798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek#include "mod_proxy.h"

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek#if APR_HAVE_TIME_H

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek#include <time.h>

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek#endif

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek#define AUTODETECT_PWD

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek#define USE_MDTM

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekmodule AP_MODULE_DECLARE_DATA proxy_ftp_module;

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekint ap_proxy_ftp_canon(request_rec *r, char *url);

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmekint ap_proxy_ftp_handler(request_rec *r, proxy_server_conf *conf,

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek char *url, const char *proxyhost,

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek apr_port_t proxyport);

c129bd5df3ca08eb352cf69d01d2f374552624aeLennart Poetteringapr_status_t ap_proxy_send_dir_filter(ap_filter_t * f,

c129bd5df3ca08eb352cf69d01d2f374552624aeLennart Poettering apr_bucket_brigade *bb);

c129bd5df3ca08eb352cf69d01d2f374552624aeLennart Poettering

c129bd5df3ca08eb352cf69d01d2f374552624aeLennart Poettering

c129bd5df3ca08eb352cf69d01d2f374552624aeLennart Poetteringstatic int decodeenc(char *x)

f32b43bda454a70ae23d6802605d41b26dc24ce2Lennart Poettering{

c129bd5df3ca08eb352cf69d01d2f374552624aeLennart Poettering int i, j, ch;

c129bd5df3ca08eb352cf69d01d2f374552624aeLennart Poettering

c129bd5df3ca08eb352cf69d01d2f374552624aeLennart Poettering if (x[0] == '\0')

c129bd5df3ca08eb352cf69d01d2f374552624aeLennart Poettering return 0; /* special case for no characters */

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek for (i = 0, j = 0; x[i] != '\0'; i++, j++) {

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek /* decode it if not already done */

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ch = x[i];

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek if (ch == '%' && ap_isxdigit(x[i + 1]) && ap_isxdigit(x[i + 2])) {

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek ch = ap_proxy_hex2c(&x[i + 1]);

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek i += 2;

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek }

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek x[j] = ch;

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek }

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek x[j] = '\0';

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek return j;

798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek}

da49e9ab4c3cf53de3e41a532877727c6c9e5804Lennart Poettering

#define FTP_GLOBBING_CHARS "*?[{~"

static char *ftp_escape_globbingchars(apr_pool_t *p, const char *path)

{

char *ret = apr_palloc(p, 2*strlen(path)+sizeof(""));

char *d;

for (d = ret; *path; ++path) {

if (strchr(FTP_GLOBBING_CHARS, *path) != NULL)

*d++ = '\\';

*d++ = *path;

}

*d = '\0';

return ret;

}

static int ftp_check_globbingchars(const char *path)

{

for ( ; *path; ++path) {

if (*path == '\\')

++path;

if (path != '\0' && strchr(FTP_GLOBBING_CHARS, *path) != NULL)

return TRUE;

}

return FALSE;

}

static int ftp_check_string(const char *x)

{

int i, ch = 0;

for (i = 0; x[i] != '\0'; i++) {

ch = x[i];

if (ch == '%' && ap_isxdigit(x[i + 1]) && ap_isxdigit(x[i + 2])) {

ch = ap_proxy_hex2c(&x[i + 1]);

i += 2;

}

#if !APR_CHARSET_EBCDIC

if (ch == '\015' || ch == '\012' || (ch & 0x80))

#else /* APR_CHARSET_EBCDIC */

if (ch == '\r' || ch == '\n' || (os_toascii[ch] & 0x80))

#endif /* APR_CHARSET_EBCDIC */

return 0;

}

return 1;

}

int ap_proxy_ftp_canon(request_rec *r, char *url)

{

char *user, *password, *host, *path, *parms, *strp, sport[7];

apr_pool_t *p = r->pool;

const char *err;

apr_port_t port, def_port;

/* */

if (strncasecmp(url, "ftp:", 4) == 0) {

url += 4;

}

else {

return DECLINED;

}

def_port = apr_uri_default_port_for_scheme("ftp");

ap_log_error(APLOG_MARK, APLOG_DEBUG | APLOG_NOERRNO, 0, r->server,

"proxy: FTP: canonicalising URL %s", url);

port = def_port;

err = ap_proxy_canon_netloc(p, &url, &user, &password, &host, &port);

if (err)

return HTTP_BAD_REQUEST;

if (user != NULL && !ftp_check_string(user))

return HTTP_BAD_REQUEST;

if (password != NULL && !ftp_check_string(password))

return HTTP_BAD_REQUEST;

/* now parse path/parameters args, according to rfc1738 */

/*

strp = strchr(url, ';');

if (strp != NULL) {

*(strp++) = '\0';

parms = ap_proxy_canonenc(p, strp, strlen(strp), enc_parm,

r->proxyreq);

if (parms == NULL)

return HTTP_BAD_REQUEST;

}

else

parms = "";

path = ap_proxy_canonenc(p, url, strlen(url), enc_path, r->proxyreq);

if (path == NULL)

return HTTP_BAD_REQUEST;

if (!ftp_check_string(path))

return HTTP_BAD_REQUEST;

if (r->proxyreq && r->args != NULL) {

if (strp != NULL) {

strp = ap_proxy_canonenc(p, r->args, strlen(r->args), enc_parm, 1);

if (strp == NULL)

return HTTP_BAD_REQUEST;

parms = apr_pstrcat(p, parms, "?", strp, NULL);

