1 /* $NetBSD: tftp-proxy.c,v 1.3 2009/06/16 02:18:07 minskim Exp $ */
2 /* $OpenBSD: tftp-proxy.c,v 1.2 2006/12/20 03:33:38 joel Exp $
3 *
4 * Copyright (c) 2005 DLS Internet Services
5 * Copyright (c) 2004, 2005 Camiel Dobbelaar, <cd@sentia.nl>
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. The name of the author may not be used to endorse or promote products
17 * derived from this software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 */
30
31 #include <sys/types.h>
32 #include <sys/ioctl.h>
33 #include <sys/uio.h>
34 #include <unistd.h>
35
36 #include <netinet/in.h>
37 #include <arpa/inet.h>
38 #include <arpa/tftp.h>
39 #include <sys/socket.h>
40 #include <net/if.h>
41 #include <net/pfvar.h>
42
43 #include <errno.h>
44 #include <pwd.h>
45 #include <stdio.h>
46 #include <syslog.h>
47 #include <string.h>
48 #include <stdlib.h>
49
50 #include "filter.h"
51
52 #define CHROOT_DIR "/var/chroot/tftp-proxy"
53 #define NOPRIV_USER "_proxy"
54
55 #define PF_NAT_PROXY_PORT_LOW 50001
56 #define PF_NAT_PROXY_PORT_HIGH 65535
57
58 #define DEFTRANSWAIT 2
59 #define NTOP_BUFS 4
60 #ifndef PKTSIZE
61 #define PKTSIZE SEGSIZE+4
62 #endif /* !PKTSIZE */
63
64 #ifndef IPPORT_HIFIRSTAUTO
65 #define IPPORT_HIFIRSTAUTO IPPORT_ANONMIN
66 #endif /* IPPORT_HIFIRSTAUTO */
67
68 #ifndef IPPORT_HILASTAUTO
69 #define IPPORT_HILASTAUTO IPPORT_ANONMAX
70 #endif /* IPPORT_HILASTAUTO */
71
72 const char *opcode(int);
73 const char *sock_ntop(struct sockaddr *);
74 u_int16_t pick_proxy_port(void);
75 static void usage(void);
76
77 extern char *__progname;
78 char ntop_buf[NTOP_BUFS][INET6_ADDRSTRLEN];
79 int verbose = 0;
80
81 int
main(int argc,char * argv[])82 main(int argc, char *argv[])
83 {
84 int c, fd = 0, on = 1, out_fd = 0, peer, reqsize = 0;
85 int transwait = DEFTRANSWAIT;
86 char *p;
87 struct tftphdr *tp;
88 struct passwd *pw;
89 size_t cbuflen;
90 char *cbuf;
91 char req[PKTSIZE];
92 struct cmsghdr *cmsg;
93 struct msghdr msg;
94 struct iovec iov;
95
96 struct sockaddr_storage from, proxy, server, proxy_to_server, s_in;
97 struct sockaddr_in sock_out;
98 socklen_t j;
99 in_port_t bindport;
100
101 openlog(__progname, LOG_PID | LOG_NDELAY, LOG_DAEMON);
102
103 while ((c = getopt(argc, argv, "vw:")) != -1)
104 switch (c) {
105 case 'v':
106 verbose++;
107 break;
108 case 'w':
109 transwait = strtoll(optarg, &p, 10);
110 if (transwait < 1) {
111 syslog(LOG_ERR, "invalid -w value");
112 exit(1);
113 }
114 break;
115 default:
116 usage();
117 break;
118 }
119
120 /* open /dev/pf */
121 init_filter(NULL, verbose);
122
123 tzset();
124
125 pw = getpwnam(NOPRIV_USER);
126 if (!pw) {
127 syslog(LOG_ERR, "no such user %s: %m", NOPRIV_USER);
128 exit(1);
129 }
130 if (chroot(CHROOT_DIR) || chdir("/")) {
131 syslog(LOG_ERR, "chroot %s: %m", CHROOT_DIR);
132 exit(1);
133 }
134 #ifdef __NetBSD__
135 if (setgroups(1, &pw->pw_gid) ||
136 setgid(pw->pw_gid) ||
137 setuid(pw->pw_uid)) {
138 syslog(LOG_ERR, "can't revoke privs: %m");
139 exit(1);
140 }
141 #else
142 if (setgroups(1, &pw->pw_gid) ||
143 setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
144 setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid)) {
145 syslog(LOG_ERR, "can't revoke privs: %m");
146 exit(1);
147 }
148 #endif /* !__NetBSD__ */
149
150 /* non-blocking io */
151 if (ioctl(fd, FIONBIO, &on) < 0) {
152 syslog(LOG_ERR, "ioctl(FIONBIO): %m");
153 exit(1);
154 }
155
156 if (setsockopt(fd, IPPROTO_IP, IP_RECVDSTADDR, &on, sizeof(on)) == -1) {
157 syslog(LOG_ERR, "setsockopt(IP_RECVDSTADDR): %m");
158 exit(1);
159 }
160
161 j = sizeof(s_in);
162 if (getsockname(fd, (struct sockaddr *)&s_in, &j) == -1) {
