Import of Darren Reed's IPFilter 3.3.4, including OpenBSD patches.

Many, many enhancements and improvements, including new in-kernel
proxies, enhancements to logging, and many bugfixes.

Note: Man pages have not yet been re-converted to mdoc.

1 files changed, 124 insertions, 88 deletions

diff --git a/sys/netinet/ip_ftp_pxy.c b/sys/netinet/ip_ftp_pxy.c
index 7079c4efa1c..08e5ce5ae3f 100644
--- a/sys/netinet/ip_ftp_pxy.c
+++ b/sys/netinet/ip_ftp_pxy.c
@@ -1,5 +1,5 @@
-/*	$OpenBSD: ip_ftp_pxy.c,v 1.4 1999/02/05 05:58:52 deraadt Exp $
- * $Id: ip_ftp_pxy.c,v 1.4 1999/02/05 05:58:52 deraadt Exp $
+/* $OpenBSD: ip_ftp_pxy.c,v 1.5 1999/12/15 05:20:22 kjell Exp $ */
+/*
  * Simple FTP transparent proxy for in-kernel use.  For use with the NAT
  * code.
  */
@@ -17,27 +17,25 @@ extern	kmutex_t	ipf_rw;
 #define	IPF_MAX227LEN	51
 
 
-int ippr_ftp_init __P((fr_info_t *, ip_t *, ap_session_t *, nat_t *));
+int ippr_ftp_init __P((void));
 int ippr_ftp_out __P((fr_info_t *, ip_t *, ap_session_t *, nat_t *));
 int ippr_ftp_in __P((fr_info_t *, ip_t *, ap_session_t *, nat_t *));
-int ippr_ftp_portmsg __P((fr_info_t *, ip_t *, nat_t *nat));
-int ippr_ftp_pasvmsg __P((fr_info_t *, ip_t *, tcphdr_t *, nat_t *));
+int ippr_ftp_portmsg __P((fr_info_t *, ip_t *, nat_t *));
+int ippr_ftp_pasvmsg __P((fr_info_t *, ip_t *, nat_t *));
+
 u_short ipf_ftp_atoi __P((char **));
 
+static	frentry_t	natfr;
+
 
 /*
- * FTP application proxy initialization.
+ * Initialize local structures.
  */
-int ippr_ftp_init(fin, ip, aps, nat)
-fr_info_t *fin;
-ip_t *ip;
-ap_session_t *aps;
-nat_t *nat;
+int ippr_ftp_init()
 {
-	tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp;
-
-	aps->aps_sport = tcp->th_sport;
-	aps->aps_dport = tcp->th_dport;
+	bzero((char *)&natfr, sizeof(natfr));
+	natfr.fr_ref = 1;
+	natfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
 	return 0;
 }
 
@@ -77,11 +75,12 @@ ip_t *ip;
 nat_t *nat;
 {
 	char portbuf[IPF_MAXPORTLEN + 1], newbuf[IPF_MAXPORTLEN + 1], *s;
-	int off, olen, dlen, nlen = 0, inc = 0;
-	u_int a1, a2, a3, a4;
 	tcphdr_t *tcp, tcph, *tcp2 = &tcph;
-	struct in_addr swip;
+	size_t nlen = 0, dlen, olen;
 	u_short a5, a6, sp, dp;
+	u_int a1, a2, a3, a4;
+	struct in_addr swip;
+	int off, inc = 0;
 	fr_info_t fi;
 	nat_t *ipn;
 	mb_t *m;
@@ -90,23 +89,26 @@ nat_t *nat;
 #endif
 
 	tcp = (tcphdr_t *)fin->fin_dp;
+	bzero(portbuf, sizeof(portbuf));
 	off = (ip->ip_hl << 2) + (tcp->th_off << 2);
-	m = *(mb_t **)fin->fin_mp;
 
 #if	SOLARIS
 	m = fin->fin_qfm;
 
 	dlen = msgdsize(m) - off;
-	bzero(portbuf, sizeof(portbuf));
-	copyout_mblk(m, off, MIN(sizeof(portbuf), dlen), portbuf);
+	if (dlen > 0)
+		copyout_mblk(m, off, MIN(sizeof(portbuf), dlen), portbuf);
 #else
+	m = *(mb_t **)fin->fin_mp;
+
 	dlen = mbufchainlen(m) - off;
-	bzero(portbuf, sizeof(portbuf));
-	m_copydata(m, off, MIN(sizeof(portbuf), dlen), portbuf);
+	if (dlen > 0)
+		m_copydata(m, off, MIN(sizeof(portbuf), dlen), portbuf);
 #endif
+	if (dlen == 0)
+		return 0;
 	portbuf[sizeof(portbuf) - 1] = '\0';
 	*newbuf = '\0';
-
 	if (!strncmp(portbuf, "PORT ", 5)) { 
 		if (dlen < IPF_MINPORTLEN)
 			return 0;
@@ -128,9 +130,9 @@ nat_t *nat;
 		return 0;
 
