libipt_NETMAP.c revision d09b6d591ca7d7d7575cb6aa20384c9830f777ab
1/* Shared library add-on to iptables to add static NAT support. 2 Author: Svenning Soerensen <svenning@post5.tele.dk> 3*/ 4#include <stdbool.h> 5#include <stdio.h> 6#include <netdb.h> 7#include <string.h> 8#include <stdlib.h> 9#include <getopt.h> 10#include <xtables.h> 11#include <net/netfilter/nf_nat.h> 12 13#define MODULENAME "NETMAP" 14 15static const struct option NETMAP_opts[] = { 16 {.name = "to", .has_arg = true, .val = '1'}, 17 XT_GETOPT_TABLEEND, 18}; 19 20static void NETMAP_help(void) 21{ 22 printf(MODULENAME" target options:\n" 23 " --%s address[/mask]\n" 24 " Network address to map to.\n\n", 25 NETMAP_opts[0].name); 26} 27 28static uint32_t 29bits2netmask(int bits) 30{ 31 uint32_t netmask, bm; 32 33 if (bits >= 32 || bits < 0) 34 return(~0); 35 for (netmask = 0, bm = 0x80000000; bits; bits--, bm >>= 1) 36 netmask |= bm; 37 return htonl(netmask); 38} 39 40static int 41netmask2bits(uint32_t netmask) 42{ 43 uint32_t bm; 44 int bits; 45 46 netmask = ntohl(netmask); 47 for (bits = 0, bm = 0x80000000; netmask & bm; netmask <<= 1) 48 bits++; 49 if (netmask) 50 return -1; /* holes in netmask */ 51 return bits; 52} 53 54static void NETMAP_init(struct xt_entry_target *t) 55{ 56 struct nf_nat_multi_range *mr = (struct nf_nat_multi_range *)t->data; 57 58 /* Actually, it's 0, but it's ignored at the moment. */ 59 mr->rangesize = 1; 60 61} 62 63/* Parses network address */ 64static void 65parse_to(char *arg, struct nf_nat_range *range) 66{ 67 char *slash; 68 const struct in_addr *ip; 69 uint32_t netmask; 70 unsigned int bits; 71 72 range->flags |= IP_NAT_RANGE_MAP_IPS; 73 slash = strchr(arg, '/'); 74 if (slash) 75 *slash = '\0'; 76 77 ip = xtables_numeric_to_ipaddr(arg); 78 if (!ip) 79 xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n", 80 arg); 81 range->min_ip = ip->s_addr; 82 if (slash) { 83 if (strchr(slash+1, '.')) { 84 ip = xtables_numeric_to_ipmask(slash+1); 85 if (!ip) 86 xtables_error(PARAMETER_PROBLEM, "Bad netmask \"%s\"\n", 87 slash+1); 88 netmask = ip->s_addr; 89 } 90 else { 91 if (!xtables_strtoui(slash+1, NULL, &bits, 0, 32)) 92 xtables_error(PARAMETER_PROBLEM, "Bad netmask \"%s\"\n", 93 slash+1); 94 netmask = bits2netmask(bits); 95 } 96 /* Don't allow /0 (/1 is probably insane, too) */ 97 if (netmask == 0) 98 xtables_error(PARAMETER_PROBLEM, "Netmask needed\n"); 99 } 100 else 101 netmask = ~0; 102 103 if (range->min_ip & ~netmask) { 104 if (slash) 105 *slash = '/'; 106 xtables_error(PARAMETER_PROBLEM, "Bad network address \"%s\"\n", 107 arg); 108 } 109 range->max_ip = range->min_ip | ~netmask; 110} 111 112static int NETMAP_parse(int c, char **argv, int invert, unsigned int *flags, 113 const void *entry, struct xt_entry_target **target) 114{ 115 struct nf_nat_multi_range *mr 116 = (struct nf_nat_multi_range *)(*target)->data; 117 118 switch (c) { 119 case '1': 120 if (xtables_check_inverse(optarg, &invert, NULL, 0, argv)) 121 xtables_error(PARAMETER_PROBLEM, 122 "Unexpected `!' after --%s", NETMAP_opts[0].name); 123 124 parse_to(optarg, &mr->range[0]); 125 *flags = 1; 126 return 1; 127 } 128 return 0; 129} 130 131static void NETMAP_check(unsigned int flags) 132{ 133 if (!flags) 134 xtables_error(PARAMETER_PROBLEM, 135 MODULENAME" needs --%s", NETMAP_opts[0].name); 136} 137 138static void NETMAP_print(const void *ip, const struct xt_entry_target *target, 139 int numeric) 140{ 141 const struct nf_nat_multi_range *mr = (const void *)target->data; 142 const struct nf_nat_range *r = &mr->range[0]; 143 struct in_addr a; 144 int bits; 145 146 a.s_addr = r->min_ip; 147 printf("%s", xtables_ipaddr_to_numeric(&a)); 148 a.s_addr = ~(r->min_ip ^ r->max_ip); 149 bits = netmask2bits(a.s_addr); 150 if (bits < 0) 151 printf("/%s", xtables_ipaddr_to_numeric(&a)); 152 else 153 printf("/%d", bits); 154} 155 156static void NETMAP_save(const void *ip, const struct xt_entry_target *target) 157{ 158 printf("--%s ", NETMAP_opts[0].name); 159 NETMAP_print(ip, target, 0); 160} 161 162static struct xtables_target netmap_tg_reg = { 163 .name = MODULENAME, 164 .version = XTABLES_VERSION, 165 .family = NFPROTO_IPV4, 166 .size = XT_ALIGN(sizeof(struct nf_nat_multi_range)), 167 .userspacesize = XT_ALIGN(sizeof(struct nf_nat_multi_range)), 168 .help = NETMAP_help, 169 .init = NETMAP_init, 170 .parse = NETMAP_parse, 171 .final_check = NETMAP_check, 172 .print = NETMAP_print, 173 .save = NETMAP_save, 174 .extra_opts = NETMAP_opts, 175}; 176 177void _init(void) 178{ 179 xtables_register_target(&netmap_tg_reg); 180} 181