Skip to content

Commit e8b4652

Browse files
sever-seversever-sever
authored
Merge pull request #1065 from AndriiFullroot/T6788
kernel: T6788: Added patch to fix sequence adjustment for FTP DNAT
2 parents 3e81f2e + 8631bc5 commit e8b4652

1 file changed

Lines changed: 212 additions & 0 deletions

File tree

‎scripts/package-build/linux-kernel/patches/kernel/v4-0001-nft_ct-Added-nfct_seqadj_ext_add-for-DNAT-ed-conn.patch‎

Lines changed: 212 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
1+
From 0b00219cbd0e942dc2a2d86ecda52b7de4617227 Mon Sep 17 00:00:00 2001
2+
From: Andrii Melnychenko <a.melnychenko@vyos.io>
3+
Date: Tue, 14 Oct 2025 12:36:55 +0200
4+
Subject: [PATCH v4 1/1] nft_ct: Added nfct_seqadj_ext_add() for DNAT'ed
5+
conntrack.
6+
7+
There is an issue with the missed seqadj extension for NAT'ed
8+
conntrack setup with nft. Sequence adjustment may be required
9+
for FTP traffic with PASV/EPSV modes.
10+
11+
The easiest way to reproduce this issue is with PASV mode.
12+
Topoloy:
13+
```
14+
+-------------------+ +----------------------------------+
15+
| FTP: 192.168.13.2 | <-> | NAT: 192.168.13.3, 192.168.100.1 |
16+
+-------------------+ +----------------------------------+
17+
|
18+
+-----------------------+
19+
| Client: 192.168.100.2 |
20+
+-----------------------+
21+
```
22+
23+
nft ruleset:
24+
```
25+
table inet ftp_nat {
26+
ct helper ftp_helper {
27+
type "ftp" protocol tcp
28+
l3proto inet
29+
}
30+
31+
chain prerouting {
32+
type filter hook prerouting priority filter; policy
33+
accept;
34+
tcp dport 21 ct state new ct helper set "ftp_helper"
35+
}
36+
}
37+
table ip nat {
38+
chain prerouting {
39+
type nat hook prerouting priority dstnat; policy accept;
40+
tcp dport 21 dnat ip prefix to ip daddr map {
41+
192.168.100.1 : 192.168.13.2/32 }
42+
}
43+
44+
chain postrouting {
45+
type nat hook postrouting priority srcnat; policy
46+
accept;
47+
tcp sport 21 snat ip prefix to ip saddr map {
48+
192.168.13.2 : 192.168.100.1/32 }
49+
}
50+
}
51+
52+
```
53+
54+
Connecting the client:
55+
```
56+
Connected to 192.168.100.1.
57+
220 Welcome to my FTP server.
58+
Name (192.168.100.1:dev): user
59+
331 Username ok, send password.
60+
Password:
61+
230 Login successful.
62+
Remote system type is UNIX.
63+
Using binary mode to transfer files.
64+
ftp> epsv
65+
EPSV/EPRT on IPv4 off.
66+
EPSV/EPRT on IPv6 off.
67+
ftp> ls
68+
227 Entering passive mode (192,168,100,1,209,129).
69+
421 Service not available, remote server has closed connection.
70+
```
71+
72+
Kernel logs:
73+
```
74+
Oct 16 10:24:44 vyos kernel: Missing nfct_seqadj_ext_add() setup call
75+
Oct 16 10:24:44 vyos kernel: WARNING: CPU: 1 PID: 0 at
76+
net/netfilter/nf_conntrack_seqadj.c:41 nf_ct_seqadj_set+0xbf/0xe0
77+
[nf_conntrack]
78+
Oct 16 10:24:44 vyos kernel: Modules linked in: nf_nat_ftp(E) nft_nat(E)
79+
nf_conntrack_ftp(E) af_packet(E) nft_ct(E) nft_chain_nat(E) nf_nat(E)
80+
nf_tables(E) nfnetlink_cthelper(E) nf_conntrack(E) nf_defrag_ipv6(E)
81+
nf_defrag_ipv4(E) nfnetlink(E) binfmt_misc(E) intel_rapl_common(E)
82+
crct10dif_pclmul(E) crc32_pclmul(E) ghash_clmulni_intel(E)
83+
sha512_ssse3(E) sha256_ssse3(E) sha1_ssse3(E) aesni_intel(E)
84+
crypto_simd(E) cryptd(E) rapl(E) iTCO_wdt(E) iTCO_vendor_support(E)
85+
button(E) virtio_console(E) virtio_balloon(E) pcspkr(E) evdev(E)
