xref: /freebsd/contrib/pf/ftp-proxy/ftp-proxy.c (revision b85e1f7d05ac7889868f2364474e02b6a024af25)
1 /*	$OpenBSD: ftp-proxy.c,v 1.19 2008/06/13 07:25:26 claudio Exp $ */
2 
3 /*
4  * Copyright (c) 2004, 2005 Camiel Dobbelaar, <cd@sentia.nl>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <sys/cdefs.h>
20 __FBSDID("$FreeBSD$");
21 
22 #include <sys/queue.h>
23 #include <sys/types.h>
24 #include <sys/time.h>
25 #include <sys/resource.h>
26 #include <sys/socket.h>
27 
28 #include <net/if.h>
29 #include <net/pfvar.h>
30 #include <netinet/in.h>
31 #include <arpa/inet.h>
32 
33 #include <err.h>
34 #include <errno.h>
35 #include <event.h>
36 #include <fcntl.h>
37 #include <netdb.h>
38 #include <pwd.h>
39 #include <signal.h>
40 #include <stdarg.h>
41 #include <stdio.h>
42 #include <stdlib.h>
43 #include <string.h>
44 #include <syslog.h>
45 #include <unistd.h>
46 #include <vis.h>
47 
48 #include "filter.h"
49 
50 #define CONNECT_TIMEOUT	30
51 #define MIN_PORT	1024
52 #define MAX_LINE	500
53 #define MAX_LOGLINE	300
54 #define NTOP_BUFS	3
55 #define TCP_BACKLOG	10
56 
57 #define CHROOT_DIR	"/var/empty"
58 #define NOPRIV_USER	"proxy"
59 
60 /* pfctl standard NAT range. */
61 #define PF_NAT_PROXY_PORT_LOW	50001
62 #define PF_NAT_PROXY_PORT_HIGH	65535
63 
64 #ifndef LIST_END
65 #define LIST_END(a)     NULL
66 #endif
67 
68 #ifndef getrtable
69 #define getrtable(a)    0
70 #endif
71 
72 #define	sstosa(ss)	((struct sockaddr *)(ss))
73 
74 enum { CMD_NONE = 0, CMD_PORT, CMD_EPRT, CMD_PASV, CMD_EPSV };
75 
76 struct session {
77 	u_int32_t		 id;
78 	struct sockaddr_storage  client_ss;
79 	struct sockaddr_storage  proxy_ss;
80 	struct sockaddr_storage  server_ss;
81 	struct sockaddr_storage  orig_server_ss;
82 	struct bufferevent	*client_bufev;
83 	struct bufferevent	*server_bufev;
84 	int			 client_fd;
85 	int			 server_fd;
86 	char			 cbuf[MAX_LINE];
87 	size_t			 cbuf_valid;
88 	char			 sbuf[MAX_LINE];
89 	size_t			 sbuf_valid;
90 	int			 cmd;
91 	u_int16_t		 port;
92 	u_int16_t		 proxy_port;
93 	LIST_ENTRY(session)	 entry;
94 };
95 
96 LIST_HEAD(, session) sessions = LIST_HEAD_INITIALIZER(sessions);
97 
98 void	client_error(struct bufferevent *, short, void *);
99 int	client_parse(struct session *s);
100 int	client_parse_anon(struct session *s);
101 int	client_parse_cmd(struct session *s);
102 void	client_read(struct bufferevent *, void *);
103 int	drop_privs(void);
104 void	end_session(struct session *);
105 void	exit_daemon(void);
106 int	getline(char *, size_t *);
107 void	handle_connection(const int, short, void *);
108 void	handle_signal(int, short, void *);
109 struct session * init_session(void);
110 void	logmsg(int, const char *, ...);
111 u_int16_t parse_port(int);
112 u_int16_t pick_proxy_port(void);
113 void	proxy_reply(int, struct sockaddr *, u_int16_t);
114 void	server_error(struct bufferevent *, short, void *);
115 int	server_parse(struct session *s);
116 int	allow_data_connection(struct session *s);
117 void	server_read(struct bufferevent *, void *);
118 const char *sock_ntop(struct sockaddr *);
119 void	usage(void);
120 
121 char linebuf[MAX_LINE + 1];
122 size_t linelen;
123 
124 char ntop_buf[NTOP_BUFS][INET6_ADDRSTRLEN];
125 
126 struct sockaddr_storage fixed_server_ss, fixed_proxy_ss;
127 const char *fixed_server, *fixed_server_port, *fixed_proxy, *listen_ip, *listen_port,
128     *qname, *tagname;
129 int anonymous_only, daemonize, id_count, ipv6_mode, loglevel, max_sessions,
130     rfc_mode, session_count, timeout, verbose;
131 extern char *__progname;
132 
133 void
134 client_error(struct bufferevent *bufev __unused, short what, void *arg)
135 {
136 	struct session *s = arg;
137 
138 	if (what & EVBUFFER_EOF)
139 		logmsg(LOG_INFO, "#%d client close", s->id);
140 	else if (what == (EVBUFFER_ERROR | EVBUFFER_READ))
141 		logmsg(LOG_ERR, "#%d client reset connection", s->id);
142 	else if (what & EVBUFFER_TIMEOUT)
143 		logmsg(LOG_ERR, "#%d client timeout", s->id);
144 	else if (what & EVBUFFER_WRITE)
145 		logmsg(LOG_ERR, "#%d client write error: %d", s->id, what);
146 	else
147 		logmsg(LOG_ERR, "#%d abnormal client error: %d", s->id, what);
148 
149 	end_session(s);
150 }
151 
152 int
153 client_parse(struct session *s)
154 {
155 	/* Reset any previous command. */
156 	s->cmd = CMD_NONE;
157 	s->port = 0;
158 
159 	/* Commands we are looking for are at least 4 chars long. */
160 	if (linelen < 4)
161 		return (1);
162 
163 	if (linebuf[0] == 'P' || linebuf[0] == 'p' ||
164 	    linebuf[0] == 'E' || linebuf[0] == 'e') {
165 		if (!client_parse_cmd(s))
166 			return (0);
167 
168 		/*
169 		 * Allow active mode connections immediately, instead of
170 		 * waiting for a positive reply from the server.  Some
171 		 * rare servers/proxies try to probe or setup the data
172 		 * connection before an actual transfer request.
