1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
#!/usr/bin/perl
use strict;
use lib "/opt/vyatta/share/perl5/";
use Vyatta::Config;
use Vyatta::NatRule;
sub numerically { $a <=> $b; }
sub raw_cleanup {
# remove the conntrack setup.
my @lines
= `iptables -t raw -L PREROUTING -vn --line-numbers | egrep ^[0-9]`;
foreach (@lines) {
my ($num, $ignore, $ignore, $chain, $ignore, $ignore, $in, $out,
$ignore, $ignore) = split /\s+/;
if ($chain eq "NAT_CONNTRACK") {
system("iptables -t raw -D PREROUTING $num");
system("iptables -t raw -D OUTPUT $num");
system("iptables -t raw -F NAT_CONNTRACK");
system("iptables -t raw -X NAT_CONNTRACK");
last;
}
}
}
my $config = new Vyatta::Config;
$config->setLevel("service nat rule");
my %rules = $config->listNodeStatus();
my $rule;
open(OUT, ">>/dev/null") or exit 1;
my %ipt_rulenum = (
source => 2,
destination => 1,
);
my %chain_name = (
source => "POSTROUTING",
destination => "PREROUTING",
);
print OUT "========= nat list =========\n";
my @rule_keys = sort numerically keys %rules;
if ($#rule_keys < 0) {
raw_cleanup();
exit 0;
}
## it seems that "multiport" does not like port range (p1:p2) if nobody has
## touched the nat table yet after reboot!?
system("iptables -t nat -L -n >& /dev/null");
# we have some nat rule(s). make sure conntrack is enabled.
system("iptables -t raw -L NAT_CONNTRACK -n >& /dev/null");
if ($? >> 8) {
# NAT_CONNTRACK chain does not exist yet. set up conntrack.
system("iptables -t raw -N NAT_CONNTRACK");
# this enables conntrack for all packets. potentially we can add more rules
# to the NAT_CONNTRACK chain for finer-grained control over which packets
# are tracked.
system("iptables -t raw -A NAT_CONNTRACK -j ACCEPT");
system("iptables -t raw -I PREROUTING 1 -j NAT_CONNTRACK");
system("iptables -t raw -I OUTPUT 1 -j NAT_CONNTRACK");
}
my $all_deleted = 1;
for $rule (@rule_keys) {
print OUT "$rule: $rules{$rule}\n";
my $nrule = new VyattaNatRule;
$nrule->setup("service nat rule $rule");
my $otype = $nrule->orig_type();
my $ntype = $nrule->new_type();
if ((defined($otype) && $otype ne "source" && $otype ne "destination")
|| (defined($ntype) && $ntype ne "source" && $ntype ne "destination")) {
exit 2;
}
if ($rules{$rule} ne "deleted") {
$all_deleted = 0;
}
my $cmd;
if ($rules{$rule} eq "static") {
# $otype and $ntype should be the same
if (!defined($ntype)) {
exit 3;
}
$ipt_rulenum{$ntype} += 1;
next;
} elsif ($rules{$rule} eq "deleted") {
# $ntype should be empty
if (!defined($otype)) {
exit 4;
}
$cmd = "iptables -t nat -D $chain_name{$otype} $ipt_rulenum{$otype}";
print OUT "$cmd\n";
if (system($cmd)) {
exit 1;
}
next;
}
my ($str, $err) = $nrule->rule_str();
if (!defined($str)) {
# rule check failed => return error
print OUT "NAT configuration error: $err\n";
print STDERR "NAT configuration error: $err\n";
exit 5;
}
if ($rules{$rule} eq "added") {
# $otype should be empty
if (!defined($ntype)) {
exit 6;
}
$cmd = "iptables -t nat -I $chain_name{$ntype} $ipt_rulenum{$ntype} " .
"$str";
print OUT "$cmd\n";
if (system($cmd)) {
exit 1;
}
$ipt_rulenum{$ntype} += 1;
} elsif ($rules{$rule} eq "changed") {
# $otype and $ntype may not be the same
if (!defined($otype) || !defined($ntype)) {
exit 7;
}
$cmd = "iptables -t nat -I $chain_name{$ntype} $ipt_rulenum{$ntype} " .
"$str";
print OUT "$cmd\n";
if (system($cmd)) {
exit 1;
}
my $idx = $ipt_rulenum{$otype};
if ($otype eq $ntype) {
$idx += 1;
}
$cmd = "iptables -t nat -D $chain_name{$otype} $idx";
print OUT "$cmd\n";
if (system($cmd)) {
exit 1;
}
$ipt_rulenum{$ntype} += 1;
}
}
if ($all_deleted) {
raw_cleanup();
}
close OUT;
exit 0;
|
