* [NETFILTER 1/2]: nf_conntrack_ftp: don't call NAT helper for unNATed connections @ 2006-11-04 23:04 Patrick McHardy 2006-11-04 23:58 ` [NETFILTER 3/*]: nf_conntrack/nf_nat: add TFTP helper port Patrick McHardy 0 siblings, 1 reply; 5+ messages in thread From: Patrick McHardy @ 2006-11-04 23:04 UTC (permalink / raw) To: Jozsef Kadlecsik; +Cc: Netfilter Development Mailinglist, Yasuyuki Kozakai [-- Attachment #1: Type: text/plain, Size: 136 bytes --] Small fix to the FTP conntrack helper not to call the NAT helper for IPv6 (or other unNATed) packets. On top of the previous patches. [-- Attachment #2: 01.diff --] [-- Type: text/plain, Size: 1239 bytes --] [NETFILTER]: nf_conntrack_ftp: don't call NAT helper for unNATed connections Since both IPv4 and IPv6 are handled by the connection tracking helper but only IPv4 supports NAT we must make sure not to call the NAT helper for unNATed connections. Signed-off-by: Patrick McHardy <kaber@trash.net> --- commit 49993257192a278f6dc7f288e6ef62059ba88762 tree 8bb4d24ab3b5a0325198c5fa0959d44b0841f9c7 parent aa3104784034fe4a9971de642e962c18b51f5a00 author Patrick McHardy <kaber@trash.net> Sat, 04 Nov 2006 21:29:22 +0100 committer Patrick McHardy <kaber@trash.net> Sat, 04 Nov 2006 21:29:22 +0100 net/netfilter/nf_conntrack_ftp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c index 10836fc..84b3f2a 100644 --- a/net/netfilter/nf_conntrack_ftp.c +++ b/net/netfilter/nf_conntrack_ftp.c @@ -520,7 +520,7 @@ static int help(struct sk_buff **pskb, /* Now, NAT might want to mangle the packet, and register the * (possibly changed) expectation itself. */ - if (nf_nat_ftp_hook) + if (nf_nat_ftp_hook && ct->status & IPS_NAT_MASK) ret = nf_nat_ftp_hook(pskb, ctinfo, search[dir][i].ftptype, matchoff, matchlen, exp, &seq); else { ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [NETFILTER 3/*]: nf_conntrack/nf_nat: add TFTP helper port 2006-11-04 23:04 [NETFILTER 1/2]: nf_conntrack_ftp: don't call NAT helper for unNATed connections Patrick McHardy @ 2006-11-04 23:58 ` Patrick McHardy 2006-11-05 0:32 ` [NETFILTER 4/*]: nf_conntrack/nf_nat: add amanda " Patrick McHardy 0 siblings, 1 reply; 5+ messages in thread From: Patrick McHardy @ 2006-11-04 23:58 UTC (permalink / raw) To: Jozsef Kadlecsik; +Cc: Netfilter Development Mailinglist, Yasuyuki Kozakai [-- Attachment #1: Type: text/plain, Size: 38 bytes --] Port the TFTP conntrack/NAT helpers. [-- Attachment #2: x --] [-- Type: text/plain, Size: 10188 bytes --] [NETFILTER]: nf_conntrack/nf_nat: add TFTP helper port Signed-off-by: Patrick McHardy <kaber@trash.net> --- commit 6cd9f9c0864b0a18a99b722bb15949effc0758a7 tree cc7aa5c69b11c96800f1179d43aaabdc703cf7b8 parent a6c08049039463f18272fa8e7139aadb8a950d22 author Patrick McHardy <kaber@trash.net> Sun, 05 Nov 2006 00:53:38 +0100 committer Patrick McHardy <kaber@trash.net> Sun, 05 Nov 2006 00:53:38 +0100 include/linux/netfilter/nf_conntrack_tftp.h | 20 +++ net/ipv4/netfilter/Kconfig | 5 + net/ipv4/netfilter/Makefile | 1 net/ipv4/netfilter/nf_nat_tftp.c | 51 ++++++++ net/netfilter/Kconfig | 11 ++ net/netfilter/Makefile | 1 net/netfilter/nf_conntrack_tftp.c | 164 +++++++++++++++++++++++++++ 7 files changed, 253 insertions(+), 0 deletions(-) diff --git a/include/linux/netfilter/nf_conntrack_tftp.h b/include/linux/netfilter/nf_conntrack_tftp.h new file mode 100644 index 0000000..93f3c18 --- /dev/null +++ b/include/linux/netfilter/nf_conntrack_tftp.h @@ -0,0 +1,20 @@ +#ifndef _NF_CONNTRACK_TFTP_H +#define _NF_CONNTRACK_TFTP_H + +#define TFTP_PORT 69 + +struct