}

else {

strp = ap_proxy_canonenc(p, r->args, strlen(r->args), enc_fpath, 1);

if (strp == NULL)

return HTTP_BAD_REQUEST;

path = apr_pstrcat(p, path, "?", strp, NULL);

}

r->args = NULL;

}

if (port != def_port)

apr_snprintf(sport, sizeof(sport), ":%d", port);

else

sport[0] = '\0';

r->filename = apr_pstrcat(p, "proxy:ftp://", (user != NULL) ? user : "",

(password != NULL) ? ":" : "",

(password != NULL) ? password : "",

(user != NULL) ? "@" : "", host, sport, "/", path,

(parms[0] != '\0') ? ";" : "", parms, NULL);

return OK;

}

#define MAX_LINE_LEN 80

static int ftp_getrc_msg(conn_rec *ftp_ctrl, apr_bucket_brigade *bb, char *msgbuf, int msglen)

{

int status;

char response[MAX_LINE_LEN];

char buff[5];

char *mb = msgbuf, *me = &msgbuf[msglen];

apr_status_t rv;

int eos;

if (APR_SUCCESS != (rv = ap_proxy_string_read(ftp_ctrl, bb, response, sizeof(response), &eos))) {

return -1;

}

if (!apr_isdigit(response[0]) || !apr_isdigit(response[1]) ||

!apr_isdigit(response[2]) || (response[3] != ' ' && response[3] != '-'))

status = 0;

else

status = 100 * response[0] + 10 * response[1] + response[2] - 111 * '0';

mb = apr_cpystrn(mb, response + 4, me - mb);

if (response[3] == '-') {

memcpy(buff, response, 3);

buff[3] = ' ';

do {

if (APR_SUCCESS != (rv = ap_proxy_string_read(ftp_ctrl, bb, response, sizeof(response), &eos))) {

return -1;

}

mb = apr_cpystrn(mb, response + (' ' == response[0] ? 1 : 4), me - mb);

} while (memcmp(response, buff, 4) != 0);

}

return status;

}

typedef struct {

apr_bucket_brigade *in;

char buffer[MAX_STRING_LEN];

enum {

HEADER, BODY, FOOTER

} state;

} proxy_dir_ctx_t;

apr_status_t ap_proxy_send_dir_filter(ap_filter_t *f, apr_bucket_brigade *in)

{

request_rec *r = f->r;

apr_pool_t *p = r->pool;

apr_bucket_brigade *out = apr_brigade_create(p);

apr_status_t rv;

register int n;

char *dir, *path, *reldir, *site, *str, *type;

const char *pwd = apr_table_get(r->notes, "Directory-PWD");

const char *readme = apr_table_get(r->notes, "Directory-README");

proxy_dir_ctx_t *ctx = f->ctx;

if (!ctx) {

f->ctx = ctx = apr_pcalloc(p, sizeof(*ctx));

ctx->in = apr_brigade_create(p);

ctx->buffer[0] = 0;

ctx->state = HEADER;

}

/* combine the stored and the new */

APR_BRIGADE_CONCAT(ctx->in, in);

if (HEADER == ctx->state) {

/* basedir is either "", or "/%2f" for the "squid %2f hack" */

const char *basedir = ""; /* By default, path is relative to the $HOME dir */

char *wildcard = NULL;

/* Save "scheme://site" prefix without password */

site = apr_uri_unparse(p, &f->r->parsed_uri, APR_URI_UNP_OMITPASSWORD | APR_URI_UNP_OMITPATHINFO);

/* ... and path without query args */

path = apr_uri_unparse(p, &f->r->parsed_uri, APR_URI_UNP_OMITSITEPART | APR_URI_UNP_OMITQUERY);

/* If path began with /%2f, change the basedir */

if (strncasecmp(path, "/%2f", 4) == 0) {

basedir = "/%2f";

}

/* Strip off a type qualifier. It is ignored for dir listings */

if ((type = strstr(path, ";type=")) != NULL)

*type++ = '\0';

(void)decodeenc(path);

while (path[1] == '/') /* collapse multiple leading slashes to one */

++path;

reldir = strrchr(path, '/');

if (reldir != NULL && ftp_check_globbingchars(reldir)) {

wildcard = &reldir[1];

reldir[0] = '\0'; /* strip off the wildcard suffix */

}

/* Copy path, strip (all except the last) trailing slashes */

/* (the trailing slash is needed for the dir component loop below) */

path = dir = apr_pstrcat(p, path, "/", NULL);

for (n = strlen(path); n > 1 && path[n - 1] == '/' && path[n - 2] == '/'; --n)

path[n - 1] = '\0';

/* Add a link to the root directory (if %2f hack was used) */

str = (basedir[0] != '\0') ? "<a href=\"/%2f/\">%2f</a>/" : "";

/* print "ftp://host/" */

str = apr_psprintf(p, DOCTYPE_HTML_3_2

"<html>\n <head>\n <title>%s%s%s</title>\n"