 	/*
-	* check that IP address in the PORT/PASV reply is the same as the
-	* sender of the command - prevents using PORT for port scanning.
-	*/
+	 * check that IP address in the PORT/PASV reply is the same as the
+	 * sender of the command - prevents using PORT for port scanning.
+	 */
 	a1 <<= 16;
 	a1 |= a2;
 	if (a1 != ntohl(nat->nat_inip.s_addr))
@@ -139,14 +141,18 @@ nat_t *nat;
 	a5 = ipf_ftp_atoi(&s);
 	if (!s)
 		return 0;
+	if (*s == ')')
+		s++;
 
 	/*
 	 * check for CR-LF at the end.
 	 */
-	if (((*s == '\r') && (*(s + 1) == '\n')) ||
-	    ((*(s - 1) == '\r') && (*s == '\n')))
+	if (*s == '\n')
+		s--;
+	if ((*s == '\r') && (*(s + 1) == '\n')) {
+		s += 2;
 		a6 = a5 & 0xff;
-	else
+	} else
 		return 0;
 	a5 >>= 8;
 	/*
@@ -157,8 +163,8 @@ nat_t *nat;
 	a3 = (a1 >> 8) & 0xff;
 	a4 = a1 & 0xff;
 	a1 >>= 24;
-	olen = s - portbuf + 1;
-	(void) sprintf(newbuf, "%s %d,%d,%d,%d,%d,%d\r\n",
+	olen = s - portbuf;
+	(void) sprintf(newbuf, "%s %u,%u,%u,%u,%u,%u\r\n",
 		       "PORT", a1, a2, a3, a4, a5, a6);
 
 	nlen = strlen(newbuf);
@@ -182,6 +188,9 @@ nat_t *nat;
 
 		linkb(m1, nm);
 	} else {
+		if (m1->b_datap->db_struiolim == m1->b_wptr)
+			m1->b_datap->db_struiolim += inc;
+		m1->b_datap->db_struioflag &= ~STRUIO_IP;
 		m1->b_wptr += inc;
 	}
 	copyin_mblk(m, off, nlen, newbuf);
@@ -191,7 +200,7 @@ nat_t *nat;
 	/* the mbuf chain will be extended if necessary by m_copyback() */
 	m_copyback(m, off, nlen, newbuf);
 #endif
-	if (inc) {
+	if (inc != 0) {
 #if SOLARIS || defined(__sgi)
 		register u_32_t	sum1, sum2;
 
@@ -204,32 +213,40 @@ nat_t *nat;
 		sum2 -= sum1;
 		sum2 = (sum2 & 0xffff) + (sum2 >> 16);
 
-		fix_outcksum(&ip->ip_sum, sum2);
+		fix_outcksum(&ip->ip_sum, sum2, 0);
 #endif
 		ip->ip_len += inc;
 	}
 
 	/*
-	* Add skeleton NAT entry for connection which will come back the
-	* other way.
-	*/
+	 * Add skeleton NAT entry for connection which will come back the
+	 * other way.
+	 */
 	sp = htons(a5 << 8 | a6);
+	/*
+	 * The server may not make the connection back from port 20, but
+	 * it is the most likely so use it here to check for a conflicting
+	 * mapping.
+	 */
 	dp = htons(fin->fin_data[1] - 1);
-	ipn = nat_outlookup(fin->fin_ifp, IPN_TCP, nat->nat_inip, sp,
-			    ip->ip_dst, dp);
+	ipn = nat_outlookup(fin->fin_ifp, IPN_TCP, nat->nat_p, nat->nat_inip,
+			    ip->ip_dst, (dp << 16) | sp);
 	if (ipn == NULL) {
 		bcopy((char *)fin, (char *)&fi, sizeof(fi));
 		bzero((char *)tcp2, sizeof(*tcp2));
+		tcp2->th_win = htons(8192);
 		tcp2->th_sport = sp;
-		tcp2->th_dport = dp;
+		tcp2->th_dport = 0; /* XXX - don't specify remote port */
+		fi.fin_data[0] = ntohs(sp);
+		fi.fin_data[1] = 0;
 		fi.fin_dp = (char *)tcp2;
 		swip = ip->ip_src;
 		ip->ip_src = nat->nat_inip;
-		ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_TCP, NAT_OUTBOUND);
+		ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_TCP|FI_W_DPORT,
+			      NAT_OUTBOUND);
 		if (ipn != NULL) {
 			ipn->nat_age = fr_defnatage;
-			(void) fr_addstate(ip, &fi, FR_INQUE|FR_PASS|
-						    FR_QUICK|FR_KEEPSTATE);
+			(void) fr_addstate(ip, &fi, FI_W_DPORT);
 		}
 		ip->ip_src = swip;
 	}
@@ -247,18 +264,18 @@ nat_t *nat;
 }
 