tftphdr { + u_int16_t opcode; +}; + +#define TFTP_OPCODE_READ 1 +#define TFTP_OPCODE_WRITE 2 +#define TFTP_OPCODE_DATA 3 +#define TFTP_OPCODE_ACK 4 +#define TFTP_OPCODE_ERROR 5 + +extern unsigned int (*nf_nat_tftp_hook)(struct sk_buff **pskb, + enum ip_conntrack_info ctinfo, + struct nf_conntrack_expect *exp); + +#endif /* _NF_CONNTRACK_TFTP_H */ diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig index 5867f7b..598865e 100644 --- a/net/ipv4/netfilter/Kconfig +++ b/net/ipv4/netfilter/Kconfig @@ -513,6 +513,11 @@ config IP_NF_NAT_TFTP default IP_NF_NAT if IP_NF_TFTP=y default m if IP_NF_TFTP=m +config NF_NAT_TFTP + tristate + depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT + default NF_NAT && NF_CONNTRACK_TFTP + config IP_NF_NAT_AMANDA tristate depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile index 30e470d..fcf3460 100644 --- a/net/ipv4/netfilter/Makefile +++ b/net/ipv4/netfilter/Makefile @@ -51,6 +51,7 @@ obj-$(CONFIG_IP_NF_NAT_SIP) += ip_nat_si # NAT helpers (nf_conntrack) obj-$(CONFIG_NF_NAT_FTP) += nf_nat_ftp.o +obj-$(CONFIG_NF_NAT_TFTP) += nf_nat_tftp.o obj-$(CONFIG_NF_NAT_SIP) += nf_nat_sip.o # generic IP tables diff --git a/net/ipv4/netfilter/nf_nat_tftp.c b/net/ipv4/netfilter/nf_nat_tftp.c new file mode 100644 index 0000000..2fc063b --- /dev/null +++ b/net/ipv4/netfilter/nf_nat_tftp.c @@ -0,0 +1,51 @@ +/* (C) 2001-2002 Magnus Boden <mb@ozaba.mine.nu> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#include <linux/module.h> +#include <linux/moduleparam.h> +#include <linux/udp.h> + +#include <net/netfilter/nf_nat_helper.h> +#include <net/netfilter/nf_nat_rule.h> +#include <net/netfilter/nf_conntrack_helper.h> +#include <net/netfilter/nf_conntrack_expect.h> +#include <linux/netfilter/nf_conntrack_tftp.h> + +MODULE_AUTHOR("Magnus Boden <mb@ozaba.mine.nu>"); +MODULE_DESCRIPTION("TFTP NAT helper"); +MODULE_LICENSE("GPL"); + +static unsigned int help(struct sk_buff **pskb, + enum ip_conntrack_info ctinfo, + struct nf_conntrack_expect *exp) +{ + struct nf_conn *ct = exp->master; + + exp->saved_proto.udp.port + = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port; + exp->dir = IP_CT_DIR_REPLY; + exp->expectfn = nf_nat_follow_master; + if (nf_conntrack_expect_related(exp) != 0) + return NF_DROP; + return NF_ACCEPT; +} + +static void __exit nf_nat_tftp_fini(void) +{ + nf_nat_tftp_hook = NULL; + synchronize_net(); +} + +static int __init nf_nat_tftp_init(void) +{ + BUG_ON(nf_nat_tftp_hook); + nf_nat_tftp_hook = help; + return 0; +} + +module_init(nf_nat_tftp_init); +module_exit(nf_nat_tftp_fini); diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig index f3be7f4..65844d7 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig @@ -150,6 +150,17 @@ config NF_CONNTRACK_FTP To compile it as a module, choose M here. If unsure, say N. +config NF_CONNTRACK_TFTP + tristate "TFTP support on new connection tracking (EXPERIMENTAL)" + depends on EXPERIMENTAL && NF_CONNTRACK + help + TFTP connection tracking helper, this is required depending + on how restrictive your ruleset is. + If you are using a tftp client behind -j SNAT or -j MASQUERADING + you will need this. + + To compile it as a module, choose M here. If unsure, say N. + config NF_CONNTRACK_SIP tristate "SIP support on new connection tracking (EXPERIMENTAL)" depends on EXPERIMENTAL && NF_CONNTRACK diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile index e50eed6..747bb78 100644 --- a/net/netfilter/Makefile +++ b/net/netfilter/Makefile @@ -20,6 +20,7 @@ obj-$(CONFIG_NF_CT_NETLINK) += nf_conntr # connection tracking helpers obj-$(CONFIG_NF_CONNTRACK_FTP) += nf_conntrack_ftp.o +obj-$(CONFIG_NF_CONNTRACK_TFTP) += nf_conntrack_tftp.o obj-$(CONFIG_NF_CONNTRACK_SIP) += nf_conntrack_sip.o # generic X tables diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c new file mode 100644 index 0000000..6c592bf --- /dev/null +++ b/net/netfilter/nf_conntrack_tftp.c @@ -0,0 +1,164 @@ +/* (C) 2001-2002 Magnus Boden <mb@ozaba.mine.nu> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#include <linux/module.h> +#include <linux/moduleparam.h> +#include <linux/in.h> +#include <linux/udp.h> + +#include <net/netfilter/nf_conntrack.h> +#include <net/netfilter/nf_conntrack_tuple.h> +#include <net/netfilter/nf_conntrack_expect.h> +#include <net/netfilter/nf_conntrack_ecache.h> +#include <net/netfilter/nf_conntrack_helper.h> +#include <linux/netfilter/nf_conntrack_tftp.h> + +MODULE_AUTHOR("Magnus Boden <mb@ozaba.mine.nu>"); +MODULE_DESCRIPTION("TFTP connection tracking helper"); +MODULE_LICENSE("GPL"); + +#define MAX_PORTS 8 +static unsigned short ports[MAX_PORTS]; +static int ports_c; +module_param_array(ports, ushort, &ports_c, 0400); +MODULE_PARM_DESC(ports, "Port numbers of TFTP servers"); + +#if 0 +#define DEBUGP(format, args...) printk("%s:%s:" format, \ + __FILE__, __FUNCTION__ , ## args) +#else +#define DEBUGP(format, args...) +#endif + +unsigned int (*nf_nat_tftp_hook)(struct sk_buff **pskb, + enum ip_conntrack_info ctinfo, + struct nf_conntrack_expect *exp); +EXPORT_SYMBOL_GPL(nf_nat_tftp_hook); + +static int tftp_help(struct sk_buff **pskb, + unsigned int protoff, + struct nf_conn *ct, + enum ip_conntrack_info ctinfo) +{ + struct tftphdr _tftph, *tfh; + struct nf_conntrack_expect *exp; + unsigned int ret = NF_ACCEPT; + int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num; + + tfh = skb_header_pointer(*pskb, protoff + sizeof(struct udphdr), + sizeof(_tftph), &_tftph); + if (tfh == NULL) + return NF_ACCEPT; + + switch (ntohs(tfh->opcode)) { + case TFTP_OPCODE_READ: + case TFTP_OPCODE_WRITE: + /* RRQ and WRQ works the same way */ + DEBUGP(""); + NF_CT_DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple); + NF_CT_DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_REPLY].tuple); + + exp = nf_conntrack_expect_alloc(ct); + if (exp == NULL) + return NF_DROP; + + exp->tuple.src.l3num = family; + exp->tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple; + exp->mask.src.l3num = htons(0xFFFF); + if (family == AF_INET) { + exp->mask.src.u3.ip = htonl(0xffffffff); + exp->mask.dst.u3.ip = htonl(0xffffffff); + } else { + memset(&exp->mask.src.u3, 0xff, sizeof(exp->mask.src.u3)); + memset(&exp->mask.dst.u3, 0xff, sizeof(exp->mask.src.u3)); + } + exp->mask.src.u.udp.port = 0; + exp->mask.dst.u.udp.port = htons(0xffff); + exp->mask.dst.protonum = 0xff; + exp->expectfn = NULL; + exp->flags = 0; + + DEBUGP("expect: "); + NF_CT_DUMP_TUPLE(&exp->tuple); + NF_CT_DUMP_TUPLE(&exp->mask); + if (nf_nat_tftp_hook && ct->status & IPS_NAT_MASK) + ret = nf_nat_tftp_hook(pskb, ctinfo, exp); + else if (nf_conntrack_expect_related(exp) != 0) + ret = NF_DROP; + nf_conntrack_expect_put(exp); + break; + case TFTP_OPCODE_DATA: + case TFTP_OPCODE_ACK: + DEBUGP("Data/ACK opcode\n"); + break; + case TFTP_OPCODE_ERROR: + DEBUGP("Error opcode\n"); + break; + default: + DEBUGP("Unknown opcode\n"); + } + return ret; +} + +static struct nf_conntrack_helper tftp[MAX_PORTS][2]; +static char tftp_names[MAX_PORTS][2][sizeof("tftp-65535")]; + +static void nf_conntrack_tftp_fini(void) +{ + int