xref: /netbsd-src/sys/external/bsd/ipf/netinet/ip_ftp_pxy.c (revision 51c5f9b7c2b2cc93506078d2cab158634a65201f)
1 /*	$NetBSD: ip_ftp_pxy.c,v 1.4 2012/07/30 19:27:46 pgoyette Exp $	*/
2 
3 /*
4  * Copyright (C) 2012 by Darren Reed.
5  *
6  * See the IPFILTER.LICENCE file for details on licencing.
7  *
8  * Simple FTP transparent proxy for in-kernel use.  For use with the NAT
9  * code.
10  *
11  * Id: ip_ftp_pxy.c,v 1.1.1.2 2012/07/22 13:45:18 darrenr Exp
12  */
13 
14 #include <sys/cdefs.h>
15 __KERNEL_RCSID(1, "$NetBSD: ip_ftp_pxy.c,v 1.4 2012/07/30 19:27:46 pgoyette Exp $");
16 
17 #define	IPF_FTP_PROXY
18 
19 #define	IPF_MINPORTLEN	18
20 #define	IPF_MINEPRTLEN	20
21 #define	IPF_MAXPORTLEN	30
22 #define	IPF_MIN227LEN	39
23 #define	IPF_MAX227LEN	51
24 #define	IPF_MIN229LEN	47
25 #define	IPF_MAX229LEN	51
26 
27 #define	FTPXY_GO	0
28 #define	FTPXY_INIT	1
29 #define	FTPXY_USER_1	2
30 #define	FTPXY_USOK_1	3
31 #define	FTPXY_PASS_1	4
32 #define	FTPXY_PAOK_1	5
33 #define	FTPXY_AUTH_1	6
34 #define	FTPXY_AUOK_1	7
35 #define	FTPXY_ADAT_1	8
36 #define	FTPXY_ADOK_1	9
37 #define	FTPXY_ACCT_1	10
38 #define	FTPXY_ACOK_1	11
39 #define	FTPXY_USER_2	12
40 #define	FTPXY_USOK_2	13
41 #define	FTPXY_PASS_2	14
42 #define	FTPXY_PAOK_2	15
43 
44 #define	FTPXY_JUNK_OK	0
45 #define	FTPXY_JUNK_BAD	1	/* Ignore all commands for this connection */
46 #define	FTPXY_JUNK_EOL	2	/* consume the rest of this line only */
47 #define	FTPXY_JUNK_CONT	3	/* Saerching for next numeric */
48 
49 /*
50  * Values for FTP commands.  Numerics cover 0-999
51  */
52 #define	FTPXY_C_PASV	1000
53 #define	FTPXY_C_PORT	1001
54 #define	FTPXY_C_EPSV	1002
55 #define	FTPXY_C_EPRT	1003
56 
57 
58 typedef struct ipf_ftp_softc_s {
59 	int	ipf_p_ftp_pasvonly;
60 	/* Do not require logins before transfers */
61 	int	ipf_p_ftp_insecure;
62 	int	ipf_p_ftp_pasvrdr;
63 	/* PASV must be last command prior to 227 */
64 	int	ipf_p_ftp_forcepasv;
65 	int	ipf_p_ftp_debug;
66 	int	ipf_p_ftp_single_xfer;
67 	void	*ipf_p_ftp_tune;
68 } ipf_ftp_softc_t;
69 
70 
71 void ipf_p_ftp_main_load(void);
72 void ipf_p_ftp_main_unload(void);
73 void *ipf_p_ftp_soft_create(ipf_main_softc_t *);
74 void ipf_p_ftp_soft_destroy(ipf_main_softc_t *, void *);
75 
76 int ipf_p_ftp_client(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
77 			  ftpinfo_t *, int);
78 int ipf_p_ftp_complete(char *, size_t);
79 int ipf_p_ftp_in(void *, fr_info_t *, ap_session_t *, nat_t *);
80 int ipf_p_ftp_new(void *, fr_info_t *, ap_session_t *, nat_t *);
81 void ipf_p_ftp_del(ipf_main_softc_t *, ap_session_t *);
82 int ipf_p_ftp_out(void *, fr_info_t *, ap_session_t *, nat_t *);
83 int ipf_p_ftp_pasv(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
84 			ftpinfo_t *, int);
85 int ipf_p_ftp_epsv(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
86 			ftpinfo_t *, int);
87 int ipf_p_ftp_port(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
88 			ftpinfo_t *, int);
89 int ipf_p_ftp_process(ipf_ftp_softc_t *, fr_info_t *, nat_t *,
90 			   ftpinfo_t *, int);
91 int ipf_p_ftp_server(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
92 			  ftpinfo_t *, int);
93 int ipf_p_ftp_valid(ipf_ftp_softc_t *, ftpinfo_t *, int, char *, size_t);
94 int ipf_p_ftp_server_valid(ipf_ftp_softc_t *, ftpside_t *, char *,
95 				size_t);
96 int ipf_p_ftp_client_valid(ipf_ftp_softc_t *, ftpside_t *, char *,
97 				size_t);
98 u_short ipf_p_ftp_atoi(char **);
99 int ipf_p_ftp_pasvreply(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
100 			     ftpinfo_t *, u_int, char *, char *);
101 int ipf_p_ftp_eprt(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
102 			ftpinfo_t *, int);
103 int ipf_p_ftp_eprt4(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
104 			 ftpinfo_t *, int);
105 int ipf_p_ftp_eprt6(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
106 			 ftpinfo_t *, int);
107 int ipf_p_ftp_addport(ipf_ftp_softc_t *, fr_info_t *, ip_t *, nat_t *,
108 			   ftpinfo_t *, int, int, int);
109 void ipf_p_ftp_setpending(ipf_main_softc_t *, ftpinfo_t *);
110 
111 /*
112  * Debug levels
113  */
114 #define	DEBUG_SECURITY		0x01
115 #define	DEBUG_ERROR		0x02
116 #define	DEBUG_INFO		0x04
117 #define	DEBUG_PARSE_ERR		0x08
118 #define	DEBUG_PARSE_INFO	0x10
119 #define	DEBUG_PARSE		0x20
120 
121 static	int	ipf_p_ftp_proxy_init = 0;
122 static	frentry_t	ftppxyfr;
123 static	ipftuneable_t	ipf_ftp_tuneables[] = {
124 	{ { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_debug) },
125 		"ftp_debug",	0,	0x7f,
126 		stsizeof(ipf_ftp_softc_t, ipf_p_ftp_debug),
127 		0, NULL, NULL },
128 	{ { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_pasvonly) },
129 		"ftp_pasvonly",	0,	1,
130 		stsizeof(ipf_ftp_softc_t, ipf_p_ftp_pasvonly),
131 		0, NULL, NULL },
132 	{ { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_insecure) },
133 		"ftp_insecure",	0,	1,
134 		stsizeof(ipf_ftp_softc_t, ipf_p_ftp_insecure),
135 		0, NULL, NULL },
136 	{ { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_pasvrdr) },
137 		"ftp_pasvrdr",	0,	1,
138 		stsizeof(ipf_ftp_softc_t, ipf_p_ftp_pasvrdr),
139 		0, NULL, NULL },
140 	{ { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_forcepasv) },
141 		"ftp_forcepasv", 0,	1,
142 		stsizeof(ipf_ftp_softc_t, ipf_p_ftp_forcepasv),
143 		0, NULL, NULL },
144 	{ { (void *)offsetof(ipf_ftp_softc_t, ipf_p_ftp_single_xfer) },
145 		"ftp_single_xfer", 0,	1,
146 		stsizeof(ipf_ftp_softc_t, ipf_p_ftp_single_xfer),
147 		0, NULL, NULL },
148 	{ { NULL }, NULL, 0, 0, 0, 0, NULL, NULL }
149 };
150 
151 
152 void
153 ipf_p_ftp_main_load(void)
154 {
155 	bzero((char *)&ftppxyfr, sizeof(ftppxyfr));
156 	ftppxyfr.fr_ref = 1;
157 	ftppxyfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
158 
159 	MUTEX_INIT(&ftppxyfr.fr_lock, "FTP Proxy Mutex");
160 	ipf_p_ftp_proxy_init = 1;
161 }
162 
163 
164 void
165 ipf_p_ftp_main_unload(void)
166 {
167 
168 	if (ipf_p_ftp_proxy_init == 1) {
169 		MUTEX_DESTROY(&ftppxyfr.fr_lock);
170 		ipf_p_ftp_proxy_init = 0;
171 	}
172 }
173 
174 
175 /*
176  * Initialize local structures.
177  */
178 void *
179 ipf_p_ftp_soft_create(ipf_main_softc_t *softc)
180 {
181 	ipf_ftp_softc_t *softf;
182 
183 	KMALLOC(softf, ipf_ftp_softc_t *);
184 	if (softf == NULL)
185 		return NULL;
186 
187 	bzero((char *)softf, sizeof(*softf));
188 #if defined(_KERNEL)
189 	softf->ipf_p_ftp_debug = 0;
190 #else
191 	softf->ipf_p_ftp_debug = DEBUG_PARSE_ERR;
192 #endif
193 	softf->ipf_p_ftp_forcepasv = 1;
194 
195 	softf->ipf_p_ftp_tune = ipf_tune_array_copy(softf,
196 						    sizeof(ipf_ftp_tuneables),
197 						    ipf_ftp_tuneables);
198 	if (softf->ipf_p_ftp_tune == NULL) {
199 		ipf_p_ftp_soft_destroy(softc, softf);
200 		return NULL;
201 	}
202 	if (ipf_tune_array_link(softc, softf->ipf_p_ftp_tune) == -1) {
203 		ipf_p_ftp_soft_destroy(softc, softf);
204 		return NULL;
205 	}
206 
207 	return softf;
208 }
209 
210 
211 void
212 ipf_p_ftp_soft_destroy(ipf_main_softc_t *softc, void *arg)
213 {
214 	ipf_ftp_softc_t *softf = arg;
215 
216 	if (softf->ipf_p_ftp_tune != NULL) {
217 		ipf_tune_array_unlink(softc, softf->ipf_p_ftp_tune);
218 		KFREES(softf->ipf_p_ftp_tune, sizeof(ipf_ftp_tuneables));
219 		softf->ipf_p_ftp_tune = NULL;
220 	}
221 
222 	KFREE(softf);
223 }
224 
225 
226 int
227 ipf_p_ftp_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
228 {
229 	ftpinfo_t *ftp;
230 	ftpside_t *f;
231 
232 	KMALLOC(ftp, ftpinfo_t *);
233 	if (ftp == NULL)
234 		return -1;
235 
236 	nat = nat;	/* LINT */
237 
238 	aps->aps_data = ftp;
239 	aps->aps_psiz = sizeof(ftpinfo_t);
240 	aps->aps_sport = htons(fin->fin_sport);
241 	aps->aps_dport = htons(fin->fin_dport);
242 
243 	bzero((char *)ftp, sizeof(*ftp));
244 	f = &ftp->ftp_side[0];
245 	f->ftps_rptr = f->ftps_buf;
246 	f->ftps_wptr = f->ftps_buf;
247 	f = &ftp->ftp_side[1];
248 	f->ftps_rptr = f->ftps_buf;
249 	f->ftps_wptr = f->ftps_buf;
250 	ftp->ftp_passok = FTPXY_INIT;
251 	ftp->ftp_incok = 0;
252 	return 0;
253 }
254 
255 
256 void
257 ipf_p_ftp_setpending(ipf_main_softc_t *softc, ftpinfo_t *ftp)
258 {
259 	if (ftp->ftp_pendnat != NULL)
260 		ipf_nat_setpending(softc, ftp->ftp_pendnat);
261 
262 	if (ftp->ftp_pendstate != NULL) {
263 		READ_ENTER(&softc->ipf_state);
264 		ipf_state_setpending(softc, ftp->ftp_pendstate);
265 		RWLOCK_EXIT(&softc->ipf_state);
266 	}
267 }
268 
269 
270 void
271 ipf_p_ftp_del(ipf_main_softc_t *softc, ap_session_t *aps)
272 {
273 	ftpinfo_t *ftp;
274 
275 	ftp = aps->aps_data;
276 	if (ftp != NULL)
277 		ipf_p_ftp_setpending(softc, ftp);
278 }
279 
280 
281 int
282 ipf_p_ftp_port(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
283     ftpinfo_t *ftp, int dlen)
284 {
285 	char newbuf[IPF_FTPBUFSZ], *s;
286 	u_int a1, a2, a3, a4;
287 	u_short a5, a6, sp;
288 	size_t nlen, olen;
289 	tcphdr_t *tcp;
290 	int inc, off;
291 	ftpside_t *f;
292 	mb_t *m;
293 
294 	m = fin->fin_m;
295 	f = &ftp->ftp_side[0];
296 	tcp = (tcphdr_t *)fin->fin_dp;
297 	off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
298 
299 	/*
300 	 * Check for client sending out PORT message.
