1 /* FTP extension for TCP NAT alteration. */
3 /* (C) 1999-2001 Paul `Rusty' Russell
4 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/netfilter_ipv4.h>
14 #include <linux/tcp.h>
15 #include <linux/moduleparam.h>
17 #include <linux/netfilter_ipv4/ip_nat.h>
18 #include <linux/netfilter_ipv4/ip_nat_helper.h>
19 #include <linux/netfilter_ipv4/ip_nat_rule.h>
20 #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
21 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
23 MODULE_LICENSE("GPL");
24 MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
25 MODULE_DESCRIPTION("ftp NAT helper");
30 #define DEBUGP(format, args...)
34 static int ports[MAX_PORTS];
37 module_param_array(ports, int, &ports_c, 0400);
39 /* FIXME: Time out? --RR */
42 ftp_nat_expected(struct sk_buff **pskb,
44 struct ip_conntrack *ct,
45 struct ip_nat_info *info)
47 struct ip_nat_multi_range mr;
48 u_int32_t newdstip, newsrcip, newip;
49 struct ip_ct_ftp_expect *exp_ftp_info;
51 struct ip_conntrack *master = master_ct(ct);
56 IP_NF_ASSERT(!(info->initialized & (1<<HOOK2MANIP(hooknum))));
58 DEBUGP("nat_expected: We have a connection!\n");
59 exp_ftp_info = &ct->master->help.exp_ftp_info;
61 if (exp_ftp_info->ftptype == IP_CT_FTP_PORT
62 || exp_ftp_info->ftptype == IP_CT_FTP_EPRT) {
63 /* PORT command: make connection go to the client. */
64 newdstip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
65 newsrcip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;
66 DEBUGP("nat_expected: PORT cmd. %u.%u.%u.%u->%u.%u.%u.%u\n",
67 NIPQUAD(newsrcip), NIPQUAD(newdstip));
69 /* PASV command: make the connection go to the server */
70 newdstip = master->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip;
71 newsrcip = master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
72 DEBUGP("nat_expected: PASV cmd. %u.%u.%u.%u->%u.%u.%u.%u\n",
73 NIPQUAD(newsrcip), NIPQUAD(newdstip));
76 if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC)
81 DEBUGP("nat_expected: IP to %u.%u.%u.%u\n", NIPQUAD(newip));
84 /* We don't want to manip the per-protocol, just the IPs... */
85 mr.range[0].flags = IP_NAT_RANGE_MAP_IPS;
86 mr.range[0].min_ip = mr.range[0].max_ip = newip;
88 /* ... unless we're doing a MANIP_DST, in which case, make
89 sure we map to the correct port */
90 if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_DST) {
91 mr.range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
92 mr.range[0].min = mr.range[0].max
93 = ((union ip_conntrack_manip_proto)
94 { .tcp = { htons(exp_ftp_info->port) } });
96 return ip_nat_setup_info(ct, &mr, hooknum);
100 mangle_rfc959_packet(struct sk_buff **pskb,
103 unsigned int matchoff,
104 unsigned int matchlen,
105 struct ip_conntrack *ct,
106 enum ip_conntrack_info ctinfo)
108 char buffer[sizeof("nnn,nnn,nnn,nnn,nnn,nnn")];
110 sprintf(buffer, "%u,%u,%u,%u,%u,%u",
111 NIPQUAD(newip), port>>8, port&0xFF);
113 DEBUGP("calling ip_nat_mangle_tcp_packet\n");
115 return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
116 matchlen, buffer, strlen(buffer));
119 /* |1|132.235.1.2|6275| */
121 mangle_eprt_packet(struct sk_buff **pskb,
124 unsigned int matchoff,
125 unsigned int matchlen,
126 struct ip_conntrack *ct,
127 enum ip_conntrack_info ctinfo)
129 char buffer[sizeof("|1|255.255.255.255|65535|")];
131 sprintf(buffer, "|1|%u.%u.%u.%u|%u|", NIPQUAD(newip), port);
133 DEBUGP("calling ip_nat_mangle_tcp_packet\n");
135 return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
136 matchlen, buffer, strlen(buffer));
139 /* |1|132.235.1.2|6275| */
141 mangle_epsv_packet(struct sk_buff **pskb,
144 unsigned int matchoff,
145 unsigned int matchlen,
146 struct ip_conntrack *ct,
147 enum ip_conntrack_info ctinfo)
149 char buffer[sizeof("|||65535|")];
151 sprintf(buffer, "|||%u|", port);
153 DEBUGP("calling ip_nat_mangle_tcp_packet\n");
155 return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
156 matchlen, buffer, strlen(buffer));
159 static int (*mangle[])(struct sk_buff **, u_int32_t, u_int16_t,
162 struct ip_conntrack *,
163 enum ip_conntrack_info)
164 = { [IP_CT_FTP_PORT] = mangle_rfc959_packet,
165 [IP_CT_FTP_PASV] = mangle_rfc959_packet,
166 [IP_CT_FTP_EPRT] = mangle_eprt_packet,
