FTP port selection ignores specified port ranges (with iptables masquerade --to-ports) when creating an expectation, based on FTP commands PORT or PASV, for the data connection. Co-developed-by: Anthony Lineham <anthony.lineham@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Anthony Lineham <anthony.lineham@xxxxxxxxxxxxxxxxxxx> Co-developed-by: Scott Parlane <scott.parlane@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Scott Parlane <scott.parlane@xxxxxxxxxxxxxxxxxxx> Co-developed-by: Blair Steven <blair.steven@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Blair Steven <blair.steven@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Cole Dishington <Cole.Dishington@xxxxxxxxxxxxxxxxxxx> --- Notes: Thanks for your time reviewing! Changes: - Avoid storing full range structure, only store min_proto and max_proto. - Store min and max_proto on nf_conn_nat rather than nf_conn. - Only store extra range info on nf_conn if NF_NAT_RANGE_PROTO_SPECIFIED and fallback to selecting from full port range. - Try to get same port if it matches the range. - Added net tag to subject. include/net/netfilter/nf_nat.h | 6 +++++ net/netfilter/nf_nat_core.c | 17 +++++++++---- net/netfilter/nf_nat_ftp.c | 44 +++++++++++++++++++++++++--------- net/netfilter/nf_nat_helper.c | 10 ++++++++ 4 files changed, 62 insertions(+), 15 deletions(-) diff --git a/include/net/netfilter/nf_nat.h b/include/net/netfilter/nf_nat.h index 0d412dd63707..231cffc16722 100644 --- a/include/net/netfilter/nf_nat.h +++ b/include/net/netfilter/nf_nat.h @@ -27,12 +27,18 @@ union nf_conntrack_nat_help { #endif }; +struct nf_conn_nat_range_info { + union nf_conntrack_man_proto min_proto; + union nf_conntrack_man_proto max_proto; +}; + /* The structure embedded in the conntrack structure. */ struct nf_conn_nat { union nf_conntrack_nat_help help; #if IS_ENABLED(CONFIG_NF_NAT_MASQUERADE) int masq_index; #endif + struct nf_conn_nat_range_info range_info; }; /* Set up the info structure to map into this range. */ diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c index ea923f8cf9c4..5412e9cf8189 100644 --- a/net/netfilter/nf_nat_core.c +++ b/net/netfilter/nf_nat_core.c @@ -397,10 +397,10 @@ find_best_ips_proto(const struct nf_conntrack_zone *zone, * * Per-protocol part of tuple is initialized to the incoming packet. */ -static void nf_nat_l4proto_unique_tuple(struct nf_conntrack_tuple *tuple, - const struct nf_nat_range2 *range, - enum nf_nat_manip_type maniptype, - const struct nf_conn *ct) +void nf_nat_l4proto_unique_tuple(struct nf_conntrack_tuple *tuple, + const struct nf_nat_range2 *range, + enum nf_nat_manip_type maniptype, + const struct nf_conn *ct) { unsigned int range_size, min, max, i, attempts; __be16 *keyptr; @@ -601,6 +601,7 @@ nf_nat_setup_info(struct nf_conn *ct, const struct nf_nat_range2 *range, enum nf_nat_manip_type maniptype) { + struct nf_conn_nat *nat; struct net *net = nf_ct_net(ct); struct nf_conntrack_tuple curr_tuple, new_tuple; @@ -623,6 +624,14 @@ nf_nat_setup_info(struct nf_conn *ct, &ct->tuplehash[IP_CT_DIR_REPLY].tuple); get_unique_tuple(&new_tuple, &curr_tuple, range, ct, maniptype); + if (range && (range->flags & NF_NAT_RANGE_PROTO_SPECIFIED)) { + nat = nf_ct_nat_ext_add(ct); + if (WARN_ON_ONCE(!nat)) + return