1 /* Same. Just like SNAT, only try to make the connections
2 * between client A and server B always have the same source ip.
4 * (C) 2000 Paul `Rusty' Russell
5 * (C) 2001 Martin Josefsson
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 #include <linux/types.h>
13 #include <linux/timer.h>
14 #include <linux/module.h>
15 #include <linux/netfilter.h>
16 #include <linux/netdevice.h>
18 #include <linux/inetdevice.h>
19 #include <net/protocol.h>
20 #include <net/checksum.h>
21 #include <linux/netfilter_ipv4.h>
22 #include <linux/netfilter/x_tables.h>
23 #include <net/netfilter/nf_nat_rule.h>
24 #include <linux/netfilter_ipv4/ipt_SAME.h>
26 MODULE_LICENSE("GPL");
27 MODULE_AUTHOR("Martin Josefsson <gandalf@wlug.westbo.se>");
28 MODULE_DESCRIPTION("iptables special SNAT module for consistent sourceip");
33 #define DEBUGP(format, args...)
37 same_check(const char *tablename
,
39 const struct xt_target
*target
,
41 unsigned int hook_mask
)
43 unsigned int count
, countess
, rangeip
, index
= 0;
44 struct ipt_same_info
*mr
= targinfo
;
48 if (mr
->rangesize
< 1) {
49 DEBUGP("same_check: need at least one dest range.\n");
52 if (mr
->rangesize
> IPT_SAME_MAX_RANGE
) {
53 DEBUGP("same_check: too many ranges specified, maximum "
58 for (count
= 0; count
< mr
->rangesize
; count
++) {
59 if (ntohl(mr
->range
[count
].min_ip
) >
60 ntohl(mr
->range
[count
].max_ip
)) {
61 DEBUGP("same_check: min_ip is larger than max_ip in "
62 "range `%u.%u.%u.%u-%u.%u.%u.%u'.\n",
63 NIPQUAD(mr
->range
[count
].min_ip
),
64 NIPQUAD(mr
->range
[count
].max_ip
));
67 if (!(mr
->range
[count
].flags
& IP_NAT_RANGE_MAP_IPS
)) {
68 DEBUGP("same_check: bad MAP_IPS.\n");
71 rangeip
= (ntohl(mr
->range
[count
].max_ip
) -
72 ntohl(mr
->range
[count
].min_ip
) + 1);
75 DEBUGP("same_check: range %u, ipnum = %u\n", count
, rangeip
);
77 DEBUGP("same_check: total ipaddresses = %u\n", mr
->ipnum
);
79 mr
->iparray
= kmalloc((sizeof(u_int32_t
) * mr
->ipnum
), GFP_KERNEL
);
81 DEBUGP("same_check: Couldn't allocate %u bytes "
82 "for %u ipaddresses!\n",
83 (sizeof(u_int32_t
) * mr
->ipnum
), mr
->ipnum
);
86 DEBUGP("same_check: Allocated %u bytes for %u ipaddresses.\n",
87 (sizeof(u_int32_t
) * mr
->ipnum
), mr
->ipnum
);
89 for (count
= 0; count
< mr
->rangesize
; count
++) {
90 for (countess
= ntohl(mr
->range
[count
].min_ip
);
91 countess
<= ntohl(mr
->range
[count
].max_ip
);
93 mr
->iparray
[index
] = countess
;
94 DEBUGP("same_check: Added ipaddress `%u.%u.%u.%u' "
96 HIPQUAD(countess
), index
);
104 same_destroy(const struct xt_target
*target
, void *targinfo
)
106 struct ipt_same_info
*mr
= targinfo
;
110 DEBUGP("same_destroy: Deallocated %u bytes for %u ipaddresses.\n",
111 (sizeof(u_int32_t
) * mr
->ipnum
), mr
->ipnum
);
115 same_target(struct sk_buff
**pskb
,
116 const struct net_device
*in
,
117 const struct net_device
*out
,
118 unsigned int hooknum
,
119 const struct xt_target
*target
,
120 const void *targinfo
)
123 enum ip_conntrack_info ctinfo
;
124 u_int32_t tmpip
, aindex
;
126 const struct ipt_same_info
*same
= targinfo
;
127 struct nf_nat_range newrange
;
128 const struct nf_conntrack_tuple
*t
;
130 NF_CT_ASSERT(hooknum
== NF_IP_PRE_ROUTING
||
131 hooknum
== NF_IP_POST_ROUTING
);
132 ct
= nf_ct_get(*pskb
, &ctinfo
);
134 t
= &ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
;
136 /* Base new source on real src ip and optionally dst ip,
137 giving some hope for consistency across reboots.
138 Here we calculate the index in same->iparray which
139 holds the ipaddress we should use */
141 tmpip
= ntohl(t
->src
.u3
.ip
);
143 if (!(same
->info
& IPT_SAME_NODST
))
144 tmpip
+= ntohl(t
->dst
.u3
.ip
);
145 aindex
= tmpip
% same
->ipnum
;
147 new_ip
= htonl(same
->iparray
[aindex
]);
149 DEBUGP("ipt_SAME: src=%u.%u.%u.%u dst=%u.%u.%u.%u, "
150 "new src=%u.%u.%u.%u\n",
151 NIPQUAD(t
->src
.ip
), NIPQUAD(t
->dst
.ip
),
154 /* Transfer from original range. */
155 newrange
= ((struct nf_nat_range
)
156 { same
->range
[0].flags
, new_ip
, new_ip
,
157 /* FIXME: Use ports from correct range! */
158 same
->range
[0].min
, same
->range
[0].max
});
160 /* Hand modified range to generic setup. */
161 return nf_nat_setup_info(ct
, &newrange
, hooknum
);
164 static struct xt_target same_reg
= {
167 .target
= same_target
,
168 .targetsize
= sizeof(struct ipt_same_info
),
170 .hooks
= (1 << NF_IP_PRE_ROUTING
| 1 << NF_IP_POST_ROUTING
),
171 .checkentry
= same_check
,
172 .destroy
= same_destroy
,
176 static int __init
ipt_same_init(void)
178 return xt_register_target(&same_reg
);
181 static void __exit
ipt_same_fini(void)
183 xt_unregister_target(&same_reg
);
186 module_init(ipt_same_init
);
187 module_exit(ipt_same_fini
);