1.\" $OpenBSD: ftp-proxy.8,v 1.22 2016/01/04 18:03:09 jmc Exp $ 2.\" 3.\" Copyright (c) 2004, 2005 Camiel Dobbelaar, <cd@sentia.nl> 4.\" 5.\" Permission to use, copy, modify, and distribute this software for any 6.\" purpose with or without fee is hereby granted, provided that the above 7.\" copyright notice and this permission notice appear in all copies. 8.\" 9.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16.\" 17.Dd $Mdocdate: January 4 2016 $ 18.Dt FTP-PROXY 8 19.Os 20.Sh NAME 21.Nm ftp-proxy 22.Nd Internet File Transfer Protocol proxy daemon 23.Sh SYNOPSIS 24.Nm 25.Bk -words 26.Op Fl 6Adrv 27.Op Fl a Ar address 28.Op Fl b Ar address 29.Op Fl D Ar level 30.Op Fl m Ar maxsessions 31.Op Fl P Ar port 32.Op Fl p Ar port 33.Op Fl q Ar queue 34.Op Fl R Ar address 35.Op Fl T Ar tag 36.Op Fl t Ar timeout 37.Ek 38.Sh DESCRIPTION 39.Nm 40is a proxy for the Internet File Transfer Protocol. 41FTP control connections should be redirected into the proxy using the 42.Xr pf 4 43.Ar divert-to 44command, after which the proxy connects to the server on behalf of 45the client. 46.Pp 47The proxy allows data connections to pass, rewriting and redirecting 48them so that the right addresses are used. 49All connections from the client to the server have their source 50address rewritten so they appear to come from the proxy. 51Consequently, all connections from the server to the proxy have 52their destination address rewritten, so they are redirected to the 53client. 54The proxy uses the 55.Xr pf 4 56.Ar anchor 57facility for this. 58.Pp 59Assuming the FTP control connection is from $client to $server, the 60proxy connected to the server using the $proxy source address, and 61$port is negotiated, then 62.Nm 63adds the following rules to the anchor. 64$server and $orig_server are the same unless 65.Fl R 66is used to force a different $server address for all connections. 67(These example rules use inet, but the proxy also supports inet6.) 68.Pp 69In case of active mode (PORT or EPRT): 70.Bd -literal -offset 2n 71pass in from $server to $proxy port $proxy_port \e 72 rdr-to $client port $port 73pass out from $server to $client port $port \e 74 nat-to $orig_server port $natport 75.Ed 76.Pp 77In case of passive mode (PASV or EPSV): 78.Bd -literal -offset 2n 79pass in from $client to $orig_server port $proxy_port \e 80 rdr-to $server port $port 81pass out from $client to $server port $port nat-to $proxy 82.Ed 83.Pp 84.Nm 85chroots to "/var/empty" and changes to user "_ftp-proxy" to drop privileges. 86.Pp 87The options are as follows: 88.Bl -tag -width Ds 89.It Fl 6 90IPv6 mode. 91The proxy will expect and use IPv6 addresses for all communication. 92Only the extended FTP modes EPSV and EPRT are allowed with IPv6. 93The proxy is in IPv4 mode by default. 94.It Fl A 95Only permit anonymous FTP connections. 96Either user "ftp" or user "anonymous" is allowed. 97.It Fl a Ar address 98The proxy will use this as the source address for the control 99connection to a server. 100.It Fl b Ar address 101Address where the proxy will listen for redirected control connections. 102The default is 127.0.0.1, or ::1 in IPv6 mode. 103.It Fl D Ar level 104Debug level, ranging from 0 to 7. 105Higher is more verbose. 106The default is 5. 107(These levels correspond to the 108.Xr syslog 3 109levels.) 110.It Fl d 111Do not daemonize. 112The process will stay in the foreground, logging to standard error. 113.It Fl m Ar maxsessions 114Maximum number of concurrent FTP sessions. 115When the proxy reaches this limit, new connections are denied. 116The default is 100 sessions. 117The limit can be lowered to a minimum of 1, or raised to a maximum of 500. 118.It Fl P Ar port 119Fixed server port. 120Only used in combination with 121.Fl R . 122The default is port 21. 123.It Fl p Ar port 124Port where the proxy will listen for redirected connections. 125The default is port 8021. 126.It Fl q Ar queue 127Create rules with queue 128.Ar queue 129appended, so that data connections can be queued. 130.It Fl R Ar address 131Fixed server address, also known as reverse mode. 132The proxy will always connect to the same server, regardless of 133where the client wanted to connect to (before it was redirected). 134Use this option to proxy for a server behind NAT, or to forward all 135connections to another proxy. 136.It Fl r 137Rewrite sourceport to 20 in active mode to suit ancient clients that insist 138on this RFC property. 139.It Fl T Ar tag 140The filter rules will add tag 141.Ar tag 142to data connections, and will use match rules instead of pass ones. 143This way alternative rules that use the 144.Ar tagged 145keyword can be implemented following the 146.Nm 147anchor. 148These rules can use special 149.Xr pf 4 150features like route-to, reply-to, label, rtable, overload, etc. that 151.Nm 152does not implement itself. 153There must be a matching pass rule after the 154.Nm 155anchor or the data connections will be blocked. 156.It Fl t Ar timeout 157Number of seconds that the control connection can be idle, before the 158proxy will disconnect. 159The maximum is 86400 seconds, which is also the default. 160Do not set this too low, because the control connection is usually 161idle when large data transfers are taking place. 162.It Fl v 163Set the 'log' flag on pf rules committed by 164.Nm . 165Use twice to set the 'log all' flag. 166The pf rules do not log by default. 167.El 168.Sh CONFIGURATION 169To make use of the proxy, 170.Xr pf.conf 5 171needs the following rules. 172Adjust the rules as needed; depending on the rest of the ruleset, the 173last rule explicitly allowing FTP sessions from the proxy may not be 174necessary. 175.Bd -literal -offset 2n 176anchor "ftp-proxy/*" 177pass in quick proto tcp to port ftp divert-to 127.0.0.1 port 8021 178pass out inet proto tcp from (self) to any port ftp 179.Ed 180.Sh SEE ALSO 181.Xr ftp 1 , 182.Xr pf 4 , 183.Xr pf.conf 5 184.Sh CAVEATS 185.Xr pf 4 186does not allow the ruleset to be modified if the system is running at a 187.Xr securelevel 7 188higher than 1. 189At that level 190.Nm 191cannot add rules to the anchors and FTP data connections may get blocked. 192.Pp 193Negotiated data connection ports below 1024 are not allowed. 194.Pp 195The negotiated IP address for active modes is ignored for security 196reasons. 197This makes third party file transfers impossible. 198.Pp 199Since 200.Nm 201acts as a man-in-the-middle it breaks explicit FTP TLS connections (RFC 4217). 202