net/ipv4/netfilter/ip_nat_ftp.c

   1 /* FTP extension for TCP NAT alteration. */
   2
   3 /* (C) 1999-2001 Paul `Rusty' Russell
   4  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 #include <linux/module.h>
  12 #include <linux/netfilter_ipv4.h>
  13 #include <linux/ip.h>
  14 #include <linux/tcp.h>
  15 #include <linux/moduleparam.h>
  16 #include <net/tcp.h>
  17 #include <linux/netfilter_ipv4/ip_nat.h>
  18 #include <linux/netfilter_ipv4/ip_nat_helper.h>
  19 #include <linux/netfilter_ipv4/ip_nat_rule.h>
  20 #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
  21 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
  22
  23 MODULE_LICENSE("GPL");
  24 MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
  25 MODULE_DESCRIPTION("ftp NAT helper");
  26
  27 #if 0
  28 #define DEBUGP printk
  29 #else
  30 #define DEBUGP(format, args...)
  31 #endif
  32
  33 #define MAX_PORTS 8
  34 static int ports[MAX_PORTS];
  35 static int ports_c;
  36
  37 module_param_array(ports, int, ports_c, 0400);
  38
  39 /* FIXME: Time out? --RR */
  40
  41 static unsigned int
  42 ftp_nat_expected(struct sk_buff **pskb,
  43                  unsigned int hooknum,
  44                  struct ip_conntrack *ct,
  45                  struct ip_nat_info *info)
  46 {
  47         struct ip_nat_multi_range mr;
  48         u_int32_t newdstip, newsrcip, newip;
  49         struct ip_ct_ftp_expect *exp_ftp_info;
  50
  51         struct ip_conntrack *master = master_ct(ct);
  52
  53         IP_NF_ASSERT(info);
  54         IP_NF_ASSERT(master);
  55
  56         IP_NF_ASSERT(!(info->initialized & (1<<HOOK2MANIP(hooknum))));
  57
  58         DEBUGP("nat_expected: We have a connection!\n");
  59         exp_ftp_info = &ct->master->help.exp_ftp_info;
  60
  61         if (exp_ftp_info->ftptype == IP_CT_FTP_PORT
  62             || exp_ftp_info->ftptype == IP_CT_FTP_EPRT) {
  63                 /* PORT command: make connection go to the client. */
  64                 newdstip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
  65                 newsrcip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;
  66                 DEBUGP("nat_expected: PORT cmd. %u.%u.%u.%u->%u.%u.%u.%u\n",
  67                        NIPQUAD(newsrcip), NIPQUAD(newdstip));
  68         } else {
  69                 /* PASV command: make the connection go to the server */
  70                 newdstip = master->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip;
  71                 newsrcip = master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
  72                 DEBUGP("nat_expected: PASV cmd. %u.%u.%u.%u->%u.%u.%u.%u\n",
  73                        NIPQUAD(newsrcip), NIPQUAD(newdstip));
  74         }
  75
  76         if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC)
  77                 newip = newsrcip;
  78         else
  79                 newip = newdstip;
  80
  81         DEBUGP("nat_expected: IP to %u.%u.%u.%u\n", NIPQUAD(newip));
  82
  83         mr.rangesize = 1;
  84         /* We don't want to manip the per-protocol, just the IPs... */
  85         mr.range[0].flags = IP_NAT_RANGE_MAP_IPS;
  86         mr.range[0].min_ip = mr.range[0].max_ip = newip;
  87
  88         /* ... unless we're doing a MANIP_DST, in which case, make
  89            sure we map to the correct port */
  90         if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_DST) {
  91                 mr.range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
  92                 mr.range[0].min = mr.range[0].max
  93                         = ((union ip_conntrack_manip_proto)
  94                                 { .tcp = { htons(exp_ftp_info->port) } });
  95         }
  96         return ip_nat_setup_info(ct, &mr, hooknum);
  97 }
  98
  99 static int
 100 mangle_rfc959_packet(struct sk_buff **pskb,
 101                      u_int32_t newip,
 102                      u_int16_t port,
 103                      unsigned int matchoff,
 104                      unsigned int matchlen,
 105                      struct ip_conntrack *ct,
 106                      enum ip_conntrack_info ctinfo)
 107 {
 108         char buffer[sizeof("nnn,nnn,nnn,nnn,nnn,nnn")];
 109
 110         sprintf(buffer, "%u,%u,%u,%u,%u,%u",
 111                 NIPQUAD(newip), port>>8, port&0xFF);
 112
 113         DEBUGP("calling ip_nat_mangle_tcp_packet\n");
 114
 115         return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
 116                                         matchlen, buffer, strlen(buffer));
 117 }
 118
 119 /* |1|132.235.1.2|6275| */
 120 static int
 121 mangle_eprt_packet(struct sk_buff **pskb,
 122                    u_int32_t newip,
 123                    u_int16_t port,
 124                    unsigned int matchoff,
 125                    unsigned int matchlen,
 126                    struct ip_conntrack *ct,
 127                    enum ip_conntrack_info ctinfo)
 128 {
 129         char buffer[sizeof("|1|255.255.255.255|65535|")];
 130
 131         sprintf(buffer, "|1|%u.%u.%u.%u|%u|", NIPQUAD(newip), port);
 132
 133         DEBUGP("calling ip_nat_mangle_tcp_packet\n");
 134
 135         return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
 136                                         matchlen, buffer, strlen(buffer));
 137 }
 138
 139 /* |1|132.235.1.2|6275| */
 140 static int
 141 mangle_epsv_packet(struct sk_buff **pskb,
 142                    u_int32_t newip,
 143                    u_int16_t port,
 144                    unsigned int matchoff,
 145                    unsigned int matchlen,
 146                    struct ip_conntrack *ct,
 147                    enum ip_conntrack_info ctinfo)
 148 {
 149         char buffer[sizeof("|||65535|")];
 150
 151         sprintf(buffer, "|||%u|", port);
 152
 153         DEBUGP("calling ip_nat_mangle_tcp_packet\n");
 154
 155         return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
 156                                         matchlen, buffer, strlen(buffer));
 157 }
 158
 159 static int (*mangle[])(struct sk_buff **, u_int32_t, u_int16_t,
 160                      unsigned int,
 161                      unsigned int,
 162                      struct ip_conntrack *,
 163                      enum ip_conntrack_info)
 164 = { [IP_CT_FTP_PORT] = mangle_rfc959_packet,
 165     [IP_CT_FTP_PASV] = mangle_rfc959_packet,
 166     [IP_CT_FTP_EPRT] = mangle_eprt_packet,
 167     [IP_CT_FTP_EPSV] = mangle_epsv_packet
 168 };
 169
 170 static int ftp_data_fixup(const struct ip_ct_ftp_expect *exp_ftp_info,
 171                           struct ip_conntrack *ct,
 172                           struct sk_buff **pskb,
 173                           enum ip_conntrack_info ctinfo,
 174                           struct ip_conntrack_expect *expect)
 175 {
 176         u_int32_t newip;
 177         struct iphdr *iph = (*pskb)->nh.iph;
 178         struct tcphdr *tcph = (void *)iph + iph->ihl*4;
 179         u_int16_t port;
 180         struct ip_conntrack_tuple newtuple;
 181
 182         DEBUGP("FTP_NAT: seq %u + %u in %u\n",
 183                expect->seq, exp_ftp_info->len,
 184                ntohl(tcph->seq));
 185
 186         /* Change address inside packet to match way we're mapping
 187            this connection. */
 188         if (exp_ftp_info->ftptype == IP_CT_FTP_PASV
 189             || exp_ftp_info->ftptype == IP_CT_FTP_EPSV) {
 190                 /* PASV/EPSV response: must be where client thinks server
 191                    is */
 192                 newip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;
 193                 /* Expect something from client->server */
 194                 newtuple.src.ip =
 195                         ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
 196                 newtuple.dst.ip =
 197                         ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;
 198         } else {
 199                 /* PORT command: must be where server thinks client is */
 200                 newip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
 201                 /* Expect something from server->client */
 202                 newtuple.src.ip =
 203                         ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip;
 204                 newtuple.dst.ip =
 205                         ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
 206         }
 207         newtuple.dst.protonum = IPPROTO_TCP;
 208         newtuple.src.u.tcp.port = expect->tuple.src.u.tcp.port;
 209
 210         /* Try to get same port: if not, try to change it. */
 211         for (port = exp_ftp_info->port; port != 0; port++) {
 212                 newtuple.dst.u.tcp.port = htons(port);
 213
 214                 if (ip_conntrack_change_expect(expect, &newtuple) == 0)
 215                         break;
 216         }
 217         if (port == 0)
 218                 return 0;
 219
 220         if (!mangle[exp_ftp_info->ftptype](pskb, newip, port,
 221                                           expect->seq - ntohl(tcph->seq),
 222                                           exp_ftp_info->len, ct, ctinfo))
 223                 return 0;
 224
 225         return 1;
 226 }
 227
 228 static unsigned int help(struct ip_conntrack *ct,
 229                          struct ip_conntrack_expect *exp,
 230                          struct ip_nat_info *info,
 231                          enum ip_conntrack_info ctinfo,
 232                          unsigned int hooknum,
 233                          struct sk_buff **pskb)
 234 {
 235         struct iphdr *iph = (*pskb)->nh.iph;
 236         struct tcphdr *tcph = (void *)iph + iph->ihl*4;
 237         unsigned int datalen;
 238         int dir;
 239         struct ip_ct_ftp_expect *exp_ftp_info;
 240
 241         if (!exp)
 242                 DEBUGP("ip_nat_ftp: no exp!!");
 243
 244         exp_ftp_info = &exp->help.exp_ftp_info;
 245
 246         /* Only mangle things once: original direction in POST_ROUTING
 247            and reply direction on PRE_ROUTING. */
 248         dir = CTINFO2DIR(ctinfo);
 249         if (!((hooknum == NF_IP_POST_ROUTING && dir == IP_CT_DIR_ORIGINAL)
 250               || (hooknum == NF_IP_PRE_ROUTING && dir == IP_CT_DIR_REPLY))) {
 251                 DEBUGP("nat_ftp: Not touching dir %s at hook %s\n",
 252                        dir == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY",
 253                        hooknum == NF_IP_POST_ROUTING ? "POSTROUTING"
 254                        : hooknum == NF_IP_PRE_ROUTING ? "PREROUTING"
 255                        : hooknum == NF_IP_LOCAL_OUT ? "OUTPUT" : "???");
 256                 return NF_ACCEPT;
 257         }
 258
 259         datalen = (*pskb)->len - iph->ihl * 4 - tcph->doff * 4;
 260         /* If it's in the right range... */
 261         if (between(exp->seq + exp_ftp_info->len,
 262                     ntohl(tcph->seq),
 263                     ntohl(tcph->seq) + datalen)) {
 264                 if (!ftp_data_fixup(exp_ftp_info, ct, pskb, ctinfo, exp))
 265                         return NF_DROP;
 266         } else {
 267                 /* Half a match?  This means a partial retransmisison.
 268                    It's a cracker being funky. */
 269                 if (net_ratelimit()) {
 270                         printk("FTP_NAT: partial packet %u/%u in %u/%u\n",
 271                                exp->seq, exp_ftp_info->len,
 272                                ntohl(tcph->seq),
 273                                ntohl(tcph->seq) + datalen);
 274                 }
 275                 return NF_DROP;
 276         }
 277         return NF_ACCEPT;
 278 }
 279
 280 static struct ip_nat_helper ftp[MAX_PORTS];
 281 static char ftp_names[MAX_PORTS][10];
 282
 283 /* Not __exit: called from init() */
 284 static void fini(void)
 285 {
 286         int i;
 287
 288         for (i = 0; i < ports_c; i++) {
 289                 DEBUGP("ip_nat_ftp: unregistering port %d\n", ports[i]);
 290                 ip_nat_helper_unregister(&ftp[i]);
 291         }
 292 }
 293
 294 static int __init init(void)
 295 {
 296         int i, ret = 0;
 297         char *tmpname;
 298
 299         if (ports_c == 0)
 300                 ports[ports_c++] = FTP_PORT;
 301
 302         for (i = 0; i < ports_c; i++) {
 303                 ftp[i].tuple.dst.protonum = IPPROTO_TCP;
 304                 ftp[i].tuple.src.u.tcp.port = htons(ports[i]);
 305                 ftp[i].mask.dst.protonum = 0xFFFF;
 306                 ftp[i].mask.src.u.tcp.port = 0xFFFF;
 307                 ftp[i].help = help;
 308                 ftp[i].me = THIS_MODULE;
 309                 ftp[i].flags = 0;
 310                 ftp[i].expect = ftp_nat_expected;
 311
 312                 tmpname = &ftp_names[i][0];
 313                 if (ports[i] == FTP_PORT)
 314                         sprintf(tmpname, "ftp");
 315                 else
 316                         sprintf(tmpname, "ftp-%d", i);
 317                 ftp[i].name = tmpname;
 318
 319                 DEBUGP("ip_nat_ftp: Trying to register for port %d\n",
 320                                 ports[i]);
 321                 ret = ip_nat_helper_register(&ftp[i]);
 322
 323                 if (ret) {
 324                         printk("ip_nat_ftp: error registering "
 325                                "helper for port %d\n", ports[i]);
 326                         fini();
 327                         return ret;
 328                 }
 329         }
 330
 331         return ret;
 332 }
 333
 334 NEEDS_CONNTRACK(ftp);
 335
 336 module_init(init);
 337 module_exit(fini);