Chinaunix首页 | 论坛 | 博客

瀚海书香forever.blog.chinaunix.net

首页　| 　博文目录　| 　关于我

瀚海书香

  • 博客访问： 3942933
  • 博文数量： 93
  • 博客积分： 3189
  • 博客等级： 中校
  • 技术积分： 4229
  • 用 户 组： 普通用户
  • 注册时间： 2009-02-02 13:29
个人简介

出没于杭州和青岛的程序猿一枚，对内核略懂一二

文章分类

全部博文（93）

文章存档

2016年（2）

2015年（3）

2014年（11）

2013年（29）

2012年（16）

2011年（5）

2010年（5）

2009年（22）

我的朋友
最近访客
推荐博文
相关博文
网段地址转换 —— NETSNAT NETDNAT target源码

分类： LINUX

2011-02-27 08:06:15

netfilter的target有一个SNAT实现源地址转换，但是无法实现网段的地址转换，于是就写了一个NETSNAT实现网段的地址转换。
比如:192.168.3.0/24-->192.168.2.0/24  ,当然了，有些时候也是需要进来的时候做转换的，所以就又写了一些NETDNAT的target。
 iptables的规则编写：
iptables -t nat -A POSTROUTING -s 192.168.3.0/24 -j NETSNAT --netsnat 192.168.3.0/24-192.168.2.0/24
相反的，如果希望外网访问192.168.2.0/24的时候，转到192.168.3.0/24，则使用如下的规则：
iptables -t nat -A PREROUTING -d 192.168.2.0/24 -j NETDNAT --netdnat 192.168.2.0/24-192.168.3.0/24
欢迎大家测试提出宝贵意见。
下面是代码：
ipt_NETSNAT.h
  1. #ifndef _IPT_NETSNAT_H_target
  2. #define _IPT_NETSNAT_H_target
  3. struct ipt_NETSNAT_info{
  4.  char netsnat[41];
  5.  unsigned int excursion;
  6.  int flag;//flag=1 means destnet is big than sourcenet;

  8.     //flag=0 means destnet is small than sourcenet.

