Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* Same. Just like SNAT, only try to make the connections |
2 | * between client A and server B always have the same source ip. | |
3 | * | |
4 | * (C) 2000 Paul `Rusty' Russell | |
5 | * (C) 2001 Martin Josefsson | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or modify | |
8 | * it under the terms of the GNU General Public License version 2 as | |
9 | * published by the Free Software Foundation. | |
10 | * | |
11 | * 010320 Martin Josefsson <gandalf@wlug.westbo.se> | |
12 | * * copied ipt_BALANCE.c to ipt_SAME.c and changed a few things. | |
13 | * 010728 Martin Josefsson <gandalf@wlug.westbo.se> | |
14 | * * added --nodst to not include destination-ip in new source | |
15 | * calculations. | |
16 | * * added some more sanity-checks. | |
17 | * 010729 Martin Josefsson <gandalf@wlug.westbo.se> | |
18 | * * fixed a buggy if-statement in same_check(), should have | |
19 | * used ntohl() but didn't. | |
20 | * * added support for multiple ranges. IPT_SAME_MAX_RANGE is | |
21 | * defined in linux/include/linux/netfilter_ipv4/ipt_SAME.h | |
22 | * and is currently set to 10. | |
23 | * * added support for 1-address range, nice to have now that | |
24 | * we have multiple ranges. | |
25 | */ | |
26 | #include <linux/types.h> | |
27 | #include <linux/ip.h> | |
28 | #include <linux/timer.h> | |
29 | #include <linux/module.h> | |
30 | #include <linux/netfilter.h> | |
31 | #include <linux/netdevice.h> | |
32 | #include <linux/if.h> | |
33 | #include <linux/inetdevice.h> | |
34 | #include <net/protocol.h> | |
35 | #include <net/checksum.h> | |
36 | #include <linux/netfilter_ipv4.h> | |
37 | #include <linux/netfilter_ipv4/ip_nat_rule.h> | |
38 | #include <linux/netfilter_ipv4/ipt_SAME.h> | |
39 | ||
40 | MODULE_LICENSE("GPL"); | |
41 | MODULE_AUTHOR("Martin Josefsson <gandalf@wlug.westbo.se>"); | |
42 | MODULE_DESCRIPTION("iptables special SNAT module for consistent sourceip"); | |
43 | ||
44 | #if 0 | |
45 | #define DEBUGP printk | |
46 | #else | |
47 | #define DEBUGP(format, args...) | |
48 | #endif | |
49 | ||
50 | static int | |
51 | same_check(const char *tablename, | |
2e4e6a17 | 52 | const void *e, |
1da177e4 LT |
53 | void *targinfo, |
54 | unsigned int targinfosize, | |
55 | unsigned int hook_mask) | |
56 | { | |
57 | unsigned int count, countess, rangeip, index = 0; | |
58 | struct ipt_same_info *mr = targinfo; | |
59 | ||
60 | mr->ipnum = 0; | |
61 | ||
62 | if (strcmp(tablename, "nat") != 0) { | |
63 | DEBUGP("same_check: bad table `%s'.\n", tablename); | |
64 | return 0; | |
65 | } | |
66 | if (targinfosize != IPT_ALIGN(sizeof(*mr))) { | |
67 | DEBUGP("same_check: size %u.\n", targinfosize); | |
68 | return 0; | |
69 | } | |
70 | if (hook_mask & ~(1 << NF_IP_PRE_ROUTING | 1 << NF_IP_POST_ROUTING)) { | |
71 | DEBUGP("same_check: bad hooks %x.\n", hook_mask); | |
72 | return 0; | |
73 | } | |
74 | if (mr->rangesize < 1) { | |
75 | DEBUGP("same_check: need at least one dest range.\n"); | |
76 | return 0; | |
77 | } | |
78 | if (mr->rangesize > IPT_SAME_MAX_RANGE) { | |
79 | DEBUGP("same_check: too many ranges specified, maximum " | |
80 | "is %u ranges\n", | |
81 | IPT_SAME_MAX_RANGE); | |
82 | return 0; | |
83 | } | |
84 | for (count = 0; count < mr->rangesize; count++) { | |
85 | if (ntohl(mr->range[count].min_ip) > | |
86 | ntohl(mr->range[count].max_ip)) { | |
87 | DEBUGP("same_check: min_ip is larger than max_ip in " | |
88 | "range `%u.%u.%u.%u-%u.%u.%u.%u'.\n", | |
89 | NIPQUAD(mr->range[count].min_ip), | |
90 | NIPQUAD(mr->range[count].max_ip)); | |
91 | return 0; | |
92 | } | |
93 | if (!(mr->range[count].flags & IP_NAT_RANGE_MAP_IPS)) { | |
94 | DEBUGP("same_check: bad MAP_IPS.\n"); | |
95 | return 0; | |
96 | } | |
97 | rangeip = (ntohl(mr->range[count].max_ip) - | |
