Commit ae5b7d8b authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[NETFILTER]: Add SIP connection tracking helper 



Add SIP connection tracking helper. Originally written by
Christian Hentschel <chentschel@arnet.com.ar>, some cleanup, minor
fixes and bidirectional SIP support added by myself.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e44ab66a

include/linux/netfilter_ipv4/ip_conntrack_sip.h

0 → 100644
+44 −0
Original line number Diff line number Diff line 
#ifndef __IP_CONNTRACK_SIP_H__

#define __IP_CONNTRACK_SIP_H__

#ifdef __KERNEL__



#define SIP_PORT	5060

#define SIP_TIMEOUT	3600



#define POS_VIA		0

#define POS_CONTACT	1

#define POS_CONTENT	2

#define POS_MEDIA	3

#define POS_OWNER	4

#define POS_CONNECTION	5

#define POS_REQ_HEADER	6

#define POS_SDP_HEADER	7



struct sip_header_nfo {

	const char	*lname;

	const char	*sname;

	const char	*ln_str;

	size_t		lnlen;

	size_t		snlen;

	size_t		ln_strlen;

	int		(*match_len)(const char *, const char *, int *);

};



extern unsigned int (*ip_nat_sip_hook)(struct sk_buff **pskb,

				       enum ip_conntrack_info ctinfo,

				       struct ip_conntrack *ct,

				       const char **dptr);

extern unsigned int (*ip_nat_sdp_hook)(struct sk_buff **pskb,

				       enum ip_conntrack_info ctinfo,

				       struct ip_conntrack_expect *exp,

				       const char *dptr);



extern int ct_sip_get_info(const char *dptr, size_t dlen,

			   unsigned int *matchoff,

			   unsigned int *matchlen,

			   struct sip_header_nfo *hnfo);

extern int ct_sip_lnlen(const char *line, const char *limit);

extern const char *ct_sip_search(const char *needle, const char *haystack,

                                 size_t needle_len, size_t haystack_len);

#endif /* __KERNEL__ */

#endif /* __IP_CONNTRACK_SIP_H__ */

net/ipv4/netfilter/Kconfig

+18 −0
Original line number Diff line number Diff line
@@ -191,6 +191,18 @@ config IP_NF_H323 
	  If you want to compile it as a module, say 'M' here and read

	  Documentation/modules.txt.  If unsure, say 'N'.



config IP_NF_SIP

	tristate "SIP protocol support (EXPERIMENTAL)"

	depends on IP_NF_CONNTRACK && EXPERIMENTAL

	help

	  SIP is an application-layer control protocol that can establish,

	  modify, and terminate multimedia sessions (conferences) such as

	  Internet telephony calls. With the ip_conntrack_sip and

	  the ip_nat_sip modules you can support the protocol on a connection

	  tracking/NATing firewall.



	  To compile it as a module, choose M here.  If unsure, say Y.



config IP_NF_QUEUE

	tristate "IP Userspace queueing via NETLINK (OBSOLETE)"

	help
@@ -503,6 +515,12 @@ config IP_NF_NAT_H323 
	default IP_NF_NAT if IP_NF_H323=y

	default m if IP_NF_H323=m



config IP_NF_NAT_SIP

	tristate

	depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n

	default IP_NF_NAT if IP_NF_SIP=y

	default m if IP_NF_SIP=m



# mangle + specific targets

config IP_NF_MANGLE

	tristate "Packet mangling"

net/ipv4/netfilter/Makefile

+2 −0
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ obj-$(CONFIG_IP_NF_AMANDA) += ip_conntrack_amanda.o 
obj-$(CONFIG_IP_NF_TFTP) += ip_conntrack_tftp.o

obj-$(CONFIG_IP_NF_FTP) += ip_conntrack_ftp.o

obj-$(CONFIG_IP_NF_IRC) += ip_conntrack_irc.o

obj-$(CONFIG_IP_NF_SIP) += ip_conntrack_sip.o

obj-$(CONFIG_IP_NF_NETBIOS_NS) += ip_conntrack_netbios_ns.o



# NAT helpers
@@ -40,6 +41,7 @@ obj-$(CONFIG_IP_NF_NAT_AMANDA) += ip_nat_amanda.o 
obj-$(CONFIG_IP_NF_NAT_TFTP) += ip_nat_tftp.o

