%*s]\n", 970*ab25eeb5Syz (int)len, buf); 9717c478bd9Sstevel@tonic-gate return 2; 9727c478bd9Sstevel@tonic-gate } 9737c478bd9Sstevel@tonic-gate 9747c478bd9Sstevel@tonic-gate 9757c478bd9Sstevel@tonic-gate int ippr_ftp_valid(ftp, side, buf, len) 9767c478bd9Sstevel@tonic-gate ftpinfo_t *ftp; 9777c478bd9Sstevel@tonic-gate int side; 9787c478bd9Sstevel@tonic-gate char *buf; 9797c478bd9Sstevel@tonic-gate size_t len; 9807c478bd9Sstevel@tonic-gate { 9817c478bd9Sstevel@tonic-gate ftpside_t *ftps; 9827c478bd9Sstevel@tonic-gate int ret; 9837c478bd9Sstevel@tonic-gate 9847c478bd9Sstevel@tonic-gate ftps = &ftp->ftp_side[side]; 9857c478bd9Sstevel@tonic-gate 9867c478bd9Sstevel@tonic-gate if (side == 0) 9877c478bd9Sstevel@tonic-gate ret = ippr_ftp_client_valid(ftps, buf, len); 9887c478bd9Sstevel@tonic-gate else 9897c478bd9Sstevel@tonic-gate ret = ippr_ftp_server_valid(ftps, buf, len); 9907c478bd9Sstevel@tonic-gate return ret; 9917c478bd9Sstevel@tonic-gate } 9927c478bd9Sstevel@tonic-gate 9937c478bd9Sstevel@tonic-gate 9947c478bd9Sstevel@tonic-gate /* 9957c478bd9Sstevel@tonic-gate * For map rules, the following applies: 9967c478bd9Sstevel@tonic-gate * rv == 0 for outbound processing, 9977c478bd9Sstevel@tonic-gate * rv == 1 for inbound processing. 9987c478bd9Sstevel@tonic-gate * For rdr rules, the following applies: 9997c478bd9Sstevel@tonic-gate * rv == 0 for inbound processing, 10007c478bd9Sstevel@tonic-gate * rv == 1 for outbound processing. 10017c478bd9Sstevel@tonic-gate */ 10027c478bd9Sstevel@tonic-gate int ippr_ftp_process(fin, nat, ftp, rv) 10037c478bd9Sstevel@tonic-gate fr_info_t *fin; 10047c478bd9Sstevel@tonic-gate nat_t *nat; 10057c478bd9Sstevel@tonic-gate ftpinfo_t *ftp; 10067c478bd9Sstevel@tonic-gate int rv; 10077c478bd9Sstevel@tonic-gate { 10087c478bd9Sstevel@tonic-gate int mlen, len, off, inc, i, sel, sel2, ok, ackoff, seqoff; 1009*ab25eeb5Syz char *rptr, *wptr, *s; 10107c478bd9Sstevel@tonic-gate u_32_t thseq, thack; 10117c478bd9Sstevel@tonic-gate ap_session_t *aps; 10127c478bd9Sstevel@tonic-gate ftpside_t *f, *t; 10137c478bd9Sstevel@tonic-gate tcphdr_t *tcp; 10147c478bd9Sstevel@tonic-gate ip_t *ip; 10157c478bd9Sstevel@tonic-gate mb_t *m; 10167c478bd9Sstevel@tonic-gate 10177c478bd9Sstevel@tonic-gate m = fin->fin_m; 10187c478bd9Sstevel@tonic-gate ip = fin->fin_ip; 10197c478bd9Sstevel@tonic-gate tcp = (tcphdr_t *)fin->fin_dp; 1020*ab25eeb5Syz off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 10217c478bd9Sstevel@tonic-gate 10227c478bd9Sstevel@tonic-gate f = &ftp->ftp_side[rv]; 10237c478bd9Sstevel@tonic-gate t = &ftp->ftp_side[1 - rv]; 10247c478bd9Sstevel@tonic-gate thseq = ntohl(tcp->th_seq); 10257c478bd9Sstevel@tonic-gate thack = ntohl(tcp->th_ack); 10267c478bd9Sstevel@tonic-gate 1027*ab25eeb5Syz #ifdef __sgi 1028*ab25eeb5Syz mlen = fin->fin_plen - off; 1029*ab25eeb5Syz #else 10307c478bd9Sstevel@tonic-gate mlen = MSGDSIZE(m) - off; 1031*ab25eeb5Syz #endif 1032*ab25eeb5Syz if (ippr_ftp_debug > 4) 1033*ab25eeb5Syz printf("ippr_ftp_process: mlen %d\n", mlen); 1034*ab25eeb5Syz 10357c478bd9Sstevel@tonic-gate if (mlen <= 0) { 10367c478bd9Sstevel@tonic-gate if ((tcp->th_flags & TH_OPENING) == TH_OPENING) { 10377c478bd9Sstevel@tonic-gate f->ftps_seq[0] = thseq + 1; 10387c478bd9Sstevel@tonic-gate t->ftps_seq[0] = thack; 10397c478bd9Sstevel@tonic-gate } 10407c478bd9Sstevel@tonic-gate return 0; 10417c478bd9Sstevel@tonic-gate } 10427c478bd9Sstevel@tonic-gate aps = nat->nat_aps; 10437c478bd9Sstevel@tonic-gate 10447c478bd9Sstevel@tonic-gate sel = aps->aps_sel[1 - rv]; 10457c478bd9Sstevel@tonic-gate sel2 = aps->aps_sel[rv]; 10467c478bd9Sstevel@tonic-gate if (rv == 0) { 10477c478bd9Sstevel@tonic-gate seqoff = aps->aps_seqoff[sel]; 10487c478bd9Sstevel@tonic-gate if (aps->aps_seqmin[sel] > seqoff + thseq) 10497c478bd9Sstevel@tonic-gate seqoff = aps->aps_seqoff[!sel]; 10507c478bd9Sstevel@tonic-gate ackoff = aps->aps_ackoff[sel2]; 10517c478bd9Sstevel@tonic-gate if (aps->aps_ackmin[sel2] > ackoff + thack) 10527c478bd9Sstevel@tonic-gate ackoff = aps->aps_ackoff[!sel2]; 10537c478bd9Sstevel@tonic-gate } else { 10547c478bd9Sstevel@tonic-gate seqoff = aps->aps_ackoff[sel]; 1055*ab25eeb5Syz if (ippr_ftp_debug > 2) 1056*ab25eeb5Syz printf("seqoff %d thseq %x ackmin %x\n", seqoff, thseq, 1057*ab25eeb5Syz aps->aps_ackmin[sel]); 10587c478bd9Sstevel@tonic-gate if (aps->aps_ackmin[sel] > seqoff + thseq) 10597c478bd9Sstevel@tonic-gate seqoff = aps->aps_ackoff[!sel]; 10607c478bd9Sstevel@tonic-gate 10617c478bd9Sstevel@tonic-gate ackoff = aps->aps_seqoff[sel2]; 1062*ab25eeb5Syz if (ippr_ftp_debug > 2) 1063*ab25eeb5Syz printf("ackoff %d thack %x seqmin %x\n", ackoff, thack, 1064*ab25eeb5Syz aps->aps_seqmin[sel2]); 10657c478bd9Sstevel@tonic-gate if (ackoff > 0) { 10667c478bd9Sstevel@tonic-gate if (aps->aps_seqmin[sel2] > ackoff + thack) 10677c478bd9Sstevel@tonic-gate ackoff = aps->aps_seqoff[!sel2]; 10687c478bd9Sstevel@tonic-gate } else { 10697c478bd9Sstevel@tonic-gate if (aps->aps_seqmin[sel2] > thack) 10707c478bd9Sstevel@tonic-gate ackoff = aps->aps_seqoff[!sel2]; 10717c478bd9Sstevel@tonic-gate } 10727c478bd9Sstevel@tonic-gate } 1073*ab25eeb5Syz if (ippr_ftp_debug > 2) { 1074*ab25eeb5Syz printf("%s: %x seq %x/%d ack %x/%d len %d/%d off %d\n", 1075*ab25eeb5Syz rv ? "IN" : "OUT", tcp->th_flags, thseq, seqoff, 1076*ab25eeb5Syz thack, ackoff, mlen, fin->fin_plen, off); 1077*ab25eeb5Syz printf("sel %d seqmin %x/%x offset %d/%d\n", sel, 1078*ab25eeb5Syz aps->aps_seqmin[sel], aps->aps_seqmin[sel2], 1079*ab25eeb5Syz aps->aps_seqoff[sel], aps->aps_seqoff[sel2]); 1080*ab25eeb5Syz printf("sel %d ackmin %x/%x offset %d/%d\n", sel2, 1081*ab25eeb5Syz aps->aps_ackmin[sel], aps->aps_ackmin[sel2], 1082*ab25eeb5Syz aps->aps_ackoff[sel], aps->aps_ackoff[sel2]); 1083*ab25eeb5Syz } 10847c478bd9Sstevel@tonic-gate 10857c478bd9Sstevel@tonic-gate /* 10867c478bd9Sstevel@tonic-gate * XXX - Ideally, this packet should get dropped because we now know 10877c478bd9Sstevel@tonic-gate * that it is out of order (and there is no real danger in doing so 10887c478bd9Sstevel@tonic-gate * apart from causing packets to go through here ordered). 