changed --to into --dst-to and --src-to

git-svn-id: https://map66.svn.sourceforge.net/svnroot/map66@18 3484d885-4da6-438d-b19d-107d078dd756

4 files changed, 114 insertions, 57 deletions

diff --git a/Makefile b/Makefile
index f54abf3..b7710df 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ EXTRA_CFLAGS := -DDEBUG
 endif
 
 all:	libip6t_MAP66.so
-	$(MAKE) -C $(KPATH) V=1 M=$(PWD) modules
+	$(MAKE) -C $(KPATH) M=$(PWD) modules
 
 libip6t_MAP66.so: libip6t_MAP66.o
 	gcc -shared -o $@ $<
diff --git a/ip6t_MAP66.c b/ip6t_MAP66.c
index 239378e..ffe4afa 100644
--- a/ip6t_MAP66.c
+++ b/ip6t_MAP66.c
@@ -35,17 +35,17 @@ static inline u_int16_t csum16(const u_int16_t *buf, int len)
 /* Perform checksum neutral mapping */
 static void map16(
 	struct in6_addr* addr,
-	unsigned char mask,
 	const struct in6_addr* to,
+	int len,
 	u_int16_t csum)
 {
 	csum = add16(
-		*((u_int16_t*)addr + mask),
-		add16(csum16((const u_int16_t *)addr, mask), csum)
+		*((u_int16_t*)addr + len),
+		add16(csum16((const u_int16_t *)addr, len), csum)
 	);
 	if (csum == 0xffff) csum = 0x0000;
-	*((u_int16_t *)addr + mask) = csum;
-	memcpy(addr, to, sizeof(u_int16_t) * mask);
+	*((u_int16_t *)addr + len) = csum;
+	memcpy(addr, to, sizeof(u_int16_t) * len);
 }
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
@@ -126,27 +126,23 @@ static unsigned int MAP66_tg6(
 		&hdr->saddr, &hdr->daddr);
 #endif
 
-	switch(par->hooknum) {
-		case NF_INET_PRE_ROUTING:
-			pr_devel("MAP66 PRE, check=%d\n", 0 != (IP6T_MAP66_OPT_NOCHECK & info->mapflags));
-			if (0 != (IP6T_MAP66_OPT_NOCHECK & info->mapflags) ||
-				!is_my_ipv6_addr(par->in, &hdr->daddr))
-			{
-				map16(&hdr->daddr, info->prefixlength, &info->prefix, info->prefixcsum);
-			}
-		break;
-		case NF_INET_POST_ROUTING:
-			pr_devel("MAP66 POST, check=%d\n", 0 != (IP6T_MAP66_OPT_NOCHECK & info->mapflags));
-			map16(&hdr->saddr, info->prefixlength, &info->prefix, info->prefixcsum);
-			if (0 == (IP6T_MAP66_OPT_NOCHECK & info->mapflags) &&
-				is_my_ipv6_addr(par->out, &hdr->saddr))
-			{
-				return NF_DROP;
-			}
-		break;
-		default:
-			pr_devel("MAP66: unsupported hook: %d\n", par->hooknum);
-		break;
+	if (0 != (IP6T_MAP66_OPT_DST_TO & info->mapflags)) {
+		pr_devel("MAP66 DST, check=%d\n", 0 != (IP6T_MAP66_OPT_NOCHECK & info->mapflags));
+		if (0 != (IP6T_MAP66_OPT_NOCHECK & info->mapflags) ||
+			!is_my_ipv6_addr(par->in, &hdr->daddr))
+		{
+			map16(&hdr->daddr, &info->pfix_dst_to, info->pfix_dst_len, info->pfix_dst_csum);
+		}
+	}
+	
+	if (0 != (IP6T_MAP66_OPT_SRC_TO & info->mapflags)) {
+		pr_devel("MAP66 SRC, check=%d\n", 0 != (IP6T_MAP66_OPT_NOCHECK & info->mapflags));
+		map16(&hdr->saddr, &info->pfix_src_to, info->pfix_src_len, info->pfix_src_csum);
+		if (0 == (IP6T_MAP66_OPT_NOCHECK & info->mapflags) &&
+			is_my_ipv6_addr(par->out, &hdr->saddr))
+		{
+			return NF_DROP;
+		}
 	}
 