173 		 */
174 		if (s->cmd == CMD_PORT || s->cmd == CMD_EPRT)
175 			return (allow_data_connection(s));
176 	}
177 
178 	if (anonymous_only && (linebuf[0] == 'U' || linebuf[0] == 'u'))
179 		return (client_parse_anon(s));
180 
181 	return (1);
182 }
183 
184 int
185 client_parse_anon(struct session *s)
186 {
187 	if (strcasecmp("USER ftp\r\n", linebuf) != 0 &&
188 	    strcasecmp("USER anonymous\r\n", linebuf) != 0) {
189 		snprintf(linebuf, sizeof linebuf,
190 		    "500 Only anonymous FTP allowed\r\n");
191 		logmsg(LOG_DEBUG, "#%d proxy: %s", s->id, linebuf);
192 
193 		/* Talk back to the client ourself. */
194 		linelen = strlen(linebuf);
195 		bufferevent_write(s->client_bufev, linebuf, linelen);
196 
197 		/* Clear buffer so it's not sent to the server. */
198 		linebuf[0] = '\0';
199 		linelen = 0;
200 	}
201 
202 	return (1);
203 }
204 
205 int
206 client_parse_cmd(struct session *s)
207 {
208 	if (strncasecmp("PASV", linebuf, 4) == 0)
209 		s->cmd = CMD_PASV;
210 	else if (strncasecmp("PORT ", linebuf, 5) == 0)
211 		s->cmd = CMD_PORT;
212 	else if (strncasecmp("EPSV", linebuf, 4) == 0)
213 		s->cmd = CMD_EPSV;
214 	else if (strncasecmp("EPRT ", linebuf, 5) == 0)
215 		s->cmd = CMD_EPRT;
216 	else
217 		return (1);
218 
219 	if (ipv6_mode && (s->cmd == CMD_PASV || s->cmd == CMD_PORT)) {
220 		logmsg(LOG_CRIT, "PASV and PORT not allowed with IPv6");
221 		return (0);
222 	}
223 
224 	if (s->cmd == CMD_PORT || s->cmd == CMD_EPRT) {
225 		s->port = parse_port(s->cmd);
226 		if (s->port < MIN_PORT) {
227 			logmsg(LOG_CRIT, "#%d bad port in '%s'", s->id,
228 			    linebuf);
229 			return (0);
230 		}
231 		s->proxy_port = pick_proxy_port();
232 		proxy_reply(s->cmd, sstosa(&s->proxy_ss), s->proxy_port);
233 		logmsg(LOG_DEBUG, "#%d proxy: %s", s->id, linebuf);
234 	}
235 
236 	return (1);
237 }
238 
239 void
240 client_read(struct bufferevent *bufev, void *arg)
241 {
242 	struct session	*s = arg;
243 	size_t		 buf_avail, clientread;
244 	int		 n;
245 
246 	do {
247 		buf_avail = sizeof s->cbuf - s->cbuf_valid;
248 		clientread = bufferevent_read(bufev, s->cbuf + s->cbuf_valid,
249 		    buf_avail);
250 		s->cbuf_valid += clientread;
251 
252 		while ((n = getline(s->cbuf, &s->cbuf_valid)) > 0) {
253 			logmsg(LOG_DEBUG, "#%d client: %s", s->id, linebuf);
254 			if (!client_parse(s)) {
255 				end_session(s);
256 				return;
257 			}
258 			bufferevent_write(s->server_bufev, linebuf, linelen);
259 		}
260 
261 		if (n == -1) {
262 			logmsg(LOG_ERR, "#%d client command too long or not"
263 			    " clean", s->id);
264 			end_session(s);
265 			return;
266 		}
267 	} while (clientread == buf_avail);
268 }
269 
270 int
271 drop_privs(void)
272 {
273 	struct passwd *pw;
274 
275 	pw = getpwnam(NOPRIV_USER);
276 	if (pw == NULL)
277 		return (0);
278 
279 	tzset();
280 	if (chroot(CHROOT_DIR) != 0 || chdir("/") != 0 ||
281 	    setgroups(1, &pw->pw_gid) != 0 ||
282 	    setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0 ||
283 	    setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0)
284 		return (0);
285 
286 	return (1);
287 }
288 
289 void
290 end_session(struct session *s)
291 {
292 	int serr;
293 
294 	logmsg(LOG_INFO, "#%d ending session", s->id);
295 
296 	/* Flush output buffers. */
297 	if (s->client_bufev && s->client_fd != -1)
298 		evbuffer_write(s->client_bufev->output, s->client_fd);
299 	if (s->server_bufev && s->server_fd != -1)
300 		evbuffer_write(s->server_bufev->output, s->server_fd);
301 
302 	if (s->client_fd != -1)
303 		close(s->client_fd);
304 	if (s->server_fd != -1)
305 		close(s->server_fd);
306 
307 	if (s->client_bufev)
308 		bufferevent_free(s->client_bufev);
309 	if (s->server_bufev)
310 		bufferevent_free(s->server_bufev);
311 
312 	/* Remove rulesets by commiting empty ones. */
313 	serr = 0;
314 	if (prepare_commit(s->id) == -1)