  10. };
  11. #endif
ipt_NETSNAT.c
  1. /* Netfilter Target NETSNAT
  2.  *
  3.  * (C) 2011 by liutingwei
  4.  * 2011-02-24 09:34:25
  5.  *
  6.  * This software is released under the terms of GNU GPL
  7.  *
  8.  */
  9. #include <linux/module.h>
  10. #include <linux/skbuff.h>
  11. #include <linux/ip.h>
  12. #include <linux/inet.h>
  13. #include <linux/netfilter_ipv4/ip_tables.h>
  14. #include <linux/types.h>
  15. #include <linux/if.h>
  16. #include <linux/inetdevice.h>
  17. #include <net/protocol.h>
  18. #include <net/checksum.h>
  19. #include <linux/netfilter_ipv4.h>
  20. #include <net/netfilter/nf_nat_rule.h>
  21. #include <net/netfilter/nf_nat_core.h>
  22. #include "ipt_NETSNAT.h"
  23. MODULE_LICENSE("GPL");
  24. MODULE_AUTHOR("LTW ");
  25. MODULE_DESCRIPTION("iptables net snat");
  26. static bool
  27. redirect_check(const char *tablename,
  28.         const void *e,
  29.         const struct xt_target *target,
  30.         void *targinfo,
  31.         unsigned int hook_mask)
  32. {
  33.  return true;
  34. }
  35. static unsigned int
  36. netsnat_target(struct sk_buff *skb,
  37.   const struct net_device *in,
  38.   const struct net_device *out,
  39.   unsigned int hooknum,
  40.   const struct xt_target *target,
  41.   const void *targinfo)
  42. {
  43.  struct nf_conn *ct;
  44.  struct nf_conn_nat *nat;
  45.  enum ip_conntrack_info ctinfo;
  46.  struct nf_nat_range newrange;
  47.  const struct ipt_NETSNAT_info *info=targinfo;
  48.  struct iphdr *iph;
  49.  __be32 sourceip;
  50.  __be32 newsrc;
  51.  iph=ip_hdr(skb);
  52.  sourceip=ntohl(iph->saddr);
  53.  NF_CT_ASSERT(hooknum == NF_IP_POST_ROUTING);
  54.  ct = nf_ct_get(skb, &ctinfo);
  55.  nat = nfct_nat(ct);
  56.  NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
  57.        || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
  58.  /* Source address is 0.0.0.0 - locally generated packet that is
  59.   * probably not supposed to be masqueraded.
  60.   */
  61.  if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip == 0)
  62.   return NF_ACCEPT;
  63.  if(info->flag==1)
  64.   newsrc=htonl(sourceip+info->excursion);
  65.  else if(info->flag==0)
  66.   newsrc=htonl(sourceip-info->excursion);
  67.  else
  68.   return NF_ACCEPT;
  69.  /* Transfer from original range. */
  70.  memset(&newrange,0,sizeof(newrange));
  71.  newrange.flags|=IP_NAT_RANGE_MAP_IPS;
  72.  newrange.min_ip=newrange.max_ip=newsrc;
  73.  /* Hand modified range to generic setup. */
  74.  return nf_nat_setup_info(ct, &newrange, hooknum);
  75. }
  76. static struct xt_target netsnat_reg __read_mostly = {
  77.  .name = "NETSNAT",
  78.  .family = AF_INET,
  79.  .target = netsnat_target,
  80.  .targetsize = sizeof(struct ipt_NETSNAT_info),
  81.  .table = "nat",
  82.  .hooks = (1 << NF_IP_POST_ROUTING),
  83.  .checkentry = redirect_check,
  84.  .me = THIS_MODULE,
  85. };
  86. static int __init ipt_multisnat_init(void)
  87. {
  88.  return xt_register_target(&netsnat_reg);
  89. }
  90. static void __exit ipt_multisnat_fini(void)
  91. {
  92.  xt_unregister_target(&netsnat_reg);
  93. }
  94. module_init(ipt_multisnat_init);
  95. module_exit(ipt_multisnat_fini);
libipt_netsnat.c
  1. /* Shared library add-on to iptables to add NETSNAT support.
  2.  *
  3.  * (C) 2011 by liutingwei
  4.  * 2011-02-24 10:20:25
  5.  *
  6.  * This software is released under the terms of GNU GPL
  7.  *
  8.  */
  9. #include <stdio.h>
  10. #include <netdb.h>
  11. #include <string.h>
  12. #include <stdlib.h>
  13. #include <syslog.h>
  14. #include <getopt.h>
  15. #include <iptables.h>
  16. #include <linux/netfilter_ipv4/ip_tables.h>
  17. #include <linux/netfilter/x_tables.h>
  18. #include "ipt_NETSNAT.h"
  19. #define IPTABLES_VERSION "1.4.0"
  20. enum{
  21.  NETSNAT =1<<0,
  22. };
  23. static void NETSNAT_check(unsigned int flags)
  24. {
  25.  if((flags&NETSNAT)==0)
  26.   //== priority is higher than &