10897c478bd9Sstevel@tonic-gate */ 1090*ab25eeb5Syz if (ippr_ftp_debug > 2) { 1091*ab25eeb5Syz printf("rv %d t:seq[0] %x seq[1] %x %d/%d\n", 1092*ab25eeb5Syz rv, t->ftps_seq[0], t->ftps_seq[1], seqoff, ackoff); 1093*ab25eeb5Syz } 10947c478bd9Sstevel@tonic-gate 10957c478bd9Sstevel@tonic-gate ok = 0; 10967c478bd9Sstevel@tonic-gate if (t->ftps_seq[0] == 0) { 10977c478bd9Sstevel@tonic-gate t->ftps_seq[0] = thack; 10987c478bd9Sstevel@tonic-gate ok = 1; 10997c478bd9Sstevel@tonic-gate } else { 11007c478bd9Sstevel@tonic-gate if (ackoff == 0) { 11017c478bd9Sstevel@tonic-gate if (t->ftps_seq[0] == thack) 11027c478bd9Sstevel@tonic-gate ok = 1; 11037c478bd9Sstevel@tonic-gate else if (t->ftps_seq[1] == thack) { 11047c478bd9Sstevel@tonic-gate t->ftps_seq[0] = thack; 11057c478bd9Sstevel@tonic-gate ok = 1; 11067c478bd9Sstevel@tonic-gate } 11077c478bd9Sstevel@tonic-gate } else { 11087c478bd9Sstevel@tonic-gate if (t->ftps_seq[0] + ackoff == thack) 11097c478bd9Sstevel@tonic-gate ok = 1; 11107c478bd9Sstevel@tonic-gate else if (t->ftps_seq[0] == thack + ackoff) 11117c478bd9Sstevel@tonic-gate ok = 1; 11127c478bd9Sstevel@tonic-gate else if (t->ftps_seq[1] + ackoff == thack) { 11137c478bd9Sstevel@tonic-gate t->ftps_seq[0] = thack - ackoff; 11147c478bd9Sstevel@tonic-gate ok = 1; 11157c478bd9Sstevel@tonic-gate } else if (t->ftps_seq[1] == thack + ackoff) { 11167c478bd9Sstevel@tonic-gate t->ftps_seq[0] = thack - ackoff; 11177c478bd9Sstevel@tonic-gate ok = 1; 11187c478bd9Sstevel@tonic-gate } 11197c478bd9Sstevel@tonic-gate } 11207c478bd9Sstevel@tonic-gate } 11217c478bd9Sstevel@tonic-gate 1122*ab25eeb5Syz if (ippr_ftp_debug > 2) { 1123*ab25eeb5Syz if (!ok) 1124*ab25eeb5Syz printf("%s ok\n", "not"); 1125*ab25eeb5Syz } 11267c478bd9Sstevel@tonic-gate 11277c478bd9Sstevel@tonic-gate if (!mlen) { 11287c478bd9Sstevel@tonic-gate if (t->ftps_seq[0] + ackoff != thack) { 1129*ab25eeb5Syz if (ippr_ftp_debug > 1) { 1130*ab25eeb5Syz printf("%s:seq[0](%x) + (%x) != (%x)\n", 1131*ab25eeb5Syz "ippr_ftp_process", t->ftps_seq[0], 1132*ab25eeb5Syz ackoff, thack); 1133*ab25eeb5Syz } 11347c478bd9Sstevel@tonic-gate return APR_ERR(1); 11357c478bd9Sstevel@tonic-gate } 11367c478bd9Sstevel@tonic-gate 1137*ab25eeb5Syz if (ippr_ftp_debug > 2) { 1138*ab25eeb5Syz printf("ippr_ftp_process:f:seq[0] %x seq[1] %x\n", 1139*ab25eeb5Syz f->ftps_seq[0], f->ftps_seq[1]); 1140*ab25eeb5Syz } 1141*ab25eeb5Syz 11427c478bd9Sstevel@tonic-gate if (tcp->th_flags & TH_FIN) { 11437c478bd9Sstevel@tonic-gate if (thseq == f->ftps_seq[1]) { 