1*a71a9546SAutomerger Merge Worker /* ebt_nat
2*a71a9546SAutomerger Merge Worker *
3*a71a9546SAutomerger Merge Worker * Authors:
4*a71a9546SAutomerger Merge Worker * Bart De Schuymer <[email protected]>
5*a71a9546SAutomerger Merge Worker *
6*a71a9546SAutomerger Merge Worker * June, 2002
7*a71a9546SAutomerger Merge Worker */
8*a71a9546SAutomerger Merge Worker
9*a71a9546SAutomerger Merge Worker #include <stdio.h>
10*a71a9546SAutomerger Merge Worker #include <stdlib.h>
11*a71a9546SAutomerger Merge Worker #include <string.h>
12*a71a9546SAutomerger Merge Worker #include <getopt.h>
13*a71a9546SAutomerger Merge Worker #include <netinet/ether.h>
14*a71a9546SAutomerger Merge Worker #include <xtables.h>
15*a71a9546SAutomerger Merge Worker #include <linux/netfilter_bridge/ebt_nat.h>
16*a71a9546SAutomerger Merge Worker #include "iptables/nft.h"
17*a71a9546SAutomerger Merge Worker #include "iptables/nft-bridge.h"
18*a71a9546SAutomerger Merge Worker
19*a71a9546SAutomerger Merge Worker #define NAT_S '1'
20*a71a9546SAutomerger Merge Worker #define NAT_S_TARGET '2'
21*a71a9546SAutomerger Merge Worker #define NAT_S_ARP '3'
22*a71a9546SAutomerger Merge Worker static const struct option brsnat_opts[] =
23*a71a9546SAutomerger Merge Worker {
24*a71a9546SAutomerger Merge Worker { "to-source" , required_argument, 0, NAT_S },
25*a71a9546SAutomerger Merge Worker { "to-src" , required_argument, 0, NAT_S },
26*a71a9546SAutomerger Merge Worker { "snat-target" , required_argument, 0, NAT_S_TARGET },
27*a71a9546SAutomerger Merge Worker { "snat-arp" , no_argument, 0, NAT_S_ARP },
28*a71a9546SAutomerger Merge Worker { 0 }
29*a71a9546SAutomerger Merge Worker };
30*a71a9546SAutomerger Merge Worker
brsnat_print_help(void)31*a71a9546SAutomerger Merge Worker static void brsnat_print_help(void)
32*a71a9546SAutomerger Merge Worker {
33*a71a9546SAutomerger Merge Worker printf(
34*a71a9546SAutomerger Merge Worker "snat options:\n"
35*a71a9546SAutomerger Merge Worker " --to-src address : MAC address to map source to\n"
36*a71a9546SAutomerger Merge Worker " --snat-target target : ACCEPT, DROP, RETURN or CONTINUE\n"
37*a71a9546SAutomerger Merge Worker " --snat-arp : also change src address in arp msg\n");
38*a71a9546SAutomerger Merge Worker }
39*a71a9546SAutomerger Merge Worker
brsnat_init(struct xt_entry_target * target)40*a71a9546SAutomerger Merge Worker static void brsnat_init(struct xt_entry_target *target)
41*a71a9546SAutomerger Merge Worker {
42*a71a9546SAutomerger Merge Worker struct ebt_nat_info *natinfo = (struct ebt_nat_info *)target->data;
43*a71a9546SAutomerger Merge Worker
44*a71a9546SAutomerger Merge Worker natinfo->target = EBT_ACCEPT;
45*a71a9546SAutomerger Merge Worker }
46*a71a9546SAutomerger Merge Worker
47*a71a9546SAutomerger Merge Worker #define OPT_SNAT 0x01
48*a71a9546SAutomerger Merge Worker #define OPT_SNAT_TARGET 0x02
49*a71a9546SAutomerger Merge Worker #define OPT_SNAT_ARP 0x04
brsnat_parse(int c,char ** argv,int invert,unsigned int * flags,const void * entry,struct xt_entry_target ** target)50*a71a9546SAutomerger Merge Worker static int brsnat_parse(int c, char **argv, int invert, unsigned int *flags,