" <base href=\"%s%s%s\">\n </head>\n"

" <body>\n <h2>Directory of "

"<a href=\"/\">%s</a>/%s",

site, basedir, ap_escape_html(p, path),

site, basedir, ap_escape_uri(p, path),

site, str);

APR_BRIGADE_INSERT_TAIL(out, apr_bucket_pool_create(str, strlen(str), p));

for (dir = path+1; (dir = strchr(dir, '/')) != NULL; )

{

*dir = '\0';

if ((reldir = strrchr(path+1, '/'))==NULL) {

reldir = path+1;

}

else

++reldir;

/* print "path/" component */

str = apr_psprintf(p, "<a href=\"%s%s/\">%s</a>/", basedir,

ap_escape_uri(p, path),

ap_escape_html(p, reldir));

*dir = '/';

while (*dir == '/')

++dir;

APR_BRIGADE_INSERT_TAIL(out, apr_bucket_pool_create(str, strlen(str), p));

}

if (wildcard != NULL) {

APR_BRIGADE_INSERT_TAIL(out, apr_bucket_pool_create(wildcard, strlen(wildcard), p));

}

/* If the caller has determined the current directory, and it differs */

/* from what the client requested, then show the real name */

if (pwd == NULL || strncmp(pwd, path, strlen(pwd)) == 0) {

str = apr_psprintf(p, "</h2>\n\n <hr />\n\n<pre>");

}

else {

str = apr_psprintf(p, "</h2>\n\n(%s)\n\n <hr />\n\n<pre>",

ap_escape_html(p, pwd));

}

APR_BRIGADE_INSERT_TAIL(out, apr_bucket_pool_create(str, strlen(str), p));

/* print README */

if (readme) {

str = apr_psprintf(p, "%s\n</pre>\n\n<hr />\n\n<pre>\n",

ap_escape_html(p, readme));

APR_BRIGADE_INSERT_TAIL(out, apr_bucket_pool_create(str, strlen(str), p));

}

/* make sure page intro gets sent out */

APR_BRIGADE_INSERT_TAIL(out, apr_bucket_flush_create());

if (APR_SUCCESS != (rv = ap_pass_brigade(f->next, out))) {

return rv;

}

apr_brigade_cleanup(out);

ctx->state = BODY;

}

/* loop through each line of directory */

while (BODY == ctx->state) {

char *filename;

int found = 0;

int eos = 0;

regex_t *re = NULL;

regmatch_t re_result[3];

/* Compile the output format of "ls -s1" as a fallback for non-unix ftp listings */

re = ap_pregcomp(p, "^ *([0-9]+) +([^ ]+)$", REG_EXTENDED);

/* get a complete line */

/* if the buffer overruns - throw data away */

while (!found && !APR_BRIGADE_EMPTY(ctx->in)) {

char *pos, *response;

apr_size_t len, max;

apr_bucket *e;

e = APR_BRIGADE_FIRST(ctx->in);

if (APR_BUCKET_IS_EOS(e)) {

eos = 1;

break;

}

if (APR_SUCCESS != (rv = apr_bucket_read(e, (const char **)&response, &len, APR_BLOCK_READ))) {

return rv;

}

pos = memchr(response, APR_ASCII_LF, len);

if (pos != NULL) {

if ((response + len) != (pos + 1)) {

len = pos - response + 1;

apr_bucket_split(e, pos - response + 1);

}

found = 1;

}

max = sizeof(ctx->buffer) - strlen(ctx->buffer) - 1;

if (len > max) {

len = max;

}

/* len+1 to leave space for the trailing nil char */

apr_cpystrn(ctx->buffer+strlen(ctx->buffer), response, len+1);

APR_BUCKET_REMOVE(e);

apr_bucket_destroy(e);

}

/* EOS? jump to footer */

if (eos) {

ctx->state = FOOTER;

break;

}

/* not complete? leave and try get some more */

if (!found) {

return APR_SUCCESS;

}

{

size_t n = strlen(ctx->buffer);

if (ctx->buffer[n-1] == CRLF[1]) /* strip trailing '\n' */

ctx->buffer[--n] = '\0';

if (ctx->buffer[n-1] == CRLF[0]) /* strip trailing '\r' if present */

ctx->buffer[--n] = '\0';

}

/* a symlink? */

if (ctx->buffer[0] == 'l' && (filename = strstr(ctx->buffer, " -> ")) != NULL) {

char *link_ptr = filename;

do {

filename--;

} while (filename[0] != ' ' && filename > ctx->buffer);

if (filename > ctx->buffer)

*(filename++) = '\0';

*(link_ptr++) = '\0';

str = apr_psprintf(p, "%s <a href=\"%s\">%s %s</a>\n",

ap_escape_html(p, ctx->buffer),

ap_escape_uri(p, filename),

ap_escape_html(p, filename),

ap_escape_html(p, link_ptr));

}

/* a directory/file? */

else if (ctx->buffer[0] == 'd' || ctx->buffer[0] == '-' || ctx->buffer[0] == 'l' || apr_isdigit(ctx->buffer[0])) {

int searchidx = 0;

char *searchptr = NULL;

int firstfile = 1;

if (apr_isdigit(ctx->buffer[0])) { /* handle DOS dir */

searchptr = strchr(ctx->buffer, '<');

if (searchptr != NULL)

