1/* Shared library add-on to iptables to add redirect support. */ 2#include <stdio.h> 3#include <netdb.h> 4#include <string.h> 5#include <stdlib.h> 6#include <getopt.h> 7#include <iptables.h> 8#include <linux/netfilter_ipv4/ip_tables.h> 9#include <linux/netfilter_ipv4/ip_nat_rule.h> 10#include <netinet/in.h> 11 12/* Function which prints out usage message. */ 13static void 14help(void) 15{ 16 printf( 17"REDIRECT v%s options:\n" 18" --to-ports <port>[-<port>]\n" 19" Port (range) to map to.\n\n", 20IPTABLES_VERSION); 21} 22 23static struct option opts[] = { 24 { "to-ports", 1, 0, '1' }, 25 { 0 } 26}; 27 28/* Initialize the target. */ 29static void 30init(struct ipt_entry_target *t, unsigned int *nfcache) 31{ 32 struct ip_nat_multi_range *mr = (struct ip_nat_multi_range *)t->data; 33 34 /* Actually, it's 0, but it's ignored at the moment. */ 35 mr->rangesize = 1; 36 37} 38 39/* Parses ports */ 40static void 41parse_ports(const char *arg, struct ip_nat_multi_range *mr) 42{ 43 const char *dash; 44 int port; 45 46 mr->range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED; 47 48 if (strchr(arg, '.')) 49 exit_error(PARAMETER_PROBLEM, "IP address not permitted\n"); 50 51 port = atoi(arg); 52 if (port == 0 || port > 65535) 53 exit_error(PARAMETER_PROBLEM, "Port `%s' not valid\n", arg); 54 55 dash = strchr(arg, '-'); 56 if (!dash) { 57 mr->range[0].min.tcp.port 58 = mr->range[0].max.tcp.port 59 = htons(port); 60 } else { 61 int maxport; 62 63 maxport = atoi(dash + 1); 64 if (maxport == 0 || maxport > 65535) 65 exit_error(PARAMETER_PROBLEM, 66 "Port `%s' not valid\n", dash+1); 67 if (maxport < port) 68 /* People are stupid. */ 69 exit_error(PARAMETER_PROBLEM, 70 "Port range `%s' funky\n", arg); 71 mr->range[0].min.tcp.port = htons(port); 72 mr->range[0].max.tcp.port = htons(maxport); 73 } 74} 75 76/* Function which parses command options; returns true if it 77 ate an option */ 78static int 79parse(int c, char **argv, int invert, unsigned int *flags, 80 const struct ipt_entry *entry, 81 struct ipt_entry_target **target) 82{ 83 struct ip_nat_multi_range *mr 84 = (struct ip_nat_multi_range *)(*target)->data; 85 int portok; 86 87 if (entry->ip.proto == IPPROTO_TCP 88 || entry->ip.proto == IPPROTO_UDP 89 || entry->ip.proto == IPPROTO_ICMP) 90 portok = 1; 91 else 92 portok = 0; 93 94 switch (c) { 95 case '1': 96 if (!portok) 97 exit_error(PARAMETER_PROBLEM, 98 "Need TCP or UDP with port specification"); 99 100 if (check_inverse(optarg, &invert, NULL, 0)) 101 exit_error(PARAMETER_PROBLEM, 102 "Unexpected `!' after --to-ports"); 103 104 parse_ports(optarg, mr); 105 return 1; 106 107 default: 108 return 0; 109 } 110} 111 112/* Final check; don't care. */ 113static void final_check(unsigned int flags) 114{ 115} 116 117/* Prints out the targinfo. */ 118static void 119print(const struct ipt_ip *ip, 120 const struct ipt_entry_target *target, 121 int numeric) 122{ 123 struct ip_nat_multi_range *mr 124 = (struct ip_nat_multi_range *)target->data; 125 struct ip_nat_range *r = &mr->range[0]; 126 127 if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) { 128 printf("redir ports "); 129 printf("%hu", ntohs(r->min.tcp.port)); 130 if (r->max.tcp.port != r->min.tcp.port) 131 printf("-%hu", ntohs(r->max.tcp.port)); 132 printf(" "); 133 } 134} 135 136/* Saves the union ipt_targinfo in parsable form to stdout. */ 137static void 138save(const struct ipt_ip *ip, const struct ipt_entry_target *target) 139{ 140 struct ip_nat_multi_range *mr 141 = (struct ip_nat_multi_range *)target->data; 142 struct ip_nat_range *r = &mr->range[0]; 143 144 if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) { 145 printf("--to-ports "); 146 printf("%hu", ntohs(r->min.tcp.port)); 147 if (r->max.tcp.port != r->min.tcp.port) 148 printf("-%hu", ntohs(r->max.tcp.port)); 149 printf(" "); 150 } 151} 152 153static struct iptables_target redir = { 154 .next = NULL, 155 .name = "REDIRECT", 156 .version = IPTABLES_VERSION, 157 .size = IPT_ALIGN(sizeof(struct ip_nat_multi_range)), 158 .userspacesize = IPT_ALIGN(sizeof(struct ip_nat_multi_range)), 159 .help = &help, 160 .init = &init, 161 .parse = &parse, 162 .final_check = &final_check, 163 .print = &print, 164 .save = &save, 165 .extra_opts = opts 166}; 167 168void ipt_REDIRECT_init(void) 169{ 170 register_target(&redir); 171} 172