1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
|
--- pmlist.c.orig 2010-11-26 17:45:26.000000000 +0300
+++ pmlist.c 2010-11-26 17:49:30.000000000 +0300
@@ -1,3 +1,5 @@
+#include <stdio.h>
+#include <string.h>
#include <stdlib.h>
#include <sys/wait.h>
#include <unistd.h>
@@ -8,10 +10,6 @@
#include "gatedevice.h"
#include "util.h"
-#if HAVE_LIBIPTC
-#include "iptc.h"
-#endif
-
struct portMap* pmlist_NewNode(int enabled, long int duration, char *remoteHost,
char *externalPort, char *internalPort,
char *protocol, char *internalClient, char *desc)
@@ -233,55 +231,18 @@
{
if (enabled)
{
-#if HAVE_LIBIPTC
- char *buffer = malloc(strlen(internalClient) + strlen(internalPort) + 2);
- if (buffer == NULL) {
- fprintf(stderr, "failed to malloc memory\n");
- return 0;
- }
-
- strcpy(buffer, internalClient);
- strcat(buffer, ":");
- strcat(buffer, internalPort);
-
- if (g_vars.forwardRules)
- iptc_add_rule("filter", g_vars.forwardChainName, protocol, NULL, NULL, NULL, internalClient, NULL, internalPort, "ACCEPT", NULL, FALSE);
-
- iptc_add_rule("nat", g_vars.preroutingChainName, protocol, g_vars.extInterfaceName, NULL, NULL, NULL, NULL, externalPort, "DNAT", buffer, TRUE);
- free(buffer);
-#else
char command[COMMAND_LEN];
- int status;
- {
- char dest[DEST_LEN];
- char *args[] = {"iptables", "-t", "nat", "-I", g_vars.preroutingChainName, "-i", g_vars.extInterfaceName, "-p", protocol, "--dport", externalPort, "-j", "DNAT", "--to", dest, NULL};
-
- snprintf(dest, DEST_LEN, "%s:%s", internalClient, internalPort);
- snprintf(command, COMMAND_LEN, "%s -t nat -I %s -i %s -p %s --dport %s -j DNAT --to %s:%s", g_vars.iptables, g_vars.preroutingChainName, g_vars.extInterfaceName, protocol, externalPort, internalClient, internalPort);
- trace(3, "%s", command);
- if (!fork()) {
- int rc = execv(g_vars.iptables, args);
- exit(rc);
- } else {
- wait(&status);
- }
- }
-
- if (g_vars.forwardRules)
- {
- char *args[] = {"iptables", "-A", g_vars.forwardChainName, "-p", protocol, "-d", internalClient, "--dport", internalPort, "-j", "ACCEPT", NULL};
-
- snprintf(command, COMMAND_LEN, "%s -A %s -p %s -d %s --dport %s -j ACCEPT", g_vars.iptables,g_vars.forwardChainName, protocol, internalClient, internalPort);
- trace(3, "%s", command);
- if (!fork()) {
- int rc = execv(g_vars.iptables, args);
- exit(rc);
- } else {
- wait(&status);
- }
- }
-#endif
+ FILE *ipnat = popen("/sbin/ipnat -f -", "w");
+ sprintf(command, "rdr %s %s/32 port %s -> %s port %s %s\n",
+ g_vars.extInterfaceName, g_vars.extIpAddress, externalPort, internalClient, internalPort, protocol);
+ trace(3, "%s", command);
+ fprintf(ipnat, command);
+ sprintf(command, "rdr lo0 %s/32 port %s -> %s port %s %s\n",
+ g_vars.extIpAddress, externalPort, internalClient, internalPort, protocol);
+ trace(3, "%s", command);
+ fprintf(ipnat, command);
+ pclose(ipnat);
}
return 1;
}
@@ -290,52 +251,18 @@
{
if (enabled)
{
-#if HAVE_LIBIPTC
- char *buffer = malloc(strlen(internalClient) + strlen(internalPort) + 2);
- strcpy(buffer, internalClient);
- strcat(buffer, ":");
- strcat(buffer, internalPort);
-
- if (g_vars.forwardRules)
- iptc_delete_rule("filter", g_vars.forwardChainName, protocol, NULL, NULL, NULL, internalClient, NULL, internalPort, "ACCEPT", NULL);
-
- iptc_delete_rule("nat", g_vars.preroutingChainName, protocol, g_vars.extInterfaceName, NULL, NULL, NULL, NULL, externalPort, "DNAT", buffer);
- free(buffer);
-#else
char command[COMMAND_LEN];
- int status;
- {
- char dest[DEST_LEN];
- char *args[] = {"iptables", "-t", "nat", "-D", g_vars.preroutingChainName, "-i", g_vars.extInterfaceName, "-p", protocol, "--dport", externalPort, "-j", "DNAT", "--to", dest, NULL};
-
- snprintf(dest, DEST_LEN, "%s:%s", internalClient, internalPort);
- snprintf(command, COMMAND_LEN, "%s -t nat -D %s -i %s -p %s --dport %s -j DNAT --to %s:%s",
- g_vars.iptables, g_vars.preroutingChainName, g_vars.extInterfaceName, protocol, externalPort, internalClient, internalPort);
- trace(3, "%s", command);
-
- if (!fork()) {
- int rc = execv(g_vars.iptables, args);
- exit(rc);
- } else {
- wait(&status);
- }
- }
-
- if (g_vars.forwardRules)
- {
- char *args[] = {"iptables", "-D", g_vars.forwardChainName, "-p", protocol, "-d", internalClient, "--dport", internalPort, "-j", "ACCEPT", NULL};
-
- snprintf(command, COMMAND_LEN, "%s -D %s -p %s -d %s --dport %s -j ACCEPT", g_vars.iptables, g_vars.forwardChainName, protocol, internalClient, internalPort);
- trace(3, "%s", command);
- if (!fork()) {
- int rc = execv(g_vars.iptables, args);
- exit(rc);
- } else {
- wait(&status);
- }
- }
-#endif
+ FILE *ipnat = popen("/sbin/ipnat -rf -", "w");
+ sprintf(command, "rdr %s %s/32 port %s -> %s port %s %s\n",
+ g_vars.extInterfaceName, g_vars.extIpAddress, externalPort, internalClient, internalPort, protocol);
+ trace(3, "%s", command);
+ fprintf(ipnat, command);
+ sprintf(command, "rdr lo0 %s/32 port %s -> %s port %s %s\n",
+ g_vars.extIpAddress, externalPort, internalClient, internalPort, protocol);
+ trace(3, "%s", command);
+ fprintf(ipnat, command);
+ pclose(ipnat);
}
return 1;
}
|