*searchptr = '[';

searchptr = strchr(ctx->buffer, '>');

if (searchptr != NULL)

*searchptr = ']';

}

filename = strrchr(ctx->buffer, ' ');

*(filename++) = '\0';

/* handle filenames with spaces in 'em */

if (!strcmp(filename, ".") || !strcmp(filename, "..") || firstfile) {

firstfile = 0;

searchidx = filename - ctx->buffer;

}

else if (searchidx != 0 && ctx->buffer[searchidx] != 0) {

*(--filename) = ' ';

ctx->buffer[searchidx - 1] = '\0';

filename = &ctx->buffer[searchidx];

}

/* Append a slash to the HREF link for directories */

if (!strcmp(filename, ".") || !strcmp(filename, "..") || ctx->buffer[0] == 'd') {

str = apr_psprintf(p, "%s <a href=\"%s/\">%s</a>\n",

ap_escape_html(p, ctx->buffer),

ap_escape_uri(p, filename),

ap_escape_html(p, filename));

}

else {

str = apr_psprintf(p, "%s <a href=\"%s\">%s</a>\n",

ap_escape_html(p, ctx->buffer),

ap_escape_uri(p, filename),

ap_escape_html(p, filename));

}

}

/* Try a fallback for listings in the format of "ls -s1" */

else if (0 == ap_regexec(re, ctx->buffer, 3, re_result, 0)) {

filename = apr_pstrndup(p, &ctx->buffer[re_result[2].rm_so], re_result[2].rm_eo - re_result[2].rm_so);

str = apr_pstrcat(p, ap_escape_html(p, apr_pstrndup(p, ctx->buffer, re_result[2].rm_so)),

"<a href=\"", ap_escape_uri(p, filename), "\">",

ap_escape_html(p, filename), "</a>\n", NULL);

}

else {

strcat(ctx->buffer, "\n"); /* re-append the newline */

str = ap_escape_html(p, ctx->buffer);

}

/* erase buffer for next time around */

ctx->buffer[0] = 0;

APR_BRIGADE_INSERT_TAIL(out, apr_bucket_pool_create(str, strlen(str), p));

APR_BRIGADE_INSERT_TAIL(out, apr_bucket_flush_create());

if (APR_SUCCESS != (rv = ap_pass_brigade(f->next, out))) {

return rv;

}

apr_brigade_cleanup(out);

}

if (FOOTER == ctx->state) {

str = apr_psprintf(p, "</pre>\n\n <hr />\n\n %s\n\n </body>\n</html>\n", ap_psignature("", r));

APR_BRIGADE_INSERT_TAIL(out, apr_bucket_pool_create(str, strlen(str), p));

APR_BRIGADE_INSERT_TAIL(out, apr_bucket_flush_create());

APR_BRIGADE_INSERT_TAIL(out, apr_bucket_eos_create());

if (APR_SUCCESS != (rv = ap_pass_brigade(f->next, out))) {

return rv;

}

apr_brigade_destroy(out);

}

return APR_SUCCESS;

}

static int

proxy_ftp_command(const char *cmd, request_rec *r, conn_rec *ftp_ctrl,

apr_bucket_brigade *bb, char **pmessage)

{

char *crlf;

int rc;

char message[HUGE_STRING_LEN];

/* If cmd == NULL, we retrieve the next ftp response line */

if (cmd != NULL) {

APR_BRIGADE_INSERT_TAIL(bb, apr_bucket_pool_create(cmd, strlen(cmd), r->pool));

APR_BRIGADE_INSERT_TAIL(bb, apr_bucket_flush_create());

ap_pass_brigade(ftp_ctrl->output_filters, bb);

/* strip off the CRLF for logging */

ap_cpystrn(message, cmd, sizeof message);

if ((crlf = strchr(message, '\r')) != NULL ||

(crlf = strchr(message, '\n')) != NULL)

*crlf = '\0';

if (strncmp(message,"PASS ", 5) == 0)

strcpy(&message[5], "****");

ap_log_error(APLOG_MARK, APLOG_DEBUG | APLOG_NOERRNO, 0, r->server,

"proxy:>FTP: %s", message);

}

rc = ftp_getrc_msg(ftp_ctrl, bb, message, sizeof message);

if (rc == -1 || rc == 421)

strcpy(message,"<unable to read result>");

if ((crlf = strchr(message, '\r')) != NULL ||

(crlf = strchr(message, '\n')) != NULL)

*crlf = '\0';

ap_log_error(APLOG_MARK, APLOG_DEBUG | APLOG_NOERRNO, 0, r->server,

"proxy:<FTP: %3.3u %s", rc, message);

if (pmessage != NULL)

*pmessage = ap_pstrdup(r->pool, message);

return rc;

}

static int ftp_set_TYPE(char xfer_type, request_rec *r, conn_rec *ftp_ctrl,

apr_bucket_brigade *bb, char **pmessage)

{

static char old_type[2] = { 'A', '\0' }; /* After logon, mode is ASCII */

int ret = HTTP_OK;

int rc;

if (xfer_type == old_type[0])

return ret;

