archive/revsuit
1
0
Fork 0
mirror of https://github.com/Li4n0/revsuit.git synced 2026-09-26 08:31:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ftp): support upload, download and PASV rebind (#13)

Browse Source 
Co-authored-by: E99p1ant <[email protected]>
This commit is contained in:
Li4n0
2021-05-05 12:59:50 +08:00
committed by GitHub
co-authored by E99p1ant
parent 3d8507e682
commit b39ee101f9
15 changed files with 374 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/ftp/ftp.go
+185 -67
View File
@@ -3,6 +3,8 @@ package ftp
import (
"bytes"
"fmt"
"go/types"
"io"
"net"
"strconv"
"strings"
@@ -10,16 +12,19 @@ import (
"time"
"github.com/li4n0/revsuit/internal/database"
"github.com/li4n0/revsuit/internal/file"
"github.com/li4n0/revsuit/internal/qqwry"
"github.com/li4n0/revsuit/internal/recycler"
"github.com/li4n0/revsuit/internal/rule"
"github.com/patrickmn/go-cache"
log "unknwon.dev/clog/v2"
)
type Server struct {
Config
rules []*Rule
rulesLock sync.RWMutex
rules []*Rule
rulesLock sync.RWMutex
dataChannel chan map[string]interface{}
}
type Status string
@@ -29,14 +34,22 @@ const (
FINISHED Status = "FINISHED"
)
type Method = string
const (
DOWNLOAD Method = "DOWNLOAD"
UPLOAD Method = "UPLOAD"
)
var (
server *Server
once sync.Once
server *Server
once sync.Once
rebindingCache = cache.New(5*time.Second, 10*time.Second)
)
func GetServer() *Server {
once.Do(func() {
server = &Server{rulesLock: sync.RWMutex{}}
server = &Server{rulesLock: sync.RWMutex{}, dataChannel: make(chan map[string]interface{}, 10)}
})
return server
}
@@ -54,7 +67,40 @@ func (s *Server) updateRules() error {
return db.Order("rank desc").Find(&s.rules).Error
}
func (s *Server) authenticate(user, password string) (_rule *Rule, flag, flagGroup string, vars map[string]string) {
for _, _rule := range s.getRules() {
for _, s := range []string{user, password} {
flag, flagGroup, vars = _rule.Match(s)
if flag != "" {
vars["user"] = user
vars["password"] = password
return _rule, flag, flagGroup, vars
}
}
}
return _rule, flag, flagGroup, vars
}
func (s *Server) getPasvAddressFromCache(ip, pasvAddressTpl string) (pasvAddress string) {
if strings.Contains(pasvAddressTpl, ",") {
values, ok := rebindingCache.Get(ip)
if !ok {
rebindingCache.Set(ip, strings.Split(pasvAddressTpl, ","), cache.DefaultExpiration)
values = strings.Split(pasvAddressTpl, ",")
}
//Choose and delete first address
pasvAddress = values.([]string)[0]
if len(values.([]string)) > 1 {
rebindingCache.Set(ip, values.([]string)[1:len(values.([]string))], cache.DefaultExpiration)
} else {
rebindingCache.Delete(ip)
}
}
return pasvAddress
}
func (s *Server) handleConnection(conn net.Conn) {
log.Trace("New FTP connection from addr [%s]", conn.RemoteAddr())
defer func() {
_ = conn.Close()
if err := recover(); err != nil {
@@ -70,13 +116,18 @@ func (s *Server) handleConnection(conn net.Conn) {
log.Warn("FTP write connection error:%v", err)
}
ip := strings.Split(conn.RemoteAddr().String(), ":")[0]
ip, port, _ := net.SplitHostPort(conn.RemoteAddr().String())
dataPort, _ := strconv.Atoi(port)
clientPasvConnAddress := fmt.Sprintf("%s:%d", ip, dataPort+1)
buf := &bytes.Buffer{}
var user, password, path, flag, flagGroup string
var user, password, method, flag, flagGroup, pasvAddress, filename string
status := CRASHED
var matchedRule *Rule
path := "/"
uploadData := make([]byte, 0)
var _rule *Rule
var vars map[string]string
var isRedirect bool
loop:
for {
@@ -88,81 +139,125 @@ loop:
buf.Write(data[:n])
if buf.Len() > 4 {
cmd := string(buf.Bytes()[:4])
frags := strings.SplitN(strings.TrimRight(buf.String(), "\r\n"), " ", 2)
var cmd = frags[0]
var args string
if len(frags) > 1 {
args = frags[1]
}
log.Trace("FTP connection[%s] exec command: %s", conn.RemoteAddr(), strings.TrimRight(buf.String(), "\r\n"))
if _rule == nil && cmd != "USER" && cmd != "PASS" {
_, _ = conn.Write([]byte("332 Need account for login.\r\n"))
break loop
}
switch cmd {