 
-int ippr_ftp_pasvmsg(fin, ip, tcp, nat)
+int ippr_ftp_pasvmsg(fin, ip, nat)
 fr_info_t *fin;
 ip_t *ip;
-tcphdr_t *tcp;
 nat_t *nat;
 {
 	char portbuf[IPF_MAX227LEN + 1], newbuf[IPF_MAX227LEN + 1], *s;
 	int off, olen, dlen, nlen = 0, inc = 0;
-	u_int a1, a2, a3, a4;
 	tcphdr_t tcph, *tcp2 = &tcph;
-	struct in_addr swip;
-	u_short a5, a6;
+	struct in_addr swip, swip2;
+	u_short a5, a6, dp, sp;
+	u_int a1, a2, a3, a4;
+	tcphdr_t *tcp;
 	fr_info_t fi;
 	nat_t *ipn;
 	mb_t *m;
@@ -266,20 +283,24 @@ nat_t *nat;
 	mb_t *m1;
 #endif
 
+	tcp = (tcphdr_t *)fin->fin_dp;
 	off = (ip->ip_hl << 2) + (tcp->th_off << 2);
 	m = *(mb_t **)fin->fin_mp;
+	bzero(portbuf, sizeof(portbuf));
 
 #if	SOLARIS
 	m = fin->fin_qfm;
 
 	dlen = msgdsize(m) - off;
-	bzero(portbuf, sizeof(portbuf));
-	copyout_mblk(m, off, MIN(sizeof(portbuf), dlen), portbuf);
+	if (dlen > 0)
+		copyout_mblk(m, off, MIN(sizeof(portbuf), dlen), portbuf);
 #else
 	dlen = mbufchainlen(m) - off;
-	bzero(portbuf, sizeof(portbuf));
-	m_copydata(m, off, MIN(sizeof(portbuf), dlen), portbuf);
+	if (dlen > 0)
+		m_copydata(m, off, MIN(sizeof(portbuf), dlen), portbuf);
 #endif
+	if (dlen == 0)
+		return 0;
 	portbuf[sizeof(portbuf) - 1] = '\0';
 	*newbuf = '\0';
 
@@ -288,21 +309,17 @@ nat_t *nat;
 			return 0;
 		else if (strncmp(portbuf, "227 Entering Passive Mode", 25))
 			return 0;
-#ifndef notyet
-		return 0;
-#endif
 	} else
 		return 0;
-
 	/*
-	* Skip the PORT command + space
-	*/
+	 * Skip the PORT command + space
+	 */
 	s = portbuf + 25;
 	while (*s && !isdigit(*s))
 		s++;
 	/*
-	* Pick out the address components, two at a time.
-	*/
+	 * Pick out the address components, two at a time.
+	 */
 	a1 = ipf_ftp_atoi(&s);
 	if (!s)
 		return 0;
@@ -311,9 +328,9 @@ nat_t *nat;
 		return 0;
 
 	/*
-	* check that IP address in the PORT/PASV reply is the same as the
-	* sender of the command - prevents using PORT for port scanning.
-	*/
+	 * check that IP address in the PORT/PASV reply is the same as the
+	 * sender of the command - prevents using PORT for port scanning.
+	 */
 	a1 <<= 16;
 	a1 |= a2;
 	if (a1 != ntohl(nat->nat_oip.s_addr))
@@ -323,25 +340,29 @@ nat_t *nat;
 	if (!s)
 		return 0;
 
