Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* Same. Just like SNAT, only try to make the connections |
2 | * between client A and server B always have the same source ip. | |
3 | * | |
4 | * (C) 2000 Paul `Rusty' Russell | |
5 | * (C) 2001 Martin Josefsson | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or modify | |
8 | * it under the terms of the GNU General Public License version 2 as | |
9 | * published by the Free Software Foundation. | |
10 | * | |
11 | * 010320 Martin Josefsson <gandalf@wlug.westbo.se> | |
12 | * * copied ipt_BALANCE.c to ipt_SAME.c and changed a few things. | |
13 | * 010728 Martin Josefsson <gandalf@wlug.westbo.se> | |
14 | * * added --nodst to not include destination-ip in new source | |
15 | * calculations. | |
16 | * * added some more sanity-checks. | |
17 | * 010729 Martin Josefsson <gandalf@wlug.westbo.se> | |
18 | * * fixed a buggy if-statement in same_check(), should have | |
19 | * used ntohl() but didn't. | |
20 | * * added support for multiple ranges. IPT_SAME_MAX_RANGE is | |
21 | * defined in linux/include/linux/netfilter_ipv4/ipt_SAME.h | |
22 | * and is currently set to 10. | |
23 | * * added support for 1-address range, nice to have now that | |
24 | * we have multiple ranges. | |
25 | */ | |
26 | #include <linux/types.h> | |
27 | #include <linux/ip.h> | |
28 | #include <linux/timer.h> | |
29 | #include <linux/module.h> | |
30 | #include <linux/netfilter.h> | |
31 | #include <linux/netdevice.h> | |
32 | #include <linux/if.h> | |
33 | #include <linux/inetdevice.h> | |
34 | #include <net/protocol.h> | |
35 | #include <net/checksum.h> | |
36 | #include <linux/netfilter_ipv4.h> | |
37 | #include <linux/netfilter_ipv4/ip_nat_rule.h> | |
38 | #include <linux/netfilter_ipv4/ipt_SAME.h> | |
39 | ||
40 | MODULE_LICENSE("GPL"); | |
41 | MODULE_AUTHOR("Martin Josefsson <gandalf@wlug.westbo.se>"); | |
42 | MODULE_DESCRIPTION("iptables special SNAT module for consistent sourceip"); | |
43 | ||
44 | #if 0 | |
45 | #define DEBUGP printk | |
46 | #else | |
47 | #define DEBUGP(format, args...) | |
48 | #endif | |
49 | ||
50 | static int | |
51 | same_check(const char *tablename, | |
2e4e6a17 | 52 | const void *e, |
c4986734 | 53 | const struct xt_target *target, |
1da177e4 LT |
54 | void *targinfo, |
55 | unsigned int targinfosize, | |
56 | unsigned int hook_mask) | |
57 | { | |
58 | unsigned int count, countess, rangeip, index = 0; | |
59 | struct ipt_same_info *mr = targinfo; | |
60 | ||
61 | mr->ipnum = 0; | |
62 | ||
1da177e4 LT |
63 | if (mr->rangesize < 1) { |
64 | DEBUGP("same_check: need at least one dest range.\n"); | |
65 | return 0; | |
66 | } | |
67 | if (mr->rangesize > IPT_SAME_MAX_RANGE) { | |
68 | DEBUGP("same_check: too many ranges specified, maximum " | |
69 | "is %u ranges\n", | |
70 | IPT_SAME_MAX_RANGE); | |
71 | return 0; | |
72 | } | |
73 | for (count = 0; count < mr->rangesize; count++) { | |
74 | if (ntohl(mr->range[count].min_ip) > | |
75 | ntohl(mr->range[count].max_ip)) { | |
76 | DEBUGP("same_check: min_ip is larger than max_ip in " | |
77 | "range `%u.%u.%u.%u-%u.%u.%u.%u'.\n", | |
78 | NIPQUAD(mr->range[count].min_ip), | |
79 | NIPQUAD(mr->range[count].max_ip)); | |
80 | return 0; | |
81 | } | |
82 | if (!(mr->range[count].flags & IP_NAT_RANGE_MAP_IPS)) { | |
83 | DEBUGP("same_check: bad MAP_IPS.\n"); | |
84 | return 0; | |
85 | } | |
86 | rangeip = (ntohl(mr->range[count].max_ip) - | |
87 | ntohl(mr->range[count].min_ip) + 1); | |
88 | mr->ipnum += rangeip; | |
89 | ||
90 | DEBUGP("same_check: range %u, ipnum = %u\n", count, rangeip); | |
91 | } | |
92 | DEBUGP("same_check: total ipaddresses = %u\n", mr->ipnum); | |
93 | ||
94 | mr->iparray = kmalloc((sizeof(u_int32_t) * mr->ipnum), GFP_KERNEL); | |
95 | if (!mr->iparray) { | |
96 | DEBUGP("same_check: Couldn't allocate %u bytes " | |