obj-$(CONFIG_IP_NF_NAT_FTP) += ip_nat_ftp.o

obj-$(CONFIG_IP_NF_NAT_IRC) += ip_nat_irc.o

obj-$(CONFIG_IP_NF_NAT_SIP) += ip_nat_sip.o



# generic IP tables 

obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o

net/ipv4/netfilter/ip_conntrack_sip.c

0 → 100644
+471 −0
Original line number Diff line number Diff line 
/* SIP extension for IP connection tracking.

 *

 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>

 * based on RR's ip_conntrack_ftp.c and other modules.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as

 * published by the Free Software Foundation.

 */



#include <linux/config.h>

#include <linux/module.h>

#include <linux/ctype.h>

#include <linux/skbuff.h>

#include <linux/in.h>

#include <linux/ip.h>

#include <linux/udp.h>



#include <linux/netfilter.h>

#include <linux/netfilter_ipv4.h>

#include <linux/netfilter_ipv4/ip_conntrack_helper.h>

#include <linux/netfilter_ipv4/ip_conntrack_sip.h>



#if 0

#define DEBUGP printk

#else

#define DEBUGP(format, args...)

#endif



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");

MODULE_DESCRIPTION("SIP connection tracking helper");



#define MAX_PORTS	8

static unsigned short ports[MAX_PORTS];

static int ports_c;

module_param_array(ports, ushort, &ports_c, 0400);

MODULE_PARM_DESC(ports, "port numbers of sip servers");



static unsigned int sip_timeout = SIP_TIMEOUT;

module_param(sip_timeout, uint, 0600);

MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");



unsigned int (*ip_nat_sip_hook)(struct sk_buff **pskb,

				enum ip_conntrack_info ctinfo,

				struct ip_conntrack *ct,

				const char **dptr);

EXPORT_SYMBOL_GPL(ip_nat_sip_hook);



unsigned int (*ip_nat_sdp_hook)(struct sk_buff **pskb,

				enum ip_conntrack_info ctinfo,

				struct ip_conntrack_expect *exp,

				const char *dptr);

EXPORT_SYMBOL_GPL(ip_nat_sdp_hook);



int ct_sip_get_info(const char *dptr, size_t dlen,

				unsigned int *matchoff,

				unsigned int *matchlen,

				struct sip_header_nfo *hnfo);

EXPORT_SYMBOL_GPL(ct_sip_get_info);





static int digits_len(const char *dptr, const char *limit, int *shift);

static int epaddr_len(const char *dptr, const char *limit, int *shift);

static int skp_digits_len(const char *dptr, const char *limit, int *shift);

static int skp_epaddr_len(const char *dptr, const char *limit, int *shift);