301 	 */
302 	if (dlen < IPF_MINPORTLEN) {
303 		DT3(ftp_PORT_error_dlen, nat_t *, nat, ftpside_t *, f,
304 		    u_int, dlen);
305 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE)
306 			printf("ipf_p_ftp_port:dlen(%d) < IPF_MINPORTLEN\n",
307 			       dlen);
308 		return 0;
309 	}
310 	/*
311 	 * Skip the PORT command + space
312 	 */
313 	s = f->ftps_rptr + 5;
314 	/*
315 	 * Pick out the address components, two at a time.
316 	 */
317 	a1 = ipf_p_ftp_atoi(&s);
318 	if (s == NULL) {
319 		DT2(ftp_PORT_error_atoi_1, nat_t *, nat, ftpside_t *, f);
320 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
321 			printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 1);
322 		return 0;
323 	}
324 	a2 = ipf_p_ftp_atoi(&s);
325 	if (s == NULL) {
326 		DT2(ftp_PORT_error_atoi_2, nat_t *, nat, ftpside_t *, f);
327 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
328 			printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 2);
329 		return 0;
330 	}
331 
332 	/*
333 	 * Check that IP address in the PORT/PASV reply is the same as the
334 	 * sender of the command - prevents using PORT for port scanning.
335 	 */
336 	a1 <<= 16;
337 	a1 |= a2;
338 	if (((nat->nat_dir == NAT_OUTBOUND) &&
339 	     (a1 != ntohl(nat->nat_osrcaddr))) ||
340 	    ((nat->nat_dir == NAT_INBOUND) &&
341 	     (a1 != ntohl(nat->nat_nsrcaddr)))) {
342 		DT3(ftp_PORT_error_address, nat_t *, nat, ftpside_t *, f,
343 		    u_int, a1);
344 		if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
345 			printf("ipf_p_ftp_port:%s != nat->nat_inip\n", "a1");
346 		return APR_ERR(1);
347 	}
348 
349 	a5 = ipf_p_ftp_atoi(&s);
350 	if (s == NULL) {
351 		DT2(ftp_PORT_error_atoi_3, nat_t *, nat, ftpside_t *, f);
352 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
353 			printf("ipf_p_ftp_port:ipf_p_ftp_atoi(%d) failed\n", 3);
354 		return 0;
355 	}
356 	if (*s == ')')
357 		s++;
358 
359 	/*
360 	 * check for CR-LF at the end.
361 	 */
362 	if (*s == '\n')
363 		s--;
364 	if ((*s != '\r') || (*(s + 1) != '\n')) {
365 		DT2(ftp_PORT_error_no_crlf, nat_t *, nat, ftpside_t *, f);
366 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
367 			printf("ipf_p_ftp_port:missing %s\n", "cr-lf");
368 		return 0;
369 	}
370 	s += 2;
371 	a6 = a5 & 0xff;
372 
373 	/*
374 	 * Calculate the source port. Verification of > 1024 is in
375 	 * ipf_p_ftp_addport.
376 	 */
377 	a5 >>= 8;
378 	a5 &= 0xff;
379 	sp = a5 << 8 | a6;
380 
381 	/*
382 	 * Calculate new address parts for PORT command
383 	 */
384 	if (nat->nat_dir == NAT_INBOUND)
385 		a1 = ntohl(nat->nat_ndstaddr);
386 	else
387 		a1 = ntohl(ip->ip_src.s_addr);
388 	a1 = ntohl(ip->ip_src.s_addr);
389 	a2 = (a1 >> 16) & 0xff;
390 	a3 = (a1 >> 8) & 0xff;
391 	a4 = a1 & 0xff;
392 	a1 >>= 24;
393 	olen = s - f->ftps_rptr;
394 	/* DO NOT change this to snprintf! */
395 #if defined(SNPRINTF) && defined(_KERNEL)
396 	SNPRINTF(newbuf, sizeof(newbuf), "%s %u,%u,%u,%u,%u,%u\r\n",
397 		 "PORT", a1, a2, a3, a4, a5, a6);
398 #else
399 	(void) sprintf(newbuf, "%s %u,%u,%u,%u,%u,%u\r\n",
400 		       "PORT", a1, a2, a3, a4, a5, a6);
401 #endif
402 
403 	nlen = strlen(newbuf);
404 	inc = nlen - olen;
405 	if ((inc + fin->fin_plen) > 65535) {
406 		DT3(ftp_PORT_error_inc, nat_t *, nat, ftpside_t *, f,
407 		    int, inc);
408 		if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
409 			printf("ipf_p_ftp_port:inc(%d) + ip->ip_len > 65535\n",
410 			       inc);
411 		return 0;
412 	}
413 
414 #if !defined(_KERNEL)
415 	M_ADJ(m, inc);
416 #else
417 	/*
418 	 * m_adj takes care of pkthdr.len, if required and treats inc<0 to
419 	 * mean remove -len bytes from the end of the packet.
420 	 * The mbuf chain will be extended if necessary by m_copyback().
421 	 */
422 	if (inc < 0)
423 		M_ADJ(m, inc);
424 #endif /* !defined(_KERNEL) */
425 	COPYBACK(m, off, nlen, newbuf);
426 	fin->fin_flx |= FI_DOCKSUM;
427 
428 	if (inc != 0) {
429 		fin->fin_plen += inc;
430 		ip->ip_len = htons(fin->fin_plen);
431 		fin->fin_dlen += inc;
432 	}
433 
434 	f->ftps_cmd = FTPXY_C_PORT;
435 	return ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, sp, inc);
436 }
437 
438 
439 int
440 ipf_p_ftp_addport(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
441     ftpinfo_t *ftp, int dlen, int nport, int inc)
442 {
443 	tcphdr_t tcph, *tcp2 = &tcph;
444 	ipf_main_softc_t *softc;
445 	ipf_nat_softc_t *softn;
446 	int direction;
447 	fr_info_t fi;
448 	ipnat_t *ipn;
449 	nat_t *nat2;
450 	u_short sp;
451 	int flags;
452 
453 	softc = fin->fin_main_soft;
454 	softn = softc->ipf_nat_soft;
455 
456 	if ((ftp->ftp_pendnat != NULL)  || (ftp->ftp_pendstate != NULL)) {
457 		if (softf->ipf_p_ftp_single_xfer != 0) {
458 			DT2(ftp_PORT_error_add_active, nat_t *, nat,
459 			    ftpinfo_t *, ftp);
460 			if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
461 				printf("ipf_p_ftp_addport:xfer active %p/%p\n",
462 				       ftp->ftp_pendnat, ftp->ftp_pendstate);
463 			return 0;
464 		}
465 		ipf_p_ftp_setpending(softc, ftp);
466 	}
467 
468 	/*
469 	 * Add skeleton NAT entry for connection which will come back the
470 	 * other way.
471 	 */
472 	sp = nport;
473 	/*
474 	 * Don't allow the PORT command to specify a port < 1024 due to
475 	 * security risks.
476 	 */
477 	if (sp < 1024) {
478 		DT3(ftp_PORT_error_port, nat_t *, nat, ftpinfo_t *, ftp,
479 		    u_int, sp);
480 		if (softf->ipf_p_ftp_debug & DEBUG_SECURITY)
481 			printf("ipf_p_ftp_addport:sp(%d) < 1024\n", sp);
482 		return 0;
483 	}
484 	/*
485 	 * The server may not make the connection back from port 20, but
486 	 * it is the most likely so use it here to check for a conflicting
487 	 * mapping.
488 	 */
489 	bcopy((char *)fin, (char *)&fi, sizeof(fi));
490 	fi.fin_flx |= FI_IGNORE;
491 	fi.fin_data[0] = sp;
492 	fi.fin_data[1] = fin->fin_data[1] - 1;
493 	fi.fin_src6 = nat->nat_ndst6;
494 	fi.fin_dst6 = nat->nat_nsrc6;
495 
496 	if (nat->nat_v[0] == 6) {
497 #ifndef USE_INET6
498 		return APR_INC(inc);
499 #endif
500 	}
501 
502 	/*
503 	 * Add skeleton NAT entry for connection which will come back the
504 	 * other way.