315 		serr = errno;
316 	else if (do_commit() == -1) {
317 		serr = errno;
318 		do_rollback();
319 	}
320 	if (serr)
321 		logmsg(LOG_ERR, "#%d pf rule removal failed: %s", s->id,
322 		    strerror(serr));
323 
324 	LIST_REMOVE(s, entry);
325 	free(s);
326 	session_count--;
327 }
328 
329 void
330 exit_daemon(void)
331 {
332 	struct session *s, *next;
333 
334 	for (s = LIST_FIRST(&sessions); s != LIST_END(&sessions); s = next) {
335 		next = LIST_NEXT(s, entry);
336 		end_session(s);
337 	}
338 
339 	if (daemonize)
340 		closelog();
341 
342 	exit(0);
343 }
344 
345 int
346 getline(char *buf, size_t *valid)
347 {
348 	size_t i;
349 
350 	if (*valid > MAX_LINE)
351 		return (-1);
352 
353 	/* Copy to linebuf while searching for a newline. */
354 	for (i = 0; i < *valid; i++) {
355 		linebuf[i] = buf[i];
356 		if (buf[i] == '\0')
357 			return (-1);
358 		if (buf[i] == '\n')
359 			break;
360 	}
361 
362 	if (i == *valid) {
363 		/* No newline found. */
364 		linebuf[0] = '\0';
365 		linelen = 0;
366 		if (i < MAX_LINE)
367 			return (0);
368 		return (-1);
369 	}
370 
371 	linelen = i + 1;
372 	linebuf[linelen] = '\0';
373 	*valid -= linelen;
374 
375 	/* Move leftovers to the start. */
376 	if (*valid != 0)
377 		bcopy(buf + linelen, buf, *valid);
378 
379 	return ((int)linelen);
380 }
381 
382 void
383 handle_connection(const int listen_fd, short event __unused, void *ev __unused)
384 {
385 	struct sockaddr_storage tmp_ss;
386 	struct sockaddr *client_sa, *server_sa, *fixed_server_sa;
387 	struct sockaddr *client_to_proxy_sa, *proxy_to_server_sa;
388 	struct session *s;
389 	socklen_t len;
390 	int client_fd, fc, on;
391 
392 	/*
393 	 * We _must_ accept the connection, otherwise libevent will keep
394 	 * coming back, and we will chew up all CPU.
395 	 */
396 	client_sa = sstosa(&tmp_ss);
397 	len = sizeof(struct sockaddr_storage);
398 	if ((client_fd = accept(listen_fd, client_sa, &len)) < 0) {
399 		logmsg(LOG_CRIT, "accept failed: %s", strerror(errno));
400 		return;
401 	}
402 
403 	/* Refuse connection if the maximum is reached. */
404 	if (session_count >= max_sessions) {
405 		logmsg(LOG_ERR, "client limit (%d) reached, refusing "
406 		    "connection from %s", max_sessions, sock_ntop(client_sa));
407 		close(client_fd);
408 		return;
409 	}
410 
411 	/* Allocate session and copy back the info from the accept(). */
412 	s = init_session();
413 	if (s == NULL) {
414 		logmsg(LOG_CRIT, "init_session failed");
415 		close(client_fd);
416 		return;
417 	}
418 	s->client_fd = client_fd;
419 	memcpy(sstosa(&s->client_ss), client_sa, client_sa->sa_len);
420 
421 	/* Cast it once, and be done with it. */
422 	client_sa = sstosa(&s->client_ss);
423 	server_sa = sstosa(&s->server_ss);
424 	client_to_proxy_sa = sstosa(&tmp_ss);
425 	proxy_to_server_sa = sstosa(&s->proxy_ss);
426 	fixed_server_sa = sstosa(&fixed_server_ss);
427 
428 	/* Log id/client early to ease debugging. */
429 	logmsg(LOG_DEBUG, "#%d accepted connection from %s", s->id,
430 	    sock_ntop(client_sa));
431 
432 	/*
433 	 * Find out the real server and port that the client wanted.
434 	 */
435 	len = sizeof(struct sockaddr_storage);
436 	if ((getsockname(s->client_fd, client_to_proxy_sa, &len)) < 0) {
437 		logmsg(LOG_CRIT, "#%d getsockname failed: %s", s->id,
438 		    strerror(errno));
439 		goto fail;
440 	}
441 	if (server_lookup(client_sa, client_to_proxy_sa, server_sa) != 0) {
442 	    	logmsg(LOG_CRIT, "#%d server lookup failed (no rdr?)", s->id);
443 		goto fail;
444 	}
445 	if (fixed_server) {
446 		memcpy(sstosa(&s->orig_server_ss), server_sa,
447 		    server_sa->sa_len);
448 		memcpy(server_sa, fixed_server_sa, fixed_server_sa->sa_len);
449 	}
450 
451 	/* XXX: check we are not connecting to ourself. */
452 
453 	/*
454 	 * Setup socket and connect to server.