/* set desired type */

old_type[0] = xfer_type;

rc = proxy_ftp_command(apr_pstrcat(r->pool, "TYPE ", old_type, CRLF, NULL),

r, ftp_ctrl, bb, pmessage);

/* 200 Command okay. */

/* 421 Service not available, closing control connection. */

/* 500 Syntax error, command unrecognized. */

/* 501 Syntax error in parameters or arguments. */

/* 504 Command not implemented for that parameter. */

/* 530 Not logged in. */

if (rc == -1 || rc == 421) {

ret = ap_proxyerror(r, HTTP_BAD_GATEWAY,

"Error reading from remote server");

}

else if (rc != 200 && rc != 504) {

ret = ap_proxyerror(r, HTTP_BAD_GATEWAY,

"Unable to set transfer type");

}

else if (rc == 504)

/* ignore it silently */;

return ret;

}

static char *ftp_get_PWD(request_rec *r, conn_rec *ftp_ctrl, apr_bucket_brigade *bb)

{

char *cwd = NULL;

char *ftpmessage = NULL;

/* responses: 257, 500, 501, 502, 421, 550 */

/* 257 "<directory-name>" <commentary> */

/* 421 Service not available, closing control connection. */

/* 500 Syntax error, command unrecognized. */

/* 501 Syntax error in parameters or arguments. */

/* 502 Command not implemented. */

/* 550 Requested action not taken. */

switch (proxy_ftp_command("PWD" CRLF, r, ftp_ctrl, bb, &ftpmessage)) {

case -1:

case 421:

case 550:

ap_proxyerror(r, HTTP_BAD_GATEWAY,

"Failed to read PWD on ftp server");

break;

case 257: {

const char *dirp = ftpmessage;

cwd = ap_getword_conf(r->pool, &dirp);

}

}

return cwd;

}

static int ftp_unauthorized(request_rec *r, int log_it)

{

r->proxyreq = PROXYREQ_NONE;

/*

if (log_it)

ap_log_rerror(APLOG_MARK, APLOG_INFO | APLOG_NOERRNO, 0, r,

"proxy: missing or failed auth to %s",

apr_uri_unparse(r->pool,

&r->parsed_uri, APR_URI_UNP_OMITPATHINFO));

apr_table_setn(r->err_headers_out, "WWW-Authenticate",

apr_pstrcat(r->pool, "Basic realm=\"",

apr_uri_unparse(r->pool, &r->parsed_uri,

APR_URI_UNP_OMITPASSWORD | APR_URI_UNP_OMITPATHINFO),

"\"", NULL));

return HTTP_UNAUTHORIZED;

}

int ap_proxy_ftp_handler(request_rec *r, proxy_server_conf *conf,

char *url, const char *proxyhost,

apr_port_t proxyport)

{

apr_pool_t *p = r->pool;

conn_rec *c = r->connection;

proxy_conn_rec *backend;

apr_socket_t *sock, *local_sock, *data_sock = NULL;

apr_sockaddr_t *connect_addr;

apr_status_t rv;

conn_rec *origin, *data = NULL;

int err;

apr_bucket_brigade *bb = apr_brigade_create(p);

char *buf, *connectname;

apr_port_t connectport;

char buffer[MAX_STRING_LEN];

char *ftpmessage = NULL;

char *path, *strp, *type_suffix, *cwd = NULL;

char *user = NULL;

const char *password = NULL;

int len, rc;

int one = 1;

char *size = NULL;

apr_socket_t *origin_sock = NULL;

char xfer_type = 'A'; /* after ftp login, the default is ASCII */

int dirlisting = 0;

#if defined(USE_MDTM) && (defined(HAVE_TIMEGM) || defined(HAVE_GMTOFF))

apr_time_t mtime = 0L;

#endif

/* stuff for PASV mode */

int connect = 0, use_port = 0;

char dates[AP_RFC822_DATE_LEN];

/* is this for us? */

if (proxyhost) {

ap_log_error(APLOG_MARK, APLOG_DEBUG | APLOG_NOERRNO, 0, r->server,

"proxy: FTP: declining URL %s - proxyhost %s specified:", url, proxyhost);

return DECLINED; /* proxy connections are via HTTP */

}

if (strncasecmp(url, "ftp:", 4)) {

ap_log_error(APLOG_MARK, APLOG_DEBUG | APLOG_NOERRNO, 0, r->server,

"proxy: FTP: declining URL %s - not ftp:", url);

return DECLINED; /* only interested in FTP */

}

ap_log_error(APLOG_MARK, APLOG_DEBUG | APLOG_NOERRNO, 0, r->server,

"proxy: FTP: serving URL %s", url);

/* create space for state information */

backend = (proxy_conn_rec *) ap_get_module_config(c->conn_config, &proxy_ftp_module);

if (!backend) {

backend = ap_pcalloc(c->pool, sizeof(proxy_conn_rec));

backend->connection = NULL;

backend->hostname = NULL;

backend->port = 0;

ap_set_module_config(c->conn_config, &proxy_ftp_module, backend);

}

if (backend->connection)

origin_sock = ap_get_module_config(backend->connection->conn_config, &core_module);

