1 #include <stdio.h>
2 #include <netdb.h>
3 #include <string.h>
4 #include <stdlib.h>
5 #include <xtables.h>
6 #include <iptables.h>
7 #include <limits.h> /* INT_MAX in ip_tables.h */
8 #include <linux/netfilter_ipv4/ip_tables.h>
9 #include <linux/netfilter/nf_nat.h>
10
11 enum {
12 O_TO_SRC = 0,
13 O_RANDOM,
14 O_RANDOM_FULLY,
15 O_PERSISTENT,
16 O_X_TO_SRC,
17 F_TO_SRC = 1 << O_TO_SRC,
18 F_RANDOM = 1 << O_RANDOM,
19 F_RANDOM_FULLY = 1 << O_RANDOM_FULLY,
20 F_X_TO_SRC = 1 << O_X_TO_SRC,
21 };
22
23 /* Source NAT data consists of a multi-range, indicating where to map
24 to. */
25 struct ipt_natinfo
26 {
27 struct xt_entry_target t;
28 struct nf_nat_ipv4_multi_range_compat mr;
29 };
30
SNAT_help(void)31 static void SNAT_help(void)
32 {
33 printf(
34 "SNAT target options:\n"
35 " --to-source [<ipaddr>[-<ipaddr>]][:port[-port]]\n"
36 " Address to map source to.\n"
37 "[--random] [--random-fully] [--persistent]\n");
38 }
39
40 static const struct xt_option_entry SNAT_opts[] = {
41 {.name = "to-source", .id = O_TO_SRC, .type = XTTYPE_STRING,
42 .flags = XTOPT_MAND | XTOPT_MULTI},
43 {.name = "random", .id = O_RANDOM, .type = XTTYPE_NONE},
44 {.name = "random-fully", .id = O_RANDOM_FULLY, .type = XTTYPE_NONE},
45 {.name = "persistent", .id = O_PERSISTENT, .type = XTTYPE_NONE},
46 XTOPT_TABLEEND,
47 };
48
49 static struct ipt_natinfo *
append_range(struct ipt_natinfo * info,const struct nf_nat_ipv4_range * range)50 append_range(struct ipt_natinfo *info, const struct nf_nat_ipv4_range *range)
51 {
52 unsigned int size;
53
54 /* One rangesize already in struct ipt_natinfo */
55 size = XT_ALIGN(sizeof(*info) + info->mr.rangesize * sizeof(*range));
56
57 info = realloc(info, size);
58 if (!info)
59 xtables_error(OTHER_PROBLEM, "Out of memory\n");
60
61 info->t.u.target_size = size;
62 info->mr.range[info->mr.rangesize] = *range;
63 info->mr.rangesize++;
64
65 return info;
66 }
67
68 /* Ranges expected in network order. */
69 static struct xt_entry_target *
parse_to(const char * orig_arg,int portok,struct ipt_natinfo * info)70 parse_to(const char *orig_arg, int portok, struct ipt_natinfo *info)
71 {
72 struct nf_nat_ipv4_range range;
73 char *arg, *colon, *dash, *error;
74 const struct in_addr *ip;
75
76 arg = strdup(orig_arg);
77 if (arg == NULL)
78 xtables_error(RESOURCE_PROBLEM, "strdup");
79 memset(&range, 0, sizeof(range));
80 colon = strchr(arg, ':');
81
82 if (colon) {
83 int port;
84
85 if (!portok)
86 xtables_error(PARAMETER_PROBLEM,
87 "Need TCP, UDP, SCTP or DCCP with port specification");
88
89 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
90
91 port = atoi(colon+1);
92 if (port <= 0 || port > 65535)
93 xtables_error(PARAMETER_PROBLEM,
94 "Port `%s' not valid\n", colon+1);
95
96 error = strchr(colon+1, ':');
97 if (error)
98 xtables_error(PARAMETER_PROBLEM,
99 "Invalid port:port syntax - use dash\n");
100
101 dash = strchr(colon, '-');
102 if (!dash) {
103 range.min.tcp.port
104 = range.max.tcp.port
105 = htons(port);
106 } else {
107 int maxport;
108
109 maxport = atoi(dash + 1);
110 if (maxport <= 0 || maxport > 65535)
111 xtables_error(PARAMETER_PROBLEM,
112 "Port `%s' not valid\n", dash+1);
113 if (maxport < port)
114 /* People are stupid. */
115 xtables_error(PARAMETER_PROBLEM,