505 	 */
506 	if (nat->nat_v[0] == 6) {
507 #ifdef USE_INET6
508 		if (nat->nat_dir == NAT_OUTBOUND) {
509 			nat2 = ipf_nat6_outlookup(&fi, IPN_TCP|NAT_SEARCH,
510 						  nat->nat_pr[1],
511 						  &nat->nat_osrc6.in6,
512 						  &nat->nat_odst6.in6);
513 		} else {
514 			nat2 = ipf_nat6_inlookup(&fi, IPN_TCP|NAT_SEARCH,
515 						 nat->nat_pr[0],
516 						 &nat->nat_odst6.in6,
517 						 &nat->nat_osrc6.in6);
518 		}
519 #endif
520 	} else {
521 		if (nat->nat_dir == NAT_OUTBOUND) {
522 			nat2 = ipf_nat_outlookup(&fi, IPN_TCP|NAT_SEARCH,
523 						 nat->nat_pr[1],
524 						 nat->nat_osrcip,
525 						 nat->nat_odstip);
526 		} else {
527 			nat2 = ipf_nat_inlookup(&fi, IPN_TCP|NAT_SEARCH,
528 						nat->nat_pr[0],
529 						nat->nat_odstip,
530 						nat->nat_osrcip);
531 		}
532 	}
533 	if (nat2 != NULL)
534 		return APR_INC(inc);
535 
536 	ipn = ipf_proxy_rule_rev(nat);
537 	if (ipn == NULL)
538 		return APR_ERR(1);
539 	ipn->in_use = 0;
540 
541 	fi.fin_fr = &ftppxyfr;
542 	fi.fin_dp = (char *)tcp2;
543 	fi.fin_dlen = sizeof(*tcp2);
544 	fi.fin_plen = fi.fin_hlen + sizeof(*tcp2);
545 	fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE;
546 	fi.fin_data[1] = sp;
547 	fi.fin_data[0] = 0;
548 
549 	bzero((char *)tcp2, sizeof(*tcp2));
550 	tcp2->th_sport = 0;
551 	tcp2->th_dport = htons(sp);
552 
553 	tcp2->th_win = htons(8192);
554 	TCP_OFF_A(tcp2, 5);
555 	tcp2->th_flags = TH_SYN;
556 
557 	if (nat->nat_dir == NAT_INBOUND) {
558 		fi.fin_out = 1;
559 		direction = NAT_OUTBOUND;
560 	} else {
561 		fi.fin_out = 0;
562 		direction = NAT_INBOUND;
563 	}
564 	flags = SI_W_SPORT|NAT_SLAVE|IPN_TCP;
565 
566 	MUTEX_ENTER(&softn->ipf_nat_new);
567 	if (nat->nat_v[0] == 6) {
568 #ifdef USE_INET6
569 		nat2 = ipf_nat6_add(&fi, ipn, &ftp->ftp_pendnat, flags,
570 				    direction);
571 #endif
572 	} else {
573 		nat2 = ipf_nat_add(&fi, ipn, &ftp->ftp_pendnat, flags,
574 				   direction);
575 	}
576 	MUTEX_EXIT(&softn->ipf_nat_new);
577 
578 	if (nat2 == NULL) {
579 		KFREES(ipn, ipn->in_size);
580 		return APR_ERR(1);
581 	}
582 
583 	(void) ipf_nat_proto(&fi, nat2, IPN_TCP);
584 	MUTEX_ENTER(&nat2->nat_lock);
585 	ipf_nat_update(&fi, nat2);
586 	MUTEX_EXIT(&nat2->nat_lock);
587 	fi.fin_ifp = NULL;
588 	if (nat2->nat_dir == NAT_INBOUND)
589 		fi.fin_dst6 = nat->nat_osrc6;
590 	if (ipf_state_add(softc, &fi, (ipstate_t **)&ftp->ftp_pendstate,
591 			  SI_W_SPORT) != 0)
592 		ipf_nat_setpending(softc, nat2);
593 
594 	return APR_INC(inc);
595 }
596 
597 
598 int
599 ipf_p_ftp_client(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
600     ftpinfo_t *ftp, int dlen)
601 {
602 	char *rptr, *wptr, cmd[6], c;
603 	ftpside_t *f;
604 	int inc, i;
605 
606 	inc = 0;
607 	f = &ftp->ftp_side[0];
608 	rptr = f->ftps_rptr;
609 	wptr = f->ftps_wptr;
610 
611 	for (i = 0; (i < 5) && (i < dlen); i++) {
612 		c = rptr[i];
613 		if (ISALPHA(c)) {
614 			cmd[i] = TOUPPER(c);
615 		} else {
616 			cmd[i] = c;
617 		}
618 	}
619 	cmd[i] = '\0';
620 
621 	ftp->ftp_incok = 0;
622 	DT2(ftp_client_command, char [], cmd, int, ftp->ftp_passok);
623 	if (!strncmp(cmd, "USER ", 5) || !strncmp(cmd, "XAUT ", 5)) {
624 		if (ftp->ftp_passok == FTPXY_ADOK_1 ||
625 		    ftp->ftp_passok == FTPXY_AUOK_1) {
626 			ftp->ftp_passok = FTPXY_USER_2;
627 			ftp->ftp_incok = 1;
628 		} else {
629 			ftp->ftp_passok = FTPXY_USER_1;
630 			ftp->ftp_incok = 1;
631 		}
632 	} else if (!strncmp(cmd, "AUTH ", 5)) {
633 		ftp->ftp_passok = FTPXY_AUTH_1;
634 		ftp->ftp_incok = 1;
635 	} else if (!strncmp(cmd, "PASS ", 5)) {
636 		if (ftp->ftp_passok == FTPXY_USOK_1) {
637 			ftp->ftp_passok = FTPXY_PASS_1;
638 			ftp->ftp_incok = 1;
639 		} else if (ftp->ftp_passok == FTPXY_USOK_2) {
640 			ftp->ftp_passok = FTPXY_PASS_2;
641 			ftp->ftp_incok = 1;
642 		}
643 	} else if ((ftp->ftp_passok == FTPXY_AUOK_1) &&
644 		   !strncmp(cmd, "ADAT ", 5)) {
645 		ftp->ftp_passok = FTPXY_ADAT_1;
646 		ftp->ftp_incok = 1;
647 	} else if ((ftp->ftp_passok == FTPXY_PAOK_1 ||
648 		    ftp->ftp_passok == FTPXY_PAOK_2) &&
649 		 !strncmp(cmd, "ACCT ", 5)) {
650 		ftp->ftp_passok = FTPXY_ACCT_1;
651 		ftp->ftp_incok = 1;
652 	} else if ((ftp->ftp_passok == FTPXY_GO) &&
653 		   !softf->ipf_p_ftp_pasvonly &&
654 		 !strncmp(cmd, "PORT ", 5)) {
655 		inc = ipf_p_ftp_port(softf, fin, ip, nat, ftp, dlen);
656 	} else if ((ftp->ftp_passok == FTPXY_GO) &&
657 		   !softf->ipf_p_ftp_pasvonly &&
658 		 !strncmp(cmd, "EPRT ", 5)) {
659 		inc = ipf_p_ftp_eprt(softf, fin, ip, nat, ftp, dlen);
660 	} else if (softf->ipf_p_ftp_insecure &&
661 		   !softf->ipf_p_ftp_pasvonly &&
662 		   !strncmp(cmd, "PORT ", 5)) {
663 		inc = ipf_p_ftp_port(softf, fin, ip, nat, ftp, dlen);
664 	}
665 	if (softf->ipf_p_ftp_debug & DEBUG_PARSE)
666 		printf("ipf_p_ftp_client: cmd[%s] passok %d incok %d inc %d\n",
667 		       cmd, ftp->ftp_passok, ftp->ftp_incok, inc);
668 
669 	DT2(ftp_client_passok, char *, cmd, int, ftp->ftp_passok);
670 	while ((*rptr++ != '\n') && (rptr < wptr))
671 		;
672 	f->ftps_rptr = rptr;
673 	return inc;
674 }
675 
676 
677 int
678 ipf_p_ftp_pasv(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
679     ftpinfo_t *ftp, int dlen)
680 {
681 	u_int a1, a2, a3, a4, data_ip;
682 	char newbuf[IPF_FTPBUFSZ];
683 	const char *brackets[2];
684 	u_short a5, a6;
685 	ftpside_t *f;
686 	char *s;
687 
688 	if ((softf->ipf_p_ftp_forcepasv != 0) &&
689 	    (ftp->ftp_side[0].ftps_cmd != FTPXY_C_PASV)) {
690 		DT2(ftp_PASV_error_state, nat_t *, nat, ftpinfo_t *, ftp);
691 		if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
692 			printf("ipf_p_ftp_pasv:ftps_cmd(%d) != FTPXY_C_PASV\n",
693 			       ftp->ftp_side[0].ftps_cmd);
694 		return 0;
695 	}
696 
697 	f = &ftp->ftp_side[1];
698 
699 #define	PASV_REPLEN	24
700 	/*
701 	 * Check for PASV reply message.
702 	 */
703 	if (dlen < IPF_MIN227LEN) {
704 		DT3(ftp_PASV_error_short, nat_t *, nat, ftpinfo_t *, ftp,
705 		    int, dlen);
706 		if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
707 			printf("ipf_p_ftp_pasv:dlen(%d) < IPF_MIN227LEN\n",
708 			       dlen);
709 		return 0;
710 	} else if (strncmp(f->ftps_rptr,
711 			   "227 Entering Passive Mod", PASV_REPLEN)) {
712 		DT2(ftp_PASV_error_string, nat_t *, nat, ftpinfo_t *, ftp);
713 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
714 			printf("ipf_p_ftp_pasv:%d reply wrong\n", 227);
715 		return 0;
716 	}
717 
718 	brackets[0] = "";
719 	brackets[1] = "";
720 	/*
721 	 * Skip the PASV reply + space
722 	 */
723 	s = f->ftps_rptr + PASV_REPLEN;
724 	while (*s && !ISDIGIT(*s)) {
725 		if (*s == '(') {
726 			brackets[0] = "(";
727 			brackets[1] = ")";
728 		}
729 		s++;
730 	}
731 
732 	/*
733 	 * Pick out the address components, two at a time.
734 	 */
735 	a1 = ipf_p_ftp_atoi(&s);
736 	if (s == NULL) {
737 		DT2(ftp_PASV_error_atoi_1, nat_t *, nat, ftpside_t *, f);
738 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
739 			printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 1);
740 		return 0;
741 	}
742 	a2 = ipf_p_ftp_atoi(&s);
743 	if (s == NULL) {
744 		DT2(ftp_PASV_error_atoi_2, nat_t *, nat, ftpside_t *, f);
745 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
746 			printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 2);
747 		return 0;
748 	}
749 
750 	/*
751 	 * check that IP address in the PASV reply is the same as the
752 	 * sender of the command - prevents using PASV for port scanning.
753 	 */
754 	a1 <<= 16;
755 	a1 |= a2;
756 
757 	if (((nat->nat_dir == NAT_INBOUND) &&
758 	     (a1 != ntohl(nat->nat_ndstaddr))) ||
759 	    ((nat->nat_dir == NAT_OUTBOUND) &&
760 	     (a1 != ntohl(nat->nat_odstaddr)))) {
761 		DT3(ftp_PASV_error_address, nat_t *, nat, ftpside_t *, f,
762 		    u_int, a1);
763 		if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
764 			printf("ipf_p_ftp_pasv:%s != nat->nat_oip\n", "a1");
765 		return 0;
766 	}
767 
768 	a5 = ipf_p_ftp_atoi(&s);
769 	if (s == NULL) {
770 		DT2(ftp_PASV_error_atoi_3, nat_t *, nat, ftpside_t *, f);
771 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
772 			printf("ipf_p_ftp_pasv:ipf_p_ftp_atoi(%d) failed\n", 3);
773 		return 0;
774 	}
775 
776 	if (*s == ')')
777 		s++;
778 	if (*s == '.')