struct sip_header_nfo ct_sip_hdrs[] = {

	{ 	/* Via header */

		.lname		= "Via:",

		.lnlen		= sizeof("Via:") - 1,

		.sname		= "\r\nv:",

		.snlen		= sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */

		.ln_str		= "UDP ",

		.ln_strlen	= sizeof("UDP ") - 1,

		.match_len	= epaddr_len,

	},

	{ 	/* Contact header */

		.lname		= "Contact:",

		.lnlen		= sizeof("Contact:") - 1,

		.sname		= "\r\nm:",

		.snlen		= sizeof("\r\nm:") - 1,

		.ln_str		= "sip:",

		.ln_strlen	= sizeof("sip:") - 1,

		.match_len	= skp_epaddr_len

	},

	{ 	/* Content length header */

		.lname		= "Content-Length:",

		.lnlen		= sizeof("Content-Length:") - 1,

		.sname		= "\r\nl:",

		.snlen		= sizeof("\r\nl:") - 1,

		.ln_str		= ":",

		.ln_strlen	= sizeof(":") - 1,

		.match_len	= skp_digits_len

	},

	{	/* SDP media info */

		.lname		= "\nm=",

		.lnlen		= sizeof("\nm=") - 1,

		.sname		= "\rm=",

		.snlen		= sizeof("\rm=") - 1,

		.ln_str		= "audio ",

		.ln_strlen	= sizeof("audio ") - 1,

		.match_len	= digits_len

	},

	{ 	/* SDP owner address*/

		.lname		= "\no=",

		.lnlen		= sizeof("\no=") - 1,

		.sname		= "\ro=",

		.snlen		= sizeof("\ro=") - 1,

		.ln_str		= "IN IP4 ",

		.ln_strlen	= sizeof("IN IP4 ") - 1,

		.match_len	= epaddr_len

	},

	{ 	/* SDP connection info */

		.lname		= "\nc=",

		.lnlen		= sizeof("\nc=") - 1,

		.sname		= "\rc=",

		.snlen		= sizeof("\rc=") - 1,

		.ln_str		= "IN IP4 ",

		.ln_strlen	= sizeof("IN IP4 ") - 1,

		.match_len	= epaddr_len

	},

	{ 	/* Requests headers */

		.lname		= "sip:",

		.lnlen		= sizeof("sip:") - 1,

		.sname		= "sip:",

		.snlen		= sizeof("sip:") - 1, /* yes, i know.. ;) */

		.ln_str		= "@",

		.ln_strlen	= sizeof("@") - 1,

		.match_len	= epaddr_len

	},

	{ 	/* SDP version header */

		.lname		= "\nv=",

		.lnlen		= sizeof("\nv=") - 1,

		.sname		= "\rv=",

		.snlen		= sizeof("\rv=") - 1,

		.ln_str		= "=",

		.ln_strlen	= sizeof("=") - 1,

		.match_len	= digits_len

	}

};

EXPORT_SYMBOL_GPL(ct_sip_hdrs);



/* get line lenght until first CR or LF seen. */

int ct_sip_lnlen(const char *line, const char *limit)

{

	const char *k = line;



	while ((line <= limit) && (*line == '\r' || *line == '\n'))

		line++;



	while (line <= limit) {

		if (*line == '\r' || *line == '\n')

			break;

		line++;

	}

	return line - k;

}

EXPORT_SYMBOL_GPL(ct_sip_lnlen);



/* Linear string search, case sensitive. */

const char *ct_sip_search(const char *needle, const char *haystack,

                          size_t needle_len, size_t haystack_len)

{

	const char *limit = haystack + (haystack_len - needle_len);



	while (haystack <= limit) {

		if (memcmp(haystack, needle, needle_len) == 0)

			return haystack;

		haystack++;

	}

	return NULL;

}

EXPORT_SYMBOL_GPL(ct_sip_search);



static int digits_len(const char *dptr, const char *limit, int *shift)

{

	int len = 0;

	while (dptr <= limit && isdigit(*dptr)) {

		dptr++;

		len++;

	}

	return len;

}



/* get digits lenght, skiping blank spaces. */

static int skp_digits_len(const char *dptr, const char *limit, int *shift)

{

	for (; dptr <= limit && *dptr == ' '; dptr++)

		(*shift)++;



	return digits_len(dptr, limit, shift);

}



/* Simple ipaddr parser.. */

static int parse_ipaddr(const char *cp,	const char **endp,

			u_int32_t *ipaddr, const char *limit)

{

	unsigned long int val;

	int i, digit = 0;



	for (i = 0, *ipaddr = 0; cp <= limit && i < 4; i++) {

		digit = 0;

		if (!isdigit(*cp))

			break;



		val = simple_strtoul(cp, (char **)&cp, 10);

		if (val > 0xFF)

			return -1;



		((u_int8_t *)ipaddr)[i] = val;

		digit = 1;



		if (*cp != '.')

			break;

		cp++;

	}

	if (!digit)

		return -1;



	if (endp)

