libipt_NETMAP.c revision 32b8e61e4e5bd405d9ad07bf9468498dfbb19f9e 
1/* Shared library add-on to iptables to add static NAT support.
2   Author: Svenning Soerensen <svenning@post5.tele.dk>
3*/
4#include <stdbool.h>
5#include <stdio.h>
6#include <netdb.h>
7#include <string.h>
8#include <stdlib.h>
9#include <getopt.h>
10#include <xtables.h>
11#include <net/netfilter/nf_nat.h>
12
13#define MODULENAME "NETMAP"
14
15static const struct option NETMAP_opts[] = {
16	{.name = "to", .has_arg = true, .val = '1'},
17	XT_GETOPT_TABLEEND,
18};
19
20static void NETMAP_help(void)
21{
22	printf(MODULENAME" target options:\n"
23	       "  --%s address[/mask]\n"
24	       "				Network address to map to.\n\n",
25	       NETMAP_opts[0].name);
26}
27
28static u_int32_t
29bits2netmask(int bits)
30{
31	u_int32_t netmask, bm;
32
33	if (bits >= 32 || bits < 0)
34		return(~0);
35	for (netmask = 0, bm = 0x80000000; bits; bits--, bm >>= 1)
36		netmask |= bm;
37	return htonl(netmask);
38}
39
40static int
41netmask2bits(u_int32_t netmask)
42{
43	u_int32_t bm;
44	int bits;
45
46	netmask = ntohl(netmask);
47	for (bits = 0, bm = 0x80000000; netmask & bm; netmask <<= 1)
48		bits++;
49	if (netmask)
50		return -1; /* holes in netmask */
51	return bits;
52}
53
54static void NETMAP_init(struct xt_entry_target *t)
55{
56	struct nf_nat_multi_range *mr = (struct nf_nat_multi_range *)t->data;
57
58	/* Actually, it's 0, but it's ignored at the moment. */
59	mr->rangesize = 1;
60
61}
62
63/* Parses network address */
64static void
65parse_to(char *arg, struct nf_nat_range *range)
66{
67	char *slash;
68	const struct in_addr *ip;
69	u_int32_t netmask;
70	unsigned int bits;
71
72	range->flags |= IP_NAT_RANGE_MAP_IPS;
73	slash = strchr(arg, '/');
74	if (slash)
75		*slash = '\0';
76
77	ip = xtables_numeric_to_ipaddr(arg);
78	if (!ip)
79		xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n",
80			   arg);
81	range->min_ip = ip->s_addr;
82	if (slash) {
83		if (strchr(slash+1, '.')) {
84			ip = xtables_numeric_to_ipmask(slash+1);
85			if (!ip)
86				xtables_error(PARAMETER_PROBLEM, "Bad netmask \"%s\"\n",
87					   slash+1);
88			netmask = ip->s_addr;
89		}
90		else {
91			if (!xtables_strtoui(slash+1, NULL, &bits, 0, 32))
92				xtables_error(PARAMETER_PROBLEM, "Bad netmask \"%s\"\n",
93					   slash+1);
94			netmask = bits2netmask(bits);
95		}
96		/* Don't allow /0 (/1 is probably insane, too) */
97		if (netmask == 0)
98			xtables_error(PARAMETER_PROBLEM, "Netmask needed\n");
99	}
100	else
101		netmask = ~0;
102
103	if (range->min_ip & ~netmask) {
104		if (slash)
105			*slash = '/';
106		xtables_error(PARAMETER_PROBLEM, "Bad network address \"%s\"\n",
107			   arg);
108	}
109	range->max_ip = range->min_ip | ~netmask;
110}
111
112static int NETMAP_parse(int c, char **argv, int invert, unsigned int *flags,
113                        const void *entry, struct xt_entry_target **target)
114{
115	struct nf_nat_multi_range *mr
116		= (struct nf_nat_multi_range *)(*target)->data;
117
118	switch (c) {
119	case '1':
120		if (xtables_check_inverse(optarg, &invert, NULL, 0, argv))
121			xtables_error(PARAMETER_PROBLEM,
122				   "Unexpected `!' after --%s", NETMAP_opts[0].name);
123
124		parse_to(optarg, &mr->range[0]);
125		*flags = 1;
126		return 1;
127
128	default:
129		return 0;
130	}
131}
132
133static void NETMAP_check(unsigned int flags)
134{
135	if (!flags)
136		xtables_error(PARAMETER_PROBLEM,
137			   MODULENAME" needs --%s", NETMAP_opts[0].name);
138}
139
140static void NETMAP_print(const void *ip, const struct xt_entry_target *target,
141                         int numeric)
142{
143	const struct nf_nat_multi_range *mr = (const void *)target->data;
144	const struct nf_nat_range *r = &mr->range[0];
145	struct in_addr a;
146	int bits;
147
148	a.s_addr = r->min_ip;
149	printf("%s", xtables_ipaddr_to_numeric(&a));
150	a.s_addr = ~(r->min_ip ^ r->max_ip);
151	bits = netmask2bits(a.s_addr);
152	if (bits < 0)
153		printf("/%s", xtables_ipaddr_to_numeric(&a));
154	else
155		printf("/%d", bits);
156}
157
158static void NETMAP_save(const void *ip, const struct xt_entry_target *target)
159{
160	printf("--%s ", NETMAP_opts[0].name);
161	NETMAP_print(ip, target, 0);
162}
163
164static struct xtables_target netmap_tg_reg = {
165	.name		= MODULENAME,
166	.version	= XTABLES_VERSION,
167	.family		= NFPROTO_IPV4,
168	.size		= XT_ALIGN(sizeof(struct nf_nat_multi_range)),
169	.userspacesize	= XT_ALIGN(sizeof(struct nf_nat_multi_range)),
170	.help		= NETMAP_help,
171	.init		= NETMAP_init,
172	.parse		= NETMAP_parse,
173	.final_check	= NETMAP_check,
174	.print		= NETMAP_print,
175	.save		= NETMAP_save,
176	.extra_opts	= NETMAP_opts,
177};
178
179void _init(void)
180{
181	xtables_register_target(&netmap_tg_reg);
182}
183