]>
Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* Same. Just like SNAT, only try to make the connections |
2 | * between client A and server B always have the same source ip. | |
3 | * | |
4 | * (C) 2000 Paul `Rusty' Russell | |
5 | * (C) 2001 Martin Josefsson | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or modify | |
8 | * it under the terms of the GNU General Public License version 2 as | |
9 | * published by the Free Software Foundation. | |
1da177e4 LT |
10 | */ |
11 | #include <linux/types.h> | |
12 | #include <linux/ip.h> | |
13 | #include <linux/timer.h> | |
14 | #include <linux/module.h> | |
15 | #include <linux/netfilter.h> | |
16 | #include <linux/netdevice.h> | |
17 | #include <linux/if.h> | |
18 | #include <linux/inetdevice.h> | |
19 | #include <net/protocol.h> | |
20 | #include <net/checksum.h> | |
21 | #include <linux/netfilter_ipv4.h> | |
6709dbbb | 22 | #include <linux/netfilter/x_tables.h> |
5b1158e9 | 23 | #include <net/netfilter/nf_nat_rule.h> |
1da177e4 LT |
24 | #include <linux/netfilter_ipv4/ipt_SAME.h> |
25 | ||
26 | MODULE_LICENSE("GPL"); | |
27 | MODULE_AUTHOR("Martin Josefsson <gandalf@wlug.westbo.se>"); | |
28 | MODULE_DESCRIPTION("iptables special SNAT module for consistent sourceip"); | |
29 | ||
e1931b78 | 30 | static bool |
1da177e4 | 31 | same_check(const char *tablename, |
2e4e6a17 | 32 | const void *e, |
c4986734 | 33 | const struct xt_target *target, |
1da177e4 | 34 | void *targinfo, |
1da177e4 LT |
35 | unsigned int hook_mask) |
36 | { | |
37 | unsigned int count, countess, rangeip, index = 0; | |
38 | struct ipt_same_info *mr = targinfo; | |
39 | ||
40 | mr->ipnum = 0; | |
41 | ||
1da177e4 | 42 | if (mr->rangesize < 1) { |
0d53778e | 43 | pr_debug("same_check: need at least one dest range.\n"); |
e1931b78 | 44 | return false; |
1da177e4 LT |
45 | } |
46 | if (mr->rangesize > IPT_SAME_MAX_RANGE) { | |
0d53778e PM |
47 | pr_debug("same_check: too many ranges specified, maximum " |
48 | "is %u ranges\n", IPT_SAME_MAX_RANGE); | |
e1931b78 | 49 | return false; |
1da177e4 LT |
50 | } |
51 | for (count = 0; count < mr->rangesize; count++) { | |
52 | if (ntohl(mr->range[count].min_ip) > | |
53 | ntohl(mr->range[count].max_ip)) { | |
0d53778e PM |
54 | pr_debug("same_check: min_ip is larger than max_ip in " |
55 | "range `%u.%u.%u.%u-%u.%u.%u.%u'.\n", | |
56 | NIPQUAD(mr->range[count].min_ip), | |
57 | NIPQUAD(mr->range[count].max_ip)); | |
e1931b78 | 58 | return false; |
1da177e4 LT |
59 | } |
60 | if (!(mr->range[count].flags & IP_NAT_RANGE_MAP_IPS)) { | |
0d53778e | 61 | pr_debug("same_check: bad MAP_IPS.\n"); |
e1931b78 | 62 | return false; |
1da177e4 | 63 | } |
e905a9ed | 64 | rangeip = (ntohl(mr->range[count].max_ip) - |
1da177e4 LT |
65 | ntohl(mr->range[count].min_ip) + 1); |
66 | mr->ipnum += rangeip; | |
e905a9ed | 67 | |
0d53778e | 68 | pr_debug("same_check: range %u, ipnum = %u\n", count, rangeip); |
1da177e4 | 69 | } |
0d53778e | 70 | pr_debug("same_check: total ipaddresses = %u\n", mr->ipnum); |
e905a9ed | 71 | |
1da177e4 LT |
72 | mr->iparray = kmalloc((sizeof(u_int32_t) * mr->ipnum), GFP_KERNEL); |
73 | if (!mr->iparray) { | |
0d53778e PM |
74 | pr_debug("same_check: Couldn't allocate %Zu bytes " |
75 | "for %u ipaddresses!\n", | |
76 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
e1931b78 | 77 | return false; |
1da177e4 | 78 | } |
0d53778e PM |
79 | pr_debug("same_check: Allocated %Zu bytes for %u ipaddresses.\n", |
80 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
e905a9ed | 81 | |
1da177e4 LT |
82 | for (count = 0; count < mr->rangesize; count++) { |
83 | for (countess = ntohl(mr->range[count].min_ip); | |
84 | countess <= ntohl(mr->range[count].max_ip); | |
85 | countess++) { | |
