1/* FTP extension for TCP NAT alteration. */
2
3/* (C) 1999-2001 Paul `Rusty' Russell
4 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11#include <linux/module.h>
12#include <linux/moduleparam.h>
13#include <linux/inet.h>
14#include <linux/tcp.h>
15#include <linux/netfilter_ipv4.h>
16#include <net/netfilter/nf_nat.h>
17#include <net/netfilter/nf_nat_helper.h>
18#include <net/netfilter/nf_conntrack_helper.h>
19#include <net/netfilter/nf_conntrack_expect.h>
20#include <linux/netfilter/nf_conntrack_ftp.h>
21
22MODULE_LICENSE("GPL");
23MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
24MODULE_DESCRIPTION("ftp NAT helper");
25MODULE_ALIAS("ip_nat_ftp");
26
27/* FIXME: Time out? --RR */
28
29static int nf_nat_ftp_fmt_cmd(struct nf_conn *ct, enum nf_ct_ftp_type type,
30			      char *buffer, size_t buflen,
31			      union nf_inet_addr *addr, u16 port)
32{
33	switch (type) {
34	case NF_CT_FTP_PORT:
35	case NF_CT_FTP_PASV:
36		return snprintf(buffer, buflen, "%u,%u,%u,%u,%u,%u",
37				((unsigned char *)&addr->ip)[0],
38				((unsigned char *)&addr->ip)[1],
39				((unsigned char *)&addr->ip)[2],
40				((unsigned char *)&addr->ip)[3],
41				port >> 8,
42				port & 0xFF);
43	case NF_CT_FTP_EPRT:
44		if (nf_ct_l3num(ct) == NFPROTO_IPV4)
45			return snprintf(buffer, buflen, "|1|%pI4|%u|",
46					&addr->ip, port);
47		else
48			return snprintf(buffer, buflen, "|2|%pI6|%u|",
49					&addr->ip6, port);
50	case NF_CT_FTP_EPSV:
51		return snprintf(buffer, buflen, "|||%u|", port);
52	}
53
54	return 0;
55}
56
57/* So, this packet has hit the connection tracking matching code.
58   Mangle it, and change the expectation to match the new version. */
59static unsigned int nf_nat_ftp(struct sk_buff *skb,
60			       enum ip_conntrack_info ctinfo,
61			       enum nf_ct_ftp_type type,
62			       unsigned int protoff,
63			       unsigned int matchoff,
64			       unsigned int matchlen,
65			       struct nf_conntrack_expect *exp)
66{
67	union nf_inet_addr newaddr;
68	u_int16_t port;
69	int dir = CTINFO2DIR(ctinfo);
70	struct nf_conn *ct = exp->master;
71	char buffer[sizeof("|1||65535|") + INET6_ADDRSTRLEN];
72	unsigned int buflen;
73
74	pr_debug("FTP_NAT: type %i, off %u len %u\n", type, matchoff, matchlen);
75
76	/* Connection will come from wherever this packet goes, hence !dir */
77	newaddr = ct->tuplehash[!dir].tuple.dst.u3;
78	exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
79	exp->dir = !dir;
80
81	/* When you see the packet, we need to NAT it the same as the
82	 * this one. */
83	exp->expectfn = nf_nat_follow_master;
84
85	/* Try to get same port: if not, try to change it. */
86	for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) {
87		int ret;
88
89		exp->tuple.dst.u.tcp.port = htons(port);
90		ret = nf_ct_expect_related(exp);
91		if (ret == 0)
92			break;
93		else if (ret != -EBUSY) {
94			port = 0;
95			break;
96		}
97	}
98
99	if (port == 0) {
100		nf_ct_helper_log(skb, ct, "all ports in use");
101		return NF_DROP;
102	}
103
104	buflen = nf_nat_ftp_fmt_cmd(ct, type, buffer, sizeof(buffer),
105				    &newaddr, port);
106	if (!buflen)
107		goto out;
108
109	pr_debug("calling nf_nat_mangle_tcp_packet\n");
110
111	if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, matchoff,
112				      matchlen, buffer, buflen))
113		goto out;
114
115	return NF_ACCEPT;
116
117out:
118	nf_ct_helper_log(skb, ct, "cannot mangle packet");
119	nf_ct_unexpect_related(exp);
120	return NF_DROP;
121}
122
123static void __exit nf_nat_ftp_fini(void)
124{
125	RCU_INIT_POINTER(nf_nat_ftp_hook, NULL);
126	synchronize_rcu();
127}
128
129static int __init nf_nat_ftp_init(void)
130{
131	BUG_ON(nf_nat_ftp_hook != NULL);
132	RCU_INIT_POINTER(nf_nat_ftp_hook, nf_nat_ftp);
133	return 0;
134}
135
136/* Prior to 2.6.11, we had a ports param.  No longer, but don't break users. */
137static int warn_set(const char *val, struct kernel_param *kp)
138{
139	printk(KERN_INFO KBUILD_MODNAME
140	       ": kernel >= 2.6.10 only uses 'ports' for conntrack modules\n");
141	return 0;
142}
143module_param_call(ports, warn_set, NULL, NULL, 0);
144
145module_init(nf_nat_ftp_init);
146module_exit(nf_nat_ftp_fini);
147