i, j; + + for (i = 0; i < ports_c; i++) { + for (j = 0; j < 2; j++) + nf_conntrack_helper_unregister(&tftp[i][j]); + } +} + +static int __init nf_conntrack_tftp_init(void) +{ + int i, j, ret; + char *tmpname; + + if (ports_c == 0) + ports[ports_c++] = TFTP_PORT; + + for (i = 0; i < ports_c; i++) { + memset(&tftp[i], 0, sizeof(tftp[i])); + + tftp[i][0].tuple.src.l3num = AF_INET; + tftp[i][1].tuple.src.l3num = AF_INET6; + for (j = 0; j < 2; j++) { + tftp[i][j].tuple.dst.protonum = IPPROTO_UDP; + tftp[i][j].tuple.src.u.udp.port = htons(ports[i]); + tftp[i][j].mask.dst.protonum = 0xFF; + tftp[i][j].mask.src.u.udp.port = htons(0xFFFF); + tftp[i][j].max_expected = 1; + tftp[i][j].timeout = 5 * 60; /* 5 minutes */ + tftp[i][j].me = THIS_MODULE; + tftp[i][j].help = tftp_help; + + tmpname = &tftp_names[i][j][0]; + if (ports[i] == TFTP_PORT) + sprintf(tmpname, "tftp"); + else + sprintf(tmpname, "tftp-%u", i); + tftp[i][j].name = tmpname; + + ret = nf_conntrack_helper_register(&tftp[i][j]); + if (ret) { + printk("nf_ct_tftp: failed to register helper " + "for pf: %u port: %u\n", + tftp[i][j].tuple.src.l3num, ports[i]); + nf_conntrack_tftp_fini(); + return ret; + } + } + } + return 0; +} + +module_init(nf_conntrack_tftp_init); +module_exit(nf_conntrack_tftp_fini); ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [NETFILTER 4/*]: nf_conntrack/nf_nat: add amanda helper port 2006-11-04 23:58 ` [NETFILTER 3/*]: nf_conntrack/nf_nat: add TFTP helper port Patrick McHardy @ 2006-11-05 0:32 ` Patrick McHardy 2006-11-14 19:54 ` [PATCH] nf_conntrack/nf_nat: nf_conntrack_netlink fix Jozsef Kadlecsik 0 siblings, 1 reply; 5+ messages in thread From: Patrick McHardy @ 2006-11-05 0:32 UTC (permalink / raw) To: Jozsef Kadlecsik; +Cc: Netfilter Development Mailinglist, Yasuyuki Kozakai [-- Attachment #1: Type: text/plain, Size: 1 bytes --] [-- Attachment #2: x --] [-- Type: text/plain, Size: 13283 bytes --] [NETFILTER]: nf_conntrack/nf_nat: add amanda helper port Signed-off-by: Patrick McHardy <kaber@trash.net> --- commit 22f4d1e132bd33107e8793466cae9695472843a8 tree 2cbff613e5117166047fc50ddb514a324b8717d2 parent 6cd9f9c0864b0a18a99b722bb15949effc0758a7 author Patrick McHardy <kaber@trash.net> Sun, 05 Nov 2006 01:30:55 +0100 committer Patrick McHardy <kaber@trash.net> Sun, 05 Nov 2006 01:30:55 +0100 include/linux/netfilter/nf_conntrack_amanda.h | 10 + net/ipv4/netfilter/Kconfig | 5 + net/ipv4/netfilter/Makefile | 1 net/ipv4/netfilter/nf_nat_amanda.c | 78 ++++++++ net/netfilter/Kconfig | 15 ++ net/netfilter/Makefile | 1 net/netfilter/nf_conntrack_amanda.c | 246 +++++++++++++++++++++++++ 7 files changed, 356 insertions(+), 0 deletions(-) diff --git a/include/linux/netfilter/nf_conntrack_amanda.h b/include/linux/netfilter/nf_conntrack_amanda.h new file mode 100644 index 0000000..26c2235 --- /dev/null +++ b/include/linux/netfilter/nf_conntrack_amanda.h @@ -0,0 +1,10 @@ +#ifndef _NF_CONNTRACK_AMANDA_H +#define _NF_CONNTRACK_AMANDA_H +/* AMANDA tracking. */ + +extern unsigned int (*nf_nat_amanda_hook)(struct sk_buff **pskb, + enum ip_conntrack_info ctinfo, + unsigned int matchoff, + unsigned int matchlen, + struct nf_conntrack_expect *exp); +#endif /* _NF_CONNTRACK_AMANDA_H */ diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig index 598865e..bdc59fa 100644 --- a/net/ipv4/netfilter/Kconfig +++ b/net/ipv4/netfilter/Kconfig @@ -524,6 +524,11 @@ config IP_NF_NAT_AMANDA default IP_NF_NAT if IP_NF_AMANDA=y default m if IP_NF_AMANDA=m +config NF_NAT_AMANDA + tristate + depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT + default NF_NAT && NF_CONNTRACK_AMANDA + config IP_NF_NAT_PPTP tristate depends on IP_NF_NAT!