779 		s++;
780 	if (*s == '\n')
781 		s--;
782 	/*
783 	 * check for CR-LF at the end.
784 	 */
785 	if ((*s != '\r') || (*(s + 1) != '\n')) {
786 		DT(pasv_missing_crlf);
787 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
788 			printf("ipf_p_ftp_pasv:missing %s", "cr-lf\n");
789 		return 0;
790 	}
791 	s += 2;
792 
793 	a6 = a5 & 0xff;
794 	a5 >>= 8;
795 	/*
796 	 * Calculate new address parts for 227 reply
797 	 */
798 	if (nat->nat_dir == NAT_INBOUND) {
799 		data_ip = nat->nat_odstaddr;
800 		a1 = ntohl(data_ip);
801 	} else
802 		data_ip = htonl(a1);
803 
804 	a2 = (a1 >> 16) & 0xff;
805 	a3 = (a1 >> 8) & 0xff;
806 	a4 = a1 & 0xff;
807 	a1 >>= 24;
808 
809 #if defined(SNPRINTF) && defined(_KERNEL)
810 	SNPRINTF(newbuf, sizeof(newbuf), "%s %s%u,%u,%u,%u,%u,%u%s\r\n",
811 		"227 Entering Passive Mode", brackets[0], a1, a2, a3, a4,
812 		a5, a6, brackets[1]);
813 #else
814 	(void) sprintf(newbuf, "%s %s%u,%u,%u,%u,%u,%u%s\r\n",
815 		"227 Entering Passive Mode", brackets[0], a1, a2, a3, a4,
816 		a5, a6, brackets[1]);
817 #endif
818 	return ipf_p_ftp_pasvreply(softf, fin, ip, nat, ftp, (a5 << 8 | a6),
819 				   newbuf, s);
820 }
821 
822 int
823 ipf_p_ftp_pasvreply(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip,
824 	nat_t *nat, ftpinfo_t *ftp, u_int port, char *newmsg, char *s)
825 {
826 	int inc, off, nflags;
827 	tcphdr_t *tcp, tcph, *tcp2;
828 	ipf_main_softc_t *softc;
829 	ipf_nat_softc_t *softn;
830 	size_t nlen, olen;
831 #ifdef USE_INET6
832 	ip6_t *ip6;
833 #endif
834 	ipnat_t *ipn;
835 	fr_info_t fi;
836 	ftpside_t *f;
837 	nat_t *nat2 = NULL;
838 	mb_t *m;
839 
840 	softc = fin->fin_main_soft;
841 	softn = softc->ipf_nat_soft;
842 
843 	if ((ftp->ftp_pendnat != NULL) || (ftp->ftp_pendstate != NULL))
844 		ipf_p_ftp_setpending(softc, ftp);
845 
846 	m = fin->fin_m;
847 	tcp = (tcphdr_t *)fin->fin_dp;
848 	off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
849 
850 	tcp2 = &tcph;
851 	inc = 0;
852 
853 	f = &ftp->ftp_side[1];
854 	olen = s - f->ftps_rptr;
855 	nlen = strlen(newmsg);
856 	inc = nlen - olen;
857 	if ((inc + fin->fin_plen) > 65535) {
858 		DT3(ftp_PASV_error_inc, nat_t *, nat, ftpside_t *, f,
859 		    int, inc);
860 		if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
861 			printf("ipf_p_ftp_pasv:inc(%d) + ip->ip_len > 65535\n",
862 			       inc);
863 		return 0;
864 	}
865 
866 	ipn = ipf_proxy_rule_fwd(nat);
867 	if (ipn == NULL)
868 		return APR_ERR(1);
869 	ipn->in_use = 0;
870 
871 	/*
872 	 * Add skeleton NAT entry for connection which will come back the
873 	 * other way.
874 	 */
875 	bzero((char *)tcp2, sizeof(*tcp2));
876 	bcopy((char *)fin, (char *)&fi, sizeof(fi));
877 	fi.fin_flx |= FI_IGNORE;
878 	fi.fin_data[0] = 0;
879 	fi.fin_data[1] = port;
880 	nflags = IPN_TCP|SI_W_SPORT;
881 
882 	fi.fin_fr = &ftppxyfr;
883 	fi.fin_dp = (char *)tcp2;
884 	fi.fin_out = 1 - fin->fin_out;
885 	fi.fin_dlen = sizeof(*tcp2);
886 	fi.fin_src6 = nat->nat_osrc6;
887 	fi.fin_dst6 = nat->nat_odst6;
888 	fi.fin_plen = fi.fin_hlen + sizeof(*tcp);
889 	fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE;
890 
891 	TCP_OFF_A(tcp2, 5);
892 	tcp2->th_flags = TH_SYN;
893 	tcp2->th_win = htons(8192);
894 	tcp2->th_dport = htons(port);
895 
896 	MUTEX_ENTER(&softn->ipf_nat_new);
897 	if (nat->nat_v[0] == 6) {
898 #ifdef USE_INET6
899 		nat2 = ipf_nat6_add(&fi, ipn, &ftp->ftp_pendnat,
900 				    nflags, nat->nat_dir);
901 #endif
902 	} else {
903 		nat2 = ipf_nat_add(&fi, ipn, &ftp->ftp_pendnat,
904 				   nflags, nat->nat_dir);
905 	}
906 	MUTEX_EXIT(&softn->ipf_nat_new);
907 
908 	if (nat2 == NULL) {
909 		KFREES(ipn, ipn->in_size);
910 		return APR_ERR(1);
911 	}
912 
913 	(void) ipf_nat_proto(&fi, nat2, IPN_TCP);
914 	MUTEX_ENTER(&nat2->nat_lock);
915 	ipf_nat_update(&fi, nat2);
916 	MUTEX_EXIT(&nat2->nat_lock);
917 	fi.fin_ifp = NULL;
918 	if (nat->nat_dir == NAT_INBOUND) {
919 		if (nat->nat_v[0] == 6) {
920 #ifdef USE_INET6
921 			fi.fin_dst6 = nat->nat_ndst6;
922 #endif
923 		} else {
924 			fi.fin_daddr = nat->nat_ndstaddr;
925 		}
926 	}
927 	if (ipf_state_add(softc, &fi, (ipstate_t **)&ftp->ftp_pendstate,
928 			  SI_W_SPORT) != 0)
929 		ipf_nat_setpending(softc, nat2);
930 
931 #if !defined(_KERNEL)
932 	M_ADJ(m, inc);
933 #else
934 	/*
935 	 * m_adj takes care of pkthdr.len, if required and treats inc<0 to
936 	 * mean remove -len bytes from the end of the packet.
937 	 * The mbuf chain will be extended if necessary by m_copyback().
938 	 */
939 	if (inc < 0)
940 		M_ADJ(m, inc);
941 #endif /* !defined(_KERNEL) */
942 	COPYBACK(m, off, nlen, newmsg);
943 	fin->fin_flx |= FI_DOCKSUM;
944 
945 	if (inc != 0) {
946 		fin->fin_plen += inc;
947 		fin->fin_dlen += inc;
948 		if (nat->nat_v[0] == 6) {
949 #ifdef USE_INET6
950 			ip6 = (ip6_t *)fin->fin_ip;
951 			u_short len = ntohs(ip6->ip6_plen) + inc;
952 			ip6->ip6_plen = htons(len);
953 #endif
954 		} else {
955 			ip->ip_len = htons(fin->fin_plen);
956 		}
957 	}
958 
959 	return APR_INC(inc);
960 }
961 
962 
963 int
964 ipf_p_ftp_server(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
965     ftpinfo_t *ftp, int dlen)
966 {
967 	char *rptr, *wptr;
968 	ftpside_t *f;
969 	int inc;
970 
971 	inc = 0;
972 	f = &ftp->ftp_side[1];
973 	rptr = f->ftps_rptr;
974 	wptr = f->ftps_wptr;
975 
976 	DT2(ftp_server_response, char *, rptr, int, ftp->ftp_passok);
977 	if (*rptr == ' ')
978 		goto server_cmd_ok;
979 	if (!ISDIGIT(*rptr) || !ISDIGIT(*(rptr + 1)) || !ISDIGIT(*(rptr + 2)))
980 		return 0;
981 	if (softf->ipf_p_ftp_debug & DEBUG_PARSE)
982 		printf("ipf_p_ftp_server_1: cmd[%4.4s] passok %d\n",
983 		       rptr, ftp->ftp_passok);
984 	if (ftp->ftp_passok == FTPXY_GO) {
985 		if (!strncmp(rptr, "227 ", 4))
986 			inc = ipf_p_ftp_pasv(softf, fin, ip, nat, ftp, dlen);
987 		else if (!strncmp(rptr, "229 ", 4))
988 			inc = ipf_p_ftp_epsv(softf, fin, ip, nat, ftp, dlen);
989 		else if (strncmp(rptr, "200", 3)) {
990 			/*
991 			 * 200 is returned for a successful command.
992 			 */
993 			;
994 		}
995 	} else if (softf->ipf_p_ftp_insecure && !strncmp(rptr, "227 ", 4)) {
996 		inc = ipf_p_ftp_pasv(softf, fin, ip, nat, ftp, dlen);
997 	} else if (softf->ipf_p_ftp_insecure && !strncmp(rptr, "229 ", 4)) {
998 		inc = ipf_p_ftp_epsv(softf, fin, ip, nat, ftp, dlen);
999 	} else if (*rptr == '5' || *rptr == '4')
1000 		ftp->ftp_passok = FTPXY_INIT;
1001 	else if (ftp->ftp_incok) {
1002 		if (*rptr == '3') {
1003 			if (ftp->ftp_passok == FTPXY_ACCT_1)
1004 				ftp->ftp_passok = FTPXY_GO;
1005 			else
1006 				ftp->ftp_passok++;
1007 		} else if (*rptr == '2') {
1008 			switch (ftp->ftp_passok)
1009 			{
1010 			case FTPXY_USER_1 :
1011 			case FTPXY_USER_2 :
1012 			case FTPXY_PASS_1 :
1013 			case FTPXY_PASS_2 :
1014 			case FTPXY_ACCT_1 :
1015 				ftp->ftp_passok = FTPXY_GO;
1016 				break;
1017 			default :
1018 				ftp->ftp_passok += 3;
1019 				break;
1020 			}
1021 		}
1022 	}
1023 	ftp->ftp_incok = 0;
1024 server_cmd_ok:
1025 	if (softf->ipf_p_ftp_debug & DEBUG_PARSE)
1026 		printf("ipf_p_ftp_server_2: cmd[%4.4s] passok %d\n",
1027 		       rptr, ftp->ftp_passok);
1028 	DT3(ftp_server_passok, char *,rptr, int, ftp->ftp_incok,
1029 	    int, ftp->ftp_passok);
1030 
1031 	while ((*rptr++ != '\n') && (rptr < wptr))
1032 		;
1033 	f->ftps_rptr = rptr;
1034 	return inc;
1035 }
1036 
1037 
1038 /*
1039  * 0 FTPXY_JUNK_OK
1040  * 1 FTPXY_JUNK_BAD
1041  * 2 FTPXY_JUNK_EOL
1042  * 3 FTPXY_JUNK_CONT
1043  *
1044  * Look to see if the buffer starts with something which we recognise as
1045  * being the correct syntax for the FTP protocol.
