1*67ecd4f3SMax Laier.\" $OpenBSD: tftp-proxy.8,v 1.1 2005/12/28 19:07:07 jcs Exp $ 2*67ecd4f3SMax Laier.\" 3*67ecd4f3SMax Laier.\" Copyright (c) 2005 joshua stein <jcs@openbsd.org> 4*67ecd4f3SMax Laier.\" 5*67ecd4f3SMax Laier.\" Redistribution and use in source and binary forms, with or without 6*67ecd4f3SMax Laier.\" modification, are permitted provided that the following conditions 7*67ecd4f3SMax Laier.\" are met: 8*67ecd4f3SMax Laier.\" 9*67ecd4f3SMax Laier.\" 1. Redistributions of source code must retain the above copyright 10*67ecd4f3SMax Laier.\" notice, this list of conditions and the following disclaimer. 11*67ecd4f3SMax Laier.\" 2. Redistributions in binary form must reproduce the above copyright 12*67ecd4f3SMax Laier.\" notice, this list of conditions and the following disclaimer in the 13*67ecd4f3SMax Laier.\" documentation and/or other materials provided with the distribution. 14*67ecd4f3SMax Laier.\" 3. The name of the author may not be used to endorse or promote products 15*67ecd4f3SMax Laier.\" derived from this software without specific prior written permission. 16*67ecd4f3SMax Laier.\" 17*67ecd4f3SMax Laier.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18*67ecd4f3SMax Laier.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19*67ecd4f3SMax Laier.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20*67ecd4f3SMax Laier.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21*67ecd4f3SMax Laier.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22*67ecd4f3SMax Laier.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23*67ecd4f3SMax Laier.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24*67ecd4f3SMax Laier.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25*67ecd4f3SMax Laier.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26*67ecd4f3SMax Laier.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27*67ecd4f3SMax Laier.\" 28*67ecd4f3SMax Laier.Dd November 28, 2005 29*67ecd4f3SMax Laier.Dt TFTP-PROXY 8 30*67ecd4f3SMax Laier.Os 31*67ecd4f3SMax Laier.Sh NAME 32*67ecd4f3SMax Laier.Nm tftp-proxy 33*67ecd4f3SMax Laier.Nd Internet Trivial File Transfer Protocol proxy 34*67ecd4f3SMax Laier.Sh SYNOPSIS 35*67ecd4f3SMax Laier.Nm tftp-proxy 36*67ecd4f3SMax Laier.Op Fl v 37*67ecd4f3SMax Laier.Op Fl w Ar transwait 38*67ecd4f3SMax Laier.Sh DESCRIPTION 39*67ecd4f3SMax Laier.Nm 40*67ecd4f3SMax Laieris a proxy for the Internet Trivial File Transfer Protocol invoked by 41*67ecd4f3SMax Laierthe 42*67ecd4f3SMax Laier.Xr inetd 8 43*67ecd4f3SMax Laierinternet server. 44*67ecd4f3SMax LaierTFTP connections should be redirected to the proxy using the 45*67ecd4f3SMax Laier.Xr pf 4 46*67ecd4f3SMax Laier.Ar rdr 47*67ecd4f3SMax Laiercommand, after which the proxy connects to the server on behalf of 48*67ecd4f3SMax Laierthe client. 49*67ecd4f3SMax Laier.Pp 50*67ecd4f3SMax LaierThe proxy establishes a 51*67ecd4f3SMax Laier.Xr pf 4 52*67ecd4f3SMax Laier.Ar rdr 53*67ecd4f3SMax Laierrule using the 54*67ecd4f3SMax Laier.Ar anchor 55*67ecd4f3SMax Laierfacility to rewrite packets between the client and the server. 56*67ecd4f3SMax LaierOnce the rule is established, 57*67ecd4f3SMax Laier.Nm 58*67ecd4f3SMax Laierforwards the initial request from the client to the server to begin the 59*67ecd4f3SMax Laiertransfer. 60*67ecd4f3SMax LaierAfter 61*67ecd4f3SMax Laier.Ar transwait 62*67ecd4f3SMax Laierseconds, the 63*67ecd4f3SMax Laier.Xr pf 4 64*67ecd4f3SMax LaierNAT state is assumed to have been established and the 65*67ecd4f3SMax Laier.Ar rdr 66*67ecd4f3SMax Laierrule is deleted and the program exits. 