/*

/* we only support GET and HEAD */

if (r->method_number != M_GET)

return HTTP_NOT_IMPLEMENTED;

/* We break the URL into host, port, path-search */

connectname = r->parsed_uri.hostname;

connectport = (r->parsed_uri.port != 0)

? r->parsed_uri.port

: apr_uri_default_port_for_scheme("ftp");

path = apr_pstrdup(p, r->parsed_uri.path);

path = (path != NULL && path[0] != '\0') ? &path[1] : "";

type_suffix = strchr(path, ';');

if (type_suffix != NULL)

*(type_suffix++) = '\0';

if (type_suffix != NULL && strncmp(type_suffix, "type=", 5) == 0

&& ap_isalpha(type_suffix[5])) {

/* "type=d" forces a dir listing.

if ( ! (dirlisting = (ap_tolower(type_suffix[5]) == 'd')))

xfer_type = ap_toupper(type_suffix[5]);

/* Check valid types, rather than ignoring invalid types silently: */

if (strchr("AEI", xfer_type) == NULL)

return ap_proxyerror(r, HTTP_BAD_REQUEST, apr_pstrcat(r->pool,

"ftp proxy supports only types 'a', 'i', or 'e': \"",

type_suffix, "\" is invalid.", NULL));

}

else {

/* make binary transfers the default */

xfer_type = 'I';

}

/*

if ((password = apr_table_get(r->headers_in, "Authorization")) != NULL

&& strcasecmp(ap_getword(r->pool, &password, ' '), "Basic") == 0

&& (password = ap_pbase64decode(r->pool, password))[0] != ':') {

/*

user = ap_getword_nulls(r->connection->pool, &password, ':');

r->ap_auth_type = "Basic";

r->user = r->parsed_uri.user = user;

}

else if ((user = r->parsed_uri.user) != NULL) {

user = apr_pstrdup(p, user);

decodeenc(user);

if ((password = r->parsed_uri.password) != NULL) {

char *tmp = apr_pstrdup(p, password);

decodeenc(tmp);

password = tmp;

}

}

else {

user = "anonymous";

password = "apache-proxy@";

}

ap_log_error(APLOG_MARK, APLOG_DEBUG | APLOG_NOERRNO, 0, r->server,

"proxy: FTP: connecting %s to %s:%d", url, connectname, connectport);

/* do a DNS lookup for the destination host */

err = apr_sockaddr_info_get(&connect_addr, connectname, APR_UNSPEC, connectport, 0, p);

/* check if ProxyBlock directive on this host */

if (OK != ap_proxy_checkproxyblock(r, conf, connect_addr)) {

return ap_proxyerror(r, HTTP_FORBIDDEN,

"Connect to remote machine blocked");

}

/*

/*

if (APR_SUCCESS != err) {

return ap_proxyerror(r, HTTP_BAD_GATEWAY, apr_pstrcat(p,

"DNS lookup failure for: ",

connectname, NULL));

}

if ((rv = apr_socket_create(&sock, APR_INET, SOCK_STREAM, r->pool)) != APR_SUCCESS) {

ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,

"proxy: FTP: error creating socket");

return HTTP_INTERNAL_SERVER_ERROR;

}

#if !defined(TPF) && !defined(BEOS)

if (conf->recv_buffer_size > 0

&& (rv = apr_setsocketopt(sock, APR_SO_RCVBUF,

conf->recv_buffer_size))) {

ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,

"setsockopt(SO_RCVBUF): Failed to set ProxyReceiveBufferSize, using default");

}

#endif

if (APR_SUCCESS != (rv = apr_setsocketopt(sock, APR_SO_REUSEADDR, one))) {

#ifndef _OSD_POSIX /* BS2000 has this option "always on" */

ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,

"proxy: FTP: error setting reuseaddr option: setsockopt(SO_REUSEADDR)");

return HTTP_INTERNAL_SERVER_ERROR;

#endif /* _OSD_POSIX */

}

/* Set a timeout on the socket */

if (conf->timeout_set == 1) {

apr_setsocketopt(sock,

APR_SO_TIMEOUT,

(int)(conf->timeout * APR_USEC_PER_SEC));

}

else {

apr_setsocketopt(sock,

APR_SO_TIMEOUT,

(int)(r->server->timeout * APR_USEC_PER_SEC));

}

ap_log_error(APLOG_MARK, APLOG_DEBUG | APLOG_NOERRNO, 0, r->server,

"proxy: FTP: socket has been created");

/*

/* try each IP address until we connect successfully */

{

int failed = 1;

while (connect_addr) {

/* FIXME: @@@: We created an APR_INET socket. Now there may be

ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r->server,

"proxy: FTP: trying to connect to %pI (%s)...", connect_addr, connectname);

/* make the connection out of the socket */

rv = apr_connect(sock, connect_addr);

/* if an error occurred, loop round and try again */

if (rv != APR_SUCCESS) {

ap_log_error(APLOG_MARK, APLOG_ERR, rv, r->server,

"proxy: FTP: attempt to connect to %pI (%s) failed", connect_addr, connectname);

connect_addr = connect_addr->next;

continue;

}

/* if we get here, all is well */

failed = 0;

break;

