bin/71490: ftp-proxy or rdr@pf not working

[Divacky Roman]

>Number:         71490
>Category:       bin
>Synopsis:       ftp-proxy or rdr at pf not working
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Sep 08 10:40:24 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Divacky Roman
>Release:        FreeBSD 5.3-BETA3 i386
>Organization:
home
>Environment:
FreeBSD queeg500 5.3-BETA3 FreeBSD 5.3-BETA3 #5: Tue Sep  7 13:01:38 CEST 2004
   rdivacky at queeg500:/usr/obj/usr/src/sys/QUEEG  i386


	
>Description:
I've got following problem
with this pf.conf
ext_if="vr0"
int_if="xl0"

#normalize packets
scrub in all

altq on $ext_if bandwidth 256Kb cbq queue {ssh_i web other} 
queue ssh_i bandwidth 25% cbq(borrow ecn)
queue web bandwidth 25% cbq(borrow ecn)
queue other bandwidth 50% cbq(borrow default ecn)

#nat
nat on $ext_if from $int_if:network to any -> ($ext_if)
#ftp redirection
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021

#rules
#default to block all
#block in on $ext_if all
#pass all out while keeping state. and queue it
pass out on $ext_if from any to any keep state queue other
#queuing
pass on $ext_if proto tcp from any to any port ssh keep state queue(ssh_i, other)
pass out on $ext_if proto tcp from any to any port http keep state queue web
#ftp proxy
pass in on $ext_if inet proto tcp from any to any user proxy keep state queue other
#allow icmp
pass in on $ext_if inet proto icmp from any to any

(notice that its in fact pass all configuration)
and properly configured inetd to run ftp-proxy I tried to debug inetd
it waited in this
574                 if ((n = select(maxsock + 1, &readable, (fd_set *)0,
(gdb)

then I on the machine behind nat issued ftp command... the select stayed the
same (ie. no packets arrived) and in pfctl -sa I found this:
STATES:
self tcp 127.0.0.1:8021 <- 195.113.15.29:21 <- 10.0.0.2:60059 CLOSED:SYN_SENT
so the connection was established but then died for an unknown reason

so I suppose there's something rotten in pf/ftp-proxy... (since the
configuration is correct)

the fbsd in question is 6-current as of:
witten inetd# uname -a
FreeBSD witten 6.0-CURRENT FreeBSD 6.0-CURRENT #123: Mon Sep  6 15:42:35 CEST
2004     root at witten:/usr/obj/usr/src/sys/NEOLOGISM  i386

but I also got it on releng_5

simply said ftp-proxy (used to provide ftp access to outer ftp for machines
behind nat) doesnt work (at least for me)

thnx for looking at it

>How-To-Repeat:
try to set up ftp-proxy using my pf.conf and use the ftp from machines behind
the nat...

>Fix:

I am not aware of any fix

>Release-Note:
>Audit-Trail:
>Unformatted: