net/ipv4/netfilter/ip_nat_ftp.c

   1 /* FTP extension for TCP NAT alteration. */
   2
   3 /* (C) 1999-2001 Paul `Rusty' Russell
   4  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 #include <linux/module.h>
  12 #include <linux/netfilter_ipv4.h>
  13 #include <linux/ip.h>
  14 #include <linux/tcp.h>
  15 #include <linux/moduleparam.h>
  16 #include <net/tcp.h>
  17 #include <linux/netfilter_ipv4/ip_nat.h>
  18 #include <linux/netfilter_ipv4/ip_nat_helper.h>
  19 #include <linux/netfilter_ipv4/ip_nat_rule.h>
  20 #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
  21 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
  22
  23 MODULE_LICENSE("GPL");
  24 MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
  25 MODULE_DESCRIPTION("ftp NAT helper");
  26
  27 #if 0
  28 #define DEBUGP printk
  29 #else
  30 #define DEBUGP(format, args...)
  31 #endif
  32
  33 /* FIXME: Time out? --RR */
  34
  35 static int
  36 mangle_rfc959_packet(struct sk_buff **pskb,
  37                      u_int32_t newip,
  38                      u_int16_t port,
  39                      unsigned int matchoff,
  40                      unsigned int matchlen,
  41                      struct ip_conntrack *ct,
  42                      enum ip_conntrack_info ctinfo,
  43                      u32 *seq)
  44 {
  45         char buffer[sizeof("nnn,nnn,nnn,nnn,nnn,nnn")];
  46
  47         sprintf(buffer, "%u,%u,%u,%u,%u,%u",
  48                 NIPQUAD(newip), port>>8, port&0xFF);
  49
  50         DEBUGP("calling ip_nat_mangle_tcp_packet\n");
  51
  52         *seq += strlen(buffer) - matchlen;
  53         return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
  54                                         matchlen, buffer, strlen(buffer));
  55 }
  56
  57 /* |1|132.235.1.2|6275| */
  58 static int
  59 mangle_eprt_packet(struct sk_buff **pskb,
  60                    u_int32_t newip,
  61                    u_int16_t port,
  62                    unsigned int matchoff,
  63                    unsigned int matchlen,
  64                    struct ip_conntrack *ct,
  65                    enum ip_conntrack_info ctinfo,
  66                    u32 *seq)
  67 {
  68         char buffer[sizeof("|1|255.255.255.255|65535|")];
  69
  70         sprintf(buffer, "|1|%u.%u.%u.%u|%u|", NIPQUAD(newip), port);
  71
  72         DEBUGP("calling ip_nat_mangle_tcp_packet\n");
  73
  74         *seq += strlen(buffer) - matchlen;
  75         return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
  76                                         matchlen, buffer, strlen(buffer));
  77 }
  78
  79 /* |1|132.235.1.2|6275| */
  80 static int
  81 mangle_epsv_packet(struct sk_buff **pskb,
  82                    u_int32_t newip,
  83                    u_int16_t port,
  84                    unsigned int matchoff,
  85                    unsigned int matchlen,
  86                    struct ip_conntrack *ct,
  87                    enum ip_conntrack_info ctinfo,
  88                    u32 *seq)
  89 {
  90         char buffer[sizeof("|||65535|")];
  91
  92         sprintf(buffer, "|||%u|", port);
  93
  94         DEBUGP("calling ip_nat_mangle_tcp_packet\n");
  95
  96         *seq += strlen(buffer) - matchlen;
  97         return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
  98                                         matchlen, buffer, strlen(buffer));
  99 }
 100
 101 static int (*mangle[])(struct sk_buff **, u_int32_t, u_int16_t,
 102                      unsigned int,
 103                      unsigned int,
 104                      struct ip_conntrack *,
 105                      enum ip_conntrack_info,
 106                      u32 *seq)
 107 = { [IP_CT_FTP_PORT] = mangle_rfc959_packet,
 108     [IP_CT_FTP_PASV] = mangle_rfc959_packet,
 109     [IP_CT_FTP_EPRT] = mangle_eprt_packet,
 110     [IP_CT_FTP_EPSV] = mangle_epsv_packet
 111 };
 112
 113 /* So, this packet has hit the connection tracking matching code.
 114    Mangle it, and change the expectation to match the new version. */
 115 static unsigned int ip_nat_ftp(struct sk_buff **pskb,
 116                                enum ip_conntrack_info ctinfo,
 117                                enum ip_ct_ftp_type type,
 118                                unsigned int matchoff,
 119                                unsigned int matchlen,
 120                                struct ip_conntrack_expect *exp,
 121                                u32 *seq)
 122 {
 123         u_int32_t newip;
 124         u_int16_t port;
 125         int dir = CTINFO2DIR(ctinfo);
 126         struct ip_conntrack *ct = exp->master;
 127
 128         DEBUGP("FTP_NAT: type %i, off %u len %u\n", type, matchoff, matchlen);
 129
 130         /* Connection will come from wherever this packet goes, hence !dir */
 131         newip = ct->tuplehash[!dir].tuple.dst.ip;
 132         exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
 133         exp->dir = !dir;
 134
 135         /* When you see the packet, we need to NAT it the same as the
 136          * this one. */
 137         exp->expectfn = ip_nat_follow_master;
 138
 139         /* Try to get same port: if not, try to change it. */
 140         for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) {
 141                 exp->tuple.dst.u.tcp.port = htons(port);
 142                 if (ip_conntrack_expect_related(exp) == 0)
 143                         break;
 144         }
 145
 146         if (port == 0) {
 147                 ip_conntrack_expect_free(exp);
 148                 return NF_DROP;
 149         }
 150
 151         if (!mangle[type](pskb, newip, port, matchoff, matchlen, ct, ctinfo,
 152                           seq)) {
 153                 ip_conntrack_unexpect_related(exp);
 154                 return NF_DROP;
 155         }
 156         return NF_ACCEPT;
 157 }
 158
 159 static void __exit fini(void)
 160 {
 161         ip_nat_ftp_hook = NULL;
 162         /* Make sure noone calls it, meanwhile. */
 163         synchronize_net();
 164 }
 165
 166 static int __init init(void)
 167 {
 168         BUG_ON(ip_nat_ftp_hook);
 169         ip_nat_ftp_hook = ip_nat_ftp;
 170         return 0;
 171 }
 172
 173 /* Prior to 2.6.11, we had a ports param.  No longer, but don't break users. */
 174 static int warn_set(const char *val, struct kernel_param *kp)
 175 {
 176         printk(KERN_INFO __stringify(KBUILD_MODNAME)
 177                ": kernel >= 2.6.10 only uses 'ports' for conntrack modules\n");
 178         return 0;
 179 }
 180 module_param_call(ports, warn_set, NULL, NULL, 0);
 181
 182 module_init(init);
 183 module_exit(fini);