@@ -27,12 +27,18 @@ union nf_conntrack_nat_help {
#endif
};
+struct nf_conn_nat_range_info {
+ union nf_conntrack_man_proto min_proto;
+ union nf_conntrack_man_proto max_proto;
+};
+
/* The structure embedded in the conntrack structure. */
struct nf_conn_nat {
union nf_conntrack_nat_help help;
#if IS_ENABLED(CONFIG_NF_NAT_MASQUERADE)
int masq_index;
#endif
+ struct nf_conn_nat_range_info range_info;
};
/* Set up the info structure to map into this range. */
@@ -623,6 +623,15 @@ nf_nat_setup_info(struct nf_conn *ct,
&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
get_unique_tuple(&new_tuple, &curr_tuple, range, ct, maniptype);
+ if (range && (range->flags & NF_NAT_RANGE_PROTO_SPECIFIED)) {
+ struct nf_conn_nat *nat = nf_ct_nat_ext_add(ct);
+
+ if (!nat)
+ return NF_DROP;
+
+ nat->range_info.min_proto = range->min_proto;
+ nat->range_info.max_proto = range->max_proto;
+ }
if (!nf_ct_tuple_equal(&new_tuple, &curr_tuple)) {
struct nf_conntrack_tuple reply;
@@ -72,12 +72,16 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb,
u_int16_t port;
int dir = CTINFO2DIR(ctinfo);
struct nf_conn *ct = exp->master;
+ struct nf_conn_nat *nat = nfct_nat(ct);
unsigned int i, min, max, range_size;
static const unsigned int max_attempts = 128;
char buffer[sizeof("|1||65535|") + INET6_ADDRSTRLEN];
unsigned int buflen;
int ret;
+ if (WARN_ON_ONCE(!nat))
+ return NF_DROP;
+
pr_debug("type %i, off %u len %u\n", type, matchoff, matchlen);
/* Connection will come from wherever this packet goes, hence !dir */
@@ -89,11 +93,23 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb,
* this one. */
exp->expectfn = nf_nat_follow_master;
- min = ntohs(exp->saved_proto.tcp.port);
- max = 65535;
+ /* Avoid applying nat->range to the reply direction */
+ if (!exp->dir || !nat->range_info.min_proto.all || !nat->range_info.max_proto.all) {
+ min = ntohs(exp->saved_proto.tcp.port);
+ max = 65535;
+ } else {
+ min = ntohs(nat->range_info.min_proto.all);
+ max = ntohs(nat->range_info.max_proto.all);
+ if (unlikely(max < min))
+ swap(max, min);
+ }
/* Try to get same port */
- ret = nf_ct_expect_related(exp, 0);
+ ret = -1;
+ port = ntohs(exp->saved_proto.tcp.port);
+ if (min < port && port < max) {
+ ret = nf_ct_expect_related(exp, 0);
+ }
/* if same port is not in range or available, try to change it. */
if (ret != 0) {
@@ -188,6 +188,16 @@ void nf_nat_follow_master(struct nf_conn *ct,
range.flags = NF_NAT_RANGE_MAP_IPS;
range.min_addr = range.max_addr
= ct->master->tuplehash[!exp->dir].tuple.dst.u3;
+ if (!exp->dir) {
+ struct nf_conn_nat *nat = nfct_nat(exp->master);
+
+ if (nat && nat->range_info.min_proto.all &&
+ nat->range_info.max_proto.all) {
+ range.min_proto = nat->range_info.min_proto;
+ range.max_proto = nat->range_info.max_proto;
+ range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
+ }
+ }
nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
/* For DST manip, map port here to where it's expected. */