1 /* Shared library add-on to iptables to add source-NAT support. */
8 #include <linux/netfilter_ipv4/ip_tables.h>
9 #include <linux/netfilter_ipv4/ip_nat_rule.h>
11 /* Source NAT data consists of a multi-range, indicating where to map
15 struct ipt_entry_target t;
16 struct ip_nat_multi_range mr;
19 /* Function which prints out usage message. */
25 " --to-source <ipaddr>[-<ipaddr>][:port-port]\n"
26 " Address to map source to.\n"
27 " (You can use this more than once)\n\n",
31 static struct option opts[] = {
32 { "to-source", 1, 0, '1' },
36 static struct ipt_natinfo *
37 append_range(struct ipt_natinfo *info, const struct ip_nat_range *range)
41 /* One rangesize already in struct ipt_natinfo */
42 size = IPT_ALIGN(sizeof(*info) + info->mr.rangesize * sizeof(*range));
44 info = realloc(info, size);
46 exit_error(OTHER_PROBLEM, "Out of memory\n");
48 info->t.u.target_size = size;
49 info->mr.range[info->mr.rangesize] = *range;
55 /* Ranges expected in network order. */
56 static struct ipt_entry_target *
57 parse_to(char *arg, int portok, struct ipt_natinfo *info)
59 struct ip_nat_range range;
60 char *colon, *dash, *error;
63 memset(&range, 0, sizeof(range));
64 colon = strchr(arg, ':');
70 exit_error(PARAMETER_PROBLEM,
71 "Need TCP or UDP with port specification");
73 range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
76 if (port <= 0 || port > 65535)
77 exit_error(PARAMETER_PROBLEM,
78 "Port `%s' not valid\n", colon+1);
80 error = strchr(colon+1, ':');
82 exit_error(PARAMETER_PROBLEM,
83 "Invalid port:port syntax - use dash\n");
85 dash = strchr(colon, '-');
93 maxport = atoi(dash + 1);
94 if (maxport <= 0 || maxport > 65535)
95 exit_error(PARAMETER_PROBLEM,
96 "Port `%s' not valid\n", dash+1);
98 /* People are stupid. */
99 exit_error(PARAMETER_PROBLEM,
100 "Port range `%s' funky\n", colon+1);
101 range.min.tcp.port = htons(port);
102 range.max.tcp.port = htons(maxport);
104 /* Starts with a colon? No IP info...*/
106 return &(append_range(info, &range)->t);
110 range.flags |= IP_NAT_RANGE_MAP_IPS;
111 dash = strchr(arg, '-');
112 if (colon && dash && dash > colon)
118 ip = dotted_to_addr(arg);
120 exit_error(PARAMETER_PROBLEM, "Bad IP address `%s'\n",
122 range.min_ip = ip->s_addr;
124 ip = dotted_to_addr(dash+1);
126 exit_error(PARAMETER_PROBLEM, "Bad IP address `%s'\n",
128 range.max_ip = ip->s_addr;
130 range.max_ip = range.min_ip;
132 return &(append_range(info, &range)->t);
135 /* Function which parses command options; returns true if it
138 parse(int c, char **argv, int invert, unsigned int *flags,
139 const struct ipt_entry *entry,
140 struct ipt_entry_target **target)
142 struct ipt_natinfo *info = (void *)*target;
145 if (entry->ip.proto == IPPROTO_TCP
146 || entry->ip.proto == IPPROTO_UDP)
153 if (check_inverse(optarg, &invert, NULL, 0))
154 exit_error(PARAMETER_PROBLEM,
155 "Unexpected `!' after --to-source");
157 *target = parse_to(optarg, portok, info);
166 /* Final check; must have specfied --to-source. */
167 static void final_check(unsigned int flags)
170 exit_error(PARAMETER_PROBLEM,
171 "You must specify --to-source");
174 static void print_range(const struct ip_nat_range *r)
176 if (r->flags & IP_NAT_RANGE_MAP_IPS) {
179 a.s_addr = r->min_ip;
180 printf("%s", addr_to_dotted(&a));
181 if (r->max_ip != r->min_ip) {
182 a.s_addr = r->max_ip;
183 printf("-%s", addr_to_dotted(&a));
186 if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) {
188 printf("%hu", ntohs(r->min.tcp.port));
189 if (r->max.tcp.port != r->min.tcp.port)
190 printf("-%hu", ntohs(r->max.tcp.port));
194 /* Prints out the targinfo. */
196 print(const struct ipt_ip *ip,
197 const struct ipt_entry_target *target,
200 struct ipt_natinfo *info = (void *)target;
204 for (i = 0; i < info->mr.rangesize; i++) {
205 print_range(&info->mr.range[i]);
210 /* Saves the union ipt_targinfo in parsable form to stdout. */
212 save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
214 struct ipt_natinfo *info = (void *)target;
217 for (i = 0; i < info->mr.rangesize; i++) {
218 printf("--to-source ");
219 print_range(&info->mr.range[i]);
224 static struct iptables_target snat = {
227 .version = IPTABLES_VERSION,
228 .size = IPT_ALIGN(sizeof(struct ip_nat_multi_range)),
229 .userspacesize = IPT_ALIGN(sizeof(struct ip_nat_multi_range)),
232 .final_check = &final_check,
240 register_target(&snat);