1046  */
1047 int
1048 ipf_p_ftp_client_valid(ipf_ftp_softc_t *softf, ftpside_t *ftps, char *buf,
1049     size_t len)
1050 {
1051 	register char *s, c, pc;
1052 	register size_t i = len;
1053 	char cmd[5];
1054 
1055 	s = buf;
1056 
1057 	if (ftps->ftps_junk == FTPXY_JUNK_BAD)
1058 		return FTPXY_JUNK_BAD;
1059 
1060 	if (i < 5) {
1061 		DT1(client_valid, int, i);
1062 		if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
1063 			printf("ipf_p_ftp_client_valid:i(%d) < 5\n", (int)i);
1064 		return 2;
1065 	}
1066 
1067 	i--;
1068 	c = *s++;
1069 
1070 	if (ISALPHA(c)) {
1071 		cmd[0] = TOUPPER(c);
1072 		c = *s++;
1073 		i--;
1074 		if (ISALPHA(c)) {
1075 			cmd[1] = TOUPPER(c);
1076 			c = *s++;
1077 			i--;
1078 			if (ISALPHA(c)) {
1079 				cmd[2] = TOUPPER(c);
1080 				c = *s++;
1081 				i--;
1082 				if (ISALPHA(c)) {
1083 					cmd[3] = TOUPPER(c);
1084 					c = *s++;
1085 					i--;
1086 					if ((c != ' ') && (c != '\r'))
1087 						goto bad_client_command;
1088 				} else if ((c != ' ') && (c != '\r'))
1089 					goto bad_client_command;
1090 			} else
1091 				goto bad_client_command;
1092 		} else
1093 			goto bad_client_command;
1094 	} else {
1095 bad_client_command:
1096 		DT4(client_junk, int, len, int, i, int, c, char *, buf);
1097 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
1098 			printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*.*s]\n",
1099 			       "ipf_p_ftp_client_valid",
1100 			       ftps->ftps_junk, (int)len, (int)i, c,
1101 			       (int)len, (int)len, buf);
1102 		return FTPXY_JUNK_BAD;
1103 	}
1104 
1105 	for (; i; i--) {
1106 		pc = c;
1107 		c = *s++;
1108 		if ((pc == '\r') && (c == '\n')) {
1109 			cmd[4] = '\0';
1110 			if (!strcmp(cmd, "PASV")) {
1111 				ftps->ftps_cmd = FTPXY_C_PASV;
1112 			} else if (!strcmp(cmd, "EPSV")) {
1113 				ftps->ftps_cmd = FTPXY_C_EPSV;
1114 			} else {
1115 				ftps->ftps_cmd = 0;
1116 			}
1117 			return 0;
1118 		}
1119 	}
1120 #if !defined(_KERNEL)
1121 	printf("ipf_p_ftp_client_valid:junk after cmd[%*.*s]\n",
1122 	       (int)len, (int)len, buf);
1123 #endif
1124 	return FTPXY_JUNK_EOL;
1125 }
1126 
1127 
1128 int
1129 ipf_p_ftp_server_valid(ipf_ftp_softc_t *softf, ftpside_t *ftps, char *buf,
1130     size_t len)
1131 {
1132 	register char *s, c, pc;
1133 	register size_t i = len;
1134 	int cmd;
1135 
1136 	s = buf;
1137 	cmd = 0;
1138 
1139 	if (ftps->ftps_junk == FTPXY_JUNK_BAD)
1140 		return FTPXY_JUNK_BAD;
1141 
1142 	if (i < 5) {
1143 		DT1(server_valid, int, i);
1144 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
1145 			printf("ipf_p_ftp_servert_valid:i(%d) < 5\n", (int)i);
1146 		return 2;
1147 	}
1148 
1149 	c = *s++;
1150 	i--;
1151 	if (c == ' ') {
1152 		cmd = -1;
1153 		goto search_eol;
1154 	}
1155 
1156 	if (ISDIGIT(c)) {
1157 		cmd = (c - '0') * 100;
1158 		c = *s++;
1159 		i--;
1160 		if (ISDIGIT(c)) {
1161 			cmd += (c - '0') * 10;
1162 			c = *s++;
1163 			i--;
1164 			if (ISDIGIT(c)) {
1165 				cmd += (c - '0');
1166 				c = *s++;
1167 				i--;
1168 				if ((c != '-') && (c != ' '))
1169 					goto bad_server_command;
1170 				if (c == '-')
1171 					return FTPXY_JUNK_CONT;
1172 			} else
1173 				goto bad_server_command;
1174 		} else
1175 			goto bad_server_command;
1176 	} else {
1177 bad_server_command:
1178 		DT4(server_junk, int len, buf, int, i, int, c, char *, buf);
1179 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO)
1180 			printf("%s:bad:junk %d len %d/%d c 0x%x buf [%*.*s]\n",
1181 			       "ipf_p_ftp_server_valid",
1182 			       ftps->ftps_junk, (int)len, (int)i,
1183 			       c, (int)len, (int)len, buf);
1184 		if (ftps->ftps_junk == FTPXY_JUNK_CONT)
1185 			return FTPXY_JUNK_CONT;
1186 		return FTPXY_JUNK_BAD;
1187 	}
1188 search_eol:
1189 	for (; i; i--) {
1190 		pc = c;
1191 		c = *s++;
1192 		if ((pc == '\r') && (c == '\n')) {
1193 			if (cmd == -1) {
1194 				if (ftps->ftps_junk == FTPXY_JUNK_CONT)
1195 					return FTPXY_JUNK_CONT;
1196 			} else {
1197 				ftps->ftps_cmd = cmd;
1198 			}
1199 			return FTPXY_JUNK_OK;
1200 		}
1201 	}
1202 
1203 	DT2(junk_eol, int, len, char *, buf);
1204 	if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO)
1205 		printf("ipf_p_ftp_server_valid:junk after cmd[%*.*s]\n",
1206 		       (int)len, (int)len, buf);
1207 	return FTPXY_JUNK_EOL;
1208 }
1209 
1210 
1211 int
1212 ipf_p_ftp_valid(ipf_ftp_softc_t *softf, ftpinfo_t *ftp, int side, char *buf,
1213     size_t len)
1214 {
1215 	ftpside_t *ftps;
1216 	int ret;
1217 
1218 	ftps = &ftp->ftp_side[side];
1219 
1220 	if (side == 0)
1221 		ret = ipf_p_ftp_client_valid(softf, ftps, buf, len);
1222 	else
1223 		ret = ipf_p_ftp_server_valid(softf, ftps, buf, len);
1224 	return ret;
1225 }
1226 
1227 
1228 /*
1229  * For map rules, the following applies:
1230  * rv == 0 for outbound processing,
1231  * rv == 1 for inbound processing.
1232  * For rdr rules, the following applies:
1233  * rv == 0 for inbound processing,
1234  * rv == 1 for outbound processing.
1235  */
1236 int
1237 ipf_p_ftp_process(ipf_ftp_softc_t *softf, fr_info_t *fin, nat_t *nat,
1238     ftpinfo_t *ftp, int rv)
1239 {
1240 	int mlen, len, off, inc, i, sel, sel2, ok, ackoff, seqoff, retry;
1241 	char *rptr, *wptr, *s;
1242 	u_32_t thseq, thack;
1243 	ap_session_t *aps;
1244 	ftpside_t *f, *t;
1245 	tcphdr_t *tcp;
1246 	ip_t *ip;
1247 	mb_t *m;
1248 
1249 	m = fin->fin_m;
1250 	ip = fin->fin_ip;
1251 	tcp = (tcphdr_t *)fin->fin_dp;
1252 	off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
1253 
1254 	f = &ftp->ftp_side[rv];
1255 	t = &ftp->ftp_side[1 - rv];
1256 	thseq = ntohl(tcp->th_seq);
1257 	thack = ntohl(tcp->th_ack);
1258 #ifdef __sgi
1259 	mlen = fin->fin_plen - off;
1260 #else
1261 	mlen = MSGDSIZE(m) - off;
1262 #endif
1263 
1264 	DT3(process_debug, tcphdr_t *, tcp, int, off, int, mlen);
1265 	if (softf->ipf_p_ftp_debug & DEBUG_INFO)
1266 		printf("ipf_p_ftp_process: %d:%d,%d, mlen %d flags %x\n",
1267 		       fin->fin_out, fin->fin_sport, fin->fin_dport,
1268 		       mlen, tcp->th_flags);
1269 
1270 	if ((mlen == 0) && ((tcp->th_flags & TH_OPENING) == TH_OPENING)) {
1271 		f->ftps_seq[0] = thseq + 1;
1272 		t->ftps_seq[0] = thack;
1273 		return 0;
1274 	} else if (mlen < 0) {
1275 		return 0;
1276 	}
1277 
1278 	aps = nat->nat_aps;
1279 
1280 	sel = aps->aps_sel[1 - rv];
1281 	sel2 = aps->aps_sel[rv];
1282 	if (rv == 1) {
1283 		seqoff = aps->aps_seqoff[sel];
1284 		if (aps->aps_seqmin[sel] > seqoff + thseq)
1285 			seqoff = aps->aps_seqoff[!sel];
1286 		ackoff = aps->aps_ackoff[sel2];
1287 		if (aps->aps_ackmin[sel2] > ackoff + thack)
1288 			ackoff = aps->aps_ackoff[!sel2];
1289 	} else {
1290 		seqoff = aps->aps_ackoff[sel];
1291 		if (softf->ipf_p_ftp_debug & DEBUG_INFO)
1292 			printf("seqoff %d thseq %x ackmin %x\n", seqoff, thseq,
1293 			       aps->aps_ackmin[sel]);
1294 		if (aps->aps_ackmin[sel] > seqoff + thseq)
1295 			seqoff = aps->aps_ackoff[!sel];
1296 
1297 		ackoff = aps->aps_seqoff[sel2];
1298 		if (softf->ipf_p_ftp_debug & DEBUG_INFO)
1299 			printf("ackoff %d thack %x seqmin %x\n", ackoff, thack,
1300 			       aps->aps_seqmin[sel2]);
1301 		if (ackoff > 0) {
1302 			if (aps->aps_seqmin[sel2] > ackoff + thack)
1303 				ackoff = aps->aps_seqoff[!sel2];
1304 		} else {
1305 			if (aps->aps_seqmin[sel2] > thack)
1306 				ackoff = aps->aps_seqoff[!sel2];
1307 		}
1308 	}
1309 	if (softf->ipf_p_ftp_debug & DEBUG_INFO) {
1310 		printf("%s: %x seq %x/%d ack %x/%d len %d/%d off %d\n",
1311 		       rv ? "IN" : "OUT", tcp->th_flags, thseq, seqoff,
1312 		       thack, ackoff, mlen, fin->fin_plen, off);
1313 		printf("sel %d seqmin %x/%x offset %d/%d\n", sel,
1314 		       aps->aps_seqmin[sel], aps->aps_seqmin[sel2],
1315 		       aps->aps_seqoff[sel], aps->aps_seqoff[sel2]);
1316 		printf("sel %d ackmin %x/%x offset %d/%d\n", sel2,
1317 		       aps->aps_ackmin[sel], aps->aps_ackmin[sel2],
1318 		       aps->aps_ackoff[sel], aps->aps_ackoff[sel2]);
1319 	}
1320 
1321 	/*
1322 	 * XXX - Ideally, this packet should get dropped because we now know
1323 	 * that it is out of order (and there is no real danger in doing so
1324 	 * apart from causing packets to go through here ordered).
