1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
|
/*
* Copyright (c) 2016 VMware, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at:
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "Conntrack.h"
#include "PacketParser.h"
/* Eg: 227 Entering Passive Mode (a1,a2,a3,a4,p1,p2)*/
#define FTP_PASV_RSP_PREFIX "227"
typedef enum FTP_TYPE {
FTP_TYPE_PASV = 1,
FTP_TYPE_ACTIVE
} FTP_TYPE;
static __inline UINT32
OvsStrncmp(const char *s1, const char *s2, size_t n)
{
if (!s1 || !s2) {
return 0;
}
const char *s2end = s2 + n;
while (s2 < s2end && *s2 != '\0' && toupper(*s1) == toupper(*s2)) {
s1++, s2++;
}
if (s2end == s2) {
return 0;
}
return (UINT32)(toupper(*s1) - toupper(*s2));
}
static __inline VOID
OvsStrlcpy(char *dest, const char *src, size_t size)
{
/* XXX Replace ret with strlen(src) instead. */
size_t ret = size;
if (size) {
size_t len = (ret >= size) ? size - 1 : ret;
memcpy(dest, src, len);
dest[len] = '\0';
}
}
/*
*---------------------------------------------------------------------------
* OvsCtExtractNumbers
* Returns an array of numbers after parsing the string.
* Eg: PASV: 192,168,0,1,5,6 -> {192,168,0,1,5,6}
* EPRT: 192.168.0.1 -> {192,168,0,1}
*
*---------------------------------------------------------------------------
*/
static __inline NDIS_STATUS
OvsCtExtractNumbers(char *buf,
UINT32 bufLen,
UINT32 arr[],
UINT32 arrLen,
char delimiter)
{
if (!buf) {
return NDIS_STATUS_INVALID_PACKET;
}
UINT32 i = 0;
while (*buf != '\0') {
if (i >= bufLen || i >= arrLen) {
/* Non-standard FTP command */
return NDIS_STATUS_INVALID_PARAMETER;
}
/* Parse the number */
if (*buf >= '0' && *buf <= '9') {
arr[i] = arr[i] * 10 + *buf - '0';
} else if (*buf == delimiter) {
i++;
} else {
/* End of FTP response is either ) or \r\n */
if (*buf == ')' || *buf == '\r' || *buf == '\n') {
return NDIS_STATUS_SUCCESS;
}
/* Could be non-numerals or space */
}
buf++;
}
/* Parsing ended without the correct format */
return NDIS_STATUS_INVALID_PARAMETER;
}
/*
*----------------------------------------------------------------------------
* OvsCtHandleFtp
* Extract the FTP control data from the packet and created a related
* entry if it's a valid connection. This method doesn't support extended
* FTP yet. Supports PORT and PASV commands.
* Eg:
* 'PORT 192,168,137,103,192,22\r\n' -> '192.168.137.103' and 49174
* '227 Entering Passive Mode (192,168,137,104,194,14)\r\n' gets extracted
* to '192.168.137.104' and 49678
*----------------------------------------------------------------------------
*/
NDIS_STATUS
OvsCtHandleFtp(PNET_BUFFER_LIST curNbl,
OvsFlowKey *key,
OVS_PACKET_HDR_INFO *layers,
UINT64 currentTime,
POVS_CT_ENTRY entry,
BOOLEAN request)
{
NDIS_STATUS status;
FTP_TYPE ftpType = 0;
const char *buf;
char temp[256] = { 0 };
char ftpMsg[256] = { 0 };
UINT32 len;
TCPHdr tcpStorage;
const TCPHdr *tcp;
tcp = OvsGetTcpHeader(curNbl, layers, &tcpStorage, &len);
if (!tcp) {
return NDIS_STATUS_INVALID_PACKET;
}
if (len > sizeof(temp)) {
/* We only care up to 256 */
len = sizeof(temp);
}
buf = OvsGetPacketBytes(curNbl, len,
layers->l4Offset + TCP_HDR_LEN(tcp),
temp);
if (buf == NULL) {
return NDIS_STATUS_INVALID_PACKET;
}
OvsStrlcpy((char *)ftpMsg, (char *)buf, min(len, sizeof(ftpMsg)));
char *req = NULL;
if (request) {
if ((len >= 5) && (OvsStrncmp("PORT", ftpMsg, 4) == 0)) {
ftpType = FTP_TYPE_ACTIVE;
req = ftpMsg + 4;
}
} else {
if ((len >= 4) && (OvsStrncmp(FTP_PASV_RSP_PREFIX, ftpMsg, 3) == 0)) {
ftpType = FTP_TYPE_PASV;
/* There are various formats for PASV command. We try to support
* some of them. This has been addressed by RFC 2428 - EPSV.
* Eg:
* 227 Entering Passive Mode (h1,h2,h3,h4,p1,p2).
* 227 Entering Passive Mode (h1,h2,h3,h4,p1,p2
* 227 Entering Passive Mode. h1,h2,h3,h4,p1,p2
* 227 =h1,h2,h3,h4,p1,p2
*/
char *paren;
paren = strchr(ftpMsg, '(');
if (paren) {
req = paren + 1;
} else {
/* PASV command without ( */
req = ftpMsg + 3;
}
}
}
if (req == NULL) {
/* Not a PORT/PASV control packet */
return NDIS_STATUS_SUCCESS;
}
UINT32 arr[6] = {0};
status = OvsCtExtractNumbers(req, len, arr, 6, ',');
if (status != NDIS_STATUS_SUCCESS) {
return status;
}
UINT32 ip = ntohl((arr[0] << 24) | (arr[1] << 16) |
(arr[2] << 8) | arr[3]);
UINT16 port = ntohs(((arr[4] << 8) | arr[5]));
switch (ftpType) {
case FTP_TYPE_PASV:
/* Ensure that the command states Server's IP address */
ASSERT(ip == key->ipKey.nwSrc);
OvsCtRelatedEntryCreate(key->ipKey.nwProto,
key->l2.dlType,
/* Server's IP */
ip,
/* Use intended client's IP */
key->ipKey.nwDst,
/* Dynamic port opened on server */
port,
/* We don't know the client port */
0,
currentTime,
entry);
break;
case FTP_TYPE_ACTIVE:
OvsCtRelatedEntryCreate(key->ipKey.nwProto,
key->l2.dlType,
/* Server's default IP address */
key->ipKey.nwDst,
/* Client's IP address */
ip,
/* FTP Data Port is 20 */
ntohs(IPPORT_FTP_DATA),
/* Port opened up on Client */
port,
currentTime,
entry);
break;
default:
OVS_LOG_ERROR("invalid ftp type:%d", ftpType);
status = NDIS_STATUS_INVALID_PARAMETER;
break;
}
return status;
}
|