455 	 */
456 	if ((s->server_fd = socket(server_sa->sa_family, SOCK_STREAM,
457 	    IPPROTO_TCP)) < 0) {
458 		logmsg(LOG_CRIT, "#%d server socket failed: %s", s->id,
459 		    strerror(errno));
460 		goto fail;
461 	}
462 	if (fixed_proxy && bind(s->server_fd, sstosa(&fixed_proxy_ss),
463 	    fixed_proxy_ss.ss_len) != 0) {
464 		logmsg(LOG_CRIT, "#%d cannot bind fixed proxy address: %s",
465 		    s->id, strerror(errno));
466 		goto fail;
467 	}
468 
469 	/* Use non-blocking connect(), see CONNECT_TIMEOUT below. */
470 	if ((fc = fcntl(s->server_fd, F_GETFL)) == -1 ||
471 	    fcntl(s->server_fd, F_SETFL, fc | O_NONBLOCK) == -1) {
472 		logmsg(LOG_CRIT, "#%d cannot mark socket non-blocking: %s",
473 		    s->id, strerror(errno));
474 		goto fail;
475 	}
476 	if (connect(s->server_fd, server_sa, server_sa->sa_len) < 0 &&
477 	    errno != EINPROGRESS) {
478 		logmsg(LOG_CRIT, "#%d proxy cannot connect to server %s: %s",
479 		    s->id, sock_ntop(server_sa), strerror(errno));
480 		goto fail;
481 	}
482 
483 	len = sizeof(struct sockaddr_storage);
484 	if ((getsockname(s->server_fd, proxy_to_server_sa, &len)) < 0) {
485 		logmsg(LOG_CRIT, "#%d getsockname failed: %s", s->id,
486 		    strerror(errno));
487 		goto fail;
488 	}
489 
490 	logmsg(LOG_INFO, "#%d FTP session %d/%d started: client %s to server "
491 	    "%s via proxy %s ", s->id, session_count, max_sessions,
492 	    sock_ntop(client_sa), sock_ntop(server_sa),
493 	    sock_ntop(proxy_to_server_sa));
494 
495 	/* Keepalive is nice, but don't care if it fails. */
496 	on = 1;
497 	setsockopt(s->client_fd, SOL_SOCKET, SO_KEEPALIVE, (void *)&on,
498 	    sizeof on);
499 	setsockopt(s->server_fd, SOL_SOCKET, SO_KEEPALIVE, (void *)&on,
500 	    sizeof on);
501 
502 	/*
503 	 * Setup buffered events.
504 	 */
505 	s->client_bufev = bufferevent_new(s->client_fd, &client_read, NULL,
506 	    &client_error, s);
507 	if (s->client_bufev == NULL) {
508 		logmsg(LOG_CRIT, "#%d bufferevent_new client failed", s->id);
509 		goto fail;
510 	}
511 	bufferevent_settimeout(s->client_bufev, timeout, 0);
512 	bufferevent_enable(s->client_bufev, EV_READ | EV_TIMEOUT);
513 
514 	s->server_bufev = bufferevent_new(s->server_fd, &server_read, NULL,
515 	    &server_error, s);
516 	if (s->server_bufev == NULL) {
517 		logmsg(LOG_CRIT, "#%d bufferevent_new server failed", s->id);
518 		goto fail;
519 	}
520 	bufferevent_settimeout(s->server_bufev, CONNECT_TIMEOUT, 0);
521 	bufferevent_enable(s->server_bufev, EV_READ | EV_TIMEOUT);
522 
523 	return;
524 
525  fail:
526 	end_session(s);
527 }
528 
529 void
530 handle_signal(int sig, short event __unused, void *arg __unused)
531 {
532 	/*
533 	 * Signal handler rules don't apply, libevent decouples for us.
534 	 */
535 
536 	logmsg(LOG_ERR, "exiting on signal %d", sig);
537 
538 	exit_daemon();
539 }
540 
541 
542 struct session *
543 init_session(void)
544 {
545 	struct session *s;
546 
547 	s = calloc(1, sizeof(struct session));
548 	if (s == NULL)
549 		return (NULL);
550 
551 	s->id = id_count++;
552 	s->client_fd = -1;
553 	s->server_fd = -1;
554 	s->cbuf[0] = '\0';
555 	s->cbuf_valid = 0;
556 	s->sbuf[0] = '\0';
557 	s->sbuf_valid = 0;
558 	s->client_bufev = NULL;
559 	s->server_bufev = NULL;
560 	s->cmd = CMD_NONE;
561 	s->port = 0;
562 
563 	LIST_INSERT_HEAD(&sessions, s, entry);
564 	session_count++;
565 
566 	return (s);
567 }
568 
569 void
570 logmsg(int pri, const char *message, ...)