1325 	 */
1326 	if (softf->ipf_p_ftp_debug & DEBUG_INFO) {
1327 		printf("rv %d t:seq[0] %x seq[1] %x %d/%d\n",
1328 		       rv, t->ftps_seq[0], t->ftps_seq[1], seqoff, ackoff);
1329 	}
1330 
1331 	ok = 0;
1332 	if (t->ftps_seq[0] == 0) {
1333 		t->ftps_seq[0] = thack;
1334 		ok = 1;
1335 	} else {
1336 		if (ackoff == 0) {
1337 			if (t->ftps_seq[0] == thack)
1338 				ok = 1;
1339 			else if (t->ftps_seq[1] == thack) {
1340 				t->ftps_seq[0] = thack;
1341 				ok = 1;
1342 			}
1343 		} else {
1344 			if (t->ftps_seq[0] + ackoff == thack) {
1345 				t->ftps_seq[0] = thack;
1346 				ok = 1;
1347 			} else if (t->ftps_seq[0] == thack + ackoff) {
1348 				t->ftps_seq[0] = thack + ackoff;
1349 				ok = 1;
1350 			} else if (t->ftps_seq[1] + ackoff == thack) {
1351 				t->ftps_seq[0] = thack;
1352 				ok = 1;
1353 			} else if (t->ftps_seq[1] == thack + ackoff) {
1354 				t->ftps_seq[0] = thack + ackoff;
1355 				ok = 1;
1356 			}
1357 		}
1358 	}
1359 
1360 	if (softf->ipf_p_ftp_debug & DEBUG_INFO) {
1361 		if (!ok)
1362 			printf("%s ok\n", "not");
1363 	}
1364 
1365 	if (!mlen) {
1366 		if (t->ftps_seq[0] + ackoff != thack &&
1367 		    t->ftps_seq[1] + ackoff != thack) {
1368 			DT3(thack, ftpside_t *t, t, int, ackoff, u_32_t, thack);
1369 			if (softf->ipf_p_ftp_debug & DEBUG_ERROR) {
1370 				printf("%s:seq[0](%u) + (%d) != (%u)\n",
1371 				       "ipf_p_ftp_process", t->ftps_seq[0],
1372 				       ackoff, thack);
1373 				printf("%s:seq[0](%u) + (%d) != (%u)\n",
1374 				       "ipf_p_ftp_process", t->ftps_seq[1],
1375 				       ackoff, thack);
1376 			}
1377 			return APR_ERR(1);
1378 		}
1379 
1380 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE) {
1381 			printf("ipf_p_ftp_process:f:seq[0] %x seq[1] %x\n",
1382 				f->ftps_seq[0], f->ftps_seq[1]);
1383 		}
1384 
1385 		if (tcp->th_flags & TH_FIN) {
1386 			if (thseq == f->ftps_seq[1]) {
1387 				f->ftps_seq[0] = f->ftps_seq[1] - seqoff;
1388 				f->ftps_seq[1] = thseq + 1 - seqoff;
1389 			} else {
1390 				DT2(thseq, ftpside_t *t, t, u_32_t, thseq);
1391 				if (softf->ipf_p_ftp_debug & DEBUG_ERROR) {
1392 					printf("FIN: thseq %x seqoff %d ftps_seq %x\n",
1393 					       thseq, seqoff, f->ftps_seq[0]);
1394 				}
1395 				return APR_ERR(1);
1396 			}
1397 		}
1398 		f->ftps_len = 0;
1399 		return 0;
1400 	}
1401 
1402 	ok = 0;
1403 	if ((thseq == f->ftps_seq[0]) || (thseq == f->ftps_seq[1])) {
1404 		ok = 1;
1405 	/*
1406 	 * Retransmitted data packet.
1407 	 */
1408 	} else if ((thseq + mlen == f->ftps_seq[0]) ||
1409 		   (thseq + mlen == f->ftps_seq[1])) {
1410 		ok = 1;
1411 	}
1412 
1413 	if (ok == 0) {
1414 		DT3(ok_0, ftpside_t *, f, u_32_t, thseq, int, mlen);
1415 		inc = thseq - f->ftps_seq[0];
1416 		if (softf->ipf_p_ftp_debug & DEBUG_ERROR) {
1417 			printf("inc %d sel %d rv %d\n", inc, sel, rv);
1418 			printf("th_seq %x ftps_seq %x/%x\n",
1419 			       thseq, f->ftps_seq[0], f->ftps_seq[1]);
1420 			printf("ackmin %x ackoff %d\n", aps->aps_ackmin[sel],
1421 			       aps->aps_ackoff[sel]);
1422 			printf("seqmin %x seqoff %d\n", aps->aps_seqmin[sel],
1423 			       aps->aps_seqoff[sel]);
1424 		}
1425 
1426 		return APR_ERR(1);
1427 	}
1428 
1429 	inc = 0;
1430 	rptr = f->ftps_rptr;
1431 	wptr = f->ftps_wptr;
1432 	f->ftps_seq[0] = thseq;
1433 	f->ftps_seq[1] = f->ftps_seq[0] + mlen;
1434 	f->ftps_len = mlen;
1435 
1436 	while (mlen > 0) {
1437 		len = MIN(mlen, sizeof(f->ftps_buf) - (wptr - rptr));
1438 		if (len == 0)
1439 			break;
1440 		COPYDATA(m, off, len, wptr);
1441 		mlen -= len;
1442 		off += len;
1443 		wptr += len;
1444 
1445 whilemore:
1446 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE)
1447 			printf("%s:len %d/%d off %d wptr %lx junk %d [%*.*s]\n",
1448 			       "ipf_p_ftp_process",
1449 			       len, mlen, off, (u_long)wptr, f->ftps_junk,
1450 			       len, len, rptr);
1451 
1452 		f->ftps_wptr = wptr;
1453 		if (f->ftps_junk != FTPXY_JUNK_OK) {
1454 			i = f->ftps_junk;
1455 			f->ftps_junk = ipf_p_ftp_valid(softf, ftp, rv, rptr,
1456 						      wptr - rptr);
1457 			DT2(junk_transit, int, i, int, f->ftps_junk);
1458 
1459 			if (softf->ipf_p_ftp_debug & DEBUG_PARSE)
1460 				printf("%s:junk %d -> %d\n",
1461 				       "ipf_p_ftp_process", i, f->ftps_junk);
1462 
1463 			if (f->ftps_junk == FTPXY_JUNK_BAD) {
1464 				DT(buffer_full);
1465 				if (wptr - rptr == sizeof(f->ftps_buf)) {
1466 					if (softf->ipf_p_ftp_debug &
1467 					    DEBUG_PARSE_INFO)
1468 						printf("%s:full buffer\n",
1469 						       "ipf_p_ftp_process");
1470 					f->ftps_rptr = f->ftps_buf;
1471 					f->ftps_wptr = f->ftps_buf;
1472 					rptr = f->ftps_rptr;
1473 					wptr = f->ftps_wptr;
1474 					continue;
1475 				}
1476 			}
1477 		}
1478 
1479 		while ((f->ftps_junk == FTPXY_JUNK_OK) && (wptr > rptr)) {
1480 			len = wptr - rptr;
1481 			f->ftps_junk = ipf_p_ftp_valid(softf, ftp, rv,
1482 						       rptr, len);
1483 
1484 			if (softf->ipf_p_ftp_debug & DEBUG_PARSE) {
1485 				printf("%s=%d len %d rv %d ptr %lx/%lx ",
1486 				       "ipf_p_ftp_valid",
1487 				       f->ftps_junk, len, rv, (u_long)rptr,
1488 				       (u_long)wptr);
1489 				printf("buf [%*.*s]\n", len, len, rptr);
1490 			}
1491 
1492 			if (f->ftps_junk == FTPXY_JUNK_OK) {
1493 				f->ftps_cmds++;
1494 				f->ftps_rptr = rptr;
1495 				if (rv)
1496 					inc += ipf_p_ftp_server(softf, fin, ip,
1497 								nat, ftp, len);
1498 				else
1499 					inc += ipf_p_ftp_client(softf, fin, ip,
1500 								nat, ftp, len);
1501 				rptr = f->ftps_rptr;
1502 				wptr = f->ftps_wptr;
1503 			}
1504 		}
1505 
1506 		/*
1507 		 * Off to a bad start so lets just forget about using the
1508 		 * ftp proxy for this connection.
1509 		 */
1510 		if ((f->ftps_cmds == 0) && (f->ftps_junk == FTPXY_JUNK_BAD)) {
1511 			/* f->ftps_seq[1] += inc; */
1512 
1513 			DT(ftp_junk_cmd);
1514 			if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
1515 				printf("%s:cmds == 0 junk == 1\n",
1516 				       "ipf_p_ftp_process");
1517 			return APR_ERR(2);
1518 		}
1519 
1520 		retry = 0;
1521 		if ((f->ftps_junk != FTPXY_JUNK_OK) && (rptr < wptr)) {
1522 			for (s = rptr; s < wptr; s++) {
1523 				if ((*s == '\r') && (s + 1 < wptr) &&
1524 				    (*(s + 1) == '\n')) {
1525 					rptr = s + 2;
1526 					retry = 1;
1527 					if (f->ftps_junk != FTPXY_JUNK_CONT)
1528 						f->ftps_junk = FTPXY_JUNK_OK;
1529 					break;
1530 				}
1531 			}
1532 		}
1533 
1534 		if (rptr == wptr) {
1535 			rptr = wptr = f->ftps_buf;
1536 		} else {
1537 			/*
1538 			 * Compact the buffer back to the start.  The junk
1539 			 * flag should already be set and because we're not
1540 			 * throwing away any data, it is preserved from its
1541 			 * current state.
