remove 'svn:keywords' property, not needed anymore after [15242]
[openwrt/svn-archive/archive.git] / target / linux / generic-2.4 / patches / 606-netfilter_NETMAP.patch
1 Index: linux-2.4.35.4/Documentation/Configure.help
2 ===================================================================
3 --- linux-2.4.35.4.orig/Documentation/Configure.help
4 +++ linux-2.4.35.4/Documentation/Configure.help
5 @@ -3086,6 +3086,17 @@ CONFIG_IP_NF_TARGET_REDIRECT
6 If you want to compile it as a module, say M here and read
7 <file:Documentation/modules.txt>. If unsure, say `N'.
8
9 +NETMAP target support
10 +CONFIG_IP_NF_TARGET_NETMAP
11 + NETMAP is an implementation of static 1:1 NAT mapping of network
12 + addresses. It maps the network address part, while keeping the
13 + host address part intact. It is similar to Fast NAT, except that
14 + Netfilter's connection tracking doesn't work well with Fast NAT.
15 +
16 + If you want to compile it as a module, say M here and read
17 + Documentation/modules.txt. The module will be called
18 + ipt_NETMAP.o. If unsure, say `N'.
19 +
20 Packet mangling
21 CONFIG_IP_NF_MANGLE
22 This option adds a `mangle' table to iptables: see the man page for
23 Index: linux-2.4.35.4/net/ipv4/netfilter/Config.in
24 ===================================================================
25 --- linux-2.4.35.4.orig/net/ipv4/netfilter/Config.in
26 +++ linux-2.4.35.4/net/ipv4/netfilter/Config.in
27 @@ -65,6 +65,7 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ];
28 define_bool CONFIG_IP_NF_NAT_NEEDED y
29 dep_tristate ' MASQUERADE target support' CONFIG_IP_NF_TARGET_MASQUERADE $CONFIG_IP_NF_NAT
30 dep_tristate ' REDIRECT target support' CONFIG_IP_NF_TARGET_REDIRECT $CONFIG_IP_NF_NAT
31 + dep_tristate ' NETMAP target support' CONFIG_IP_NF_TARGET_NETMAP $CONFIG_IP_NF_NAT
32 if [ "$CONFIG_IP_NF_PPTP" = "m" ]; then
33 define_tristate CONFIG_IP_NF_NAT_PPTP m
34 else
35 Index: linux-2.4.35.4/net/ipv4/netfilter/ipt_NETMAP.c
36 ===================================================================
37 --- /dev/null
38 +++ linux-2.4.35.4/net/ipv4/netfilter/ipt_NETMAP.c
39 @@ -0,0 +1,112 @@
40 +/* NETMAP - static NAT mapping of IP network addresses (1:1).
41 + The mapping can be applied to source (POSTROUTING),
42 + destination (PREROUTING), or both (with separate rules).
43 +
44 + Author: Svenning Soerensen <svenning@post5.tele.dk>
45 +*/
46 +
47 +#include <linux/config.h>
48 +#include <linux/ip.h>
49 +#include <linux/module.h>
50 +#include <linux/netdevice.h>
51 +#include <linux/netfilter.h>
52 +#include <linux/netfilter_ipv4.h>
53 +#include <linux/netfilter_ipv4/ip_nat_rule.h>
54 +
55 +#define MODULENAME "NETMAP"
56 +MODULE_LICENSE("GPL");
57 +MODULE_AUTHOR("Svenning Soerensen <svenning@post5.tele.dk>");
58 +MODULE_DESCRIPTION("iptables 1:1 NAT mapping of IP networks target");
59 +
60 +#if 0
61 +#define DEBUGP printk
62 +#else
63 +#define DEBUGP(format, args...)