}

/* handle a permanent error from the above loop */

if (failed) {

return ap_proxyerror(r, HTTP_BAD_GATEWAY, apr_psprintf(r->pool,

"Could not connect to remote machine: %s port %d",

connectname, connectport));

}

}

/* the socket is now open, create a new connection */

origin = ap_run_create_connection(p, r->server, sock, r->connection->id, r->connection->sbh);

if (!origin) {

/*

ap_log_error(APLOG_MARK, APLOG_DEBUG | APLOG_NOERRNO, 0, r->server,

"proxy: FTP: an error occurred creating a new connection to %pI (%s)", connect_addr, connectname);

return HTTP_INTERNAL_SERVER_ERROR;

}

/* if a keepalive connection is floating around, close it first! */

/* we might support ftp keepalives later, but not now... */

if (backend->connection) {

apr_socket_close(origin_sock);

backend->connection = NULL;

origin_sock = NULL;

}

ap_log_error(APLOG_MARK, APLOG_DEBUG | APLOG_NOERRNO, 0, r->server,

"proxy: FTP: control connection complete");

/*

/* set up the connection filters */

ap_run_pre_connection(origin, sock);

/* possible results: */

/* 120 Service ready in nnn minutes. */

/* 220 Service ready for new user. */

/* 421 Service not available, closing control connection. */

rc = proxy_ftp_command(NULL, r, origin, bb, &ftpmessage);

if (rc == -1 || rc == 421) {

return ap_proxyerror(r, HTTP_BAD_GATEWAY, "Error reading from remote server");

}

if (rc == 120) {

/*

char *secs_str = ftpmessage;

time_t secs;

/* Look for a number, preceded by whitespace */

while (*secs_str)

if ((secs_str==ftpmessage || apr_isspace(secs_str[-1])) &&

apr_isdigit(secs_str[0]))

break;

if (*secs_str != '\0') {

secs = atol(secs_str);

ap_table_add(r->headers_out, "Retry-After",

apr_psprintf(p, "%lu", (unsigned long)(60 * secs)));

}

return ap_proxyerror(r, HTTP_SERVICE_UNAVAILABLE, ftpmessage);

}

if (rc != 220) {

return ap_proxyerror(r, HTTP_BAD_GATEWAY, ftpmessage);

}

rc = proxy_ftp_command(apr_pstrcat(p, "USER ", user, CRLF, NULL),

r, origin, bb, &ftpmessage);

/* possible results; 230, 331, 332, 421, 500, 501, 530 */

/* states: 1 - error, 2 - success; 3 - send password, 4,5 fail */

/* 230 User logged in, proceed. */

/* 331 User name okay, need password. */

/* 332 Need account for login. */

/* 421 Service not available, closing control connection. */

/* 500 Syntax error, command unrecognized. */

/* (This may include errors such as command line too long.) */

/* 501 Syntax error in parameters or arguments. */

/* 530 Not logged in. */

if (rc == -1 || rc == 421) {

return ap_proxyerror(r, HTTP_BAD_GATEWAY, "Error reading from remote server");

}

if (rc == 530) {

return ftp_unauthorized(r, 1); /* log it: user name guessing

}

if (rc != 230 && rc != 331) {

return ap_proxyerror(r, HTTP_BAD_GATEWAY, ftpmessage);

}

if (rc == 331) { /* send password */

if (password == NULL) {

return ftp_unauthorized(r, 0);

}

rc = proxy_ftp_command(apr_pstrcat(p, "PASS ", password, CRLF, NULL),

r, origin, bb, &ftpmessage);

/* possible results 202, 230, 332, 421, 500, 501, 503, 530 */

/* 230 User logged in, proceed. */

/* 332 Need account for login. */

/* 421 Service not available, closing control connection. */

/* 500 Syntax error, command unrecognized. */

/* 501 Syntax error in parameters or arguments. */

/* 503 Bad sequence of commands. */

/* 530 Not logged in. */

if (rc == -1 || rc == 421) {

return ap_proxyerror(r, HTTP_BAD_GATEWAY,

"Error reading from remote server");

}

if (rc == 332) {

return ap_proxyerror(r, HTTP_UNAUTHORIZED,

apr_pstrcat(p, "Need account for login: ", ftpmessage, NULL));

}

/* @@@ questionable -- we might as well return a 403 Forbidden here */

if (rc == 530) {

return ftp_unauthorized(r, 1); /* log it: passwd guessing

}

if (rc != 230 && rc != 202) {

return ap_proxyerror(r, HTTP_BAD_GATEWAY, ftpmessage);

}

}

apr_table_set(r->notes, "Directory-README", ftpmessage);

/* Special handling for leading "%2f": this enforces a "cwd /"

if (strncasecmp(path, "%2f", 3) == 0) {

path += 3;

while (*path == '/') /* skip leading '/' (after root %2f) */

++path;

rc = proxy_ftp_command("CWD /" CRLF, r, origin, bb, &ftpmessage);

if (rc == -1 || rc == 421)

return ap_proxyerror(r, HTTP_BAD_GATEWAY,

"Error reading from remote server");

}

/*

for (;;) {

strp = strchr(path, '/');

if (strp == NULL)

break;