116 "Port range `%s' funky\n", colon+1);
117 range.min.tcp.port = htons(port);
118 range.max.tcp.port = htons(maxport);
119 }
120 /* Starts with a colon? No IP info...*/
121 if (colon == arg) {
122 free(arg);
123 return &(append_range(info, &range)->t);
124 }
125 *colon = '\0';
126 }
127
128 range.flags |= NF_NAT_RANGE_MAP_IPS;
129 dash = strchr(arg, '-');
130 if (colon && dash && dash > colon)
131 dash = NULL;
132
133 if (dash)
134 *dash = '\0';
135
136 ip = xtables_numeric_to_ipaddr(arg);
137 if (!ip)
138 xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n",
139 arg);
140 range.min_ip = ip->s_addr;
141 if (dash) {
142 ip = xtables_numeric_to_ipaddr(dash+1);
143 if (!ip)
144 xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n",
145 dash+1);
146 range.max_ip = ip->s_addr;
147 } else
148 range.max_ip = range.min_ip;
149
150 free(arg);
151 return &(append_range(info, &range)->t);
152 }
153
SNAT_parse(struct xt_option_call * cb)154 static void SNAT_parse(struct xt_option_call *cb)
155 {
156 const struct ipt_entry *entry = cb->xt_entry;
157 struct ipt_natinfo *info = (void *)(*cb->target);
158 int portok;
159
160 if (entry->ip.proto == IPPROTO_TCP
161 || entry->ip.proto == IPPROTO_UDP
162 || entry->ip.proto == IPPROTO_SCTP
163 || entry->ip.proto == IPPROTO_DCCP
164 || entry->ip.proto == IPPROTO_ICMP)
165 portok = 1;
166 else
167 portok = 0;
168
169 xtables_option_parse(cb);
170 switch (cb->entry->id) {
171 case O_TO_SRC:
172 if (cb->xflags & F_X_TO_SRC) {
173 if (!kernel_version)
174 get_kernel_version();
175 if (kernel_version > LINUX_VERSION(2, 6, 10))
176 xtables_error(PARAMETER_PROBLEM,
177 "SNAT: Multiple --to-source not supported");
178 }
179 *cb->target = parse_to(cb->arg, portok, info);
180 cb->xflags |= F_X_TO_SRC;
181 break;
182 case O_PERSISTENT:
183 info->mr.range[0].flags |= NF_NAT_RANGE_PERSISTENT;
184 break;
185 }
186 }
187
SNAT_fcheck(struct xt_fcheck_call * cb)188 static void SNAT_fcheck(struct xt_fcheck_call *cb)
189 {
190 static const unsigned int f = F_TO_SRC | F_RANDOM;
191 static const unsigned int r = F_TO_SRC | F_RANDOM_FULLY;
192 struct nf_nat_ipv4_multi_range_compat *mr = cb->data;
193
194 if ((cb->xflags & f) == f)
195 mr->range[0].flags |= NF_NAT_RANGE_PROTO_RANDOM;
196 if ((cb->xflags & r) == r)
197 mr->range[0].flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY;
198 }
199
print_range(const struct nf_nat_ipv4_range * r)200 static void print_range(const struct nf_nat_ipv4_range *r)
201 {
202 if (r->flags & NF_NAT_RANGE_MAP_IPS) {
203 struct in_addr a;
204
205 a.s_addr = r->min_ip;
206 printf("%s", xtables_ipaddr_to_numeric(&a));
207 if (r->max_ip != r->min_ip) {
208 a.s_addr = r->max_ip;
209 printf("-%s", xtables_ipaddr_to_numeric(&a));
210 }
211 }
212 if (r->flags & NF_NAT_RANGE_PROTO_SPECIFIED) {
213 printf(":");
214 printf("%hu", ntohs(r->min.tcp.port));
215 if (r->max.tcp.port != r->min.tcp.port)
216 printf("-%hu", ntohs(r->max.tcp.port));
217 }
218 }
219
SNAT_print(const void * ip,const struct xt_entry_target * target,int numeric)220 static void SNAT_print(const void *ip, const struct xt_entry_target *target,
221 int numeric)
222 {
223 const struct ipt_natinfo *info = (const void *)target;
224 unsigned int i = 0;
225
226 printf(" to:");