64 +#endif
65 +
66 +static int
67 +check(const char *tablename,
68 + const struct ipt_entry *e,
69 + void *targinfo,
70 + unsigned int targinfosize,
71 + unsigned int hook_mask)
72 +{
73 + const struct ip_nat_multi_range *mr = targinfo;
74 +
75 + if (strcmp(tablename, "nat") != 0) {
76 + DEBUGP(MODULENAME":check: bad table `%s'.\n", tablename);
77 + return 0;
78 + }
79 + if (targinfosize != IPT_ALIGN(sizeof(*mr))) {
80 + DEBUGP(MODULENAME":check: size %u.\n", targinfosize);
81 + return 0;
82 + }
83 + if (hook_mask & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_POST_ROUTING))) {
84 + DEBUGP(MODULENAME":check: bad hooks %x.\n", hook_mask);
85 + return 0;
86 + }
87 + if (!(mr->range[0].flags & IP_NAT_RANGE_MAP_IPS)) {
88 + DEBUGP(MODULENAME":check: bad MAP_IPS.\n");
89 + return 0;
90 + }
91 + if (mr->rangesize != 1) {
92 + DEBUGP(MODULENAME":check: bad rangesize %u.\n", mr->rangesize);
93 + return 0;
94 + }
95 + return 1;
96 +}
97 +
98 +static unsigned int
99 +target(struct sk_buff **pskb,
100 + unsigned int hooknum,
101 + const struct net_device *in,
102 + const struct net_device *out,
103 + const void *targinfo,
104 + void *userinfo)
105 +{
106 + struct ip_conntrack *ct;
107 + enum ip_conntrack_info ctinfo;
108 + u_int32_t new_ip, netmask;
109 + const struct ip_nat_multi_range *mr = targinfo;
110 + struct ip_nat_multi_range newrange;
111 +
112 + IP_NF_ASSERT(hooknum == NF_IP_PRE_ROUTING
113 + || hooknum == NF_IP_POST_ROUTING);
114 + ct = ip_conntrack_get(*pskb, &ctinfo);
115 +
116 + netmask = ~(mr->range[0].min_ip ^ mr->range[0].max_ip);
117 +
118 + if (hooknum == NF_IP_PRE_ROUTING)
119 + new_ip = (*pskb)->nh.iph->daddr & ~netmask;
120 + else
121 + new_ip = (*pskb)->nh.iph->saddr & ~netmask;
122 + new_ip |= mr->range[0].min_ip & netmask;
123 +
124 + newrange = ((struct ip_nat_multi_range)
125 + { 1, { { mr->range[0].flags | IP_NAT_RANGE_MAP_IPS,
126 + new_ip, new_ip,
127 + mr->range[0].min, mr->range[0].max } } });
128 +
129 + /* Hand modified range to generic setup. */
130 + return ip_nat_setup_info(ct, &newrange, hooknum);
131 +}
132 +
133 +static struct ipt_target target_module = {
134 + .name = MODULENAME,
135 + .target = target,
136 + .checkentry = check,
137 + .me = THIS_MODULE
138 +};
139 +
140 +static int __init init(void)
141 +{
142 + return ipt_register_target(&target_module);
143 +}
144 +
145 +static void __exit fini(void)
146 +{
147 + ipt_unregister_target(&target_module);
148 +}
149 +
150 +module_init(init);
151 +module_exit(fini);
152 Index: linux-2.4.35.4/net/ipv4/netfilter/Makefile
153 ===================================================================
154 --- linux-2.4.35.4.orig/net/ipv4/netfilter/Makefile
155 +++ linux-2.4.35.4/net/ipv4/netfilter/Makefile
156 @@ -107,6 +107,7 @@ obj-$(CONFIG_IP_NF_TARGET_DSCP) += ipt_D
157 obj-$(CONFIG_IP_NF_TARGET_MARK) += ipt_MARK.o
158 obj-$(CONFIG_IP_NF_TARGET_MASQUERADE) += ipt_MASQUERADE.o
159 obj-$(CONFIG_IP_NF_TARGET_REDIRECT) += ipt_REDIRECT.o
160 +obj-$(CONFIG_IP_NF_TARGET_NETMAP) += ipt_NETMAP.o
161 obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
162 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
163 obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o