86 | mr->iparray[index] = countess; | |
0d53778e PM |
87 | pr_debug("same_check: Added ipaddress `%u.%u.%u.%u' " |
88 | "in index %u.\n", HIPQUAD(countess), index); | |
1da177e4 LT |
89 | index++; |
90 | } | |
91 | } | |
e1931b78 | 92 | return true; |
1da177e4 LT |
93 | } |
94 | ||
e905a9ed | 95 | static void |
efa74165 | 96 | same_destroy(const struct xt_target *target, void *targinfo) |
1da177e4 LT |
97 | { |
98 | struct ipt_same_info *mr = targinfo; | |
99 | ||
100 | kfree(mr->iparray); | |
e905a9ed | 101 | |
0d53778e PM |
102 | pr_debug("same_destroy: Deallocated %Zu bytes for %u ipaddresses.\n", |
103 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
1da177e4 LT |
104 | } |
105 | ||
106 | static unsigned int | |
3db05fea | 107 | same_target(struct sk_buff *skb, |
1da177e4 LT |
108 | const struct net_device *in, |
109 | const struct net_device *out, | |
110 | unsigned int hooknum, | |
c4986734 | 111 | const struct xt_target *target, |
fe1cb108 | 112 | const void *targinfo) |
1da177e4 | 113 | { |
587aa641 | 114 | struct nf_conn *ct; |
1da177e4 | 115 | enum ip_conntrack_info ctinfo; |
6a19d614 AV |
116 | u_int32_t tmpip, aindex; |
117 | __be32 new_ip; | |
1da177e4 | 118 | const struct ipt_same_info *same = targinfo; |
587aa641 PM |
119 | struct nf_nat_range newrange; |
120 | const struct nf_conntrack_tuple *t; | |
1da177e4 | 121 | |
587aa641 | 122 | NF_CT_ASSERT(hooknum == NF_IP_PRE_ROUTING || |
1da177e4 | 123 | hooknum == NF_IP_POST_ROUTING); |
3db05fea | 124 | ct = nf_ct_get(skb, &ctinfo); |
1da177e4 LT |
125 | |
126 | t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; | |
127 | ||
128 | /* Base new source on real src ip and optionally dst ip, | |
129 | giving some hope for consistency across reboots. | |
130 | Here we calculate the index in same->iparray which | |
131 | holds the ipaddress we should use */ | |
e905a9ed | 132 | |
5b1158e9 JK |
133 | tmpip = ntohl(t->src.u3.ip); |
134 | ||
135 | if (!(same->info & IPT_SAME_NODST)) | |
136 | tmpip += ntohl(t->dst.u3.ip); | |
1da177e4 LT |
137 | aindex = tmpip % same->ipnum; |
138 | ||
139 | new_ip = htonl(same->iparray[aindex]); | |
140 | ||
0d53778e PM |
141 | pr_debug("ipt_SAME: src=%u.%u.%u.%u dst=%u.%u.%u.%u, " |
142 | "new src=%u.%u.%u.%u\n", | |
143 | NIPQUAD(t->src.u3.ip), NIPQUAD(t->dst.u3.ip), NIPQUAD(new_ip)); | |
1da177e4 LT |
144 | |
145 | /* Transfer from original range. */ | |
587aa641 | 146 | newrange = ((struct nf_nat_range) |
1da177e4 LT |
147 | { same->range[0].flags, new_ip, new_ip, |
148 | /* FIXME: Use ports from correct range! */ | |
149 | same->range[0].min, same->range[0].max }); | |
150 | ||
151 | /* Hand modified range to generic setup. */ | |
587aa641 | 152 | return nf_nat_setup_info(ct, &newrange, hooknum); |
1da177e4 LT |
153 | } |
154 | ||
9f15c530 | 155 | static struct xt_target same_reg __read_mostly = { |
1da177e4 | 156 | .name = "SAME", |
6709dbbb | 157 | .family = AF_INET, |
1da177e4 | 158 | .target = same_target, |
1d5cd909 PM |
159 | .targetsize = sizeof(struct ipt_same_info), |
160 | .table = "nat", | |
161 | .hooks = (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_POST_ROUTING), | |
1da177e4 LT |
162 | .checkentry = same_check, |
163 | .destroy = same_destroy, | |
164 | .me = THIS_MODULE, | |
165 | }; | |
166 | ||
65b4b4e8 | 167 | static int __init ipt_same_init(void) |
1da177e4 | 168 | { |
6709dbbb | 169 | return xt_register_target(&same_reg); |
1da177e4 LT |
170 | } |
171 | ||
65b4b4e8 | 172 | static void __exit ipt_same_fini(void) |
1da177e4 | 173 | { |
6709dbbb | 174 | xt_unregister_target(&same_reg); |
1da177e4 LT |
175 | } |
176 | ||
65b4b4e8 AM |
177 | module_init(ipt_same_init); |
178 | module_exit(ipt_same_fini); | |
1da177e4 | 179 |