227 for (i = 0; i < info->mr.rangesize; i++) {
228 print_range(&info->mr.range[i]);
229 if (info->mr.range[i].flags & NF_NAT_RANGE_PROTO_RANDOM)
230 printf(" random");
231 if (info->mr.range[i].flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY)
232 printf(" random-fully");
233 if (info->mr.range[i].flags & NF_NAT_RANGE_PERSISTENT)
234 printf(" persistent");
235 }
236 }
237
SNAT_save(const void * ip,const struct xt_entry_target * target)238 static void SNAT_save(const void *ip, const struct xt_entry_target *target)
239 {
240 const struct ipt_natinfo *info = (const void *)target;
241 unsigned int i = 0;
242
243 for (i = 0; i < info->mr.rangesize; i++) {
244 printf(" --to-source ");
245 print_range(&info->mr.range[i]);
246 if (info->mr.range[i].flags & NF_NAT_RANGE_PROTO_RANDOM)
247 printf(" --random");
248 if (info->mr.range[i].flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY)
249 printf(" --random-fully");
250 if (info->mr.range[i].flags & NF_NAT_RANGE_PERSISTENT)
251 printf(" --persistent");
252 }
253 }
254
print_range_xlate(const struct nf_nat_ipv4_range * r,struct xt_xlate * xl)255 static void print_range_xlate(const struct nf_nat_ipv4_range *r,
256 struct xt_xlate *xl)
257 {
258 if (r->flags & NF_NAT_RANGE_MAP_IPS) {
259 struct in_addr a;
260
261 a.s_addr = r->min_ip;
262 xt_xlate_add(xl, "%s", xtables_ipaddr_to_numeric(&a));
263 if (r->max_ip != r->min_ip) {
264 a.s_addr = r->max_ip;
265 xt_xlate_add(xl, "-%s", xtables_ipaddr_to_numeric(&a));
266 }
267 }
268 if (r->flags & NF_NAT_RANGE_PROTO_SPECIFIED) {
269 xt_xlate_add(xl, ":");
270 xt_xlate_add(xl, "%hu", ntohs(r->min.tcp.port));
271 if (r->max.tcp.port != r->min.tcp.port)
272 xt_xlate_add(xl, "-%hu", ntohs(r->max.tcp.port));
273 }
274 }
275
SNAT_xlate(struct xt_xlate * xl,const struct xt_xlate_tg_params * params)276 static int SNAT_xlate(struct xt_xlate *xl,
277 const struct xt_xlate_tg_params *params)
278 {
279 const struct ipt_natinfo *info = (const void *)params->target;
280 unsigned int i = 0;
281 bool sep_need = false;
282 const char *sep = " ";
283
284 for (i = 0; i < info->mr.rangesize; i++) {
285 xt_xlate_add(xl, "snat to ");
286 print_range_xlate(&info->mr.range[i], xl);
287 if (info->mr.range[i].flags & NF_NAT_RANGE_PROTO_RANDOM) {
288 xt_xlate_add(xl, " random");
289 sep_need = true;
290 }
291 if (info->mr.range[i].flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY) {
292 if (sep_need)
293 sep = ",";
294 xt_xlate_add(xl, "%sfully-random", sep);
295 sep_need = true;
296 }
297 if (info->mr.range[i].flags & NF_NAT_RANGE_PERSISTENT) {
298 if (sep_need)
299 sep = ",";
300 xt_xlate_add(xl, "%spersistent", sep);
301 }
302 }
303
304 return 1;
305 }
306
307 static struct xtables_target snat_tg_reg = {
308 .name = "SNAT",
309 .version = XTABLES_VERSION,
310 .family = NFPROTO_IPV4,
311 .size = XT_ALIGN(sizeof(struct nf_nat_ipv4_multi_range_compat)),
312 .userspacesize = XT_ALIGN(sizeof(struct nf_nat_ipv4_multi_range_compat)),
313 .help = SNAT_help,
314 .x6_parse = SNAT_parse,
315 .x6_fcheck = SNAT_fcheck,
316 .print = SNAT_print,
317 .save = SNAT_save,
318 .x6_options = SNAT_opts,
319 .xlate = SNAT_xlate,
320 };
321
_init(void)322 void _init(void)
323 {
324 xtables_register_target(&snat_tg_reg);
325 }
326