571 {
572 	va_list	ap;
573 
574 	if (pri > loglevel)
575 		return;
576 
577 	va_start(ap, message);
578 
579 	if (daemonize)
580 		/* syslog does its own vissing. */
581 		vsyslog(pri, message, ap);
582 	else {
583 		char buf[MAX_LOGLINE];
584 		char visbuf[2 * MAX_LOGLINE];
585 
586 		/* We don't care about truncation. */
587 		vsnprintf(buf, sizeof buf, message, ap);
588 #ifdef __FreeBSD__
589 		strvis(visbuf, buf, VIS_CSTYLE | VIS_NL);
590 #else
591 		strnvis(visbuf, buf, sizeof visbuf, VIS_CSTYLE | VIS_NL);
592 #endif
593 		fprintf(stderr, "%s\n", visbuf);
594 	}
595 
596 	va_end(ap);
597 }
598 
599 int
600 main(int argc, char *argv[])
601 {
602 	struct rlimit rlp;
603 	struct addrinfo hints, *res;
604 	struct event ev, ev_sighup, ev_sigint, ev_sigterm;
605 	int ch, error, listenfd, on;
606 	const char *errstr;
607 
608 	/* Defaults. */
609 	anonymous_only	= 0;
610 	daemonize	= 1;
611 	fixed_proxy	= NULL;
612 	fixed_server	= NULL;
613 	fixed_server_port = "21";
614 	ipv6_mode	= 0;
615 	listen_ip	= NULL;
616 	listen_port	= "8021";
617 	loglevel	= LOG_NOTICE;
618 	max_sessions	= 100;
619 	qname		= NULL;
620 	rfc_mode	= 0;
621 	tagname		= NULL;
622 	timeout		= 24 * 3600;
623 	verbose		= 0;
624 
625 	/* Other initialization. */
626 	id_count	= 1;
627 	session_count	= 0;
628 
629 	while ((ch = getopt(argc, argv, "6Aa:b:D:dm:P:p:q:R:rT:t:v")) != -1) {
630 		switch (ch) {
631 		case '6':
632 			ipv6_mode = 1;
633 			break;
634 		case 'A':
635 			anonymous_only = 1;
636 			break;
637 		case 'a':
638 			fixed_proxy = optarg;
639 			break;
640 		case 'b':
641 			listen_ip = optarg;
642 			break;
643 		case 'D':
644 			loglevel = strtonum(optarg, LOG_EMERG, LOG_DEBUG,
645 			    &errstr);
646 			if (errstr)
647 				errx(1, "loglevel %s", errstr);
648 			break;
649 		case 'd':
650 			daemonize = 0;
651 			break;
652 		case 'm':
653 			max_sessions = strtonum(optarg, 1, 500, &errstr);
654 			if (errstr)
655 				errx(1, "max sessions %s", errstr);
656 			break;
657 		case 'P':
658 			fixed_server_port = optarg;
659 			break;
660 		case 'p':
661 			listen_port = optarg;
662 			break;
663 		case 'q':
664 			if (strlen(optarg) >= PF_QNAME_SIZE)
665 				errx(1, "queuename too long");
666 			qname = optarg;
667 			break;
668 		case 'R':
669 			fixed_server = optarg;
670 			break;
671 		case 'r':
672 			rfc_mode = 1;
673 			break;
674 		case 'T':
675 			if (strlen(optarg) >= PF_TAG_NAME_SIZE)
676 				errx(1, "tagname too long");
677 			tagname = optarg;
678 			break;
679 		case 't':
680 			timeout = strtonum(optarg, 0, 86400, &errstr);
681 			if (errstr)
682 				errx(1, "timeout %s", errstr);
683 			break;
684 		case 'v':
685 			verbose++;
686 			if (verbose > 2)
687 				usage();
688 			break;
689 		default:
690 			usage();
691 		}
692 	}
693 
694 	if (listen_ip == NULL)
695 		listen_ip = ipv6_mode ? "::1" : "127.0.0.1";
696 
697 	/* Check for root to save the user from cryptic failure messages. */
698 	if (getuid() != 0)
699 		errx(1, "needs to start as root");
700 
701 	/* Raise max. open files limit to satisfy max. sessions. */
702 	rlp.rlim_cur = rlp.rlim_max = (2 * max_sessions) + 10;
703 	if (setrlimit(RLIMIT_NOFILE, &rlp) == -1)
704 		err(1, "setrlimit");
705 
706 	if (fixed_proxy) {
707 		memset(&hints, 0, sizeof hints);
708 		hints.ai_flags = AI_NUMERICHOST;
709 		hints.ai_family = ipv6_mode ? AF_INET6 : AF_INET;
710 		hints.ai_socktype = SOCK_STREAM;
711 		error = getaddrinfo(fixed_proxy, NULL, &hints, &res);
712 		if (error)
713 			errx(1, "getaddrinfo fixed proxy address failed: %s",
714 			    gai_strerror(error));
715 		memcpy(&fixed_proxy_ss, res->ai_addr, res->ai_addrlen);
716 		logmsg(LOG_INFO, "using %s to connect to servers",
717 		    sock_ntop(sstosa(&fixed_proxy_ss)));
718 		freeaddrinfo(res);
719 	}
720 
721 	if (fixed_server) {
722 		memset(&hints, 0, sizeof hints);
723 		hints.ai_family = ipv6_mode ? AF_INET6 : AF_INET;
724 		hints.ai_socktype = SOCK_STREAM;
725 		error = getaddrinfo(fixed_server, fixed_server_port, &hints,
726 		    &res);
727 		if (error)
728 			errx(1, "getaddrinfo fixed server address failed: %s",
729 			    gai_strerror(error));
730 		memcpy(&fixed_server_ss, res->ai_addr, res->ai_addrlen);
731 		logmsg(LOG_INFO, "using fixed server %s",
732 		    sock_ntop(sstosa(&fixed_server_ss)));
733 		freeaddrinfo(res);
734 	}
735 
736 	/* Setup listener. */
737 	memset(&hints, 0, sizeof hints);
738 	hints.ai_flags = AI_NUMERICHOST | AI_PASSIVE;
739 	hints.ai_family = ipv6_mode ? AF_INET6 : AF_INET;
740 	hints.ai_socktype = SOCK_STREAM;
741 	error = getaddrinfo(listen_ip, listen_port, &hints, &res);
742 	if (error)
743 		errx(1, "getaddrinfo listen address failed: %s",