98 | ntohl(mr->range[count].min_ip) + 1); | |
99 | mr->ipnum += rangeip; | |
100 | ||
101 | DEBUGP("same_check: range %u, ipnum = %u\n", count, rangeip); | |
102 | } | |
103 | DEBUGP("same_check: total ipaddresses = %u\n", mr->ipnum); | |
104 | ||
105 | mr->iparray = kmalloc((sizeof(u_int32_t) * mr->ipnum), GFP_KERNEL); | |
106 | if (!mr->iparray) { | |
107 | DEBUGP("same_check: Couldn't allocate %u bytes " | |
108 | "for %u ipaddresses!\n", | |
109 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
110 | return 0; | |
111 | } | |
112 | DEBUGP("same_check: Allocated %u bytes for %u ipaddresses.\n", | |
113 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
114 | ||
115 | for (count = 0; count < mr->rangesize; count++) { | |
116 | for (countess = ntohl(mr->range[count].min_ip); | |
117 | countess <= ntohl(mr->range[count].max_ip); | |
118 | countess++) { | |
119 | mr->iparray[index] = countess; | |
120 | DEBUGP("same_check: Added ipaddress `%u.%u.%u.%u' " | |
121 | "in index %u.\n", | |
122 | HIPQUAD(countess), index); | |
123 | index++; | |
124 | } | |
125 | } | |
126 | return 1; | |
127 | } | |
128 | ||
129 | static void | |
130 | same_destroy(void *targinfo, | |
131 | unsigned int targinfosize) | |
132 | { | |
133 | struct ipt_same_info *mr = targinfo; | |
134 | ||
135 | kfree(mr->iparray); | |
136 | ||
137 | DEBUGP("same_destroy: Deallocated %u bytes for %u ipaddresses.\n", | |
138 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
139 | } | |
140 | ||
141 | static unsigned int | |
142 | same_target(struct sk_buff **pskb, | |
143 | const struct net_device *in, | |
144 | const struct net_device *out, | |
145 | unsigned int hooknum, | |
146 | const void *targinfo, | |
147 | void *userinfo) | |
148 | { | |
149 | struct ip_conntrack *ct; | |
150 | enum ip_conntrack_info ctinfo; | |
151 | u_int32_t tmpip, aindex, new_ip; | |
152 | const struct ipt_same_info *same = targinfo; | |
153 | struct ip_nat_range newrange; | |
154 | const struct ip_conntrack_tuple *t; | |
155 | ||
156 | IP_NF_ASSERT(hooknum == NF_IP_PRE_ROUTING || | |
157 | hooknum == NF_IP_POST_ROUTING); | |
158 | ct = ip_conntrack_get(*pskb, &ctinfo); | |
159 | ||
160 | t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; | |
161 | ||
162 | /* Base new source on real src ip and optionally dst ip, | |
163 | giving some hope for consistency across reboots. | |
164 | Here we calculate the index in same->iparray which | |
165 | holds the ipaddress we should use */ | |
166 | ||
167 | tmpip = ntohl(t->src.ip); | |
168 | ||
169 | if (!(same->info & IPT_SAME_NODST)) | |
170 | tmpip += ntohl(t->dst.ip); | |
171 | ||
172 | aindex = tmpip % same->ipnum; | |
173 | ||
174 | new_ip = htonl(same->iparray[aindex]); | |
175 | ||
176 | DEBUGP("ipt_SAME: src=%u.%u.%u.%u dst=%u.%u.%u.%u, " | |
177 | "new src=%u.%u.%u.%u\n", | |
178 | NIPQUAD(t->src.ip), NIPQUAD(t->dst.ip), | |
179 | NIPQUAD(new_ip)); | |
180 | ||
181 | /* Transfer from original range. */ | |
182 | newrange = ((struct ip_nat_range) | |
183 | { same->range[0].flags, new_ip, new_ip, | |
184 | /* FIXME: Use ports from correct range! */ | |
185 | same->range[0].min, same->range[0].max }); | |
186 | ||
187 | /* Hand modified range to generic setup. */ | |
188 | return ip_nat_setup_info(ct, &newrange, hooknum); | |
189 | } | |
190 | ||
191 | static struct ipt_target same_reg = { | |
192 | .name = "SAME", | |
193 | .target = same_target, | |
194 | .checkentry = same_check, | |
195 | .destroy = same_destroy, | |
196 | .me = THIS_MODULE, | |
197 | }; | |
198 | ||
199 | static int __init init(void) | |
200 | { | |
201 | return ipt_register_target(&same_reg); | |
202 | } | |
203 | ||
204 | static void __exit fini(void) | |
205 | { | |
206 | ipt_unregister_target(&same_reg); | |
207 | } | |
208 | ||
209 | module_init(init); | |
210 | module_exit(fini); | |
211 |