ip_nat_tftp: Fix expectation NAT.
Subsystems (2)
PATCH 1/1 ip_nat_tftp: Fix expectation NAT.
Hi,
this patch fixes the case where the port in an initial TFTP packet is SNATed. Previously the port was never DNATed back for the expected connection.
//Marcus
Signature · 3 lines
---------------------------------------+-------------------------- Marcus Sundberg <[email protected]> | Firewalls with SIP & NAT Software Developer, Ingate Systems AB | http://www.ingate.com/
[NETFILTER] ip_nat_tftp: Fix expectation NAT.
When a TFTP client is SNATed so that the port is also changed, the port is never changed back for the expected connection.
net/ipv4/netfilter/ip_nat_tftp.c +4 -1
@@ -42,7 +42,10 @@ static unsigned int help(struct sk_buffenum ip_conntrack_info ctinfo, struct ip_conntrack_expect *exp) { - exp->saved_proto.udp.port = exp->tuple.dst.u.tcp.port; + struct ip_conntrack *ct = exp->master; + + exp->saved_proto.udp.port + = ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.u.udp.port; exp->dir =IP_CT_DIR_REPLY ; exp->expectfn = ip_nat_follow_master;if (ip_conntrack_expect_related (exp) !=0 )
Quoted 5 lines · Marcus Sundberg
Hi,
this patch fixes the case where the port in an initial TFTP packet is SNATed. Previously the port was never DNATed back for the expected connection.
Thanks!
This is one of the cases where I'd really appreciate having a nfsim test for the testsuite to
1) help understanding the problem
2) prevent further regressions
Would you be willing to provide us with a testcase for nfsim-testsuite? Unfortunately we cannot offer anything but bonus points ;)
Patrick: I'm still not back from Bangalore, so I'm still relying on you picking up all the patches ;)
Signature · 5 lines
- Harald Welte <[email protected]> http://netfilter.org/ ============================================================================ "Fragmentation is like classful addressing -- an interesting early architectural error that shows how much experimentation was going on while IP was being designed." -- Paul Vixie
Quoted 6 lines · Harald Welte
Quoted 3 lines · Marcus Sundberg
this patch fixes the case where the port in an initial TFTP packet is SNATed. Previously the port was never DNATed back for the expected connection.
Quoted 7 lines
This is one of the cases where I'd really appreciate having a nfsim test for the testsuite to
1) help understanding the problem
2) prevent further regressionsWould you be willing to provide us with a testcase for nfsim-testsuite? Unfortunately we cannot offer anything but bonus points ;)
Well, I'm currently looking at the RTSP patch for 2.6.15, so getting familiar with nfsim might be useful in any case. I'll have a look.
//Marcus
Signature · 3 lines
---------------------------------------+-------------------------- Marcus Sundberg <[email protected]> | Firewalls with SIP & NAT Software Developer, Ingate Systems AB | http://www.ingate.com/
Quoted 7 lines · Harald Welte
This is one of the cases where I'd really appreciate having a nfsim test for the testsuite to
1) help understanding the problem
2) prevent further regressionsWould you be willing to provide us with a testcase for nfsim-testsuite? Unfortunately we cannot offer anything but bonus points ;)
Hi,
How about the following simple test?
//Marcus
03NAT/67tftp.sim new file +46 -0
@@ -0,0 +1,46 @@ +# Setup SNAT with port NAT. +iptables -t nat -A POSTROUTING -p udp -s 192.168.0.0/24 -d 192.168.1.0/24 -j SNAT --to-source 192.168.1.1:30000-40000 + +# Issue TFTP read request. +expect gen_ip send:eth1 {IPv4 192.168.1.1 192.168.1.2 21 17 30000 69 DATA \0\x01/nicefile\0netascii\0} +gen_ip IF=eth0 192.168.0.2 192.168.1.2 21 17 1051 69 DATA \0\x01/nicefile\0netascii\0 + +# Show expectation. +proc cat /proc/net/ip_conntrack_expect + +# First data packet. +expect gen_ip send:eth0 {IPv4 192.168.1.2 192.168.0.2 524 17 4711 1051} +gen_ip IF=eth1 192.168.1.2 192.168.1.1 524 17 4711 30000 +# First ACK. +expect gen_ip send:eth1 {IPv4 192.168.1.1 192.168.1.2 12 17 30000 4711} +gen_ip IF=eth0 192.168.0.2 192.168.1.2 12 17 1051 4711 +# Second data packet. +expect gen_ip send:eth0 {IPv4 192.168.1.2 192.168.0.2 87 17 4711 1051} +gen_ip IF=eth1 192.168.1.2 192.168.1.1 87 17 4711 30000 +# Second ACK. +expect gen_ip send:eth1 {IPv4 192.168.1.1 192.168.1.2 12 17 30000 4711} +gen_ip IF=eth0 192.168.0.2 192.168.1.2 12 17 1051 4711 + +# Issue TFTP read request again from a new port. +expect gen_ip send:eth1 {IPv4 192.168.1.1 192.168.1.2 28 17 30001 69 DATA \0\x01/anothernicefile\0netascii\0} +gen_ip IF=eth0 192.168.0.2 192.168.1.2 28 17 1052 69 DATA \0\x01/anothernicefile\0netascii\0 + +# Show expectation. +proc cat /proc/net/ip_conntrack_expect + +# First data packet. +expect gen_ip send:eth0 {IPv4 192.168.1.2 192.168.0.2 524 17 4711 1052} +gen_ip IF=eth1 192.168.1.2 192.168.1.1 524 17 4711 30001 +# First ACK. +expect gen_ip send:eth1 {IPv4 192.168.1.1 192.168.1.2 12 17 30001 4711} +gen_ip IF=eth0 192.168.0.2 192.168.1.2 12 17 1052 4711 +# Second data packet. +expect gen_ip send:eth0 {IPv4 192.168.1.2 192.168.0.2 233 17 4711 1052} +gen_ip IF=eth1 192.168.1.2 192.168.1.1 233 17 4711 30001 +# Second ACK. +expect gen_ip send:eth1 {IPv4 192.168.1.1 192.168.1.2 12 17 30001 4711} +gen_ip IF=eth0 192.168.0.2 192.168.1.2 12 17 1052 4711 + +# Show conntracks and expectations. +proc cat /proc/net/ip_conntrack +proc cat /proc/net/ip_conntrack_expect
Signature · 3 lines
---------------------------------------+-------------------------- Marcus Sundberg <[email protected]> | Firewalls with SIP & NAT Software Developer, Ingate Systems AB | http://www.ingate.com/
Quoted 3 lines · Marcus Sundberg
this patch fixes the case where the port in an initial TFTP packet is SNATed. Previously the port was never DNATed back for the expected connection.
Took me some time to understand why this works for other helpers and not this one, but finally applied :) Thanks.