1.\" $NetBSD: tftp-proxy.8,v 1.4 2009/03/22 14:29:35 perry Exp $ 2.\" $OpenBSD: tftp-proxy.8,v 1.2 2007/05/31 19:19:41 jmc Exp $ 3.\" 4.\" Copyright (c) 2005 joshua stein <jcs@openbsd.org> 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. The name of the author may not be used to endorse or promote products 16.\" derived from this software without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28.\" 29.Dd May 31, 2007 30.Dt TFTP-PROXY 8 31.Os 32.Sh NAME 33.Nm tftp-proxy 34.Nd Internet Trivial File Transfer Protocol proxy 35.Sh SYNOPSIS 36.Nm tftp-proxy 37.Op Fl v 38.Op Fl w Ar transwait 39.Sh DESCRIPTION 40.Nm 41is a proxy for the Internet Trivial File Transfer Protocol invoked by 42the 43.Xr inetd 8 44internet server. 45TFTP connections should be redirected to the proxy using the 46.Xr pf 4 47.Ar rdr 48command, after which the proxy connects to the server on behalf of 49the client. 50.Pp 51The proxy establishes a 52.Xr pf 4 53.Ar rdr 54rule using the 55.Ar anchor 56facility to rewrite packets between the client and the server. 57Once the rule is established, 58.Nm 59forwards the initial request from the client to the server to begin the 60transfer. 61After 62.Ar transwait 63seconds, the 64.Xr pf 4 65NAT state is assumed to have been established and the 66.Ar rdr 67rule is deleted and the program exits. 68Once the transfer between the client and the server is completed, the 69NAT state will naturally expire. 70.Pp 71Assuming the TFTP command request is from $client to $server, the 72proxy connected to the server using the $proxy source address, and 73$port is negotiated, 74.Nm 75adds the following rule to the anchor: 76.Bd -literal -offset indent 77rdr proto udp from $server to $proxy port $port -\*(Gt $client 78.Ed 79.Pp 80The options are as follows: 81.Bl -tag -width Ds 82.It Fl v 83Log the connection and request information to 84.Xr syslogd 8 . 85.It Fl w Ar transwait 86Number of seconds to wait for the data transmission to begin before 87removing the 88.Xr pf 4 89.Ar rdr 90rule. 91The default is 2 seconds. 92.El 93.Sh CONFIGURATION 94To make use of the proxy, 95.Xr pf.conf 5 96needs the following rules. 97The anchors are mandatory. 98Adjust the rules as needed for your configuration. 99.Pp 100In the NAT section: 101.Bd -literal -offset indent 102nat on $ext_if from $int_if -\*(Gt ($ext_if:0) 103 104no nat on $ext_if to port tftp 105 106rdr-anchor "tftp-proxy/*" 107rdr on $int_if proto udp from $lan to any port tftp -\*(Gt \e 108 127.0.0.1 port 6969 109.Ed 110.Pp 111In the filter section, an anchor must be added to hold the pass rules: 112.Bd -literal -offset indent 113anchor "tftp-proxy/*" 114.Ed 115.Pp 116.Xr inetd 8 117must be configured to spawn the proxy on the port that packets are 118being forwarded to by 119.Xr pf 4 . 120An example 121.Xr inetd.conf 5 122entry follows: 123.Bd -literal -offset indent 124127.0.0.1:6969 dgram udp wait root \e 125 /usr/libexec/tftp-proxy tftp-proxy 126.Ed 127.Sh SEE ALSO 128.Xr tftp 1 , 129.Xr pf 4 , 130.Xr pf.conf 5 , 131.Xr ftp-proxy 8 , 132.Xr inetd 8 , 133.Xr syslogd 8 , 134.Xr tftpd 8 135.Sh CAVEATS 136.Nm 137chroots to 138.Pa /var/chroot/tftp-proxy 139and changes to user 140.Dq _proxy 141to drop privileges. 142