]>
Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* Same. Just like SNAT, only try to make the connections |
2 | * between client A and server B always have the same source ip. | |
3 | * | |
4 | * (C) 2000 Paul `Rusty' Russell | |
5 | * (C) 2001 Martin Josefsson | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or modify | |
8 | * it under the terms of the GNU General Public License version 2 as | |
9 | * published by the Free Software Foundation. | |
10 | * | |
11 | * 010320 Martin Josefsson <gandalf@wlug.westbo.se> | |
12 | * * copied ipt_BALANCE.c to ipt_SAME.c and changed a few things. | |
13 | * 010728 Martin Josefsson <gandalf@wlug.westbo.se> | |
14 | * * added --nodst to not include destination-ip in new source | |
15 | * calculations. | |
16 | * * added some more sanity-checks. | |
17 | * 010729 Martin Josefsson <gandalf@wlug.westbo.se> | |
18 | * * fixed a buggy if-statement in same_check(), should have | |
19 | * used ntohl() but didn't. | |
20 | * * added support for multiple ranges. IPT_SAME_MAX_RANGE is | |
21 | * defined in linux/include/linux/netfilter_ipv4/ipt_SAME.h | |
22 | * and is currently set to 10. | |
23 | * * added support for 1-address range, nice to have now that | |
24 | * we have multiple ranges. | |
25 | */ | |
26 | #include <linux/types.h> | |
27 | #include <linux/ip.h> | |
28 | #include <linux/timer.h> | |
29 | #include <linux/module.h> | |
30 | #include <linux/netfilter.h> | |
31 | #include <linux/netdevice.h> | |
32 | #include <linux/if.h> | |
33 | #include <linux/inetdevice.h> | |
34 | #include <net/protocol.h> | |
35 | #include <net/checksum.h> | |
36 | #include <linux/netfilter_ipv4.h> | |
6709dbbb | 37 | #include <linux/netfilter/x_tables.h> |
5b1158e9 JK |
38 | #ifdef CONFIG_NF_NAT_NEEDED |
39 | #include <net/netfilter/nf_nat_rule.h> | |
40 | #else | |
1da177e4 | 41 | #include <linux/netfilter_ipv4/ip_nat_rule.h> |
5b1158e9 | 42 | #endif |
1da177e4 LT |
43 | #include <linux/netfilter_ipv4/ipt_SAME.h> |
44 | ||
45 | MODULE_LICENSE("GPL"); | |
46 | MODULE_AUTHOR("Martin Josefsson <gandalf@wlug.westbo.se>"); | |
47 | MODULE_DESCRIPTION("iptables special SNAT module for consistent sourceip"); | |
48 | ||
49 | #if 0 | |
50 | #define DEBUGP printk | |
51 | #else | |
52 | #define DEBUGP(format, args...) | |
53 | #endif | |
54 | ||
55 | static int | |
56 | same_check(const char *tablename, | |
2e4e6a17 | 57 | const void *e, |
c4986734 | 58 | const struct xt_target *target, |
1da177e4 | 59 | void *targinfo, |
1da177e4 LT |
60 | unsigned int hook_mask) |
61 | { | |
62 | unsigned int count, countess, rangeip, index = 0; | |
63 | struct ipt_same_info *mr = targinfo; | |
64 | ||
65 | mr->ipnum = 0; | |
66 | ||
1da177e4 LT |
67 | if (mr->rangesize < 1) { |
68 | DEBUGP("same_check: need at least one dest range.\n"); | |
69 | return 0; | |
70 | } | |
71 | if (mr->rangesize > IPT_SAME_MAX_RANGE) { | |
72 | DEBUGP("same_check: too many ranges specified, maximum " | |
73 | "is %u ranges\n", | |
74 | IPT_SAME_MAX_RANGE); | |
75 | return 0; | |
76 | } | |
77 | for (count = 0; count < mr->rangesize; count++) { | |
78 | if (ntohl(mr->range[count].min_ip) > | |
79 | ntohl(mr->range[count].max_ip)) { | |
80 | DEBUGP("same_check: min_ip is larger than max_ip in " | |
81 | "range `%u.%u.%u.%u-%u.%u.%u.%u'.\n", | |
82 | NIPQUAD(mr->range[count].min_ip), | |
83 | NIPQUAD(mr->range[count].max_ip)); | |
84 | return 0; | |
85 | } | |
86 | if (!(mr->range[count].flags & IP_NAT_RANGE_MAP_IPS)) { | |
87 | DEBUGP("same_check: bad MAP_IPS.\n"); | |
88 | return 0; | |
89 | } | |
e905a9ed | 90 | rangeip = (ntohl(mr->range[count].max_ip) - |
1da177e4 LT |
91 | ntohl(mr->range[count].min_ip) + 1); |
92 | mr->ipnum += rangeip; | |
e905a9ed | 93 | |
1da177e4 LT |
94 | DEBUGP("same_check: range %u, ipnum = %u\n", count, rangeip); |
95 | } | |
96 | DEBUGP("same_check: total ipaddresses = %u\n", mr->ipnum); | |
e905a9ed | 97 | |
1da177e4 LT |
98 | mr->iparray = kmalloc((sizeof(u_int32_t) * mr->ipnum), GFP_KERNEL); |
99 | if (!mr->iparray) { | |
100 | DEBUGP("same_check: Couldn't allocate %u bytes " | |
e905a9ed | 101 | "for %u ipaddresses!\n", |
1da177e4 LT |