11447c478bd9Sstevel@tonic-gate f->ftps_seq[0] = f->ftps_seq[1] - seqoff; 11457c478bd9Sstevel@tonic-gate f->ftps_seq[1] = thseq + 1 - seqoff; 11467c478bd9Sstevel@tonic-gate } else { 1147*ab25eeb5Syz if (ippr_ftp_debug > 1) { 1148*ab25eeb5Syz printf("FIN: thseq %x seqoff %d ftps_seq %x\n", 1149*ab25eeb5Syz thseq, seqoff, f->ftps_seq[0]); 1150*ab25eeb5Syz } 11517c478bd9Sstevel@tonic-gate return APR_ERR(1); 11527c478bd9Sstevel@tonic-gate } 11537c478bd9Sstevel@tonic-gate } 11547c478bd9Sstevel@tonic-gate f->ftps_len = 0; 11557c478bd9Sstevel@tonic-gate return 0; 11567c478bd9Sstevel@tonic-gate } 11577c478bd9Sstevel@tonic-gate 11587c478bd9Sstevel@tonic-gate ok = 0; 11597c478bd9Sstevel@tonic-gate if ((thseq == f->ftps_seq[0]) || (thseq == f->ftps_seq[1])) { 11607c478bd9Sstevel@tonic-gate ok = 1; 11617c478bd9Sstevel@tonic-gate /* 11627c478bd9Sstevel@tonic-gate * Retransmitted data packet. 11637c478bd9Sstevel@tonic-gate */ 11647c478bd9Sstevel@tonic-gate } else if ((thseq + mlen == f->ftps_seq[0]) || 11657c478bd9Sstevel@tonic-gate (thseq + mlen == f->ftps_seq[1])) { 11667c478bd9Sstevel@tonic-gate ok = 1; 11677c478bd9Sstevel@tonic-gate } 11687c478bd9Sstevel@tonic-gate 11697c478bd9Sstevel@tonic-gate if (ok == 0) { 11707c478bd9Sstevel@tonic-gate inc = thseq - f->ftps_seq[0]; 1171*ab25eeb5Syz if (ippr_ftp_debug > 1) { 1172*ab25eeb5Syz printf("inc %d sel %d rv %d\n", inc, sel, rv); 1173*ab25eeb5Syz printf("th_seq %x ftps_seq %x/%x\n", 1174*ab25eeb5Syz thseq, f->ftps_seq[0], f->ftps_seq[1]); 1175*ab25eeb5Syz printf("ackmin %x ackoff %d\n", aps->aps_ackmin[sel], 1176*ab25eeb5Syz aps->aps_ackoff[sel]); 1177*ab25eeb5Syz printf("seqmin %x seqoff %d\n", aps->aps_seqmin[sel], 1178*ab25eeb5Syz aps->aps_seqoff[sel]); 1179*ab25eeb5Syz } 11807c478bd9Sstevel@tonic-gate 11817c478bd9Sstevel@tonic-gate return APR_ERR(1); 11827c478bd9Sstevel@tonic-gate } 11837c478bd9Sstevel@tonic-gate 11847c478bd9Sstevel@tonic-gate inc = 0; 11857c478bd9Sstevel@tonic-gate rptr = f->ftps_rptr; 11867c478bd9Sstevel@tonic-gate wptr = f->ftps_wptr; 11877c478bd9Sstevel@tonic-gate f->ftps_seq[0] = thseq; 11887c478bd9Sstevel@tonic-gate f->ftps_seq[1] = f->ftps_seq[0] + mlen; 11897c478bd9Sstevel@tonic-gate f->ftps_len = mlen; 11907c478bd9Sstevel@tonic-gate 11917c478bd9Sstevel@tonic-gate while (mlen > 0) { 1192*ab25eeb5Syz len = MIN(mlen, sizeof(f->ftps_buf) - (wptr - rptr)); 11937c478bd9Sstevel@tonic-gate COPYDATA(m, off, len, wptr); 11947c478bd9Sstevel@tonic-gate mlen -= len; 11957c478bd9Sstevel@tonic-gate off += len; 11967c478bd9Sstevel@tonic-gate wptr += len; 1197*ab25eeb5Syz 1198*ab25eeb5Syz if (ippr_ftp_debug > 3) 1199*ab25eeb5Syz printf("%s:len %d/%d off %d wptr %lx junk %d [%*s]\n", 1200*ab25eeb5Syz "ippr_ftp_process", 1201*ab25eeb5Syz len, mlen, off, (u_long)wptr, f->ftps_junk, 1202*ab25eeb5Syz len, rptr); 1203*ab25eeb5Syz 12047c478bd9Sstevel@tonic-gate f->ftps_wptr = wptr; 