1542 			 */
1543 			if (rptr > f->ftps_buf) {
1544 				bcopy(rptr, f->ftps_buf, wptr - rptr);
1545 				wptr -= rptr - f->ftps_buf;
1546 				rptr = f->ftps_buf;
1547 			}
1548 		}
1549 		f->ftps_rptr = rptr;
1550 		f->ftps_wptr = wptr;
1551 		if (retry)
1552 			goto whilemore;
1553 	}
1554 
1555 	/* f->ftps_seq[1] += inc; */
1556 	if (tcp->th_flags & TH_FIN)
1557 		f->ftps_seq[1]++;
1558 	if (softf->ipf_p_ftp_debug & DEBUG_PARSE_INFO) {
1559 #ifdef __sgi
1560 		mlen = fin->fin_plen;
1561 #else
1562 		mlen = MSGDSIZE(m);
1563 #endif
1564 		mlen -= off;
1565 		printf("ftps_seq[1] = %x inc %d len %d\n",
1566 		       f->ftps_seq[1], inc, mlen);
1567 	}
1568 
1569 	f->ftps_rptr = rptr;
1570 	f->ftps_wptr = wptr;
1571 	return APR_INC(inc);
1572 }
1573 
1574 
1575 int
1576 ipf_p_ftp_out(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
1577 {
1578 	ipf_ftp_softc_t *softf = arg;
1579 	ftpinfo_t *ftp;
1580 	int rev;
1581 
1582 	ftp = aps->aps_data;
1583 	if (ftp == NULL)
1584 		return 0;
1585 
1586 	rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1;
1587 	if (ftp->ftp_side[1 - rev].ftps_ifp == NULL)
1588 		ftp->ftp_side[1 - rev].ftps_ifp = fin->fin_ifp;
1589 
1590 	return ipf_p_ftp_process(softf, fin, nat, ftp, rev);
1591 }
1592 
1593 
1594 int
1595 ipf_p_ftp_in(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
1596 {
1597 	ipf_ftp_softc_t *softf = arg;
1598 	ftpinfo_t *ftp;
1599 	int rev;
1600 
1601 	ftp = aps->aps_data;
1602 	if (ftp == NULL)
1603 		return 0;
1604 
1605 	rev = (nat->nat_dir == NAT_OUTBOUND) ? 0 : 1;
1606 	if (ftp->ftp_side[rev].ftps_ifp == NULL)
1607 		ftp->ftp_side[rev].ftps_ifp = fin->fin_ifp;
1608 
1609 	return ipf_p_ftp_process(softf, fin, nat, ftp, 1 - rev);
1610 }
1611 
1612 
1613 /*
1614  * ipf_p_ftp_atoi - implement a version of atoi which processes numbers in
1615  * pairs separated by commas (which are expected to be in the range 0 - 255),
1616  * returning a 16 bit number combining either side of the , as the MSB and
1617  * LSB.
1618  */
1619 u_short
1620 ipf_p_ftp_atoi(char **ptr)
1621 {
1622 	register char *s = *ptr, c;
1623 	register u_char i = 0, j = 0;
1624 
1625 	while (((c = *s++) != '\0') && ISDIGIT(c)) {
1626 		i *= 10;
1627 		i += c - '0';
1628 	}
1629 	if (c != ',') {
1630 		*ptr = NULL;
1631 		return 0;
1632 	}
1633 	while (((c = *s++) != '\0') && ISDIGIT(c)) {
1634 		j *= 10;
1635 		j += c - '0';
1636 	}
1637 	*ptr = s;
1638 	i &= 0xff;
1639 	j &= 0xff;
1640 	return (i << 8) | j;
1641 }
1642 
1643 
1644 int
1645 ipf_p_ftp_eprt(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
1646     ftpinfo_t *ftp, int dlen)
1647 {
1648 	ftpside_t *f;
1649 
1650 	/*
1651 	 * Check for client sending out EPRT message.
1652 	 */
1653 	if (dlen < IPF_MINEPRTLEN) {
1654 		DT1(epert_dlen, int, dlen);
1655 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
1656 			printf("ipf_p_ftp_eprt:dlen(%d) < IPF_MINEPRTLEN\n",
1657 				dlen);
1658 		return 0;
1659 	}
1660 
1661 	/*
1662 	 * Parse the EPRT command.  Format is:
1663 	 * "EPRT |1|1.2.3.4|2000|" for IPv4 and
1664 	 * "EPRT |2|ef00::1:2|2000|" for IPv6
1665 	 */
1666 	f = &ftp->ftp_side[0];
1667 	if (f->ftps_rptr[5] != '|')
1668 		return 0;
1669 	if (f->ftps_rptr[5] == f->ftps_rptr[7]) {
1670 		if (f->ftps_rptr[6] == '1' && nat->nat_v[0] == 4)
1671 			return ipf_p_ftp_eprt4(softf, fin, ip, nat, ftp, dlen);
1672 #ifdef USE_INET6
1673 		if (f->ftps_rptr[6] == '2' && nat->nat_v[0] == 6)
1674 			return ipf_p_ftp_eprt6(softf, fin, ip, nat, ftp, dlen);
1675 #endif
1676 	}
1677 	return 0;
1678 }
1679 
1680 
1681 int
1682 ipf_p_ftp_eprt4(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
1683     ftpinfo_t *ftp, int dlen)
1684 {
1685 	int a1, a2, a3, a4, port, olen, nlen, inc, off;
1686 	char newbuf[IPF_FTPBUFSZ];
1687 	char *s, c, delim;
1688 	u_32_t addr, i;
1689 	tcphdr_t *tcp;
1690 	ftpside_t *f;
1691 	mb_t *m;
1692 
1693 	m = fin->fin_m;
1694 	tcp = (tcphdr_t *)fin->fin_dp;
1695 	off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
1696 	f = &ftp->ftp_side[0];
1697 	delim = f->ftps_rptr[5];
1698 	s = f->ftps_rptr + 8;
1699 
1700 	/*
1701 	 * get the IP address.
1702 	 */
1703 	i = 0;
1704 	while (((c = *s++) != '\0') && ISDIGIT(c)) {
1705 		i *= 10;
1706 		i += c - '0';
1707 	}
1708 	if (i > 255)
1709 		return 0;
1710 	if (c != '.')
1711 		return 0;
1712 	addr = (i << 24);
1713 
1714 	i = 0;
1715 	while (((c = *s++) != '\0') && ISDIGIT(c)) {
1716 		i *= 10;
1717 		i += c - '0';
1718 	}
1719 	if (i > 255)
1720 		return 0;
1721 	if (c != '.')
1722 		return 0;
1723 	addr |= (addr << 16);
1724 
1725 	i = 0;
1726 	while (((c = *s++) != '\0') && ISDIGIT(c)) {
1727 		i *= 10;
1728 		i += c - '0';
1729 	}
1730 	if (i > 255)
1731 		return 0;
1732 	if (c != '.')
1733 		return 0;
1734 	addr |= (addr << 8);
1735 
1736 	i = 0;
1737 	while (((c = *s++) != '\0') && ISDIGIT(c)) {
1738 		i *= 10;
1739 		i += c - '0';
1740 	}
1741 	if (i > 255)
1742 		return 0;
1743 	if (c != delim)
1744 		return 0;
1745 	addr |= addr;
1746 
1747 	/*
1748 	 * Get the port number
1749 	 */
1750 	i = 0;
1751 	while (((c = *s++) != '\0') && ISDIGIT(c)) {
1752 		i *= 10;
1753 		i += c - '0';
1754 	}
1755 	if (i > 65535)
1756 		return 0;
1757 	if (c != delim)
1758 		return 0;
1759 	port = i;
1760 
1761 	/*
1762 	 * Check for CR-LF at the end of the command string.
1763 	 */
1764 	if ((*s != '\r') || (*(s + 1) != '\n')) {
1765 		DT(eprt4_no_crlf);
1766 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
1767 			printf("ipf_p_ftp_eprt4:missing %s\n", "cr-lf");
1768 		return 0;
1769 	}
1770 	s += 2;
1771 
1772 	/*
1773 	 * Calculate new address parts for PORT command
1774 	 */
1775 	if (nat->nat_dir == NAT_INBOUND)
1776 		a1 = ntohl(nat->nat_odstaddr);
1777 	else
1778 		a1 = ntohl(ip->ip_src.s_addr);
1779 	a2 = (a1 >> 16) & 0xff;
1780 	a3 = (a1 >> 8) & 0xff;
1781 	a4 = a1 & 0xff;
1782 	a1 >>= 24;
1783 	olen = s - f->ftps_rptr;
1784 	/* DO NOT change this to snprintf! */
1785 	/*
1786 	 * While we could force the use of | as a delimiter here, it makes
1787 	 * sense to preserve whatever character is being used by the systems
1788 	 * involved in the communication.
1789 	 */
1790 #if defined(SNPRINTF) && defined(_KERNEL)
1791 	SNPRINTF(newbuf, sizeof(newbuf), "%s %c1%c%u.%u.%u.%u%c%u%c\r\n",
1792 		 "EPRT", delim, delim, a1, a2, a3, a4, delim, port, delim);
1793 #else
1794 	(void) sprintf(newbuf, "%s %c1%c%u.%u.%u.%u%c%u%c\r\n",
1795 		       "EPRT", delim, delim, a1, a2, a3, a4, delim, port,
1796 			delim);
1797 #endif
1798 
1799 	nlen = strlen(newbuf);
1800 	inc = nlen - olen;
1801 	if ((inc + fin->fin_plen) > 65535) {
1802 		DT2(eprt4_len, int, inc, int, fin->fin_plen);
1803 		if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
1804 			printf("ipf_p_ftp_eprt4:inc(%d) + ip->ip_len > 65535\n",
1805 				inc);
1806 		return 0;
1807 	}
1808 
1809 	off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
1810 #if !defined(_KERNEL)
1811 	M_ADJ(m, inc);
1812 #else
1813 	if (inc < 0)
1814 		M_ADJ(m, inc);
1815 #endif
1816 	/* the mbuf chain will be extended if necessary by m_copyback() */
1817 	COPYBACK(m, off, nlen, newbuf);
1818 	fin->fin_flx |= FI_DOCKSUM;
1819 
1820 	if (inc != 0) {
1821 		fin->fin_plen += inc;
1822 		ip->ip_len = htons(fin->fin_plen);
1823 		fin->fin_dlen += inc;
1824 	}
1825 
1826 	f->ftps_cmd = FTPXY_C_EPRT;
1827 	return ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, port, inc);
1828 }
1829 
1830 
1831 int
1832 ipf_p_ftp_epsv(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip, nat_t *nat,
1833     ftpinfo_t *ftp, int dlen)
1834 {
1835 	char newbuf[IPF_FTPBUFSZ];
1836 	u_short ap = 0;
1837 	ftpside_t *f;
1838 	char *s;
1839 
1840 	if ((softf->ipf_p_ftp_forcepasv != 0) &&
1841 	    (ftp->ftp_side[0].ftps_cmd != FTPXY_C_EPSV)) {
1842 		DT1(epsv_cmd, int, ftp->ftp_side[0].ftps_cmd);
1843 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
1844 			printf("ipf_p_ftp_epsv:ftps_cmd(%d) != FTPXY_C_EPSV\n",
1845 			       ftp->ftp_side[0].ftps_cmd);
1846 		return 0;
1847 	}
1848 	f = &ftp->ftp_side[1];
1849 
1850 #define EPSV_REPLEN	33
1851 	/*
1852 	 * Check for EPSV reply message.