		*endp = cp;



	return 0;

}



/* skip ip address. returns it lenght. */

static int epaddr_len(const char *dptr, const char *limit, int *shift)

{

	const char *aux = dptr;

	u_int32_t ip;



	if (parse_ipaddr(dptr, &dptr, &ip, limit) < 0) {

		DEBUGP("ip: %s parse failed.!\n", dptr);

		return 0;

	}



	/* Port number */

	if (*dptr == ':') {

		dptr++;

		dptr += digits_len(dptr, limit, shift);

	}

	return dptr - aux;

}



/* get address length, skiping user info. */

static int skp_epaddr_len(const char *dptr, const char *limit, int *shift)

{

	int s = *shift;



	for (; dptr <= limit && *dptr != '@'; dptr++)

		(*shift)++;



	if (*dptr == '@') {

		dptr++;

		(*shift)++;

	} else

		*shift = s;



	return epaddr_len(dptr, limit, shift);

}



/* Returns 0 if not found, -1 error parsing. */

int ct_sip_get_info(const char *dptr, size_t dlen,

		    unsigned int *matchoff,

		    unsigned int *matchlen,

		    struct sip_header_nfo *hnfo)

{

	const char *limit, *aux, *k = dptr;

	int shift = 0;



	limit = dptr + (dlen - hnfo->lnlen);



	while (dptr <= limit) {

		if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&

		    (strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {

			dptr++;

			continue;

		}

		aux = ct_sip_search(hnfo->ln_str, dptr, hnfo->ln_strlen,

		                    ct_sip_lnlen(dptr, limit));

		if (!aux) {

			DEBUGP("'%s' not found in '%s'.\n", hnfo->ln_str,

			       hnfo->lname);

			return -1;

		}

		aux += hnfo->ln_strlen;



		*matchlen = hnfo->match_len(aux, limit, &shift);

		if (!*matchlen)

			return -1;



		*matchoff = (aux - k) + shift;



		DEBUGP("%s match succeeded! - len: %u\n", hnfo->lname,

		       *matchlen);

		return 1;

	}

	DEBUGP("%s header not found.\n", hnfo->lname);

	return 0;

}



static int set_expected_rtp(struct sk_buff **pskb,

			    struct ip_conntrack *ct,

			    enum ip_conntrack_info ctinfo,

			    u_int32_t ipaddr, u_int16_t port,

			    const char *dptr)

{

	struct ip_conntrack_expect *exp;

	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

	int ret;



	exp = ip_conntrack_expect_alloc(ct);

	if (exp == NULL)

		return NF_DROP;



	exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;

	exp->tuple.src.u.udp.port = 0;

	exp->tuple.dst.ip = ipaddr;

	exp->tuple.dst.u.udp.port = htons(port);

	exp->tuple.dst.protonum = IPPROTO_UDP;



	exp->mask.src.ip = 0xFFFFFFFF;

	exp->mask.src.u.udp.port = 0;

	exp->mask.dst.ip = 0xFFFFFFFF;

	exp->mask.dst.u.udp.port = 0xFFFF;

	exp->mask.dst.protonum = 0xFF;



	exp->expectfn = NULL;

	exp->flags = 0;



	if (ip_nat_sdp_hook)

		ret = ip_nat_sdp_hook(pskb, ctinfo, exp, dptr);

	else {

		if (ip_conntrack_expect_related(exp) != 0)

			ret = NF_DROP;

		else

			ret = NF_ACCEPT;

	}

	ip_conntrack_expect_put(exp);



	return ret;

}



static int sip_help(struct sk_buff **pskb,

		    struct ip_conntrack *ct,

		    enum ip_conntrack_info ctinfo)

{

	unsigned int dataoff, datalen;

	const char *dptr;

	int ret = NF_ACCEPT;

	int matchoff, matchlen;

	u_int32_t ipaddr;

	u_int16_t port;



	/* No Data ? */

	dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);

	if (dataoff >= (*pskb)->len) {

		DEBUGP("skb->len = %u\n", (*pskb)->len);

		return NF_ACCEPT;