1205*ab25eeb5Syz if (f->ftps_junk != 0) { 1206*ab25eeb5Syz i = f->ftps_junk; 12077c478bd9Sstevel@tonic-gate f->ftps_junk = ippr_ftp_valid(ftp, rv, rptr, 12087c478bd9Sstevel@tonic-gate wptr - rptr); 12097c478bd9Sstevel@tonic-gate 1210*ab25eeb5Syz if (ippr_ftp_debug > 5) 1211*ab25eeb5Syz printf("%s:junk %d -> %d\n", 1212*ab25eeb5Syz "ippr_ftp_process", i, f->ftps_junk); 1213*ab25eeb5Syz 1214*ab25eeb5Syz if (f->ftps_junk != 0) { 1215*ab25eeb5Syz if (wptr - rptr == sizeof(f->ftps_buf)) { 1216*ab25eeb5Syz if (ippr_ftp_debug > 4) 1217*ab25eeb5Syz printf("%s:full buffer\n", 1218*ab25eeb5Syz "ippr_ftp_process"); 1219*ab25eeb5Syz f->ftps_rptr = f->ftps_buf; 1220*ab25eeb5Syz f->ftps_wptr = f->ftps_buf; 1221*ab25eeb5Syz rptr = f->ftps_rptr; 1222*ab25eeb5Syz wptr = f->ftps_wptr; 1223*ab25eeb5Syz /* 1224*ab25eeb5Syz * Because we throw away data here that 1225*ab25eeb5Syz * we would otherwise parse, set the 1226*ab25eeb5Syz * junk flag to indicate just ignore 1227*ab25eeb5Syz * any data upto the next CRLF. 1228*ab25eeb5Syz */ 1229*ab25eeb5Syz f->ftps_junk = 1; 1230*ab25eeb5Syz continue; 1231*ab25eeb5Syz } 1232*ab25eeb5Syz } 1233*ab25eeb5Syz } 1234*ab25eeb5Syz 12357c478bd9Sstevel@tonic-gate while ((f->ftps_junk == 0) && (wptr > rptr)) { 1236*ab25eeb5Syz len = wptr - rptr; 1237*ab25eeb5Syz f->ftps_junk = ippr_ftp_valid(ftp, rv, rptr, len); 1238*ab25eeb5Syz 1239*ab25eeb5Syz if (ippr_ftp_debug > 3) { 1240*ab25eeb5Syz printf("%s=%d len %d rv %d ptr %lx/%lx ", 1241*ab25eeb5Syz "ippr_ftp_valid", 1242*ab25eeb5Syz f->ftps_junk, len, rv, (u_long)rptr, 1243*ab25eeb5Syz (u_long)wptr); 1244*ab25eeb5Syz printf("buf [%*s]\n", len, rptr); 1245*ab25eeb5Syz } 1246*ab25eeb5Syz 12477c478bd9Sstevel@tonic-gate if (f->ftps_junk == 0) { 12487c478bd9Sstevel@tonic-gate f->ftps_rptr = rptr; 12497c478bd9Sstevel@tonic-gate if (rv) 12507c478bd9Sstevel@tonic-gate inc += ippr_ftp_server(fin, ip, nat, 12517c478bd9Sstevel@tonic-gate ftp, len); 12527c478bd9Sstevel@tonic-gate else 12537c478bd9Sstevel@tonic-gate inc += ippr_ftp_client(fin, ip, nat, 12547c478bd9Sstevel@tonic-gate ftp, len); 12557c478bd9Sstevel@tonic-gate rptr = f->ftps_rptr; 12567c478bd9Sstevel@tonic-gate wptr = f->ftps_wptr; 12577c478bd9Sstevel@tonic-gate } 12587c478bd9Sstevel@tonic-gate } 12597c478bd9Sstevel@tonic-gate 12607c478bd9Sstevel@tonic-gate /* 12617c478bd9Sstevel@tonic-gate * Off to a bad start so lets just forget about using the 12627c478bd9Sstevel@tonic-gate * ftp proxy for this connection. 