diff options
| -rw-r--r-- | README.dbk | 9 | ||||
| -rw-r--r-- | ip6t_MAP66.h | 4 | ||||
| -rw-r--r-- | libip6t_MAP66.c | 33 |
3 files changed, 38 insertions, 8 deletions
@@ -304,11 +304,12 @@ ip6tables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp- <para>If you already deployed ULA adresses in your network, you may be interested in a solution that runs on my Freifunk router. The router - uses the IPv4 192.168.65.65/26 on it's LAN interface. The OLSR-based - mesh network uses an fdca:ffee:babe::/64 prefix. The following internal - mapping is configured for this: </para> + uses the IPv4 192.168.65.65/26 on it's LAN interface. WIthin the + OLSR-based mesh network, any interface uses an fdca:ffee:babe::/64 + prefix. The following internal mapping is configured for this: </para> - <programlisting></programlisting> + <programlisting>ip6tables -t mangle -I PREROUTING -i br0 -s 2002:c0a8:4141::/64 -j MAP66 --src-to fdca:ffee:babe::/64 +ip6tables -t mangle -I POSTROUTING -o br0 -d fdca:ffee:babe::/64 -j MAP66 --dst-to 2002:c0a8:4141::/64</programlisting> </section> </section> diff --git a/ip6t_MAP66.h b/ip6t_MAP66.h index 291956d..c3e124f 100644 --- a/ip6t_MAP66.h +++ b/ip6t_MAP66.h @@ -12,7 +12,8 @@ #define IP6T_MAP66_OPT_DST_TO 0x01 #define IP6T_MAP66_OPT_SRC_TO 0x02 -#define IP6T_MAP66_OPT_NOCHECK 0x04 +#define IP6T_MAP66_OPT_OFFSET 0x04 +#define IP6T_MAP66_OPT_NOCHECK 0x08 struct ip6t_MAP66_info { struct in6_addr pfix_dst_to; /* The prefix to map destination addrs to */ @@ -21,6 +22,7 @@ struct ip6t_MAP66_info { struct in6_addr pfix_src_to; /* The prefix to map source addrs from */ u_int16_t pfix_src_len; /* Source addrs prefix length DIV 16 */ u_int16_t pfix_src_csum; /* Pre-calculated csum for source addrs */ + u_int16_t mapoffset; /* Offset in addrs for balanced csum change */ u_int16_t mapflags; /* Some flags */ }; diff --git a/libip6t_MAP66.c b/libip6t_MAP66.c index a5502c3..9fab6a6 100644 --- a/libip6t_MAP66.c +++ b/libip6t_MAP66.c @@ -61,6 +61,7 @@ static void MAP66_help(void) "MAP66 target options\n" " --" IP6T_MAP66_DST_TO " ipv6addr/prefixlength (Prefix to map IPv6 destination address to)\n" " --" IP6T_MAP66_SRC_TO " ipv6addr/prefixlength (Prefix to map IPv6 source address to)\n" +" --offset number (Use another part of addrs to balance csum)\n" " --nocheck (Disables the do-not-map-to-my-addr check)\n" "\n" "Note: you need two ip6tables rules to map an internal network\n" @@ -140,14 +141,36 @@ static int MAP66_parse( xtables_error(PARAMETER_PROBLEM, "Invalid IPv6 address in --" IP6T_MAP66_SRC_TO ": \"%s\"", optarg); } i = atoi(p + 1); - if (0 >= i || 128 <= i || 0 != i % 16) { - xtables_error(PARAMETER_PROBLEM, "Invalid prefix length in --" IP6T_MAP66_SRC_TO ": \"%s\" (use /112, /96 .. /16)", p + 1); + if (0 > i || 128 <= i || 0 != i % 16) { + xtables_error(PARAMETER_PROBLEM, "Invalid prefix length in --" IP6T_MAP66_SRC_TO ": \"%s\" (use /112, /96 .. /0)", p + 1); } info->pfix_src_len = i / 16; info->pfix_src_csum = ~csum16((const u_int16_t *)&info->pfix_src_to, info->pfix_src_len); return 1; break; case '3': + if (!optarg) { + xtables_error(PARAMETER_PROBLEM, "--offset: You must specify a value"); + } + if (xtables_check_inverse(optarg, &invert, NULL, 0 +#if IPTABLES_VERSION_CODE >= IPTABLES_VERSION_CMP(1,4,6) + ,argv +#endif + )) { + xtables_error(PARAMETER_PROBLEM, "Unexpected `!' after --offset"); + } + if (0 != (IP6T_MAP66_OPT_OFFSET & *flags)) { + xtables_error(PARAMETER_PROBLEM, "Multiple --offset not supported"); + } + *flags |= IP6T_MAP66_OPT_OFFSET; + i = atoi(p + 1); + if (0 > i || 14 <= i) { + xtables_error(PARAMETER_PROBLEM, "Invalid value in --offset: \"%s\" (use 0-14)", p + 1); + } + info->mapoffset = i; + return 0; + break; + case '4': if (0 != (IP6T_MAP66_OPT_NOCHECK & *flags)) { xtables_error(PARAMETER_PROBLEM, "Multiple --nocheck not supported"); } @@ -178,6 +201,9 @@ static void MAP66_save( if (0 != (IP6T_MAP66_OPT_SRC_TO & info->mapflags)) { printf("--" IP6T_MAP66_SRC_TO " %s/%d ", inet_ntop(AF_INET6, &info->pfix_src_to, s, sizeof(s)), 16 * info->pfix_src_len); } + if (0 != info->mapoffset)) { + printf("--offset %d ", info->mapoffset); + } if (0 != (IP6T_MAP66_OPT_NOCHECK & info->mapflags)) { printf("--nocheck "); } @@ -186,7 +212,8 @@ static void MAP66_save( static struct option MAP66_opts[] = { { .name = IP6T_MAP66_DST_TO, .has_arg = 1, .flag = NULL, .val = '1' }, { .name = IP6T_MAP66_SRC_TO, .has_arg = 1, .flag = NULL, .val = '2' }, - { .name = "nocheck", .has_arg = 0, .flag = NULL, .val = '3' }, + { .name = "offset", .has_arg = 1, .flag = NULL, .val = '3' }, + { .name = "nocheck", .has_arg = 0, .flag = NULL, .val = '4' }, { .name = NULL } }; |