1
2
3
4
5
6
7
8
9
10#include <linux/types.h>
11#include <linux/ip.h>
12#include <linux/timer.h>
13#include <linux/module.h>
14#include <linux/netfilter.h>
15#include <linux/netdevice.h>
16#include <linux/if.h>
17#include <linux/inetdevice.h>
18#include <net/protocol.h>
19#include <net/checksum.h>
20#include <linux/netfilter_ipv4.h>
21#include <linux/netfilter/x_tables.h>
22#include <net/netfilter/nf_nat_rule.h>
23
24MODULE_LICENSE("GPL");
25MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
26MODULE_DESCRIPTION("iptables REDIRECT target module");
27
28
29static bool
30redirect_check(const char *tablename,
31 const void *e,
32 const struct xt_target *target,
33 void *targinfo,
34 unsigned int hook_mask)
35{
36 const struct nf_nat_multi_range_compat *mr = targinfo;
37
38 if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
39 pr_debug("redirect_check: bad MAP_IPS.\n");
40 return false;
41 }
42 if (mr->rangesize != 1) {
43 pr_debug("redirect_check: bad rangesize %u.\n", mr->rangesize);
44 return false;
45 }
46 return true;
47}
48
49static unsigned int
50redirect_target(struct sk_buff *skb,
51 const struct net_device *in,
52 const struct net_device *out,
53 unsigned int hooknum,
54 const struct xt_target *target,
55 const void *targinfo)
56{
57 struct nf_conn *ct;
58 enum ip_conntrack_info ctinfo;
59 __be32 newdst;
60 const struct nf_nat_multi_range_compat *mr = targinfo;
61 struct nf_nat_range newrange;
62
63 NF_CT_ASSERT(hooknum == NF_IP_PRE_ROUTING
64 || hooknum == NF_IP_LOCAL_OUT);
65
66 ct = nf_ct_get(skb, &ctinfo);
67 NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
68
69
70 if (hooknum == NF_IP_LOCAL_OUT)
71 newdst = htonl(0x7F000001);
72 else {
73 struct in_device *indev;
74 struct in_ifaddr *ifa;
75
76 newdst = 0;
77
78 rcu_read_lock();
79 indev = __in_dev_get_rcu(skb->dev);
80 if (indev && (ifa = indev->ifa_list))
81 newdst = ifa->ifa_local;
82 rcu_read_unlock();
83
84 if (!newdst)
85 return NF_DROP;
86 }
87
88
89 newrange = ((struct nf_nat_range)
90 { mr->range[0].flags | IP_NAT_RANGE_MAP_IPS,
91 newdst, newdst,
92 mr->range[0].min, mr->range[0].max });
93
94
95 return nf_nat_setup_info(ct, &newrange, hooknum);
96}
97
98static struct xt_target redirect_reg __read_mostly = {
99 .name = "REDIRECT",
100 .family = AF_INET,
101 .target = redirect_target,
102 .targetsize = sizeof(struct nf_nat_multi_range_compat),
103 .table = "nat",
104 .hooks = (1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT),
105 .checkentry = redirect_check,
106 .me = THIS_MODULE,
107};
108
109static int __init ipt_redirect_init(void)
110{
111 return xt_register_target(&redirect_reg);
112}
113
114static void __exit ipt_redirect_fini(void)
115{
116 xt_unregister_target(&redirect_reg);
117}
118
119module_init(ipt_redirect_init);
120module_exit(ipt_redirect_fini);
121