12637c478bd9Sstevel@tonic-gate */ 12647c478bd9Sstevel@tonic-gate if ((f->ftps_cmds == 0) && (f->ftps_junk == 1)) { 12657c478bd9Sstevel@tonic-gate /* f->ftps_seq[1] += inc; */ 1266*ab25eeb5Syz 1267*ab25eeb5Syz if (ippr_ftp_debug > 1) 1268*ab25eeb5Syz printf("%s:cmds == 0 junk == 1\n", 1269*ab25eeb5Syz "ippr_ftp_process"); 12707c478bd9Sstevel@tonic-gate return APR_ERR(2); 12717c478bd9Sstevel@tonic-gate } 12727c478bd9Sstevel@tonic-gate 1273*ab25eeb5Syz if ((f->ftps_junk != 0) && (rptr < wptr)) { 1274*ab25eeb5Syz for (s = rptr; s < wptr; s++) { 1275*ab25eeb5Syz if ((*s == '\r') && (s + 1 < wptr) && 1276*ab25eeb5Syz (*(s + 1) == '\n')) { 1277*ab25eeb5Syz rptr = s + 2; 1278*ab25eeb5Syz f->ftps_junk = 0; 12797c478bd9Sstevel@tonic-gate break; 1280*ab25eeb5Syz } 12817c478bd9Sstevel@tonic-gate } 12827c478bd9Sstevel@tonic-gate } 12837c478bd9Sstevel@tonic-gate 12847c478bd9Sstevel@tonic-gate if (rptr == wptr) { 12857c478bd9Sstevel@tonic-gate rptr = wptr = f->ftps_buf; 12867c478bd9Sstevel@tonic-gate } else { 1287*ab25eeb5Syz /* 1288*ab25eeb5Syz * Compact the buffer back to the start. The junk 1289*ab25eeb5Syz * flag should already be set and because we're not 1290*ab25eeb5Syz * throwing away any data, it is preserved from its 1291*ab25eeb5Syz * current state. 1292*ab25eeb5Syz */ 1293*ab25eeb5Syz if (rptr > f->ftps_buf) { 1294*ab25eeb5Syz bcopy(rptr, f->ftps_buf, len); 1295*ab25eeb5Syz wptr -= rptr - f->ftps_buf; 1296*ab25eeb5Syz rptr = f->ftps_buf; 12977c478bd9Sstevel@tonic-gate } 12987c478bd9Sstevel@tonic-gate } 1299*ab25eeb5Syz f->ftps_rptr = rptr; 1300*ab25eeb5Syz f->ftps_wptr = wptr; 13017c478bd9Sstevel@tonic-gate } 13027c478bd9Sstevel@tonic-gate 13037c478bd9Sstevel@tonic-gate /* f->ftps_seq[1] += inc; */ 13047c478bd9Sstevel@tonic-gate if (tcp->th_flags & TH_FIN) 13057c478bd9Sstevel@tonic-gate f->ftps_seq[1]++; 1306*ab25eeb5Syz if (ippr_ftp_debug > 3) { 1307*ab25eeb5Syz #ifdef __sgi 1308*ab25eeb5Syz mlen = fin->fin_plen; 1309*ab25eeb5Syz #else 1310*ab25eeb5Syz mlen = MSGDSIZE(m); 13117c478bd9Sstevel@tonic-gate #endif 1312*ab25eeb5Syz mlen -= off; 1313*ab25eeb5Syz printf("ftps_seq[1] = %x inc %d len %d\n", 1314*ab25eeb5Syz f->ftps_seq[1], inc, mlen); 1315*ab25eeb5Syz } 13167c478bd9Sstevel@tonic-gate 13177c478bd9Sstevel@tonic-gate f->ftps_rptr = rptr; 13187c478bd9Sstevel@tonic-gate f->ftps_wptr = wptr; 13197c478bd9Sstevel@tonic-gate return APR_INC(inc); 13207c478bd9Sstevel@tonic-gate } 13217c478bd9Sstevel@tonic-gate 13227c478bd9Sstevel@tonic-gate 13237c478bd9Sstevel@tonic-gate int ippr_ftp_out(fin, aps, nat) 13247c478bd9Sstevel@tonic-gate fr_info_t *fin; 13257c478bd9Sstevel@tonic-gate ap_session_t *aps; 13267c478bd9Sstevel@tonic-gate nat_t *nat; 13277c478bd9Sstevel@tonic-gate { 13287c478bd9Sstevel@tonic-gate ftpinfo_t *ftp; 13297c478bd9Sstevel@tonic-gate int rev; 13307c478bd9Sstevel@tonic-gate 13317c478bd9Sstevel@tonic-gate ftp = aps->aps_data; 13327c478bd9Sstevel@tonic-gate if (ftp == NULL) 13337c478bd9Sstevel@tonic-gate return 0; 13347c478bd9Sstevel@tonic-gate 13357c478bd9Sstevel@tonic-gate rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1; 13367c478bd9Sstevel@tonic-gate if (ftp->ftp_side[1 - rev].ftps_ifp == NULL) 13377c478bd9Sstevel@tonic-gate ftp->ftp_side[1 - rev].ftps_ifp = fin->fin_ifp; 13387c478bd9Sstevel@tonic-gate 