diff options
author | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2006-12-03 01:07:44 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2006-12-03 01:07:44 -0500 |
commit | 55a733247d6d2883d9bb77825fafac3dfca13fc2 (patch) | |
tree | e16357243c80ca11fe84639fc84f92e653eb3079 /net/ipv4/netfilter/nf_nat_ftp.c | |
parent | 5b1158e909ecbe1a052203e0d8df15633f829930 (diff) |
[NETFILTER]: nf_nat: add FTP NAT helper port
Add FTP NAT helper.
Split out from Jozsef's big nf_nat patch with a few small fixes by myself.
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/netfilter/nf_nat_ftp.c')
-rw-r--r-- | net/ipv4/netfilter/nf_nat_ftp.c | 179 |
1 files changed, 179 insertions, 0 deletions
diff --git a/net/ipv4/netfilter/nf_nat_ftp.c b/net/ipv4/netfilter/nf_nat_ftp.c new file mode 100644 index 00000000000..751b5980175 --- /dev/null +++ b/net/ipv4/netfilter/nf_nat_ftp.c | |||
@@ -0,0 +1,179 @@ | |||
1 | /* FTP extension for TCP NAT alteration. */ | ||
2 | |||
3 | /* (C) 1999-2001 Paul `Rusty' Russell | ||
4 | * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License version 2 as | ||
8 | * published by the Free Software Foundation. | ||
9 | */ | ||
10 | |||
11 | #include <linux/module.h> | ||
12 | #include <linux/moduleparam.h> | ||
13 | #include <linux/ip.h> | ||
14 | #include <linux/tcp.h> | ||
15 | #include <linux/netfilter_ipv4.h> | ||
16 | #include <net/netfilter/nf_nat.h> | ||
17 | #include <net/netfilter/nf_nat_helper.h> | ||
18 | #include <net/netfilter/nf_nat_rule.h> | ||
19 | #include <net/netfilter/nf_conntrack_helper.h> | ||
20 | #include <net/netfilter/nf_conntrack_expect.h> | ||
21 | #include <linux/netfilter/nf_conntrack_ftp.h> | ||
22 | |||
23 | MODULE_LICENSE("GPL"); | ||
24 | MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>"); | ||
25 | MODULE_DESCRIPTION("ftp NAT helper"); | ||
26 | MODULE_ALIAS("ip_nat_ftp"); | ||
27 | |||
28 | #if 0 | ||
29 | #define DEBUGP printk | ||
30 | #else | ||
31 | #define DEBUGP(format, args...) | ||
32 | #endif | ||
33 | |||
34 | /* FIXME: Time out? --RR */ | ||
35 | |||
36 | static int | ||
37 | mangle_rfc959_packet(struct sk_buff **pskb, | ||
38 | __be32 newip, | ||
39 | u_int16_t port, | ||
40 | unsigned int matchoff, | ||
41 | unsigned int matchlen, | ||
42 | struct nf_conn *ct, | ||
43 | enum ip_conntrack_info ctinfo, | ||
44 | u32 *seq) | ||
45 | { | ||
46 | char buffer[sizeof("nnn,nnn,nnn,nnn,nnn,nnn")]; | ||
47 | |||
48 | sprintf(buffer, "%u,%u,%u,%u,%u,%u", | ||
49 | NIPQUAD(newip), port>>8, port&0xFF); | ||
50 | |||
51 | DEBUGP("calling nf_nat_mangle_tcp_packet\n"); | ||
52 | |||
53 | *seq += strlen(buffer) - matchlen; | ||
54 | return nf_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff, | ||
55 | matchlen, buffer, strlen(buffer)); | ||
56 | } | ||
57 | |||
58 | /* |1|132.235.1.2|6275| */ | ||
59 | static int | ||
60 | mangle_eprt_packet(struct sk_buff **pskb, | ||
61 | __be32 newip, | ||
62 | u_int16_t port, | ||
63 | unsigned int matchoff, | ||
64 | unsigned int matchlen, | ||
65 | struct nf_conn *ct, | ||
66 | enum ip_conntrack_info ctinfo, | ||
67 | u32 *seq) | ||
68 | { | ||
69 | char buffer[sizeof("|1|255.255.255.255|65535|")]; | ||
70 | |||
71 | sprintf(buffer, "|1|%u.%u.%u.%u|%u|", NIPQUAD(newip), port); | ||
72 | |||
73 | DEBUGP("calling nf_nat_mangle_tcp_packet\n"); | ||
74 | |||
75 | *seq += strlen(buffer) - matchlen; | ||
76 | return nf_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff, | ||
77 | matchlen, buffer, strlen(buffer)); | ||
78 | } | ||
79 | |||
80 | /* |1|132.235.1.2|6275| */ | ||
81 | static int | ||