        }



	ip_ct_refresh(ct, *pskb, sip_timeout * HZ);



	if (!skb_is_nonlinear(*pskb))

		dptr = (*pskb)->data + dataoff;

	else {

		DEBUGP("Copy of skbuff not supported yet.\n");

		goto out;

	}



	if (ip_nat_sip_hook) {

		if (!ip_nat_sip_hook(pskb, ctinfo, ct, &dptr)) {

			ret = NF_DROP;

			goto out;

		}

	}



	/* After this point NAT, could have mangled skb, so

	   we need to recalculate payload lenght. */

	datalen = (*pskb)->len - dataoff;



	if (datalen < (sizeof("SIP/2.0 200") - 1))

		goto out;



	/* RTP info only in some SDP pkts */

	if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 &&

	    memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {

		goto out;

	}

	/* Get ip and port address from SDP packet. */

	if (ct_sip_get_info(dptr, datalen, &matchoff, &matchlen,

	                    &ct_sip_hdrs[POS_CONNECTION]) > 0) {



		/* We'll drop only if there are parse problems. */

		if (parse_ipaddr(dptr + matchoff, NULL, &ipaddr,

		                 dptr + datalen) < 0) {

			ret = NF_DROP;

			goto out;

		}

		if (ct_sip_get_info(dptr, datalen, &matchoff, &matchlen,

		                    &ct_sip_hdrs[POS_MEDIA]) > 0) {



			port = simple_strtoul(dptr + matchoff, NULL, 10);

			if (port < 1024) {

				ret = NF_DROP;

				goto out;

			}

			ret = set_expected_rtp(pskb, ct, ctinfo,

					       ipaddr, port, dptr);

		}

	}

out:

	return ret;

}



static struct ip_conntrack_helper sip[MAX_PORTS];

static char sip_names[MAX_PORTS][10];



static void fini(void)

{

	int i;

	for (i = 0; i < ports_c; i++) {

		DEBUGP("unregistering helper for port %d\n", ports[i]);

		ip_conntrack_helper_unregister(&sip[i]);

	}

}



static int __init init(void)

{

	int i, ret;

	char *tmpname;



	if (ports_c == 0)

		ports[ports_c++] = SIP_PORT;



	for (i = 0; i < ports_c; i++) {

		/* Create helper structure */

		memset(&sip[i], 0, sizeof(struct ip_conntrack_helper));



		sip[i].tuple.dst.protonum = IPPROTO_UDP;

		sip[i].tuple.src.u.udp.port = htons(ports[i]);

		sip[i].mask.src.u.udp.port = 0xFFFF;

		sip[i].mask.dst.protonum = 0xFF;

		sip[i].max_expected = 1;

		sip[i].timeout = 3 * 60; /* 3 minutes */

		sip[i].me = THIS_MODULE;

		sip[i].help = sip_help;



		tmpname = &sip_names[i][0];

		if (ports[i] == SIP_PORT)

			sprintf(tmpname, "sip");

		else

			sprintf(tmpname, "sip-%d", i);

		sip[i].name = tmpname;



		DEBUGP("port #%d: %d\n", i, ports[i]);



		ret = ip_conntrack_helper_register(&sip[i]);

		if (ret) {

			printk("ERROR registering helper for port %d\n",

				ports[i]);

			fini();

			return ret;

		}

	}

	return 0;

}



module_init(init);

module_exit(fini);

net/ipv4/netfilter/ip_nat_sip.c

0 → 100644
+249 −0
Original line number Diff line number Diff line 
/* SIP extension for UDP NAT alteration.

 *

 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>

 * based on RR's ip_nat_ftp.c and other modules.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as

 * published by the Free Software Foundation.