  28.   exit_error(PARAMETER_PROBLEM,"NETSNAT target: You must specify --netsnat");
  29. }
  30. /* Function which prints out usage message. */
  31. static void NETSNAT_help(void)
  32. {
  33.  printf("NETSNAT[LTW] v%s options:\n"
  34.       "--netsnat source-dest\n"
  35.    "\n"
  36.    ,IPTABLES_VERSION);
  37. }
  38. static const struct option NETSNAT_opts[] = {
  39.  {"netsnat", 1, NULL, '1'},
  40.  {NULL,0,NULL,0}
  41. };
  42. /* Function which parses command options; returns true if it
  43.    ate an option */
  44. static int NETSNAT_parse(int c, char **argv, int invert, unsigned int *flags,
  45.                       const void *entry, struct xt_entry_target **target)
  46. {
  47.  char *temp,*tempnet,*p,*n;
  48.  unsigned int sourceip;
  49.  unsigned int destip;
  50.  int mask1,mask2;
  51.  struct ipt_NETSNAT_info *info = (struct ipt_NETSNAT_info *) (*target)->data;
  52.  switch (c) {
  53.   case '1':
  54.    if (*flags&NETSNAT)
  55.     exit_error(PARAMETER_PROBLEM,
  56.       "Can't specify --netsnat twice");
  57.    *flags|=NETSNAT;
  58.    if(strlen(optarg)>37)
  59.     exit_error(PARAMETER_PROBLEM,
  60.       "\"%s\" is not a valid netsnat");
  61.    memcpy(info->netsnat,optarg,strlen(optarg));
  62.    temp=strdup(optarg);
  63.    tempnet=temp;
  64.    n=strchr(tempnet,'-');
  65.    if(n==NULL||(n+1)==NULL)
  66.     exit_error(PARAMETER_PROBLEM,"\"%s\" is not a valid netsnat");
  67.    *n++=0;
  68.    p=strchr(tempnet,'/');
  69.    if(p==NULL||(p+1)==NULL)
  70.     exit_error(PARAMETER_PROBLEM,"\"%s\" is not a valid netsnat");
  71.    *p++=0;
  72.    mask1=atoi(p);
  73.    sourceip=inet_network(tempnet);
  74.    tempnet=n;
  75.    p=strchr(tempnet,'/');
  76.    if(p==NULL||(p+1)==NULL)
  77.     exit_error(PARAMETER_PROBLEM,"\"%s\" is not a valid netsnat");
  78.    *p++=0;
  79.    mask2=atoi(p);
  80.    destip=inet_network(tempnet);
  81.    if(mask1!=mask2)
  82.     exit_error(PARAMETER_PROBLEM,
  83.       "Source and Dest net mask not equeal");
  84.    if(mask1<0||mask1>32)
  85.     exit_error(PARAMETER_PROBLEM,
  86.       "Source and Dest net mask not valid (0-32)");
  87.    if(sourceip==(unsigned int)(-1) || destip==(unsigned int)(-1))
  88.     exit_error(PARAMETER_PROBLEM,
  89.       "Source or Dest ip not valid");
  90.    mask2=32-mask1;
  91.    sourceip=sourceip&~((1<<mask2)-1);
  92.    destip=destip&~((1<<mask2)-1);
  93.    if(sourceip<destip){
  94.     info->flag=1;
  95.     info->excursion=destip-sourceip;
  96.    }else{
  97.     info->flag=0;
  98.     info->excursion=sourceip-destip;
  99.    }
  100.    free(temp);
  101.    break;
  102.   default:
  103.    return 0;
  104.  }
  105.  return 1;
  106. }
  107. /* Saves the union ipt_targinfo in parsable form to stdout. */
  108. static void NETSNAT_save(const void *ip, const struct xt_entry_target *target)
  109. {
  110.  return;
  111. }
  112. static void NETSNAT_init(struct xt_entry_target *t)
  113. {
  114.  struct ipt_NETSNAT_info *info = (struct ipt_NETSNAT_info *) t->data;
  115.  info->flag=-1;
  116.  memset(info->netsnat,0,41);
  117.  return;
  118. }
  119. /* Prints out the targinfo. */
  120. static void NETSNAT_print(const void *ip, const struct xt_entry_target *target,
  121.                        int numeric)
  122. {
  123.  const struct ipt_NETSNAT_info *info
  124.      = (const struct ipt_NETSNAT_info *) target->data;
  125.  printf(" NETSNAT %s ", info->netsnat);
  126. }
  127. static struct iptables_target NETSNAT_target = {
  128.  .name = "NETSNAT",
  129.  .version = IPTABLES_VERSION,
  130.  .size = IPT_ALIGN(sizeof(struct ipt_NETSNAT_info)),
  131.  .userspacesize = IPT_ALIGN(sizeof(struct ipt_NETSNAT_info)),
  132.  .help = NETSNAT_help,
  133.  .parse = NETSNAT_parse,
  134.  .init = NETSNAT_init,
  135.  .final_check= NETSNAT_check,
  136.  .print = NETSNAT_print,
  137.  .save = NETSNAT_save,
  138.  .extra_opts =NETSNAT_opts,
  139. };
  140. void _init(void)
  141. {
  142.  register_target(&NETSNAT_target);
  143. }
ipt_netdnat.h
  1. #ifndef _IPT_NETDNAT_H_target
  2. #define _IPT_NETDNAT_H_target
  3. struct ipt_NETDNAT_info{
  4.  char netdnat[41];
  5.  unsigned int excursion;
  6.  int flag;//flag=1 means destnet is big than sourcenet;

  8.     //flag=0 means destnet is small than sourcenet.