1853 	 */
1854 	if (dlen < IPF_MIN229LEN) {
1855 		return (0);
1856 	} else if (strncmp(f->ftps_rptr,
1857 			 "229 Entering Extended Passive Mode", EPSV_REPLEN)) {
1858 		return (0);
1859 }
1860 
1861 	/*
1862 	 * Skip the EPSV command + space
1863 	 */
1864 	s = f->ftps_rptr + 33;
1865 	while (*s && !ISDIGIT(*s))
1866 		s++;
1867 
1868 	/*
1869 	 * As per RFC 2428, there are no addres components in the EPSV
1870 	 * response.  So we'll go straight to getting the port.
1871 	 */
1872 	while (*s && ISDIGIT(*s)) {
1873 		ap *= 10;
1874 		ap += *s++ - '0';
1875 	}
1876 
1877 	if (!s) {
1878 		return 0;
1879 }
1880 
1881 	if (*s == '|')
1882 		s++;
1883 	if (*s == ')')
1884 		s++;
1885 	if (*s == '\n')
1886 		s--;
1887 	/*
1888 	 * check for CR-LF at the end.
1889 	 */
1890 	if ((*s != '\r') || (*(s + 1) != '\n')) {
1891 		return 0;
1892 	}
1893 	s += 2;
1894 
1895 #if defined(SNPRINTF) && defined(_KERNEL)
1896 	SNPRINTF(newbuf, sizeof(newbuf), "%s (|||%u|)\r\n",
1897 		 "229 Entering Extended Passive Mode", ap);
1898 #else
1899 	(void) sprintf(newbuf, "%s (|||%u|)\r\n",
1900 		       "229 Entering Extended Passive Mode", ap);
1901 #endif
1902 
1903 	return ipf_p_ftp_pasvreply(softf, fin, ip, nat, ftp, (u_int)ap,
1904 				   newbuf, s);
1905 }
1906 
1907 #ifdef USE_INET6
1908 int
1909 ipf_p_ftp_eprt6(ipf_ftp_softc_t *softf, fr_info_t *fin, ip_t *ip,
1910 	nat_t *nat, ftpinfo_t *ftp, int dlen)
1911 {
1912 	int port, olen, nlen, inc, off, left, i;
1913 	char newbuf[IPF_FTPBUFSZ];
1914 	char *s, c;
1915 	i6addr_t addr, *a6;
1916 	tcphdr_t *tcp;
1917 	ip6_t *ip6;
1918 	char delim;
1919 	u_short whole;
1920 	u_short part;
1921 	ftpside_t *f;
1922 	u_short *t;
1923 	int fwd;
1924 	mb_t *m;
1925 	u_32_t a;
1926 
1927 	m = fin->fin_m;
1928 	ip6 = (ip6_t *)ip;
1929 	f = &ftp->ftp_side[0];
1930 	s = f->ftps_rptr + 8;
1931 	f = &ftp->ftp_side[0];
1932 	delim = f->ftps_rptr[5];
1933 	tcp = (tcphdr_t *)fin->fin_dp;
1934 	off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
1935 
1936 	addr.i6[0] = 0;
1937 	addr.i6[1] = 0;
1938 	addr.i6[2] = 0;
1939 	addr.i6[3] = 0;
1940 	/*
1941 	 * Parse an IPv6 address.
1942 	 * Go forward until either :: or | is found. If :: is found,
1943 	 * reverse direction. Direction change is performed to ease
1944 	 * parsing an unknown number of 0s in the middle.
1945 	 */
1946 	whole = 0;
1947 	t = (u_short *)&addr;
1948 	fwd = 1;
1949 	for (part = 0; (c = *s) != '\0'; ) {
1950 		if (c == delim) {
1951 			*t = htons((u_short)whole);
1952 			break;
1953 		}
1954 		if (c == ':') {
1955 			*t = part;
1956 			if (fwd) {
1957 				*t = htons((u_short)whole);
1958 				t++;
1959 			} else {
1960 				*t = htons((u_short)(whole >> 16));
1961 				t--;
1962 			}
1963 			whole = 0;
1964 			if (fwd == 1 && s[1] == ':') {
1965 				while (*s && *s != '|')
1966 					s++;
1967 				if ((c = *s) != delim)
1968 					break;
1969 				t = (u_short *)&addr.i6[3];
1970 				t++;
1971 				fwd = 0;
1972 			} else if (fwd == 0 && s[-1] == ':') {
1973 				break;
1974 			}
1975 		} else {
1976 			if (c >= '0' && c <= '9') {
1977 				c -= '0';
1978 			} else if (c >= 'a' && c <= 'f') {
1979 				c -= 'a' + 10;
1980 			} else if (c >= 'A' && c <= 'F') {
1981 				c -= 'A' + 10;
1982 			}
1983 			if (fwd) {
1984 				whole <<= 8;
1985 				whole |= c;
1986 			} else {
1987 				whole >>= 8;
1988 				whole |= ((u_32_t)c) << 24;
1989 			}
1990 		}
1991 		if (fwd)
1992 			s++;
1993 		else
1994 			s--;
1995 	}
1996 	if (c != ':' && c != delim)
1997 		return 0;
1998 
1999 	while (*s != '|')
2000 		s++;
2001 	s++;
2002 
2003 	/*
2004 	 * Get the port number
2005 	 */
2006 	i = 0;
2007 	while (((c = *s++) != '\0') && ISDIGIT(c)) {
2008 		i *= 10;
2009 		i += c - '0';
2010 	}
2011 	if (i > 65535)
2012 		return 0;
2013 	if (c != delim)
2014 		return 0;
2015 	port = (u_short)(i & 0xffff);
2016 
2017 	/*
2018 	 * Check for CR-LF at the end of the command string.
2019 	 */
2020 	if ((*s != '\r') || (*(s + 1) != '\n')) {
2021 		DT(eprt6_no_crlf);
2022 		if (softf->ipf_p_ftp_debug & DEBUG_PARSE_ERR)
2023 			printf("ipf_p_ftp_eprt6:missing %s\n", "cr-lf");
2024 		return 0;
2025 	}
2026 	s += 2;
2027 
2028 	/*
2029 	 * Calculate new address parts for PORT command
2030 	 */
2031 	a6 = (i6addr_t *)&ip6->ip6_src;
2032 	olen = s - f->ftps_rptr;
2033 	/* DO NOT change this to snprintf! */
2034 	/*
2035 	 * While we could force the use of | as a delimiter here, it makes
2036 	 * sense to preserve whatever character is being used by the systems
2037 	 * involved in the communication.
2038 	 */
2039 	s = newbuf;
2040 	left = sizeof(newbuf);
2041 #if defined(SNPRINTF) && defined(_KERNEL)
2042 	SNPRINTF(newbuf, left, "EPRT %c2%c", delim, delim);
2043 	left -= strlen(s) + 1;
2044 	s += strlen(s);
2045 	a = ntohl(a6->i6[0]);
2046 	SNPRINTF(s, left, "%x:%x:", a >> 16, a & 0xffff);
2047 	left -= strlen(s);
2048 	s += strlen(s);
2049 	a = ntohl(a6->i6[1]);
2050 	SNPRINTF(s, left, "%x:%x:", a >> 16, a & 0xffff);
2051 	left -= strlen(s);
2052 	s += strlen(s);
2053 	a = ntohl(a6->i6[2]);
2054 	SNPRINTF(s, left, "%x:%x:", a >> 16, a & 0xffff);
2055 	left -= strlen(s);
2056 	s += strlen(s);
2057 	a = ntohl(a6->i6[3]);
2058 	SNPRINTF(s, left, "%x:%x", a >> 16, a & 0xffff);
2059 	left -= strlen(s);
2060 	s += strlen(s);
2061 	sprintf(s, "|%d|\r\n", port);
2062 #else
2063 	(void) sprintf(s, "EPRT %c2%c", delim, delim);
2064 	s += strlen(s);
2065 	a = ntohl(a6->i6[0]);
2066 	sprintf(s, "%x:%x:", a >> 16, a & 0xffff);
2067 	s += strlen(s);
2068 	a = ntohl(a6->i6[1]);
2069 	sprintf(s, "%x:%x:", a >> 16, a & 0xffff);
2070 	left -= strlen(s);
2071 	s += strlen(s);
2072 	a = ntohl(a6->i6[2]);
2073 	sprintf(s, "%x:%x:", a >> 16, a & 0xffff);
2074 	left -= strlen(s);
2075 	s += strlen(s);
2076 	a = ntohl(a6->i6[3]);
2077 	sprintf(s, "%x:%x", a >> 16, a & 0xffff);
2078 	left -= strlen(s);
2079 	s += strlen(s);
2080 	sprintf(s, "|%d|\r\n", port);
2081 #endif
2082 	nlen = strlen(newbuf);
2083 	inc = nlen - olen;
2084 	if ((inc + fin->fin_plen) > 65535) {
2085 		DT2(eprt6_len, int, inc, int, fin->fin_plen);
2086 		if (softf->ipf_p_ftp_debug & DEBUG_ERROR)
2087 			printf("ipf_p_ftp_eprt6:inc(%d) + ip->ip_len > 65535\n",
2088 				inc);
2089 		return 0;
2090 	}
2091 
2092 	off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
2093 #if !defined(_KERNEL)
2094 	M_ADJ(m, inc);
2095 #else
2096 	if (inc < 0)
2097 		M_ADJ(m, inc);
2098 #endif
2099 	/* the mbuf chain will be extended if necessary by m_copyback() */
2100 	COPYBACK(m, off, nlen, newbuf);
2101 	fin->fin_flx |= FI_DOCKSUM;
2102 
2103 	if (inc != 0) {
2104 		fin->fin_plen += inc;
2105 		ip6->ip6_plen = htons(fin->fin_plen - fin->fin_hlen);
2106 		fin->fin_dlen += inc;
2107 	}
2108 
2109 	f->ftps_cmd = FTPXY_C_EPRT;
2110 	return ipf_p_ftp_addport(softf, fin, ip, nat, ftp, dlen, port, inc);
2111 }
2112 #endif /* USE_INET6 */
2113