case "USER":
user = strings.TrimRight(string(buf.Bytes()[5:]), "\r\n")
user = args
_, _ = conn.Write([]byte("331 password please - version check\r\n"))
case "PASS":
password = strings.TrimRight(string(buf.Bytes()[5:]), "\r\n")
_, _ = conn.Write([]byte("230 User logged in\r\n"))
for _, _rule := range s.getRules() {
for _, s := range []string{user, password} {
flag, flagGroup, vars = _rule.Match(s)
if flag != "" {
vars["user"] = user
vars["password"] = password
break
}
}
if flag == "" {
continue
}
matchedRule = _rule
password = args
if _rule, flag, flagGroup, vars = s.authenticate(user, password); _rule == nil {
_, _ = conn.Write([]byte("331 please specify the password\r\n"))
break loop
}
case "QUIT":
_, _ = conn.Write([]byte("221 Goodbye.\r\n"))
case "RETR":
path += "/" + strings.TrimRight(string(buf.Bytes()[5:]), "\r\n")
_, _ = conn.Write([]byte("451 Nope\r\n"))
_, _ = conn.Write([]byte("221 Goodbye.\r\n"))
status = FINISHED
break loop
log.Trace("FTP connection[%s] matched rule[rule_name: %s, flag: %s]", conn.RemoteAddr(), _rule.Name, flag)
_, _ = conn.Write([]byte("230 User logged in\r\n"))
if pasvAddress = s.getPasvAddressFromCache(ip, _rule.PasvAddress); pasvAddress == "" {
pasvAddress = fmt.Sprintf("%s:%d", s.PasvIP, s.PasvPort)
}
isRedirect = rule.CompileTpl(pasvAddress, vars) != fmt.Sprintf("%s:%d", s.PasvIP, s.PasvPort)
case "SIZE":
path += strings.TrimLeft(args, "/")
if _rule == nil || isRedirect || len(_rule.Data) == 0 {
_, _ = conn.Write([]byte(fmt.Sprintf("550 %s: No such file or directory.\r\n", args)))
break
}
_, _ = conn.Write([]byte(fmt.Sprintf("213 %d\r\n", len(_rule.Data))))
case "EPSV", "EPRT", "PORT":
// refuse to use EPSV/EPRT/PORT in order to make the client to use PASV mode.
_, _ = conn.Write([]byte(fmt.Sprintf("500 '%s': command not understood.\r\n", cmd)))
case "PASV":
// return rule's pasv_address or default pasv address
ret := fmt.Sprintf("227 Entering Passive Mode (%s,%v,%d)\r\n", strings.ReplaceAll(s.PasvIP, ".", ","), float64(s.PasvPort/256), s.PasvPort%256)
if matchedRule != nil && matchedRule.PasvAddress != "" {
pasvAddress := rule.CompileTpl(matchedRule.PasvAddress, vars)
//Just so that ide does not prompt that there may be a nil value
if _rule != nil {
// return rule's pasv_address or default pasv address
pasvAddress := rule.CompileTpl(pasvAddress, vars)
pasvIP, pasvPort, err := net.SplitHostPort(pasvAddress)
if err != nil {
log.Warn("FTP failed to split rule[id%d] pasv_address(%s) :%s", matchedRule.ID, pasvAddress, err)
log.Warn("FTP failed to split rule[id%d] pasv_address(%s) :%s", _rule.ID, pasvAddress, err)
break
}
port, err := strconv.Atoi(pasvPort)
if err != nil {
log.Warn("FTP failed to convert rule[id%d] pasv_port(%s) :%s", matchedRule.ID, pasvPort, err)
log.Warn("FTP failed to convert rule[id%d] pasv_port(%s) :%s", _rule.ID, pasvPort, err)
break
}
ret = fmt.Sprintf("227 Entering Passive Mode (%s,%v,%d)\r\n", strings.ReplaceAll(pasvIP, ".", ","), float64(port/256), port%256)
ret := fmt.Sprintf("227 Entering Passive Mode (%s,%v,%d)\r\n", strings.ReplaceAll(pasvIP, ".", ","), float64(port/256), port%256)
_, _ = conn.Write([]byte(ret))
if isRedirect {
log.Trace("FTP connection[%s] will be redirect[pasv_address: %s]", conn.RemoteAddr(), pasvAddress)
}
}
_, _ = conn.Write([]byte(ret))
case "RETR":
//Just so that ide does not prompt that there may be a nil value
if _rule != nil {
filename = args
method = DOWNLOAD
//send data to client
_, _ = conn.Write([]byte(fmt.Sprintf("150 Opening BINARY mode data connection for '%s' (%d bytes).\r\n", filename, len(_rule.Data))))
s.dataChannel <- map[string]interface{}{clientPasvConnAddress: []byte(rule.CompileTpl(_rule.Data, vars))}
_, _ = conn.Write([]byte("226 Transfer complete.\r\n"))
}
case "STOR":
filename = args
method = UPLOAD
_, _ = conn.Write([]byte(fmt.Sprintf("150 Opening BINARY mode data connection for '%s'.\r\n", filename)))
//only could read data send to local pasv server.