  10. };
  11. #endif
ipt_netdnat.c
  1. /* Netfilter NETDNAT Target
  2.  *
  3.  * (C) 2011 by liutingwei
  4.  * 2011-02-24 11:02:47
  5.  *
  6.  * This software is released under the terms of GNU GPL
  7.  *
  8.  */
  9. #include <linux/module.h>
  10. #include <linux/skbuff.h>
  11. #include <linux/ip.h>
  12. #include <linux/inet.h>
  13. #include <linux/netfilter_ipv4/ip_tables.h>
  14. #include <linux/types.h>
  15. #include <linux/if.h>
  16. #include <linux/inetdevice.h>
  17. #include <net/protocol.h>
  18. #include <net/checksum.h>
  19. #include <linux/netfilter_ipv4.h>
  20. #include <net/netfilter/nf_nat_rule.h>
  21. #include <net/netfilter/nf_nat_core.h>
  22. #include "ipt_NETDNAT.h"
  23. MODULE_LICENSE("GPL");
  24. MODULE_AUTHOR("LTW ");
  25. MODULE_DESCRIPTION("iptables net snat");
  26. static bool
  27. redirect_check(const char *tablename,
  28.         const void *e,
  29.         const struct xt_target *target,
  30.         void *targinfo,
  31.         unsigned int hook_mask)
  32. {
  33.  return true;
  34. }
  35. static unsigned int
  36. netdnat_target(struct sk_buff *skb,
  37.   const struct net_device *in,
  38.   const struct net_device *out,
  39.   unsigned int hooknum,
  40.   const struct xt_target *target,
  41.   const void *targinfo)
  42. {
  43.  struct nf_conn *ct;
  44.  struct nf_conn_nat *nat;
  45.  enum ip_conntrack_info ctinfo;
  46.  struct nf_nat_range newrange;
  47.  const struct ipt_NETDNAT_info *info=targinfo;
  48.  struct iphdr *iph;
  49.  __be32 destip;
  50.  __be32 newdest;
  51.  iph=ip_hdr(skb);
  52.  destip=ntohl(iph->daddr);
  53.  NF_CT_ASSERT(hooknum == NF_IP_PRE_ROUTING);
  54.  ct = nf_ct_get(skb, &ctinfo);
  55.  nat = nfct_nat(ct);
  56.  NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
  57.  if(info->flag==1)
  58.   newdest=htonl(destip+info->excursion);
  59.  else if(info->flag==0)
  60.   newdest=htonl(destip-info->excursion);
  61.  else
  62.   return NF_ACCEPT;
  63.  /* Transfer from original range. */
  64.  memset(&newrange,0,sizeof(newrange));
  65.  newrange.flags|=IP_NAT_RANGE_MAP_IPS;
  66.  newrange.min_ip=newrange.max_ip=newdest;
  67.  /* Hand modified range to generic setup. */
  68.  return nf_nat_setup_info(ct, &newrange, hooknum);
  69. }
  70. static struct xt_target netdnat_reg __read_mostly = {
  71.  .name = "NETDNAT",
  72.  .family = AF_INET,
  73.  .target = netdnat_target,
  74.  .targetsize = sizeof(struct ipt_NETDNAT_info),
  75.  .table = "nat",
  76.  .hooks = (1 << NF_IP_PRE_ROUTING),
  77.  .checkentry = redirect_check,
  78.  .me = THIS_MODULE,
  79. };
  80. static int __init ipt_multisnat_init(void)
  81. {
  82.  return xt_register_target(&netdnat_reg);
  83. }
  84. static void __exit ipt_multisnat_fini(void)
  85. {
  86.  xt_unregister_target(&netdnat_reg);
  87. }
  88. module_init(ipt_multisnat_init);
  89. module_exit(ipt_multisnat_fini);
libipt_netdnat.c
  1. /* Shared library add-on to iptables to add NETDNAT support.
  2.  *
  3.  * (C) 2011 by liutingwei
  4.  * 2011-02-24 11:28:08
  5.  *
  6.  * This software is released under the terms of GNU GPL
  7.  *
  8.  */
  9. #include <stdio.h>
  10. #include <netdb.h>
  11. #include <string.h>
  12. #include <stdlib.h>
  13. #include <syslog.h>
  14. #include <getopt.h>
  15. #include <iptables.h>
  16. #include <linux/netfilter_ipv4/ip_tables.h>
  17. #include <linux/netfilter/x_tables.h>
  18. #include "ipt_NETDNAT.h"
  19. #define IPTABLES_VERSION "1.4.0"
  20. enum{
  21.  NETDNAT =1<<0,
  22. };
  23. static void NETDNAT_check(unsigned int flags)
  24. {
  25.  if((flags&NETDNAT)==0)
  26.   //== priority is higher than &