=n && IP_NF_PPTP!=n diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile index fcf3460..39cebc4 100644 --- a/net/ipv4/netfilter/Makefile +++ b/net/ipv4/netfilter/Makefile @@ -51,6 +51,7 @@ obj-$(CONFIG_IP_NF_NAT_SIP) += ip_nat_si # NAT helpers (nf_conntrack) obj-$(CONFIG_NF_NAT_FTP) += nf_nat_ftp.o +obj-$(CONFIG_NF_NAT_AMANDA) += nf_nat_amanda.o obj-$(CONFIG_NF_NAT_TFTP) += nf_nat_tftp.o obj-$(CONFIG_NF_NAT_SIP) += nf_nat_sip.o diff --git a/net/ipv4/netfilter/nf_nat_amanda.c b/net/ipv4/netfilter/nf_nat_amanda.c new file mode 100644 index 0000000..efbc07f --- /dev/null +++ b/net/ipv4/netfilter/nf_nat_amanda.c @@ -0,0 +1,78 @@ +/* Amanda extension for TCP NAT alteration. + * (C) 2002 by Brian J. Murrell <netfilter@interlinx.bc.ca> + * based on a copy of HW's ip_nat_irc.c as well as other modules + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version + * 2 of the License, or (at your option) any later version. + */ + +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/skbuff.h> +#include <linux/udp.h> + +#include <net/netfilter/nf_nat_helper.h> +#include <net/netfilter/nf_nat_rule.h> +#include <net/netfilter/nf_conntrack_helper.h> +#include <net/netfilter/nf_conntrack_expect.h> +#include <linux/netfilter/nf_conntrack_amanda.h> + +MODULE_AUTHOR("Brian J. Murrell <netfilter@interlinx.bc.ca>"); +MODULE_DESCRIPTION("Amanda NAT helper"); +MODULE_LICENSE("GPL"); + +static unsigned int help(struct sk_buff **pskb, + enum ip_conntrack_info ctinfo, + unsigned int matchoff, + unsigned int matchlen, + struct nf_conntrack_expect *exp) +{ + char buffer[sizeof("65535")]; + u_int16_t port; + unsigned int ret; + + /* Connection comes from client. */ + exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port; + exp->dir = IP_CT_DIR_ORIGINAL; + + /* When you see the packet, we need to NAT it the same as the + * this one (ie. same IP: it will be TCP and master is UDP). */ + exp->expectfn = nf_nat_follow_master; + + /* Try to get same port: if not, try to change it. */ + for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) { + exp->tuple.dst.u.tcp.port = htons(port); + if (nf_conntrack_expect_related(exp) == 0) + break; + } + + if (port == 0) + return NF_DROP; + + sprintf(buffer, "%u", port); + ret = nf_nat_mangle_udp_packet(pskb, exp->master, ctinfo, + matchoff, matchlen, + buffer, strlen(buffer)); + if (ret != NF_ACCEPT) + nf_conntrack_unexpect_related(exp); + return ret; +} + +static void __exit nf_nat_amanda_fini(void) +{ + nf_nat_amanda_hook = NULL; + /* Make sure noone calls it, meanwhile. */ + synchronize_net(); +} + +static int __init nf_nat_amanda_init(void) +{ + BUG_ON(nf_nat_amanda_hook); + nf_nat_amanda_hook = help; + return 0; +} + +module_init(nf_nat_amanda_init); +module_exit(nf_nat_amanda_fini); diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig index 65844d7..ebe2fee 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig @@ -150,6 +150,21 @@ config NF_CONNTRACK_FTP To compile it as a module, choose M here. If unsure, say N. +config NF_CONNTRACK_AMANDA + tristate "Amanda backup support on new connection tracking (EXPERIMENTAL)" + depends on EXPERIMENTAL && NF_CONNTRACK + select TEXTSEARCH + select TEXTSEARCH_KMP + help + If you are running the Amanda backup package <http://www.amanda.org/> + on this machine or machines that will be MASQUERADED through this + machine, then you may want to enable this feature. This allows the + connection