add --snat-arp
diff --git a/extensions/ebt_nat.c b/extensions/ebt_nat.c
index 5906ac4..a2941fc 100644
--- a/extensions/ebt_nat.c
+++ b/extensions/ebt_nat.c
@@ -20,11 +20,13 @@
#define NAT_D '1'
#define NAT_S_TARGET '2'
#define NAT_D_TARGET '2'
+#define NAT_S_ARP '3'
static struct option opts_s[] =
{
{ "to-source" , required_argument, 0, NAT_S },
{ "to-src" , required_argument, 0, NAT_S },
{ "snat-target" , required_argument, 0, NAT_S_TARGET },
+ { "snat-arp" , no_argument, 0, NAT_S_ARP },
{ 0 }
};
@@ -41,7 +43,8 @@
printf(
"snat options:\n"
" --to-src address : MAC address to map source to\n"
- " --snat-target target : ACCEPT, DROP, RETURN or CONTINUE\n");
+ " --snat-target target : ACCEPT, DROP, RETURN or CONTINUE\n"
+ " --snat-arp : also change src address in arp msg\n");
}
static void print_help_d()
@@ -72,6 +75,7 @@
#define OPT_SNAT 0x01
#define OPT_SNAT_TARGET 0x02
+#define OPT_SNAT_ARP 0x04
static int parse_s(int c, char **argv, int argc,
const struct ebt_u_entry *entry, unsigned int *flags,
struct ebt_entry_target **target)
@@ -88,9 +92,16 @@
memcpy(natinfo->mac, addr, ETH_ALEN);
break;
case NAT_S_TARGET:
+ { int tmp;
ebt_check_option2(flags, OPT_SNAT_TARGET);
- if (FILL_TARGET(optarg, natinfo->target))
+ if (FILL_TARGET(optarg, tmp))
ebt_print_error2("Illegal --snat-target target");
+ natinfo->target = (natinfo->target & ~EBT_VERDICT_BITS) | (tmp & EBT_VERDICT_BITS);
+ }
+ break;
+ case NAT_S_ARP:
+ ebt_check_option2(flags, OPT_SNAT_ARP);
+ natinfo->target ^= NAT_ARP_BIT;
break;
default:
return 0;
@@ -132,7 +143,7 @@
{
struct ebt_nat_info *natinfo = (struct ebt_nat_info *)target->data;
- if (BASE_CHAIN && natinfo->target == EBT_RETURN) {
+ if (BASE_CHAIN && (natinfo->target | ~EBT_VERDICT_BITS) == EBT_RETURN) {
ebt_print_error("--snat-target RETURN not allowed on base chain");
return;
}
@@ -158,7 +169,7 @@
|| strcmp(name, "nat")) &&
((hookmask & ~(1 << NF_BR_BROUTING)) || strcmp(name, "broute"))) {
ebt_print_error("Wrong chain for dnat");
- } if (time == 0 && to_dest_supplied == 0)
+ } else if (time == 0 && to_dest_supplied == 0)
ebt_print_error("No dnat address supplied");
}
@@ -169,7 +180,9 @@
printf("--to-src ");
ebt_print_mac(natinfo->mac);
- printf(" --snat-target %s", TARGET_NAME(natinfo->target));
+ if (!(natinfo->target&NAT_ARP_BIT))
+ printf(" --snat-arp");
+ printf(" --snat-target %s", TARGET_NAME((natinfo->target|~EBT_VERDICT_BITS)));
}
static void print_d(const struct ebt_u_entry *entry,