163 syslog(LOG_ERR, "getsockname: %m");
164 exit(1);
165 }
166
167 bindport = ((struct sockaddr_in *)&s_in)->sin_port;
168
169 /* req will be pushed back out at the end, unchanged */
170 j = sizeof(from);
171 if ((reqsize = recvfrom(fd, req, sizeof(req), MSG_PEEK,
172 (struct sockaddr *)&from, &j)) < 0) {
173 syslog(LOG_ERR, "recvfrom: %m");
174 exit(1);
175 }
176
177 bzero(&msg, sizeof(msg));
178 iov.iov_base = req;
179 iov.iov_len = sizeof(req);
180 msg.msg_name = &from;
181 msg.msg_namelen = sizeof(from);
182 msg.msg_iov = &iov;
183 msg.msg_iovlen = 1;
184
185 cbuflen = CMSG_SPACE(sizeof(struct sockaddr_storage));
186 if ((cbuf = malloc(cbuflen)) == NULL) {
187 syslog(LOG_ERR, "malloc: %m");
188 exit(1);
189 }
190
191 msg.msg_control = cbuf;
192 msg.msg_controllen = cbuflen;
193
194 if (recvmsg(fd, &msg, 0) < 0) {
195 syslog(LOG_ERR, "recvmsg: %m");
196 exit(1);
197 }
198
199 close(fd);
200 close(1);
201
202 peer = socket(from.ss_family, SOCK_DGRAM, 0);
203 if (peer < 0) {
204 syslog(LOG_ERR, "socket: %m");
205 exit(1);
206 }
207 memset(&s_in, 0, sizeof(s_in));
208 s_in.ss_family = from.ss_family;
209 s_in.ss_len = from.ss_len;
210
211 /* get local address if possible */
212 for (cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL;
213 cmsg = CMSG_NXTHDR(&msg, cmsg)) {
214 if (cmsg->cmsg_level == IPPROTO_IP &&
215 cmsg->cmsg_type == IP_RECVDSTADDR) {
216 memcpy(&((struct sockaddr_in *)&s_in)->sin_addr,
217 CMSG_DATA(cmsg), sizeof(struct in_addr));
218 break;
219 }
220 }
221
222 if (bind(peer, (struct sockaddr *)&s_in, s_in.ss_len) < 0) {
223 syslog(LOG_ERR, "bind: %m");
224 exit(1);
225 }
226 if (connect(peer, (struct sockaddr *)&from, from.ss_len) < 0) {
227 syslog(LOG_ERR, "connect: %m");
228 exit(1);
229 }
230
231 tp = (struct tftphdr *)req;
232 if (!(ntohs(tp->th_opcode) == RRQ || ntohs(tp->th_opcode) == WRQ)) {
233 /* not a tftp request, bail */
234 if (verbose) {
235 syslog(LOG_WARNING, "not a valid tftp request");
236 exit(1);
237 } else
238 /* exit 0 so inetd doesn't log anything */
239 exit(0);
240 }
241
242 j = sizeof(struct sockaddr_storage);
243 if (getsockname(fd, (struct sockaddr *)&proxy, &j) == -1) {
244 syslog(LOG_ERR, "getsockname: %m");
245 exit(1);
246 }
247
248 ((struct sockaddr_in *)&proxy)->sin_port = bindport;
249
250 /* find the un-rdr'd server and port the client wanted */
251 if (server_lookup((struct sockaddr *)&from,
252 (struct sockaddr *)&proxy, (struct sockaddr *)&server,
253 IPPROTO_UDP) != 0) {
254 syslog(LOG_ERR, "pf connection lookup failed (no rdr?)");
255 exit(1);
256 }
257
258 /* establish a new outbound connection to the remote server */
259 if ((out_fd = socket(((struct sockaddr *)&from)->sa_family,
260 SOCK_DGRAM, IPPROTO_UDP)) < 0) {
261 syslog(LOG_ERR, "couldn't create new socket");
262 exit(1);
263 }
264
265 bzero((char *)&sock_out, sizeof(sock_out));
266 sock_out.sin_family = from.ss_family;
267 sock_out.sin_port = htons(pick_proxy_port());
268 if (bind(out_fd, (struct sockaddr *)&sock_out, sizeof(sock_out)) < 0) {
269 syslog(LOG_ERR, "couldn't bind to new socket: %m");
270 exit(1);
271 }
272
273 if (connect(out_fd, (struct sockaddr *)&server,
274 ((struct sockaddr *)&server)->sa_len) < 0 && errno != EINPROGRESS) {
275 syslog(LOG_ERR, "couldn't connect to remote server: %m");
276 exit(1);
277 }
278
279 j = sizeof(struct sockaddr_storage);
280 if ((getsockname(out_fd, (struct sockaddr *)&proxy_to_server,
281 &j)) < 0) {
282 syslog(LOG_ERR, "getsockname: %m");
283 exit(1);
284 }
285
286 if (verbose)
287 syslog(LOG_INFO, "%s:%d -> %s:%d/%s:%d -> %s:%d \"%s %s\"",