*strp = '\0';

len = decodeenc(path); /* Note! This decodes a %2f -> "/" */

if (strchr(path, '/')) { /* are there now any '/' characters? */

return ap_proxyerror(r, HTTP_BAD_REQUEST,

"Use of /%2f is only allowed at the base directory");

}

/* NOTE: FTP servers do globbing on the path.

rc = proxy_ftp_command(apr_pstrcat(p, "CWD ",

ftp_escape_globbingchars(p, path), CRLF, NULL),

r, origin, bb, &ftpmessage);

*strp = '/';

/* responses: 250, 421, 500, 501, 502, 530, 550 */

/* 250 Requested file action okay, completed. */

/* 421 Service not available, closing control connection. */

/* 500 Syntax error, command unrecognized. */

/* 501 Syntax error in parameters or arguments. */

/* 502 Command not implemented. */

/* 530 Not logged in. */

/* 550 Requested action not taken. */

if (rc == -1 || rc == 421) {

return ap_proxyerror(r, HTTP_BAD_GATEWAY,

"Error reading from remote server");

}

if (rc == 550) {

return ap_proxyerror(r, HTTP_NOT_FOUND, ftpmessage);

}

if (rc != 250) {

return ap_proxyerror(r, HTTP_BAD_GATEWAY, ftpmessage);

}

path = strp + 1;

}

/*

/* set up data connection - EPSV */

{

apr_sockaddr_t *data_addr;

char *data_ip;

apr_port_t data_port;

/*

rc = proxy_ftp_command("EPSV" CRLF,

r, origin, bb, &ftpmessage);

/* possible results: 227, 421, 500, 501, 502, 530 */

/* 227 Entering Passive Mode (h1,h2,h3,h4,p1,p2). */

/* 421 Service not available, closing control connection. */

/* 500 Syntax error, command unrecognized. */

/* 501 Syntax error in parameters or arguments. */

/* 502 Command not implemented. */

/* 530 Not logged in. */

if (rc == -1 || rc == 421) {

return ap_proxyerror(r, HTTP_BAD_GATEWAY,

"Error reading from remote server");

}

if (rc != 229 && rc != 500 && rc != 501 && rc != 502) {

return ap_proxyerror(r, HTTP_BAD_GATEWAY, ftpmessage);

}

else if (rc == 229) {

char *pstr;

char *tok_cntx;

pstr = ftpmessage;

pstr = apr_strtok(pstr, " ", &tok_cntx); /* separate result code */

if (pstr != NULL) {

if (*(pstr + strlen(pstr) + 1) == '=') {

pstr += strlen(pstr) + 2;

}

else {

pstr = apr_strtok(NULL, "(", &tok_cntx); /* separate address &

if (pstr != NULL)

pstr = apr_strtok(NULL, ")", &tok_cntx);

}

}

if (pstr) {

apr_sockaddr_t *epsv_addr;

data_port = atoi(pstr + 3);

ap_log_error(APLOG_MARK, APLOG_DEBUG | APLOG_NOERRNO, 0, r->server,

"proxy: FTP: EPSV contacting remote host on port %d",

data_port);

if ((rv = apr_socket_create(&data_sock, APR_INET, SOCK_STREAM, r->pool)) != APR_SUCCESS) {

ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,

"proxy: FTP: error creating EPSV socket");

return HTTP_INTERNAL_SERVER_ERROR;

}

#if !defined (TPF) && !defined(BEOS)

if (conf->recv_buffer_size > 0 && (rv = apr_setsocketopt(data_sock, APR_SO_RCVBUF,

conf->recv_buffer_size))) {

ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,

"proxy: FTP: setsockopt(SO_RCVBUF): Failed to set ProxyReceiveBufferSize, using default");

}

#endif

/* make the connection */

apr_socket_addr_get(&data_addr, APR_REMOTE, sock);

apr_sockaddr_ip_get(&data_ip, data_addr);

apr_sockaddr_info_get(&epsv_addr, data_ip, APR_INET, data_port, 0, p);

rv = apr_connect(data_sock, epsv_addr);

if (rv != APR_SUCCESS) {

ap_log_error(APLOG_MARK, APLOG_ERR, rv, r->server,

"proxy: FTP: EPSV attempt to connect to %pI failed - Firewall/NAT?", epsv_addr);

return ap_proxyerror(r, HTTP_BAD_GATEWAY, apr_psprintf(r->pool,

"EPSV attempt to connect to %pI failed - firewall/NAT?", epsv_addr));

}

else {

connect = 1;

}

}

else {

/* and try the regular way */

apr_socket_close(data_sock);

}

}

}

/* set up data connection - PASV */

if (!connect) {

rc = proxy_ftp_command("PASV" CRLF,

r, origin, bb, &ftpmessage);

/* possible results: 227, 421, 500, 501, 502, 530 */

/* 227 Entering Passive Mode (h1,h2,h3,h4,p1,p2). */

/* 421 Service not available, closing control connection. */

/* 500 Syntax error, command unrecognized. */

/* 501 Syntax error in parameters or arguments. */

/* 502 Command not implemented. */

/* 530 Not logged in. */

if (rc == -1 || rc == 421) {