mirror of https://github.com/torvalds/linux.git
90918e3b64
Sequence adjustment may be required for FTP traffic with PASV/EPSV modes.
due to need to re-write packet payload (IP, port) on the ftp control
connection. This can require changes to the TCP length and expected
seq / ack_seq.
The easiest way to reproduce this issue is with PASV mode.
Example ruleset:
table inet ftp_nat {
ct helper ftp_helper {
type "ftp" protocol tcp
l3proto inet
}
chain prerouting {
type filter hook prerouting priority 0; policy accept;
tcp dport 21 ct state new ct helper set "ftp_helper"
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority -100; policy accept;
tcp dport 21 dnat ip prefix to ip daddr map {
192.168.100.1 : 192.168.13.2/32 }
}
chain postrouting {
type nat hook postrouting priority 100 ; policy accept;
tcp sport 21 snat ip prefix to ip saddr map {
192.168.13.2 : 192.168.100.1/32 }
}
}
Note that the ftp helper gets assigned *after* the dnat setup.
The inverse (nat after helper assign) is handled by an existing
check in nf_nat_setup_info() and will not show the problem.
Topoloy:
+-------------------+ +----------------------------------+
| FTP: 192.168.13.2 | <-> | NAT: 192.168.13.3, 192.168.100.1 |
+-------------------+ +----------------------------------+
|
+-----------------------+
| Client: 192.168.100.2 |
+-----------------------+
ftp nat changes do not work as expected in this case:
Connected to 192.168.100.1.
[..]
ftp> epsv
EPSV/EPRT on IPv4 off.
ftp> ls
227 Entering passive mode (192,168,100,1,209,129).
421 Service not available, remote server has closed connection.
Kernel logs:
Missing nfct_seqadj_ext_add() setup call
WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41
[..]
__nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat]
nf_nat_ftp+0x142/0x280 [nf_nat_ftp]
help+0x4d1/0x880 [nf_conntrack_ftp]
nf_confirm+0x122/0x2e0 [nf_conntrack]
nf_hook_slow+0x3c/0xb0
..
Fix this by adding the required extension when a conntrack helper is assigned
to a connection that has a nat binding.
Fixes:
|
||
|---|---|---|
| .. | ||
| ipset | ||
| ipvs | ||
| Kconfig | ||
| Makefile | ||
| core.c | ||
| nf_bpf_link.c | ||
| nf_conncount.c | ||
| nf_conntrack_acct.c | ||
| nf_conntrack_amanda.c | ||
| nf_conntrack_bpf.c | ||
| nf_conntrack_broadcast.c | ||
| nf_conntrack_core.c | ||
| nf_conntrack_ecache.c | ||
| nf_conntrack_expect.c | ||
| nf_conntrack_extend.c | ||
| nf_conntrack_ftp.c | ||
| nf_conntrack_h323_asn1.c | ||
| nf_conntrack_h323_main.c | ||
| nf_conntrack_h323_types.c | ||
| nf_conntrack_helper.c | ||
| nf_conntrack_irc.c | ||
| nf_conntrack_labels.c | ||
| nf_conntrack_netbios_ns.c | ||
| nf_conntrack_netlink.c | ||
| nf_conntrack_ovs.c | ||
| nf_conntrack_pptp.c | ||
| nf_conntrack_proto.c | ||
| nf_conntrack_proto_generic.c | ||
| nf_conntrack_proto_gre.c | ||
| nf_conntrack_proto_icmp.c | ||
| nf_conntrack_proto_icmpv6.c | ||
| nf_conntrack_proto_sctp.c | ||
| nf_conntrack_proto_tcp.c | ||
| nf_conntrack_proto_udp.c | ||
| nf_conntrack_sane.c | ||
| nf_conntrack_seqadj.c | ||
| nf_conntrack_sip.c | ||
| nf_conntrack_snmp.c | ||
| nf_conntrack_standalone.c | ||
| nf_conntrack_tftp.c | ||
| nf_conntrack_timeout.c | ||
| nf_conntrack_timestamp.c | ||
| nf_dup_netdev.c | ||
| nf_flow_table_bpf.c | ||
| nf_flow_table_core.c | ||
| nf_flow_table_inet.c | ||