167 [IP_CT_FTP_EPSV] = mangle_epsv_packet
170 static int ftp_data_fixup(const struct ip_ct_ftp_expect *exp_ftp_info,
171 struct ip_conntrack *ct,
172 struct sk_buff **pskb,
173 enum ip_conntrack_info ctinfo,
174 struct ip_conntrack_expect *expect)
177 struct iphdr *iph = (*pskb)->nh.iph;
178 struct tcphdr *tcph = (void *)iph + iph->ihl*4;
180 struct ip_conntrack_tuple newtuple;
182 DEBUGP("FTP_NAT: seq %u + %u in %u\n",
183 expect->seq, exp_ftp_info->len,
186 /* Change address inside packet to match way we're mapping
188 if (exp_ftp_info->ftptype == IP_CT_FTP_PASV
189 || exp_ftp_info->ftptype == IP_CT_FTP_EPSV) {
190 /* PASV/EPSV response: must be where client thinks server
192 newip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;
193 /* Expect something from client->server */
195 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
197 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;
199 /* PORT command: must be where server thinks client is */
200 newip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
201 /* Expect something from server->client */
203 ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip;
205 ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
207 newtuple.dst.protonum = IPPROTO_TCP;
208 newtuple.src.u.tcp.port = expect->tuple.src.u.tcp.port;
210 /* Try to get same port: if not, try to change it. */
211 for (port = exp_ftp_info->port; port != 0; port++) {
212 newtuple.dst.u.tcp.port = htons(port);
214 if (ip_conntrack_change_expect(expect, &newtuple) == 0)
220 if (!mangle[exp_ftp_info->ftptype](pskb, newip, port,
221 expect->seq - ntohl(tcph->seq),
222 exp_ftp_info->len, ct, ctinfo))
228 static unsigned int help(struct ip_conntrack *ct,
229 struct ip_conntrack_expect *exp,
230 struct ip_nat_info *info,
231 enum ip_conntrack_info ctinfo,
232 unsigned int hooknum,
233 struct sk_buff **pskb)
235 struct iphdr *iph = (*pskb)->nh.iph;
236 struct tcphdr *tcph = (void *)iph + iph->ihl*4;
237 unsigned int datalen;
239 struct ip_ct_ftp_expect *exp_ftp_info;
242 DEBUGP("ip_nat_ftp: no exp!!");
244 exp_ftp_info = &exp->help.exp_ftp_info;
246 /* Only mangle things once: original direction in POST_ROUTING
247 and reply direction on PRE_ROUTING. */
248 dir = CTINFO2DIR(ctinfo);
249 if (!((hooknum == NF_IP_POST_ROUTING && dir == IP_CT_DIR_ORIGINAL)
250 || (hooknum == NF_IP_PRE_ROUTING && dir == IP_CT_DIR_REPLY))) {
251 DEBUGP("nat_ftp: Not touching dir %s at hook %s\n",
252 dir == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY",
253 hooknum == NF_IP_POST_ROUTING ? "POSTROUTING"
254 : hooknum == NF_IP_PRE_ROUTING ? "PREROUTING"
255 : hooknum == NF_IP_LOCAL_OUT ? "OUTPUT" : "???");
259 datalen = (*pskb)->len - iph->ihl * 4 - tcph->doff * 4;
260 /* If it's in the right range... */
261 if (between(exp->seq + exp_ftp_info->len,
263 ntohl(tcph->seq) + datalen)) {
264 if (!ftp_data_fixup(exp_ftp_info, ct, pskb, ctinfo, exp))
267 /* Half a match? This means a partial retransmisison.
268 It's a cracker being funky. */
269 if (net_ratelimit()) {
270 printk("FTP_NAT: partial packet %u/%u in %u/%u\n",
271 exp->seq, exp_ftp_info->len,
273 ntohl(tcph->seq) + datalen);
280 static struct ip_nat_helper ftp[MAX_PORTS];
281 static char ftp_names[MAX_PORTS][10];
283 /* Not __exit: called from init() */
284 static void fini(void)
288 for (i = 0; i < ports_c; i++) {
289 DEBUGP("ip_nat_ftp: unregistering port %d\n", ports[i]);
290 ip_nat_helper_unregister(&ftp[i]);
294 static int __init init(void)
300 ports[ports_c++] = FTP_PORT;
302 for (i = 0; i < ports_c; i++) {
303 ftp[i].tuple.dst.protonum = IPPROTO_TCP;
304 ftp[i].tuple.src.u.tcp.port = htons(ports[i]);
305 ftp[i].mask.dst.protonum = 0xFFFF;
306 ftp[i].mask.src.u.tcp.port = 0xFFFF;
308 ftp[i].me = THIS_MODULE;
310 ftp[i].expect = ftp_nat_expected;
312 tmpname = &ftp_names[i][0];
313 if (ports[i] == FTP_PORT)
314 sprintf(tmpname, "ftp");
316 sprintf(tmpname, "ftp-%d", i);
317 ftp[i].name = tmpname;
319 DEBUGP("ip_nat_ftp: Trying to register for port %d\n",
321 ret = ip_nat_helper_register(&ftp[i]);
324 printk("ip_nat_ftp: error registering "
325 "helper for port %d\n", ports[i]);
334 NEEDS_CONNTRACK(ftp);