1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
|
/*
* MAP66: Network Address Translation IPv6-to-IPv6 as
* proposed in the IETF's second NAT66 draft document.
* (c) 2010 sven-ola()gmx.de
*/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <getopt.h>
#include <arpa/inet.h>
#define IPTABLES_VERSION_CMP(a,b,c) (((a) << 16) + ((b) << 8) + (c))
#if IPTABLES_VERSION_CODE < IPTABLES_VERSION_CMP(1,4,0)
# include <ip6tables.h>
# define xt_entry_target ip6t_entry_target
# define void_entry struct ip6t_entry
# define void_ip6 struct ip6t_ip6
# define XT_ALIGN IP6T_ALIGN
#else
# include <xtables.h>
# define void_entry void
# define void_ip6 void
#endif
#if IPTABLES_VERSION_CODE < IPTABLES_VERSION_CMP(1,4,1)
# define xtables_target ip6tables_target
# define XTABLES_VERSION IPTABLES_VERSION
# define xtables_register_target register_target6
#endif
#if IPTABLES_VERSION_CODE < IPTABLES_VERSION_CMP(1,4,3)
# define xtables_error exit_error
# define xtables_check_inverse check_inverse
# define NFPROTO_IPV6 PF_INET6
#endif
#include "ip6t_MAP66.h"
/* One's complement add */
static inline u_int16_t add16(
u_int16_t a,
u_int16_t b)
{
a += b;
return a + (a < b);
}
/* Calc one's complement csum */
static inline u_int16_t csum16(const u_int16_t *buf, int len)
{
u_int16_t csum = 0;
while(len--) csum = add16(csum, *buf++);
return csum;
}
static void MAP66_help(void)
{
printf(
"MAP66 target options\n"
" --to ipv6addr/prefixlength (External IPv6 address)\n"
" --nocheck (Disables check check)\n"
"\n"
"Note: you need two ip6tables rules to map an internal network\n"
"using ULAs to an external network with official IPv6 address.\n"
"\n"
"Example:\n"
"\n"
"ip6tables -t mangle -I PREROUTING -i eth0 -d 2001:0DB8:0001::/48 -j MAP66 --to FD01:0203:0405::/48\n"
"ip6tables -t mangle -I POSTROUTING -o eth0 -s FD01:0203:0405::/48 -j MAP66 --to 2001:0DB8:0001::/48\n");
}
static int MAP66_parse(
int c,
char **argv,
int invert,
unsigned int *flags,
const void_entry *entry,
struct xt_entry_target **target)
{
int i;
char *p;
struct ip6t_MAP66_info* info = (struct ip6t_MAP66_info*)(*target)->data;
switch(c) {
case '1':
if (!optarg) {
xtables_error(PARAMETER_PROBLEM, "--to: You must specify a value");
}
if (xtables_check_inverse(optarg, &invert, NULL, 0
#if IPTABLES_VERSION_CODE >= IPTABLES_VERSION_CMP(1,4,6)
,argv
#endif
)) {
xtables_error(PARAMETER_PROBLEM, "Unexpected `!' after --to");
}
if (0 != (IP6T_MAP66_OPT_TO & *flags)) {
xtables_error(PARAMETER_PROBLEM, "Multiple --to not supported");
}
*flags |= IP6T_MAP66_OPT_TO;
if (NULL == (p = strchr(optarg, '/'))) {
xtables_error(PARAMETER_PROBLEM, "Missing '/' character in --to: \"%s\"", optarg);
}
*p = '\0';
if (1 != inet_pton(AF_INET6, optarg, &info->prefix)) {
xtables_error(PARAMETER_PROBLEM, "Invalid IPv6 address in --to: \"%s\"", optarg);
}
i = atoi(p + 1);
if (0 >= i || 128 <= i || 0 != i % 16) {
xtables_error(PARAMETER_PROBLEM, "Invalid prefix length in --to: \"%s\" (use /112, /96 .. /16)", p + 1);
}
info->prefixlength = i / 16;
info->prefixcsum = ~csum16((const u_int16_t *)&info->prefix, info->prefixlength);
return 1;
break;
case '2':
if (0 != (IP6T_MAP66_OPT_NOCHECK & *flags)) {
xtables_error(PARAMETER_PROBLEM, "Multiple --nocheck not supported");
}
info->mapflags |= IP6T_MAP66_OPT_NOCHECK;
*flags |= IP6T_MAP66_OPT_NOCHECK;
return 1;
break;
}
return 0;
}
static void MAP66_check(unsigned int flags)
{
if (!(flags & IP6T_MAP66_OPT_TO)) {
xtables_error(PARAMETER_PROBLEM, "You must specify --to");
}
}
static void MAP66_save(
const void_ip6 *ip,
const struct xt_entry_target *target)
{
char s[50+1];
const struct ip6t_MAP66_info* info = (struct ip6t_MAP66_info*)target->data;
printf("--to %s/%d ", inet_ntop(AF_INET6, &info->prefix, s, sizeof(s)), 16 * info->prefixlength);
if (0 != (IP6T_MAP66_OPT_NOCHECK & info->mapflags)) printf("--nocheck ");
}
static struct option MAP66_opts[] = {
{ .name = "to", .has_arg = 1, .flag = NULL, .val = '1' },
{ .name = "nocheck", .has_arg = 0, .flag = NULL, .val = '2' },
{ .name = NULL }
};
static struct xtables_target MAP66_tg6_reg = {
.name = "MAP66",
.version = XTABLES_VERSION,
#if IPTABLES_VERSION_CODE >= IPTABLES_VERSION_CMP(1,4,1)
.family = NFPROTO_IPV6,
#endif
.size = XT_ALIGN(sizeof(struct ip6t_MAP66_info)),
.userspacesize = XT_ALIGN(sizeof(struct ip6t_MAP66_info)),
.help = MAP66_help,
.parse = MAP66_parse,
.final_check = MAP66_check,
.save = MAP66_save,
.extra_opts = MAP66_opts,
};
void _init(void)
{
xtables_register_target(&MAP66_tg6_reg);
}
|