if !isRedirect {
dataChannel := make(chan []byte)
s.dataChannel <- map[string]interface{}{clientPasvConnAddress: dataChannel}
uploadData = <-dataChannel
log.Trace("FTP connection[%s] uploaded %d bytes", conn.RemoteAddr(), len(uploadData))
}
_, _ = conn.Write([]byte("226 Transfer complete.\r\n"))
case "QUIT":
_, _ = conn.Write([]byte("221 Goodbye.\r\n"))
status = FINISHED
break loop
case "CWD":
_, _ = conn.Write([]byte("250 Directory successfully changed.\r\n"))
path += strings.TrimRight(args, "\r\n") + "/"
case "PWD":
_, _ = conn.Write([]byte(fmt.Sprintf("257 \"%s\" is the current directory\r\n", path)))
default:
cmd = string(buf.Bytes()[:3])
if cmd == "CWD" {
_, _ = conn.Write([]byte("250 Directory successfully changed.\r\n"))
path += "/" + strings.TrimRight(string(buf.Bytes()[4:]), "\r\n")
} else if cmd == "PWD" {
_, _ = conn.Write([]byte("257 \"/\" is the current directory\r\n"))
} else {
_, _ = conn.Write([]byte("230 more data please!\r\n"))
}
_, _ = conn.Write([]byte("230 more data please!\r\n"))
}
}
buf = &bytes.Buffer{}
}
if matchedRule != nil {
_rule := matchedRule
if _rule != nil {
area := qqwry.Area(ip)
var r *Record
var err error
// create new record
r, err := NewRecord(_rule, flag, user, password, path, ip, area, status)
ftpFile := &file.FTPFile{}
if len(uploadData) != 0 {
ftpFile = &file.FTPFile{
Name: filename,
Content: uploadData,
}
}
r, err = NewRecord(_rule, flag, user, password, method, path, ip, area, ftpFile, status)
if err != nil {
log.Warn("FTP record[rule_id:%d] created failed :%s", _rule.ID, err)
return
@@ -193,19 +288,35 @@ loop:
}
}
func (s *Server) handlePasvConnection(conn net.Conn, data map[string]interface{}) {
remoteAddress := conn.RemoteAddr().String()
switch v := data[remoteAddress].(type) {
case types.Nil:
s.dataChannel <- data
return
case []byte:
_, err := conn.Write(v)
if err != nil {
log.Warn("FTP PASV server sent data to connection[%s] failed with error: %s", remoteAddress, err)
}
log.Trace("FTP PASV server has sent data to connection[%s]", remoteAddress)
case chan []byte:
buf, err := io.ReadAll(conn)
if err != nil {
log.Warn("FTP PASV server received data from connection[%s] failed with error: %s", remoteAddress, err)
}
v <- buf
log.Trace("FTP PASV server has received data from connection[%s]", remoteAddress)
}
_ = conn.Close()
}
func (s *Server) Run() {
if err := s.updateRules(); err != nil {
log.Fatal(err.Error())
}
// run server
log.Info("Starting FTP Server at %v", s.Addr)
listener, err := net.Listen("tcp", s.Addr)
if err != nil {
log.Fatal(err.Error())
}
// run pasv server
go func() {
pasvAddress := fmt.Sprintf("%s:%d", strings.Split(s.Addr, ":")[0], s.PasvPort)
log.Info("Start to listen FTP PASV port at %v", pasvAddress)
@@ -213,16 +324,23 @@ func (s *Server) Run() {
if err != nil {
log.Fatal("FTP failed to listen on pasv port : %v", err)
}
for {
for data := range s.dataChannel {
tcpConn, err := listener.Accept()
if err != nil {
log.Warn("FTP accept connection error: %v", err)
continue
}
_ = tcpConn.Close()
s.handlePasvConnection(tcpConn, data)
}
}()
// run ftp server
log.Info("Starting FTP Server at %v", s.Addr)
listener, err := net.Listen("tcp", s.Addr)
if err != nil {
log.Fatal(err.Error())
}
for {
tcpConn, err := listener.Accept()
if err != nil {