Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* Same. Just like SNAT, only try to make the connections |
2 | * between client A and server B always have the same source ip. | |
3 | * | |
4 | * (C) 2000 Paul `Rusty' Russell | |
5 | * (C) 2001 Martin Josefsson | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or modify | |
8 | * it under the terms of the GNU General Public License version 2 as | |
9 | * published by the Free Software Foundation. | |
10 | * | |
11 | * 010320 Martin Josefsson <gandalf@wlug.westbo.se> | |
12 | * * copied ipt_BALANCE.c to ipt_SAME.c and changed a few things. | |
13 | * 010728 Martin Josefsson <gandalf@wlug.westbo.se> | |
14 | * * added --nodst to not include destination-ip in new source | |
15 | * calculations. | |
16 | * * added some more sanity-checks. | |
17 | * 010729 Martin Josefsson <gandalf@wlug.westbo.se> | |
18 | * * fixed a buggy if-statement in same_check(), should have | |
19 | * used ntohl() but didn't. | |
20 | * * added support for multiple ranges. IPT_SAME_MAX_RANGE is | |
21 | * defined in linux/include/linux/netfilter_ipv4/ipt_SAME.h | |
22 | * and is currently set to 10. | |
23 | * * added support for 1-address range, nice to have now that | |
24 | * we have multiple ranges. | |
25 | */ | |
26 | #include <linux/types.h> | |
27 | #include <linux/ip.h> | |
28 | #include <linux/timer.h> | |
29 | #include <linux/module.h> | |
30 | #include <linux/netfilter.h> | |
31 | #include <linux/netdevice.h> | |
32 | #include <linux/if.h> | |
33 | #include <linux/inetdevice.h> | |
34 | #include <net/protocol.h> | |
35 | #include <net/checksum.h> | |
36 | #include <linux/netfilter_ipv4.h> | |
37 | #include <linux/netfilter_ipv4/ip_nat_rule.h> | |
38 | #include <linux/netfilter_ipv4/ipt_SAME.h> | |
39 | ||
40 | MODULE_LICENSE("GPL"); | |
41 | MODULE_AUTHOR("Martin Josefsson <gandalf@wlug.westbo.se>"); | |
42 | MODULE_DESCRIPTION("iptables special SNAT module for consistent sourceip"); | |
43 | ||
44 | #if 0 | |
45 | #define DEBUGP printk | |
46 | #else | |
47 | #define DEBUGP(format, args...) | |
48 | #endif | |
49 | ||
50 | static int | |
51 | same_check(const char *tablename, | |
2e4e6a17 | 52 | const void *e, |
c4986734 | 53 | const struct xt_target *target, |
1da177e4 | 54 | void *targinfo, |
1da177e4 LT |
55 | unsigned int hook_mask) |
56 | { | |
57 | unsigned int count, countess, rangeip, index = 0; | |
58 | struct ipt_same_info *mr = targinfo; | |
59 | ||
60 | mr->ipnum = 0; | |
61 | ||
1da177e4 LT |
62 | if (mr->rangesize < 1) { |
63 | DEBUGP("same_check: need at least one dest range.\n"); | |
64 | return 0; | |
65 | } | |
66 | if (mr->rangesize > IPT_SAME_MAX_RANGE) { | |
67 | DEBUGP("same_check: too many ranges specified, maximum " | |
68 | "is %u ranges\n", | |
69 | IPT_SAME_MAX_RANGE); | |
70 | return 0; | |
71 | } | |
72 | for (count = 0; count < mr->rangesize; count++) { | |
73 | if (ntohl(mr->range[count].min_ip) > | |
74 | ntohl(mr->range[count].max_ip)) { | |
75 | DEBUGP("same_check: min_ip is larger than max_ip in " | |
76 | "range `%u.%u.%u.%u-%u.%u.%u.%u'.\n", | |
77 | NIPQUAD(mr->range[count].min_ip), | |
78 | NIPQUAD(mr->range[count].max_ip)); | |
79 | return 0; | |
80 | } | |
81 | if (!(mr->range[count].flags & IP_NAT_RANGE_MAP_IPS)) { | |
82 | DEBUGP("same_check: bad MAP_IPS.\n"); | |
83 | return 0; | |
84 | } | |
85 | rangeip = (ntohl(mr->range[count].max_ip) - | |
86 | ntohl(mr->range[count].min_ip) + 1); | |
87 | mr->ipnum += rangeip; | |
88 | ||
89 | DEBUGP("same_check: range %u, ipnum = %u\n", count, rangeip); | |
90 | } | |
91 | DEBUGP("same_check: total ipaddresses = %u\n", mr->ipnum); | |
92 | ||
93 | mr->iparray = kmalloc((sizeof(u_int32_t) * mr->ipnum), GFP_KERNEL); | |
94 | if (!mr->iparray) { | |
95 | DEBUGP("same_check: Couldn't allocate %u bytes " | |
