libipt_DNAT.c revision 1d5b63d12984d12c8d87242179855e17657be16d
1/* Shared library add-on to iptables to add destination-NAT support. */ 2#include <stdio.h> 3#include <netdb.h> 4#include <string.h> 5#include <stdlib.h> 6#include <getopt.h> 7#include <iptables.h> 8#include <linux/netfilter_ipv4/ip_tables.h> 9#include <linux/netfilter/nf_nat.h> 10 11#define IPT_DNAT_OPT_DEST 0x1 12#define IPT_DNAT_OPT_RANDOM 0x2 13 14/* Dest NAT data consists of a multi-range, indicating where to map 15 to. */ 16struct ipt_natinfo 17{ 18 struct xt_entry_target t; 19 struct ip_nat_multi_range mr; 20}; 21 22/* Function which prints out usage message. */ 23static void DNAT_help(void) 24{ 25 printf( 26"DNAT v%s options:\n" 27" --to-destination <ipaddr>[-<ipaddr>][:port-port]\n" 28" Address to map destination to.\n" 29"[--random]\n" 30"\n", 31IPTABLES_VERSION); 32} 33 34static const struct option DNAT_opts[] = { 35 { "to-destination", 1, NULL, '1' }, 36 { "random", 0, NULL, '2' }, 37 { } 38}; 39 40static struct ipt_natinfo * 41append_range(struct ipt_natinfo *info, const struct ip_nat_range *range) 42{ 43 unsigned int size; 44 45 /* One rangesize already in struct ipt_natinfo */ 46 size = IPT_ALIGN(sizeof(*info) + info->mr.rangesize * sizeof(*range)); 47 48 info = realloc(info, size); 49 if (!info) 50 exit_error(OTHER_PROBLEM, "Out of memory\n"); 51 52 info->t.u.target_size = size; 53 info->mr.range[info->mr.rangesize] = *range; 54 info->mr.rangesize++; 55 56 return info; 57} 58 59/* Ranges expected in network order. */ 60static struct xt_entry_target * 61parse_to(char *arg, int portok, struct ipt_natinfo *info) 62{ 63 struct ip_nat_range range; 64 char *colon, *dash, *error; 65 struct in_addr *ip; 66 67 memset(&range, 0, sizeof(range)); 68 colon = strchr(arg, ':'); 69 70 if (colon) { 71 int port; 72 73 if (!portok) 74 exit_error(PARAMETER_PROBLEM, 75 "Need TCP or UDP with port specification"); 76 77 range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED; 78 79 port = atoi(colon+1); 80 if (port <= 0 || port > 65535) 81 exit_error(PARAMETER_PROBLEM, 82 "Port `%s' not valid\n", colon+1); 83 84 error = strchr(colon+1, ':'); 85 if (error) 86 exit_error(PARAMETER_PROBLEM, 87 "Invalid port:port syntax - use dash\n"); 88 89 dash = strchr(colon, '-'); 90 if (!dash) { 91 range.min.tcp.port 92 = range.max.tcp.port 93 = htons(port); 94 } else { 95 int maxport; 96 97 maxport = atoi(dash + 1); 98 if (maxport <= 0 || maxport > 65535) 99 exit_error(PARAMETER_PROBLEM, 100 "Port `%s' not valid\n", dash+1); 101 if (maxport < port) 102 /* People are stupid. */ 103 exit_error(PARAMETER_PROBLEM, 104 "Port range `%s' funky\n", colon+1); 105 range.min.tcp.port = htons(port); 106 range.max.tcp.port = htons(maxport); 107 } 108 /* Starts with a colon? No IP info...*/ 109 if (colon == arg) 110 return &(append_range(info, &range)->t); 111 *colon = '\0'; 112 } 113 114 range.flags |= IP_NAT_RANGE_MAP_IPS; 115 dash = strchr(arg, '-'); 116 if (colon && dash && dash > colon) 117 dash = NULL; 118 119 if (dash) 120 *dash = '\0'; 121 122 ip = dotted_to_addr(arg); 123 if (!ip) 124 exit_error(PARAMETER_PROBLEM, "Bad IP address `%s'\n", 125 arg); 126 range.min_ip = ip->s_addr; 127 if (dash) { 128 ip = dotted_to_addr(dash+1); 129 if (!ip) 130 exit_error(PARAMETER_PROBLEM, "Bad IP address `%s'\n", 131 dash+1); 132 range.max_ip = ip->s_addr; 133 } else 134 range.max_ip = range.min_ip; 135 136 return &(append_range(info, &range)->t); 