744 		    gai_strerror(error));
745 	if ((listenfd = socket(res->ai_family, SOCK_STREAM, IPPROTO_TCP)) == -1)
746 		errx(1, "socket failed");
747 	on = 1;
748 	if (setsockopt(listenfd, SOL_SOCKET, SO_REUSEADDR, (void *)&on,
749 	    sizeof on) != 0)
750 		err(1, "setsockopt failed");
751 	if (bind(listenfd, (struct sockaddr *)res->ai_addr,
752 	    (socklen_t)res->ai_addrlen) != 0)
753 	    	err(1, "bind failed");
754 	if (listen(listenfd, TCP_BACKLOG) != 0)
755 		err(1, "listen failed");
756 	freeaddrinfo(res);
757 
758 	/* Initialize pf. */
759 	init_filter(qname, tagname, verbose);
760 
761 	if (daemonize) {
762 		if (daemon(0, 0) == -1)
763 			err(1, "cannot daemonize");
764 		openlog(__progname, LOG_PID | LOG_NDELAY, LOG_DAEMON);
765 	}
766 
767 	/* Use logmsg for output from here on. */
768 
769 	if (!drop_privs()) {
770 		logmsg(LOG_ERR, "cannot drop privileges: %s", strerror(errno));
771 		exit(1);
772 	}
773 
774 	event_init();
775 
776 	/* Setup signal handler. */
777 	signal(SIGPIPE, SIG_IGN);
778 	signal_set(&ev_sighup, SIGHUP, handle_signal, NULL);
779 	signal_set(&ev_sigint, SIGINT, handle_signal, NULL);
780 	signal_set(&ev_sigterm, SIGTERM, handle_signal, NULL);
781 	signal_add(&ev_sighup, NULL);
782 	signal_add(&ev_sigint, NULL);
783 	signal_add(&ev_sigterm, NULL);
784 
785 	event_set(&ev, listenfd, EV_READ | EV_PERSIST, handle_connection, &ev);
786 	event_add(&ev, NULL);
787 
788 	logmsg(LOG_NOTICE, "listening on %s port %s", listen_ip, listen_port);
789 
790 	/*  Vroom, vroom.  */
791 	event_dispatch();
792 
793 	logmsg(LOG_ERR, "event_dispatch error: %s", strerror(errno));
794 	exit_daemon();
795 
796 	/* NOTREACHED */
797 	return (1);
798 }
799 
800 u_int16_t
801 parse_port(int mode)
802 {
803 	unsigned int	 port, v[6];
804 	int		 n;
805 	char		*p;
806 
807 	/* Find the last space or left-parenthesis. */
808 	for (p = linebuf + linelen; p > linebuf; p--)
809 		if (*p == ' ' || *p == '(')
810 			break;
811 	if (p == linebuf)
812 		return (0);
813 
814 	switch (mode) {
815 	case CMD_PORT:
816 		n = sscanf(p, " %u,%u,%u,%u,%u,%u", &v[0], &v[1], &v[2],
817 		    &v[3], &v[4], &v[5]);
818 		if (n == 6 && v[0] < 256 && v[1] < 256 && v[2] < 256 &&
819 		    v[3] < 256 && v[4] < 256 && v[5] < 256)
820 			return ((v[4] << 8) | v[5]);
821 		break;
822 	case CMD_PASV:
823 		n = sscanf(p, "(%u,%u,%u,%u,%u,%u)", &v[0], &v[1], &v[2],
824 		    &v[3], &v[4], &v[5]);
825 		if (n == 6 && v[0] < 256 && v[1] < 256 && v[2] < 256 &&
826 		    v[3] < 256 && v[4] < 256 && v[5] < 256)
827 			return ((v[4] << 8) | v[5]);
828 		break;
829 	case CMD_EPSV:
830 		n = sscanf(p, "(|||%u|)", &port);
831 		if (n == 1 && port < 65536)
832 			return (port);
833 		break;
834 	case CMD_EPRT:
835 		n = sscanf(p, " |1|%u.%u.%u.%u|%u|", &v[0], &v[1], &v[2],
836 		    &v[3], &port);
837 		if (n == 5 && v[0] < 256 && v[1] < 256 && v[2] < 256 &&
838 		    v[3] < 256 && port < 65536)
839 			return (port);
840 		n = sscanf(p, " |2|%*[a-fA-F0-9:]|%u|", &port);
841 		if (n == 1 && port < 65536)
842 			return (port);
843 		break;
844 	default:
845 		return (0);
846 	}
847 
848 	return (0);
849 }
850 
851 u_int16_t
852 pick_proxy_port(void)
853 {
854 	/* Random should be good enough for avoiding port collisions. */
855 	return (IPPORT_HIFIRSTAUTO +
856 	    arc4random_uniform(IPPORT_HILASTAUTO - IPPORT_HIFIRSTAUTO));
857 }
858 
859 void
860 proxy_reply(int cmd, struct sockaddr *sa, u_int16_t port)
861 {
862 	u_int i;
863 	int r = 0;
864 
865 	switch (cmd) {
866 	case CMD_PORT:
867 		r = snprintf(linebuf, sizeof linebuf,
868 		    "PORT %s,%u,%u\r\n", sock_ntop(sa), port / 256,
869 		    port % 256);
870 		break;
871 	case CMD_PASV:
872 		r = snprintf(linebuf, sizeof linebuf,
873 		    "227 Entering Passive Mode (%s,%u,%u)\r\n", sock_ntop(sa),
874 		        port / 256, port % 256);
875 		break;
876 	case CMD_EPRT:
877 		if (sa->sa_family == AF_INET)
878 			r = snprintf(linebuf, sizeof linebuf,
879 			    "EPRT |1|%s|%u|\r\n", sock_ntop(sa), port);
880 		else if (sa->sa_family == AF_INET6)
881 			r = snprintf(linebuf, sizeof linebuf,
882 			    "EPRT |2|%s|%u|\r\n", sock_ntop(sa), port);
883 		break;
884 	case CMD_EPSV:
885 		r = snprintf(linebuf, sizeof linebuf,
886 		    "229 Entering Extended Passive Mode (|||%u|)\r\n", port);
887 		break;
888 	}
889 
890 	if (r < 0 || ((u_int)r) >= sizeof linebuf) {
891 		logmsg(LOG_ERR, "proxy_reply failed: %d", r);
892 		linebuf[0] = '\0';
893 		linelen = 0;
894 		return;
895 	}
896 	linelen = (size_t)r;
897 
898 	if (cmd == CMD_PORT || cmd == CMD_PASV) {
899 		/* Replace dots in IP address with commas. */
900 		for (i = 0; i < linelen; i++)
901 			if (linebuf[i] == '.')
