netfilter: nf_nat: support IPv6 in FTP NAT helper
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
parent
ed72d9e294
commit
d33cbeeb1a
|
@ -221,11 +221,6 @@ config NF_NAT_PROTO_GRE
|
||||||
tristate
|
tristate
|
||||||
depends on NF_NAT_IPV4 && NF_CT_PROTO_GRE
|
depends on NF_NAT_IPV4 && NF_CT_PROTO_GRE
|
||||||
|
|
||||||
config NF_NAT_FTP
|
|
||||||
tristate
|
|
||||||
depends on NF_CONNTRACK && NF_NAT_IPV4
|
|
||||||
default NF_NAT_IPV4 && NF_CONNTRACK_FTP
|
|
||||||
|
|
||||||
config NF_NAT_IRC
|
config NF_NAT_IRC
|
||||||
tristate
|
tristate
|
||||||
depends on NF_CONNTRACK && NF_NAT_IPV4
|
depends on NF_CONNTRACK && NF_NAT_IPV4
|
||||||
|
|
|
@ -21,7 +21,6 @@ obj-$(CONFIG_NF_DEFRAG_IPV4) += nf_defrag_ipv4.o
|
||||||
|
|
||||||
# NAT helpers (nf_conntrack)
|
# NAT helpers (nf_conntrack)
|
||||||
obj-$(CONFIG_NF_NAT_AMANDA) += nf_nat_amanda.o
|
obj-$(CONFIG_NF_NAT_AMANDA) += nf_nat_amanda.o
|
||||||
obj-$(CONFIG_NF_NAT_FTP) += nf_nat_ftp.o
|
|
||||||
obj-$(CONFIG_NF_NAT_H323) += nf_nat_h323.o
|
obj-$(CONFIG_NF_NAT_H323) += nf_nat_h323.o
|
||||||
obj-$(CONFIG_NF_NAT_IRC) += nf_nat_irc.o
|
obj-$(CONFIG_NF_NAT_IRC) += nf_nat_irc.o
|
||||||
obj-$(CONFIG_NF_NAT_PPTP) += nf_nat_pptp.o
|
obj-$(CONFIG_NF_NAT_PPTP) += nf_nat_pptp.o
|
||||||
|
|
|
@ -380,6 +380,11 @@ config NF_NAT_PROTO_SCTP
|
||||||
depends on NF_NAT && NF_CT_PROTO_SCTP
|
depends on NF_NAT && NF_CT_PROTO_SCTP
|
||||||
select LIBCRC32C
|
select LIBCRC32C
|
||||||
|
|
||||||
|
config NF_NAT_FTP
|
||||||
|
tristate
|
||||||
|
depends on NF_CONNTRACK && NF_NAT
|
||||||
|
default NF_NAT && NF_CONNTRACK_FTP
|
||||||
|
|
||||||
endif # NF_CONNTRACK
|
endif # NF_CONNTRACK
|
||||||
|
|
||||||
# transparent proxy support
|
# transparent proxy support
|
||||||
|
|
|
@ -54,6 +54,9 @@ obj-$(CONFIG_NF_NAT_PROTO_DCCP) += nf_nat_proto_dccp.o
|
||||||
obj-$(CONFIG_NF_NAT_PROTO_UDPLITE) += nf_nat_proto_udplite.o
|
obj-$(CONFIG_NF_NAT_PROTO_UDPLITE) += nf_nat_proto_udplite.o
|
||||||
obj-$(CONFIG_NF_NAT_PROTO_SCTP) += nf_nat_proto_sctp.o
|
obj-$(CONFIG_NF_NAT_PROTO_SCTP) += nf_nat_proto_sctp.o
|
||||||
|
|
||||||
|
# NAT helpers
|
||||||
|
obj-$(CONFIG_NF_NAT_FTP) += nf_nat_ftp.o
|
||||||
|
|
||||||
# transparent proxy support
|
# transparent proxy support
|
||||||
obj-$(CONFIG_NETFILTER_TPROXY) += nf_tproxy_core.o
|
obj-$(CONFIG_NETFILTER_TPROXY) += nf_tproxy_core.o
|
||||||
|
|
||||||
|
|
|
@ -488,8 +488,7 @@ static int help(struct sk_buff *skb,
|
||||||
/* Now, NAT might want to mangle the packet, and register the
|
/* Now, NAT might want to mangle the packet, and register the
|
||||||
* (possibly changed) expectation itself. */
|
* (possibly changed) expectation itself. */
|
||||||
nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
|
nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
|
||||||
if (nf_nat_ftp && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
|
if (nf_nat_ftp && ct->status & IPS_NAT_MASK)
|
||||||
ct->status & IPS_NAT_MASK)
|
|
||||||
ret = nf_nat_ftp(skb, ctinfo, search[dir][i].ftptype,
|
ret = nf_nat_ftp(skb, ctinfo, search[dir][i].ftptype,
|
||||||
protoff, matchoff, matchlen, exp);
|
protoff, matchoff, matchlen, exp);
|
||||||
else {
|
else {
|
||||||
|
|
|
@ -10,7 +10,7 @@
|
||||||
|
|
||||||
#include <linux/module.h>
|
#include <linux/module.h>
|
||||||
#include <linux/moduleparam.h>
|
#include <linux/moduleparam.h>
|
||||||
#include <linux/ip.h>
|
#include <linux/inet.h>
|
||||||
#include <linux/tcp.h>
|
#include <linux/tcp.h>
