1 /* Shared library add-on to iptables to add masquerade support. */
2 #include <stdio.h>
3 #include <netdb.h>
4 #include <string.h>
5 #include <stdlib.h>
6 #include <getopt.h>
7 #include <iptables.h>
8 #include <linux/netfilter_ipv4/ip_tables.h>
9 #include <linux/netfilter_ipv4/ip_nat_rule.h>
10 #include <netinet/in.h>
11
12 /* Function which prints out usage message. */
13 static void
help(void)14 help(void)
15 {
16 printf(
17 "MASQUERADE v%s options:\n"
18 " --to-ports <port>[-<port>]\n"
19 " Port (range) to map to.\n\n",
20 IPTABLES_VERSION);
21 }
22
23 static struct option opts[] = {
24 { "to-ports", 1, 0, '1' },
25 { 0 }
26 };
27
28 /* Initialize the target. */
29 static void
init(struct ipt_entry_target * t,unsigned int * nfcache)30 init(struct ipt_entry_target *t, unsigned int *nfcache)
31 {
32 struct ip_nat_multi_range *mr = (struct ip_nat_multi_range *)t->data;
33
34 /* Actually, it's 0, but it's ignored at the moment. */
35 mr->rangesize = 1;
36
37 }
38
39 /* Parses ports */
40 static void
parse_ports(const char * arg,struct ip_nat_multi_range * mr)41 parse_ports(const char *arg, struct ip_nat_multi_range *mr)
42 {
43 const char *dash;
44 int port;
45
46 mr->range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
47
48 port = atoi(arg);
49 if (port <= 0 || port > 65535)
50 exit_error(PARAMETER_PROBLEM, "Port `%s' not valid\n", arg);
51
52 dash = strchr(arg, '-');
53 if (!dash) {
54 mr->range[0].min.tcp.port
55 = mr->range[0].max.tcp.port
56 = htons(port);
57 } else {
58 int maxport;
59
60 maxport = atoi(dash + 1);
61 if (maxport == 0 || maxport > 65535)
62 exit_error(PARAMETER_PROBLEM,
63 "Port `%s' not valid\n", dash+1);
64 if (maxport < port)
65 /* People are stupid. Present reader excepted. */
66 exit_error(PARAMETER_PROBLEM,
67 "Port range `%s' funky\n", arg);
68 mr->range[0].min.tcp.port = htons(port);
69 mr->range[0].max.tcp.port = htons(maxport);
70 }
71 }
72
73 /* Function which parses command options; returns true if it
74 ate an option */
75 static int
parse(int c,char ** argv,int invert,unsigned int * flags,const struct ipt_entry * entry,struct ipt_entry_target ** target)76 parse(int c, char **argv, int invert, unsigned int *flags,
77 const struct ipt_entry *entry,
78 struct ipt_entry_target **target)
79 {
80 int portok;
81 struct ip_nat_multi_range *mr
82 = (struct ip_nat_multi_range *)(*target)->data;
83
84 if (entry->ip.proto == IPPROTO_TCP
85 || entry->ip.proto == IPPROTO_UDP
86 || entry->ip.proto == IPPROTO_ICMP)
87 portok = 1;
88 else
89 portok = 0;
90
91 switch (c) {
92 case '1':
93 if (!portok)
94 exit_error(PARAMETER_PROBLEM,
95 "Need TCP or UDP with port specification");
96
97 if (check_inverse(optarg, &invert, NULL, 0))
98 exit_error(PARAMETER_PROBLEM,
99 "Unexpected `!' after --to-ports");
100
101 parse_ports(optarg, mr);
102 return 1;
103
104 default:
105 return 0;
106 }
107 }
108
109 /* Final check; don't care. */
final_check(unsigned int flags)110 static void final_check(unsigned int flags)
111 {
112 }
113
114 /* Prints out the targinfo. */
115 static void
print(const struct ipt_ip * ip,const struct ipt_entry_target * target,int numeric)116 print(const struct ipt_ip *ip,
117 const struct ipt_entry_target *target,
118 int numeric)
119 {
120 struct ip_nat_multi_range *mr
121 = (struct ip_nat_multi_range *)target->data;
122 struct ip_nat_range *r = &mr->range[0];
123
124 if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) {
125 printf("masq ports: ");
126 printf("%hu", ntohs(r->min.tcp.port));
127 if (r->max.tcp.port != r->min.tcp.port)
128 printf("-%hu", ntohs(r->max.tcp.port));
129 printf(" ");
130 }
131 }
132
133 /* Saves the union ipt_targinfo in parsable form to stdout. */
134 static void
save(const struct ipt_ip * ip,const struct ipt_entry_target * target)135 save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
136 {
137 struct ip_nat_multi_range *mr
138 = (struct ip_nat_multi_range *)target->data;
139 struct ip_nat_range *r = &mr->range[0];
140
141 if (r->flags & IP_NAT_RANGE_PROTO_SPECIFIED) {
142 printf("--to-ports %hu", ntohs(r->min.tcp.port));
143 if (r->max.tcp.port != r->min.tcp.port)
144 printf("-%hu", ntohs(r->max.tcp.port));
145 printf(" ");
146 }
147 }
148
149 static struct iptables_target masq = { NULL,
150 .name = "MASQUERADE",
151 .version = IPTABLES_VERSION,
152 .size = IPT_ALIGN(sizeof(struct ip_nat_multi_range)),
153 .userspacesize = IPT_ALIGN(sizeof(struct ip_nat_multi_range)),
154 .help = &help,
155 .init = &init,
156 .parse = &parse,
157 .final_check = &final_check,
158 .print = &print,
159 .save = &save,
160 .extra_opts = opts
161 };
162
ipt_MASQUERADE_init(void)163 void ipt_MASQUERADE_init(void)
164 {
165 register_target(&masq);
166 }
167