netfilter: nf_conntrack: restrict NAT helper invocation to IPv4

The NAT helpers currently only handle IPv4 packets correctly. Restrict
invocation of the helpers to IPv4 in preparation of IPv6 NAT.

Signed-off-by: Patrick McHardy <kaber@trash.net>

6 files changed, 49 insertions, 22 deletions

diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index f2de8c55ac50..184c0dc6e437 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -154,7 +154,8 @@ static int amanda_help(struct sk_buff *skb,
                                   IPPROTO_TCP, NULL, &port);
 
                 nf_nat_amanda = rcu_dereference(nf_nat_amanda_hook);
-                if (nf_nat_amanda && ct->status & IPS_NAT_MASK)
+                if (nf_nat_amanda && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+                    ct->status & IPS_NAT_MASK)
                         ret = nf_nat_amanda(skb, ctinfo, off - dataoff,
                                             len, exp);
                 else if (nf_ct_expect_related(exp) != 0)
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 4bb771d1f57a..3e1587e63c03 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -487,7 +487,8 @@ static int help(struct sk_buff *skb,
         /* Now, NAT might want to mangle the packet, and register the
          * (possibly changed) expectation itself. */
         nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
-        if (nf_nat_ftp && ct->status & IPS_NAT_MASK)
+        if (nf_nat_ftp && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK)
                 ret = nf_nat_ftp(skb, ctinfo, search[dir][i].ftptype,
                                  matchoff, matchlen, exp);
         else {
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 4283b207e63b..517c5e3fe7c6 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -295,6 +295,7 @@ static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
                    &ct->tuplehash[!dir].tuple.dst.u3,
                    sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
                    (nat_rtp_rtcp = rcu_dereference(nat_rtp_rtcp_hook)) &&
+                   nf_ct_l3num(ct) == NFPROTO_IPV4 &&
                    ct->status & IPS_NAT_MASK) {
                 /* NAT needed */
                 ret = nat_rtp_rtcp(skb, ct, ctinfo, data, dataoff,
@@ -353,6 +354,7 @@ static int expect_t120(struct sk_buff *skb,
                    &ct->tuplehash[!dir].tuple.dst.u3,
                    sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
             (nat_t120 = rcu_dereference(nat_t120_hook)) &&
+            nf_ct_l3num(ct) == NFPROTO_IPV4 &&
             ct->status & IPS_NAT_MASK) {
                 /* NAT needed */
                 ret = nat_t120(skb, ct, ctinfo, data, dataoff, taddr,
@@ -688,6 +690,7 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct,
                    &ct->tuplehash[!dir].tuple.dst.u3,
                    sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
             (nat_h245 = rcu_dereference(nat_h245_hook)) &&
+            nf_ct_l3num(ct) == NFPROTO_IPV4 &&
             ct->status & IPS_NAT_MASK) {
                 /* NAT needed */
                 ret = nat_h245(skb, ct, ctinfo, data, dataoff, taddr,
@@ -811,6 +814,7 @@ static int expect_callforwarding(struct sk_buff *skb,
                    &ct->tuplehash[!dir].tuple.dst.u3,
                    sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
             (nat_callforwarding = rcu_dereference(nat_callforwarding_hook)) &&
+            nf_ct_l3num(ct) == NFPROTO_IPV4 &&
             ct->status & IPS_NAT_MASK) {
                 /* Need NAT */
                 ret = nat_callforwarding(skb, ct, ctinfo, data, dataoff,
@@ -852,7 +856,8 @@ static int process_setup(struct sk_buff *skb, struct nf_conn *ct,
 
         set_h225_addr = rcu_dereference(set_h225_addr_hook);
         if ((setup->options & eSetup_UUIE_destCallSignalAddress) &&
-            (set_h225_addr) && ct->status & IPS_NAT_MASK &&
+            (set_h225_addr) && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK &&
             get_h225_addr(ct, *data, &setup->destCallSignalAddress,
                           &addr, &port) &&
             memcmp(&addr, &ct->tuplehash[!dir].tuple.src.u3, sizeof(addr))) {
@@ -868,7 +873,8 @@ static int process_setup(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         if ((setup->options & eSetup_UUIE_sourceCallSignalAddress) &&
-            (set_h225_addr) && ct->status & IPS_NAT_MASK &&
+            (set_h225_addr) && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK &&
             get_h225_addr(ct, *data, &setup->sourceCallSignalAddress,
                           &addr, &port) &&
             memcmp(&addr, &ct->tuplehash[!dir].tuple.dst.u3, sizeof(addr))) {
@@ -1278,7 +1284,8 @@ static int expect_q931(struct sk_buff *skb, struct nf_conn *ct,
         exp->flags = NF_CT_EXPECT_PERMANENT;    /* Accept multiple calls */
 
         nat_q931 = rcu_dereference(nat_q931_hook);
-        if (nat_q931 && ct->status & IPS_NAT_MASK) {    /* Need NAT */
+        if (nat_q931 && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK) {        /* Need NAT */
                 ret = nat_q931(skb, ct, ctinfo, data, taddr, i, port, exp);
         } else {                /* Conntrack only */
                 if (nf_ct_expect_related(exp) == 0) {
@@ -1306,7 +1313,8 @@ static int process_grq(struct sk_buff *skb, struct nf_conn *ct,
         pr_debug("nf_ct_ras: GRQ\n");
 
         set_ras_addr = rcu_dereference(set_ras_addr_hook);
-        if (set_ras_addr && ct->status & IPS_NAT_MASK)  /* NATed */
+        if (set_ras_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK)  /* NATed */
                 return set_ras_addr(skb, ct, ctinfo, data,
                                     &grq->rasAddress, 1);
         return 0;
@@ -1374,7 +1382,8 @@ static int process_rrq(struct sk_buff *skb, struct nf_conn *ct,
                 return -1;
 
         set_ras_addr = rcu_dereference(set_ras_addr_hook);
-        if (set_ras_addr && ct->status & IPS_NAT_MASK) {
+        if (set_ras_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK) {
                 ret = set_ras_addr(skb, ct, ctinfo, data,
                                    rrq->rasAddress.item,
                                    rrq->rasAddress.count);
@@ -1405,7 +1414,8 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
         pr_debug("nf_ct_ras: RCF\n");
 
         set_sig_addr = rcu_dereference(set_sig_addr_hook);
-        if (set_sig_addr && ct->status & IPS_NAT_MASK) {
+        if (set_sig_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK) {
                 ret = set_sig_addr(skb, ct, ctinfo, data,
                                         rcf->callSignalAddress.item,
                                         rcf->callSignalAddress.count);
@@ -1453,7 +1463,8 @@ static int process_urq(struct sk_buff *skb, struct nf_conn *ct,
         pr_debug("nf_ct_ras: URQ\n");
 
         set_sig_addr = rcu_dereference(set_sig_addr_hook);
-        if (set_sig_addr && ct->status & IPS_NAT_MASK) {
+        if (set_sig_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK) {
                 ret = set_sig_addr(skb, ct, ctinfo, data,
                                    urq->callSignalAddress.item,
                                    urq->callSignalAddress.count);
@@ -1491,6 +1502,7 @@ static int process_arq(struct sk_buff *skb, struct nf_conn *ct,
                           &addr, &port) &&