| nf_flow_table_ip.c | ||
| nf_flow_table_offload.c | ||
| nf_flow_table_procfs.c | ||
| nf_flow_table_xdp.c | ||
| nf_hooks_lwtunnel.c | ||
| nf_internals.h | ||
| nf_log.c | ||
| nf_log_syslog.c | ||
| nf_nat_amanda.c | ||
| nf_nat_bpf.c | ||
| nf_nat_core.c | ||
| nf_nat_ftp.c | ||
| nf_nat_helper.c | ||
| nf_nat_irc.c | ||
| nf_nat_masquerade.c | ||
| nf_nat_ovs.c | ||
| nf_nat_proto.c | ||
| nf_nat_redirect.c | ||
| nf_nat_sip.c | ||
| nf_nat_tftp.c | ||
| nf_queue.c | ||
| nf_sockopt.c | ||
| nf_synproxy_core.c | ||
| nf_tables_api.c | ||
| nf_tables_core.c | ||
| nf_tables_offload.c | ||
| nf_tables_trace.c | ||
| nfnetlink.c | ||
| nfnetlink_acct.c | ||
| nfnetlink_cthelper.c | ||
| nfnetlink_cttimeout.c | ||
| nfnetlink_hook.c | ||
| nfnetlink_log.c | ||
| nfnetlink_osf.c | ||
| nfnetlink_queue.c | ||
| nft_bitwise.c | ||
| nft_byteorder.c | ||
| nft_chain_filter.c | ||
| nft_chain_nat.c | ||
| nft_chain_route.c | ||
| nft_cmp.c | ||
| nft_compat.c | ||
| nft_connlimit.c | ||
| nft_counter.c | ||
| nft_ct.c | ||
| nft_ct_fast.c | ||
| nft_dup_netdev.c | ||
| nft_dynset.c | ||
| nft_exthdr.c | ||
| nft_fib.c | ||
| nft_fib_inet.c | ||
| nft_fib_netdev.c | ||
| nft_flow_offload.c | ||
| nft_fwd_netdev.c | ||
| nft_hash.c | ||
| nft_immediate.c | ||
| nft_inner.c | ||
| nft_last.c | ||
| nft_limit.c | ||
| nft_log.c | ||
| nft_lookup.c | ||
| nft_masq.c | ||
| nft_meta.c | ||
| nft_nat.c | ||
| nft_numgen.c | ||
| nft_objref.c | ||
| nft_osf.c | ||
| nft_payload.c | ||
| nft_queue.c | ||
| nft_quota.c | ||
| nft_range.c | ||
| nft_redir.c | ||
| nft_reject.c | ||
| nft_reject_inet.c | ||
| nft_reject_netdev.c | ||
| nft_rt.c | ||
| nft_set_bitmap.c | ||
| nft_set_hash.c | ||
| nft_set_pipapo.c | ||
| nft_set_pipapo.h | ||
| nft_set_pipapo_avx2.c | ||
| nft_set_pipapo_avx2.h | ||
| nft_set_rbtree.c | ||
| nft_socket.c | ||
| nft_synproxy.c | ||
| nft_tproxy.c | ||
| nft_tunnel.c | ||
| nft_xfrm.c | ||
| utils.c | ||
| x_tables.c | ||
| xt_AUDIT.c | ||
| xt_CHECKSUM.c | ||
| xt_CLASSIFY.c | ||
| xt_CONNSECMARK.c | ||
| xt_CT.c | ||
| xt_DSCP.c | ||
| xt_HL.c | ||
| xt_HMARK.c | ||
| xt_IDLETIMER.c | ||
| xt_LED.c | ||
| xt_LOG.c | ||
| xt_MASQUERADE.c | ||
| xt_NETMAP.c | ||
| xt_NFLOG.c | ||
| xt_NFQUEUE.c | ||
| xt_RATEEST.c | ||
| xt_REDIRECT.c | ||
| xt_SECMARK.c | ||
| xt_TCPMSS.c | ||
| xt_TCPOPTSTRIP.c | ||
| xt_TEE.c | ||
| xt_TPROXY.c | ||
| xt_TRACE.c | ||
| xt_addrtype.c | ||
| xt_bpf.c | ||
| xt_cgroup.c | ||
| xt_cluster.c | ||
| xt_comment.c | ||
| xt_connbytes.c | ||
| xt_connlabel.c | ||
| xt_connlimit.c | ||
| xt_connmark.c | ||
| xt_conntrack.c | ||
| xt_cpu.c | ||
| xt_dccp.c | ||
| xt_devgroup.c | ||
| xt_dscp.c | ||
| xt_ecn.c | ||
| xt_esp.c | ||
| xt_hashlimit.c | ||
| xt_helper.c | ||
| xt_hl.c | ||
| xt_ipcomp.c | ||
| xt_iprange.c | ||
| xt_ipvs.c | ||
| xt_l2tp.c | ||
| xt_length.c | ||
| xt_limit.c | ||
| xt_mac.c | ||
| xt_mark.c | ||
| xt_multiport.c | ||
| xt_nat.c | ||
| xt_nfacct.c | ||
| xt_osf.c | ||
| xt_owner.c | ||
| xt_physdev.c | ||
| xt_pkttype.c | ||
| xt_policy.c | ||
| xt_quota.c | ||
| xt_rateest.c | ||
| xt_realm.c | ||
| xt_recent.c | ||
| xt_repldata.h | ||
| xt_sctp.c | ||
| xt_set.c | ||
| xt_socket.c | ||
| xt_state.c | ||
| xt_statistic.c | ||
| xt_string.c | ||
| xt_tcpmss.c | ||
| xt_tcpudp.c | ||
| xt_time.c | ||
| xt_u32.c | ||