13397c478bd9Sstevel@tonic-gate return ippr_ftp_process(fin, nat, ftp, rev); 13407c478bd9Sstevel@tonic-gate } 13417c478bd9Sstevel@tonic-gate 13427c478bd9Sstevel@tonic-gate 13437c478bd9Sstevel@tonic-gate int ippr_ftp_in(fin, aps, nat) 13447c478bd9Sstevel@tonic-gate fr_info_t *fin; 13457c478bd9Sstevel@tonic-gate ap_session_t *aps; 13467c478bd9Sstevel@tonic-gate nat_t *nat; 13477c478bd9Sstevel@tonic-gate { 13487c478bd9Sstevel@tonic-gate ftpinfo_t *ftp; 13497c478bd9Sstevel@tonic-gate int rev; 13507c478bd9Sstevel@tonic-gate 13517c478bd9Sstevel@tonic-gate ftp = aps->aps_data; 13527c478bd9Sstevel@tonic-gate if (ftp == NULL) 13537c478bd9Sstevel@tonic-gate return 0; 13547c478bd9Sstevel@tonic-gate 13557c478bd9Sstevel@tonic-gate rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1; 13567c478bd9Sstevel@tonic-gate if (ftp->ftp_side[rev].ftps_ifp == NULL) 13577c478bd9Sstevel@tonic-gate ftp->ftp_side[rev].ftps_ifp = fin->fin_ifp; 13587c478bd9Sstevel@tonic-gate 13597c478bd9Sstevel@tonic-gate return ippr_ftp_process(fin, nat, ftp, 1 - rev); 13607c478bd9Sstevel@tonic-gate } 13617c478bd9Sstevel@tonic-gate 13627c478bd9Sstevel@tonic-gate 13637c478bd9Sstevel@tonic-gate /* 13647c478bd9Sstevel@tonic-gate * ippr_ftp_atoi - implement a version of atoi which processes numbers in 13657c478bd9Sstevel@tonic-gate * pairs separated by commas (which are expected to be in the range 0 - 255), 13667c478bd9Sstevel@tonic-gate * returning a 16 bit number combining either side of the , as the MSB and 13677c478bd9Sstevel@tonic-gate * LSB. 13687c478bd9Sstevel@tonic-gate */ 13697c478bd9Sstevel@tonic-gate u_short ippr_ftp_atoi(ptr) 13707c478bd9Sstevel@tonic-gate char **ptr; 13717c478bd9Sstevel@tonic-gate { 13727c478bd9Sstevel@tonic-gate register char *s = *ptr, c; 13737c478bd9Sstevel@tonic-gate register u_char i = 0, j = 0; 13747c478bd9Sstevel@tonic-gate 1375*ab25eeb5Syz while (((c = *s++) != '\0') && ISDIGIT(c)) { 13767c478bd9Sstevel@tonic-gate i *= 10; 13777c478bd9Sstevel@tonic-gate i += c - '0'; 13787c478bd9Sstevel@tonic-gate } 13797c478bd9Sstevel@tonic-gate if (c != ',') { 13807c478bd9Sstevel@tonic-gate *ptr = NULL; 13817c478bd9Sstevel@tonic-gate return 0; 13827c478bd9Sstevel@tonic-gate } 1383*ab25eeb5Syz while (((c = *s++) != '\0') && ISDIGIT(c)) { 13847c478bd9Sstevel@tonic-gate j *= 10; 13857c478bd9Sstevel@tonic-gate j += c - '0'; 13867c478bd9Sstevel@tonic-gate } 13877c478bd9Sstevel@tonic-gate *ptr = s; 13887c478bd9Sstevel@tonic-gate i &= 0xff; 13897c478bd9Sstevel@tonic-gate j &= 0xff; 13907c478bd9Sstevel@tonic-gate return (i << 8) | j; 13917c478bd9Sstevel@tonic-gate } 13927c478bd9Sstevel@tonic-gate 13937c478bd9Sstevel@tonic-gate 13947c478bd9Sstevel@tonic-gate int ippr_ftp_epsv(fin, ip, nat, f, dlen) 13957c478bd9Sstevel@tonic-gate fr_info_t *fin; 13967c478bd9Sstevel@tonic-gate ip_t *ip; 13977c478bd9Sstevel@tonic-gate nat_t *nat; 13987c478bd9Sstevel@tonic-gate