51*a71a9546SAutomerger Merge Worker const void *entry, struct xt_entry_target **target)
52*a71a9546SAutomerger Merge Worker {
53*a71a9546SAutomerger Merge Worker struct ebt_nat_info *natinfo = (struct ebt_nat_info *)(*target)->data;
54*a71a9546SAutomerger Merge Worker struct ether_addr *addr;
55*a71a9546SAutomerger Merge Worker
56*a71a9546SAutomerger Merge Worker switch (c) {
57*a71a9546SAutomerger Merge Worker case NAT_S:
58*a71a9546SAutomerger Merge Worker EBT_CHECK_OPTION(flags, OPT_SNAT);
59*a71a9546SAutomerger Merge Worker if (!(addr = ether_aton(optarg)))
60*a71a9546SAutomerger Merge Worker xtables_error(PARAMETER_PROBLEM, "Problem with specified --to-source mac");
61*a71a9546SAutomerger Merge Worker memcpy(natinfo->mac, addr, ETH_ALEN);
62*a71a9546SAutomerger Merge Worker break;
63*a71a9546SAutomerger Merge Worker case NAT_S_TARGET:
64*a71a9546SAutomerger Merge Worker { unsigned int tmp;
65*a71a9546SAutomerger Merge Worker EBT_CHECK_OPTION(flags, OPT_SNAT_TARGET);
66*a71a9546SAutomerger Merge Worker if (ebt_fill_target(optarg, &tmp))
67*a71a9546SAutomerger Merge Worker xtables_error(PARAMETER_PROBLEM, "Illegal --snat-target target");
68*a71a9546SAutomerger Merge Worker natinfo->target = (natinfo->target & ~EBT_VERDICT_BITS) | (tmp & EBT_VERDICT_BITS);
69*a71a9546SAutomerger Merge Worker }
70*a71a9546SAutomerger Merge Worker break;
71*a71a9546SAutomerger Merge Worker case NAT_S_ARP:
72*a71a9546SAutomerger Merge Worker EBT_CHECK_OPTION(flags, OPT_SNAT_ARP);
73*a71a9546SAutomerger Merge Worker natinfo->target ^= NAT_ARP_BIT;
74*a71a9546SAutomerger Merge Worker break;
75*a71a9546SAutomerger Merge Worker default:
76*a71a9546SAutomerger Merge Worker return 0;
77*a71a9546SAutomerger Merge Worker }
78*a71a9546SAutomerger Merge Worker return 1;
79*a71a9546SAutomerger Merge Worker }
80*a71a9546SAutomerger Merge Worker
brsnat_final_check(unsigned int flags)81*a71a9546SAutomerger Merge Worker static void brsnat_final_check(unsigned int flags)
82*a71a9546SAutomerger Merge Worker {
83*a71a9546SAutomerger Merge Worker if (!flags)
84*a71a9546SAutomerger Merge Worker xtables_error(PARAMETER_PROBLEM,
85*a71a9546SAutomerger Merge Worker "You must specify proper arguments");
86*a71a9546SAutomerger Merge Worker }
87*a71a9546SAutomerger Merge Worker
brsnat_print(const void * ip,const struct xt_entry_target * target,int numeric)88*a71a9546SAutomerger Merge Worker static void brsnat_print(const void *ip, const struct xt_entry_target *target, int numeric)
89*a71a9546SAutomerger Merge Worker {
90*a71a9546SAutomerger Merge Worker struct ebt_nat_info *natinfo = (struct ebt_nat_info *)target->data;
91*a71a9546SAutomerger Merge Worker
92*a71a9546SAutomerger Merge Worker printf("--to-src ");
93*a71a9546SAutomerger Merge Worker xtables_print_mac(natinfo->mac);
94*a71a9546SAutomerger Merge Worker if (!(natinfo->target&NAT_ARP_BIT))
95*a71a9546SAutomerger Merge Worker printf(" --snat-arp");
96*a71a9546SAutomerger Merge Worker printf(" --snat-target %s", ebt_target_name((natinfo->target|~EBT_VERDICT_BITS)));
97*a71a9546SAutomerger Merge Worker }