82 | mangle_epsv_packet(struct sk_buff **pskb, | ||
83 | __be32 newip, | ||
84 | u_int16_t port, | ||
85 | unsigned int matchoff, | ||
86 | unsigned int matchlen, | ||
87 | struct nf_conn *ct, | ||
88 | enum ip_conntrack_info ctinfo, | ||
89 | u32 *seq) | ||
90 | { | ||
91 | char buffer[sizeof("|||65535|")]; | ||
92 | |||
93 | sprintf(buffer, "|||%u|", port); | ||
94 | |||
95 | DEBUGP("calling nf_nat_mangle_tcp_packet\n"); | ||
96 | |||
97 | *seq += strlen(buffer) - matchlen; | ||
98 | return nf_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff, | ||
99 | matchlen, buffer, strlen(buffer)); | ||
100 | } | ||
101 | |||
102 | static int (*mangle[])(struct sk_buff **, __be32, u_int16_t, | ||
103 | unsigned int, unsigned int, struct nf_conn *, | ||
104 | enum ip_conntrack_info, u32 *seq) | ||
105 | = { | ||
106 | [NF_CT_FTP_PORT] = mangle_rfc959_packet, | ||
107 | [NF_CT_FTP_PASV] = mangle_rfc959_packet, | ||
108 | [NF_CT_FTP_EPRT] = mangle_eprt_packet, | ||
109 | [NF_CT_FTP_EPSV] = mangle_epsv_packet | ||
110 | }; | ||
111 | |||
112 | /* So, this packet has hit the connection tracking matching code. | ||
113 | Mangle it, and change the expectation to match the new version. */ | ||
114 | static unsigned int nf_nat_ftp(struct sk_buff **pskb, | ||
115 | enum ip_conntrack_info ctinfo, | ||
116 | enum nf_ct_ftp_type type, | ||
117 | unsigned int matchoff, | ||
118 | unsigned int matchlen, | ||
119 | struct nf_conntrack_expect *exp, | ||
120 | u32 *seq) | ||
121 | { | ||
122 | __be32 newip; | ||
123 | u_int16_t port; | ||
124 | int dir = CTINFO2DIR(ctinfo); | ||
125 | struct nf_conn *ct = exp->master; | ||
126 | |||
127 | DEBUGP("FTP_NAT: type %i, off %u len %u\n", type, matchoff, matchlen); | ||
128 | |||
129 | /* Connection will come from wherever this packet goes, hence !dir */ | ||
130 | newip = ct->tuplehash[!dir].tuple.dst.u3.ip; | ||
131 | exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port; | ||
132 | exp->dir = !dir; | ||
133 | |||
134 | /* When you see the packet, we need to NAT it the same as the | ||
135 | * this one. */ | ||
136 | exp->expectfn = nf_nat_follow_master; | ||
137 | |||
138 | /* Try to get same port: if not, try to change it. */ | ||
139 | for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) { | ||
140 | exp->tuple.dst.u.tcp.port = htons(port); | ||
141 | if (nf_conntrack_expect_related(exp) == 0) | ||
142 | break; | ||
143 | } | ||
144 | |||
145 | if (port == 0) | ||
146 | return NF_DROP; | ||
147 | |||
148 | if (!mangle[type](pskb, newip, port, matchoff, matchlen, ct, ctinfo, | ||
149 | seq)) { | ||
150 | nf_conntrack_unexpect_related(exp); | ||
151 | return NF_DROP; | ||
152 | } | ||
153 | return NF_ACCEPT; | ||
154 | } | ||
155 | |||
156 | static void __exit nf_nat_ftp_fini(void) | ||
157 | { | ||
158 | rcu_assign_pointer(nf_nat_ftp_hook, NULL); | ||
159 | synchronize_rcu(); | ||
160 | } | ||
161 | |||
162 | static int __init nf_nat_ftp_init(void) | ||
163 | { | ||
164 | BUG_ON(rcu_dereference(nf_nat_ftp_hook)); | ||
165 | rcu_assign_pointer(nf_nat_ftp_hook, nf_nat_ftp); | ||
166 | return 0; | ||
167 | } | ||
168 | |||
169 | /* Prior to 2.6.11, we had a ports param. No longer, but don't break users. */ | ||
170 | static int warn_set(const char *val, struct kernel_param *kp) | ||
171 | { | ||
172 | printk(KERN_INFO KBUILD_MODNAME | ||
173 | ": kernel >= 2.6.10 only uses 'ports' for conntrack modules\n"); | ||
174 | return 0; | ||
175 | } | ||
176 | module_param_call(ports, warn_set, NULL, NULL, 0); | ||
177 | |||
178 | module_init(nf_nat_ftp_init); | ||
179 | module_exit(nf_nat_ftp_fini); | ||