 */



#include <linux/module.h>

#include <linux/skbuff.h>

#include <linux/ip.h>

#include <linux/udp.h>



#include <linux/netfilter_ipv4.h>

#include <linux/netfilter_ipv4/ip_nat.h>

#include <linux/netfilter_ipv4/ip_nat_helper.h>

#include <linux/netfilter_ipv4/ip_conntrack_helper.h>

#include <linux/netfilter_ipv4/ip_conntrack_sip.h>



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");

MODULE_DESCRIPTION("SIP NAT helper");



#if 0

#define DEBUGP printk

#else

#define DEBUGP(format, args...)

#endif



extern struct sip_header_nfo ct_sip_hdrs[];



static unsigned int mangle_sip_packet(struct sk_buff **pskb,

				      enum ip_conntrack_info ctinfo,

				      struct ip_conntrack *ct,

				      const char **dptr, size_t dlen,

				      char *buffer, int bufflen,

				      struct sip_header_nfo *hnfo)

{

	unsigned int matchlen, matchoff;



	if (ct_sip_get_info(*dptr, dlen, &matchoff, &matchlen, hnfo) <= 0)

		return 0;



	if (!ip_nat_mangle_udp_packet(pskb, ct, ctinfo,

	                              matchoff, matchlen, buffer, bufflen))

		return 0;



	/* We need to reload this. Thanks Patrick. */

	*dptr = (*pskb)->data + (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);

	return 1;

}



static unsigned int ip_nat_sip(struct sk_buff **pskb,

			       enum ip_conntrack_info ctinfo,

			       struct ip_conntrack *ct,

			       const char **dptr)

{

	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

	char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];

	unsigned int bufflen, dataoff;

	u_int32_t ip;

	u_int16_t port;



	dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);



	ip   = ct->tuplehash[!dir].tuple.dst.ip;

	port = ct->tuplehash[!dir].tuple.dst.u.udp.port;

	bufflen = sprintf(buffer, "%u.%u.%u.%u:%u", NIPQUAD(ip), ntohs(port));



	/* short packet ? */

	if (((*pskb)->len - dataoff) < (sizeof("SIP/2.0") - 1))

		return 0;



	/* Basic rules: requests and responses. */

	if (memcmp(*dptr, "SIP/2.0", sizeof("SIP/2.0") - 1) == 0) {

		const char *aux;



		if ((ctinfo) < IP_CT_IS_REPLY) {

			mangle_sip_packet(pskb, ctinfo, ct, dptr,

			                  (*pskb)->len - dataoff,

			                  buffer, bufflen,

			                  &ct_sip_hdrs[POS_CONTACT]);

			return 1;

		}



		if (!mangle_sip_packet(pskb, ctinfo, ct, dptr,

				       (*pskb)->len - dataoff,

		                       buffer, bufflen, &ct_sip_hdrs[POS_VIA]))

			return 0;



		/* This search should ignore case, but later.. */

		aux = ct_sip_search("CSeq:", *dptr, sizeof("CSeq:") - 1,

		                    (*pskb)->len - dataoff);

		if (!aux)

			return 0;



		if (!ct_sip_search("REGISTER", aux, sizeof("REGISTER"),

		    ct_sip_lnlen(aux, *dptr + (*pskb)->len - dataoff)))

			return 1;



		return mangle_sip_packet(pskb, ctinfo, ct, dptr,

					 (*pskb)->len - dataoff,

		                         buffer, bufflen,

					 &ct_sip_hdrs[POS_CONTACT]);

	}

	if ((ctinfo) < IP_CT_IS_REPLY) {

		if (!mangle_sip_packet(pskb, ctinfo, ct, dptr,

				       (*pskb)->len - dataoff,

		                       buffer, bufflen, &ct_sip_hdrs[POS_VIA]))

			return 0;



		/* Mangle Contact if exists only. - watch udp_nat_mangle()! */

		mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,

		                  buffer, bufflen, &ct_sip_hdrs[POS_CONTACT]);

		return 1;

	}

	/* This mangle requests headers. */

	return mangle_sip_packet(pskb, ctinfo, ct, dptr,

	                         ct_sip_lnlen(*dptr,

				              *dptr + (*pskb)->len - dataoff),

	                         buffer, bufflen, &ct_sip_hdrs[POS_REQ_HEADER]);