 #if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,28)
@@ -169,8 +165,23 @@ static bool MAP66_tg6_check(
 {
 	const struct ip6t_MAP66_info *info = par->targinfo;
 
-	if (0 >= info->prefixlength || 8 <= info->prefixlength) {
-		printk("MAP66: Unsupported prefix length /%d\n", 16 * info->prefixlength);
+
+	if (0 == ((IP6T_MAP66_OPT_DST_TO | IP6T_MAP66_OPT_SRC_TO) & info->mapflags)) {
+		printk("MAP66: No " IP6T_MAP66_DST_TO " nor " IP6T_MAP66_SRC_TO "\n");
+		return false;
+	}
+
+	if (0 != (IP6T_MAP66_OPT_DST_TO & info->mapflags) &&
+	   (0 >= info->pfix_dst_len || 8 <= info->pfix_dst_len))
+	{
+		printk("MAP66: Unsupported dst-to prefix length /%d\n", 16 * info->pfix_dst_len);
+		return false;
+	}
+
+	if (0 != (IP6T_MAP66_OPT_SRC_TO & info->mapflags) &&
+	   (0 >= info->pfix_src_len || 8 <= info->pfix_src_len))
+	{
+		printk("MAP66: Unsupported src-to prefix length /%d\n", 16 * info->pfix_src_len);
 		return false;
 	}
 	return true;
diff --git a/ip6t_MAP66.h b/ip6t_MAP66.h
index 21cb833..70fd5fc 100644
--- a/ip6t_MAP66.h
+++ b/ip6t_MAP66.h
@@ -7,14 +7,21 @@
 #ifndef _IP6T_MAP66_H
 #define _IP6T_MAP66_H
 
-#define IP6T_MAP66_OPT_TO 0x01
-#define IP6T_MAP66_OPT_NOCHECK 0x02
+#define IP6T_MAP66_DST_TO "--dst-to"
+#define IP6T_MAP66_SRC_TO "--src-to"
+
+#define IP6T_MAP66_OPT_DST_TO 0x01
+#define IP6T_MAP66_OPT_SRC_TO 0x02
+#define IP6T_MAP66_OPT_NOCHECK 0x04
 
 struct ip6t_MAP66_info {
-	struct in6_addr	prefix;		/* The prefix to map to */
-	u_int16_t	prefixcsum;	/* Pre-calculated csum */
-	u_int8_t	prefixlength;	/* Prefix length DIV sizeof(u_int16_t) */
-	u_int8_t	mapflags;	/* Some flags */
+	struct in6_addr	pfix_dst_to;	/* The prefix to map destination addrs to */
+	u_int16_t	pfix_dst_len;	/* Destination addrs prefix length DIV 16 */
+	u_int16_t	pfix_dst_csum;	/* Pre-calculated csum for destination addrs */
+	struct in6_addr	pfix_src_to;	/* The prefix to map source addrs from */
+	u_int16_t	pfix_src_len;	/* Source addrs prefix length DIV 16 */
+	u_int16_t	pfix_src_csum;	/* Pre-calculated csum for source addrs */
+	u_int16_t	mapflags;	/* Some flags */
 };
 
 extern void _init(void);
diff --git a/libip6t_MAP66.c b/libip6t_MAP66.c
index 1d56d7f..a3705b6 100644
--- a/libip6t_MAP66.c
+++ b/libip6t_MAP66.c
@@ -59,16 +59,17 @@ static void MAP66_help(void)
 {
 	printf(
 "MAP66 target options\n"
-"  --to ipv6addr/prefixlength (External IPv6 address)\n"
-"  --nocheck                  (Disables check check)\n"
+"  " IP6T_MAP66_DST_TO " ipv6addr/prefixlength (Prefix to map IPv6 destination address to)\n"
+"  " IP6T_MAP66_SRC_TO " ipv6addr/prefixlength (Prefix to map IPv6 source address to)\n"
+"  --nocheck                      (Disables the do-not-map-to-my-addr check)\n"
 "\n"
 "Note: you need two ip6tables rules to map an internal network\n"
-"using ULAs to an external network with official IPv6 address.\n"
+"using ULAs to/from external network with official IPv6 address.\n"
 "\n"
 "Example:\n"
 "\n"
-"ip6tables -t mangle -I PREROUTING  -i eth0 -d 2001:0DB8:0001::/48 -j MAP66 --to FD01:0203:0405::/48\n"
-"ip6tables -t mangle -I POSTROUTING -o eth0 -s FD01:0203:0405::/48 -j MAP66 --to 2001:0DB8:0001::/48\n");
+"ip6tables -t mangle -I PREROUTING  -i eth0 -d 2001:0DB8:0001::/48 -j MAP66 " IP6T_MAP66_DST_TO " FD01:0203:0405::/48\n"
+"ip6tables -t mangle -I POSTROUTING -o eth0 -s FD01:0203:0405::/48 -j MAP66 " IP6T_MAP66_SRC_TO " 2001:0DB8:0001::/48\n");
 }
 