97 | "for %u ipaddresses!\n", | |
98 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
99 | return 0; | |
100 | } | |
101 | DEBUGP("same_check: Allocated %u bytes for %u ipaddresses.\n", | |
102 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
103 | ||
104 | for (count = 0; count < mr->rangesize; count++) { | |
105 | for (countess = ntohl(mr->range[count].min_ip); | |
106 | countess <= ntohl(mr->range[count].max_ip); | |
107 | countess++) { | |
108 | mr->iparray[index] = countess; | |
109 | DEBUGP("same_check: Added ipaddress `%u.%u.%u.%u' " | |
110 | "in index %u.\n", | |
111 | HIPQUAD(countess), index); | |
112 | index++; | |
113 | } | |
114 | } | |
115 | return 1; | |
116 | } | |
117 | ||
118 | static void | |
c4986734 | 119 | same_destroy(const struct xt_target *target, void *targinfo, |
1da177e4 LT |
120 | unsigned int targinfosize) |
121 | { | |
122 | struct ipt_same_info *mr = targinfo; | |
123 | ||
124 | kfree(mr->iparray); | |
125 | ||
126 | DEBUGP("same_destroy: Deallocated %u bytes for %u ipaddresses.\n", | |
127 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
128 | } | |
129 | ||
130 | static unsigned int | |
131 | same_target(struct sk_buff **pskb, | |
132 | const struct net_device *in, | |
133 | const struct net_device *out, | |
134 | unsigned int hooknum, | |
c4986734 | 135 | const struct xt_target *target, |
1da177e4 LT |
136 | const void *targinfo, |
137 | void *userinfo) | |
138 | { | |
139 | struct ip_conntrack *ct; | |
140 | enum ip_conntrack_info ctinfo; | |
141 | u_int32_t tmpip, aindex, new_ip; | |
142 | const struct ipt_same_info *same = targinfo; | |
143 | struct ip_nat_range newrange; | |
144 | const struct ip_conntrack_tuple *t; | |
145 | ||
146 | IP_NF_ASSERT(hooknum == NF_IP_PRE_ROUTING || | |
147 | hooknum == NF_IP_POST_ROUTING); | |
148 | ct = ip_conntrack_get(*pskb, &ctinfo); | |
149 | ||
150 | t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; | |
151 | ||
152 | /* Base new source on real src ip and optionally dst ip, | |
153 | giving some hope for consistency across reboots. | |
154 | Here we calculate the index in same->iparray which | |
155 | holds the ipaddress we should use */ | |
156 | ||
157 | tmpip = ntohl(t->src.ip); | |
158 | ||
159 | if (!(same->info & IPT_SAME_NODST)) | |
160 | tmpip += ntohl(t->dst.ip); | |
161 | ||
162 | aindex = tmpip % same->ipnum; | |
163 | ||
164 | new_ip = htonl(same->iparray[aindex]); | |
165 | ||
166 | DEBUGP("ipt_SAME: src=%u.%u.%u.%u dst=%u.%u.%u.%u, " | |
167 | "new src=%u.%u.%u.%u\n", | |
168 | NIPQUAD(t->src.ip), NIPQUAD(t->dst.ip), | |
169 | NIPQUAD(new_ip)); | |
170 | ||
171 | /* Transfer from original range. */ | |
172 | newrange = ((struct ip_nat_range) | |
173 | { same->range[0].flags, new_ip, new_ip, | |
174 | /* FIXME: Use ports from correct range! */ | |
175 | same->range[0].min, same->range[0].max }); | |
176 | ||
177 | /* Hand modified range to generic setup. */ | |
178 | return ip_nat_setup_info(ct, &newrange, hooknum); | |
179 | } | |
180 | ||
181 | static struct ipt_target same_reg = { | |
182 | .name = "SAME", | |
183 | .target = same_target, | |
1d5cd909 PM |
184 | .targetsize = sizeof(struct ipt_same_info), |
185 | .table = "nat", | |
186 | .hooks = (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_POST_ROUTING), | |
1da177e4 LT |
187 | .checkentry = same_check, |
188 | .destroy = same_destroy, | |
189 | .me = THIS_MODULE, | |
190 | }; | |
191 | ||
65b4b4e8 | 192 | static int __init ipt_same_init(void) |
1da177e4 LT |
193 | { |
194 | return ipt_register_target(&same_reg); | |
195 | } | |
196 | ||
65b4b4e8 | 197 | static void __exit ipt_same_fini(void) |
1da177e4 LT |
198 | { |
199 | ipt_unregister_target(&same_reg); | |
200 | } | |
201 | ||
65b4b4e8 AM |
202 | module_init(ipt_same_init); |
203 | module_exit(ipt_same_fini); | |
1da177e4 | 204 |