96 | "for %u ipaddresses!\n", | |
97 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
98 | return 0; | |
99 | } | |
100 | DEBUGP("same_check: Allocated %u bytes for %u ipaddresses.\n", | |
101 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
102 | ||
103 | for (count = 0; count < mr->rangesize; count++) { | |
104 | for (countess = ntohl(mr->range[count].min_ip); | |
105 | countess <= ntohl(mr->range[count].max_ip); | |
106 | countess++) { | |
107 | mr->iparray[index] = countess; | |
108 | DEBUGP("same_check: Added ipaddress `%u.%u.%u.%u' " | |
109 | "in index %u.\n", | |
110 | HIPQUAD(countess), index); | |
111 | index++; | |
112 | } | |
113 | } | |
114 | return 1; | |
115 | } | |
116 | ||
117 | static void | |
efa74165 | 118 | same_destroy(const struct xt_target *target, void *targinfo) |
1da177e4 LT |
119 | { |
120 | struct ipt_same_info *mr = targinfo; | |
121 | ||
122 | kfree(mr->iparray); | |
123 | ||
124 | DEBUGP("same_destroy: Deallocated %u bytes for %u ipaddresses.\n", | |
125 | (sizeof(u_int32_t) * mr->ipnum), mr->ipnum); | |
126 | } | |
127 | ||
128 | static unsigned int | |
129 | same_target(struct sk_buff **pskb, | |
130 | const struct net_device *in, | |
131 | const struct net_device *out, | |
132 | unsigned int hooknum, | |
c4986734 | 133 | const struct xt_target *target, |
fe1cb108 | 134 | const void *targinfo) |
1da177e4 LT |
135 | { |
136 | struct ip_conntrack *ct; | |
137 | enum ip_conntrack_info ctinfo; | |
138 | u_int32_t tmpip, aindex, new_ip; | |
139 | const struct ipt_same_info *same = targinfo; | |
140 | struct ip_nat_range newrange; | |
141 | const struct ip_conntrack_tuple *t; | |
142 | ||
143 | IP_NF_ASSERT(hooknum == NF_IP_PRE_ROUTING || | |
144 | hooknum == NF_IP_POST_ROUTING); | |
145 | ct = ip_conntrack_get(*pskb, &ctinfo); | |
146 | ||
147 | t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; | |
148 | ||
149 | /* Base new source on real src ip and optionally dst ip, | |
150 | giving some hope for consistency across reboots. | |
151 | Here we calculate the index in same->iparray which | |
152 | holds the ipaddress we should use */ | |
153 | ||
154 | tmpip = ntohl(t->src.ip); | |
155 | ||
156 | if (!(same->info & IPT_SAME_NODST)) | |
157 | tmpip += ntohl(t->dst.ip); | |
158 | ||
159 | aindex = tmpip % same->ipnum; | |
160 | ||
161 | new_ip = htonl(same->iparray[aindex]); | |
162 | ||
163 | DEBUGP("ipt_SAME: src=%u.%u.%u.%u dst=%u.%u.%u.%u, " | |
164 | "new src=%u.%u.%u.%u\n", | |
165 | NIPQUAD(t->src.ip), NIPQUAD(t->dst.ip), | |
166 | NIPQUAD(new_ip)); | |
167 | ||
168 | /* Transfer from original range. */ | |
169 | newrange = ((struct ip_nat_range) | |
170 | { same->range[0].flags, new_ip, new_ip, | |
171 | /* FIXME: Use ports from correct range! */ | |
172 | same->range[0].min, same->range[0].max }); | |
173 | ||
174 | /* Hand modified range to generic setup. */ | |
175 | return ip_nat_setup_info(ct, &newrange, hooknum); | |
176 | } | |
177 | ||
178 | static struct ipt_target same_reg = { | |
179 | .name = "SAME", | |
180 | .target = same_target, | |
1d5cd909 PM |
181 | .targetsize = sizeof(struct ipt_same_info), |
182 | .table = "nat", | |
183 | .hooks = (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_POST_ROUTING), | |
1da177e4 LT |
184 | .checkentry = same_check, |
185 | .destroy = same_destroy, | |
186 | .me = THIS_MODULE, | |
187 | }; | |
188 | ||
65b4b4e8 | 189 | static int __init ipt_same_init(void) |
1da177e4 LT |
190 | { |
191 | return ipt_register_target(&same_reg); | |
192 | } | |
193 | ||
65b4b4e8 | 194 | static void __exit ipt_same_fini(void) |
1da177e4 LT |
195 | { |
196 | ipt_unregister_target(&same_reg); | |
197 | } | |
198 | ||
65b4b4e8 AM |
199 | module_init(ipt_same_init); |
200 | module_exit(ipt_same_fini); | |
1da177e4 | 201 |