diff options
Diffstat (limited to 'extensions/libipt_SNAT.c')
-rw-r--r-- | extensions/libipt_SNAT.c | 159 |
1 files changed, 89 insertions, 70 deletions
diff --git a/extensions/libipt_SNAT.c b/extensions/libipt_SNAT.c index 94b85c7..f8a46f4 100644 --- a/extensions/libipt_SNAT.c +++ b/extensions/libipt_SNAT.c @@ -4,47 +4,50 @@ #include <string.h> #include <stdlib.h> #include <getopt.h> +#include <xtables.h> #include <iptables.h> +#include <limits.h> /* INT_MAX in ip_tables.h */ #include <linux/netfilter_ipv4/ip_tables.h> -#include <linux/netfilter_ipv4/ip_nat_rule.h> -#include <netinet/in.h> +#include <net/netfilter/nf_nat.h> + +#define IPT_SNAT_OPT_SOURCE 0x01 +#define IPT_SNAT_OPT_RANDOM 0x02 /* Source NAT data consists of a multi-range, indicating where to map to. */ struct ipt_natinfo { - struct ipt_entry_target t; - struct ip_nat_multi_range mr; + struct xt_entry_target t; + struct nf_nat_multi_range mr; }; -/* Function which prints out usage message. */ -static void -help(void) +static void SNAT_help(void) { printf( -"SNAT v%s options:\n" +"SNAT target options:\n" " --to-source <ipaddr>[-<ipaddr>][:port-port]\n" " Address to map source to.\n" -" (You can use this more than once)\n\n", -IPTABLES_VERSION); +"[--random] [--persistent]\n"); } -static struct option opts[] = { - { "to-source", 1, 0, '1' }, - { 0 } +static const struct option SNAT_opts[] = { + { "to-source", 1, NULL, '1' }, + { "random", 0, NULL, '2' }, + { "persistent", 0, NULL, '3' }, + { .name = NULL } }; static struct ipt_natinfo * -append_range(struct ipt_natinfo *info, const struct ip_nat_range *range) +append_range(struct ipt_natinfo *info, const struct nf_nat_range *range) { unsigned int size; /* One rangesize already in struct ipt_natinfo */ - size = IPT_ALIGN(sizeof(*info) + info->mr.rangesize * sizeof(*range)); + size = XT_ALIGN(sizeof(*info) + info->mr.rangesize * sizeof(*range)); info = realloc(info, size); if (!info) - exit_error(OTHER_PROBLEM, "Out of memory\n"); + xtables_error(OTHER_PROBLEM, "Out of memory\n"); info->t.u.target_size = size; info->mr.range[info->mr.rangesize] = *range; @@ -54,12 +57,12 @@ append_range(struct ipt_natinfo *info, const struct ip_nat_range *range) } /* Ranges expected in network order. */ -static struct ipt_entry_target * +static struct xt_entry_target * parse_to(char *arg, int portok, struct ipt_natinfo *info) { - struct ip_nat_range range; + struct nf_nat_range range; char *colon, *dash, *error; - struct in_addr *ip; + const struct in_addr *ip; memset(&range, 0, sizeof(range)); colon = strchr(arg, ':'); @@ -68,19 +71,19 @@ parse_to(char *arg, int portok, struct ipt_natinfo *info) int port; if (!portok) - exit_error(PARAMETER_PROBLEM, - "Need TCP or UDP with port specification"); + xtables_error(PARAMETER_PROBLEM, + "Need TCP, UDP, SCTP or DCCP with port specification"); range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED; port = atoi(colon+1); if (port <= 0 || port > 65535) - exit_error(PARAMETER_PROBLEM, + xtables_error(PARAMETER_PROBLEM, "Port `%s' not valid\n", colon+1); error = strchr(colon+1, ':'); if (error) - exit_error(PARAMETER_PROBLEM, + xtables_error(PARAMETER_PROBLEM, "Invalid port:port syntax - use dash\n"); dash = strchr(colon, '-'); @@ -93,11 +96,11 @@ parse_to(char *arg, int portok, struct ipt_natinfo *info) maxport = atoi(dash + 1); if (maxport <= 0 || maxport > 65535) - exit_error(PARAMETER_PROBLEM, + xtables_error(PARAMETER_PROBLEM, "Port `%s' not valid\n", dash+1); if (maxport < port) /* People are stupid. */ - exit_error(PARAMETER_PROBLEM, + xtables_error(PARAMETER_PROBLEM, "Port range `%s' funky\n", colon+1); range.min.tcp.port = htons(port); range.max.tcp.port = htons(maxport); @@ -116,15 +119,15 @@ parse_to(char *arg, int portok, struct ipt_natinfo *info) if (dash) *dash = '\0'; - ip = dotted_to_addr(arg); + ip = xtables_numeric_to_ipaddr(arg); if (!ip) - exit_error(PARAMETER_PROBLEM, "Bad IP address `%s'\n", + xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n", arg); range.min_ip = ip->s_addr; if (dash) { - ip = dotted_to_addr(dash+1); + ip = xtables_numeric_to_ipaddr(dash+1); if (!ip) - exit_error(PARAMETER_PROBLEM, "Bad IP address `%s'\n", + xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n", dash+1); range.max_ip = ip->s_addr; } else @@ -133,18 +136,17 @@ parse_to(char *arg, int portok, struct ipt_natinfo *info) return &(append_range(info, &range)->t); } -/* Function which parses command options; returns true if it - ate an option */ -static int -parse(int c, char **argv, int invert, unsigned int *flags, - const struct ipt_entry *entry, - struct ipt_entry_target **target) +static int SNAT_parse(int c, char **argv, int invert, unsigned int *flags, + const void *e, struct xt_entry_target **target) { + const struct ipt_entry *entry = e; struct ipt_natinfo *info = (void *)*target; int portok; if (entry->ip.proto == IPPROTO_TCP || entry->ip.proto == IPPROTO_UDP + || entry->ip.proto == IPPROTO_SCTP + || entry->ip.proto == IPPROTO_DCCP || entry->ip.proto == IPPROTO_ICMP) portok = 1; else @@ -152,19 +154,34 @@ parse(int c, char **argv, int invert, unsigned int *flags, switch (c) { case '1': - if (check_inverse(optarg, &invert, NULL, 0)) - exit_error(PARAMETER_PROBLEM, + if (xtables_check_inverse(optarg, &invert, NULL, 0, argv)) + xtables_error(PARAMETER_PROBLEM, "Unexpected `!' after --to-source"); - if (*flags) { + if (*flags & IPT_SNAT_OPT_SOURCE) { if (!kernel_version) get_kernel_version(); if (kernel_version > LINUX_VERSION(2, 6, 10)) - exit_error(PARAMETER_PROBLEM, + xtables_error(PARAMETER_PROBLEM, "Multiple --to-source not supported"); } *target = parse_to(optarg, portok, info); - *flags = 1; + /* WTF do we need this for?? */ + if (*flags & IPT_SNAT_OPT_RANDOM) + info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; + *flags |= IPT_SNAT_OPT_SOURCE; + return 1; + + case '2': + if (*flags & IPT_SNAT_OPT_SOURCE) { + info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; + *flags |= IPT_SNAT_OPT_RANDOM; + } else + *flags |= IPT_SNAT_OPT_RANDOM; + return 1; + + case '3': + info->mr.range[0].flags |= IP_NAT_RANGE_PERSISTENT; return 1; default: @@ -172,24 +189,23 @@ parse(int c, char **argv, int invert, unsigned int *flags, } } -/* Final check; must have specfied --to-source. */ -static void final_check(unsigned int flags) +static void SNAT_check(unsigned int flags) { - if (!flags) - exit_error(PARAMETER_PROBLEM, + if (!(flags & IPT_SNAT_OPT_SOURCE)) + xtables_error(PARAMETER_PROBLEM, "You must specify --to-source"); } -static void print_range(const struct ip_nat_range *r) +static void print_range(const struct nf_nat_range *r) { if (r->flags & IP_NAT_RANGE_MAP_IPS) { struct in_addr a; a.s_addr = r->min_ip; - printf("%s", addr_to_dotted(&a)); + printf("%s", xtables_ipaddr_to_numeric(&a)); if (r->max_ip != r->min_ip) { a.s_addr = r->max_ip; - printf("-%s", addr_to_dotted(&a)); + printf("-%s", xtables_ipaddr_to_numeric(&a)); } } if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) { @@ -200,51 +216,54 @@ static void print_range(const struct ip_nat_range *r) } } -/* Prints out the targinfo. */ -static void -print(const struct ipt_ip *ip, - const struct ipt_entry_target *target, - int numeric) +static void SNAT_print(const void *ip, const struct xt_entry_target *target, + int numeric) { - struct ipt_natinfo *info = (void *)target; + const struct ipt_natinfo *info = (const void *)target; unsigned int i = 0; printf("to:"); for (i = 0; i < info->mr.rangesize; i++) { print_range(&info->mr.range[i]); printf(" "); + if (info->mr.range[i].flags & IP_NAT_RANGE_PROTO_RANDOM) + printf("random "); + if (info->mr.range[i].flags & IP_NAT_RANGE_PERSISTENT) + printf("persistent "); } } -/* Saves the union ipt_targinfo in parsable form to stdout. */ -static void -save(const struct ipt_ip *ip, const struct ipt_entry_target *target) +static void SNAT_save(const void *ip, const struct xt_entry_target *target) { - struct ipt_natinfo *info = (void *)target; + const struct ipt_natinfo *info = (const void *)target; unsigned int i = 0; for (i = 0; i < info->mr.rangesize; i++) { printf("--to-source "); print_range(&info->mr.range[i]); printf(" "); + if (info->mr.range[i].flags & IP_NAT_RANGE_PROTO_RANDOM) + printf("--random "); + if (info->mr.range[i].flags & IP_NAT_RANGE_PERSISTENT) + printf("--persistent "); } } -static struct iptables_target snat = { - .next = NULL, +static struct xtables_target snat_tg_reg = { .name = "SNAT", - .version = IPTABLES_VERSION, - .size = IPT_ALIGN(sizeof(struct ip_nat_multi_range)), - .userspacesize = IPT_ALIGN(sizeof(struct ip_nat_multi_range)), - .help = &help, - .parse = &parse, - .final_check = &final_check, - .print = &print, - .save = &save, - .extra_opts = opts + .version = XTABLES_VERSION, + .family = NFPROTO_IPV4, + .size = XT_ALIGN(sizeof(struct nf_nat_multi_range)), + .userspacesize = XT_ALIGN(sizeof(struct nf_nat_multi_range)), + .help = SNAT_help, + .parse = SNAT_parse, + .final_check = SNAT_check, + .print = SNAT_print, + .save = SNAT_save, + .extra_opts = SNAT_opts, }; -void ipt_SNAT_init(void) +void libipt_SNAT_init(void) { - register_target(&snat); + xtables_register_target(&snat_tg_reg); } |