tracking and natting code to allow the sub-channels that + Amanda requires for communication of the backup data, messages and + index. + + To compile it as a module, choose M here. If unsure, say N. + config NF_CONNTRACK_TFTP tristate "TFTP support on new connection tracking (EXPERIMENTAL)" depends on EXPERIMENTAL && NF_CONNTRACK diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile index 747bb78..3fd1cc3 100644 --- a/net/netfilter/Makefile +++ b/net/netfilter/Makefile @@ -20,6 +20,7 @@ obj-$(CONFIG_NF_CT_NETLINK) += nf_conntr # connection tracking helpers obj-$(CONFIG_NF_CONNTRACK_FTP) += nf_conntrack_ftp.o +obj-$(CONFIG_NF_CONNTRACK_AMANDA) += nf_conntrack_amanda.o obj-$(CONFIG_NF_CONNTRACK_TFTP) += nf_conntrack_tftp.o obj-$(CONFIG_NF_CONNTRACK_SIP) += nf_conntrack_sip.o diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c new file mode 100644 index 0000000..2d7703f --- /dev/null +++ b/net/netfilter/nf_conntrack_amanda.c @@ -0,0 +1,246 @@ +/* Amanda extension for IP connection tracking + * + * (C) 2002 by Brian J. Murrell <netfilter@interlinx.bc.ca> + * based on HW's ip_conntrack_irc.c as well as other modules + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version + * 2 of the License, or (at your option) any later version. + */ +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/moduleparam.h> +#include <linux/textsearch.h> +#include <linux/skbuff.h> +#include <linux/in.h> +#include <linux/udp.h> + +#include <net/netfilter/nf_conntrack.h> +#include <net/netfilter/nf_conntrack_expect.h> +#include <net/netfilter/nf_conntrack_ecache.h> +#include <net/netfilter/nf_conntrack_helper.h> +#include <linux/netfilter/nf_conntrack_amanda.h> + +static unsigned int master_timeout = 300; +static char *ts_algo = "kmp"; + +MODULE_AUTHOR("Brian J. Murrell <netfilter@interlinx.bc.ca>"); +MODULE_DESCRIPTION("Amanda connection tracking module"); +MODULE_LICENSE("GPL"); +module_param(master_timeout, uint, 0600); +MODULE_PARM_DESC(master_timeout, "timeout for the master connection"); +module_param(ts_algo, charp, 0400); +MODULE_PARM_DESC(ts_algo, "textsearch algorithm to use (default kmp)"); + +unsigned int (*nf_nat_amanda_hook)(struct sk_buff **pskb, + enum ip_conntrack_info ctinfo, + unsigned int matchoff, + unsigned int matchlen, + struct nf_conntrack_expect *exp); +EXPORT_SYMBOL_GPL(nf_nat_amanda_hook); + +enum amanda_strings { + SEARCH_CONNECT, + SEARCH_NEWLINE, + SEARCH_DATA, + SEARCH_MESG, + SEARCH_INDEX, +}; + +static struct { + char *string; + size_t len; + struct ts_config *ts; +} search[] = { + [SEARCH_CONNECT] = { + .string = "CONNECT ", + .len = 8, + }, + [SEARCH_NEWLINE] = { + .string = "\n", + .len = 1, + }, + [SEARCH_DATA] = { + .string = "DATA ", + .len = 5, + }, + [SEARCH_MESG] = { + .string = "MESG ", + .len = 5, + }, + [SEARCH_INDEX] = { + .string = "INDEX ", + .len = 6, + }, +}; + +static int amanda_help(struct sk_buff **pskb, + unsigned int protoff, + struct nf_conn *ct, + enum ip_conntrack_info ctinfo) +{ + struct ts_state ts; + struct nf_conntrack_expect *exp; + unsigned int dataoff, start, stop, off, i; + char pbuf[sizeof("65535")], *tmp; + u_int16_t port, len; + int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num; + int ret = NF_ACCEPT; + + /* Only look at packets from the Amanda server */ + if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) + return NF_ACCEPT; + + /* increase the UDP timeout of the master connection as replies from + * Amanda clients to the server can be quite delayed */ + nf_ct_refresh(ct, *pskb, master_timeout * HZ); + + /* No data? */ + dataoff = protoff + sizeof(struct udphdr); + if (dataoff >= (*pskb)->len) { + if (net_ratelimit()) + printk("amanda_help: skblen = %u\n", (*pskb)->len); + return NF_ACCEPT; + } + + memset(&ts, 0, sizeof(ts)); + start = skb_find_text(*pskb, dataoff, (*pskb)->len, + search[SEARCH_CONNECT].ts, &ts); + if (start == UINT_MAX) + goto out; + start += dataoff + search[SEARCH_CONNECT].len; + + memset(&ts, 0, sizeof(ts)); + stop = skb_find_text(*pskb, start, (*pskb)->len, + search[SEARCH_NEWLINE].ts, &ts); + if (stop == UINT_MAX) + goto out; + stop += start; + + for (i = SEARCH_DATA; i <= SEARCH_INDEX; i++) { + memset(&ts, 0, sizeof(ts)); + off = skb_find_text(*pskb, start, stop, search[i].ts, &ts); + if (off == UINT_MAX) + continue; + off += start + search[i].len; + + len = min_t(unsigned int, sizeof(pbuf) - 1, stop - off); + if (skb_copy_bits(*pskb, off, pbuf, len)) + break; + pbuf[len] = '\0'; + + port = simple_strtoul(pbuf, &tmp, 10); + len = tmp - pbuf; + if (port == 0 || len > 5) + break; + + exp = nf_conntrack_expect_alloc(ct); + if (exp == NULL) { + ret = NF_DROP; + goto out; + } + + exp->expectfn = NULL; + exp->flags = 0; + + exp->tuple.src.l3num = family; + exp->tuple.src.u3 = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3; + exp->tuple.src.u.tcp.port = 0; + exp->tuple.dst.u3 = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3; + exp->tuple.dst.protonum = IPPROTO_TCP; + exp->tuple.dst.u.tcp.port = htons(port); + + exp->mask.src.l3num = htons(0xFFFF); + if (family == AF_INET) { + exp->mask.src.u3.ip = htonl(0xFFFFFFFF); + exp->mask.dst.u3.ip = htonl(0xFFFFFFFF); + } else { + memset(&exp->mask.src.u3, 0xff, sizeof(exp->mask.src.u3)); + memset(&exp->mask.dst.u3, 0xff, sizeof(exp->mask.dst.u3)); + } + exp->mask.src.u.tcp.port = 0; + exp->mask.dst.protonum = 0xFF; + exp->mask.dst.u.tcp.port = htons(0xFFFF); + + if (nf_nat_amanda_hook && ct->status & IPS_NAT_MASK) + ret = nf_nat_amanda_hook(pskb, ctinfo, off - dataoff, + len, exp); + else if (nf_conntrack_expect_related(exp) != 0) + ret = NF_DROP; + nf_conntrack_expect_put(exp); + } + +out: + return ret; +} + +static struct nf_conntrack_helper amanda_helper[2] = { + { + .name = "amanda", + .max_expected = 3, + .timeout = 180, + .me = THIS_MODULE, + .help = amanda_help, + .tuple.src.l3num = AF_INET, + .tuple.src.u.udp.port = __constant_htons(10080), + .tuple.dst.protonum = IPPROTO_UDP, + .mask.src.u.udp.port = __constant_htons(0xFFFF), + .mask.dst.protonum = 0xFF, + }, + { + .name = "amanda", + .max_expected = 3, + .timeout = 180, + .me = THIS_MODULE, + .help = amanda_help, + .tuple.src.l3num = AF_INET6, + .tuple.src.u.udp.port = __constant_htons(10080), + .tuple.dst.protonum = IPPROTO_UDP, + .mask.src.u.udp.port = __constant_htons(0xFFFF), + .mask.dst.protonum = 0xFF, + }, +}; + +static void __exit nf_conntrack_amanda_fini(void) +{ + int i; + + nf_conntrack_helper_unregister(&amanda_helper[0]); + nf_conntrack_helper_unregister(&amanda_helper[1]); + for (i = 0; i < ARRAY_SIZE(search); i++) + textsearch_destroy(search[i].ts); +} + +static int __init nf_conntrack_amanda_init(void) +{ + int ret, i; + + ret = -ENOMEM; + for (i = 0; i < ARRAY_SIZE(search); i++) { + search[i].ts = textsearch_prepare(ts_algo, search[i].string, + search[i].len, + GFP_KERNEL, TS_AUTOLOAD); + if (search[i].ts == NULL) + goto err1; + } + ret = nf_conntrack_helper_register(&amanda_helper[0]); + if (ret < 0) + goto err1; + ret = nf_conntrack_helper_register(&amanda_helper[1]); + if (ret < 0) + goto err2; + return 0; + +err2: + nf_conntrack_helper_unregister(&amanda_helper[0]); +err1: + for (; i >= 0; i--) { + if (search[i].ts) + textsearch_destroy(search[i].ts); + } + return ret; +} + +module_init(nf_conntrack_amanda_init); +module_exit(nf_conntrack_amanda_fini); ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH] nf_conntrack/nf_nat: nf_conntrack_netlink fix 2006-11-05 0:32 ` [NETFILTER 4/*]: nf_conntrack/nf_nat: add amanda " Patrick McHardy @ 2006-11-14 19:54 ` Jozsef Kadlecsik 2006-11-15 5:14 ` Patrick McHardy 0 siblings, 1 reply; 5+ messages in thread From: Jozsef Kadlecsik @ 2006-11-14 19:54 UTC (permalink / raw) To: Patrick McHardy; +Cc: Netfilter Development Mailinglist, Yasuyuki Kozakai [-- Attachment #1: Type: TEXT/PLAIN, Size: 316 bytes --] Hi Patrick, Attached is a simple fix on top of your git tree. Best regards, Jozsef - E-mail : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary [-- Attachment #2: netlink0.patch --] [-- Type: TEXT/PLAIN, Size: 1363 bytes --] [NETFILTER]: nf_conntrack_netlink: fix hooknum Buggy porting fixed, we can figure out the hooknum. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> diff -urN --exclude-from=/usr/src/diff.exclude linux-2.6.20-nat-core/net/netfilter/nf_conntrack_netlink.c linux-2.6.20-netlink0/net/netfilter/nf_conntrack_netlink.c --- linux-2.6.20-nat-core/net/netfilter/nf_conntrack_netlink.c 2006-11-06 14:08:15.000000000 +0100 +++ linux-2.6.20-netlink0/net/netfilter/nf_conntrack_netlink.c 2006-11-14 20:45:57.000000000 +0100 @@ -801,8 +801,6 @@ return -EINVAL; #else struct nf_nat_range range; - /* This is LYING! But how could we get the proper data? */ - unsigned int hooknum = NF_IP_POST_ROUTING; if (cda[CTA_NAT_DST-1]) { if (nfnetlink_parse_nat(cda[CTA_NAT_DST-1], ct, @@ -811,7 +809,7 @@ if (nf_nat_initialized(ct, HOOK2MANIP(NF_IP_PRE_ROUTING))) return -EEXIST; - nf_nat_setup_info(ct, &range, hooknum); + nf_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING); } if (cda[CTA_NAT_SRC-1]) { if (nfnetlink_parse_nat(cda[CTA_NAT_SRC-1], ct, @@ -820,7 +818,7 @@ if (nf_nat_initialized(ct, HOOK2MANIP(NF_IP_POST_ROUTING))) return -EEXIST; - nf_nat_setup_info(ct, &range, hooknum); + nf_nat_setup_info(ct, &range, NF_IP_POST_ROUTING); } #endif } ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] nf_conntrack/nf_nat: nf_conntrack_netlink fix 2006-11-14 19:54 ` [PATCH] nf_conntrack/nf_nat: nf_conntrack_netlink fix Jozsef Kadlecsik @ 2006-11-15 5:14 ` Patrick McHardy 0 siblings, 0 replies; 5+ messages in thread From: Patrick McHardy @ 2006-11-15 5:14 UTC (permalink / raw) To: Jozsef Kadlecsik; +Cc: Netfilter Development Mailinglist, Yasuyuki Kozakai Jozsef Kadlecsik wrote: > Hi Patrick, > > Attached is a simple fix on top of your git tree. > > [NETFILTER]: nf_conntrack_netlink: fix hooknum > > Buggy porting fixed, we can figure out the hooknum. Thanks, I've folded it into the nf_nat patch. I'll look into your allocation fix next, sorry for taking so long. ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2006-11-15 5:14 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2006-11-04 23:04 [NETFILTER 1/2]: nf_conntrack_ftp: don't call NAT helper for unNATed connections Patrick McHardy 2006-11-04 23:58 ` [NETFILTER 3/*]: nf_conntrack/nf_nat: add TFTP helper port Patrick McHardy 2006-11-05 0:32 ` [NETFILTER 4/*]: nf_conntrack/nf_nat: add amanda " Patrick McHardy 2006-11-14 19:54 ` [PATCH] nf_conntrack/nf_nat: nf_conntrack_netlink fix Jozsef Kadlecsik 2006-11-15 5:14 ` Patrick McHardy
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.