1 /* FTP extension for TCP NAT alteration. */
3 /* (C) 1999-2001 Paul `Rusty' Russell
4 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/netfilter_ipv4.h>
14 #include <linux/tcp.h>
16 #include <linux/netfilter_ipv4/ip_nat.h>
17 #include <linux/netfilter_ipv4/ip_nat_helper.h>
18 #include <linux/netfilter_ipv4/ip_nat_rule.h>
19 #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
20 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
22 MODULE_LICENSE("GPL");
23 MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
24 MODULE_DESCRIPTION("ftp NAT helper");
29 #define DEBUGP(format, args...)
33 static int ports[MAX_PORTS];
36 MODULE_PARM(ports, "1-" __MODULE_STRING(MAX_PORTS) "i");
38 DECLARE_LOCK_EXTERN(ip_ftp_lock);
40 /* FIXME: Time out? --RR */
43 ftp_nat_expected(struct sk_buff **pskb,
45 struct ip_conntrack *ct,
46 struct ip_nat_info *info)
48 struct ip_nat_multi_range mr;
49 u_int32_t newdstip, newsrcip, newip;
50 struct ip_ct_ftp_expect *exp_ftp_info;
52 struct ip_conntrack *master = master_ct(ct);
57 IP_NF_ASSERT(!(info->initialized & (1<<HOOK2MANIP(hooknum))));
59 DEBUGP("nat_expected: We have a connection!\n");
60 exp_ftp_info = &ct->master->help.exp_ftp_info;
62 LOCK_BH(&ip_ftp_lock);
64 if (exp_ftp_info->ftptype == IP_CT_FTP_PORT
65 || exp_ftp_info->ftptype == IP_CT_FTP_EPRT) {
66 /* PORT command: make connection go to the client. */
67 newdstip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
68 newsrcip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;
69 DEBUGP("nat_expected: PORT cmd. %u.%u.%u.%u->%u.%u.%u.%u\n",
70 NIPQUAD(newsrcip), NIPQUAD(newdstip));
72 /* PASV command: make the connection go to the server */
73 newdstip = master->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip;
74 newsrcip = master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
75 DEBUGP("nat_expected: PASV cmd. %u.%u.%u.%u->%u.%u.%u.%u\n",
76 NIPQUAD(newsrcip), NIPQUAD(newdstip));
78 UNLOCK_BH(&ip_ftp_lock);
80 if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC)
85 DEBUGP("nat_expected: IP to %u.%u.%u.%u\n", NIPQUAD(newip));
88 /* We don't want to manip the per-protocol, just the IPs... */
89 mr.range[0].flags = IP_NAT_RANGE_MAP_IPS;
90 mr.range[0].min_ip = mr.range[0].max_ip = newip;
92 /* ... unless we're doing a MANIP_DST, in which case, make
93 sure we map to the correct port */
94 if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_DST) {
95 mr.range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
96 mr.range[0].min = mr.range[0].max
97 = ((union ip_conntrack_manip_proto)
98 { .tcp = { htons(exp_ftp_info->port) } });
100 return ip_nat_setup_info(ct, &mr, hooknum);
104 mangle_rfc959_packet(struct sk_buff **pskb,
107 unsigned int matchoff,
108 unsigned int matchlen,
109 struct ip_conntrack *ct,
110 enum ip_conntrack_info ctinfo)
112 char buffer[sizeof("nnn,nnn,nnn,nnn,nnn,nnn")];
114 MUST_BE_LOCKED(&ip_ftp_lock);
116 sprintf(buffer, "%u,%u,%u,%u,%u,%u",
117 NIPQUAD(newip), port>>8, port&0xFF);
119 DEBUGP("calling ip_nat_mangle_tcp_packet\n");
121 return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
122 matchlen, buffer, strlen(buffer));
125 /* |1|132.235.1.2|6275| */
127 mangle_eprt_packet(struct sk_buff **pskb,
130 unsigned int matchoff,
131 unsigned int matchlen,
132 struct ip_conntrack *ct,
133 enum ip_conntrack_info ctinfo)
135 char buffer[sizeof("|1|255.255.255.255|65535|")];
137 MUST_BE_LOCKED(&ip_ftp_lock);
139 sprintf(buffer, "|1|%u.%u.%u.%u|%u|", NIPQUAD(newip), port);
141 DEBUGP("calling ip_nat_mangle_tcp_packet\n");
143 return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
144 matchlen, buffer, strlen(buffer));
147 /* |1|132.235.1.2|6275| */
149 mangle_epsv_packet(struct sk_buff **pskb,
152 unsigned int matchoff,
153 unsigned int matchlen,
154 struct ip_conntrack *ct,
155 enum ip_conntrack_info ctinfo)
157 char buffer[sizeof("|||65535|")];
159 MUST_BE_LOCKED(&ip_ftp_lock);
161 sprintf(buffer, "|||%u|", port);
163 DEBUGP("calling ip_nat_mangle_tcp_packet\n");
165 return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
166 matchlen, buffer, strlen(buffer));
169 static int (*mangle[])(struct sk_buff **, u_int32_t, u_int16_t,
172 struct ip_conntrack *,
173 enum ip_conntrack_info)
174 = { [IP_CT_FTP_PORT] = mangle_rfc959_packet,
175 [IP_CT_FTP_PASV] = mangle_rfc959_packet,
