libipt_MASQUERADE.c revision 32b8e61e4e5bd405d9ad07bf9468498dfbb19f9e
1/* Shared library add-on to iptables to add masquerade support. */ 2#include <stdbool.h> 3#include <stdio.h> 4#include <netdb.h> 5#include <string.h> 6#include <stdlib.h> 7#include <getopt.h> 8#include <xtables.h> 9#include <limits.h> /* INT_MAX in ip_tables.h */ 10#include <linux/netfilter_ipv4/ip_tables.h> 11#include <net/netfilter/nf_nat.h> 12 13static void MASQUERADE_help(void) 14{ 15 printf( 16"MASQUERADE target options:\n" 17" --to-ports <port>[-<port>]\n" 18" Port (range) to map to.\n" 19" --random\n" 20" Randomize source port.\n"); 21} 22 23static const struct option MASQUERADE_opts[] = { 24 {.name = "to-ports", .has_arg = true, .val = '1'}, 25 {.name = "random", .has_arg = false, .val = '2'}, 26 XT_GETOPT_TABLEEND, 27}; 28 29static void MASQUERADE_init(struct xt_entry_target *t) 30{ 31 struct nf_nat_multi_range *mr = (struct nf_nat_multi_range *)t->data; 32 33 /* Actually, it's 0, but it's ignored at the moment. */ 34 mr->rangesize = 1; 35 36} 37 38/* Parses ports */ 39static void 40parse_ports(const char *arg, struct nf_nat_multi_range *mr) 41{ 42 char *end; 43 unsigned int port, maxport; 44 45 mr->range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED; 46 47 if (!xtables_strtoui(arg, &end, &port, 0, UINT16_MAX)) 48 xtables_param_act(XTF_BAD_VALUE, "MASQUERADE", "--to-ports", arg); 49 50 switch (*end) { 51 case '\0': 52 mr->range[0].min.tcp.port 53 = mr->range[0].max.tcp.port 54 = htons(port); 55 return; 56 case '-': 57 if (!xtables_strtoui(end + 1, NULL, &maxport, 0, UINT16_MAX)) 58 break; 59 60 if (maxport < port) 61 break; 62 63 mr->range[0].min.tcp.port = htons(port); 64 mr->range[0].max.tcp.port = htons(maxport); 65 return; 66 default: 67 break; 68 } 69 xtables_param_act(XTF_BAD_VALUE, "MASQUERADE", "--to-ports", arg); 70} 71 72static int MASQUERADE_parse(int c, char **argv, int invert, unsigned int *flags, 73 const void *e, struct xt_entry_target **target) 74{ 75 const struct ipt_entry *entry = e; 76 int portok; 77 struct nf_nat_multi_range *mr 78 = (struct nf_nat_multi_range *)(*target)->data; 79 80 if (entry->ip.proto == IPPROTO_TCP 81 || entry->ip.proto == IPPROTO_UDP 82 || entry->ip.proto == IPPROTO_SCTP 83 || entry->ip.proto == IPPROTO_DCCP 84 || entry->ip.proto == IPPROTO_ICMP) 85 portok = 1; 86 else 87 portok = 0; 88 89 switch (c) { 90 case '1': 91 if (!portok) 92 xtables_error(PARAMETER_PROBLEM, 93 "Need TCP, UDP, SCTP or DCCP with port specification"); 94 95 if (xtables_check_inverse(optarg, &invert, NULL, 0, argv)) 96 xtables_error(PARAMETER_PROBLEM, 97 "Unexpected `!' after --to-ports"); 98 99 parse_ports(optarg, mr); 100 return 1; 101 102 case '2': 103 mr->range[0].flags |= IP_NAT_RANGE_PROTO_RANDOM; 104 return 1; 105 106 default: 107 return 0; 108 } 109} 110 111static void 112MASQUERADE_print(const void *ip, const struct xt_entry_target *target, 113 int numeric) 114{ 115 const struct nf_nat_multi_range *mr = (const void *)target->data; 116 const struct nf_nat_range *r = &mr->range[0]; 117 118 if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) { 119 printf("masq ports: "); 120 printf("%hu", ntohs(r->min.tcp.port)); 121 if (r->max.tcp.port != r->min.tcp.port) 122 printf("-%hu", ntohs(r->max.tcp.port)); 123 printf(" "); 124 } 125 126 if (r->flags & IP_NAT_RANGE_PROTO_RANDOM) 127 printf("random "); 128} 129 130static void 131MASQUERADE_save(const void *ip, const struct xt_entry_target *target) 132{ 133 const struct nf_nat_multi_range *mr = (const void *)target->data; 134 const struct nf_nat_range *r = &mr->range[0]; 135 136 if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) { 137 printf("--to-ports %hu", ntohs(r->min.tcp.port)); 138 if (r->max.tcp.port != r->min.tcp.port) 139 printf("-%hu", ntohs(r->max.tcp.port)); 140 printf(" "); 141 } 142 143 if (r->flags & IP_NAT_RANGE_PROTO_RANDOM) 144 printf("--random "); 145} 146 147static struct xtables_target masquerade_tg_reg = { 148 .name = "MASQUERADE", 149 .version = XTABLES_VERSION, 150 .family = NFPROTO_IPV4, 151 .size = XT_ALIGN(sizeof(struct nf_nat_multi_range)), 152 .userspacesize = XT_ALIGN(sizeof(struct nf_nat_multi_range)), 153 .help = MASQUERADE_help, 154 .init = MASQUERADE_init, 155 .parse = MASQUERADE_parse, 156 .print = MASQUERADE_print, 157 .save = MASQUERADE_save, 158 .extra_opts = MASQUERADE_opts, 159}; 160 161void _init(void) 162{ 163 xtables_register_target(&masquerade_tg_reg); 164} 165