102 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); |
103 | return 0; | |
104 | } | |
105 | DEBUGP("same_check: Allocated %u bytes for %u ipaddresses.\n", | |
106 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
e905a9ed | 107 | |
1da177e4 LT |
108 | for (count = 0; count < mr->rangesize; count++) { |
109 | for (countess = ntohl(mr->range[count].min_ip); | |
110 | countess <= ntohl(mr->range[count].max_ip); | |
111 | countess++) { | |
112 | mr->iparray[index] = countess; | |
113 | DEBUGP("same_check: Added ipaddress `%u.%u.%u.%u' " | |
114 | "in index %u.\n", | |
115 | HIPQUAD(countess), index); | |
116 | index++; | |
117 | } | |
118 | } | |
119 | return 1; | |
120 | } | |
121 | ||
e905a9ed | 122 | static void |
efa74165 | 123 | same_destroy(const struct xt_target *target, void *targinfo) |
1da177e4 LT |
124 | { |
125 | struct ipt_same_info *mr = targinfo; | |
126 | ||
127 | kfree(mr->iparray); | |
e905a9ed | 128 | |
1da177e4 LT |
129 | DEBUGP("same_destroy: Deallocated %u bytes for %u ipaddresses.\n", |
130 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
131 | } | |
132 | ||
133 | static unsigned int | |
134 | same_target(struct sk_buff **pskb, | |
135 | const struct net_device *in, | |
136 | const struct net_device *out, | |
137 | unsigned int hooknum, | |
c4986734 | 138 | const struct xt_target *target, |
fe1cb108 | 139 | const void *targinfo) |
1da177e4 LT |
140 | { |
141 | struct ip_conntrack *ct; | |
142 | enum ip_conntrack_info ctinfo; | |
6a19d614 AV |
143 | u_int32_t tmpip, aindex; |
144 | __be32 new_ip; | |
1da177e4 LT |
145 | const struct ipt_same_info *same = targinfo; |
146 | struct ip_nat_range newrange; | |
147 | const struct ip_conntrack_tuple *t; | |
148 | ||
149 | IP_NF_ASSERT(hooknum == NF_IP_PRE_ROUTING || | |
150 | hooknum == NF_IP_POST_ROUTING); | |
151 | ct = ip_conntrack_get(*pskb, &ctinfo); | |
152 | ||
153 | t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; | |
154 | ||
155 | /* Base new source on real src ip and optionally dst ip, | |
156 | giving some hope for consistency across reboots. | |
157 | Here we calculate the index in same->iparray which | |
158 | holds the ipaddress we should use */ | |
e905a9ed | 159 | |
5b1158e9 JK |
160 | #ifdef CONFIG_NF_NAT_NEEDED |
161 | tmpip = ntohl(t->src.u3.ip); | |
162 | ||
163 | if (!(same->info & IPT_SAME_NODST)) | |
164 | tmpip += ntohl(t->dst.u3.ip); | |
165 | #else | |
1da177e4 LT |
166 | tmpip = ntohl(t->src.ip); |
167 | ||
168 | if (!(same->info & IPT_SAME_NODST)) | |
169 | tmpip += ntohl(t->dst.ip); | |
5b1158e9 | 170 | #endif |
1da177e4 LT |
171 | aindex = tmpip % same->ipnum; |
172 | ||
173 | new_ip = htonl(same->iparray[aindex]); | |
174 | ||
175 | DEBUGP("ipt_SAME: src=%u.%u.%u.%u dst=%u.%u.%u.%u, " | |
176 | "new src=%u.%u.%u.%u\n", | |
177 | NIPQUAD(t->src.ip), NIPQUAD(t->dst.ip), | |
178 | NIPQUAD(new_ip)); | |
179 | ||
180 | /* Transfer from original range. */ | |
181 | newrange = ((struct ip_nat_range) | |
182 | { same->range[0].flags, new_ip, new_ip, | |
183 | /* FIXME: Use ports from correct range! */ | |
184 | same->range[0].min, same->range[0].max }); | |
185 | ||
186 | /* Hand modified range to generic setup. */ | |
187 | return ip_nat_setup_info(ct, &newrange, hooknum); | |
188 | } | |
189 | ||
6709dbbb | 190 | static struct xt_target same_reg = { |
1da177e4 | 191 | .name = "SAME", |
6709dbbb | 192 | .family = AF_INET, |
1da177e4 | 193 | .target = same_target, |
1d5cd909 PM |
194 | .targetsize = sizeof(struct ipt_same_info), |
195 | .table = "nat", | |
196 | .hooks = (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_POST_ROUTING), | |
1da177e4 LT |
197 | .checkentry = same_check, |
198 | .destroy = same_destroy, | |
199 | .me = THIS_MODULE, | |
200 | }; | |
201 | ||
65b4b4e8 | 202 | static int __init ipt_same_init(void) |
1da177e4 | 203 | { |
6709dbbb | 204 | return xt_register_target(&same_reg); |
1da177e4 LT |
205 | } |
206 | ||
65b4b4e8 | 207 | static void __exit ipt_same_fini(void) |
1da177e4 | 208 | { |
6709dbbb | 209 | xt_unregister_target(&same_reg); |
1da177e4 LT |
210 | } |
211 | ||
65b4b4e8 AM |
212 | module_init(ipt_same_init); |
213 | module_exit(ipt_same_fini); | |
1da177e4 | 214 |