176 [IP_CT_FTP_EPRT] = mangle_eprt_packet,
177 [IP_CT_FTP_EPSV] = mangle_epsv_packet
180 static int ftp_data_fixup(const struct ip_ct_ftp_expect *ct_ftp_info,
181 struct ip_conntrack *ct,
182 struct sk_buff **pskb,
183 enum ip_conntrack_info ctinfo,
184 struct ip_conntrack_expect *expect)
187 struct iphdr *iph = (*pskb)->nh.iph;
188 struct tcphdr *tcph = (void *)iph + iph->ihl*4;
190 struct ip_conntrack_tuple newtuple;
192 MUST_BE_LOCKED(&ip_ftp_lock);
193 DEBUGP("FTP_NAT: seq %u + %u in %u\n",
194 expect->seq, ct_ftp_info->len,
197 /* Change address inside packet to match way we're mapping
199 if (ct_ftp_info->ftptype == IP_CT_FTP_PASV
200 || ct_ftp_info->ftptype == IP_CT_FTP_EPSV) {
201 /* PASV/EPSV response: must be where client thinks server
203 newip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;
204 /* Expect something from client->server */
206 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
208 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;
210 /* PORT command: must be where server thinks client is */
211 newip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
212 /* Expect something from server->client */
214 ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip;
216 ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
218 newtuple.dst.protonum = IPPROTO_TCP;
219 newtuple.src.u.tcp.port = expect->tuple.src.u.tcp.port;
221 /* Try to get same port: if not, try to change it. */
222 for (port = ct_ftp_info->port; port != 0; port++) {
223 newtuple.dst.u.tcp.port = htons(port);
225 if (ip_conntrack_change_expect(expect, &newtuple) == 0)
231 if (!mangle[ct_ftp_info->ftptype](pskb, newip, port,
232 expect->seq - ntohl(tcph->seq),
233 ct_ftp_info->len, ct, ctinfo))
239 static unsigned int help(struct ip_conntrack *ct,
240 struct ip_conntrack_expect *exp,
241 struct ip_nat_info *info,
242 enum ip_conntrack_info ctinfo,
243 unsigned int hooknum,
244 struct sk_buff **pskb)
246 struct iphdr *iph = (*pskb)->nh.iph;
247 struct tcphdr *tcph = (void *)iph + iph->ihl*4;
248 unsigned int datalen;
250 struct ip_ct_ftp_expect *ct_ftp_info;
253 DEBUGP("ip_nat_ftp: no exp!!");
255 ct_ftp_info = &exp->help.exp_ftp_info;
257 /* Only mangle things once: original direction in POST_ROUTING
258 and reply direction on PRE_ROUTING. */
259 dir = CTINFO2DIR(ctinfo);
260 if (!((hooknum == NF_IP_POST_ROUTING && dir == IP_CT_DIR_ORIGINAL)
261 || (hooknum == NF_IP_PRE_ROUTING && dir == IP_CT_DIR_REPLY))) {
262 DEBUGP("nat_ftp: Not touching dir %s at hook %s\n",
263 dir == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY",
264 hooknum == NF_IP_POST_ROUTING ? "POSTROUTING"
265 : hooknum == NF_IP_PRE_ROUTING ? "PREROUTING"
266 : hooknum == NF_IP_LOCAL_OUT ? "OUTPUT" : "???");
270 datalen = (*pskb)->len - iph->ihl * 4 - tcph->doff * 4;
271 LOCK_BH(&ip_ftp_lock);
272 /* If it's in the right range... */
273 if (between(exp->seq + ct_ftp_info->len,
275 ntohl(tcph->seq) + datalen)) {
276 if (!ftp_data_fixup(ct_ftp_info, ct, pskb, ctinfo, exp)) {
277 UNLOCK_BH(&ip_ftp_lock);
281 /* Half a match? This means a partial retransmisison.
282 It's a cracker being funky. */
283 if (net_ratelimit()) {
284 printk("FTP_NAT: partial packet %u/%u in %u/%u\n",
285 exp->seq, ct_ftp_info->len,
287 ntohl(tcph->seq) + datalen);
289 UNLOCK_BH(&ip_ftp_lock);
292 UNLOCK_BH(&ip_ftp_lock);
297 static struct ip_nat_helper ftp[MAX_PORTS];
298 static char ftp_names[MAX_PORTS][10];
300 /* Not __exit: called from init() */
301 static void fini(void)
305 for (i = 0; i < ports_c; i++) {
306 DEBUGP("ip_nat_ftp: unregistering port %d\n", ports[i]);
307 ip_nat_helper_unregister(&ftp[i]);
311 static int __init init(void)
319 for (i = 0; (i < MAX_PORTS) && ports[i]; i++) {
320 ftp[i].tuple.dst.protonum = IPPROTO_TCP;
321 ftp[i].tuple.src.u.tcp.port = htons(ports[i]);
322 ftp[i].mask.dst.protonum = 0xFFFF;
323 ftp[i].mask.src.u.tcp.port = 0xFFFF;
325 ftp[i].me = THIS_MODULE;
327 ftp[i].expect = ftp_nat_expected;
329 tmpname = &ftp_names[i][0];
330 if (ports[i] == FTP_PORT)
331 sprintf(tmpname, "ftp");
333 sprintf(tmpname, "ftp-%d", i);
334 ftp[i].name = tmpname;
336 DEBUGP("ip_nat_ftp: Trying to register for port %d\n",
338 ret = ip_nat_helper_register(&ftp[i]);
341 printk("ip_nat_ftp: error registering "
342 "helper for port %d\n", ports[i]);
352 NEEDS_CONNTRACK(ftp);