1 /* Same. Just like SNAT, only try to make the connections
2 * between client A and server B always have the same source ip.
4 * (C) 2000 Paul `Rusty' Russell
5 * (C) 2001 Martin Josefsson
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 * 010320 Martin Josefsson <gandalf@wlug.westbo.se>
12 * * copied ipt_BALANCE.c to ipt_SAME.c and changed a few things.
13 * 010728 Martin Josefsson <gandalf@wlug.westbo.se>
14 * * added --nodst to not include destination-ip in new source
16 * * added some more sanity-checks.
17 * 010729 Martin Josefsson <gandalf@wlug.westbo.se>
18 * * fixed a buggy if-statement in same_check(), should have
19 * used ntohl() but didn't.
20 * * added support for multiple ranges. IPT_SAME_MAX_RANGE is
21 * defined in linux/include/linux/netfilter_ipv4/ipt_SAME.h
22 * and is currently set to 10.
23 * * added support for 1-address range, nice to have now that
24 * we have multiple ranges.
26 #include <linux/types.h>
28 #include <linux/timer.h>
29 #include <linux/module.h>
30 #include <linux/netfilter.h>
31 #include <linux/netdevice.h>
33 #include <linux/inetdevice.h>
34 #include <net/protocol.h>
35 #include <net/checksum.h>
36 #include <linux/netfilter_ipv4.h>
37 #include <linux/netfilter/x_tables.h>
38 #ifdef CONFIG_NF_NAT_NEEDED
39 #include <net/netfilter/nf_nat_rule.h>
41 #include <linux/netfilter_ipv4/ip_nat_rule.h>
43 #include <linux/netfilter_ipv4/ipt_SAME.h>
45 MODULE_LICENSE("GPL");
46 MODULE_AUTHOR("Martin Josefsson <gandalf@wlug.westbo.se>");
47 MODULE_DESCRIPTION("iptables special SNAT module for consistent sourceip");
52 #define DEBUGP(format, args...)
56 same_check(const char *tablename
,
58 const struct xt_target
*target
,
60 unsigned int hook_mask
)
62 unsigned int count
, countess
, rangeip
, index
= 0;
63 struct ipt_same_info
*mr
= targinfo
;
67 if (mr
->rangesize
< 1) {
68 DEBUGP("same_check: need at least one dest range.\n");
71 if (mr
->rangesize
> IPT_SAME_MAX_RANGE
) {
72 DEBUGP("same_check: too many ranges specified, maximum "
77 for (count
= 0; count
< mr
->rangesize
; count
++) {
78 if (ntohl(mr
->range
[count
].min_ip
) >
79 ntohl(mr
->range
[count
].max_ip
)) {
80 DEBUGP("same_check: min_ip is larger than max_ip in "
81 "range `%u.%u.%u.%u-%u.%u.%u.%u'.\n",
82 NIPQUAD(mr
->range
[count
].min_ip
),
83 NIPQUAD(mr
->range
[count
].max_ip
));
86 if (!(mr
->range
[count
].flags
& IP_NAT_RANGE_MAP_IPS
)) {
87 DEBUGP("same_check: bad MAP_IPS.\n");
90 rangeip
= (ntohl(mr
->range
[count
].max_ip
) -
91 ntohl(mr
->range
[count
].min_ip
) + 1);
94 DEBUGP("same_check: range %u, ipnum = %u\n", count
, rangeip
);
96 DEBUGP("same_check: total ipaddresses = %u\n", mr
->ipnum
);
98 mr
->iparray
= kmalloc((sizeof(u_int32_t
) * mr
->ipnum
), GFP_KERNEL
);
100 DEBUGP("same_check: Couldn't allocate %u bytes "
101 "for %u ipaddresses!\n",
102 (sizeof(u_int32_t
) * mr
->ipnum
), mr
->ipnum
);
105 DEBUGP("same_check: Allocated %u bytes for %u ipaddresses.\n",
106 (sizeof(u_int32_t
) * mr
->ipnum
), mr
->ipnum
);
108 for (count
= 0; count
< mr
->rangesize
; count
++) {
109 for (countess
= ntohl(mr
->range
[count
].min_ip
);
110 countess
<= ntohl(mr
->range
[count
].max_ip
);
112 mr
->iparray
[index
] = countess
;
113 DEBUGP("same_check: Added ipaddress `%u.%u.%u.%u' "
115 HIPQUAD(countess
), index
);
123 same_destroy(const struct xt_target
*target
, void *targinfo
)
125 struct ipt_same_info
*mr
= targinfo
;
129 DEBUGP("same_destroy: Deallocated %u bytes for %u ipaddresses.\n",
130 (sizeof(u_int32_t
) * mr
->ipnum
), mr
->ipnum
);
134 same_target(struct sk_buff
**pskb
,
135 const struct net_device
*in
,
136 const struct net_device
*out
,
137 unsigned int hooknum
,
138 const struct xt_target
*target
,
139 const void *targinfo
)
141 struct ip_conntrack
*ct
;
142 enum ip_conntrack_info ctinfo
;
143 u_int32_t tmpip
, aindex
;
145 const struct ipt_same_info
*same
= targinfo
;
146 struct ip_nat_range newrange
;
147 const struct ip_conntrack_tuple
*t
;
149 IP_NF_ASSERT(hooknum
== NF_IP_PRE_ROUTING
||
150 hooknum
== NF_IP_POST_ROUTING
);
151 ct
= ip_conntrack_get(*pskb
, &ctinfo
);
153 t
= &ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
;
155 /* Base new source on real src ip and optionally dst ip,
156 giving some hope for consistency across reboots.
157 Here we calculate the index in same->iparray which
158 holds the ipaddress we should use */
160 #ifdef CONFIG_NF_NAT_NEEDED
161 tmpip
= ntohl(t
->src
.u3
.ip
);
163 if (!(same
->info
& IPT_SAME_NODST
))
164 tmpip
+= ntohl(t
->dst
.u3
.ip
);
166 tmpip
= ntohl(t
->src
.ip
);
168 if (!(same
->info
& IPT_SAME_NODST
))
169 tmpip
+= ntohl(t
->dst
.ip
);
171 aindex
= tmpip
% same
->ipnum
;
173 new_ip
= htonl(same
->iparray
[aindex
]);
175 DEBUGP("ipt_SAME: src=%u.%u.%u.%u dst=%u.%u.%u.%u, "
176 "new src=%u.%u.%u.%u\n",
177 NIPQUAD(t
->src
.ip
), NIPQUAD(t
->dst
.ip
),
180 /* Transfer from original range. */
181 newrange
= ((struct ip_nat_range
)
182 { same
->range
[0].flags
, new_ip
, new_ip
,
183 /* FIXME: Use ports from correct range! */
184 same
->range
[0].min
, same
->range
[0].max
});
186 /* Hand modified range to generic setup. */
187 return ip_nat_setup_info(ct
, &newrange
, hooknum
);
190 static struct xt_target same_reg
= {
193 .target
= same_target
,
194 .targetsize
= sizeof(struct ipt_same_info
),
196 .hooks
= (1 << NF_IP_PRE_ROUTING
| 1 << NF_IP_POST_ROUTING
),
197 .checkentry
= same_check
,
198 .destroy
= same_destroy
,
202 static int __init
ipt_same_init(void)
204 return xt_register_target(&same_reg
);
207 static void __exit
ipt_same_fini(void)
209 xt_unregister_target(&same_reg
);
212 module_init(ipt_same_init
);
213 module_exit(ipt_same_fini
);