 static int MAP66_parse(
@@ -86,35 +87,65 @@ static int MAP66_parse(
 	switch(c) {
 		case '1':
 			if (!optarg) {
-				xtables_error(PARAMETER_PROBLEM, "--to: You must specify a value");
+				xtables_error(PARAMETER_PROBLEM, IP6T_MAP66_DST_TO ": You must specify a value");
 			}
 			if (xtables_check_inverse(optarg, &invert, NULL, 0
 #if IPTABLES_VERSION_CODE >= IPTABLES_VERSION_CMP(1,4,6)
 				,argv
 #endif
 			)) {
-				xtables_error(PARAMETER_PROBLEM, "Unexpected `!' after --to");
+				xtables_error(PARAMETER_PROBLEM, "Unexpected `!' after " IP6T_MAP66_DST_TO);
 			}
-			if (0 != (IP6T_MAP66_OPT_TO & *flags)) {
-				xtables_error(PARAMETER_PROBLEM, "Multiple --to not supported");
+			if (0 != (IP6T_MAP66_OPT_DST_TO & *flags)) {
+				xtables_error(PARAMETER_PROBLEM, "Multiple " IP6T_MAP66_DST_TO " not supported");
 			}
-			*flags |= IP6T_MAP66_OPT_TO;
+			*flags |= IP6T_MAP66_OPT_DST_TO;
 			if (NULL == (p = strchr(optarg, '/'))) {
-				xtables_error(PARAMETER_PROBLEM, "Missing '/' character in --to: \"%s\"", optarg);
+				xtables_error(PARAMETER_PROBLEM, "Missing '/' character in " IP6T_MAP66_DST_TO ": \"%s\"", optarg);
 			}
 			*p = '\0';
-			if (1 != inet_pton(AF_INET6, optarg, &info->prefix)) {
-				xtables_error(PARAMETER_PROBLEM, "Invalid IPv6 address in --to: \"%s\"", optarg);
+			if (1 != inet_pton(AF_INET6, optarg, &info->pfix_dst_to)) {
+				xtables_error(PARAMETER_PROBLEM, "Invalid IPv6 address in " IP6T_MAP66_DST_TO ": \"%s\"", optarg);
 			}
 			i = atoi(p + 1);
 			if (0 >= i || 128 <= i || 0 != i % 16) {
-				xtables_error(PARAMETER_PROBLEM, "Invalid prefix length in --to: \"%s\" (use /112, /96 .. /16)", p + 1);
+				xtables_error(PARAMETER_PROBLEM, "Invalid prefix length in " IP6T_MAP66_DST_TO ": \"%s\" (use /112, /96 .. /16)", p + 1);
 			}
-			info->prefixlength = i / 16;
-			info->prefixcsum = ~csum16((const u_int16_t *)&info->prefix, info->prefixlength);
+			info->pfix_dst_len = i / 16;
+			info->pfix_dst_csum = ~csum16((const u_int16_t *)&info->pfix_dst_to, info->pfix_dst_len);
 			return 1;
 		break;
 		case '2':
+			if (!optarg) {
+				xtables_error(PARAMETER_PROBLEM, IP6T_MAP66_SRC_TO ": You must specify a value");
+			}
+			if (xtables_check_inverse(optarg, &invert, NULL, 0
+#if IPTABLES_VERSION_CODE >= IPTABLES_VERSION_CMP(1,4,6)
+				,argv
+#endif
+			)) {
+				xtables_error(PARAMETER_PROBLEM, "Unexpected `!' after " IP6T_MAP66_SRC_TO);
+			}
+			if (0 != (IP6T_MAP66_OPT_SRC_TO & *flags)) {
+				xtables_error(PARAMETER_PROBLEM, "Multiple " IP6T_MAP66_SRC_TO " not supported");
+			}
+			*flags |= IP6T_MAP66_OPT_SRC_TO;
+			if (NULL == (p = strchr(optarg, '/'))) {
+				xtables_error(PARAMETER_PROBLEM, "Missing '/' character in " IP6T_MAP66_SRC_TO ": \"%s\"", optarg);
+			}
+			*p = '\0';
+			if (1 != inet_pton(AF_INET6, optarg, &info->pfix_src_to)) {
+				xtables_error(PARAMETER_PROBLEM, "Invalid IPv6 address in " IP6T_MAP66_SRC_TO ": \"%s\"", optarg);
+			}
+			i = atoi(p + 1);
+			if (0 >= i || 128 <= i || 0 != i % 16) {
+				xtables_error(PARAMETER_PROBLEM, "Invalid prefix length in " IP6T_MAP66_SRC_TO ": \"%s\" (use /112, /96 .. /16)", p + 1);
+			}
+			info->pfix_src_len = i / 16;
+			info->pfix_src_csum = ~csum16((const u_int16_t *)&info->pfix_src_to, info->pfix_src_len);
+			return 1;
+		break;
+		case '3':
 			if (0 != (IP6T_MAP66_OPT_NOCHECK & *flags)) {
 				xtables_error(PARAMETER_PROBLEM, "Multiple --nocheck not supported");
 			}
@@ -128,8 +159,8 @@ static int MAP66_parse(
 
