libipt_MASQUERADE.c revision 73866357e4a7a0fdc1b293bf8863fee2bd56da9e 
1/* Shared library add-on to iptables to add masquerade support. */
2#include <stdbool.h>
3#include <stdio.h>
4#include <netdb.h>
5#include <string.h>
6#include <stdlib.h>
7#include <getopt.h>
8#include <xtables.h>
9#include <limits.h> /* INT_MAX in ip_tables.h */
10#include <linux/netfilter_ipv4/ip_tables.h>
11#include <net/netfilter/nf_nat.h>
12
13static void MASQUERADE_help(void)
14{
15	printf(
16"MASQUERADE target options:\n"
17" --to-ports <port>[-<port>]\n"
18"				Port (range) to map to.\n"
19" --random\n"
20"				Randomize source port.\n");
21}
22
23static const struct option MASQUERADE_opts[] = {
24	{.name = "to-ports", .has_arg = true,  .val = '1'},
25	{.name = "random",   .has_arg = false, .val = '2'},
26	XT_GETOPT_TABLEEND,
27};
28
29static void MASQUERADE_init(struct xt_entry_target *t)
30{
31	struct nf_nat_multi_range *mr = (struct nf_nat_multi_range *)t->data;
32
33	/* Actually, it's 0, but it's ignored at the moment. */
34	mr->rangesize = 1;
35
36}
37
38/* Parses ports */
39static void
40parse_ports(const char *arg, struct nf_nat_multi_range *mr)
41{
42	char *end;
43	unsigned int port, maxport;
44
45	mr->range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
46
47	if (!xtables_strtoui(arg, &end, &port, 0, UINT16_MAX))
48		xtables_param_act(XTF_BAD_VALUE, "MASQUERADE", "--to-ports", arg);
49
50	switch (*end) {
51	case '\0':
52		mr->range[0].min.tcp.port
53			= mr->range[0].max.tcp.port
54			= htons(port);
55		return;
56	case '-':
57		if (!xtables_strtoui(end + 1, NULL, &maxport, 0, UINT16_MAX))
58			break;
59
60		if (maxport < port)
61			break;
62
63		mr->range[0].min.tcp.port = htons(port);
64		mr->range[0].max.tcp.port = htons(maxport);
65		return;
66	default:
67		break;
68	}
69	xtables_param_act(XTF_BAD_VALUE, "MASQUERADE", "--to-ports", arg);
70}
71
72static int MASQUERADE_parse(int c, char **argv, int invert, unsigned int *flags,
73                            const void *e, struct xt_entry_target **target)
74{
75	const struct ipt_entry *entry = e;
76	int portok;
77	struct nf_nat_multi_range *mr
78		= (struct nf_nat_multi_range *)(*target)->data;
79
80	if (entry->ip.proto == IPPROTO_TCP
81	    || entry->ip.proto == IPPROTO_UDP
82	    || entry->ip.proto == IPPROTO_SCTP
83	    || entry->ip.proto == IPPROTO_DCCP
84	    || entry->ip.proto == IPPROTO_ICMP)
85		portok = 1;
86	else
87		portok = 0;
88
89	switch (c) {
90	case '1':
91		if (!portok)
92			xtables_error(PARAMETER_PROBLEM,
93				   "Need TCP, UDP, SCTP or DCCP with port specification");
94
95		if (xtables_check_inverse(optarg, &invert, NULL, 0, argv))
96			xtables_error(PARAMETER_PROBLEM,
97				   "Unexpected `!' after --to-ports");
98
99		parse_ports(optarg, mr);
100		return 1;
101
102	case '2':
103		mr->range[0].flags |=  IP_NAT_RANGE_PROTO_RANDOM;
104		return 1;
105	}
106	return 0;
107}
108
109static void
110MASQUERADE_print(const void *ip, const struct xt_entry_target *target,
111                 int numeric)
112{
113	const struct nf_nat_multi_range *mr = (const void *)target->data;
114	const struct nf_nat_range *r = &mr->range[0];
115
116	if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) {
117		printf(" masq ports: ");
118		printf("%hu", ntohs(r->min.tcp.port));
119		if (r->max.tcp.port != r->min.tcp.port)
120			printf("-%hu", ntohs(r->max.tcp.port));
121	}
122
123	if (r->flags & IP_NAT_RANGE_PROTO_RANDOM)
124		printf(" random");
125}
126
127static void
128MASQUERADE_save(const void *ip, const struct xt_entry_target *target)
129{
130	const struct nf_nat_multi_range *mr = (const void *)target->data;
131	const struct nf_nat_range *r = &mr->range[0];
132
133	if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) {
134		printf(" --to-ports %hu", ntohs(r->min.tcp.port));
135		if (r->max.tcp.port != r->min.tcp.port)
136			printf("-%hu", ntohs(r->max.tcp.port));
137	}
138
139	if (r->flags & IP_NAT_RANGE_PROTO_RANDOM)
140		printf(" --random");
141}
142
143static struct xtables_target masquerade_tg_reg = {
144	.name		= "MASQUERADE",
145	.version	= XTABLES_VERSION,
146	.family		= NFPROTO_IPV4,
147	.size		= XT_ALIGN(sizeof(struct nf_nat_multi_range)),
148	.userspacesize	= XT_ALIGN(sizeof(struct nf_nat_multi_range)),
149	.help		= MASQUERADE_help,
150	.init		= MASQUERADE_init,
151	.parse		= MASQUERADE_parse,
152	.print		= MASQUERADE_print,
153	.save		= MASQUERADE_save,
154	.extra_opts	= MASQUERADE_opts,
155};
156
157void _init(void)
158{
159	xtables_register_target(&masquerade_tg_reg);
160}
161