86+
tcp_bbr(E) sch_fq_codel(E) mpls_iptunnel(E) mpls_router(E) ip_tunnel(E)
87+
br_netfilter(E) bridge(E) stp(E) llc(E) fuse(E) efi_pstore(E)
88+
configfs(E) virtio_rng(E) rng_core(E) ip_tables(E) x_tables(E)
89+
autofs4(E) usb_storage(E) ohci_hcd(E) uhci_hcd(E) ehci_hcd(E) sd_mod(E)
90+
squashfs(E) lz4_decompress(E) loop(E) overlay(E) ext4(E) crc16(E)
91+
mbcache(E) jbd2(E) nls_cp437(E) vfat(E) fat(E) efivarfs(E) nls_ascii(E)
92+
hid_generic(E) usbhid(E) hid(E) virtio_net(E) net_failover(E)
93+
virtio_blk(E) failover(E) ahci(E) libahci(E)
94+
Oct 16 10:24:44 vyos kernel: crc32c_intel(E) i2c_i801(E) i2c_smbus(E)
95+
libata(E) lpc_ich(E) scsi_mod(E) scsi_common(E) xhci_pci(E) xhci_hcd(E)
96+
virtio_pci(E) virtio_pci_legacy_dev(E) virtio_pci_modern_dev(E)
97+
virtio(E) virtio_ring(E)
98+
Oct 16 10:24:44 vyos kernel: CPU: 1 PID: 0 Comm: swapper/1 Tainted: G
99+
E 6.6.108-vyos #1
100+
Oct 16 10:24:44 vyos kernel: Hardware name: QEMU Standard PC (Q35 +
101+
ICH9, 2009), BIOS Arch Linux 1.17.0-2-2 04/01/2014
102+
Oct 16 10:24:44 vyos kernel: RIP: 0010:nf_ct_seqadj_set+0xbf/0xe0
103+
[nf_conntrack]
104+
Oct 16 10:24:44 vyos kernel: Code: ea 44 89 20 89 50 08 eb db 45 85 ed
105+
74 de 80 3d 51 6d 00 00 00 75 d5 48 c7 c7 68 57 ad c0 c6 05 41 6d 00 00
106+
01 e8 71 28 dd dc <0f> 0b eb be be 02 00 00 00 e8 63 fc ff ff 48 89 c3
107+
e9 66 ff ff ff
108+
Oct 16 10:24:44 vyos kernel: RSP: 0018:ffff9a66c00e8910 EFLAGS: 00010286
109+
Oct 16 10:24:44 vyos kernel: RAX: 0000000000000000 RBX: 0000000000000014
110+
RCX: 000000000000083f
111+
Oct 16 10:24:44 vyos kernel: RDX: 0000000000000000 RSI: 00000000000000f6
112+
RDI: 000000000000083f
113+
Oct 16 10:24:44 vyos kernel: RBP: ffff89387978fb00 R08: 0000000000000000
114+
R09: ffff9a66c00e87a8
115+
Oct 16 10:24:44 vyos kernel: R10: 0000000000000003 R11: ffffffff9ecbab08
116+
R12: ffff89387978fb00
117+
Oct 16 10:24:44 vyos kernel: R13: 0000000000000001 R14: ffff893872e18862
118+
R15: ffff893842f8c700
119+
Oct 16 10:24:44 vyos kernel: FS: 0000000000000000(0000)
120+
GS:ffff893bafc80000(0000) knlGS:0000000000000000
121+
Oct 16 10:24:44 vyos kernel: CS: 0010 DS: 0000 ES: 0000 CR0:
122+
0000000080050033
123+
Oct 16 10:24:44 vyos kernel: CR2: 000055fbc64ec690 CR3: 000000011de22001
124+
CR4: 0000000000370ee0
125+
Oct 16 10:24:44 vyos kernel: Call Trace:
126+
Oct 16 10:24:44 vyos kernel: <IRQ>
127+
Oct 16 10:24:44 vyos kernel: __nf_nat_mangle_tcp_packet+0x100/0x160
128+
[nf_nat]
129+
Oct 16 10:24:44 vyos kernel: nf_nat_ftp+0x142/0x280 [nf_nat_ftp]
130+
Oct 16 10:24:44 vyos kernel: ? kmem_cache_alloc+0x157/0x290
131+
Oct 16 10:24:44 vyos kernel: ? help+0x4d1/0x880 [nf_conntrack_ftp]
132+
Oct 16 10:24:44 vyos kernel: help+0x4d1/0x880 [nf_conntrack_ftp]
133+
Oct 16 10:24:44 vyos kernel: ? nf_confirm+0x122/0x2e0 [nf_conntrack]
134+
Oct 16 10:24:44 vyos kernel: nf_confirm+0x122/0x2e0 [nf_conntrack]
135+
Oct 16 10:24:44 vyos kernel: nf_hook_slow+0x3c/0xb0
136+
Oct 16 10:24:44 vyos kernel: ip_output+0xb6/0xf0
137+
Oct 16 10:24:44 vyos kernel: ? __pfx_ip_finish_output+0x10/0x10
138+
Oct 16 10:24:44 vyos kernel: ip_sublist_rcv_finish+0x90/0xa0
139+
Oct 16 10:24:44 vyos kernel: ip_sublist_rcv+0x190/0x220
140+
Oct 16 10:24:44 vyos kernel: ? __pfx_ip_rcv_finish+0x10/0x10
141+
Oct 16 10:24:44 vyos kernel: ip_list_rcv+0x134/0x160