902 				linebuf[i] = ',';
903 	}
904 }
905 
906 void
907 server_error(struct bufferevent *bufev __unused, short what, void *arg)
908 {
909 	struct session *s = arg;
910 
911 	if (what & EVBUFFER_EOF)
912 		logmsg(LOG_INFO, "#%d server close", s->id);
913 	else if (what == (EVBUFFER_ERROR | EVBUFFER_READ))
914 		logmsg(LOG_ERR, "#%d server refused connection", s->id);
915 	else if (what & EVBUFFER_WRITE)
916 		logmsg(LOG_ERR, "#%d server write error: %d", s->id, what);
917 	else if (what & EVBUFFER_TIMEOUT)
918 		logmsg(LOG_NOTICE, "#%d server timeout", s->id);
919 	else
920 		logmsg(LOG_ERR, "#%d abnormal server error: %d", s->id, what);
921 
922 	end_session(s);
923 }
924 
925 int
926 server_parse(struct session *s)
927 {
928 	if (s->cmd == CMD_NONE || linelen < 4 || linebuf[0] != '2')
929 		goto out;
930 
931 	if ((s->cmd == CMD_PASV && strncmp("227 ", linebuf, 4) == 0) ||
932 	    (s->cmd == CMD_EPSV && strncmp("229 ", linebuf, 4) == 0))
933 		return (allow_data_connection(s));
934 
935  out:
936 	s->cmd = CMD_NONE;
937 	s->port = 0;
938 
939 	return (1);
940 }
941 
942 int
943 allow_data_connection(struct session *s)
944 {
945 	struct sockaddr *client_sa, *orig_sa, *proxy_sa, *server_sa;
946 	int prepared = 0;
947 
948 	/*
949 	 * The pf rules below do quite some NAT rewriting, to keep up
950 	 * appearances.  Points to keep in mind:
951 	 * 1)  The client must think it's talking to the real server,
952 	 *     for both control and data connections.  Transparently.
953 	 * 2)  The server must think that the proxy is the client.
954 	 * 3)  Source and destination ports are rewritten to minimize
955 	 *     port collisions, to aid security (some systems pick weak
956 	 *     ports) or to satisfy RFC requirements (source port 20).
957 	 */
958 
959 	/* Cast this once, to make code below it more readable. */
960 	client_sa = sstosa(&s->client_ss);
961 	server_sa = sstosa(&s->server_ss);
962 	proxy_sa = sstosa(&s->proxy_ss);
963 	if (fixed_server)
964 		/* Fixed server: data connections must appear to come
965 		   from / go to the original server, not the fixed one. */
966 		orig_sa = sstosa(&s->orig_server_ss);
967 	else
968 		/* Server not fixed: orig_server == server. */
969 		orig_sa = sstosa(&s->server_ss);
970 
971 	/* Passive modes. */
972 	if (s->cmd == CMD_PASV || s->cmd == CMD_EPSV) {
973 		s->port = parse_port(s->cmd);
974 		if (s->port < MIN_PORT) {
975 			logmsg(LOG_CRIT, "#%d bad port in '%s'", s->id,
976 			    linebuf);
977 			return (0);
978 		}
979 		s->proxy_port = pick_proxy_port();
980 		logmsg(LOG_INFO, "#%d passive: client to server port %d"
981 		    " via port %d", s->id, s->port, s->proxy_port);
982 
983 		if (prepare_commit(s->id) == -1)
984 			goto fail;
985 		prepared = 1;
986 
987 		proxy_reply(s->cmd, orig_sa, s->proxy_port);
988 		logmsg(LOG_DEBUG, "#%d proxy: %s", s->id, linebuf);
989 
990 		/* rdr from $client to $orig_server port $proxy_port -> $server
991 		    port $port */
992 		if (add_rdr(s->id, client_sa, orig_sa, s->proxy_port,
993 		    server_sa, s->port) == -1)
994 			goto fail;
995 
996 		/* nat from $client to $server port $port -> $proxy */
997 		if (add_nat(s->id, client_sa, server_sa, s->port, proxy_sa,
998 		    PF_NAT_PROXY_PORT_LOW, PF_NAT_PROXY_PORT_HIGH) == -1)
999 			goto fail;
1000 
1001 		/* pass in from $client to $server port $port */
1002 		if (add_filter(s->id, PF_IN, client_sa, server_sa,
1003 		    s->port) == -1)
1004 			goto fail;
1005 
1006 		/* pass out from $proxy to $server port $port */
1007 		if (add_filter(s->id, PF_OUT, proxy_sa, server_sa,
1008 		    s->port) == -1)
1009 			goto fail;
1010 	}
1011 
1012 	/* Active modes. */
1013 	if (s->cmd == CMD_PORT || s->cmd == CMD_EPRT) {