288 sock_ntop((struct sockaddr *)&from),
289 ntohs(((struct sockaddr_in *)&from)->sin_port),
290 sock_ntop((struct sockaddr *)&proxy),
291 ntohs(((struct sockaddr_in *)&proxy)->sin_port),
292 sock_ntop((struct sockaddr *)&proxy_to_server),
293 ntohs(((struct sockaddr_in *)&proxy_to_server)->sin_port),
294 sock_ntop((struct sockaddr *)&server),
295 ntohs(((struct sockaddr_in *)&server)->sin_port),
296 opcode(ntohs(tp->th_opcode)),
297 tp->th_stuff);
298
299 /* get ready to add rdr and pass rules */
300 if (prepare_commit(1) == -1) {
301 syslog(LOG_ERR, "couldn't prepare pf commit");
302 exit(1);
303 }
304
305 /* rdr from server to us on our random port -> client on its port */
306 if (add_rdr(1, (struct sockaddr *)&server,
307 (struct sockaddr *)&proxy_to_server, ntohs(sock_out.sin_port),
308 (struct sockaddr *)&from,
309 ntohs(((struct sockaddr_in *)&from)->sin_port),
310 IPPROTO_UDP) == -1) {
311 syslog(LOG_ERR, "couldn't add rdr");
312 exit(1);
313 }
314
315 /* explicitly allow the packets to return back to the client (which pf
316 * will see post-rdr) */
317 if (add_filter(1, PF_IN, (struct sockaddr *)&server,
318 (struct sockaddr *)&from,
319 ntohs(((struct sockaddr_in *)&from)->sin_port),
320 IPPROTO_UDP) == -1) {
321 syslog(LOG_ERR, "couldn't add pass in");
322 exit(1);
323 }
324 if (add_filter(1, PF_OUT, (struct sockaddr *)&server,
325 (struct sockaddr *)&from,
326 ntohs(((struct sockaddr_in *)&from)->sin_port),
327 IPPROTO_UDP) == -1) {
328 syslog(LOG_ERR, "couldn't add pass out");
329 exit(1);
330 }
331
332 /* and just in case, to pass out from us to the server */
333 if (add_filter(1, PF_OUT, (struct sockaddr *)&proxy_to_server,
334 (struct sockaddr *)&server,
335 ntohs(((struct sockaddr_in *)&server)->sin_port),
336 IPPROTO_UDP) == -1) {
337 syslog(LOG_ERR, "couldn't add pass out");
338 exit(1);
339 }
340
341 if (do_commit() == -1) {
342 syslog(LOG_ERR, "couldn't commit pf rules");
343 exit(1);
344 }
345
346 /* forward the initial tftp request and start the insanity */
347 if (send(out_fd, tp, reqsize, 0) < 0) {
348 syslog(LOG_ERR, "couldn't forward tftp packet: %m");
349 exit(1);
350 }
351
352 /* allow the transfer to start to establish a state */
353 sleep(transwait);
354
355 /* delete our rdr rule and clean up */
356 prepare_commit(1);
357 do_commit();
358
359 return(0);
360 }
361
362 const char *
opcode(int code)363 opcode(int code)
364 {
365 static char str[6];
366
367 switch (code) {
368 case 1:
369 (void)snprintf(str, sizeof(str), "RRQ");
370 break;
371 case 2:
372 (void)snprintf(str, sizeof(str), "WRQ");
373 break;
374 default:
375 (void)snprintf(str, sizeof(str), "(%d)", code);
376 break;
377 }
378
379 return (str);
380 }
381
382 const char *
sock_ntop(struct sockaddr * sa)383 sock_ntop(struct sockaddr *sa)
384 {
385 static int n = 0;
386
387 /* Cycle to next buffer. */
388 n = (n + 1) % NTOP_BUFS;
389 ntop_buf[n][0] = '\0';
390
391 if (sa->sa_family == AF_INET) {
392 struct sockaddr_in *sin = (struct sockaddr_in *)sa;
393
394 return (inet_ntop(AF_INET, &sin->sin_addr, ntop_buf[n],
395 sizeof ntop_buf[0]));
396 }
397
398 if (sa->sa_family == AF_INET6) {
399 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
400
401 return (inet_ntop(AF_INET6, &sin6->sin6_addr, ntop_buf[n],
402 sizeof ntop_buf[0]));
403 }
404
405 return (NULL);
406 }
407
408 u_int16_t
pick_proxy_port(void)409 pick_proxy_port(void)
410 {
411 return (IPPORT_HIFIRSTAUTO + (arc4random() %
412 (IPPORT_HILASTAUTO - IPPORT_HIFIRSTAUTO)));
413 }
414
415 static void
usage(void)416 usage(void)
417 {
418 syslog(LOG_ERR, "usage: %s [-v] [-w transwait]", __progname);
419 exit(1);
420 }
421