attach the ftp helper when a port forward sends another public port to port 21

Author: Damans227

systemvm/debian/opt/cloud/bin/configure.py

@@ -1411,6 +1411,25 @@ def processForwardRule(self, rule):
             self.forward_vpc(rule)
         else:
             self.forward_vr(rule)
+        self.forward_ftp_helper(rule)
+
+    def forward_ftp_helper(self, rule):
+        # Linux 6.0 no longer attaches the ftp helper after DNAT, so attach it
+        # to the public port that is forwarded to port 21. Public port 21 is
+        # already covered by the rule from CsAddress.py
+        if rule["protocol"] != "tcp" or "any" in [rule["public_ports"], rule["internal_ports"]]:
+            return
+        public_start = int(rule["public_ports"].split(":")[0])
+        internal_ports = rule["internal_ports"].split(":")
+        internal_start = int(internal_ports[0])
+        internal_end = int(internal_ports[-1])
+        if not internal_start <= 21 <= internal_end:
+            return
+        public_port = public_start + 21 - internal_start
+        if public_port == 21:
+            return
+        self.fw.append(["raw", "", "-A PREROUTING -d %s/32 -p tcp -m tcp --dport %s -j CT --helper ftp" %
+                        (rule["public_ip"], public_port)])
 
     def forward_vr(self, rule):
         # Prefetch iptables variables

systemvm/test/TestCsForwardingRules.py

@@ -0,0 +1,47 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import unittest
+from configure import CsForwardingRules
+
+
+class TestCsForwardingRules(unittest.TestCase):
+
+    def ftp_helper_rules(self, protocol, public_ports, internal_ports):
+        forwarding = CsForwardingRules.__new__(CsForwardingRules)
+        forwarding.fw = []
+        forwarding.forward_ftp_helper({"public_ip": "10.0.0.2", "internal_ip": "10.1.1.10", "protocol": protocol,
+                                       "public_ports": public_ports, "internal_ports": internal_ports})
+        return forwarding.fw
+
+    def test_ftp_helper_on_other_public_port(self):
+        self.assertEqual(self.ftp_helper_rules("tcp", "2121:2121", "21:21"),
+                         [["raw", "", "-A PREROUTING -d 10.0.0.2/32 -p tcp -m tcp --dport 2121 -j CT --helper ftp"]])
+
+    def test_ftp_helper_on_port_range(self):
+        self.assertEqual(self.ftp_helper_rules("tcp", "1020:1030", "20:30"),
+                         [["raw", "", "-A PREROUTING -d 10.0.0.2/32 -p tcp -m tcp --dport 1021 -j CT --helper ftp"]])
+
+    def test_no_ftp_helper(self):
+        self.assertEqual(self.ftp_helper_rules("tcp", "21:21", "21:21"), [])
+        self.assertEqual(self.ftp_helper_rules("tcp", "2121:2121", "2121:2121"), [])
+        self.assertEqual(self.ftp_helper_rules("udp", "2121:2121", "21:21"), [])
+        self.assertEqual(self.ftp_helper_rules("tcp", "any", "any"), [])
+
+
+if __name__ == '__main__':
+    unittest.main()