98*a71a9546SAutomerger Merge Worker
brsnat_verdict(int verdict)99*a71a9546SAutomerger Merge Worker static const char* brsnat_verdict(int verdict)
100*a71a9546SAutomerger Merge Worker {
101*a71a9546SAutomerger Merge Worker switch (verdict) {
102*a71a9546SAutomerger Merge Worker case EBT_ACCEPT: return "accept";
103*a71a9546SAutomerger Merge Worker case EBT_DROP: return "drop";
104*a71a9546SAutomerger Merge Worker case EBT_CONTINUE: return "continue";
105*a71a9546SAutomerger Merge Worker case EBT_RETURN: return "return";
106*a71a9546SAutomerger Merge Worker }
107*a71a9546SAutomerger Merge Worker
108*a71a9546SAutomerger Merge Worker return "";
109*a71a9546SAutomerger Merge Worker }
110*a71a9546SAutomerger Merge Worker
brsnat_xlate(struct xt_xlate * xl,const struct xt_xlate_tg_params * params)111*a71a9546SAutomerger Merge Worker static int brsnat_xlate(struct xt_xlate *xl,
112*a71a9546SAutomerger Merge Worker const struct xt_xlate_tg_params *params)
113*a71a9546SAutomerger Merge Worker {
114*a71a9546SAutomerger Merge Worker const struct ebt_nat_info *natinfo = (const void*)params->target->data;
115*a71a9546SAutomerger Merge Worker
116*a71a9546SAutomerger Merge Worker xt_xlate_add(xl, "ether saddr set %s ",
117*a71a9546SAutomerger Merge Worker ether_ntoa((struct ether_addr *)natinfo->mac));
118*a71a9546SAutomerger Merge Worker
119*a71a9546SAutomerger Merge Worker /* NAT_ARP_BIT set -> no arp mangling, not set -> arp mangling (yes, its inverted) */
120*a71a9546SAutomerger Merge Worker if (!(natinfo->target&NAT_ARP_BIT))
121*a71a9546SAutomerger Merge Worker return 0;
122*a71a9546SAutomerger Merge Worker
123*a71a9546SAutomerger Merge Worker xt_xlate_add(xl, "%s ", brsnat_verdict(natinfo->target | ~EBT_VERDICT_BITS));
124*a71a9546SAutomerger Merge Worker return 1;
125*a71a9546SAutomerger Merge Worker }
126*a71a9546SAutomerger Merge Worker
127*a71a9546SAutomerger Merge Worker static struct xtables_target brsnat_target =
128*a71a9546SAutomerger Merge Worker {
129*a71a9546SAutomerger Merge Worker .name = "snat",
130*a71a9546SAutomerger Merge Worker .version = XTABLES_VERSION,
131*a71a9546SAutomerger Merge Worker .family = NFPROTO_BRIDGE,
132*a71a9546SAutomerger Merge Worker .size = XT_ALIGN(sizeof(struct ebt_nat_info)),
133*a71a9546SAutomerger Merge Worker .userspacesize = XT_ALIGN(sizeof(struct ebt_nat_info)),
134*a71a9546SAutomerger Merge Worker .help = brsnat_print_help,
135*a71a9546SAutomerger Merge Worker .init = brsnat_init,
136*a71a9546SAutomerger Merge Worker .parse = brsnat_parse,
137*a71a9546SAutomerger Merge Worker .final_check = brsnat_final_check,
138*a71a9546SAutomerger Merge Worker .print = brsnat_print,
139*a71a9546SAutomerger Merge Worker .xlate = brsnat_xlate,
140*a71a9546SAutomerger Merge Worker .extra_opts = brsnat_opts,
141*a71a9546SAutomerger Merge Worker };
142*a71a9546SAutomerger Merge Worker
_init(void)143*a71a9546SAutomerger Merge Worker void _init(void)
144*a71a9546SAutomerger Merge Worker {
145*a71a9546SAutomerger Merge Worker xtables_register_target(&brsnat_target);
146*a71a9546SAutomerger Merge Worker }
147