NF_DROP; + + nat->range_info.min_proto = range->min_proto; + nat->range_info.max_proto = range->max_proto; + } if (!nf_ct_tuple_equal(&new_tuple, &curr_tuple)) { struct nf_conntrack_tuple reply; diff --git a/net/netfilter/nf_nat_ftp.c b/net/netfilter/nf_nat_ftp.c index aace6768a64e..cf675dc589be 100644 --- a/net/netfilter/nf_nat_ftp.c +++ b/net/netfilter/nf_nat_ftp.c @@ -17,6 +17,10 @@ #include <net/netfilter/nf_conntrack_helper.h> #include <net/netfilter/nf_conntrack_expect.h> #include <linux/netfilter/nf_conntrack_ftp.h> +void nf_nat_l4proto_unique_tuple(struct nf_conntrack_tuple *tuple, + const struct nf_nat_range2 *range, + enum nf_nat_manip_type maniptype, + const struct nf_conn *ct); #define NAT_HELPER_NAME "ftp" @@ -72,8 +76,14 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb, u_int16_t port; int dir = CTINFO2DIR(ctinfo); struct nf_conn *ct = exp->master; + struct nf_conn_nat *nat = nfct_nat(ct); + struct nf_nat_range2 range = {}; char buffer[sizeof("|1||65535|") + INET6_ADDRSTRLEN]; unsigned int buflen; + int ret; + + if (WARN_ON_ONCE(!nat)) + return NF_DROP; pr_debug("type %i, off %u len %u\n", type, matchoff, matchlen); @@ -86,21 +96,33 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb, * this one. */ exp->expectfn = nf_nat_follow_master; - /* Try to get same port: if not, try to change it. */ - for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) { - int ret; + if (htons(nat->range_info.min_proto.all) == 0 || + htons(nat->range_info.max_proto.all) == 0) { + range.min_proto.all = htons(1); + range.max_proto.all = htons(65535); + } else { + range.min_proto = nat->range_info.min_proto; + range.max_proto = nat->range_info.max_proto; + } + range.flags = NF_NAT_RANGE_PROTO_SPECIFIED; - exp->tuple.dst.u.tcp.port = htons(port); + /* Try to get same port if it matches NAT rule: if not, try to change it. */ + ret = -1; + port = ntohs(exp->tuple.dst.u.tcp.port); + if (port != 0 && ntohs(range.min_proto.all) <= port && + port <= ntohs(range.max_proto.all)) { ret = nf_ct_expect_related(exp, 0); - if (ret == 0) - break; - else if (ret != -EBUSY) { - port = 0; - break; + } + if (ret != 0 || port == 0) { + if (!dir) { + nf_nat_l4proto_unique_tuple(&exp->tuple, &range, + NF_NAT_MANIP_DST, + ct); } + port = ntohs(exp->tuple.dst.u.tcp.port); + ret = nf_ct_expect_related(exp, 0); } - - if (port == 0) { + if (ret != 0 || port == 0) { nf_ct_helper_log(skb, ct, "all ports in use"); return NF_DROP; } diff --git a/net/netfilter/nf_nat_helper.c b/net/netfilter/nf_nat_helper.c index a263505455fc..29fa78cfdb9c 100644 --- a/net/netfilter/nf_nat_helper.c +++ b/net/netfilter/nf_nat_helper.c @@ -188,6 +188,16 @@ void nf_nat_follow_master(struct nf_conn *ct, range.flags = NF_NAT_RANGE_MAP_IPS; range.min_addr = range.max_addr = ct->master->tuplehash[!exp->dir].tuple.dst.u3; + if (exp->master && !exp->dir) { + struct nf_conn_nat *nat = nfct_nat(exp->master); + + if (nat && nat->range_info.min_proto.all != 0 && + nat->range_info.max_proto.all != 0) { + range.min_proto = nat->range_info.min_proto; + range.max_proto = nat->range_info.max_proto; + range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; + } + } nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC); /* For DST manip, map port here to where it's expected. */ -- 2.33.0