  28.   exit_error(PARAMETER_PROBLEM,"NETDNAT target: You must specify --netdnat");
  29. }
  30. /* Function which prints out usage message. */
  31. static void NETDNAT_help(void)
  32. {
  33.  printf("NETDNAT[LTW] v%s options:\n"
  34.       "--netdnat source-dest\n"
  35.    "\n"
  36.    ,IPTABLES_VERSION);
  37. }
  38. static const struct option NETDNAT_opts[] = {
  39.  {"netdnat", 1, NULL, '1'},
  40.  {NULL,0,NULL,0}
  41. };
  42. /* Function which parses command options; returns true if it
  43.    ate an option */
  44. static int NETDNAT_parse(int c, char **argv, int invert, unsigned int *flags,
  45.                       const void *entry, struct xt_entry_target **target)
  46. {
  47.  char *temp,*tempnet,*p,*n;
  48.  unsigned int sourceip;
  49.  unsigned int destip;
  50.  int mask1,mask2;
  51.  struct ipt_NETDNAT_info *info = (struct ipt_NETDNAT_info *) (*target)->data;
  52.  switch (c) {
  53.   case '1':
  54.    if (*flags&NETDNAT)
  55.     exit_error(PARAMETER_PROBLEM,
  56.       "Can't specify --netdnat twice");
  57.    *flags|=NETDNAT;
  58.    if(strlen(optarg)>37)
  59.     exit_error(PARAMETER_PROBLEM,
  60.       "\"%s\" is not a valid netdnat");
  61.    memcpy(info->netdnat,optarg,strlen(optarg));
  62.    temp=strdup(optarg);
  63.    tempnet=temp;
  64.    n=strchr(tempnet,'-');
  65.    if(n==NULL||(n+1)==NULL)
  66.     exit_error(PARAMETER_PROBLEM,"\"%s\" is not a valid netdnat");
  67.    *n++=0;
  68.    p=strchr(tempnet,'/');
  69.    if(p==NULL||(p+1)==NULL)
  70.     exit_error(PARAMETER_PROBLEM,"\"%s\" is not a valid netdnat");
  71.    *p++=0;
  72.    mask1=atoi(p);
  73.    sourceip=inet_network(tempnet);
  74.    tempnet=n;
  75.    p=strchr(tempnet,'/');
  76.    if(p==NULL||(p+1)==NULL)
  77.     exit_error(PARAMETER_PROBLEM,"\"%s\" is not a valid netdnat");
  78.    *p++=0;
  79.    mask2=atoi(p);
  80.    destip=inet_network(tempnet);
  81.    if(mask1!=mask2)
  82.     exit_error(PARAMETER_PROBLEM,
  83.       "Source and Dest net mask not equeal");
  84.    if(mask1<0||mask1>32)
  85.     exit_error(PARAMETER_PROBLEM,
  86.       "Source and Dest net mask not valid (0-32)");
  87.    if(sourceip==(unsigned int)(-1) || destip==(unsigned int)(-1))
  88.     exit_error(PARAMETER_PROBLEM,
  89.       "Source or Dest ip not valid");
  90.    mask2=32-mask1;
  91.    sourceip=sourceip&~((1<<mask2)-1);
  92.    destip=destip&~((1<<mask2)-1);
  93.    if(sourceip<destip){
  94.     info->flag=1;
  95.     info->excursion=destip-sourceip;
  96.    }else{
  97.     info->flag=0;
  98.     info->excursion=sourceip-destip;
  99.    }
  100.    free(temp);
  101.    break;
  102.   default:
  103.    return 0;
  104.  }
  105.  return 1;
  106. }
  107. /* Saves the union ipt_targinfo in parsable form to stdout. */
  108. static void NETDNAT_save(const void *ip, const struct xt_entry_target *target)
  109. {
  110.  return;
  111. }
  112. static void NETDNAT_init(struct xt_entry_target *t)
  113. {
  114.  struct ipt_NETDNAT_info *info = (struct ipt_NETDNAT_info *) t->data;
  115.  info->flag=-1;
  116.  memset(info->netdnat,0,41);
  117.  return;
  118. }
  119. /* Prints out the targinfo. */
  120. static void NETDNAT_print(const void *ip, const struct xt_entry_target *target,
  121.                        int numeric)
  122. {
  123.  const struct ipt_NETDNAT_info *info
  124.      = (const struct ipt_NETDNAT_info *) target->data;
  125.  printf(" NETDNAT %s ", info->netdnat);
  126. }
  127. static struct iptables_target NETDNAT_target = {
  128.  .name = "NETDNAT",
  129.  .version = IPTABLES_VERSION,
  130.  .size = IPT_ALIGN(sizeof(struct ipt_NETDNAT_info)),
  131.  .userspacesize = IPT_ALIGN(sizeof(struct ipt_NETDNAT_info)),
  132.  .help = NETDNAT_help,
  133.  .parse = NETDNAT_parse,
  134.  .init = NETDNAT_init,
  135.  .final_check= NETDNAT_check,
  136.  .print = NETDNAT_print,
  137.  .save = NETDNAT_save,
  138.  .extra_opts =NETDNAT_opts,
  139. };
  140. void _init(void)
  141. {
  142.  register_target(&NETDNAT_target);
  143. }
阅读(102915) | 评论(9) | 转发(2) |
1