+	if (*s == ')')
+		s++;
+	if (*s == '\n')
+		s--;
 	/*
-	* check for CR-LF at the end.
-	*/
-	if (((*s == '\r') && (*(s + 1) == '\n')) ||
-	    ((*(s - 1) == '\r') && (*s == '\n')))
+	 * check for CR-LF at the end.
+	 */
+	if ((*s == '\r') && (*(s + 1) == '\n')) {
+		s += 2;
 		a6 = a5 & 0xff;
-	else
+	} else
 		return 0;
 	a5 >>= 8;
 	/*
-	* Calculate new address parts for 227 reply
-	*/
-	a1 = ntohl(nat->nat_inip.s_addr);
+	 * Calculate new address parts for 227 reply
+	 */
+	a1 = ntohl(ip->ip_src.s_addr);
 	a2 = (a1 >> 16) & 0xff;
 	a3 = (a1 >> 8) & 0xff;
 	a4 = a1 & 0xff;
 	a1 >>= 24;
-	olen = s - portbuf + 1;
-	(void) sprintf(newbuf, "%s %d,%d,%d,%d,%d,%d\r\n",
+	olen = s - portbuf;
+	(void) sprintf(newbuf, "%s %u,%u,%u,%u,%u,%u\r\n",
 		       "227 Entering Passive Mode", a1, a2, a3, a4, a5, a6);
 
 	nlen = strlen(newbuf);
@@ -374,7 +395,7 @@ nat_t *nat;
 	/* the mbuf chain will be extended if necessary by m_copyback() */
 	m_copyback(m, off, nlen, newbuf);
 #endif
-	if (inc) {
+	if (inc != 0) {
 #if SOLARIS || defined(__sgi)
 		register u_32_t	sum1, sum2;
 
@@ -387,7 +408,7 @@ nat_t *nat;
 		sum2 -= sum1;
 		sum2 = (sum2 & 0xffff) + (sum2 >> 16);
 
-		fix_outcksum(&ip->ip_sum, sum2);
+		fix_outcksum(&ip->ip_sum, sum2, 0);
 #endif
 		ip->ip_len += inc;
 	}
@@ -396,27 +417,42 @@ nat_t *nat;
 	 * Add skeleton NAT entry for connection which will come back the
 	 * other way.
 	 */
-	bcopy((char *)fin, (char *)&fi, sizeof(fi));
-	bzero((char *)tcp2, sizeof(*tcp2));
-	tcp2->th_sport = htons(a5 << 8 | a6);
-	fi.fin_dp = (char *)tcp2;
-	swip = ip->ip_src;
-	ip->ip_src = nat->nat_oip;
-	ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_TCP, NAT_INBOUND);
-	if (ipn != NULL)
-		ipn->nat_age = fr_defnatage;
-	(void) fr_addstate(ip, &fi, FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE);
-	ip->ip_src = swip;
+	sp = 0;
+	dp = htons(fin->fin_data[1] - 1);
+	ipn = nat_outlookup(fin->fin_ifp, IPN_TCP, nat->nat_p, nat->nat_inip,
+			    ip->ip_dst, (dp << 16) | sp);
+	if (ipn == NULL) {
+		bcopy((char *)fin, (char *)&fi, sizeof(fi));
+		bzero((char *)tcp2, sizeof(*tcp2));
+		tcp2->th_win = htons(8192);
+		tcp2->th_sport = 0;		/* XXX - fake it for nat_new */
+		fi.fin_data[0] = a5 << 8 | a6;
+		tcp2->th_dport = htons(fi.fin_data[0]);
+		fi.fin_data[1] = 0;
+		fi.fin_dp = (char *)tcp2;
+		swip = ip->ip_src;
+		swip2 = ip->ip_dst;
+		ip->ip_dst = ip->ip_src;
+		ip->ip_src = nat->nat_inip;
+		ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_TCP|FI_W_SPORT,
+			      NAT_OUTBOUND);
+		if (ipn != NULL) {
+			ipn->nat_age = fr_defnatage;
+			(void) fr_addstate(ip, &fi, FI_W_SPORT);
+		}
+		ip->ip_src = swip;
+		ip->ip_dst = swip2;
+	}
 	return inc;
 }
 
+
 int ippr_ftp_in(fin, ip, aps, nat)
 fr_info_t *fin;
 ip_t *ip;
 ap_session_t *aps;
 nat_t *nat;
 {
-	tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp;
 
-	return ippr_ftp_pasvmsg(fin, ip, tcp, nat);
+	return ippr_ftp_pasvmsg(fin, ip, nat);
 }