ftpside_t *f; 13997c478bd9Sstevel@tonic-gate int dlen; 14007c478bd9Sstevel@tonic-gate { 14017c478bd9Sstevel@tonic-gate char newbuf[IPF_FTPBUFSZ]; 14027c478bd9Sstevel@tonic-gate char *s; 14037c478bd9Sstevel@tonic-gate u_short ap = 0; 14047c478bd9Sstevel@tonic-gate 14057c478bd9Sstevel@tonic-gate #define EPSV_REPLEN 33 14067c478bd9Sstevel@tonic-gate /* 14077c478bd9Sstevel@tonic-gate * Check for EPSV reply message. 14087c478bd9Sstevel@tonic-gate */ 14097c478bd9Sstevel@tonic-gate if (dlen < IPF_MIN229LEN) 14107c478bd9Sstevel@tonic-gate return (0); 14117c478bd9Sstevel@tonic-gate else if (strncmp(f->ftps_rptr, 14127c478bd9Sstevel@tonic-gate "229 Entering Extended Passive Mode", EPSV_REPLEN)) 14137c478bd9Sstevel@tonic-gate return (0); 14147c478bd9Sstevel@tonic-gate 14157c478bd9Sstevel@tonic-gate /* 14167c478bd9Sstevel@tonic-gate * Skip the EPSV command + space 14177c478bd9Sstevel@tonic-gate */ 14187c478bd9Sstevel@tonic-gate s = f->ftps_rptr + 33; 1419*ab25eeb5Syz while (*s && !ISDIGIT(*s)) 14207c478bd9Sstevel@tonic-gate s++; 14217c478bd9Sstevel@tonic-gate 14227c478bd9Sstevel@tonic-gate /* 14237c478bd9Sstevel@tonic-gate * As per RFC 2428, there are no addres components in the EPSV 14247c478bd9Sstevel@tonic-gate * response. So we'll go straight to getting the port. 14257c478bd9Sstevel@tonic-gate */ 1426*ab25eeb5Syz while (*s && ISDIGIT(*s)) { 14277c478bd9Sstevel@tonic-gate ap *= 10; 14287c478bd9Sstevel@tonic-gate ap += *s++ - '0'; 14297c478bd9Sstevel@tonic-gate } 14307c478bd9Sstevel@tonic-gate 14317c478bd9Sstevel@tonic-gate if (!s) 14327c478bd9Sstevel@tonic-gate return 0; 14337c478bd9Sstevel@tonic-gate 14347c478bd9Sstevel@tonic-gate if (*s == '|') 14357c478bd9Sstevel@tonic-gate s++; 14367c478bd9Sstevel@tonic-gate if (*s == ')') 14377c478bd9Sstevel@tonic-gate s++; 14387c478bd9Sstevel@tonic-gate if (*s == '\n') 14397c478bd9Sstevel@tonic-gate s--; 14407c478bd9Sstevel@tonic-gate /* 14417c478bd9Sstevel@tonic-gate * check for CR-LF at the end. 14427c478bd9Sstevel@tonic-gate */ 14437c478bd9Sstevel@tonic-gate if ((*s == '\r') && (*(s + 1) == '\n')) { 14447c478bd9Sstevel@tonic-gate s += 2; 14457c478bd9Sstevel@tonic-gate } else 14467c478bd9Sstevel@tonic-gate return 0; 14477c478bd9Sstevel@tonic-gate 1448*ab25eeb5Syz #if defined(SNPRINTF) && defined(_KERNEL) 1449*ab25eeb5Syz (void) SNPRINTF(newbuf, sizeof(newbuf), "%s (|||%u|)\r\n", 1450*ab25eeb5Syz "229 Entering Extended Passive Mode", ap); 14517c478bd9Sstevel@tonic-gate #else 14527c478bd9Sstevel@tonic-gate (void) sprintf(newbuf, "%s (|||%u|)\r\n", 14537c478bd9Sstevel@tonic-gate "229 Entering Extended Passive Mode", ap); 14547c478bd9Sstevel@tonic-gate #endif 14557c478bd9Sstevel@tonic-gate 14567c478bd9Sstevel@tonic-gate return ippr_ftp_pasvreply(fin, ip, nat, f, (u_int)ap, newbuf, s, 14577c478bd9Sstevel@tonic-gate ip->ip_src.s_addr); 14587c478bd9Sstevel@tonic-gate } 1459