 static void MAP66_check(unsigned int flags)
 {
-	if (!(flags & IP6T_MAP66_OPT_TO)) {
-		xtables_error(PARAMETER_PROBLEM, "You must specify --to");
+	if (0 == ((IP6T_MAP66_OPT_DST_TO | IP6T_MAP66_OPT_SRC_TO) & flags)) {
+		xtables_error(PARAMETER_PROBLEM, "You must specify " IP6T_MAP66_DST_TO " or " IP6T_MAP66_SRC_TO);
 	}
 }
 
@@ -139,13 +170,21 @@ static void MAP66_save(
 {
 	char s[50+1];
 	const struct ip6t_MAP66_info* info = (struct ip6t_MAP66_info*)target->data;
-	printf("--to %s/%d ", inet_ntop(AF_INET6, &info->prefix, s, sizeof(s)), 16 * info->prefixlength);
-	if (0 != (IP6T_MAP66_OPT_NOCHECK & info->mapflags)) printf("--nocheck ");
+	if (0 != (IP6T_MAP66_OPT_DST_TO & info->mapflags)) {
+		printf(IP6T_MAP66_DST_TO " %s/%d ", inet_ntop(AF_INET6, &info->pfix_dst_to, s, sizeof(s)), 16 * info->pfix_dst_len);
+	}
+	if (0 != (IP6T_MAP66_OPT_SRC_TO & info->mapflags)) {
+		printf(IP6T_MAP66_SRC_TO " %s/%d ", inet_ntop(AF_INET6, &info->pfix_src_to, s, sizeof(s)), 16 * info->pfix_src_len);
+	}
+	if (0 != (IP6T_MAP66_OPT_NOCHECK & info->mapflags)) {
+		printf("--nocheck ");
+	}
 }
 
 static struct option MAP66_opts[] = {
-	{ .name = "to",      .has_arg = 1, .flag = NULL, .val = '1' },
-	{ .name = "nocheck", .has_arg = 0, .flag = NULL, .val = '2' },
+	{ .name = "dst-to",  .has_arg = 1, .flag = NULL, .val = '1' },
+	{ .name = "src-to",  .has_arg = 1, .flag = NULL, .val = '2' },
+	{ .name = "nocheck", .has_arg = 0, .flag = NULL, .val = '3' },
 	{ .name = NULL }
 };