142+
Oct 16 10:24:44 vyos kernel: __netif_receive_skb_list_core+0x299/0x2c0
143+
Oct 16 10:24:44 vyos kernel:
144+
netif_receive_skb_list_internal+0x1a7/0x2d0
145+
Oct 16 10:24:44 vyos kernel: napi_complete_done+0x69/0x1a0
146+
Oct 16 10:24:44 vyos kernel: virtnet_poll+0x3c0/0x540 [virtio_net]
147+
Oct 16 10:24:44 vyos kernel: __napi_poll+0x26/0x1a0
148+
Oct 16 10:24:44 vyos kernel: net_rx_action+0x141/0x2c0
149+
Oct 16 10:24:44 vyos kernel: ? lock_timer_base+0x5c/0x80
150+
Oct 16 10:24:44 vyos kernel: handle_softirqs+0xd5/0x280
151+
Oct 16 10:24:44 vyos kernel: __irq_exit_rcu+0x95/0xb0
152+
Oct 16 10:24:44 vyos kernel: common_interrupt+0x7a/0xa0
153+
Oct 16 10:24:44 vyos kernel: </IRQ>
154+
Oct 16 10:24:44 vyos kernel: <TASK>
155+
Oct 16 10:24:44 vyos kernel: asm_common_interrupt+0x22/0x40
156+
Oct 16 10:24:44 vyos kernel: RIP: 0010:pv_native_safe_halt+0xb/0x10
157+
Oct 16 10:24:44 vyos kernel: Code: 0b 66 66 2e 0f 1f 84 00 00 00 00 00
158+
0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 0f 00 2d
159+
29 9a 3e 00 fb f4 <c3> cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90
160+
90 90 90 90 8b
161+
Oct 16 10:24:44 vyos kernel: RSP: 0018:ffff9a66c009bed8 EFLAGS: 00000252
162+
Oct 16 10:24:44 vyos kernel: RAX: ffff893bafcaaca8 RBX: 0000000000000001
163+
RCX: 0000000000000001
164+
Oct 16 10:24:44 vyos kernel: RDX: 0000000000000000 RSI: 0000000000000083
165+
RDI: 0000000000064cec
166+
Oct 16 10:24:44 vyos kernel: RBP: ffff8938401f2200 R08: 0000000000000001
167+
R09: 0000000000000000
168+
Oct 16 10:24:44 vyos kernel: R10: 000000000001ffc0 R11: 0000000000000000
169+
R12: 0000000000000000
170+
Oct 16 10:24:44 vyos kernel: R13: 0000000000000000 R14: ffff8938401f2200
171+
R15: 0000000000000000
172+
Oct 16 10:24:44 vyos kernel: default_idle+0x5/0x20
173+
Oct 16 10:24:44 vyos kernel: default_idle_call+0x28/0xb0
174+
Oct 16 10:24:44 vyos kernel: do_idle+0x1ec/0x230
175+
Oct 16 10:24:44 vyos kernel: cpu_startup_entry+0x21/0x30
176+
Oct 16 10:24:44 vyos kernel: start_secondary+0x11a/0x140
177+
Oct 16 10:24:44 vyos kernel: secondary_startup_64_no_verify+0x178/0x17b
178+
Oct 16 10:24:44 vyos kernel: </TASK>
179+
```
180+
181+
Fixes: 1a64edf54f55 ("netfilter: nft_ct: add helper set support")
182+
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
183+
---
184+
net/netfilter/nft_ct.c | 5 +++++
185+
1 file changed, 5 insertions(+)
186+
187+
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
188+
index d526e69a2..f358cdc5e 100644
189+
--- a/net/netfilter/nft_ct.c
190+
+++ b/net/netfilter/nft_ct.c
191+
@@ -22,6 +22,7 @@
192+
#include <net/netfilter/nf_conntrack_timeout.h>
193+
#include <net/netfilter/nf_conntrack_l4proto.h>
194+
#include <net/netfilter/nf_conntrack_expect.h>
195+
+#include <net/netfilter/nf_conntrack_seqadj.h>
196+
197+
struct nft_ct_helper_obj {
198+
struct nf_conntrack_helper *helper4;
199+
@@ -1173,6 +1174,10 @@ static void nft_ct_helper_obj_eval(struct nft_object *obj,
200+
if (help) {
201+
rcu_assign_pointer(help->helper, to_assign);
202+
set_bit(IPS_HELPER_BIT, &ct->status);
203+
+
204+
+ if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct))
205+
+ if (!nfct_seqadj_ext_add(ct))
206+
+ regs->verdict.code = NF_DROP;
207+
}
208+
}
209+
210+
--
211+
2.43.0
212+

0 commit comments

Comments
 (0)