137} 138 139/* Function which parses command options; returns true if it 140 ate an option */ 141static int DNAT_parse(int c, char **argv, int invert, unsigned int *flags, 142 const void *e, struct xt_entry_target **target) 143{ 144 const struct ipt_entry *entry = e; 145 struct ipt_natinfo *info = (void *)*target; 146 int portok; 147 148 if (entry->ip.proto == IPPROTO_TCP 149 || entry->ip.proto == IPPROTO_UDP 150 || entry->ip.proto == IPPROTO_ICMP) 151 portok = 1; 152 else 153 portok = 0; 154 155 switch (c) { 156 case '1': 157 if (check_inverse(optarg, &invert, NULL, 0)) 158 exit_error(PARAMETER_PROBLEM, 159 "Unexpected `!' after --to-destination"); 160 161 if (*flags) { 162 if (!kernel_version) 163 get_kernel_version(); 164 if (kernel_version > LINUX_VERSION(2, 6, 10)) 165 exit_error(PARAMETER_PROBLEM, 166 "Multiple --to-destination not supported"); 167 } 168 *target = parse_to(optarg, portok, info); 169 /* WTF do we need this for?? */ 170 if (*flags & IPT_DNAT_OPT_RANDOM) 171 info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; 172 *flags |= IPT_DNAT_OPT_DEST; 173 return 1; 174 175 case '2': 176 if (*flags & IPT_DNAT_OPT_DEST) { 177 info->mr.range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; 178 *flags |= IPT_DNAT_OPT_RANDOM; 179 } else 180 *flags |= IPT_DNAT_OPT_RANDOM; 181 default: 182 return 0; 183 } 184} 185 186/* Final check; must have specfied --to-source. */ 187static void DNAT_check(unsigned int flags) 188{ 189 if (!flags) 190 exit_error(PARAMETER_PROBLEM, 191 "You must specify --to-destination"); 192} 193 194static void print_range(const struct ip_nat_range *r) 195{ 196 if (r->flags & IP_NAT_RANGE_MAP_IPS) { 197 struct in_addr a; 198 199 a.s_addr = r->min_ip; 200 printf("%s", addr_to_dotted(&a)); 201 if (r->max_ip != r->min_ip) { 202 a.s_addr = r->max_ip; 203 printf("-%s", addr_to_dotted(&a)); 204 } 205 } 206 if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) { 207 printf(":"); 208 printf("%hu", ntohs(r->min.tcp.port)); 209 if (r->max.tcp.port != r->min.tcp.port) 210 printf("-%hu", ntohs(r->max.tcp.port)); 211 } 212} 213 214/* Prints out the targinfo. */ 215static void DNAT_print(const void *ip, const struct xt_entry_target *target, 216 int numeric) 217{ 218 struct ipt_natinfo *info = (void *)target; 219 unsigned int i = 0; 220 221 printf("to:"); 222 for (i = 0; i < info->mr.rangesize; i++) { 223 print_range(&info->mr.range[i]); 224 printf(" "); 225 if (info->mr.range[i].flags & IP_NAT_RANGE_PROTO_RANDOM) 226 printf("random "); 227 } 228} 229 230/* Saves the union ipt_targinfo in parsable form to stdout. */ 231static void DNAT_save(const void *ip, const struct xt_entry_target *target) 232{ 233 struct ipt_natinfo *info = (void *)target; 234 unsigned int i = 0; 235 236 for (i = 0; i < info->mr.rangesize; i++) { 237 printf("--to-destination "); 238 print_range(&info->mr.range[i]); 239 printf(" "); 240 if (info->mr.range[i].flags & IP_NAT_RANGE_PROTO_RANDOM) 241 printf("--random "); 242 } 243} 244 245static struct iptables_target dnat_target = { 246 .name = "DNAT", 247 .version = IPTABLES_VERSION, 248 .size = IPT_ALIGN(sizeof(struct ip_nat_multi_range)), 249 .userspacesize = IPT_ALIGN(sizeof(struct ip_nat_multi_range)), 250 .help = DNAT_help, 251 .parse = DNAT_parse, 252 .final_check = DNAT_check, 253 .print = DNAT_print, 254 .save = DNAT_save, 255 .extra_opts = DNAT_opts, 256}; 257 258void _init(void) 259{ 260 register_target(&dnat_target); 261} 262