1014 		logmsg(LOG_INFO, "#%d active: server to client port %d"
1015 		    " via port %d", s->id, s->port, s->proxy_port);
1016 
1017 		if (prepare_commit(s->id) == -1)
1018 			goto fail;
1019 		prepared = 1;
1020 
1021 		/* rdr from $server to $proxy port $proxy_port -> $client port
1022 		    $port */
1023 		if (add_rdr(s->id, server_sa, proxy_sa, s->proxy_port,
1024 		    client_sa, s->port) == -1)
1025 			goto fail;
1026 
1027 		/* nat from $server to $client port $port -> $orig_server port
1028 		    $natport */
1029 		if (rfc_mode && s->cmd == CMD_PORT) {
1030 			/* Rewrite sourceport to RFC mandated 20. */
1031 			if (add_nat(s->id, server_sa, client_sa, s->port,
1032 			    orig_sa, 20, 20) == -1)
1033 				goto fail;
1034 		} else {
1035 			/* Let pf pick a source port from the standard range. */
1036 			if (add_nat(s->id, server_sa, client_sa, s->port,
1037 			    orig_sa, PF_NAT_PROXY_PORT_LOW,
1038 			    PF_NAT_PROXY_PORT_HIGH) == -1)
1039 			    	goto fail;
1040 		}
1041 
1042 		/* pass in from $server to $client port $port */
1043 		if (add_filter(s->id, PF_IN, server_sa, client_sa, s->port) ==
1044 		    -1)
1045 			goto fail;
1046 
1047 		/* pass out from $orig_server to $client port $port */
1048 		if (add_filter(s->id, PF_OUT, orig_sa, client_sa, s->port) ==
1049 		    -1)
1050 			goto fail;
1051 	}
1052 
1053 	/* Commit rules if they were prepared. */
1054 	if (prepared && (do_commit() == -1)) {
1055 		if (errno != EBUSY)
1056 			goto fail;
1057 		/* One more try if busy. */
1058 		usleep(5000);
1059 		if (do_commit() == -1)
1060 			goto fail;
1061 	}
1062 
1063 	s->cmd = CMD_NONE;
1064 	s->port = 0;
1065 
1066 	return (1);
1067 
1068  fail:
1069 	logmsg(LOG_CRIT, "#%d pf operation failed: %s", s->id, strerror(errno));
1070 	if (prepared)
1071 		do_rollback();
1072 	return (0);
1073 }
1074 
1075 void
1076 server_read(struct bufferevent *bufev, void *arg)
1077 {
1078 	struct session	*s = arg;
1079 	size_t		 buf_avail, srvread;
1080 	int		 n;
1081 
1082 	bufferevent_settimeout(bufev, timeout, 0);
1083 
1084 	do {
1085 		buf_avail = sizeof s->sbuf - s->sbuf_valid;
1086 		srvread = bufferevent_read(bufev, s->sbuf + s->sbuf_valid,
1087 		    buf_avail);
1088 		s->sbuf_valid += srvread;
1089 
1090 		while ((n = getline(s->sbuf, &s->sbuf_valid)) > 0) {
1091 			logmsg(LOG_DEBUG, "#%d server: %s", s->id, linebuf);
1092 			if (!server_parse(s)) {
1093 				end_session(s);
1094 				return;
1095 			}
1096 			bufferevent_write(s->client_bufev, linebuf, linelen);
1097 		}
1098 
1099 		if (n == -1) {
1100 			logmsg(LOG_ERR, "#%d server reply too long or not"
1101 			    " clean", s->id);
1102 			end_session(s);
1103 			return;
1104 		}
1105 	} while (srvread == buf_avail);
1106 }
1107 
1108 const char *
1109 sock_ntop(struct sockaddr *sa)
1110 {
1111 	static int n = 0;
1112 
1113 	/* Cycle to next buffer. */
1114 	n = (n + 1) % NTOP_BUFS;
1115 	ntop_buf[n][0] = '\0';
1116 
1117 	if (sa->sa_family == AF_INET) {
1118 		struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1119 
1120 		return (inet_ntop(AF_INET, &sin->sin_addr, ntop_buf[n],
1121 		    sizeof ntop_buf[0]));
1122 	}
1123 
1124 	if (sa->sa_family == AF_INET6) {
1125 		struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
1126 
1127 		return (inet_ntop(AF_INET6, &sin6->sin6_addr, ntop_buf[n],
1128 		    sizeof ntop_buf[0]));
1129 	}
1130 
1131 	return (NULL);
1132 }
1133 
1134 void
1135 usage(void)
1136 {
1137 	fprintf(stderr, "usage: %s [-6Adrv] [-a address] [-b address]"
1138 	    " [-D level] [-m maxsessions]\n                 [-P port]"
1139 	    " [-p port] [-q queue] [-R address] [-T tag]\n"
1140             "                 [-t timeout]\n", __progname);
1141 	exit(1);
1142 }
1143