上一篇：内核调试方法之串口输出

下一篇：libnids tcp重组分析

给主人留下些什么吧！~~

lujian198619862011-11-03 08:54:06

瀚海书香: MASQUERAED是无法实现网段地址转换的。
比如将192.168.0.0/24按一一对应的关系转换成172.16.5.0/24

192.168.0.1-->172.16.5.1
192.168.0.86-->172.16.5......
不太明白：iptables的规则编写：
iptables -t nat -A POSTROUTING -s 192.168.3.0/24 -j NETSNAT --netsnat 192.168.2.0/24（：（原来为什么是192.168.2.0/24-192.168.3.0/24）

回复 | 举报

lujian198619862011-11-03 08:45:09

哦，这样也是。有个方法可以，用bingding wan的方式。

回复 | 举报

瀚海书香2011-11-03 08:19:26

lujian19861986: 我看路由器内网出去的包在POSTROUING用 MASQUERADE，进来的时候用DNAT（内网架设服务器的时候 DMZ host等）就可以了.....
MASQUERAED是无法实现网段地址转换的。
比如将192.168.0.0/24按一一对应的关系转换成172.16.5.0/24

192.168.0.1-->172.16.5.1
192.168.0.86-->172.16.5.86
....

回复 | 举报

lujian198619862011-11-02 09:52:36

我看路由器内网出去的包在POSTROUING用 MASQUERADE，进来的时候用DNAT（内网架设服务器的时候 DMZ host等）就可以了

回复 | 举报
关于我们 | 关于IT168 | 联系方式 | 广告合作 | 法律声明 | 免费注册

Copyright 2001-2010 ChinaUnix.net All Rights Reserved 北京皓辰网域网络信息技术有限公司. 版权所有

感谢所有关心和支持过ChinaUnix的朋友们

16024965号-6