}



static int mangle_content_len(struct sk_buff **pskb,

			      enum ip_conntrack_info ctinfo,

			      struct ip_conntrack *ct,

			      const char *dptr)

{

	unsigned int dataoff, matchoff, matchlen;

	char buffer[sizeof("65536")];

	int bufflen;



	dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);



	/* Get actual SDP lenght */

	if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff,

	                    &matchlen, &ct_sip_hdrs[POS_SDP_HEADER]) > 0) {



		/* since ct_sip_get_info() give us a pointer passing 'v='

		   we need to add 2 bytes in this count. */

		int c_len = (*pskb)->len - dataoff - matchoff + 2;



		/* Now, update SDP lenght */

		if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff,

		                    &matchlen, &ct_sip_hdrs[POS_CONTENT]) > 0) {



			bufflen = sprintf(buffer, "%u", c_len);



			return ip_nat_mangle_udp_packet(pskb, ct, ctinfo,

							matchoff, matchlen,

							buffer, bufflen);

		}

	}

	return 0;

}



static unsigned int mangle_sdp(struct sk_buff **pskb,

			       enum ip_conntrack_info ctinfo,

			       struct ip_conntrack *ct,

			       u_int32_t newip, u_int16_t port,

			       const char *dptr)

{

	char buffer[sizeof("nnn.nnn.nnn.nnn")];

	unsigned int dataoff, bufflen;



	dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);



	/* Mangle owner and contact info. */

	bufflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(newip));

	if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,

	                       buffer, bufflen, &ct_sip_hdrs[POS_OWNER]))

		return 0;



	if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,

	                       buffer, bufflen, &ct_sip_hdrs[POS_CONNECTION]))

		return 0;



	/* Mangle media port. */

	bufflen = sprintf(buffer, "%u", port);

	if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,

	                       buffer, bufflen, &ct_sip_hdrs[POS_MEDIA]))

		return 0;



	return mangle_content_len(pskb, ctinfo, ct, dptr);

}



/* So, this packet has hit the connection tracking matching code.

   Mangle it, and change the expectation to match the new version. */

static unsigned int ip_nat_sdp(struct sk_buff **pskb,

			       enum ip_conntrack_info ctinfo,

			       struct ip_conntrack_expect *exp,

			       const char *dptr)

{

	struct ip_conntrack *ct = exp->master;

	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

	u_int32_t newip;

	u_int16_t port;



	DEBUGP("ip_nat_sdp():\n");



	/* Connection will come from reply */

	newip = ct->tuplehash[!dir].tuple.dst.ip;



	exp->tuple.dst.ip = newip;

	exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;

	exp->dir = !dir;



	/* When you see the packet, we need to NAT it the same as the

	   this one. */

	exp->expectfn = ip_nat_follow_master;



	/* Try to get same port: if not, try to change it. */

	for (port = ntohs(exp->saved_proto.udp.port); port != 0; port++) {

		exp->tuple.dst.u.udp.port = htons(port);

		if (ip_conntrack_expect_related(exp) == 0)

			break;

	}



	if (port == 0)

		return NF_DROP;



	if (!mangle_sdp(pskb, ctinfo, ct, newip, port, dptr)) {

		ip_conntrack_unexpect_related(exp);

		return NF_DROP;

	}

	return NF_ACCEPT;

}



static void __exit fini(void)

{

	ip_nat_sip_hook = NULL;

	ip_nat_sdp_hook = NULL;

	/* Make sure noone calls it, meanwhile. */

	synchronize_net();

}



static int __init init(void)

{

	BUG_ON(ip_nat_sip_hook);

	BUG_ON(ip_nat_sdp_hook);

	ip_nat_sip_hook = ip_nat_sip;

	ip_nat_sdp_hook = ip_nat_sdp;

	return 0;

}



module_init(init);

module_exit(fini);

CRA Git | Maintained and supported by SUSTech CRA and CCSE