67*67ecd4f3SMax LaierOnce the transfer between the client and the server is completed, the 68*67ecd4f3SMax LaierNAT state will naturally expire. 69*67ecd4f3SMax Laier.Pp 70*67ecd4f3SMax LaierAssuming the TFTP command request is from $client to $server, the 71*67ecd4f3SMax Laierproxy connected to the server using the $proxy source address, and 72*67ecd4f3SMax Laier$port is negotiated, 73*67ecd4f3SMax Laier.Nm 74*67ecd4f3SMax Laieradds the following rule to the anchor: 75*67ecd4f3SMax Laier.Bd -literal -offset indent 76*67ecd4f3SMax Laierrdr proto udp from $server to $proxy port $port -\*(Gt $client 77*67ecd4f3SMax Laier.Ed 78*67ecd4f3SMax Laier.Pp 79*67ecd4f3SMax LaierThe options are as follows: 80*67ecd4f3SMax Laier.Bl -tag -width Ds 81*67ecd4f3SMax Laier.It Fl v 82*67ecd4f3SMax LaierLog the connection and request information to 83*67ecd4f3SMax Laier.Xr syslogd 8 . 84*67ecd4f3SMax Laier.It Fl w Ar transwait 85*67ecd4f3SMax LaierNumber of seconds to wait for the data transmission to begin before 86*67ecd4f3SMax Laierremoving the 87*67ecd4f3SMax Laier.Xr pf 4 88*67ecd4f3SMax Laier.Ar rdr 89*67ecd4f3SMax Laierrule. 90*67ecd4f3SMax LaierThe default is 2 seconds. 91*67ecd4f3SMax Laier.El 92*67ecd4f3SMax Laier.Sh CONFIGURATION 93*67ecd4f3SMax LaierTo make use of the proxy, 94*67ecd4f3SMax Laier.Xr pf.conf 5 95*67ecd4f3SMax Laierneeds the following rules. 96*67ecd4f3SMax LaierThe anchors are mandatory. 97*67ecd4f3SMax LaierAdjust the rules as needed for your configuration. 98*67ecd4f3SMax Laier.Pp 99*67ecd4f3SMax LaierIn the NAT section: 100*67ecd4f3SMax Laier.Bd -literal -offset indent 101*67ecd4f3SMax Laiernat on $ext_if from $int_if -\*(Gt ($ext_if:0) 102*67ecd4f3SMax Laier 103*67ecd4f3SMax Laierno nat on $ext_if to port tftp 104*67ecd4f3SMax Laier 105*67ecd4f3SMax Laierrdr-anchor "tftp-proxy/*" 106*67ecd4f3SMax Laierrdr on $int_if proto udp from $lan to any port tftp -\*(Gt \e 107*67ecd4f3SMax Laier 127.0.0.1 port 6969 108*67ecd4f3SMax Laier.Ed 109*67ecd4f3SMax Laier.Pp 110*67ecd4f3SMax LaierIn the filter section, an anchor must be added to hold the pass rules: 111*67ecd4f3SMax Laier.Bd -literal -offset indent 112*67ecd4f3SMax Laieranchor "tftp-proxy/*" 113*67ecd4f3SMax Laier.Ed 114*67ecd4f3SMax Laier.Pp 115*67ecd4f3SMax Laier.Xr inetd 8 116*67ecd4f3SMax Laiermust be configured to spawn the proxy on the port that packets are 117*67ecd4f3SMax Laierbeing forwarded to by 118*67ecd4f3SMax Laier.Xr pf 4 . 119*67ecd4f3SMax LaierAn example 120*67ecd4f3SMax Laier.Xr inetd.conf 5 121*67ecd4f3SMax Laierentry follows: 122*67ecd4f3SMax Laier.Bd -literal -offset indent 123*67ecd4f3SMax Laier127.0.0.1:6969 dgram udp wait root \e 124*67ecd4f3SMax Laier /usr/libexec/tftp-proxy tftp-proxy 125*67ecd4f3SMax Laier.Ed 126*67ecd4f3SMax Laier.Sh SEE ALSO 127*67ecd4f3SMax Laier.Xr tftp 1 , 128*67ecd4f3SMax Laier.Xr pf 4 , 129*67ecd4f3SMax Laier.Xr pf.conf 5 , 130*67ecd4f3SMax Laier.Xr ftp-proxy 8 , 131*67ecd4f3SMax Laier.Xr inetd 8 , 132*67ecd4f3SMax Laier.Xr syslogd 8 , 133*67ecd4f3SMax Laier.Xr tftpd 8 134*67ecd4f3SMax Laier.Sh CAVEATS 135*67ecd4f3SMax Laier.Nm 136*67ecd4f3SMax Laierchroots to 137*67ecd4f3SMax Laier.Pa /var/empty 138*67ecd4f3SMax Laierand changes to user 139*67ecd4f3SMax Laier.Dq proxy 140*67ecd4f3SMax Laierto drop privileges. 141