|
||||||
#include <linux/netfilter_ipv4.h>
|
#include <linux/netfilter_ipv4.h>
|
||||||
#include <net/netfilter/nf_nat.h>
|
#include <net/netfilter/nf_nat.h>
|
||||||
|
@ -26,22 +26,27 @@ MODULE_ALIAS("ip_nat_ftp");
|
||||||
|
|
||||||
/* FIXME: Time out? --RR */
|
/* FIXME: Time out? --RR */
|
||||||
|
|
||||||
static int nf_nat_ftp_fmt_cmd(enum nf_ct_ftp_type type,
|
static int nf_nat_ftp_fmt_cmd(struct nf_conn *ct, enum nf_ct_ftp_type type,
|
||||||
char *buffer, size_t buflen,
|
char *buffer, size_t buflen,
|
||||||
__be32 addr, u16 port)
|
union nf_inet_addr *addr, u16 port)
|
||||||
{
|
{
|
||||||
switch (type) {
|
switch (type) {
|
||||||
case NF_CT_FTP_PORT:
|
case NF_CT_FTP_PORT:
|
||||||
case NF_CT_FTP_PASV:
|
case NF_CT_FTP_PASV:
|
||||||
return snprintf(buffer, buflen, "%u,%u,%u,%u,%u,%u",
|
return snprintf(buffer, buflen, "%u,%u,%u,%u,%u,%u",
|
||||||
((unsigned char *)&addr)[0],
|
((unsigned char *)&addr->ip)[0],
|
||||||
((unsigned char *)&addr)[1],
|
((unsigned char *)&addr->ip)[1],
|
||||||
((unsigned char *)&addr)[2],
|
((unsigned char *)&addr->ip)[2],
|
||||||
((unsigned char *)&addr)[3],
|
((unsigned char *)&addr->ip)[3],
|
||||||
port >> 8,
|
port >> 8,
|
||||||
port & 0xFF);
|
port & 0xFF);
|
||||||
case NF_CT_FTP_EPRT:
|
case NF_CT_FTP_EPRT:
|
||||||
return snprintf(buffer, buflen, "|1|%pI4|%u|", &addr, port);
|
if (nf_ct_l3num(ct) == NFPROTO_IPV4)
|
||||||
|
return snprintf(buffer, buflen, "|1|%pI4|%u|",
|
||||||
|
&addr->ip, port);
|
||||||
|
else
|
||||||
|
return snprintf(buffer, buflen, "|2|%pI6|%u|",
|
||||||
|
&addr->ip6, port);
|
||||||
case NF_CT_FTP_EPSV:
|
case NF_CT_FTP_EPSV:
|
||||||
return snprintf(buffer, buflen, "|||%u|", port);
|
return snprintf(buffer, buflen, "|||%u|", port);
|
||||||
}
|
}
|
||||||
|
@ -59,17 +64,17 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb,
|
||||||
unsigned int matchlen,
|
unsigned int matchlen,
|
||||||
struct nf_conntrack_expect *exp)
|
struct nf_conntrack_expect *exp)
|
||||||
{
|
{
|
||||||
__be32 newip;
|
union nf_inet_addr newaddr;
|
||||||
u_int16_t port;
|
u_int16_t port;
|
||||||
int dir = CTINFO2DIR(ctinfo);
|
int dir = CTINFO2DIR(ctinfo);
|
||||||
struct nf_conn *ct = exp->master;
|
struct nf_conn *ct = exp->master;
|
||||||
char buffer[sizeof("|1|255.255.255.255|65535|")];
|
char buffer[sizeof("|1||65535|") + INET6_ADDRSTRLEN];
|
||||||
unsigned int buflen;
|
unsigned int buflen;
|
||||||
|
|
||||||
pr_debug("FTP_NAT: type %i, off %u len %u\n", type, matchoff, matchlen);
|
pr_debug("FTP_NAT: type %i, off %u len %u\n", type, matchoff, matchlen);
|
||||||
|
|
||||||
/* Connection will come from wherever this packet goes, hence !dir */
|
/* Connection will come from wherever this packet goes, hence !dir */
|
||||||
newip = ct->tuplehash[!dir].tuple.dst.u3.ip;
|
newaddr = ct->tuplehash[!dir].tuple.dst.u3;
|
||||||
exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
|
exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
|
||||||
exp->dir = !dir;
|
exp->dir = !dir;
|
||||||
|
|
||||||
|
@ -94,7 +99,8 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb,
|
||||||
if (port == 0)
|
if (port == 0)
|
||||||
return NF_DROP;
|
return NF_DROP;
|
||||||
|
|
||||||
buflen = nf_nat_ftp_fmt_cmd(type, buffer, sizeof(buffer), newip, port);
|
buflen = nf_nat_ftp_fmt_cmd(ct, type, buffer, sizeof(buffer),
|
||||||
|
&newaddr, port);
|
||||||
if (!buflen)
|
if (!buflen)
|
||||||
goto out;
|
goto out;
|
||||||
|
|
Reference in New Issue