Subject: adapating ftp-proxy to ipfilter
To: None <tech-net@netbsd.org>
From: Darren Reed <avalon@caligula.anu.edu.au>
List: tech-net
Date: 06/29/2004 17:49:21
I've adapted the ftp-proxy program to work with both ipfilter & pf.
The main change is it requires either a -i or -p command line option
to tell it which it is expected to interact with.  The main change
as far as code organisation was to move the NAT interaction code out
of util.c and into a firewall specific files.

With the changes, I've added comments in various places (and some
#if 0'd code) that place holders for code to enable fully transparent
proxying - only of use when you're doing the FTP proxy thing for
hosts that are not using private network addresses.  i.e. what
you get if you had an ipnat rule like this:

map pppoe0 0/0 -> 0/0 proxy port ftp ftp/tcp

Anyway, if it's not appropriate to have this kind of stuff committed,
I can easily take it out.

In case anyone is curious about why is ipfilter stuff always before
pf, well i comes before p in the alphabet and that's a natural way
to list/sort.

There's just one other thing I'll address (mainly because it really
pissed me off) and that's code copyright.  The ipf.c file has only
a TNF copyright and no mention of Obtuse even though the code is
similar.  Why?  Well, I think they copied code I wrote and didn't
credit me - look at samples/proxy.c in any ipfilter distribution.
I've looked and can find no evidence that this was supplied from an
outside party. 

The man page has been updated appropriately.  Details (no diffs):
http://coombs.anu.edu.au/~avalon/ftpstuff.tgz

I plan on committing this, as is, sometime in the next day or so.

Darren