1.\" $OpenBSD: ftp-proxy.8,v 1.25 2022/03/31 17:27:29 naddy Exp $ 2.\" 3.\" Copyright (c) 2004, 2005 Camiel Dobbelaar, <cd@sentia.nl> 4.\" 5.\" Permission to use, copy, modify, and distribute this software for any 6.\" purpose with or without fee is hereby granted, provided that the above 7.\" copyright notice and this permission notice appear in all copies. 8.\" 9.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16.\" 17.Dd $Mdocdate: March 31 2022 $ 18.Dt FTP-PROXY 8 19.Os 20.Sh NAME 21.Nm ftp-proxy 22.Nd Internet File Transfer Protocol proxy daemon 23.Sh SYNOPSIS 24.Nm 25.Bk -words 26.Op Fl 6Adrv 27.Op Fl a Ar sourceaddr 28.Op Fl b Ar address 29.Op Fl D Ar level 30.Op Fl m Ar maxsessions 31.Op Fl P Ar port 32.Op Fl p Ar port 33.Op Fl q Ar queue 34.Op Fl R Ar address 35.Op Fl T Ar tag 36.Op Fl t Ar timeout 37.Ek 38.Sh DESCRIPTION 39.Nm 40is a proxy for the Internet File Transfer Protocol. 41FTP control connections should be redirected into the proxy using the 42.Xr pf 4 43.Ar divert-to 44command, after which the proxy connects to the server on behalf of 45the client. 46.Pp 47The proxy allows data connections to pass, rewriting and redirecting 48them so that the right addresses are used. 49All connections from the client to the server have their source 50address rewritten so they appear to come from the proxy. 51Consequently, all connections from the server to the proxy have 52their destination address rewritten, so they are redirected to the 53client. 54The proxy uses the 55.Xr pf 4 56.Ar anchor 57facility for this. 58.Pp 59Assuming the FTP control connection is from $client to $server, the 60proxy connected to the server using the $proxy source address, and 61$port is negotiated, then 62.Nm 63adds the following rules to the anchor. 64$server and $orig_server are the same unless 65.Fl R 66is used to force a different $server address for all connections. 67(These example rules use inet, but the proxy also supports inet6.) 68.Pp 69In case of active mode (PORT or EPRT): 70.Bd -literal -offset 2n 71pass in from $server to $proxy port $proxy_port \e 72 rdr-to $client port $port 73pass out from $server to $client port $port \e 74 nat-to $orig_server port $natport 75.Ed 76.Pp 77In case of passive mode (PASV or EPSV): 78.Bd -literal -offset 2n 79pass in from $client to $orig_server port $proxy_port \e 80 rdr-to $server port $port 81pass out from $client to $server port $port nat-to $proxy 82.Ed 83.Pp 84.Nm 85chroots to "/var/empty" and changes to user "_ftp_proxy" to drop privileges. 86.Pp 87The options are as follows: 88.Bl -tag -width Ds 89.It Fl 6 90IPv6 mode. 91The proxy will expect and use IPv6 addresses for all communication. 92Only the extended FTP modes EPSV and EPRT are allowed with IPv6. 93The proxy is in IPv4 mode by default. 94.It Fl A 95Only permit anonymous FTP connections. 96Either user "ftp" or user "anonymous" is allowed. 97.It Fl a Ar sourceaddr 98The proxy will use this as the source address for the control 99connection to a server, which is useful on machines with multiple 100interfaces. 101.It Fl b Ar address 102Address where the proxy will listen for redirected control connections. 103The default is 127.0.0.1, or ::1 in IPv6 mode. 104.It Fl D Ar level 105Debug level, ranging from 0 to 7. 106Higher is more verbose. 107The default is 5. 108(These levels correspond to the 109.Xr syslog 3 110levels.) 111.It Fl d 112Do not daemonize. 113The process will stay in the foreground, logging to standard error. 114.It Fl m Ar maxsessions 115Maximum number of concurrent FTP sessions. 116When the proxy reaches this limit, new connections are denied. 117The default is 100 sessions. 118The limit can be lowered to a minimum of 1, or raised to a maximum of 500. 119.It Fl P Ar port 120Fixed server port. 121Only used in combination with 122.Fl R . 123The default is port 21. 124.It Fl p Ar port 125Port where the proxy will listen for redirected connections. 126The default is port 8021. 127.It Fl q Ar queue 128Create rules with queue 129.Ar queue 130appended, so that data connections can be queued. 131.It Fl R Ar address 132Fixed server address, also known as reverse mode. 133The proxy will always connect to the same server, regardless of 134where the client wanted to connect to (before it was redirected). 135Use this option to proxy for a server behind NAT, or to forward all 136connections to another proxy. 137.It Fl r 138Rewrite sourceport to 20 in active mode to suit ancient clients that insist 139on this RFC property. 140.It Fl T Ar tag 141The filter rules will add tag 142.Ar tag 143to data connections, and will use match rules instead of pass ones. 144This way alternative rules that use the 145.Ar tagged 146keyword can be implemented following the 147.Nm 148anchor. 149These rules can use special 150.Xr pf 4 151features like route-to, reply-to, label, rtable, overload, etc. that 152.Nm 153does not implement itself. 154There must be a matching pass rule after the 155.Nm 156anchor or the data connections will be blocked. 157.It Fl t Ar timeout 158Number of seconds that the control connection can be idle, before the 159proxy will disconnect. 160The maximum is 86400 seconds, which is also the default. 161Do not set this too low, because the control connection is usually 162idle when large data transfers are taking place. 163.It Fl v 164Set the 'log' flag on pf rules committed by 165.Nm . 166Use twice to set the 'log all' flag. 167The pf rules do not log by default. 168.El 169.Sh CONFIGURATION 170To make use of the proxy, 171.Xr pf.conf 5 172needs the following rules. 173Adjust the rules as needed; depending on the rest of the ruleset, the 174last rule explicitly allowing FTP sessions from the proxy may not be 175necessary. 176.Bd -literal -offset 2n 177anchor "ftp-proxy/*" 178pass in quick proto tcp to port ftp divert-to 127.0.0.1 port 8021 179pass out inet proto tcp from (self) to any port ftp 180.Ed 181.Sh SEE ALSO 182.Xr ftp 1 , 183.Xr pf 4 , 184.Xr pf.conf 5 185.Sh CAVEATS 186.Xr pf 4 187does not allow the ruleset to be modified if the system is running at a 188.Xr securelevel 7 189higher than 1. 190At that level 191.Nm 192cannot add rules to the anchors and FTP data connections may get blocked. 193.Pp 194Negotiated data connection ports below 1024 are not allowed. 195.Pp 196The negotiated IP address for active modes is ignored for security 197reasons. 198This makes third party file transfers impossible. 199.Pp 200Since 201.Nm 202acts as a man-in-the-middle, it breaks explicit FTP TLS connections (RFC 4217). 203