1 /* Shared library add-on to iptables to add source-NAT support. */
8 #include <linux/netfilter_ipv4/ip_tables.h>
9 #include <linux/netfilter/nf_nat.h>
11 #define IPT_SNAT_OPT_SOURCE 0x01
12 #define IPT_SNAT_OPT_RANDOM 0x02
14 /* Source NAT data consists of a multi-range, indicating where to map
18 struct xt_entry_target t;
19 struct ip_nat_multi_range mr;
22 /* Function which prints out usage message. */
23 static void SNAT_help(void)
26 "SNAT target options:\n"
27 " --to-source <ipaddr>[-<ipaddr>][:port-port]\n"
28 " Address to map source to.\n"
32 static const struct option SNAT_opts[] = {
33 { "to-source", 1, NULL, '1' },
34 { "random", 0, NULL, '2' },
38 static struct ipt_natinfo *
39 append_range(struct ipt_natinfo *info, const struct ip_nat_range *range)
43 /* One rangesize already in struct ipt_natinfo */
44 size = XT_ALIGN(sizeof(*info) + info->mr.rangesize * sizeof(*range));
46 info = realloc(info, size);
48 exit_error(OTHER_PROBLEM, "Out of memory\n");
50 info->t.u.target_size = size;
51 info->mr.range[info->mr.rangesize] = *range;
57 /* Ranges expected in network order. */
58 static struct xt_entry_target *
59 parse_to(char *arg, int portok, struct ipt_natinfo *info)
61 struct ip_nat_range range;
62 char *colon, *dash, *error;
63 const struct in_addr *ip;
65 memset(&range, 0, sizeof(range));
66 colon = strchr(arg, ':');
72 exit_error(PARAMETER_PROBLEM,
73 "Need TCP or UDP with port specification");
75 range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
78 if (port <= 0 || port > 65535)
79 exit_error(PARAMETER_PROBLEM,
80 "Port `%s' not valid\n", colon+1);
82 error = strchr(colon+1, ':');
84 exit_error(PARAMETER_PROBLEM,
85 "Invalid port:port syntax - use dash\n");
87 dash = strchr(colon, '-');
95 maxport = atoi(dash + 1);
96 if (maxport <= 0 || maxport > 65535)
97 exit_error(PARAMETER_PROBLEM,
98 "Port `%s' not valid\n", dash+1);
100 /* People are stupid. */
101 exit_error(PARAMETER_PROBLEM,
102 "Port range `%s' funky\n", colon+1);
103 range.min.tcp.port = htons(port);
104 range.max.tcp.port = htons(maxport);
106 /* Starts with a colon? No IP info...*/
108 return &(append_range(info, &range)->t);
112 range.flags |= IP_NAT_RANGE_MAP_IPS;
113 dash = strchr(arg, '-');
114 if (colon && dash && dash > colon)
120 ip = numeric_to_ipaddr(arg);
122 exit_error(PARAMETER_PROBLEM, "Bad IP address `%s'\n",
124 range.min_ip = ip->s_addr;
126 ip = numeric_to_ipaddr(dash+1);
128 exit_error(PARAMETER_PROBLEM, "Bad IP address `%s'\n",
130 range.max_ip = ip->s_addr;
132 range.max_ip = range.min_ip;
134 return &(append_range(info, &range)->t);
137 /* Function which parses command options; returns true if it
139 static int SNAT_parse(int c, char **argv, int invert, unsigned int *flags,
140 const void *e, struct xt_entry_target **target)
142 const struct ipt_entry *entry = e;
143 struct ipt_natinfo *info = (void *)*target;
146 if (entry->ip.proto == IPPROTO_TCP
147 || entry->ip.proto == IPPROTO_UDP
148 || entry->ip.proto == IPPROTO_ICMP)
155 if (check_inverse(optarg, &invert, NULL, 0))
156 exit_error(PARAMETER_PROBLEM,
157 "Unexpected `!' after --to-source");
159 if (*flags & IPT_SNAT_OPT_SOURCE) {
161 get_kernel_version();
162 if (kernel_version > LINUX_VERSION(2, 6, 10))
163 exit_error(PARAMETER_PROBLEM,
164 "Multiple --to-source not supported");
166 *target = parse_to(optarg, portok, info);
167 /* WTF do we need this for?? */
168 if (*flags & IPT_SNAT_OPT_RANDOM)
169 info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM;
170 *flags |= IPT_SNAT_OPT_SOURCE;
174 if (*flags & IPT_SNAT_OPT_SOURCE) {
175 info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM;
176 *flags |= IPT_SNAT_OPT_RANDOM;
178 *flags |= IPT_SNAT_OPT_RANDOM;
186 /* Final check; must have specfied --to-source. */
187 static void SNAT_check(unsigned int flags)
189 if (!(flags & IPT_SNAT_OPT_SOURCE))
190 exit_error(PARAMETER_PROBLEM,
191 "You must specify --to-source");
194 static void print_range(const struct ip_nat_range *r)
196 if (r->flags & IP_NAT_RANGE_MAP_IPS) {
199 a.s_addr = r->min_ip;
200 printf("%s", ipaddr_to_numeric(&a));
201 if (r->max_ip != r->min_ip) {
202 a.s_addr = r->max_ip;
203 printf("-%s", ipaddr_to_numeric(&a));
206 if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) {
208 printf("%hu", ntohs(r->min.tcp.port));
209 if (r->max.tcp.port != r->min.tcp.port)
210 printf("-%hu", ntohs(r->max.tcp.port));
214 /* Prints out the targinfo. */
215 static void SNAT_print(const void *ip, const struct xt_entry_target *target,
218 struct ipt_natinfo *info = (void *)target;
222 for (i = 0; i < info->mr.rangesize; i++) {
223 print_range(&info->mr.range[i]);
225 if (info->mr.range[i].flags & IP_NAT_RANGE_PROTO_RANDOM)
230 /* Saves the union ipt_targinfo in parsable form to stdout. */
231 static void SNAT_save(const void *ip, const struct xt_entry_target *target)
233 struct ipt_natinfo *info = (void *)target;
236 for (i = 0; i < info->mr.rangesize; i++) {
237 printf("--to-source ");
238 print_range(&info->mr.range[i]);
240 if (info->mr.range[i].flags & IP_NAT_RANGE_PROTO_RANDOM)
245 static struct xtables_target snat_tg_reg = {
247 .version = XTABLES_VERSION,
249 .size = XT_ALIGN(sizeof(struct ip_nat_multi_range)),
250 .userspacesize = XT_ALIGN(sizeof(struct ip_nat_multi_range)),
253 .final_check = SNAT_check,
256 .extra_opts = SNAT_opts,
261 xtables_register_target(&snat_tg_reg);